UAPC UPDATE
-----------
by The Plague

I certainly hope you enjoyed my article in the last issue. However the folks 
at UAPC did not. Needless to say, there was a big media
scandal here in New York when 2600 hit the stands last fall. Certain
individuals took it upon themselves to crack UAPC at any cost. As I predicted, 
s cial engineering and trashing were key elements used in cracking the
system. At least one group of hackers was able to get access to more than a 
dozen accounts. They contacted people at 2600 who alerted the media. And
for the first time in America, hackers were the ones to break a story
about hacking. For once, the hackers had the upper hand, which greatly
reduced the amount of inaccuracies in the story. It also made those in
charge of the system look like utter fools.

The almighty school system got very angry and decided to take security 
measures. They claimed that they were going to put UAPC on leased lines by 
January 1990. Well, that hasn't happened, and even if it does happen, the next
few paragraphs will show you how to get around that.

I myself enjoyed rubbing it in to UAPC, by placing certain foul
stickers on their door as well as having some fun engineering their Help Desk
while they were in a state of security alertness. "Hello, is this the UAPC
Help Desk? Yeah? Well you certainly do need help!!" and things of that
sort.

One thing that UAPC did which was very nasty was to place a Project
ID on every single account. Now, that's not a big problem. If you can get
the password, you can get the Project ID in the same way . However, one day I
stumbled onto something interesting. I found out that you can connect to UAPC
through the CUNY/UCC (City University of New York - University Computer Center).
What's even better is that you can connect at up to 2400 baud and use the 
terminal emulation of your choice. But, the very best thing about it is that 
you don't have to provide a Project ID to UAPC if you connect via UCC.
Apparently, the Project ID's are only used when UAPC is accessed via UAPC's own 
dial-up lines.

UCC is a computing server located in Manhatten. It provides high-speed network 
links (SNA) to many computers throughout the CUNY system. UAPC is linked via 
this high-speed network, and there is much less security when accessing UAPC 
via UCC.

Here is what you can do. UCC is a public number, so I might as well give it 
out. It's 212-974-8600 and connects at 300, 1200, and 2400 baud using 7E1 
(seven data bits, even parity, one stop bit). Once connected, you hit 
RETURN a few times. It should ask for terminal type. You can hit return to see
the avaivable terminal types, and then choose one that your software can
emulate. You will then see the UCC opening screen. At that point you hit
the TAB key until the cursor is at the COMMAND line, then type DIAL VTAM
and hit return. You will then see a menu screen of the computers that you can
connect to. You keep hitting TAB (also known as Ctrl-I) until your cursor is at
UAPC and then you hit return. You are now connected to UAPC. You will notice
that UAPC only asks for User ID and Password. It does not ask for Project iD. 
The password input area is divided into three areas. The first is required. 
The other two are optional. The first input area is for the password, the
second is for the password you want to change it to (if the password is valid),
the third is to verify the change. You don't have to worry about that at all. 
You can just type the username followed by return and then the password 
followed by return. As a side note on UCC, you can emulate the PF keys on your 
terminal by using the ESC key. For instance, PF1 is the same thing as hitting 
ESC and then 1.

So now you can see that even if UAPC does go on leased lines, which I'm
willing to bet it will not, you can still access it via UCC. The reason that
I think leased lines are out of the question is because it will severely 
hinder access for legitimate users all throughout the Board of Ed and CUNY.

Apparently, UAPC hacking and abuse has become a rather popular hobby here in 
New York. I'm constantly hearing rumors about people willing to pay cash for 
grade changes and people who can fill that particular service need.