==Phrack Magazine==



             Volume Four, Issue Forty-Two, File 4 of 14



                          Prelude to a Kiss



    - Lessons Unlearned Are Doomed To Bring Misery Ad-Infinitum -





The following is an article I wrote for a mainstream computer security

periodical called ISPNews.  At the time, I had been discussing the idea

of a bi-monthly column with the editor at that time, Len Spitz. (Now the

editor is Michael Alexander, ex-of Computerworld)



The following article, although very, very tame by my standards, and

admittedly lacking in enough hardcore information to help security

professionals to apply a quick fix to their many problems, caused quite

a stir among the folks at ISPNews.



Since this article was from me, a self-proclaimed hacker, it

underwent an extraordinary amount of scrutiny.  Rather than be

accepted or denied by the editor, my article got the dubious honor of

being sent before an editorial advisory board.  I checked every back

issue of ISPNews and could find no mention of such an entity until the

November/December 1991 issue, the issue immediately following an length

interview with none other than myself.



When I questioned Len Spitz about this rather odd fact, he maintained

that this committee had indeed existed, but stammered his way through my

question to name any other article that they had convened to judge in

the past, and to explain the duties of such a group.  He could not give

me any answers.



The group itself was obviously geared to be a type of kangaroo-court.

It consisted of:



William J. Cook -- The man who less than two years prior had ordered my

                   privacy and civil rights violated by the Secret

                   Service solely on the basis of two bulletin board

                   posts and my association with members of the Legion

                   of Doom and the Phrack Magazine staff.



William H. Murray -- A senior consultant with Deloitte & Touche who had

                     two weeks prior stood up before my presentation to

                     the MIS Training Institute's 11th Annual Conference

                     and said loudly "I can't take this any more, I'm leaving,"

                     to the astounded audience.  The man who went on to

                     state in his own column in ISPNews, "Can we lie

                     down with dogs and get up without fleas?"  and "Ask

                     yourself if you wish to work in a profession

                     populated by rogues.  Ask yourself if you want your

                     reputation mixed with theirs."



Winn Schwartau -- A security consultant with a broad view and an open

                  mind, undoubtedly resulting from his background in the

                  music industry, as opposed to the bean-counting world

                  of MIS.



David J. Stang -- Director of research, NCSA.  Noted virus specialist.



This was the group.  Here is what they said about my article:



Bill Cook --  "It's very well-written and informative, but shouldn't be

published for legal reasons."  (What those reasons might have been were

not stated, nor did Mr. Cook return my call to his office.)



Bill Murray -- Was not even given the file to read, as his response was

deemed to predictable.



Winn Schwartau -- "Publish it.  This is valuable information."



David Stang -- Was not given the file because, according to Len Spitz

"David is just a virus expert, and this isn't in his arena, so we gave

it to Ray Kaplan."



    Ray Kaplan -- Did not want to comment on it because he said, "It's

    not my expertise, so I gave it to a friend."  I believe Ray did not

    want to get involved with anything having to do with hackers after

    the reactionary attitudes of the DECUS attendees towards his defense

    of Kevin Mitnik that nearly left him in bankruptcy.  I cannot blame

    him at all.  (Hell, I like the guy...he's certainly more brazen with

    attitude these days, I mean, he went to HoHoCon for God's-sake!)



      Ray's Friend -- "This is of absolutely no use to the information

      security professional, but of great use to the hacker community."

      I still do not know who Ray's "friend" was.  I hope his

      Alzeheimer's has subsided since this comment.



Needless to say, the article went unpublished.



Shortly thereafter I received a letter from Robert Fox, an assistant

vice-president at Sprint.  Somehow my little article had snaked its

way over to Kansas City.  It's amazing how one faxed copy of an article

could have reached so many people in such a short period of time.

Mr. Fox had the following to say:



------------------------------------------------------------------------



United Telecom/US Sprint

9221 Ward Parkway

Kansas City, Missouri 64114

816-822-6262



Robert F. Fox                                     January 13, 1992

Assistant Vice President

Corporate Security





VIA AIRBORNE EXPRESS



Mr. Chris Goggans

COMSEC

Suite 1470

7322 Southwest Freeway

Houston, TX 77074



    Re:  Your Article "Packet-switched Networks

          Security Begins With Configuration"



Dear Mr. Goggans:



    A copy of the referenced unpublished article, which is

enclosed with this letter, has come to our attention.  After

review, we believe the article is inaccurate and libelous.  If

published the contents of the article could cause damage to Sprint

customers, Sprint and our reputation, and we request that you not

publish or otherwise disseminate it.



     In addition, we believe some of the information contained in

the article has been obtained through violation of the property

rights of Sprint and/or our customers and we demand that you cease

any efforts or attempts to violate or otherwise compromise our

property whether or not for you personal financial gain.



                        Sincerely,



                        Robert F. Fox





Enclosure





------------------------------------------------------------------------





Regardless of how Mr. Fox came into possession of this article, i have to

question his letter based on his comments.   First he states that

the information is almost criminally incorrect and could cause harm to

Sprint's reputation.  Then he states that information in the article has

come to be known through the violation of the security of Sprintnet and/or

clients of Sprintnet.  In effect, I am both a thief and a liar according

to Mr. Fox.  Well, if I were a thief the information could not possibly

be inaccurate if it were obtained from Sprintnet or its clients.  If I

was a liar, why would they think the information came from themselves

and/or their clients?  Mr. Fox's thinly veiled threat caused me great

amusement.



I then decided no mainstream publication would touch this article.  I

don't know why everyone is so scared of the truth.  Perhaps if the truth

were known people would have to work, and perhaps if the truth were

known some people would be out of work.  None of this is of concern to

me anymore.  I am here to speak the truth and to provide uncensored

information gathered from a variety of sources to provide readers of

this magazine the facts they need to quench their thirst for knowledge.



This article is included as a prelude to a series of articles all based

on packet switched networks as related to information merely alluded to

in my harmless little article.  To our readers, "enjoy."  To the cowering

so-called security experts, "kiss my ass."



------------------------------------------------------------------------



Packet-switched Networks



Security Begins with Configuration





For many companies the use of packet-switched networks has

allowed for increased interconnectivity of systems and easy

remote access.  Connection to a major public packet-switched

network brings increased access points with local dialups in

many cities around the nation as well as access

points from foreign countries.



With the many obvious benefits provided by this service,

improper configuration of either the host's connection to the

network or of the network itself can lead to extreme security

problems.



The very connection to a public packet-switched network

immediately increases the exposure of that particular system.

America's two major commercial networks, BT-Tymnet and

Sprintnet, are probably the most popular US targets for hackers

around the world.  The wealth of systems available on

these two networks has provided hackers with a seemly endless

supply of sites on which to sharpen their skills.  The ease of use

inherent in both networks makes them popular for legitimate

users as well as illegitimate users.



The Telenet software utilized in the Sprintnet network allows

users to enter a network user address (NUA) in the standard

format as outlined in the X.121 numbering standard:



DDDDAAAHHHHHPP



Where D = the four digit data network identifier code (DNIC)

      A = the three digit area code corresponding to the host

      H = the host address

      P = the port or (sub) address



On domestic calls the DNIC for Sprintnet (3110) is stored in

all Sprintnet equipment and is used as the default.  By

merely picking an area code, most often corresponding to the standard

area codes of the North American Numbering Plan, and an

additional one to five digits a would-be intruder can

connect to any number of systems while looking for targets.



In the past many software packages have been written to

automate this process, and large scans of the network have

been published in a variety of underground media.



The Tymnet II software utilized in BT's Tymnet

prompts the user for a mnemonic which corresponds to a host

or number of hosts.  The mnemonic, or username, is referenced

to a fixed host address in the network's Master User

Directory (MUD).  This username may allow the caller to

connect to a variety of sites, as opposed to merely one, by

entering additional information in separate fields after the username.

It may also correspond to a network gateway thereby allowing

the user to enter a number in the X.121 format and connect to that

specific site.



This particular network, with its primary use of words as

opposed to numbers, has been compromised by intruders who

guess common words or names in their attempts to connect to

remote sites.



Each network has its own particular set of problems but

solutions to these problems are both simple and quick in

implementation.



SPRINTNET



The first deterrence in securing a host on this

network is to restrict access to the site.  This can be

accomplished in a number of ways.  The most obvious is to

have the site refuse collect calls.  All calls on Sprintnet

are reverse-billed, unless the site has specifically asked

that they not be billed for incoming calls.  This makes the

site accessible only through the use of a Network User

Identifier (NUI).



Another method of restricting access from intruders is to

place the host in a closed user group (CUG).  By electing to

have the host in a CUG, the administrator can allow only

certain NUIs to connect, and can also restrict the actual

addresses from which access is allowed.  For example:  A site

is placed in a CUG that will allow only calls from the

company's remote branch in Dallas to access the host and only

with the NUI created specifically for that branch.  All

attempts to access the site from an address outside the 214

area will result in an error message indicating an invalid

source address.  All attempts to connect with an invalid NUI

will result in an error indicating an invalid ID.  This

information is maintained in the networks main TAMS (TP

Access Management System) database, and is not subject to

manipulation under normal circumstances.



Many sites on the Sprintnet network have specific

subaddresses connecting to a debug port.  This is usually at

subaddress 99.  All connections to debug ports should be

restricted.  Allowing users access to this port will allow

them the ability to load and display memory registers of the

Sprintnet equipment connected to the port, and even reset

as well as enable or disable the host.  Most debug ports are

equipped with preset passwords from the vendor, but should be

changed.  These ports should also restrict connection from

all addresses except those specified by the company.



An additional measure that may foil intruders relying on

software programs to find all addresses in a given area code

is to request that the host be given an address above 10000.

The time involved in scanning the network is extensive and

most casual intruders will not look past the 10000 range.  In

fact, many will not venture past 2000.



BT-TYMNET



Any company having a host on the Tymnet network should choose

a username that is not easily associated with the company or

one that is not a common word or name.  If an intruder is aware that

XYZ Inc. has a UNIX based system on TYMNET he or she would

begin attempts to find this system with the obvious

usernames:  XYZ, XYZINC, XYZNET, XYZ1, XYZUNIX, UNIX, etc.



BT-Tymnet allows for these usernames to have additional

password security as well.  All hosts should have this option

enabled, and passwords should be changed frequently.

The password should always be a minimum of six

digits, should include letters, numbers and at least one symbol

character, and should not be associated in any way with the

corresponding username.



Many clients of BT-Tymnet have purchased the Tymnet II

software and have individual sub-networks that are linked to

the public network through gateways.  Each subnet is

personally configured and maintained through the use of a

package of utilities provided by Tymnet.  These utilities

each perform a specific task and are highly important to the

smooth operation of the network.  These utilities may be

accessed either directly from the host-end or remotely

through the network by entering a corresponding username.

Some of these utilities are:



XRAY : a monitoring utility

DDT : a debugging utility

NETVAL : a database of username to host correspondence

PROBE : a monitoring utility

TMCS : a monitoring utility



Under NO CIRCUMSTANCES should these utilities be left

without a password on the company's subnet.  These utilities should

also never be named similarly to their given name.  Should an

intruder gain access to any of these utilities the integrity

of your network will be at risk.



For example:



Allowing an outsider access to the XRAY utility, would give

he or she the ability to monitor both incoming and outgoing

data from the host using the "TA" command (display trace data

table in ASCII).  Use of certain XRAY commands are restricted

by a security function that allows only certain usernames to

execute commands on the basis of their existence in a

"Goodguy" list, which can be displayed by any XRAY user.

Should a user be of the highest privilege, (2), he or she can

add or delete from the "Goodguy" list, reset connections, and

display trace data on channels other than the default

channel.



Allowing a user access to DDT can result in complete

disruption of the network.  DDT allows the user the ability

to write directly to the network controller "node code" and

alter its configuration.



Allowing a user access to NETVAL will allow the user to

display all usernames active on the network and the

corresponding host addresses.



OTHER PROBLEMS



EXAMPLE ONE



On many networks users have the ability to connect to the

packet assembler/disassembler (PAD) of the network dial-ups.

This has led to significant problems in the past.



In the mid-1980's two American hackers were exploring the

German packet network DATEX-P.  One connected to a host in

Berlin and was immediately disconnected by the remote site.

Before the hacker could react, the German host connected to

the NUA corresponding to his Sprintnet PAD and sent him a

login prompt.  This alarmed the hacker greatly, as he assumed

that the proprietors of the German host had somehow noticed

his attempt to access their system.  He contacted his partner

and told him of the occurrence.  The two concluded that since

the NUA of the origination point is sent in the packet-header,

the remote site must have been programed to recognize the NUA and

then return the call.  The fact that it had returned a call to a

public PAD was intriguing to the pair, so they decided to

attempt to recreate the event by calling each other.  Both

individuals connected to the network and one entered the NUA

corresponding to the others PAD.  A connection resulted and

the two were able to interact with one another.  They then

decided that they would periodically meet in this fashion and

discuss their findings from Germany.  At the time of the next

meeting, the connection did not occur as planned.  One hacker

quickly received a telephone call from the second who

exclaimed rather excitedly that he had attempted to connect

to his partner as planned, but accidentally connected to

another PAD and intercepted a legitimate user typing his NUI.

Further investigation proved that one could connect to public

PADs during the idle period when the user was in network

mode, prior to making a connection to a remote site.  This

discovery was intended to remain secret, because of its

extremely dangerous applications.  Nevertheless, word of this

discovery soon reached the entire hacker community and what

came to be known as "PAD to PAD" was born.



The "PAD to PAD" technique became so wide-spread that hackers

were soon writing software to intercept data and emulate

hosts and capture login names and passwords from unsuspecting

network users.  Hackers were intercepting thousands of calls

every day from users connecting to systems ranging from

banking and credit to the Fortune 500 to government sites.



After nearly two years of "PAD to PAD" Sprintnet became

alerted to the crisis and disallowed all connections to

public PADs.  When Sprintnet expanded its service overseas

they once again left access to the overseas PADs

unrestricted.  The problem went unnoticed again until

their attention was brought to it by a hacker who called

Sprintnet security and told them that they ought to fix it

quickly before it became as wide-spread as before.

The problem was resolved much quicker this time.



This particular technique was not limited to Sprintnet.  All

networks using the Telenet software are at risk to this type

of manipulation.  This type of network manipulation was

integral in the recent compromise of a large Bell Company's packet

network in a much-publicized case.  Certain foreign

networks in countries such as Israel, England, Chile, Panama,

Peru and Brazil are also at risk.



EXAMPLE TWO



In the late 1980's hackers stumbled onto a packet network

owned and maintained by a large facilities maintenance

company.  This particular network had a huge flaw in its

setup.  It connected all calls placed through it as if they

were placed with an NUI.  This allowed hackers to place calls

to addresses that refused collect connections on networks

around the world.  This became a popular method for hackers

to access underground chat systems in Europe.  Additionally,

this network contained a score of computers belonging to a

major automobile manufacturer.  Most of these systems were

highly insecure.  The network also allowed unrestricted

access to network debug ports.  This particular network also

had a toll-free number on an MCI exchange.  At the time, MCI

was having some difficulty getting their equipment to accept

the ANI information to provide customers with a full call-

detail report on their monthly statement.  The hackers were

well aware of this fact and made frequent use of the network

with no fear of prosecution.  Eventually MCI was able to fix

their translation problem and were able to provide their

clients with full call-detail reports.  When this was

learned, many hackers abandoned use of the network, but

several others were later prosecuted for its usage when their

number turned up on the bill.



EXAMPLE THREE



Until quite recently intimate knowledge of the utilities

driving various packet-switched networks were known by an

exclusive few.  While investigating a network owned by an

extremely large Cleveland-based conglomerate hackers came

across a system where documentation on the usage of every

utility was kept online.  The hackers quickly downloaded all

the information and it soon became somewhat wide-spread among

the underground community.  With less-skilled and more

unscrupulous individuals in possession of this information

many networks began experiencing disruptions and system

integrity was quickly lost as hackers began monitoring data

traffic.



No information on the usage of packet networks or their

utilities should ever be kept online.  Hard copies should be

kept in the possession of the network administrator, and when

updated, obsolete versions must be destroyed.



WHAT TO DO



When a security violation stemming from a connection through

the packet network is noticed, Network Security should be

notified.  Clients of BT-Tymnet should notify Steve Matthews

at 408-922-7384.  Clients of Sprintnet should notify

Pat Sisson at 703-689-6913.



Once changes have been enacted in the network to prevent

further break-ins, the host computer should be checked

thoroughly for any changes or damages, and all individual

account passwords should be changed.



CONCLUSION



It is critical that the packet network be configured properly

and that all measures are taken to ensure its security.  Even

the most secure host computer can be easily compromised if it

is connected to an insecure packet network.

----------------------------------------------------------------------