______ _____ ____ _____ _ _ ____ __ ____ ___ ___ _ _ / ____/ / __ \ / __/ / __ \ // // / __/ /\ / / / __|\ \ / / \\ // / /__ / /_/ ) / /_ / / \ \ // // / / / \ / / / / \ \/ / \\ // / ___/ / __/ / __/ ( ( ) \) // // / __/ / \/ / ( ( / / \\// / / / /\ \ / /__ \ \__/ \ \ //____// / /__ / /\ / \ \__ / / || /_/ /__/ \__\ /____/ \_____/\_\ /______/ /____/ /_/ \__/ \____|/__/ || INSIDE THE HACKER MIND frequency.50megs.com Note: If you wish to take any information from this ezine, you are welcome to as long as proper credit is given to both Frequency and the article author. 1) Introduction 2) Screamer 3) Welcome to the New World 4) Privacy Box (2600) 5) Computer Security (or lack there of) by: Mystic 6) Why Zines are Important by: IceDog 7) Until Next Time 1) INTRODUCTION Pick up the telephone and listen to the beautiful sound of a dialtone, my the wondrous possibilities that await you. Bring up a terminal, and take a moment to think about how you can explore every inch of the world without leaving home. Or start up a radio, and hear signals that fill the skies overhead…coming from somewhere "out there" in the world…. Welcome to Frequency, the phile for those of you with the hacker frame of mind. Curiosity, a desire to do the things that everyone told you were impossible, and exploring the world from the comfort of your home. In this first edition, we would like to build a foundation for things to come. Through submissions from fellow hackers and phreakers we will hopefully be able to provide a phile every few months that's not only informative, but enjoyable as well. What you will not find here is anarchy material, such as how to destroy a building or really screw up someone's life. We're more concerned with how things work, so for a simple example we will not publish how you can use a Trojan to destroy someone's computer. We may however, publish how exactly a Trojan does what it does. After that, we ask that you're smart enough to know right from wrong and do not attempt to use it for ill purposes, as this is not the true hacker way. If you do, you will be caught…plain and simple I'm afraid. You may notice that this publication is quite similar to other ones out there on store shelves, or elsewhere on the vast internet. This is not a coincidence. In no way do we wish to infringe on anyone's rights, rather we wish to pay homage to the great philes that have come before us. People were making information available for quite sometime, and to come along and to try and do it any better would be an insult. What else can you expect from this phile? Mainly editorials full of opinionated viewpoints on various issues relating to the hacking world, but of course informative texts as well. Our goal is not to train anyone to "become" a hacker, for frankly we strongly believe that a true hacker is not someone looking for answers, but someone with the desire to go out and get them. We're not in the business of training "newbies," and while we will gladly provide information in our articles, we will not reply to your "How do I get so and so's email?" etc. As stated above, this phile is primarily for presenting the hacker viewpoint on the world, and will hopefully create some excellent discussions. If you are a newbie searching for the answers to questions hackers have worked their entire lives to answer, we invite to search around the net. Trust me, you'll find some things that will interest you and make you think you're a hacker for a little while. With that out of the way, I would like to take this chance to thank BlackBeard and the entire undergroundnews.com team for their support. And a special thanks to all the hackers out there in the world for helping push the limits of technology. -screamer 2) SCREAMER Having been involved in the hacking world for as long as I can remember, I chose the name Screamer as a way to show how my mind is constantly crying out to quench a desire for knowledge that will never be tamed. And since I have nothing against last names, my full name is Screamer Chaotix. (kay-otix). But feel free to just call me Screamer, everyone does. My main interests lie in networking and telephones, however I'm interested in all forms of communications. Not to mention computers in general. While I do not claim to be the greatest hacker that ever lived, I've been around the block a few times and feel that I have just as much right to express my views as anyone else. There are many out there whose intelligence in a certain field far surpasses mine, but hopefully through this phile I can learn from them and further my knowledge. I know many may want to know what I've hacked, or where I've been. Well I must say that only the closest of my friends get that information, and the reason for this is simple. Breaking into other people's computers gets you in trouble, and I'm not here advocating it. I can be reached at screamer666@hotmail.com, and no…I'm not expressing religious views here (frankly I don't have any) that was just the only name they had. Feel free to write and give me any comments, questions, or articles you may have. -screamer 3)WELCOME TO THE NEW WORLD Going back to the beginning of it all would be far too great a journey for a simple publication such as this, but I will take the effort to send you, the reader, back about ten years. Back to a time when phone phreaks were learning ways of using loops and corporate numbers to make free calls to anywhere in the world. It was a time when teleconferences were at an all time high, with some people spending in excess of 65,000 dollars to talk to others in their area. "Trashing" was quite popular, with people accessing these corporate numbers by swimming through a company's garbage bin in the middle of the night. The internet was in it's infancy, with only a few bulletin board services (bbs) available for people to dial up using their modems and terminals (and in turn, spend even more money on the phone…unless of course they had a way around that). This was a time when the only security a company would bother to put up was a single letter password, hoping that would be enough to let people know they didn't belong in there. Telenet, a service still in use today, was one of the worst secured networks of all time, with what amounted to nearly negligible security precautions. Thus allowing users to access all sorts of networks and computer systems. It was around this time that many a hacker were born. And while it may go all the way back to the 60's and a fellow named Steve Wozniak's bluebox, you can rest assured that the real fun began in the late 1980's. "Reach out and Touch Somebody" A phreaker can be defined as a person with a desire to explore the phone system to learn it inside and out. A person who wants to reach out to the rest of the world with only a few buttons, and hopefully do it in the cheapest way possible. With 2600mhz tones and the right phone number, a person could make a machine think they had hung up…and then proceed to dial any number they wish for absolutely free. These phreakers loved telephones. They loved everything about them. From how they worked, to where they could take them. To a phreaker, exploring a phone was not about only taking it apart and putting it back together, but also about exploring the world itself. Sitting in a dark room in the middle of the night, a phreaker would be able to lift the receiver, press a few buttons, and contact a research base thousands of miles away in Antartica. To them, it was as though they had physically made the journey there themselves. They were the phone junkies that did everything to keep their love for their hobby. Refusing to allow the phone to become just another tool in an office, another chore that must be dealt with during a typical work day. "Windows to the World" Take phreaking one step forward. No longer can you only hear what's going on, but you can see it as well. Using a terminal and what would now be considered a modem no faster than a snail in glue, you would be able to dial up a bbs and actually interact with other people using text. Meetings on bbs's were extremely popular, and much similar to the chatrooms or message boards of today. It was on these boards that ideas were shared, and people were able to meet without the awkwardness of having to talk to someone you didn't even know. Soon however, a select few found that there were more than just bbs systems out there. Other computer systems could be reached by modem, and with security that was so lax it was virtually non-existent, a person could get inside the system and explore a whole new world of computing excitement. New operating systems to learn, new commands to try, and of course the most exciting part of hacking…getting the machine to do what you want it to do. There was no theft involved…only the pursuit of knowledge. "1995 - United Artists presents 'Hackers'" Dade Murphy alias Crash Override (aka Zero Cool), Kate Libby alias Acid Burn, Emmanuel Goldstein alias Cereal Killer, Ray Sanchez alias The Phantom Phreak, and Paul Cook alias Lord Nikon. These are the names of infamy in the hacker world, the names of those responsible for making every 10 year old on AOL a "hacker." The film was released and was not what you would call a box office smash, and yet this didn't stop those that saw it from emailing everyone they know claiming to be "1337." And for a while, it seemed as though legitimate hacker sites were doomed to fall victim to the power of the overwhelming numbers of the "newbie." A typical newbie site is one that is located on a server such as geocities, with pictures of skulls and crossbones and gothic music playing in the background. The files you'll find are ones listed as "Phuck j00 up Bad!" etc. These are the homes of the script kiddies who want neither information or a chance to speak their mind, but rather a quick and easy way to mess up their best friend's computer and look cool in front of everyone they know. The film undoubtedly caused this, but I will admit that a few hackers have been somewhat too cruel to this film. While not many share my opinion, I'm one of the few hackers of the world that enjoyed Hackers for what it was, a crazy sci fi flick that was meant to be viewed for entertainment. At the very least they paid homage to the founder of 2600 magazine and included his name in the film (true hackers know which name) as well as presented hackers in a good light, which is rarely done nowadays. Nonetheless, this film did start what I stated above…and what would nearly become the downfall of the real hacker, versus the kid down the street that runs Sub7. "Billions and Billions in Damages!" I Love You. Sounds sweet right? Well apparently not to all the people infected with the dreaded iloveyou virus that swept the world and infected numerous email programs. Seems like the melissa virus wasn't enough, Microsoft needed yet another kick in the ass before making changes to the pathetic Outlook Express program. If you choose to believe the amazingly high amount in damages caused by the iloveyou virus, then that's your choice. Although to me, and many others that I know, this sounds a bit exaggerated. But let's not forget that the more damage that is done, the more hackers can be blamed. And after all, the world has learned that nearly every 10 year old with a computer is a hacker! So obviously we have a serious threat to national security, and it's posed by these so called "cyber terrorists!" Does the blame head towards a faulty email program whose company was too lazy to fix it? Of course not. Does the blame go towards a person referred to as a "criminal?" Of course not…the blame heads straight for a hacker. And while the person sending the virus may very well be a hacker, this does not mean that the entire hacker community supports their behavior. Is every cop bad because a few take advantage of their power? No. The same should be said for the hackers of the world. "The New World" With the film "Hackers" now five years behind us, the internet has somewhat calmed down from the sudden boom of hacker wanna-bes. We're beginning to return to the old idea of exploration not necessarily having to be illegal. Of course it still exists, but the same thing can happen in any field, not just hacking. And of course you will always have the teens with blue hair on MTV who claim they're hackers, and try to impress everyone by doing what they think they should. At least to seem like what they interpret to be a hacker. But for every one of them, there are a dozen legitimate hackers who only want to explore their computers and phones to give themselves a better understanding of the way things work. Technology may be advancing in this new world, but so are the hackers. And quite frankly, it's the hackers that are moving us forward…. -screamer 4)PRIVACY BOX - Information gathered from 2600 magazine, Volume 17, number 2. Sent in by obitus. The purpose of this box is to prevent anyone in your house from eavesdropping on a phone call by picking up the extension in another room. While rather simple to make, it does require a small amount of soldering. For further information, please refer to 2600 magazine. Equipment: 1 modular phone jack 2 15v zener diodes 1 small switch (spst micromini toggle switch will work fine) phone cord Theory: This design, created by obitus (obitus@marmoset.net) is based on the Fuscia Box. This is the theory behind the device: your phone line has electricity running through it. When you are talking to someone, the voltage is around 20 or so volts. When someone picks up another phone in the house, the voltage is cut in half. The box runs on two 15v zener diodes. The diodes only allow the electricity to flow through it if it is above the preset voltage of the diode. So when there are two phones in the house off the hook, the voltage on the line is only like 10 volts. That isn't enough to flow through the diodes, which causes your phone to be blocked. You have to use two zeners because, depending on how you have the box hooked up, the electricity flows through differently. With only one zener, the box would only work 50 percent of the time because the zener only tests the voltage if the electricity is flowing through it from a certain direction. From the other direction, the electricity can flow through freely. Assembly: 1. Open everything up and spread it out. You will need a screwdriver, something to strip wire with, and these directions nearby. 2. Locate your modular phone jack and open it up. Inside should be eight screws with eight wires running to them. The two that we are working with are the red and the green. 3. Unscrew the other screws. You may want to keep the black and the yellow wires. Cut the rest as close to the socket as you can. 4. You should have a red wire and a green wire running from the socket to two separate screws and six empty holes. 5. Move the green wire and screw it into an empty hole. 6. Next, solder two short wires to the poles on your switch. 7. Then solder the two anode ends of the two zener diodes. (anode is the end not marked with a black stripe) 8. Take your phone cord and cut off one of the plugs. Peel back the insulation and expose the green and red wires. Strip the ends of these wires. 9. You will want to screw the red wire from your piece of phone cord to the screw that is holding the red wire from the socket. 10. Next you will want to screw the green wire from your phone cord to the screw that isn't holding anything at the moment. One wire from the switch and the cathode from one of the zener diodes will also be screwed to that screw. 11. The other wire from the switch and the cathode of the other zener will be screwed to the screw that is holding the green wire form the socket. 12. Lastly, drill a hole in the cover of the modular jack and push the switch through. Use: Hook it up between the wall and the phone. You will have to figure out which way is "privacy mode" and which way is "bypass mode" if you used the toggle switch. This can be done by calling a friend and telling him to keep the line open while you pick up the extension and see which way is bypass, and which gives you privacy. 5)COMPUTER SECURITY (OR LACK THERE OF) BY: MYSTIC Computer Security (or lack there of) in Corporate America By: Mystic There are a lot of texts that talk about how to get around security. This is one that questions why should you? Why not go right through it. Most companies, especially within the mid size range of corporate America do not realize that security is a risk. Even when they do they do not believe that it actually affects them and are there fore lax on the subject. Many times all you need are a few pieces of information that can be gathered from some easily available places to get in. From there it is a cakewalk to further your ends. Before I go on… Of course all information contained within this article are for informative purposes only. The author, namely me, assumes no responsibility for anything done with this information. Of course you should always have fun. That said let us continue. Now as I said why go around security if you can just go right through it. Of course there is the challenge of going around. But that aside let us talk about going through. After working at many mid-sized companies I can tell you that most do not think that network security is of any great importance to them. They all naively believe that hacking is something only done in the movies or perhaps only to larger companies. It is this naivety that we plan to exploit. But where do we start? How naïve can they actually believe? The answers to both are surprisingly simple. You start at the beginning, and yes they are that naïve. The beginning. Not all companies are as lax but with some work you can find one that is and have no end to the fun. To begin with of course you would need a company to work with. Lets use ACME Inc. as our example. ACME deals with retail. Why retail? Retail companies (clothing, food, specialty stores) all have the same thought in mind. Spend the money on the moneymakers, namely the buyers. Computers are not a money maker, because of this most small to medium sized business will tend to under staff this area or get someone else that may have a little computer experience to work with the computers. This creates an obvious hole. With people having little or no experience in computers lots of little factors are over looked. But more on this later. As far as mid sized companies are concerned computers are a necessary evil that are only needed as far as storing data. Anything beyond this is unneeded and there fore not bothered with. So ACME our little retail company needs computers and a server so that they can store data. But since computers do not actually make money they get John from accounting who has a computer at home to set up the network. John only knows a little bit about computers so he sets up the little network and it works. But what John doesn't realize is that when he set up the network he didn't create proper security. Everyone has access to all folders. Also since John doesn't know much about security and the users are fairly computer illiterate he sets all users passwords to their last name. Now the little network is set up. It works and everyone is happy. Overtime as ACME grows they add a dial in option, something like a pool modem. Now to make this easy on the people that need to dial in they set the usernames and passwords the same as on the server. Now we have an easy access point. But what do we actually have at this point and how do we know what the dial in number is? How do we know what the usernames are to try the password? To get this information is actually a lot simpler then it sounds. First for the usernames, check and see if the company has a website. Most do nowadays, on the website find a couple of links that send email to people at the company there you have the username. How? Most companies email addresses are the same as the logins. Take those names and add them to a list. The web site would probably also have a phone number on the web site. You can use this and try to find other names. If an actual person answers, not likely any more then you make up a name and claim you are from a store and you need the backdoor number. NOTE: A backdoor number is a number that goes straight to the voicemail system not a gay number. If in the unlikely event that they do not have a backdoor number thank them and hang up. Now you have to find another way to find names. Simply call and ask to speak to the head of XXX department and do that a few times to get a few names. On the other hand if they have a backdoor number then all you have to do is start-trying extensions or even better most voicemail systems have a 411 directory you can access which will have all the names in it. Then just choose the ones that you can spell and add them to the list. Now for the dial up number, this is the easy part. Dial up the company, if you get the operator skip a head a little bit. If you get the voicemail system normally you can hit 0 to get assistance. Say that you are John Doe from the list that you created earlier and you need the dial in number. 99% of the time the receptionist will have it and give it to you know questions asked. TIP: If you are a man don't use a woman's name and vice versa. Now what do we have? We have a list of usernames to try, a good guess at the password (The last name of the person) and we have a dial in number to work on. Set up your dialer to dial the number put in the first username (the format that the email is in, normally first initial then last name.) and the password (last name) try the list out. This may seem like ok we have a regular account so what. The so what is that remember ACME had John set it up. And he didn't know much about security so everyone has access to everything. Not only that but there are tons of ways to elevate your user privileges. Now you have full access to the system. Now even on the off chance that ACME hired someone as they grew to work on the computers they wouldn't rush to any changes. Trust someone who has worked in the field for a while when it comes to security most companies don't find the need for it and refuse to change because of the inconvenience that it would impose on the user. Till next time kids, this is Mystic asking; What do you want to hack today? 6)WHY ZINES ARE IMPORTANT Why are Zines so important for the current hacking-community ? I think zines are very important for the current hacking scene because they will always remember us where everything started. It started with Phrack, with all the Zines and undergroundnewsletters all over the world. It started with the first BBS runned by real hackers. No one was talking about things like sub7 and how to nuke the hell out of chatters. It was just important what you know and what you want to learn. Now its just important who got the newest tools and who can push a button. Nowadays are zines something special for the community, much zines only have published one or two issues, only several zines had published more than 10 issues. I think most zines where published between 1991 and 96. This was a time of change, and time for a change in the hacker community, the underground. Several hackers/crackers where busted and the media got more attention for hackers. The zines overlived that development. It seems they are coming back bigger and better then ever. The purpose of the zines nowadays is to trade information, report the latest bugs and exploitz and maybe a review of a meeting like Defcon or H2K. Maybe you can support them by sending new articles, news or something that you have found on the net that seems to be important. Without any help of readers are zines condemned to death. Please support them, so they can stay alive and can publish and support the underground. In one of the next issues we will look at the development of several zines. So stay tuned. 7)UNTIL NEXT TIME Thanks for reading the first issue of Frequency: Inside the Hacker Mind. We hope that it has given you a little to think about, and openly invite anyone and everyone to reply to the articles printed above (Contact information is listed below). In future issues we plan on bringing you more intriguing opinions and points of view from the hacker world, but again the opinions can only be as intriguing as those that submit them. So feel free to write in with any articles you may have pertaining to the hacker world. Our hope is to have the hacker community play an active role in this zine and mold it the way that they think it should be. Frequency is meant to be a zine for everyone, and with that in mind we invite you to write in with any criticisms or praise you may have. This is the only way of ensuring that we all get as much enjoyment from this publication as possible. And lastly, to the hackers of the world: While there may be more and more newbies begging for help in chatrooms claiming they're elite because they have a shell account, or kids on aol who want to learn about Trojans…you will always be out there. The true elites who wish to make information free for all, and who will not stop in their quest for knowledge, as well as a better understanding of how things work. Play it safe, but never stop exploring. To all the hackers out there, this is Screamer saying thanks, and see you in the next issue of Frequency…. 8)CREW Editor In Chief / Head Writer: Screamer Contributing Writers (In alphabetical order): Asseverate (not published as of yet), IceDog, Mystic Webmasta: D4sh Title: IceDog (Y by Screamer :)) Special Thanks to www.undergroundnews.com and BlackBeard, as well as everyone who did or did not think this ezine would become a reality. And to Phrack, L0pht, and 2600 for their inspiration! 9)CONTACT Article Submissions: screamer666@hotmail.com Comments, Questions, Complaints: screamer666@hotmail.com