FREQUENCY: INSIDE THE HACKER MIND JANUARY 2001 1. Introduction "The Longest Mile" 2. Targets (How to get the info you want) 3. Intro to Encryption, by: DamienAK 4. Newbies, One Last Word, by: Gedoan 5. Attention Kmart Shoppers (fun with Kmart's intercom) 6. Unfair Treatment, by: mm 7. Closing Arguments 8. Crew 1. INTRODUCTION, "The Longest Mile" Here we are in the year 2001, once thought of as the year we would be taking regular trips to Jupiter, now seen as the year when DFAST and the DMCA will rob everyday people like you and me of their fair use rights. DFAST, also known as the computer code now being installed on digital televisions to prevent you from recording things cable companies and movie studios don't want you to, will soon be commonplace. Television makers that are against this have options of course, if they don't put the DFAST code in their televisions…they can't sell them. The DMCA, the real cause of all this, is still here and going strong. And if Hollywood had it their way, fair use wouldn't exist at all. As stated on www.securityfocus.org "If it were up to Hollywood, the play button would become the pay button." What can be done about this? Write to your senators, explain to them that the DMCA robs the average person of their rights and that this cannot be tolerated. State your position clearly, and after you receive the standard "Thanks for writing, now let me tell you why you're wrong" letter, write back! You have a right to voice your opinion (freedom of speech is beautiful), so let them hear you! It's a long road ahead of us, but we'll see it through. If we keep our cool, we'll protect our freedoms from those that are out to only make a buck. You know, I can't help but see a comparison between reality and fiction in today's world. For those of you familiar with the film/comic book "X-Men" you know it's about a group of people who are hated by society because they can do things that others cannot, doesn't this sound familiar? Should DFAST come into existence, there will be those of us who are able to crack it and change it to so that it doesn't rob us of our rights. And this, of course, will royally piss off those in the MPAA. Because of hackers who know more than most people, DFAST will be decrypted and people will be able to record whatever they want. It'll happen, we all know that, but this will only provide a temporary solution. We need to do more to tell the government that what they're doing to us is not right. While we may be able to make these brief fixes, we need to concentrate on the larger picture. Will governments understand us more? Doubtful. But hopefully they will see that we have a genuine opinion on these matters just as everyone else does. With your help, we can all come out victorious. -screamer 2. TARGETS It's every hacker's dream. To see what they want, fight for it, and then finally obtain it. Whether it's the "uncrackable" system that all the experts are raving about, or just a computer that you're interested in exploring, we all would love to come, see, and conquer. For me, it was a large building in the distance. For shits and giggles I decided to "get into" that building and see what they had running inside. Why? Just because it was there. Every time I walked out of class at my university I saw the same building on the horizon, completely anonymous, nothing but a mystery. What was it? What did they do there? And how were they communicating with the rest of the world? The radio tower on the roof flashed an ominous red light in the night sky, and taunted me every night. I had to get inside! I'm sure others out there have felt this way, you would love to get into a particular system, and not just happen to stumble upon some system out there that you have a vulnerability for. But how? Perhaps the most important thing is to learn the name of the corporation or system (or in reality, whatever it is you want access to). This is only your first step of course, and the next few should be obvious. Go online, look up the companies website. 9 out of 10 websites will show an address at the bottom of where they're located. The only time this doesn't happen is when it's a nation wide organization (ie: SNET). Then you may have some trouble, how do you know you're actually getting into that particular building's system…and not the main headquarters in Nowhere, Arkansas? For this you need Visual Route (for you Win users). With this, you can narrow down the physical location of the machine you want to enter. What's that? The SNET website shows you that it's located in Dallas, Texas and that's not the particular office you wanted? Hmm…little problem here huh? Time to get old school folks. Yes that's right, it's time for social engineering. For you newbies, this is a great way to practice. Go to SNET's website (or your particular target) and locate the number you dial for information. Dial that number, and using a little social engineering (nothing major mind you) ask them for the number of the location nearest you (aka your target). Most likely they will be glad to help you (if they offer to patch you through say you cant talk at the moment, but would like the number for later) and will give you all the information you require. Great, if this was WarGames you could hook up your "can-never-be-disconnected-modem" and wardial the number…alas this is 2001, and you'll need a bit more information than just the number. But fear not, all hope is not lost. Call the number and get ready for more social engineering (this time a bit more tricky). When you get a real person on the line, tell them you're trying to reach an acquaintance that a friend of yours told you about. Only you cant remember their last name! How foolish of you for not writing it down, and now your friend is on vacation and you're completely stuck. Oh how nice, the kind person at the company wants to help you figure out who it was! Obviously he won't give you all the information, you need to supply a little, so go for an obvious name like John S….If you're lucky, he'll have a John Sebastian on record, or perhaps a John Solomon. Whatever you do…NEVER agree to a name. No matter what happens there are NO certainties, those only lead you into a brick wall. What if there is no John Solomon? He'll know you're full of shit, so instead act as though you're taking his word for it. Let's say John is real, but just like with the operator you don't have time to talk, something came up! Ask how long John will be there (DO NOT ask when John's leaving…far too suspicious) and say you'll call back later. Hopefully, the nice man on the other end will tell you. If not, say you understand, hang up, and call back later that night (try to remember if it's the same person you spoke with earlier) and try to get information from the new person that answers. If you got all you need, congratulations! You're getting somewhere now. Let's face it, you're not John Solomon…so what good does this do? Well right now you know someone in the company, and this has infinite possibilities. There's one option glaring you in the face…and I'm sure if you have any skills whatsoever you know what it is…you pretend to be Mr. Solomon. (NOTE: It's even better if you get some info about Mr. Solomon before you pretend to be him. Look at www.resume.com or www.monster.com for his name, or any other resume site out there…many times people put their resumes up for all to see, and give out precious information. Even if this information isn't enough, you can track most of it back to other sources and get plenty of info on this man you're impersonating.) Call up the company, and give the typical social engineering bit about forgetting your password etc. Try as hard as you can to get some sort of access to the system, even a guest account will do (and most people have no problems handing those out). Remember, you ARE John Solomon while doing this…don't ever forget that, and NEVER let anyone tell you otherwise. No matter how much they pressure you, you have nothing to worry about because you are who you say you are! Confidence is critical. If this gives you access, congratulations! Learn the system and find a vulnerability. You just hacked into exactly what you wanted to. But what if you didn't? What if they didn't buy it? Are you shit out of luck? Of course not. Any information you obtain is critical, even if you just find out the address of someone at the company (John Solomon has no reason to remember his email…he never uses it! So why not ask for it so you can write to yourself?) Bingo, if the company uses an independent mail server (independent from the headquarters down in Texas that is) you can find them out there on the net. Using DNScape or your favorite nsloookup utility should work nicely. If all else fails, ask if they're even connected to the internet (just out of curiousity). If they're not, well then you went through all this for nothing. Get a job there and give yourself access, that's about all you can do. But with a little luck you have all you need to locate the system and hack out an entrance. This is the fun of hacking, seeing what you want and going for it. Finding a weak web site and taking it over is child's play, but owning a network that you desire so uncontrollably is indescribable. Now excuse me, I have to find out what the hell that building in the distance is…. -screamer 3. INTRO TO ENCRYPTION: By DamienAK We talked bout encryption in IRC once and I went out and gathered some info. If you ever send really sensitive information over the web or have something on ur comp that can really get u in trouble Encryption is a must. For every encrypted document you need a key to decrypt it in order to be able to read the information. There is encryption strenght ranging from 8bit to now I believe it's 256 bit. If you encrypt a file with 40bit encryption there are billions of possible keys but with 128bit encryption there are 300 billion trillion times as many keys as with 40-bit encryption. As you can see, encrypting a file could really save ur ass one time. Over the last 3 years there has been a worldwide competition in the cryptography buisness to come up with an Advanced Encryption Standard (AES) and in October of this year, which Rijndael data enryption formulas won. This new standard for data encryption will be started to be used in a couple of months. Algorithms are mathmatical formulas which are used to encrypt data. The stronger the algoritm, the harder it is to crack the code. For normal computers it is pratically impossible to ever crack encrypted data and it would take a really long time for the strongest super-computers on this world. That is if u use brute force against encryption. The encryption that is used in Unix password files is really weak compared to encryption being used by governments and big coorperations to keep themselves safe. Just like these bastards have the right to keep their **** from other peoples eyes so should hackers. Encryption keys: There are two types of encryption keys, Symmetric and Asymmetric. Symmetric keys use the same key to both encrypt and decrypt the file, while Asymmetrical keys use one key to encrypt and a separate key to decrypt. The keys are in different sizes depending on the streght. Usally the bigger and more complex a key is, the harded it is to encrypt it. Sizes ange from 56 bits to 2034 bits. Eventhough the size of the key is not really the most imporant thing, it does play a big role. Now, the problem with Encryption is that the goverment will not allow comericail products to be sold unless they have the keys for it. That mean eventough ur frined won't be able to crack the key, Big Brother won't have a problem. This, in my opnion is total bull****. Doesn't really matter how strong the algorithms are if they have the keys for it. Thats a little primer on encryption. There is lot more information to be read. I'm tryin to keep the post down to a readable size. p.s. I wanted to send this in to Frequency so Screamer, if u want it in please use it. But I thought that this might help get some more usefull info on the board. )))DamienAK((( 4. NEWBIES, ONE LAST WORD, by Gedoan Hello sceamer. I think your view of newbies in general is far to negative. But maybe that is because you where in a dark mood. Let me tell you how my experiences with newbies have been. Well, first of all I still (and always will) call myself a newbie since I believe you always are. There´s always something new to learn and it feels strange to think of yourself as a Hacker. It sounds as you would be god or something. But still, I guess the hackerhood lies in the eye of the beholder. When explaining assembler to someone who doesn´t know what it is..understand what I mean. When I first discovered IRC, I ofcourse went to the cool #haxx0r #hack whatever channels. And sometimes they where taken over, sometimes you where kicked out and sometimes you where allowed to stay. But the boring thing there was that I found no spirit there. So I forgot about thoose channels and started to play with linux. There finally I found spirit, in the local #linux channel. Together in the #linux channel to struggle to get something to work in linux, I asked about some things, got a few replies, tried to fix it, tried a little more, didn´t work asked about something more specific based on what I discovered by trying, got more specific information and finally got it. Most of the time I´ve always met patient, kind people who´ll gladly guide you or shall I say help you with your problems. There I found spirit, sitting a whole night trying to get something to work and well, you know. The next time someone asks that question ofcourse I answered him the same way I was answered. There I found hackers, sitting with non-standard OSs learning together. Not in the #hack channels. And the process is a circle I sometimes feel. I managed to salvage an old alpha station from work and there I am again starting to learn yet another OS. Always something new to learn and experiment with. Always the newbie, but that shouldn´t stop you from helping other newbies. Well, now it was my time sitting here (in my chair) and thinking about how it was a couple of years ago. Do what you want with this text. I just had to comment on your text "Why We Should Appreciate Newbies, and Why We Never Will" in Frequency VOLUME 1 ISSUE 2. I hope you will read this text, and maybe you wont agree but continue to write and publish frequency for a while. -REPLY- This is going to be the last article published about newbies for a while, as I think many of us will agree the topic has been played out to death. Nonetheless, I wanted to post this particular email because it focuses on what hackers really are, and where they really are. Just because you go to a channel in irc called #hacker doesn't mean you're necessarily in the company of those that know what they're doing. But this is a problem anywhere you go. There are those that like to be called hackers, and there are those called hackers because of the things they do. As far as treating newbies too harshly, I think you must look at it as a right of passage. When you're going through that passage, it hurts you terribly. So much in fact that you may consider dropping out entirely…well that's the whole point. If you dare call yourself a hacker, you're going to be grilled and made to do things the right way. This is not the same as booing the freshmen at a pep assembly in high school, they have no choice but to go, but newbies do…they go into this with their own free will. If they ask questions, people that have been around for a while are going to make sure they know what to do. And yes, 99% of the time that is reading books and studying all you can. If you don't like that answer, then go be something else. No one can make you a hacker, it's a lot of hard work…but if you really have the hacker way of mind, then you should enjoy every moment of it. Finally, Gedoan points out that he found more real hackers in linux channels. This is a good point considering that these are people who are doing what they do not because of some stupid title, but because they enjoy it. They enjoy learning about computers and other forms of technology, which is what it's really about. I would like to thank Geodan for writing in, and even though I'm not going to publish any more on this topic, you can still feel free to write in and I will read your replies on Hackermind. Thanks again. -screamer -END- 5. ATTENTION KMART SHOPPERS Let's take a look at the logic behind setting up your phone system to allow an extension to your intercom service. Kmart is a great example of this. What follows is meant to show how easy it is to-ah hell it's meant for you to go and fuck with Kmart's intercom service! Just don't do any harm. Kmart's phone system has numerous extensions, some for different parts of the store, others for employee only services…such as the intercom (public address system). By calling up the store, it's possible to be put onto the proper extension…but first you must know what it is. Here is one example of how you can obtain this information: Call up the store and ask for a department (doesn't matter which one). After you're connected to that department, act as though you're from the front desk (they won't know if you're an employee or not). And then ask for the manager. The manager will come on the line, and you then say you're Roy from the Kmart on Claymore Street (just an example, use a real location of another Kmart). Ask him if he's having trouble with his intercom system, because you're having trouble with yours. He will say no, and then you go onto to explain how your intercom is on extension 50…this will seem odd to him, and provide you with an opportunity to ask him what number his store uses. Most likely he will see no reason to hide this from you. Let's assume he says his intercom extension is 450. Next, call up the other Kmart location (the one that you told the manager you were calling from) and ask for the shoe department. An employee will come on the line, tell him/her you're so and so (if the manager from the other store gave you a name, use that) from the other Kmart location. You were wondering if they received their shipment of ladies sneakers. She will, of course, have no clue. So while she's confused, just say "Ok can you just put me through to 450?" and she probably will be happy to…since she doesn't have the answer nor the desire to be bothered. Bingo…you've just been hooked up to the intercom. Say what you want quick, and hang up! ATTENTION KMART SHOPPERS! EVERYTHING IN AISLE 3 IS FREE!!! This will probably work in any store with an intercom, but now for some insider information about Kmart. And this I don't recommend…but hey, information never hurt anyone. Kmart uses special "Caroline" codes in it's stores. When you get on the intercom, saying "Caroline Blue" will indicate a spill. "Caroline White" indicates a tornado outside. And "Caroline Adam" will lock down the entire store! Of course, this is very dangerous as people could be hurt in the confusion. If you MUST attempt this stunt, please limit yourself to only making a quick joke on the intercom and leaving it at that. Besides, Caroline codes may not be used in every location and you may wind up making an ass of yourself. What does this teach us? This teaches us that it's very easy to get your voice on a privately owned intercom system. Hopefully someone in authority will see this and change this ridiculously easy system. The other flaw of this is that it's extremely difficult to disconnect someone who's on the intercom without shutting down the entire PBX or switch. -screamer 6. UNFAIR TREATMENT by: mm We've all experienced it at one point or another in the real world, but now discrimination has bled over into another plane of existence. Cyberspace. While there are those, some say, that deserve this treatment, others believe that people should be judged by their actions and not by their words. To give an example, picture if you will a young man around 16 years of age. Now this young man is fascinated by computers, and loves learning everything he can about them. He eventually finds comfort among others who feel the same way he does. They call themselves hackers, and before long he realizes that he is one of them. Because of this love of electronics and cyberspace, he decides to create a webpage devoted to his favorite hackers of all time. To him, these people are legends and deserve a spot on this infinite net where they can be honored instead of shown in only their mugshots and labeled cyberterrorists. He attempts to get this site hosted on a free server such as 50megs, or any other site for that matter. He carefully reads their terms of use, and when he sees nothing about posting information he creates a site dedicated to these hacker legends. A week later, his site is removed without warning. The website tells him that no such material will be allowed. Why? Because it condones hacking. I won't bore with a discussion of "what is hacking." My point is to show to people that this kind of discrimination should not be allowed. As stated on "Hackermind" it can be said that these free servers have a right to decide the types of material they allow. But to shutdown a site for being dedicated to someone's heroes? Just because they happen to be hackers? Why then would the same server allow someone to create a site with information on serial killers? It makes no sense whatsoever. People, and yes even websites, should be judged by their content and actions…and not by mere words that raise flags, words such as "hacker." All is not lost however, servers such as freeservers.com and brinkster.com all allow users to post information related to hacking…as long as no illegal and/or pirated material is posted. While this may still not please everyone, considering all hackers have different morals, it's definitely a step in the right direction. Perhaps there are those that shouldn't be allowed to have a place on the internet, and we all know those types of people. But the truth is, to take away their right to free speech we must also take away our own. To bring this same idea into a real world environment, consider a person complaining about Eminem's lyrics. He or she can complain all they want, and even demand that he be silenced. What they forget though, is that the only reason they can say what they say is because of the very right they are trying to destroy. 7. CLOSING ARGUMENTS www.hackermind.net has finally gotten a bit of a facelift thanks to D4sh. A news section has been put up on the front page, as well as a bbs (or message board to you web folks.) We will be adding links shortly, so if you want to link with us let us know and we'll get you listed. Of course undergroundnews.com will be the first up thanks to all the support they've given us. I had promised on Hackermind that there would be new article starting this issue entitled "Welcome to the Underground." I have decided to save that for a later issue, as I would prefer to get more facts before I post it. It will chronicle the evolution of the underground world of the internet, as far back as the original phone phreaks that wandered the lines. Also, I had said the final ten questions for my interview would be posted in this issue, but I was only going to do that as a space filler. I believe we had far more important material to post this month than something like that. However, if you would like to be interviewed, feel free to contact me and we'll work something out. For those of you wondering if this issue is a bit shorter than most, you're probably right. But that's only because of the small amount of articles I received. Numerous people said they would write something, but never did. This is fine for me, hey I love writing every month…but this ezine is only as good as the material you send in. I know people don't want to only hear from me, so send those articles in. Got a technical how-to? Send that along as well, but do us a favor and try to stick an opinion in their somewhere…after all that's what we're about. A big thanks to everyone who signed up for our mailing list, I was overwhelmed by the interest this ezine is receiving! Considering emails don't have the same space limitations as the unreliable notepad, it's very possible those of you that subscribe to the mailing list will receive a few extra bonuses from time to time. Regardless, subscribers ALWAYS get hte newest issues first! So go sign up, hey it's free! And finally, we're looking for full time writers here at Frequency. If you'd be interested in contributing an article every month, or whenever needed, contact me and we'll be sure to make you a part of the team and give you a spot on the soon to be "crew" section of the website. It's not exactly the treatment of royalty, but you will get a say in the way things go around here and may even get a chance to be on Hackermind. 8. CREW Editor - in - Chief: Screamer Chaotix Webmaster: D4sh Contributing Writers: DamienAK, Gedoan, mm Tune into Hackermind every Thursday by using Winamp or Real Player to open location 166.90.148.114:9474 every half hour. Articles for Frequency: Inside the Hacker Mind are due by FEBRUARY 8, 2001 Dedicated to those who don't back down. We thank you for staying strong. WWW.HACKERMIND.NET