TAP No. 71 - Simon Jester Issue

Simon Jester Issue I have a little for all you computer phreaks out-there. If you have access to a hardwire term- inal hooked up to 8 mini or maxi system, not a micro, and want to collect a few passwords and @ccount numbers belonging to other people, read on. There is a very simple method of getting accounts and pa called simulation. What you do ig imitate the operating system, so that when an unsuspecting hacker comes up and its down, the terminal types “ENTER USERID" or whateve he types it in, it then types “ENTER PASSWORI he sype it in, the program records them in a fil You have to make your program simul: operating system very closely. so that no one can tell that they are in your program, not the OS, You must make your program give all the appropriate error Messages if the guy makes a typo, or if he tries to enter an OS command, or if he presses the break key (if your system uses break), or slips in some controi characters. There are other ways someone might accidently find out that he's not really in the 0S, so try to anticipate all of them. Moat likely he will think the computer is just spassing out, and forget about it. But you might get a system programmer who will know what you are doing immediately. Also, when you collect some guys (how come there are very few girl hackers?) password, you don*t want him to know that you just got it, or he'll just go and have it changed. So, there is a trick called slipping back into the 0S. If you are on a paper printer (TTY or whatever) you may have to slip out of the 0S too, What it is,is this. You're program is supposed to immitate the 0S so that no one call tell they're not in the 05. Now when you start you're program, it has to look as if you never left the OS. This sounds hard to do, but again there is a trick. You start you pro- gram, and then have it print out whatever junk your system prints when a program ends. Now it locks like your program has just finished, but it didn't really. Algo, it is wise to have your pro- gram print something out before it pretends it finishes, go at it looks like your program does something t. Now you have your, program running, but it looks like the 0S. So the nect step is to pretend to log out. You type in "BYE" or whatever for your system, and have the program return whatever Dulishit it prints when you log out. Then you leave. Don't stick around after this, you'll just look suspicious. Now some hacker comes up and types whatever our system needs to give “ENTER USERCODE”. What if he doesn't type it right? Don't let your Program ook for the usereode until he types it in correctly, after all, the OS wouldn't.) You collect his account number and password, and enter then into a data file, which You, will come back and print up later. That's the simple part. Now comes the hard part. The guy just logged onto his account, or he thinks he did. You can't imitate the entire system, in fact you don't want him to think he's even on his account, because imitating his account is a hell of a lot of work (I tried once). So, bump him off with an error, about how his password is wrong or whatever. Now he knows his password is it, he used it yesterday or whenever, but he'll think he made @ typo. Once. Maybe twice. After that, he'll go get help, and the system operator will discover what you did pretty quickly, so you can't give him reagon to go for help. After you get his password and give some error, you have to let your program slip back into the real 0S without letting him know, so that he can type it in again really get into his account. This is the hardest part to get away with. There is usually some way for 4 pi to og out on its own in every system, look it up in ‘the manuals and have your program log out. The problem here is that the log out will look like a log out, and there is no legit reason why the system would print a log out message at this point. You can either try to cover up the log out Message, or print some bullshit to explain it, or there even be a way to suppress it. Every sys- tea is different, I can't give any specifics on Be TAP ~~ i New York 10036 Room 603 147 W. 42 St. 1982 No.71 Then you come back later and print up his account and password! This method will work, I have used a simulator on several systems, and I have always gotten good results. There are many other methods for breaking into computers, but most are specific for some particular system. If you have any other ideas, send them int Also, if anyone needs specific data on any aspect of a Hewlett-Packard 2000 system, especially the 2000/ACCESS model, send & SASE to TAP to be fowarded to me, and I'can probably tell you whatever you want. I worked for several years as a systems programmer/system operator on one, and I know alm- ost everything about it. For all of you TAPpers into Sci-Fi.and computer hacking, there is a fantastic book called “The Adol- escence of P-1", by Thomas J Ryan. P-1 is a heuris- tic computer program, with a tendency to take over the operating systems (0S) of large computers, especially ones belonging to the Pentagon. (Ught Puck the registration!). One more note. If you would be interested in getting a lineman’s handset, just find some nice cool phone man, go up, talk to him, ask him about a ringback or two to break the ice, and then ask him if he could kind of lose hig handset for a small price. I picked one up from @ really cool lineman for five bucks, and I got @ Bell hardhat for $2.50. Also, they ar glad to talk to you about all kinds of ANI test numbers, and such. Just make sure you get a lineman, not a supervisor. Long live Robert Heinleint '® from California is trovght to you ty Simon Jester TAP RAP by TOM EDISON Some good news and some bad news. First the good news. Starting with this issue, TAP will be published every month. Now the bad news. Due to inflation,. printing costs, and the resent outrageous Postal Monopoly rate hikes, TAP must increase all subscription rates. A ten issue one ulk subscription will now cost $7. A ten 8 subscription will now cribers who like their issues delivered in a plain unmarked envelope but don't want to pay the new increased Pirst Class rate, I have created a new subscription type which will be bulk mailed in a plain unmarked envelope. This new Bulk Envelope subscription will cost $8. All TAP back issues will be 75 cents each except issue #50 which will be $1.50. All of these new tates go into effect on February 1,1982. You First Class subscribers may net like the following news but due to the expense of mailing every month, all previous First Class subscribers will now get their issues mailed Bulk Envelope. If you still want to receive your is mailed First ot you will have to send in an additional $2. It costs FAP $2.40 to mail out 12 issues and this does not include the cost of the envelopes. I have heard about a dook called the “Radio Engineers Handbook", which contains specs on all sorts of electronic stuff, including phone systems. ‘They have info on frequencys, standard impedances, and such, I don't know who publishes it. Also, the IEEE (Institute of Electrical and Electronic Engineers) and the EIA (Electronic Industries Assoc) publish handbooks of @ectrical standards, which include the same type of stuff, info on normal electronic cireiute plus sections on phone line standards. They may ve of interest to TAPpers, and are protably available at the library of any large university. I have heard that silver boxes are being used in LA, on an experimental basis only. I believe that they only let you tap into numbers in that exchange. One possibility that I thought of is tapping into data lines. You can record standard 300 baud digital data on a normal cassette tape, and later play it beek into your microcomputer. You would probably be able to identify the machine they are using, and you would have a good chance of picking up some account numbers and passwords. Then just dial up the number you are tapping, log in, and the machine is open to you. There are special computer data lines known ae hard wire lines, like direct TWX lines I think. Does anyone know if you could use a silver box to tap into a hard wire line? Hard wire lines aren't given regular phone numbers, they have special numbers like 1KAA1243. How do you convert that number into a standard number, or can you? Do they run through the same exchanges as normal lines? If not, can you dial into hard wire exchanges? If you could get in, there are many possibilities. Banks, among other people, run data over hard wire lines which they presume to be secure. If you know anything about data lines, please get off your ass and write to me, Simon Jester, c/o TAP. Any of you who have apple micros might be Anterested in getting the apple-cat modem. It is like a normal modem, but has a few very nice features. It can diel numbers and has auto-answer, like most, but besides dialing in pulses it can use touch tone, and it can recieve touch tone data. This would allow you to use your computer from any phone without a terminal, vy simply using touch tones instead of a normal carrier. Also, it would make it very easy to break into Sprint and the like. The only problem is that the apple-cat costs over $300, Oh well. Any of you hackers might be interested in ‘two good bulletin board systems (BBS), One is BBBS #1 in Santa Clara, CA., at 408-296-5799. It is up 24 hours a day, and uses 110, 150, 300, and 1200 baud. (I have never figured out where 8BBS #2 is) It is hard to get a line because there are so many people trying to use it; so just have patience and call back again, And again. And-again. I promise it is not down, just very very busy. Another BBS it CBBS/NW also up 24 hours, in Portland, OR., at 503-646-5510. @hese both have phone phreak type of stuff on them, I've seen lists of Sprint codes on 8HBS. Don*t put on anything too blatantly illegal, because the PBI has been known to log in occasionally and check these systemn. I have heard a rumor from Crange county, CA that sounds very interesting. It seems that they are testing some new system, where when you get a call and pick up your handset, just after the ringing stops and tefore the tattery connects, the number calling is sent to in in binary pulses. I don't know if this is true as I don't live near Orange county nor do I know anyone there. But if you live there, check this out. The pulses are supposed to come down in “sideways binary”, using a 5 bit word length. the digits represent 0,1,2.3.7 instead of the usual 0,1.2,3,4. This is so that there are never more than 2 bits set in any one word since you only go up to 9. not 16. There should be 7 words, and I have no idea what they use as start and stop bits, or if they do. The pulses could be from § to $0 ms long. If anyone in Orange county can detect these pules, let us know! Ag I'm sure you all know, Bell is slowly but surely going to out of band signalling. This means that I will have to throw away my blue tox in a few years, and if I had a black box I'd have to dump that too. In fact the only box that may be of any use will be the red box. Fortunately, Sprint and the other alternate calling networks are filling in ap caused by out of band signalling. There are four alternate calling compamies, Southern Pacific Communications (sprint), ITT (citicall), MCI, and Western Union. They all offer two plans, one for business in which the code works all the time but costs 8 lot, one for home in which the code only works at night and on weekends. Sometimes home codes work during business hours but you get charged prime time rate. They all have lousy quality lines. By far Ha Bells lines are much better quality, with almost no hiss or clipping compared to alternate companies. In fact some of the alternate companies lines are so tad, that after stealing a code, I was unable to run computer data over it because my modem wouldn't hold a carrier on it. Sprint has the best quality lines, but even those are inferior to Bell long-lines. Also, you often have problems putting a call through, getting a busy signal when the other persons phone is on the hook and such. Again Sprint does the best on this, putting through calls more often on the first try. KCI appears to have the next best quality equipment, with ITT and Western Union behind, tiuch of the problem is because Bell won't give these companies the same quality connections that it gives its own long-lines dept. The quality will continue to go up as equipment is improved and they win more court battles forcing Bell to give them better quality connections on both ends, Another problem is that alternate calling nets don't go everywhere Bell does. None that I know of go international yet, although Sprint is planning to soon. Sprint goes to the most places in the US, 138 major cities. ITT goes to 105 major cities, KCI to 86 major cities and Western Union to 29. If you want a list of where each service goes, call their service rep (list in yellow or white pages) and ask. Also ask for info on subscribing, they'll send you @ packet with all sorte of goodies in it, like lists of cities they go to and sometimes access numbers. If you want to read a good (but straight) article on alternate calling nets, Consumer Reports wrote them up in its Karch 1981 isaue, available * at any library. Alternate nets can be just as dangerous as a-Sell if your caught. They often have automatic traps on all incoming lifes, so don't call from home. (No shit!) If you go scanning a bunch of codes, you can be sure that you'll set off a bunch of flags in their office. If you can, try to conceal the number you are calling, because they will try to hassle the person receiving the calls if they can't find out who is making them, just like Bell. Call your friend through a loop-around, or better yet, all up to the city he lives in, then call the access numter for another alternate net, and make @ local call on it to your friend. For instance I call from San Diego to San Prancisco on liCI, then I have MCI call Sprint in SF. I then go through Sprint and make a local call in SP. This way KCI can't find out where I called to, and Sprint isn't going to waste time worrying about a local call. “ake sure you don't call through another access number of the same net, beause that sets off a red light on a board somewhere in the office, and they will want to know what you are up to, also they can easily trace the call through their own net no matter where you run it. If you are caught, they may just make you pay for whatever they canget.you to, KCI is known to do that. You could be busted though, under wire fraud and breaking PCC regulations, Both federal crimes, Also in California, there is @ law against computer crimes. It is very tough, and the way it is written, they can bust you for Alternate calling nets are actually just large computer networks, so guess what else the DA will charge you with. Many other stats have computer crime laws too, I'm not sure which ones do. But don!t worry, they'll get you on the federal rap anyway. So don't get caught. Ka Bell Security works with the alternate calling companies security divisions, they will trade numbers and info, Bell has even teen known to makes busts for Sprint. One thing you may want to try, it still works in a few places, is calling through on an alternate net, then blue boxing the line going out of the alternate company into Hell. You then get a Bell dial tone on the outgoing line, which yeu can NIP ‘through to. You can go overseas or whatever. There are 2600 Hz notch filters on most alternate calling inputs; but not all. If you have a micro computer, you can break Sprint (and other) codes very easily. Hook up a modem or even an audio interface to your phone line and program your computer to scan through possible codes, until. it finds a good one. A micro can scan more codes in an hour than you could in a day, and it doesn't make mistakes or get tired. If you don't have a micro yet, you will soon. They are the box of the future, and are quickly becoming the box of the present. Have Phun Phreaking Simon Jester‘ 3 spread of fallacious reason ‘oly importamt and powerful stitution — the Phone Company. The Phooe Company playi fecently about the overuse of directory assistance. Perhaps you have heatd them, One af the com mercials has two people talking, ‘sho, for eaavenience, will be eall- ed Lazy and Wrang, Lacy calls directory snsistance to get = number which bave easily looked up ‘Wrong chastises Lazy, say looking at a computer wrong. (The Fucking Legislature..) CE. — Fullacious muthematical reasoning is one of the most [prevalent destructive forces in our society today. ‘cancer through the highest in the Reagan Adminstration. ‘This has not been u major source f concern 10 Am .) < = umbers . dustries. They would have no choice but to go on the Federal dole. Since the Federal doe is be ory . many ex-ireciony asisers might hve to go without food {or at least toveh-ione service), Riots could ensue, ‘Admitiedly this is = worst-case scenario, but it does highlight the anger of fallacious mathernatical reasoning leading to un incorrect cconamie policy. A poticy af us- ing directory sistance as often aH possible, on the ether hand, Soul pat"Americans to work; i has spread Massachusetts lone last year, und that all phone users must shate this expense. Not sur- - irisingly. Lacy 1 40 shocked by figure that Be readily wprees to use the phonebook next time and never again to use directory ansistance, ‘So where is the fullacious reasoning. you ask? Suppose that everyone agreed not to use direc . ‘s 43 been als ‘maybe even bring ubout lower in~ terest rates. Phonebooks would ‘become obsolete, com duindling qaturat trees. Cleatly the Phone Company's reasoning was ‘completely menerect, The overuse of directory assistance is not a problem, although underuse may be, ‘Since MIT is presumably an ia- . stitution designed te promote cor- fect thinking. we must set an €x- ‘ample for the rBst of the state and the rest of the country. We must tue directory assistance whenever possible. Remember, ul i Ka uber, Aree become w great nation upain, but ‘with the Phone Company's sishtunce — and yours, several_comt (popelution costs $30 million a year. then directory assistance ia the Slates (population about 224 mil fiom) probably costs xbaut $2 bil- lion a year — a remarkable one tenth of one percent of our Gross National Product, could ff. at otha fn) OTe A scheme you can bank on ‘Oceanside, Calif, —A lay robber made some easy money by ‘posting a sign directing bank customers to make thelr deposits in a bogus deposit box. “We won't know how much was lost until people ‘thelr money wasn't depotited,” pallee spakeaman Bili Krurigelevich ex Priday. Krungelevich ssid the thlef put 2 note on the outside deposit ‘machine at a Pirst California Bank branch. The note exit, “The night deposit is out of order=please leave your deposit in the bax.” Branch ‘manager Bill Reedy exid two women who left their deposit canh.to “= -ahabbily built wooden opa” hare egmplaned th birt. to gon hone bills, cut your cut out this chart. aoe ee ee ee eS 6) aya sisters, ike the forcr afr tlle controllers, have a skill which is fnot of mock use in other in FP nack rssues are §.75 each. Tasue $50 {9 $1,50- | Subscriptions - 10 issues - US Bulk Rate $7. os Bulk Enver: ‘ope Rate $8. ' US First Class in plain sealed envelope $10. ' Canada & Mexico First Class $10. 1 Foreign Surface $8. - Foreign Air Mail $12. IMPORTANT! Please include your mailing label or a | Xerox copy whenever you write to TAP about your subscription. i} Blectronic Courses - $.75 each. A - DC Basics, B= AC Basics, C - Phone Basics, D - Amplifiers. | TAP “Ha Bell’ $1.50. TAP Tit Pen - §.50. 1 h Anniversar; ERD Cassette Tape --$4— Wear Capt Crunch. Al Bell, Joe Engressia £ Beli Security Chief dohn Doherty. 1 Send CASH, check, or money order to: TAP, Room 603, 147 West 42nd Street, New York, l N.Y. Co J PICK LOCKS Classified neem ey eee PORE GY EE AAS teleoerperne pte a aes Up te 20 % MORE 11. P. G. for under § 1:00 beivapheenelepensaabiahespnad © SURVELULANEE ba TT rr hae ject bits complete: Amazing but true, a simple device costing cents Sete tegm og se eg, ore Say needed Conponent acces” enables this fantastic gas aaving . Easily installed. Wat it 18 , where to get it ,.how to fit it . confidential report with fuli information , send $4.00 cash ( or $5.00 check ) Plus SASE to Box # T. 537 Jones St. O86 ca gt07. NEED: 1) Plans/schematics for scanners. 2) Plane and info. on antenna construction (any band). 3) Copies of material from Information Unlimited, Scientific Systems and Solaser. 4) Info. on the MAC-MLO (TAP #58) and a replacement for Special Parte Ltd. (defunct). Sree eter an cetann hese ate, 5) Books and back issues of publications covering Petar NT oe electronics, defense and alternative technologies. uA there I have other plane available and will trade for above SURVIV aa Ia love to hear fron OF W111 make other arrangenente. SASE to Box L tid the wonen who read thie WITH BOOKS FROM wiactoot crows: ad, 1'm shure sone of you peanedpaamoeadr em anamaeaatinneid ALTERNATE IDENTITIES, NAME CHANGES, COVERING URBAN, RURAL read TAP, Pleneo write and wHATEWE. GET LEGAL 2.0 61TH OUR RETREAT SURVIVAL, AND GOODIES. “ALGO Lat: ENFORCEMENT. TYPE MANY OTHER SUBJECTS a5 told me about yourself. 1.C. CARDS (23 DIFFERENT K13DS] WELL! Discounts to 60% on I'm a 25yr old male radio-tvob, BADGES & ACCESSORIES. List $1.08 (REFUNDAGLE WITH PURCHASE). C.W.L. BOX 3230, PASADENA, CA 91103 {eA RRR RABANNE some titles. DEALERS WANTED !! List $2 (refundable with order). TECH-GROUP, Box 3125, Pasadena, Calif. 91103 USA BEAT THE GAS PUMP The TAP Classified Ad Sheet is publisned as a so4 arte tenn BIG ULL service to our readers. All ads MUST be typed and Faas are roti retues camera ready. Ads will appear in the next ad sheet iar ’ unless they arcive after printing deadline in 33 photos, 6 line drawings. which case they will appear in the following ad Big. O% x11 pages. sheet. The cost per ad per issue is $2. If you Weitten by former Sig Ol! wish to preserve your anonymity, TAP Box numbers employee. | ailable at the cost of $4 per ad per issue. $23.00 each xtra cost is for the postage to mail you the DEALERS WANTED! replies to your ad. Full page ads cost $10 and half-page ads cost $5. Payment must accom all LUst $1.00 (refundable) ads. Send cash and get a 10 8 discount on ail, ad: 1 Address all ad requests to : TAP, Room 603, TECH-GROUP West 42nd Street, New York, w.¥. 16036. Pasadena, CA 91103 TAP, Room 603, 147 W. 42 St., NY 10036 oper vel