PDEx5RRp

1Ok just a quick note, this is a very early version of the book and
2was later banned. We've done our best in converting it to ASCII.
3It's taken us some time to put it together because of the
4reformatting, so I hope it's appreciated. We have kept to the
5original page numbering for so that the index will be correct.
6Compliments Electronic Images - Gizmo
7Century Communications
8- T H E -
9- H A C K E R ' S -
10- H A N D B O O K -
11Copyright (c) Hugo Cornwall
12All rights reserved
13First published in Great Britain in 1985 by Century Communications Ltd
14Portland House, 12-13 Greek Street, London W1V 5LE.
15Reprinted 1985 (four times)
16ISBN 0 7126 0650 5
17Printed and bound in Great Britain by Billing & Sons Limited, Worcester.
18CONTENTS
19Introduction vii
20First Principles
212 Computer-to-computer communications 7
223 Hackers' Equipment 15
234 Targets: What you can find on mainframes 30
245 Hackers' Intelligence 42
256 Hackers' Techniques 57
267 Networks 69
278 Viewdata systems 86
289 Radio computer data 99
2910 Hacking: the future 108
30Hacker's Handbook
31file:///E|/Books/Hackers Handbook.htm (1 of 133) [11/28/2000 5:58:48 AM]
32Appendices
33I troubleshooting 112
34II Glossary 117
35III CCITT and related standards 130
36IV Standard computer alphabets 132
37V Modems 141
38VI Radio Spectrum 144
39VII Port-finder flow chart 148
40INTRODUCTION
41The word 'hacker' is used in two different but associated
42ways: for some, a hacker is merely a computer enthusiast of any kind,
43who loves working with the beasties for their own sake, as opposed to
44operating them in order to enrich a company or research project --or
45to play games.
46This book uses the word in a more restricted sense: hacking is a
47recreational and educational sport. It consists of attempting to make
48unauthorised entry into computers and to explore what is there. The
49sport's aims and purposes have been widely misunderstood; most
50hackers are not interested in perpetrating massive frauds, modifying
51their personal banking, taxation and employee records, or inducing
52one world super-power into inadvertently commencing Armageddon in the
53mistaken belief that another super-power is about to attack it. Every
54hacker I have ever come across has been quite clear about where the
55fun lies: it is in developing an understanding of a system and
56finally producing the skills and tools to defeat it. In the vast
57majority of cases, the process of 'getting in' is much more
58satisfying than what is discovered in the protected computer files.
59In this respect, the hacker is the direct descendant of the phone
60phreaks of fifteen years ago. Phone phreaking became interesting as
61intra-nation and international subscriber trunk dialling was
62introduced, but when the London-based phreak finally chained his way
63through to Hawaii, he usually had no one there to speak to except the
64local weather service or American Express office, to confirm that the
65desired target had indeed been hit. One of the earliest of the
66present generation of hackers, Susan Headley, only 17 when she began
67her exploits in California in 1977, chose as her target the local
68phone company and, with the information extracted from her hacks, ran
69all over the telephone network. She 'retired' four years later, when
70friends started developing schemes to shut down part of the phone
71system.
72There is also a strong affinity with program copy-protection
73crunchers. Most commercial software for micros is sold in a form to
74prevent obvious casual copying, say by loading a cassette, cartridge
75or disk into memory and then executing a 'save' on to a
76** Page VII
77Hacker's Handbook
78file:///E|/Books/Hackers Handbook.htm (2 of 133) [11/28/2000 5:58:48 AM]
79blank cassette or disk. Copy-protection devices vary greatly in
80their methodology and sophistication and there are those who, without
81any commercial motive, enjoy nothing so much as defeating them. Every
82computer buff has met at least one cruncher with a vast store of
83commercial programs, all of which have somehow had the protection
84removed--and perhaps the main title subtly altered to show the
85cruncher's technical skills--but which are then never actually used
86at all.
87Perhaps I should tell you what you can reasonably expect from this
88handbook. Hacking is an activity like few others: it is semi-legal,
89seldom encouraged, and in its full extent so vast that no individual
90or group, short of an organisation like GCHQ or NSA, could hope to
91grasp a fraction of the possibilities. So this is not one of those
92books with titles like Games Programming with the 6502 where, if the
93book is any good and if you are any good, you will emerge with some
94mastery of the subject-matter. The aim of this book is merely to give
95you some grasp of methodology, help you develop the appropriate
96attitudes and skills, provide essential background and some
97referencing material--and point you in the right directions for more
98knowledge. Up to a point, each chapter may be read by itself; I have
99compiled extensive appendices, containing material which will be of
100use long after the main body of the text has been absorbed.
101It is one of the characteristics of hacking anecdotes, like those
102relating to espionage exploits, that almost no one closely involved
103has much stake in the truth; victims want to describe damage as
104minimal, and perpetrators like to paint themselves as heroes while
105carefully disguising sources and methods. In addition, journalists
106who cover such stories are not always sufficiently competent to write
107accurately, or even to know when they are being hoodwink- ed. (A note
108for journalists: any hacker who offers to break into a system on
109demand is conning you--the most you can expect is a repeat
110performance for your benefit of what a hacker has previously
111succeeded in doing. Getting to the 'front page' of a service or
112network need not imply that everything within that service can be
113accessed. Being able to retrieve confidential information, perhaps
114credit ratings, does not mean that the hacker would also be able to
115alter that data. Remember the first rule of good reporting: be
116sceptical.) So far as possible, I have tried to verify each story
117that appears in these pages, but hackers work in isolated groups and
118my sources on some of the important hacks of recent years are more
119remote than I would have liked. In these
120** Page VIII
121cases, my accounts are of events and methods which, in all the
122circumstances, I believe are true. I welcome notes of correction.
123Experienced hackers may identify one or two curious gaps in the
124range of coverage, or less than full explanations; you can chose any
125combination of the following explanations without causing me any
126worry: first, I may be ignorant and incompetent; second, much of the
127fun of hacking is making your own discoveries and I wouldn't want to
128Hacker's Handbook
129file:///E|/Books/Hackers Handbook.htm (3 of 133) [11/28/2000 5:58:48 AM]
130spoil that; third, maybe there are a few areas which are really best
131left alone.
132Nearly all of the material is applicable to readers in all
133countries; however, the author is British and so are most of his
134experiences.
135The pleasures of hacking are possible at almost any level of
136computer competence beyond rank beginner and with quite minimal
137equipment. It is quite difficult to describe the joy of using the
138world's cheapest micro, some clever firmware, a home-brew acoustic
139coupler and find that, courtesy of a friendly remote PDP11/70, you
140can be playing with Unix, the fashionable multitasking operating
141system.
142The assumptions I have made about you as a reader are that you own a
143modest personal computer, a modem and some communications software
144which you know, roughly, how to use. (If you are not confident yet,
145practise logging on to a few hobbyist bulletin boards.) For more
146advanced hacking, better equipment helps; but, just as very tasty
147photographs can be taken with snap-shot cameras, the computer
148equivalent of a Hasselblad with a trolley- load of accessories is not
149essential.
150Since you may at this point be suspicious that I have vast
151technical resources at my disposal, let me describe the kit that has
152been used for most of my network adventures. At the centre is a
153battered old Apple II+, its lid off most of the time to draw away the
154heat from the many boards cramming the expansion slots. I use an
155industry standard dot matrix printer, famous equally for the variety
156of type founts possible, and for the paper-handling path, which
157regularly skews off. I have two large boxes crammed full of software,
158as I collect comms software in particular like a deranged
159philatelist, but I use one package almost exclusively. As for
160modems--well, at this point the set-up does become unconventional; by
161the phone point are jack sockets for BT 95A, BT 96A, BT 600 and a
162North American modular jack. I have two acoustic couplers, devices
163for plunging telephone handsets into so that the computer can talk
164down the line, at operating speeds of 300/300 and 75/1200. I also
165have three heavy, mushroom coloured 'shoe-boxes', representing modem
166technology of 4 or 5 years ago and operating at various speeds and
167combinations of duplex/half- duplex. Whereas the acoustic coupler
168connects my computer to the line by audio, the modem links up at the
169electrical level and is more accurate and free from error. I have
170access to other equipment in my work and through friends, but this is
171what I use most of the time.
172** Page IX
173Behind me is my other important bit of kit: a filing cabinet.
174Hacking is not an activity confined to sitting at keyboards and
175watching screens. All good hackers retain formidable collections of
176articles, promotional material and documentation; read on, and you
177will see why.
178Hacker's Handbook
179file:///E|/Books/Hackers Handbook.htm (4 of 133) [11/28/2000 5:58:48 AM]
180Finally, to those who would argue that a hacker's handbook must be
181giving guidance to potential criminals, I have two things to say:
182First, few people object to the sports of clay-pigeon shooting or
183archery, although rifles, pistols and crossbows have no 'real'
184purpose other than to kill things--and hackers have their own code of
185responsibility, too. Second, real hacking is not as it is shown in
186the movies and on tv, a situation which the publication of this book
187may do something to correct. The sport of hacking itself may involve
188breach of aspects of the law, notably theft of electricity, theft of
189computer time and unlicensed usage of copyright material; every
190hacker must decide individually each instance as it arises.
191Various people helped me on various aspects of this book; they
192must all remain unnamed--they know who they are and that they have my
193thanks.
194** Page X
195CHAPTER 1
196First Principles
197The first hack I ever did was executed at an exhibition stand run
198by BT's then rather new Prestel service. Earlier, in an adjacent
199conference hall, an enthusiastic speaker had demonstrated view-
200data's potential world-wide spread by logging on to Viditel, the
201infant Dutch service. He had had, as so often happens in the these
202circumstances, difficulty in logging on first time. He was using one
203of those sets that displays auto-dialled telephone numbers; that was
204how I found the number to call. By the time he had finished his third
205unsuccessful log-on attempt I (and presumably several others) had all
206the pass numbers. While the BT staff were busy with other visitors to
207their stand, I picked out for myself a relatively neglected viewdata
208set. I knew that it was possible to by-pass the auto-dialler with its
209pre-programmed phone numbers in this particular model, simply by
210picking up the the phone adjacent to it, dialling my preferred
211number, waiting for the whistle, and then hitting the keyboard button
212labelled 'viewdata'. I dialled Holland, performed my little by-pass
213trick and watched Viditel write itself on the screen. The pass
214numbers were accepted first time and, courtesy of...no, I'll spare
215them embarrassment...I had only lack of fluency in Dutch to restrain
216my explorations. Fortunately, the first BT executive to spot what I
217had done was amused as well.
218Most hackers seem to have started in a similar way. Essentially
219you rely on the foolishness and inadequate sense of security of
220computer salesmen, operators, programmers and designers.
221In the introduction to this book I described hacking as a sport;
222and like most sports, it is both relatively pointless and filled with
223rules, written or otherwise, which have to be obeyed if there is to
224be any meaningfulness to it. Just as rugby football is not only about
225Hacker's Handbook
226file:///E|/Books/Hackers Handbook.htm (5 of 133) [11/28/2000 5:58:48 AM]
227forcing a ball down one end of a field, so hacking is not just about
228using any means to secure access to a computer.
229On this basis, opening private correspondence to secure a password
230on a public access service like Prestel and then running around the
231system building up someone's bill, is not what hackers call hacking.
232The critical element must be the use of skill in some shape or form.
233** Page 1
234Hacking is not a new pursuit. It started in the early 1960s when
235the first "serious" time-share computers began to appear at
236university sites. Very early on, 'unofficial' areas of the memory
237started to appear, first as mere notice boards and scratch pads for
238private programming experiments, then, as locations for games.
239(Where, and how do you think the early Space Invaders, Lunar Landers
240and Adventure Games were created?) Perhaps tech-hacking-- the
241mischievous manipulation of technology--goes back even further. One
242of the old favourites of US campus life was to rewire the control
243panels of elevators (lifts) in high-rise buildings, so that a request
244for the third floor resulted in the occupants being whizzed to the
245twenty-third.
246Towards the end of the 60s, when the first experimental networks
247arrived on the scene (particularly when the legendary
248ARPAnet--Advanced Research Projects Agency network-- opened up), the
249computer hackers skipped out of their own local computers, along the
250packet-switched high grade communications lines, and into the other
251machines on the net. But all these hackers were privileged
252individuals. They were at a university or research resource, and they
253were able to borrow terminals to work with.
254What has changed now, of course, is the wide availability of home
255computers and the modems to go with them, the growth of public-access
256networking of computers, and the enormous quantity and variety of
257computers that can be accessed.
258Hackers vary considerably in their native computer skills; a basic
259knowledge of how data is held on computers and can be transferred
260from one to another is essential. Determination, alertness,
261opportunism, the ability to analyse and synthesise, the collection of
262relevant helpful data and luck--the pre-requisites of any
263intelligence officer--are all equally important. If you can write
264quick effective programs in either a high level language or machine
265code, well, it helps. A knowledge of on-line query procedures is
266helpful, and the ability to work in one or more popular mainframe and
267mini operating systems could put you in the big league.
268The materials and information you need to hack are all around
269you--only they are seldom marked as such. Remember that a large
270proportion of what is passed off as 'secret intelligence' is openly
271available, if only you know where to look and how to appreciate what
272you find. At one time or another, hacking will test everything you
273know about computers and communications. You will discover your
274abilities increase in fits and starts, and you must
275Hacker's Handbook
276file:///E|/Books/Hackers Handbook.htm (6 of 133) [11/28/2000 5:58:48 AM]
277** Page 2
278be prepared for long periods when nothing new appears to happen.
279Popular films and tv series have built up a mythology of what
280hackers can do and with what degree of ease. My personal delight in
281such Dream Factory output is in compiling a list of all the mistakes
282in each episode. Anyone who has ever tried to move a graphics game
283from one micro to an almost-similar competitor will already know that
284the chances of getting a home micro to display the North Atlantic
285Strategic Situation as it would be viewed from the President's
286Command Post would be slim even if appropriate telephone numbers and
287passwords were available. Less immediately obvious is the fact that
288most home micros talk to the outside world through limited but
289convenient asynchronous protocols, effectively denying direct access
290to the mainframe products of the world's undisputed leading computer
291manufacturer, which favours synchronous protocols. And home micro
292displays are memory-mapped, not vector-traced... Nevertheless, it is
293astonishingly easy to get remarkable results. And thanks to the
294protocol transformation facilities of PADs in PSS networks (of which
295much more later), you can get into large IBM devices....
296The cheapest hacking kit I have ever used consisted of a ZX81, 16K
297RAMpack, a clever firmware accessory and an acoustic coupler. Total
298cost, just over ú100. The ZX81's touch-membrane keyboard was one
299liability; another was the uncertainty of the various connectors.
300Much of the cleverness of the firmware was devoted to overcoming the
301native drawbacks of the ZX81's inner configuration--the fact that it
302didn't readily send and receive characters in the industry-standard
303ASCII code, and that the output port was designed more for instant
304access to the Z80's main logic rather than to use industry-standard
305serial port protocols and to rectify the limited screen display.
306Yet this kit was capable of adjusting to most bulletin boards;
307could get into most dial-up 300/300 asynchronous ports,
308re-configuring for word-length and parity if needed; could have
309accessed a PSS PAD and hence got into a huge range of computers not
310normally available to micro-owners; and, with another modem, could
311have got into viewdata services. You could print out pages on the ZX
312'tin-foil' printer. The disadvantages of this kit were all in
313convenience, not in facilities. Chapter 3 describes the sort of kit
314most hackers use.
315It is even possible to hack with no equipment at all. All major
316banks now have a network of 'hole in the wall' cash machines-- ATMs
317or Automatic Telling Machines, as they are officially
318** Page 3
319known. Major building societies have their own network. These
320machines have had faults in software design, and the hackers who
321played around with them used no more equipment than their fingers and
322brains. More about this later.
323Hacker's Handbook
324file:///E|/Books/Hackers Handbook.htm (7 of 133) [11/28/2000 5:58:48 AM]
325Though I have no intention of writing at length about hacking
326etiquette, it is worth one paragraph: lovers of fresh-air walks obey
327the Country Code; they close gates behind them, and avoid damage to
328crops and livestock. Something very similar ought to guide your
329rambles into other people's computers: don't manipulate files unless
330you are sure a back-up exists; don't crash operating systems; don't
331lock legitimate users out from access; watch who you give information
332to; if you really discover something confidential, keep it to
333yourself. Hackers should not be interested in fraud. Finally, just
334as any rambler who ventured past barbed wire and notices warning
335about the Official Secrets Acts would deserve whatever happened
336thereafter, there are a few hacking projects which should never be
337attempted.
338On the converse side, I and many hackers I know are convinced of one
339thing: we receive more than a little help from the system managers of
340the computers we attack. In the case of computers owned by
341universities and polys, there is little doubt that a number of them
342are viewed like academic libraries--strictly speaking they are for
343the student population, but if an outsider seriously thirsty for
344knowledge shows up, they aren't turned away. As for other computers,
345a number of us are almost sure we have been used as a cheap means to
346test a system's defences...someone releases a phone number and
347low-level password to hackers (there are plenty of ways) and watches
348what happens over the next few weeks while the computer files
349themselves are empty of sensitive data. Then, when the results have
350been noted, the phone numbers and passwords are changed, the security
351improved etc etc....much easier on dp budgets than employing
352programmers at £150/man/ day or more. Certainly the Pentagon has been
353known to form 'Tiger Units' of US Army computer specialists to
354pin-point weaknesses in systems security.
355Two spectacular hacks of recent years have captured the public
356imagination: the first, the Great Prince Philip Prestel Hack, is
357described in detail in chapter 8, which deals with viewdata. The
358second was spectacular because it was carried out on live national
359television. It occurred on October 2nd 1983 during a follow-up to the
360BBC's successful Computer Literacy series. It's worth reporting here,
361because it neatly illustrates the essence of hacking as a sport...
362skill with systems, careful research, maximum impact
363** Page 4
364with minimum real harm, and humour.
365The tv presenter, John Coll, was trying to show off the Telecom
366Gold electronic mail service. Coll had hitherto never liked long
367passwords and, in the context of the tight timing and pressures of
368live tv, a two letter password seemed a good idea at the time. On
369Telecom Gold, it is only the password that is truly confidential;
370system and account numbers, as well as phone numbers to log on to the
371system, are easily obtainable. The BBC's account number, extensively
372publicised, was OWL001, the owl being the 'logo' for the tv series as
373well as the BBC computer.
374Hacker's Handbook
375file:///E|/Books/Hackers Handbook.htm (8 of 133) [11/28/2000 5:58:48 AM]
376The hacker, who appeared on a subsequent programme as a 'former
377hacker' and who talked about his activities in general, but did not
378openly acknowledge his responsibility for the BBC act, managed to
379seize control of Coll's mailbox and superimpose a message of his own:
380Computer Security Error. Illegal access. I hope your television
381PROGRAMME runs as smoothly as my PROGRAM worked out your passwords!
382Nothing is secure!
383Hackers' Song
384"Put another password in,
385Bomb it out and try again
386Try to get past logging in,
387We're hacking, hacking, hacking
388Try his first wife's maiden name,
389This is more than just a game,
390It's real fun, but just the same,
391It's hacking, hacking, hacking"
392The Nutcracker (Hackers UK)
393HI THERE, OWLETS, FROM OZ AND YUG
394(OLIVER AND GUY)
395After the hack a number of stories about how it had been carried
396out, and by whom, circulated; it was suggested that the hackers had
397crashed through to the operating system of the Prime computers upon
398which the Dialcom electronic mail software
399** Page 5
400resided--it was also suggested that the BBC had arranged the whole
401thing as a stunt, or alternatively, that some BBC employees had fixed
402it up without telling their colleagues. Getting to the truth of a
403legend in such cases is almost always impossible. No one involved has
404a stake in the truth. British Telecom, with a strong commitment to
405get Gold accepted in the business community, was anxious to suggest
406that only the dirtiest of dirty tricks could remove the inherent
407confidentiality of their electronic mail service. Naturally, the
408British Broadcasting Corporation rejected any possibility that it
409would connive in an irresponsible cheap stunt. But the hacker had no
410great stake in the truth either--he had sources and contacts to
411protect, and his image in the hacker community to bolster. Never
412expect any hacking anecdote to be completely truthful.
413** Page 6
414CHAPTER 2
415Hacker's Handbook
416file:///E|/Books/Hackers Handbook.htm (9 of 133) [11/28/2000 5:58:48 AM]
417Computer-to-Computer
418Communications
419Services intended for access by microcomputers are nowadays
420usually presented in a very user-friendly fashion: pop in your
421software disc or firmware, check the connections, dial the telephone
422number, listen for the tone...and there you are. Hackers, interested
423in venturing where they are not invited, enjoy no such luxury. They
424may want to access older services which preceded the modern 'human
425interface'; they are very likely to travel along paths intended, not
426for ordinary customers, but for engineers or salesmen; they could be
427utilising facilities that were part of a computer's commissioning
428process and have been hardly used since.
429So the hacker needs a greater knowledge of datacomms technology than
430does a more passive computer user, and some feeling for the history
431of the technology is pretty essential, because of its growth pattern
432and because of the fact that many interesting installations still use
433yesterday's solutions.
434Getting one computer to talk to another some distance away means
435accepting a number of limiting factors:
436* Although computers can send out several bits of information at
437once, the ribbon cable necessary to do this is not economical at any
438great length, particularly if the information is to be sent out over
439a network--each wire in the ribbon would need switching separately,
440thus making ex- changes prohibitively expensive. So bits must be
441transmitted one at a time, or serially.
442** Page 7
443* Since you will be using, in the first instance, wires and networks
444already installed--in the form of the telephone and telex
445networks--you must accept that the limited bandwidth of these
446facilities will restrict the rate at which data can be sent. The data
447will pass through long lengths of wire, frequently being
448re-amplified, and undergoing de- gradation as it passes through dirty
449switches and relays in a multiplicity of exchanges.
450* Data must be easily capable of accurate recovery at the far end.
451* Sending and receiving computers must be synchronised in their
452working.
453* The mode in which data is transmitted must be one understood by
454all computers; accepting a standard protocol may mean adopting the
455speed and efficiency of the slowest.
456* The present 'universal' standard for data transmission used by
457microcomputers and many other services uses agreed tones to signify
458binary 0 and binary 1, the ASCII character set (also known as
459International Alphabet No 5), and an asynchronous protocol, whereby
460Hacker's Handbook
461file:///E|/Books/Hackers Handbook.htm (10 of 133) [11/28/2000 5:58:48 AM]
462the transmitting and receiving computers are locked in step every
463time a character is sent, not just at the beginning of a transmission
464stream. Like nearly all standards, it is highly arbitrary in its
465decisions and derives its importance simply from the fact of being
466generally accepted. Like many standards, too, there are a number of
467subtle and important variations.
468To see how the standard works, how it came about and the reasons
469for the variations, we need to look back a little into history.
470The Growth of Telegraphy
471The essential techniques of sending data along wires has a history
472of 150 years, and some of the common terminology of modern data
473transmission goes right back to the first experiments.
474The earliest form of telegraphy, itself the earliest form of
475electrical message sending, used the remote actuation of electrical
476relays to leave marks on a strip of paper. The letters of the
477alphabet were defined by the patterns of 'mark' and 'space'.
478** Page 8
479The terms have come through to the present, to signify binary
480conditions of '1' and '0' respectively. The first reliable machine
481for sending letters and figures by this method dates from 1840; the
482direct successor of that machine, using remarkably unchanged
483electromechanical technology and a 5-bit alphabetic code, is still
484widely used today, as the telex/teleprinter/teletype. The mark and
485space have been replaced by holes punched in paper-tape: larger holes
486for mark, smaller ones for space. Synchronisation between sending and
487receiving stations is carried out by beginning each letter with a
488'start' bit (a space) and concluding it with a 'stop' bit (mark). The
489'idle' state of a circuit is thus 'mark'. In effect, therefore, each
490letter requires the transmission of 7 bits:
491. * * . . . * (letter A: . = space; * = mark)
492of which the first . is the start bit, the last * is the stop bit and
493* * . .. is the code for A.
494This is the principle means for sending text messages around the
495world, and the way in which news reports are distributed globally.
496And, until third-world countries are rich enough to afford more
497advanced devices, the technology will survive.
498Early computer communications
499When, 110 years after the first such machines came on line, the
500need arose to address computers remotely, telegraphy was the obvious
501way to do so. No one expected computers in the early 1950s to give
502instant results; jobs were assembled in batches, often fed in by
503means of paper-tape (another borrowing from telex, still in use) and
504Hacker's Handbook
505file:///E|/Books/Hackers Handbook.htm (11 of 133) [11/28/2000 5:58:48 AM]
506then run. The instant calculation and collation of data was then
507considered quite miraculous. So the first use of data communications
508was almost exclusively to ensure that the machine was fed with
509up-to-date information, not for the machine to send the results out
510to those who might want it; they could wait for the 'print-out' in
511due course, borne to them with considerable solemnity by the computer
512experts. Typical communications speeds were 50 or 75 baud. (The baud
513is the measure of speed of data transmission: specifically, it refers
514to the number of signal level changes per second and is thus not the
515same as bits-per-second.)
516These early computers were, of course, in today's jargon,
517single-user/single-task; programs were fed by direct machine coding.
518Gradually, over the next 15 years, computers spawned multi-user
519capabilities by means of time-sharing techniques, and their human
520interface became more 'user-friendly'.
521** Page 9
522With these facilities grew the demand for remote access to
523computers, and modern data communications began.
524Even at the very end of the 1960s when I had my own very first
525encounter with a computer, the links with telegraphy were still
526obvious. As a result of happenstance, I was in a Government-run
527research facility to the south-west of London, and the program I was
528to use was located on a computer just to the north of Central London;
529I was sat down in front of a battered teletype--capitals and figures
530only, and requiring not inconsiderable physical force from my
531smallish fingers to actuate the keys of my choice. As it was a
532teletype outputting on to a paper roll, mistakes could not as readily
533be erased as on a VDU, and since the sole form of error reporting
534consisted of a solitary ?, the episode was more frustrating than
535thrilling. VDUs and good keyboards were then far too expensive for
536'ordinary' use.
537The telephone network
538But by that time all sorts of changes in datacomms were taking
539place. The telex and telegraphy network, originally so important, had
540long been overtaken by voice-grade telephone circuits (Bell's
541invention dates from 1876). For computer communication, mark and
542space could be indicated by different audio tones, rather than by
543different voltage conditions. Data traffic on a telex line can
544operate in only one direction at a time, but, by selecting different
545pairs of tones, both 'transmitter' and 'receiver' could speak
546simultaneously--so that in fact, one has to talk about 'originate'
547and 'answer' instead.
548Improved electrical circuit design meant that higher speeds than
54950 or 75 baud became possible; there was a move to 110 baud, then 300
550and, so far as ordinary telephone circuits are concerned, 1200 baud
551is now regarded as the top limit.
552Hacker's Handbook
553file:///E|/Books/Hackers Handbook.htm (12 of 133) [11/28/2000 5:58:48 AM]
554The 'start' and 'stop' method of synchronising the near and far
555end of a communications circuit at the beginning of each individual
556letter has been retained, but the common use of the 5-bit Baudot code
557has been replaced by a 7-bit extended code which allows for many more
558characters, 128 in fact.
559Lastly, to reduce errors in transmission due to noise in the
560telephone line and circuitry, each letter can be checked by the use
561of a further bit (the parity bit), which adds up all the bits in the
562main character and then, depending on whether the result is odd or
563even, adds a binary 0 or binary 1.
564The full modern transmission of a letter in this system, in this
565case, K, therefore, looks like this:
566** Page 10
567START-STOP TRANSMISSION OF A DATA CHARACTER
568TIME
569INTERVAL_____________9___0___1___2___3___4___5___6___7___8___9___
570NUMBER
5711 1 1 1 1 1
572Mark +---+ +---+ +---+ +---+---+ +---+
573LINE | | 0 | | 0 0 | | 0 | | 0 | |
574CONDITION Space-+ +---+ +---+---+ +---+ +---+ +-
575^ ^
576| |
577BINARY STOP-+ START 1 0 0 1 0 1 1 0
578DIGIT
579The first 0 is the start bit; then follows 7 bits of the actual
580letter code (1001011); then the parity bit; then the final 1 is the
581stop code.
582This system, asynchronous start-stop ASCII (the common name for
583the alphabetic code), is the basis for nearly all micro-based
584communications. The key variations relate to:
585bit-length; you can have 7 or 8 databits (*)
586parity; (it can be even or odd, or entirely absent),
587Tones - The tones used to signify binary 0 and binary 1, and which
588computer is in 'originate' and which in 'answer', can vary according
589to the speed of the transmission and also to whether the service is
590used in North America or the rest of the world. (Briefly, most of
591the world uses tones and standards laid down by the Geneva-based
592organisation, CCITT, a specialised agency of the International
593Telecommunications Union; whereas in the United States and most parts
594of Canada, tones determined by the telephone utility, colloquially
595known as Ma Bell, are adopted.) The following table gives the
596standards and tones in common use.
597Hacker's Handbook
598file:///E|/Books/Hackers Handbook.htm (13 of 133) [11/28/2000 5:58:48 AM]
599(*) There are no 'obvious explanations' for the variations commonly
600found: most electronic mail services and viewdata transmit 7 data
601bits, even parity and I stop Bit; Telecom Gold and most hobbyist
602bulletin boards transmit 8 data bits, odd parity and 1 stop bit.
603Terminal emulator software--see chapter 3--allows users to adjust for
604these differing requirements.
605** Page 11
606Service Speed Duplex Transmit Receive Answer
607Designator 0 1 0 1
608V21 orig 300(*) full 1180 980 1850 1650 -
609V21 ans 300(*) full 1850 1650 1180 980 2100
610V23 (1) 600 half 1700 1300 1700 1300 2100
611V23 (2) 1200 f/h(**) 2100 1300 2100 1300 2100
612V23 back 75 f/h(**) 450 390 450 390 -
613Bell 103 orig 300(*) full 1070 1270 2025 2225 -
614Bell 103 ans 300(*) full 2025 2225 1070 1270 2225
615Bell 202 1200 half 2200 1200 2200 1200 2025
616(*)any speed up to 300 baud, can also include 75 and 110 baud
617services
618(**)service can either be half-duplex at 1200 baud or asymmetrical
619full duplex, with 75 baud originate and 1200 baud receive (commonly
620used as viewdata user) or 1200 transmit and 75 receive (viewdata
621host)
622Higher Speeds
6231200 baud is usually regarded as the fastest speed possible on an
624ordinary voice-grade telephone line. Beyond this, noise on the line
625due to the switching circuits at the various telephone exchanges,
626poor cabling, etc. make accurate transmission difficult. Indeed, at
627higher speeds it becomes increasingly important to use transmission
628protocols that include error correction.
629Error correction techniques usually consist of dividing the
630transmission stream into a series of blocks which can be checked, one
631at a time, by the receiving computer. The 'parity' system mentioned
632above is one example, but obviously a crude one. The difficulty is
633that the more secure an error-correction protocol becomes, the
634greater becomes the overhead in terms of numbers of bits transmitted
635to send just one character from one computer to another. Thus, in the
636typical 300 bit situation, the actual letter is defined by 7 bits,
637'start' and 'stop' account for another two, and the check takes a
638further one--ten in all. After a while, what you gain in the speed
639with which each actual bit is transmitted, you lose, because so many
640bits have to be sent to ensure that a single character is accurately
641received!
642** Page 12
643Hacker's Handbook
644file:///E|/Books/Hackers Handbook.htm (14 of 133) [11/28/2000 5:58:48 AM]
645Although some people risk using 2400 baud on ordinary telephone
646lines--the jargon is the PTSN (Public Telephone Switched
647Network)--this means using expensive modems. Where higher speeds are
648essential, leased circuits, not available via dial-up. become
649essential. The leased circuit is paid for on a fixed charge, not a
650charge based on time-connected. Such circuits can be conditioned',
651for example by using special amplifiers, to support the higher data
652rate.
653For really high speed transmissions, however, pairs of copper
654cable are inadequate. Medium speed is obtainable by the use of
655coaxial cable (a little like that used for tv antenna hook-ups) which
656have a very broad bandwidth. Imposing several different channels on
657one cable-length is called multiplexing and, depending on the
658application, the various channels can either carry several different
659computer conversations simultaneously or can send several bits of one
660computer conversation in parallel, just as though there were a ribbon
661cable between the two participating computers. Either way, what
662happens is that each binary 0 or binary 1 is given, not an audio
663tone, but a radio frequency tone.
664Synchronous Protocols
665In the asynchronous protocols so far described, transmitting and
666receiving computers are kept in step with each other every time a
667character is sent, via the 'start' and 'stop' bits. In synchronous
668comms, the locking together is done merely at the start of each block
669of transmission by the sending of a special code (often SYN). The SYN
670code starts a clock (a timed train of pulses) in the receiver and it
671is this that ensures that binary 0s and 1s originating at the
672transmitter are correctly interpreted by the receiver; clearly, the
673displacement of even one binary digit can cause havoc.
674A variety of synchronous protocols exist, such as the length of
675block sent each time, the form of checking that takes place, the form
676of acknowledgement, and so on. A synchronous protocol is not only a
677function of the modem, which has to have a suitable clock, but also
678of the software and firmware in the computers. Because asynchronous
679protocols transmit so many 'extra' bits in order to avoid error,
680savings in transmission time under synchronous systems often exceed
68120-30%. The disadvantage of synchronous protocols lie in increased
682hardware costs.
683One other complication exists: most asynchronous protocols use the
684ASCII code to define characters. IBM ('Big Blue'), the biggest
685enthusiast of synchronous comms, has its own binary code to define
686characters. In Appendix IV, you will find an explanation and a
687comparison with ASCII.
688** Page 13
689The hacker, wishing to come to terms with synchronous comms, has
690two choices: the more expensive is to purchase a protocol convertor
691board. These are principally available for the IBM PC, which has been
692Hacker's Handbook
693file:///E|/Books/Hackers Handbook.htm (15 of 133) [11/28/2000 5:58:48 AM]
694increasingly marketed for the 'executive workstation' audience, where
695the ability to interface to a company's existing (IBM) mainframe is a
696key feature. The alternative is to see whether the target mainframe
697has a port on to a packet- switched service; in that event, the
698hacker can use ordinary asynchronous equipment and protocols--the
699local PAD (Packet Assembler/Disassembler) will carry out the
700necessary transformations.
701Networks
702Which brings us neatly to the world of high-speed digital networks
703using packet-switching. All the computer communications so far
704described have taken place either on the phone (voice-grade) network
705or on the telex network.
706In Chapter 7 we will look at packet-switching and the
707opportunities offered by international data networks. We must now
708specify hackers' equipment in more detail.
709** Page 14
710CHAPTER 3
711Hackers' Equipment
712You can hack with almost any microcomputer capable of talking to
713the outside world via a serial port and a modem. In fact, you don't
714even need a micro; my first hack was with a perfectly ordinary
715viewdata terminal.
716What follows in this chapter, therefore, is a description of the
717elements of a system I like to think of as optimum for
718straight-forward asynchronous ASCII and Baudot communications. What
719is at issue is convenience as much as anything. With kit like this,
720you will be able to get through most dial-up ports and into
721packet-switching through a PAD -- a packet assembler/ disassembler
722port. (It will not get you into IBM networks, because these use
723different and incompatible protocols; we will return to the matter of
724the IBM world in chapter 10.) In other words, given a bit of money, a
725bit of knowledge, a bit of help from friends and a bit of luck, what
726is described here is the sort of equipment most hackers have at their
727command.
728You will find few products on the market labelled 'for hackers';
729you must select those items that appear to have 'legitimate' but
730interesting functions and see if they can be bent to the hacker's
731purposes. The various sections within this chapter highlight the sort
732of facilities you need; before lashing out on some new software or
733hardware, try to get hold of as much publicity and documentation
734material as possible to see how adaptable the products are. In a few
735cases, it is worth looking at the second-hand market, particularly
736Hacker's Handbook
737file:///E|/Books/Hackers Handbook.htm (16 of 133) [11/28/2000 5:58:48 AM]
738for modems, cables and test equipment.
739Although it is by no means essential, an ability to solder a few
740connections and scrabble among the circuit diagrams of 'official'
741products often yield unexpectedly rewarding results.
742The computer
743Almost any popular microcomputer will do; hacking does not call
744upon enormous reserves of computer power. Nearly everything you hack
745will come to you in alphanumeric form, not graphics. The computer
746you already have will almost certainly have the essential qualities.
747However the very cheapest micros, like the ZX81, whilst usable,
748require much more work on the part of the operator/hacker, and give
749him far less in the way of instant facilities.
750** Page 15
751(In fact, as the ZX81 doesn't use ASCII internally, but a
752Sinclair-developed variant; you will need a software or firmware fix
753for that, before you even think of hooking it up to a modem.)
754Most professional data services assume the user is viewing on an
75580-column screen; ideally the hacker's computer should be capable of
756doing that as well, otherwise the display will be full of awkward
757line breaks. Terminal emulator software (see below) can some- times
758provide a 'fix'.
759One or two disc drives are pretty helpful, because you will want
760to be able to save the results of your network adventures as quickly
761and efficiently as possible. Most terminal emulators use the
762computer's free memory (i.e. all that is not required to support the
763operating system and the emulator software itself) as store for the
764received data, but once the buffer is full, you will begin to lose
765the earliest items. You can, of course, try to save to cassette, but
766normally that is a slow and tedious process.
767An alternative storage method is to save to a printer, printing
768the received data stream not only to the computer screen, but also on
769a dot matrix printer. However, most of the more popular (and cheaper)
770printers do not work sufficiently fast. You may find you lose
771characters at the beginning of each line. Moreover, if you print
772everything in real-time, you'll include all your mistakes, false
773starts etc., and in the process use masses of paper. So, if you can
774save to disc regularly, you can review each hack afterwards at your
775leisure and, using a screen editor or word processor, save or print
776out only those items of real interest.
777Serial ports
778The computer must have a serial port, either called that or marked
779RS232C (or its slight variant RS423), or V24, which is the official
780designator of RS232C used outside the USA, though not often seen on
781Hacker's Handbook
782file:///E|/Books/Hackers Handbook.htm (17 of 133) [11/28/2000 5:58:48 AM]
783micros.
784The very cheapest micros, like the ZX81, Spectrum, VIC20, do not
785have RS232C ports, though add-on boards are available. Some of the
786older personal computers, like the Apple or the original Pet, were
787also originally sold without serial ports, though standard boards are
788available for all of these.
789You are probably aware that the RS232C standard has a large number
790of variants, and that not all computers (or add-on boards) that claim
791to have a RS232C port can actually talk into a modem.
792Historically, RS232C/V24 is supposed to cover all aspects of
793serial communication, including printers and dumb terminals as well
794as computers. The RS232C standard specifies electrical and physical
795requirements.
796** Page 16
797Everything is pumped through a 25-pin D-shaped connector, each pin
798of which has some function in some implementation. But in most cases,
799nearly all the pins are not used. In practice, only three connections
800are essential for computer to modem communication:
801Pin 7 signal ground
802Pin 2 characters leaving the computer
803Pin 3 characters arriving at the computer
804The remaining connections are for such purposes as feeding power
805to an external device, switching the external advice on or off,
806exchanging status and timing signals, monitoring the state of the
807line, and so forth. Some computers and their associated firmware
808require one or other of these status signals to go 'high' or 'low' in
809particular circumstances, or the program hangs. Check your
810documentation if you have trouble.
811Some RS232C implementations on microcomputers or add-on boards are
812there simply to support printers with serial interfaces, but they can
813often be modified to talk into modems. The critical two lines are
814those serving Pins 2 and 3.
815A computer serving a modem needs a cable in which Pin 2 on the
816computer is linked to Pin 2 on the modem.
817A computer serving a printer, etc, needs a cable in which Pin 3 on
818the: computer is linked to Pin 2 on the printer and Pin 3 on the
819printer is linked to Pin 2 on the computer.
820If two computers are linked together directly, without a modem,
821then Pin 2 on computer A must be linked to Pin 3 on computer B and
822Pin 3 on computer B linked to Pin 2 on computer A: this arrangement
823is sometimes called a 'null modem' or a 'null modem cable'.
824Hacker's Handbook
825file:///E|/Books/Hackers Handbook.htm (18 of 133) [11/28/2000 5:58:48 AM]
826There are historic explanations for these arrangements, depending
827on who you think is sending and who is receiving--forget about them,
828they are confusing. The above three cases are all you need to know
829about in practice.
830One difficulty that frequently arises with newer or portable
831computers is that some manufacturers have abandoned the traditional
83225-way D-connector, largely on the grounds of bulk, cost and
833redundancy. Some European computer and peripheral companies favour
834connectors based on the DIN series (invented in Germany), while
835others use D-connectors with fewer pin-outs.
836** Page 17
837There is no standardisation. Even if you see two physically
838similar connectors on two devices, regard them with suspicion. In
839each case, you must determine the equivalents of:
840Characters leaving computer (Pin 2)
841Characters arriving at computer (Pin 3)
842Signal ground (Pin 7)
843You can usually set the speed of the port from the computer's
844operating system and/or from Basic. There is no standard way of doing
845this; you must check your handbook and manuals. Most RS232C ports can
846handle the following speeds:
84775, 110, 300, 600, 1200, 2400, 4800, 9600
848and sometimes 50 and 19200 baud as well. These speeds are selectable
849in hardware by appropriate wiring of a chip called a baud-rate
850generator. Many modern computers let you select speed in hardware by
851means of a DIL switch. The higher speeds are used either for driving
852printers or for direct computer-to-computer or computer-to-peripheral
853connections. The normal maximum speed for transmitting along phone
854lines is 1200 baud.
855Depending on how your computer has been set up, you may be able to
856control the speed from the keyboard--a bit of firmware in the
857computer will accept micro-instructions to flip transistor switches
858controlling the wiring of the baud-rate generator. Alternatively,
859the speeds may be set in pure software, the micro deciding at what
860speed to feed information into the serial port.
861In most popular micro implementations the RS232C cannot support
862split-speed working (different speeds for receive and transmit). If
863you set the port up for 1200 baud, it has to be 1200 receive and
864transmit. This is a nuisance in Europe, where 75/1200 is in common
865use both for viewdata systems and for some on-line services. The
866usual way round is to have special terminal emulator software, which
867requires the RS232C hardware to operate at 1200 /1200 and then slows
868down (usually the micro's transmit path) to 75 baud in software by
869means of a timing loop. An alternative method relies on a special
870modem, which accepts data from the computer at 1200/1200 and then
871Hacker's Handbook
872file:///E|/Books/Hackers Handbook.htm (19 of 133) [11/28/2000 5:58:48 AM]
873performs the slowing-down to 75 baud in its own internal firmware.
874Terminal emulators
875We all need a quest in life. Sometimes I think mine is to search
876for the perfect software package to make micros talk to the outside
877world.
878** Page 18
879As in all such quests, the goal is occasionally approached but
880never reached, if only because the process of the quest causes one to
881redefine what one is looking for.
882These items of software are sometimes called communications
883packages, or asynchronous comms packages, and sometimes terminal
884emulators, on the grounds that the software can make the micro appear
885to be a variety of different computer terminals. Until recently, most
886on-line computer services assumed that they were being examined
887through 'dumb' terminals--simply a keyboard and a screen, with no
888attendant processing or storage power (except perhaps a printer).
889With the arrival of PCs all this is slowly changing, so that the
890remote computer has to do no more than provide relatively raw data
891and all the formatting and on-screen presentation is done by the
892user's own computer. Terminal emulator software is a sort of
893half-way house between 'dumb' terminals and PCs with considerable
894local processing power.
895Given the habit of manufacturers of mainframe and mini- computers
896to make their products as incompatible with those of their
897competitors as possible (to maximise their profits), many slight
898variants on the 'dumb' computer terminal exist--hence the
899availability of terminal emulators to provide, in one software
900package, a way of mimicking all the popular types.
901Basic software to get a computer to talk through its RS232C port,
902and to take in data sent to it, is trivial. What the hacker needs is
903software that will make his computer assume a number of different
904personalities upon command, store data as it is collected, and print
905it out.
906Two philosophies of presenting such software to the user exist:
907first, one which gives the naive user a simple menu which says, in
908effect, 'press a key to connect to database' and then performs
909everything smoothly, without distracting menus. Such programs need an
910'install' procedure, which requires some knowledge, but most
911'ordinary' users never see this. Normally, this is a philosophy of
912software writing I very much admire: however, as a hacker you will
913want the precise opposite. The second approach to terminal emulator
914software allows you to re configure your computer as you go on--there
915is plenty of on-screen help in the form of menus allowing you to turn
916on and off local echo, set parity bits, show non-visible control
917codes and so on. In a typical hack, you may have only vague
918information about the target computer, and much of the fun is seeing
919Hacker's Handbook
920file:///E|/Books/Hackers Handbook.htm (20 of 133) [11/28/2000 5:58:48 AM]
921how quickly you can work out what the remote computer wants to 'see'
922- and how to make your machine respond.
923** Page 19
924Given the numbers of popular computers on the market, and the
925numbers of terminal emulators for each one, it is difficult to make a
926series of specific recommendations. What follows there- fore, is a
927list of the sort of facilities you should look for:
928On-line help You must be able to change the software
929characteristics while on-line--no separate 'install' routine. You
930should be able to call up 'help' menus instantly, with simple
931commands --while holding on to the line.
932Text buffer - The received data should be capable of going into the
933computer's free memory automatically so that you can view it later
934off-line. The size of the buffer will depend on the amount of memory
935left after the computer has used up the space required for its
936operating system and the terminal software. If the terminal software
937includes special graphics, as in Apple Visiterm or some of the ROM
938packs used with the BBC, the buffer space may be relatively small.
939The software should tell you how much buffer space you have used and
940how much is left, at any time. A useful adjunct is an auto-save
941facility which, when the buffer becomes full, stops the stream of
942text from the host computer and automatically saves the buffer text
943to disc. A number of associated software commands should let you turn
944on and off the buffer store, clear it or, when off-line, view the
945buffer. You should also be able to print the buffer to a 'line'
946printer (dot-matrix or daisy wheel or thermal image). Some terminal
947emulators even include a simple line editor, so that you can delete
948or adjust the buffer before printing. (I use a terminal emulator
949which saves text files in a form which can be accessed by my
950word-processor and use that before printing out.)
951Half/full Duplex (Echo On/Off) - Most remote services use an echoing
952protocol: this means that when the user sends a character to the host
953computer, the host immediately sends back the same character to the
954user's computer, by way of confirmation. What the user sees on his
955computer screen, therefore, has been generated, not locally by his
956direct action on the keyboard, but remotely by the host computer.
957(One effect of this is that there may sometimes be a perceptible
958delay between keystroke and display of a letter, particularly if you
959are using a packet-switched connection--if the telephone line is
960noisy, the display may appear corrupt). This echoing protocol is
961known as full duplex, because both the user's computer and the host
962are in communication simultaneously.
963However, use of full duplex/echo is not universal, and all
964terminal emulators allow you to switch on and off the facility. If,
965for example, you are talking into a half-duplex system (i.e. no
966echo), your screen would appear totally blank. In these
967circumstances, it is best if your software reproduces on the screen
968your keystrokes.
969Hacker's Handbook
970file:///E|/Books/Hackers Handbook.htm (21 of 133) [11/28/2000 5:58:48 AM]
971** Page 20
972However, if you have your computer set for half-duplex and the host
973computer is actually operating in full duplex. each letter will
974appear twice--once from the keyboard and once, echoing from the host,
975ggiiwiinngg tthhiiss ssoorrtt ooff eeffffeecctt. Your terminal
976emulator needs to able to toggle between the two states.
977Data Format/Parity Setting - In a typical asynchronous protocol, each
978character is surrounded by bits to show when it starts, when it ends,
979and to signify whether a checksum performed on its binary equivalent
980comes out even or odd. The character itself is described, typically,
981in 7 bits and the other bits, start, stop and parity, bringing the
982number up to 10. (See chapter 2.) However, this is merely one very
983common form, and many systems use subtle variants -- the ideal
984terminal emulator software will let you try out these variants while
985you are still on line. Typical variants should include:
986Word length Parity No stop bits
9877 Even 2
9887 Odd 2
9897 Even 1
9907 Odd 1
9918 None 2
9928 None 1
9938 Even 1
9948 Odd 1
995(NB although the ASCII character set is 7 bit, 8 bits are sometimes
996transmitted with a ~padding~ bit; machine code instructions for 8-bit
997and 16-bit machines obviously need 8-bit transmissions.)
998Show Control Characters - This is a software switch to display
999characters not normally part of the text that is meant to be read but
1000which nevertheless are sent by the host computer to carry out display
1001functions, operate protocols, etc. With the switch on, you will see
1002line feeds displayed as ^J, a back-space as ^H and so on; see
1003Appendix IV for the usual equivalents.
1004Using this device properly you will be able, if you are unable to
1005get the text stream to display properly on your screen, to work out
1006what exactly is being sent from the host, and modify your local
1007software accordingly.
1008** Page 21
1009Control-Show is also useful for spotting 'funnies' in passwords and
1010log-on procedures--a common trick is to include ^H (backspace) in the
1011middle of a log-on so that part of the full password is overwritten.
1012(For normal reading of text, you have Control-Show switched off, as
1013it makes normal reading difficult.)
1014Macros - This is the US term, now rapidly being adopted in the UK,
1015Hacker's Handbook
1016file:///E|/Books/Hackers Handbook.htm (22 of 133) [11/28/2000 5:58:48 AM]
1017for the preformatting of a log-on procedure, passwords etc. Typical
1018connecting procedures to US services like The Source, CompuServe, Dow
1019Jones etc are relatively complicated, compared with using a local
1020hobbyist bulletin board or calling up Prestel. Typically, the user
1021must first connect to a packet- switched service like Telenet or
1022Tymnet (the US commercial equivalents of BT's PSS), specify an
1023'address' for the host required (a long string of letters and
1024numbers) and then, when the desired service or 'host' is on line,
1025enter password(s) to be fully admitted. The password itself may be in
1026several parts.
1027The value of the 'macro' is that you can type all this junk in
1028once and then send off the entire stream any time you wish by means
1029of a simple command. Most terminal emulators that have this feature
1030allow you to preformat several such macros.
1031From the hacker's point of view, the best type of macro facility
1032is one that can be itself addressed and altered in software:
1033supposing you have only part of a password: write a little routine
1034which successively tries all the unknowns; you can then let the
1035computer attempt penetration automatically. (You'll have to read the
1036emulator's manual carefully to see if it has software-addressable
1037macros: the only people who need them are hackers, and, as we have
1038often observed, very few out-and-out hacker products exist!)
1039Auto-dial - Some modems contain programmable auto-diallers so that
1040frequently-called services can be dialled from a single keyboard
1041command.
1042Again the advantage to the hacker is obvious--a partly- known
1043telephone number can be located by writing some simple software
1044routine to test the variables.
1045However, not all auto-dial facilities are equally useful. Some
1046included in US-originated communications software and terminal
1047emulators are for specific 'smart' modems not available
1048elsewhere--and there is no way of altering the software to work with
1049other equipment. In general, each modem that contains an auto-dialler
1050has its own way of requiring instructions to be sent to it. If an
1051auto-dialling facility is important to you, check that your software
1052is configurable to your choice of auto-dial modem.
1053Another hazard is that certain auto-diallers only operate on the
1054multi-frequency tones method ('touch-tone') of dialling used in large
1055parts of the United States and only very slowly being introduced in
1056other countries. The system widely used in the UK is called 'pulse'
1057dialling. Touch-tone dialling is much more rapid than pulse dialling,
1058of course.
1059** Page 22
1060Finally, on the subject of US-originated software, some packages
1061will only accept phone numbers in the standard North American format
1062of: 3-digit area code, 3-digit local code, 4-digit subscriber code.
1063In the UK and Europe the phone number formats vary quite
1064Hacker's Handbook
1065file:///E|/Books/Hackers Handbook.htm (23 of 133) [11/28/2000 5:58:48 AM]
1066considerably. Make sure that any auto-dial facility you use actually
1067operates on your phone system.
1068Format Screen - Most professional on-line and time-share services
1069assume an 80-column screen. The 'format screen' option in terminal
1070emulators may allow you to change the regular text display on your
1071micro to show 80 characters across by means of a graphics 'fiddle';
1072alternatively, it may give you a more readable display of the stream
1073from the host by forcing line feeds at convenient intervals, just
1074before the stream reaches the right- hand margin of the micro's
1075'natural' screen width.
1076Related to this are settings to handle the presentation of the
1077cursor and to determine cursor movement about the screen-- normally
1078you won't need to use these facilities, but they may help you when
1079on-line to some odd-ball, non-standard service. Certain specific
1080'dumb' terminals like the VT52 (which has become something of a
1081mainframe industry standard) use special sequences to move the cursor
1082about the screen--useful when the operator is filling in standard
1083forms of information.
1084Other settings within this category may allow you to view
1085characters on your screen which are not part of the normal character
1086set. The early Apples, for example, lacked lower case, presenting
1087everything in capitals (as does the ZX81), so various ingenious
1088'fixes' were needed to cope. Even quite advanced home computers may
1089lack some of the full ASCII character set, such oddities as the tilde
1090~ or backslash \ or curly bracket { }, for example.
1091Re-assign - keyboard A related problem is that home micro keyboards
1092may not be able to generate all the required characters the remote
1093service wishes to see. The normal way to generate an ASCII character
1094not available from the keyboard is from Basic, by using a Print
1095CHR$(n) type command. This may not be possible when on-line to a
1096remote computer, where everything is needed in immediate mode. Hence
1097the requirement for a software facility to re-assign any little-used
1098key to send the desired 'missing' feature. Typical requirements are
1099BREAK~ ESC, RETURN (when part of a string as opposed to being the end
1100of a command) etc. When re-assigning a series of keys, you must make
1101sure you don't interfere with the essential functioning of the
1102terminal emulator.
1103** Page 23
1104For example, if you designate the sequence ctrl-S to mean 'send a DC1
1105character to the host', the chances are you will stop the host from
1106sending anything to you, because ctrl-S is a common command (some-
1107times called XOF) to call for a pause--incidentally, you can end the
1108pause by hitting ctrl-Q. Appendix IV gives a list of the full ASCII
1109implementation and the usual 'special' codes as they apply to
1110computer-to-computer communications.
1111File Protocols - When computers are sending large files to each
1112other, a further layer of protocol, beyond that defining individual
1113letters, is necessary. For example, if your computer is automatically
1114Hacker's Handbook
1115file:///E|/Books/Hackers Handbook.htm (24 of 133) [11/28/2000 5:58:48 AM]
1116saving to disk at regular intervals as the buffer fills up, it is
1117necessary to be able to tell the host to stop sending for a period,
1118until the save is complete. On older time-share services, where the
1119typical terminal is a teletypewriter, the terminal is in constant
1120danger of being unable mechanically to keep up with the host
1121computer's output. For this reason, many host computers use one of
1122two well-known protocols which require the regular exchange of
1123special control characters for host and user to tell each other all
1124is well. The two protocols are:
1125Stop/Start - The receiving computer can at any time send to the host
1126a Stop (ctrl-S) signal, followed by, when it is ready a Start,
1127(ctrl-Q).
1128EOB/ACK - The sending computer divides its file into a blocks (of any
1129convenient length); after each block is sent, an EOB (End of Block)
1130character is sent (see ASCII table, Appendix IV). The user's computer
1131must then respond with a ACK (Acknowledge) character.
1132These protocols can be used individually, together or not at all.
1133You may be able to use the 'Show Control Codes' option to check
1134whether either of the protocols are in use. Alternatively, if you
1135have hooked on to a service which for no apparent reason, seems to
1136stop in its tracks, you could try ending an ACK or Start (ctrl-F or
1137ctrl-S) and see if you can get things moving.
1138File transmission - All terminal emulators assume you will want to
1139send, as well as receive, text files. Thus, in addition to the
1140protocol settings already mentioned, there may be additional ones for
1141that purpose, e.g. the XMODEM protocol very popular on bulletin
1142boards. Hackers, of course, usually don't want to place files on
1143remote computers.....
1144Specific terminal emulation - Some software has pre-formatted sets of
1145characteristics to mimic popular commercial 'dumb' terminals. For
1146example, with a ROM costing under £60 fitted to a BBC micro, you can
1147obtain almost all of the features of DEC's VT100 terminal, which
1148until recently was regarded as something of an industry-standard and
1149costing just under £1000.
1150** Page 24
1151Other popular terminals are the VT52 and some Tektronix models, the
1152latter for graphics display. ANSI have produced a 'standard'
1153specification.
1154Baudot characters - The Baudot code, or International Telegraphic
1155Code No 2, is the 5-bit code used in telex and telegraphy -- and in
1156many wire-based news services. A few terminal emulators include it as
1157an option, and it is useful if you are attempting to hack such
1158services. Most software intended for use on radio link-ups (see
1159Chapter 10) operates primarily in Baudot, with ASCII as an option.
1160Viewdata emulation - This gives you the full, or almost full,
1161graphics and text characters of UK-standard viewdata. Viewdata tv
1162Hacker's Handbook
1163file:///E|/Books/Hackers Handbook.htm (25 of 133) [11/28/2000 5:58:48 AM]
1164sets and adapters use a special character-generator chip and a few,
1165mostly British-manufactured, micros use that chip also-- the Acorn
1166Atom was one example. The BBC has a teletext mode which adopts the
1167same display. But for most micros, viewdata emulation is a matter of
1168using hi-res graphics to mimic the qualities of the real thing, or to
1169strip out most of the graphics. Viewdata works on a screen 40
1170characters by 24 rows, and as some popular home micros have 'native'
1171displays smaller than that, some considerable fiddling is necessary
1172to get them to handle viewdata at all.
1173In some emulators, the option is referred to as Prestel or
1174Micronet--they are all the same thing. Micronet-type software usually
1175has additional facilities for fetching down telesoftware programs
1176(see Chapter 10).
1177Viewdata emulators must attend not only to the graphics
1178presentation, but also to split-speed operation: the usual speeds are
11791200 receive from host, 75 transmit to host. USA users of such
1180services may get them via a packet-switched network, in which case
1181they will receive it either at 1200/1200 full duplex or at 300/300.
1182Integrated terminal emulators offering both 'ordinary'
1183asynchronous emulation and viewdata emulation are rare: I have to use
1184completely different and non-compatible bits of software on my own
1185home set-up.
1186Modems
1187Every account of what a modem is and does begins with the classic
1188explanation of the derivation of the term: let this be no exception.
1189Modem is a contraction of modulator-demodulator.
1190A modem taking instructions from a computer (pin 2 on RS232C)
1191converts the binary 0's and 1's into specific single tones, according
1192to which 'standard' is being used. In RS232C/V24, binary 0 (ON)
1193appears as positive volts and binary 1 (OFF) appears as negative
1194volts.
1195** Page 25
1196The tones are then fed, either acoustically via the telephone
1197mouth-piece into the telephone line, or electrically, by generating
1198the electrical equivalent direct onto the line. This is the
1199modulating process.
1200In the demodulating stage, the equipment sits on the phone line
1201listening for occurrences of pre-selected tones (again according to
1202whichever 'standard' is in operation) and, when it hears one,
1203delivers a binary 0 or binary 1 in the form of positive or negative
1204voltage pulses into pin 3 of the computer's serial port.
1205This explanation holds true for modems operating at up to 1200
1206baud; above this speed, the modem must be able to originate tones,
1207and detect them according to phase as well, but since higher-speed
1208Hacker's Handbook
1209file:///E|/Books/Hackers Handbook.htm (26 of 133) [11/28/2000 5:58:48 AM]
1210working is unusual in dial-up ports--the hacker's special interest,
1211we can leave this matter to one side.
1212The modem is a relatively simple bit of kit: on the transmit side
1213it consists of a series of oscillators acting as tone generators, and
1214on receive has a series of narrow band-pass filters. Designers of
1215modems must ensure that unwanted tones do not leak into the telephone
1216line (exchanges and amplifiers used by telephone companies are
1217sometimes remotely controlled by the injection of specific tones) and
1218also that, on the receive side, only the distinct tones used for
1219communications are 'interpreted' into binary 0s or 1s. The other
1220engineering requirements are that unwanted electrical currents do not
1221wander down the telephone cable (to the possible risk of phone
1222company employees) or back into the user's computer.
1223Until relatively recently, the only UK source of low-speed modems
1224was British Telecom. The situation is much easier now, but
1225de-regulation of 'telephone line attachments', which include modems,
1226is still so recent that the ordinary customer can easily become
1227confused. Moreover, modems offering exactly the same service can vary
1228in price by over 300%. Strictly speaking, all modems connected to
1229the phone line should be officially approved by BT or other
1230appropriate regulatory authority.
1231At 300 baud, you have the option of using direct-connect modems
1232which are hard-wired into the telephone line, an easy enough
1233exercise, or using an acoustic coupler in which you place the
1234telephone hand-set. Acoustic couplers are inherently prone to
1235interference from room-noise, but are useful for quick lash-ups and
1236portable operation. Many acoustic couplers operate only in
1237'originate' mode, not in' answer'. Newer commercial direct- connect
1238modems are cheaper than acoustic couplers.
1239** Page 26
1240At higher speeds acoustic coupling is not recommended, though a
124175/1200 acoustic coupler produced in association with the Prestel
1242Micronet service is not too bad, and is now exchanged on the
1243second-hand market very cheaply indeed.
1244I prefer modems that have proper status lights--power on, line
1245seized, transmit and receive indicators. Hackers need to know what is
1246going on more than most users.
1247The table below shows all but two of the types of service you are
1248likely to come across; V-designators are the world-wide 'official'
1249names given by the CCITT; Bell-designators are the US names:
1250Service Speed Duplex Transmit Receive Answer
1251Designator 0 1 0 1
1252V21 orig 300(*) full 1180 980 1850 1650 -
1253V21 ans 300(*) full 1850 1650 1180 980 2100
1254V23 (1) 600 half 1700 1300 1700 1300 2100
1255V23 (2) 1200 f/h(**) 2100 1300 2100 1300 2100
1256Hacker's Handbook
1257file:///E|/Books/Hackers Handbook.htm (27 of 133) [11/28/2000 5:58:48 AM]
1258V23 back 75 f/h(**) 450 390 450 390 -
1259Bell 103 orig 300(*) full 1070 1270 2025 2225 -
1260Bell 103 ans 300(*) full 2025 2225 1070 1270 2225
1261Bell 202 1200 half 2200 1200 2200 1200 2025
1262(*)any speed up to 300 baud, can also include 75 and 110 baud
1263services
1264(**)service can either be half-duplex at 1200 baud or asymmetrical
1265full duplex, with 75 baud originate and 1200 baud receive (commonly
1266used as viewdata user) or 1200 transmit and 75 receive (viewdata
1267host)
1268The two exceptions are:
1269V22 1200 baud full duplex, two wire
1270Bell 212A The US equivalent
1271These services use phase modulation as well as tone.
1272British Telecom markets the UK services under the name of
1273Datel--details are given in Appendix V.
1274BT's methods of connecting modems to the line are either to
1275hard-wire the junction box (the two outer-wires are the ones you
1276usually need)--a 4-ring plug and associated socket (type 95A) for
1277most modems, a 5-ring plug and associated socket (type 96A) for
1278Prestel applications (note that the fifth ring isn't used)--and, for
1279all new equipment, a modular jack called type 600. The US also has a
1280modular jack, but of course it is not compatible.
1281** Page 27
1282Modern modem design is greatly aided by a wonder chip called the
1283AMD 7910. This contains nearly all the facilities to modulate and
1284demodulate the tones associated with the popular speed services, both
1285in the CCITT and Bell standards. The only omission--not always made
1286clear in the advertisements--are services using 1200/1200
1287full-duplex, ie V22 and Bell 212A.
1288Building a modem is now largely a question of adding a few
1289peripheral components, some switches and indicator lights, and a box.
1290In deciding which 'world standard' modem to purchase, hackers should
1291consider the following features:
1292Status lights you need to be able to see what is happening on the
1293line.
1294Hardware/software switching - cheaper versions merely give you a
1295switch on the front enabling you to change speeds, originate or
1296answer mode and CClTT or Bell tones. More expensive ones feature
1297firmware which allows your computer to send specially formatted
1298instructions to change speed under program control. However, to make
1299full use of this facility, you may need to write (or modify) your
1300terminal emulator.
1301Auto-dial - a pulse dialler and associated firmware are included in
1302Hacker's Handbook
1303file:///E|/Books/Hackers Handbook.htm (28 of 133) [11/28/2000 5:58:48 AM]
1304some more expensive models. You should ascertain whether the
1305auto-dialer operates on the telephone system you intend to hook the
1306modem up to--some of the US 'smart' modems present difficulties
1307outside the States. You will of course need software in your micro to
1308address the firmware in the modem --and the software has to be part
1309of your terminal emulator, otherwise you gain nothing in convenience.
1310However, with appropriate software, you can get your computer to try
1311a whole bank of numbers one after the other.
1312D25 connector - this is the official 'approved' RS232CN24 physical
1313connection--useful from the point-of-view of easy hook-up. A number
1314of lower-cost models substitute alternative DIN connectors. You must
1315be prepared to solder up your own cables to be sure of connecting up
1316properly.
1317Documentation I always prefer items to be accompanied by proper
1318instructions. Since hackers tend to want to use equipment in
1319unorthodox ways, they should look for good documentation too.
1320** Page 28
1321Finally, a word on build-your-own modems. A number of popular
1322electronics magazines and mail-order houses have offered modem
1323designs. Such modems are not likely to be approved for direct
1324connection to the public telephone network. However, most of them
1325work. If you are uncertain of your kit-constructing skills, though.
1326remember badly-built modems can be dangerous both to your computer
1327and to the telephone network.
1328Test Equipment
1329Various items of useful test equipment occasionally appear on the
1330second-hand market--via mail-order, in computer junk shops, in the
1331flea-market section of exhibitions and via computer clubs.
1332It's worth searching out a cable 'break-out' box. This lets you
1333restrap a RS232C cable without using a soldering iron--the various
1334lines are brought out on to an accessible matrix and you use small
1335connectors to make (or break) the links you require. It's useful if
1336you have an 'unknown' modem, or an unusually configured computer.
1337Related, but much more expensive, is a RS232C/V24 analyser --this
1338gives LED status lights for each of the important lines, so you can
1339see what is happening.
1340Lastly, if you are a very rich and enthusiastic hacker, you can
1341buy a protocol analyser. This is usually a portable device with a
1342VDU, full keyboard, and some very clever firmware which examines the
1343telephone line or RS232C port and carries out tests to see which of
1344several popular datacomms protocols is in use. Hewlett Packard do a
1345nice range. Protocol analysers will handle synchronous transmissions
1346as well as synchronous. Cost: £1500 and up...and up.
1347** Page 29
1348Hacker's Handbook
1349file:///E|/Books/Hackers Handbook.htm (29 of 133) [11/28/2000 5:58:48 AM]
1350CHAPTER 4
1351Targets
1352Wherever hackers gather, talk soon moves from past achievements
1353and adventures to speculation about what new territory might be
1354explored. It says much about the compartmentalisation of computer
1355specialities in general and the isolation of micro- owners from
1356mainstream activities in particular that a great deal of this
1357discussion is like that of navigators in the days before Columbus:
1358the charts are unreliable, full of blank spaces and confounded with
1359myth.
1360In this chapter I am attempting to provide a series of notes on
1361the main types of services potentially available on dial-up, and to
1362give some idea of the sorts of protocols and conventions employed.
1363The idea is to give voyagers an outline atlas of what is interesting
1364and possible, and what is not.
1365On-line hosts
1366On-line services were the first form of electronic publishing: a
1367series of big storage computers--and on occasion, associated
1368dedicated networks -- act as hosts to a group of individual databases
1369by providing not only mass data storage and the appropriate 'search
1370language' to access it, but also the means for registering, logging
1371and billing users. Typically, users access the on-line hosts via a
1372phone number which links into a a public data network using packet
1373switching (there's more on these networks in chapter 7).
1374The on-line business began almost by accident; large corporations
1375and institutions involved in complicated technological developments
1376found that their libraries simply couldn't keep track of the
1377publication of relevant new scientific papers, and decided to
1378maintain indices of the papers by name, author, subject-matter, and
1379so on, on computer. One of the first of these was the armaments and
1380aircraft company, Lockheed Corporation.
1381In time the scope of these indices expanded and developed and
1382outsiders -- sub-contractors, research agencies, universities,
1383government employees, etc were granted access. Other organisations
1384with similar information-handling requirements asked if space could
1385be found on the computer for their needs.
1386** Page 30
1387Eventually Lockheed and others recognised the beginnings of a quite
1388separate business; in Lockheed's case it lead to the foundation of
1389Dialogue, which today acts as host and marketing agent for almost 300
1390separate databases. Other on-line hosts include BRS (Bibliographic
1391Hacker's Handbook
1392file:///E|/Books/Hackers Handbook.htm (30 of 133) [11/28/2000 5:58:48 AM]
1393Retrieval Services), Comshare (used for sophisticated financial
1394modelling), DataStar, Blaise (British Library) I P Sharp, and
1395Euronet-Diane.
1396On-line services, particularly the older ones, are not especially
1397user-friendly by modern standards. They were set up at a time when
1398both core and storage memory was expensive, and the search languages
1399tend to be abbreviated and formal. Typically they are used, not by
1400the eventual customer for the information, but by professional
1401intermediaries--librarians and the like-- who have undertaken special
1402courses. Originally on-line hosts were accessed by dumb terminals,
1403usually teletypewriters like the Texas Whisperwriter portable with
1404built-in acoustic modem, rather than by VDUs. Today the trend is to
1405use 'front-end' intelligent software on an IBM PC which allows the
1406naive user to pose his/her questions informally while offline; the
1407software then redefines the information request into the formal
1408language of the on-line host (the user does not witness this process)
1409and then goes on-line via an auto-dial modem to extract the
1410information as swiftly and efficiently as possible.
1411On-line services require the use of a whole series of passwords:
1412the usual NUI and NUA for PSS (see chapter 7), another to reach the
1413host, yet another for the specific information service required.
1414Charges are either for connect-time or per record retrieved, or
1415sometimes a combination.
1416The categories of on-line service include bibliographic, which
1417merely indexes the existence of an article or book--you must then
1418find a physical copy to read; and source, which contains the article
1419or extract thereof. Full-text services not only contain the complete
1420article or book but will, if required, search the entire text (as
1421opposed to mere keywords) to locate the desired information. An
1422example of this is LEXIS, a vast legal database which contains nearly
1423all important US and English law judgements, as well as statutes.
1424News Services
1425The vast majority of news services, even today, are not, in the
1426strictest sense, computer-based, although computers play an important
1427role in assembling the information and, depending on the nature of
1428the newspaper or radio or tv station receiving it, its subsequent
1429handling.
1430** Page 31
1431The world's big press agencies--United Press, Associated Press,
1432Reuters, Agence France Presse, TASS, Xinhua, PAP, VoA -- use telex
1433techniques to broadcast their stories. Permanent leased telegraphy
1434lines exist between agencies and customers, and the technology is
1435pure telex: the 5-bit Baudot code (rather than ASCII) is adopted,
1436giving capital letters only, and 'mark' and space' are sent by
1437changing voltage conditions on the line rather than audio tones.
1438Speeds are 50 or 75 baud.
1439Hacker's Handbook
1440file:///E|/Books/Hackers Handbook.htm (31 of 133) [11/28/2000 5:58:48 AM]
1441The user cannot interrogate the agency in any way. The stories
1442come in a single stream which is collected on rolls of paper and then
1443used as per the contract between agency and subscriber. To hack a
1444news agency line you will need to get physically near the appropriate
1445leased line, tap in by means of an inductive loop, and convert the
1446changing voltage levels (+80 volts on the line) into something your
1447RS232C port can handle. You will then need software to translate the
1448Baudot code into the ASCII which your computer can handle internally,
1449and display on screen or print to a file. The Baudot code is given in
1450Appendix IV.
1451None of this is easy and will probably involve breaches of several
1452laws, including theft of copyright material! However a number of news
1453agencies also transmit services by radio, in which case the signals
1454can be hijacked with a short-wave receiver. Chapter 9 explains.
1455Historic news, as opposed to the current stuff from agencies, is
1456now becoming available on-line. The New York Times, for example, has
1457long held its stories in an electronic 'morgue' or clippings library.
1458Initially this was for internal use, but for the last several years
1459it has been sold to outsiders, chiefly broadcasting stations and
1460large corporations. You can search for information by a combination
1461of keyword and date-range. The New York Times Information Bank is
1462available through several on-line hosts.
1463As the world's great newspapers increasingly move to electronic
1464means of production--journalists working at VDUs, sub-editors
1465assembling pages and direct-input into photo-typesetters--the
1466additional cost to each newspaper of creating its own morgue is
1467relatively slight and we can expect to see many more commercial
1468services.
1469In the meantime, other publishing organisations have sought to
1470make available articles, extract or complete, from leading magazines
1471also. Two UK examples are Finsbury Data Services' Textline and
1472Datasolve's d Reporter, the latter including material from the BBC's
1473monitoring service, Associated Press, the Economist and the Guardian.
1474Textline is an abstract service, but World Reporter gives the full
1475text. In October 1984 it already held 500 million English words.
1476** Page 32
1477In the US there is NEXIS, which shares resources with LEXIS; NEXIS
1478held 16 million full text articles at that same date. All these
1479services are expensive for casual use and are accessed by dial-up
1480using ordinary asynchronous protocols.
1481Many electronic newsrooms also have dial-in ports for reporters
1482out on the job; depending on the system these ports not only allow
1483the reporter to transmit his or her story from a portable computer,
1484but may also (like Basys Newsfury used by Channel Four News) let them
1485see news agency tapes, read headlines and send electronic mail. Such
1486systems have been the subject of considerable hacker speculation.
1487Hacker's Handbook
1488file:///E|/Books/Hackers Handbook.htm (32 of 133) [11/28/2000 5:58:48 AM]
1489Financial Services
1490The financial world can afford more computer aids than any other
1491non-governmental sector. The vast potential profits that can be made
1492by trading huge blocks of currency, securities or commodities--and
1493the extraordinary advantages that a slight 'edge' in information can
1494bring--have meant that the City, Wall Street and the equivalents in
1495Hong Kong, Japan and major European capitals have been in the
1496forefront of getting the most from high-speed comms.
1497Ten years ago the sole form of instant financial information was
1498the ticker tape--telegraphy technology delivering the latest share
1499price movements in a highly abbreviated form. As with its news
1500equivalents, these were broadcast services (and still are, for the
1501services still exist) sent along leased telegraph lines. The user
1502could only watch, and 'interrogation' consisted of back-tracking
1503along a tape of paper. Extel (Exchange Telegraph) continues to use
1504this technique, though it is gradually upgrading by using viewdata
1505and intelligent terminals.
1506However, just over ten years ago Reuters put together the first
1507packages which gave some intelligence and 'questioning power' to the
1508end user. Each Reuters' Monitor is intelligent, containing (usually)
1509a DEC PDP-8 series mini and some firmware which accepts and selects
1510the stream of data from the host at the far end of the leased line,
1511marshalls interrogation requests and takes care of the local display.
1512Information is formatted in 'pages' rather like viewdata frames, but
1513without the colour. There is little point in eavesdropping into a
1514Reuters line unless you know what the terminal firmware does. Reuters
1515now face an aggressive rival in Telerate, and the fight is on to
1516deliver not only fast comprehensive prices services but international
1517screen-based dealing as well. The growth of Reuters and its rivals is
1518an illustration of technology creating markets--especially in
1519international currency--where none existed before.
1520** Page 33
1521The first sophisticated Stock Exchange prices 'screens' used
1522modified closed circuit television technology. London had a system
1523called Market Price Display Service--MPDS--which consisted of a
1524number of tv displays of current prices services on different
1525'channels' which could be selected by the user. But London now uses
1526TOPIC, a leased line variant on viewdata technology, though with its
1527magazine-like arrangement and auto-screen refresh, it has as much in
1528common with teletext as Prestel. TOPIC carries about 2,500 of the
1529total 7,500 shares traded in London, plus selected analytical
1530material from brokers. Datastream represents a much higher level of
1531sophistication: using its £40,000 plus pa terminals you can compare
1532historic data-- price movements, movements against sector indices
1533etc--and chart the results.
1534The hacker's reward for getting into such systems is that you can
1535see share and other prices on the move. None of these prices is
1536confidential; all could be obtained by ringing a stockbroker.
1537However, this situation is likely to change; as the City makes the
1538Hacker's Handbook
1539file:///E|/Books/Hackers Handbook.htm (33 of 133) [11/28/2000 5:58:48 AM]
1540change from the traditional broker/jobber method of dealing towards
1541specialist market making, there will then be electronic prices
1542services giving privileged information to specialist share dealers.
1543All these services are only available via leased lines; City
1544professionals would not tolerate the delays and uncertainties of
1545dial-up facilities. However dial-up ports exist for demonstrations,
1546exhibitions, engineering and as back-up--and a lot of hacking effort
1547has gone into tracking them down.
1548In the United States, in addition to Reuters, Telerate and local
1549equivalents of official streams of stock exchange and over-the-
1550counter data, there is Dow Jones, best known internationally for its
1551market indices similar to those produced by the Financial Times in
1552London. Dow Jones is in fact the owner of the Wall Street Journal and
1553some influential business magazines. Its Dow Jones News/Retrieval
1554Service is aimed at businesses and private investors. It features
1555current share prices, deliberately delayed by 15 minutes, historic
1556price data, which can be charted by the user's own computer
1557(typically an Apple or IBM PC) and historic 'morgue' type company
1558news and analysis. Extensions of the service enable customers to
1559examine accounts of companies in which they are interested. The bulk
1560of the information is US-based, but can be obtained world-wide via
1561packet-switching networks. All you need are the passwords and special
1562software.
1563** Page 34
1564Business Information
1565Business information is usually about the credit-worthiness of
1566companies, company annual reports, trading opportunities and market
1567research. The biggest electronic credit data resource is owned by the
1568international company Dun & Bradstreet: during 1985-86 it is due to
1569spend £25m on making its data available all over Europe, including
1570the UK. The service, which covers more than 250,000 UK businesses, is
1571called DunsPrint and access is both on-line and via a viewdata
1572front-end processor. Another credit agency, CNN Services, extensively
1573used already by the big clearing banks, and with 3000 customers
1574accessing information via viewdata sets, has recently also announced
1575an extended electronic retrieval service for its own called Guardian
1576Business Information A third UK credit service available
1577electronically is called InfoLink.
1578In addition, all UK companies quoted on the London Stock Exchange
1579and many others of any size who are not, have a report and analysis
1580available from ICC (InterCompany Comparisons) who can be accessed via
1581on--line dial--up, through a viewdata interface and also by
1582Datastream customers. Dun & Bradstreet also have an on--line service
1583called KBE covering 20,000 key British enterprises.
1584Prodigious quantities of credit and background data on US
1585companies can be found on several of the major on--line hosts. A
1586valid phone number, passwords and extracts from the operations manual
1587of one of the largest US services, TRW--it has credit histories on 90
1588Hacker's Handbook
1589file:///E|/Books/Hackers Handbook.htm (34 of 133) [11/28/2000 5:58:48 AM]
1590million people--sat on some hackers' bulletin boards (of which much
1591more later) for over twelve months during 1983 and 1984 before the
1592company found out. No one knows how many times hackers accessed the
1593service. According to the Washington Post, the password and manual
1594had been obtained from a Sears Roebuck national chain store in
1595Sacramento; some hackers claimed they were able to alter credit
1596records, but TRW maintain that telephone access to their systems is
1597designed for read-only operations alone, updating of files taking
1598place solely on magnetic tape.
1599US market research and risk analysis comes from Frost Sullivan.
1600Risk analysis tells international businessmen which countries are
1601politically or economically unstable, or likely t become so, and so
1602unsafe to do business with. I once found myself accessing a
1603viewdata-based international assessment service run b a company
1604called Control Risks, which reputedly has strong link to the Special
1605Air Service. As so often happens when hacker think they are about to
1606uncover secret knowledge, the actual data files seemed relatively
1607trivial, the sort of judgements that could be made by a bright sixth
1608former who read posh newspapers and thoughtful weekly magazines.
1609** Page 35
1610University facilities
1611In complete contrast to computers that are used to store and
1612present data are those where the value is to deliver processing power
1613to the outside world. Paramount among these are those installed in
1614universities and research institutes.
1615Although hackers frequently acquire phone numbers to enter such
1616machines, what you can do once you are there varies enormously. There
1617are usually tiers and banks of passwords, each allowing only limited
1618access to the range of services. It takes considerable knowledge of
1619the machine's operating system to break through from one to another
1620and indeed, in some cases, the operating system is so thoroughly
1621embedded in the mainframe's hardware architecture that the
1622substantial modifications necessary to permit a hacker to roam free
1623can only be done from a few designated terminals, or by having
1624physical access to the machine. However, the hobbyist bulletin board
1625system quite often provides passwords giving access to games and the
1626ability to write and run programs in exotic languages--my own first
1627hands--on experience of Unix came in exactly this way. There are
1628bulletin boards on mainframes and even, in some cases, boards for
1629hackers!
1630Given the nature of hacking, it is not surprising that some of the
1631earliest japes occurred on computers owned by universities. Way back
1632in the 1970s, MIT was the location of the famous 'Cookie Monster',
1633inspired by a character in the then-popular Rowan & Martin Laugh-in
1634television show. As someone worked away at their terminal, the word
1635'cookie' would appear across their screen, at first slowly wiping out
1636the user's work. Unless the user moved quickly, things started to
1637speed up and the machine would flash urgently: "Cookie, cookie, give
1638Hacker's Handbook
1639file:///E|/Books/Hackers Handbook.htm (35 of 133) [11/28/2000 5:58:48 AM]
1640me a cookie". The whole screen would pulse with this message until,
1641after a while, the hacking program relented and the 'Monster' would
1642clear the screen, leaving the message: "I didn't want a cookie
1643anyway." It would then disappear into the computer until it snared
1644another unsuspecting user. You could save yourself from the Monster
1645by typing the word "Cookie", to which it replied "Thank you" and then
1646vanished.
1647In another US case, this time in 1980, two kids in Chicago,
1648calling themselves System Cruncher and Vladimir, entered the computer
1649at DePaul University and caused a system crash which cost $22,000 to
1650fix. They were prosecuted, given probation and were then made a movie
1651offer.
1652** Page 36
1653In the UK, many important university and research institution
1654computers have been linked together on a special data network called
1655SERCNET. SERC is the Science and Engineering Research Council.
1656Although most of the computers are individually accessible via PSS,
1657SERCNET makes it possible to enter one computer and pass through to
1658others. During early 1984, SERCNET was the target of much hacker
1659attention; a fuller account appears in chapter 7, but to anticipate a
1660little, a local entry node was discovered via one of the London
1661University college computers with a demonstration facility which, if
1662asked nicely, disgorged an operating manual and list of 'addresses'.
1663One of the minor joys of this list was an entry labelled "Gateway to
1664the Universe", pure Hitch-hiker material, concealing an extensive
1665long-term multi-function communications project. Eventually some
1666hackers based at a home counties university managed to discover ways
1667of roaming free around the network....
1668Banking
1669Prominent among public fantasies about hackers is the one where
1670banks are entered electronically, accounts examined and some money
1671moved from one to another. The fantasies, bolstered by
1672under-researched low-budget movies and tv features, arise from
1673confusing the details of several actual happenings.
1674Most 'remote stealing' from banks or illicit obtaining of account
1675details touch computers only incidentally and involve straight-
1676forward fraud, conning or bribery of bank employees. In fact, when
1677you think about the effort involved, human methods would be much more
1678cost-effective for the criminal. For hackers, however, the very
1679considerable effort that has been made to provide security makes the
1680systems a great challenge in them- selves.
1681In the United Kingdom, the banking scene is dominated by a handful
1682of large companies with many branches. Cheque clearing and account
1683maintenance are conducted under conditions of high security with
1684considerable isolation of key elements; inter-bank transactions in
1685the UK go through a scheme called CHAPS, Clearing House Automatic
1686Payments System, which uses the X.25 packet switching protocols (see
1687Hacker's Handbook
1688file:///E|/Books/Hackers Handbook.htm (36 of 133) [11/28/2000 5:58:49 AM]
1689chapter 7). The network is based on Tandem machines; half of each
1690machine is common to the network and half unique to the bank. The
1691encryption standard used is the US Data Encryption Standard. Certain
1692parts of the network, relating to the en- and de-cryption of
1693messages, apparently auto-destruct if tampered with.
1694** Page 37
1695The service started early in 1984. The international equivalent
1696is SWIFT (Society for Worldwide Interbank Financial Transactions);
1697this is also X.25- based and it handles about half-a-million messages
1698a day. If you want to learn someone's balance, the easiest and most
1699reliable way to obtain it is with a plausible call to the local
1700branch. If you want some easy money, steal a cheque book and cheque
1701card and practise signature imitation. Or, on a grander scale, follow
1702the example of the £780,000 kruggerand fraud in the City. Thieves
1703intercepted a telephone call from a solicitor or bank manager to
1704'authenticate' forged drafts; the gold coins were then delivered to a
1705bogus company.
1706In the United States, where federal law limits the size of an
1707individual bank's operations and in international banking, direct
1708attacks on banks has been much easier because the technology adopted
1709is much cruder and more use is made of public phone and telex lines.
1710One of the favourite techniques has been to send fake authorisations
1711for money transfers. This was the approach used against the Security
1712National Pacific Bank by Stanley Rifkin and a Russian diamond dealer
1713in Geneva. $10.2m moved from bank to bank across the United States
1714and beyond. Rifkin obtained code numbers used in the bilateral Test
1715Keys. The trick is to spot weaknesses in the cryptographic systems
1716used in such authorisations. The specifications for the systems
1717themselves are openly published; one computer security expert, Leslie
1718Goldberg, was recently able to take apart one scheme--proposed but
1719not actually implemented--and show that much of the 'key' that was
1720supposed to give high level cryptographic security was technically
1721redundant, and could be virtually ignored. A surprisingly full
1722account of his 'perfect' fraud appears in a 1980 issue of the journal
1723Computer Fraud and Security Bulletin.
1724There are, however, a few areas where banking is becoming
1725vulnerable to the less mathematically literate hacker. A number of
1726international banks are offering their big corporation customers
1727special facilities so that their Treasury Departments (which ensure,
1728among other things, that any spare million dollars are not left doing
1729nothing over night but are earning short-term interest) can have
1730direct access to their account details via a PC on dial-up. Again,
1731telebanking is now available via Prestel and some of its overseas
1732imitators. Although such services use several layers of passwords to
1733validate transactions, if those passwords are mis-acquired, since no
1734signatures are involved, the bank account becomes vulnerable.
1735** Page 38
1736Finally, the network of ATMs (hole-in-the-wall cash machines) is
1737expanding greatly. As mentioned early in this book, hackers have
1738Hacker's Handbook
1739file:///E|/Books/Hackers Handbook.htm (37 of 133) [11/28/2000 5:58:49 AM]
1740identified a number of bugs in the machines. None of them,
1741incidentally, lead directly to fraud. These machines allow card-
1742holders to extract cash up to a finite limit each week (usually
1743£100). The magnetic stripe contains the account number, validation
1744details of the owner's PIN (Personal Identity Number), usually 4
1745digits, and a record of how much cash has been drawn that week. The
1746ATM is usually off-line to the bank's main computer and only goes
1747on-line in two circumstances--first, during business hours, to
1748respond to a customer's 'balance request'; and second, outside
1749regular hours, to take into local memory lists of invalid cards which
1750should not be returned to the customer, and to dump out cheque book
1751and printed statement requests.
1752Hackers have found ways of getting more than their cash limit each
1753week. The ATMs belonging to one clearing bank could be 'cheated' in
1754this way: you asked for your maximum amount and then, when the
1755transaction was almost completed, the ATM asked you 'Do you want
1756another transaction, Yes/No?' If you responded 'yes' you could then
1757ask for--and get--your credit limit again, and again, and again. The
1758weakness in the system was that the magnetic stripe was not
1759overwritten to show you had had a transaction till it was physically
1760ejected from the machine. This bug has now been fixed.
1761A related but more bizarre bug resided for a while on the ATMs
1762used by that first bank's most obvious High Street rivals. In that
1763case, you had to first exhaust your week's limit. You then asked for
1764a further sum, say £75. The machine refused but asked if you wanted a
1765further transaction. Then, you slowly decremented the amounts you
1766were asking for by £5...70, 65, 60...and so on, down to £10. You then
1767told the ATM to cancel the last £5 transaction...and the machine gave
1768you the full £75. Some hackers firmly believe the bug was placed
1769there by the original software writer. This bug too has now been
1770fixed.
1771Neither of these quirks resulted in hackers 'winning' money from
1772the banks involved; the accounts were in every case, properly
1773debited. The only victory was to beat the system. For the future, I
1774note that the cost of magnetic stripe reader/writers which interface
1775to PCs is dropping to very low levels. I await the first inevitable
1776news reports.
1777Electronic Mail
1778Electronic mail services work by storing messages created by some
1779users until they are retrieved by their intended recipients.
1780** Page 39
1781The ingredients of a typical system are: registration/logging on
1782facilities, storage, search and retrieval, networking, timing and
1783billing. Electronic mail is an easy add-on to most mainframe
1784installations, but in recent years various organisations have sought
1785to market services to individuals, companies and industries where
1786electronic mail was the main purpose of the system, not an add-on.
1787Hacker's Handbook
1788file:///E|/Books/Hackers Handbook.htm (38 of 133) [11/28/2000 5:58:49 AM]
1789The system software in widest use is that of ITI-Dialcom; it's the
1790one that runs Telecom Gold. Another successful package is that used
1791in the UK and USA by Easylink, which is supported by Cable & Wireless
1792and Western Union.
1793In the Dialcom/Telecom Gold service, the assumption is made that
1794most users will want to concentrate on a relatively narrow range of
1795correspondents. Accordingly, the way it is sold is as a series of
1796systems, each run by a 'manager': someone within a company. The
1797'manager' is the only person who has direct contact with the
1798electronic mail owner and he in turn is responsible for bringing
1799individual users on to his 'system' -- he can issue 'mailboxes'
1800direct, determine tariff levels, put up general messages. In most
1801other services, every user has a direct relationship with the
1802electronic mail company.
1803The services vary according to their tariff structures and levels;
1804and also in the additional facilities: some offer bi-directional
1805interfaces to telex; and some contain electronic magazines, a little
1806like videotex.
1807The basic systems tend to be quite robust and hacking is mainly
1808concentrated on second-guessing users IDs. Many of the systems have
1809now sought to increase security by insisting on passwords of a
1810certain length--and by giving users only three or four attempts at
1811logging on before closing down the line. But increasingly their
1812customers are using PCs and special software to automate logging-in.
1813The software packages of course have the IDs nicely pre-stored....
1814Government computers
1815Among hackers themselves the richest source of fantasising
1816revolves around official computers like those used by the tax and
1817national insurance authorities, the police, armed forces and
1818intelligence agencies.
1819The Pentagon was hacked in 1983 by a 19-year-old Los Angeles
1820student, Ronald Austin. Because of the techniques he used, a full
1821account is given in the operating systems section of chapter 6. NASA,
1822the Space Agency, has also acknowledged that its e-mail system has
1823been breached and that messages and pictures of Kilroy were left as
1824graffiti.
1825** Page 40
1826This leaves only one outstanding mega-target, Platform, the global
1827data network of 52 separate systems focused on the headquarters of
1828the US's electronic spooks, the National Security Agency at Fort
1829Meade, Maryland. The network includes at least one Cray-1, the worlds
1830most powerful number-cruncher, and facilities provided by GCHQ at
1831Cheltenham.
1832Although I know UK phone freaks who claim to have managed to
1833Hacker's Handbook
1834file:///E|/Books/Hackers Handbook.htm (39 of 133) [11/28/2000 5:58:49 AM]
1835appear on the internal exchanges used by Century House (M16) and
1836Curzon Street House (M15) and have wandered along AUTOVON, the US
1837secure military phone network, I am not aware of anyone bold or
1838clever enough to have penetrated the UK's most secure computers.
1839It must be acknowledged that in general it is far easier to obtain
1840the information held on these machines--and lesser ones like the DVLC
1841(vehicle licensing) and PNC (Police National Computer)-- by criminal
1842means than by hacking -- bribery, trickery or blackmail, for example.
1843Nevertheless, there is an interesting hacker's exercise in
1844demonstrating how far it is possible to produce details from open
1845sources of these systems, even when the details are supposed to be
1846secret. But this relates to one of the hacker's own secret
1847weapons--thorough research, the subject of the next chapter.
1848** Page 41
1849CHAPTER 5
1850Hackers' Intelligence
1851Of all the features of hacking that mystify outsiders, the first
1852is how the hackers get the phone numbers that give access to the
1853computer systems, and the passwords that open the data. Of all the
1854ways in which hacking is portrayed in films, books and tv, the most
1855misleading is the concentration on the image of the solitary genius
1856bashing away at a keyboard trying to 'break in'.
1857It is now time to reveal one of the dirty secrets of hacking:
1858there are really two sorts of hacker. For this purpose I will call
1859them the trivial and the dedicated. Anyone can become a trivial
1860hacker: you acquire, from someone else, a phone number and a password
1861to a system; you dial up, wait for the whistle, tap out the password,
1862browse around for a few minutes and log off. You've had some fun,
1863perhaps, but you haven't really done anything except follow a
1864well-marked path. Most unauthorised computer invasions are actually
1865of this sort.
1866The dedicated hacker, by contrast, makes his or her own
1867discoveries, or builds on those of other pioneers. The motto of
1868dedicated hackers is modified directly from a celebrated split
1869infinitive: to boldly pass where no man has hacked before.
1870Successful hacking depends on good research. The materials of
1871research are all around: as well as direct hacker-oriented material
1872of the sort found on bulletin board systems and heard in quiet
1873corners during refreshment breaks at computer clubs, huge quantities
1874of useful literature are published daily by the marketing departments
1875of computer companies and given away to all comers: sheaves of
1876stationery and lorry loads of internal documentation containing
1877important clues are left around to be picked up. It is up to the
1878hacker to recognise this treasure for what it is, and to assemble it
1879Hacker's Handbook
1880file:///E|/Books/Hackers Handbook.htm (40 of 133) [11/28/2000 5:58:49 AM]
1881in a form in which it can be used.
1882Anyone who has ever done any intelligence work, not necessarily
1883for a government, but for a company, or who has worked as an
1884investigative journalist, will tell you that easily 90% of the
1885information you want is freely available and that the difficult part
1886is recognising and analysing it. Of the remaining 10%, well over
1887half can usually be inferred from the material you already have,
1888because, given a desired objective, there are usually only a limited
1889number of sensible solutions.
1890** Page 42
1891You can go further: it is often possible to test your inferences and,
1892having done that, develop further hypotheses. So the dedicated
1893hacker, far from spending all the time staring at a VDU and 'trying
1894things' on the keyboard, is often to be found wandering around
1895exhibitions, attending demonstrations, picking up literature, talking
1896on the phone (voice-mode!) and scavenging in refuse bins.
1897But for both trivial operator, and the dedicated hacker who wishes
1898to consult with his colleagues, the bulletin board movement has been
1899the single greatest source of intelligence.
1900Bulletin Boards
1901Since 1980, when good software enabling solitary micro-computers
1902to offer a welcome to all callers first became widely available, the
1903bulletin board movement has grown by leaps and bounds. If you haven t
1904logged on to at least one already, now is the time to try. At the
1905very least it will test out your computer, modem and software --and
1906your skills in handling them. Current phone numbers, together with
1907system hours and comms protocol requirements, are regularly published
1908in computer mags; once you have got into one, you will usually find
1909current details of most of the others.
1910Somewhere on most boards you will find a series of Special
1911Interest Group (SIG) sections and among these, often, will be a
1912Hacker's Club. Entrance to each SIG will be at the discretion of the
1913Sysop, the Bulletin Board owner. Since the BBS software allows the
1914Sysop to conceal from users the list of possible SIGs, it may not be
1915immediately obvious whether a Hacker's section exists on a particular
1916board. Often the Sysop will be anxious to form a view of a new
1917entrant before admitting him or her to a 'sensitive' area. It has
1918even been known for bulletin boards to carry two hacker sections:
1919one, admission to which can be fairly easily obtained; and a second,
1920the very existence of which is a tightly-controlled secret, where
1921mutually trusting initiates swap information.
1922The first timer, reading through a hacker's bulletin board, will
1923find that it seems to consist of a series of discursive conversations
1924between friends. Occasionally, someone may write up a summary for
1925more universal consumption. You will see questions being posed. if
1926you feel you can contribute, do so, because the whole idea is that a
1927Hacker's Handbook
1928file:///E|/Books/Hackers Handbook.htm (41 of 133) [11/28/2000 5:58:49 AM]
1929BBS is an information exchange. It is considered crass to appear on a
1930board and simply ask 'Got any good numbers?; if you do, you will not
1931get any answers. Any questions you ask should be highly specific,
1932show that you have already done some ground-work, and make clear that
1933any results derived from the help you receive will be reported back
1934to the board.
1935** Page 43
1936Confidential notes to individuals, not for general consumption,
1937can be sent using the E-Mail option on the bulletin board, but
1938remember, nothing is hidden from the Sysop.
1939A flavour of the type of material that can be seen on bulletin
1940boards appears from this slightly doctored excerpt (I have removed
1941some of the menu sequences in which the system asks what you want to
1942do next and have deleted the identities of individuals):
1943Msg#: 3538 *Modem Spot*
194401/30/84 12:34:54 (Read 39 Times)
1945From: xxxxxxxxxx
1946To: ALL
1947Subj: BBC/MAPLIN MODEMS
1948RE THE CONNECTIONS ON THE BBC/MAPLIN MODEM SETUP. THE crs PIN IS USED TO
1949HANDSHAKE WITH THE RTS PIN E.G. ONE UNIT SENDS RTS (READY TO SEND) AND
1950SECOND UNIT REPLIES CTS (CLEAR TO SEND). USUALLY DONE BY TAKING PIN HIGH. IF
1951YOU STRAP IT HIGH I WOULD SUGGEST VIA A 4K7 RESISTOR TO THE VCC/+VE RAIL (5V).
1952IN THE EVENT OF A BUFFER OVERFLOW THESE RTS/CTS PINS ARE TAKEN LOW AND THIS
1953STOPS THE DATA TRANSFER. ON A 25WAY D TYPE CONNECTOR TX DATA IS PIN 2
1954RX DATA IS PIN 3
1955RTS IS PIN 4
1956CTS IS PIN 5
1957GROUND IS PIN 7
1958ALL THE BEST -- ANY COMMTO XXXXXXXXX
1959(DATA COMMS ENGINEER)
1960Msg#: 3570 *Modem Spot*
196101/31/84 23:43:08 (Read 31 Times)
1962From: XXXXXXXXXX
1963To: XXXXXXXXXXX
1964Subj: REPLY TO MSG# 3538 (BBC/MAPLIN MODEMS)
1965ON THE BBC COMPUTER IT IS EASIER TO CONNECT THE RTS (READY TO SEND) PIN HE
1966CTS (CLEAR TO SEND) PIN. THIS OVERCOMES THE PROBLEM OF HANDSHAKING.
1967SINCE THE MAPLIN MODEM DOES NOT HAVE HANDSHAKING.I HAVE PUT MY RTS CTS JUMPER
1968INSIDE THE MODEM. MY CABLES ARE THEN STANDARD AND CAN BE USED WITH HANDSHAKERS.
1969REGARDS
1970Hsg#: 3662 *HACKER'S CLUB*
197102/04/84 23:37:11 (Read 41 Times)
1972From: XXXXXXXXXX
1973To: ALL
1974Subj: PUBLIC DATA NET
1975Does anyone know what the Public Data Net is? I appear to have access to it, &
1976I daren't ask what it is!
1977Hacker's Handbook
1978file:///E|/Books/Hackers Handbook.htm (42 of 133) [11/28/2000 5:58:49 AM]
1979Also, can anyone tell me more about the Primenet systems... Again I seem to
1980have the means,but no info. For instance, I have a relative who logs on to
1981another Prime Both of our systems are on Primenet, is there any way we can
1982communicate?
1983More info to those who want it...
1984<n>ext msg, <r>eply, or <s>top?
1985Msg has replies, read now(Y/N)? y
1986Reply has been deleted
1987<n>ext msg, <r>eply, or <s>top?
1988Msg#: 3739 *HACKER'S CLUB*
198902/06/84 22:39:06 (Read 15 Times)
1990From: xxxxxxxxxx
1991To: xxxxxxxxxx
1992Subj: REPLY TO MSG# 3716 (PRIMENET COMMS)
1993Ahh, but what is the significance of the Address-does it mean a PSS number. or
1994some thing like that? Meanwhile, I'II get on-line (via voice-link on the phone!)
1995to my cousin, and see what he has on it....
1996** Page 44
1997Msg#: 3766 *HACKER'S CLUB*
199802/07/84 13:37:54 (Read 13 Times)
1999From: xxxxxxxxxxx
2000To: xxxxxxxxxxx
2001Subj: REPLY TO MSG# 3751 (PUBLIC DATA NET)
2002Primenet is a local network. I know of one in Poole, An BTGold use
2003one between their systems too. It Is only an internal network, I
2004suggest using PSS to communicate between different primes. Cheers.
2005<n>ext msg, <r>eply, or <s>top?
2006Msg#: 3799 *BBC*
200702/07/84 22:09:05 (Read 4 Times)
2008From: xxxxxxxxxxx
2009To: xxxxxxxxxxx
2010Subj: REPLY TO MSG# 3751 (RGB VIDEO)
2011The normal video output BNC can be made to produce colour video by
2012making a link near to the bnc socket on the pcb. details are in the
2013advanced user guide under the chapter on what the various links do.
2014If you require more I will try to help, as I have done this mod and
2015it works fine
2016Msg#: 935 *EREWHON*
201709/25/83 01:23:00 (Read 90 Times)
2018From: xxxxxxxxxx
2019To: ALL
2020Subj: US PHONE FREAKING
2021USA Phone Freaking is done with a 2 out of 5 Code. The tones must be
2022with 30Hz, and have less than 1% Distortion.
2023Master Tone Frequency = 2600 Hz.
2024Hacker's Handbook
2025file:///E|/Books/Hackers Handbook.htm (43 of 133) [11/28/2000 5:58:49 AM]
2026>1 = 700 & 900 Hz
2027>2 = 700 & 1100 Hz
2028>3 = 900 & 1100 HZ
2029>4 = 700 & 1300 Hz
2030>5 = 900 & 1300 Hz
2031>6 = 1100 & 1300 Hz
2032>7 = 700 & 1500 HZ
2033>8 = 900 & 1500 Hz
2034>9 = 1100 & 1500 Hz
2035>0 = 1300 & 1500 Hz
2036>Start Key Signal = 1100 & 1700 Hz
2037>End Key Signal = 1300 & 1700 Hz
2038> Military Priority Keys 11=700 & 1700 ; 12=900 & 1700 - I don't
2039recommend using these. ( The method of use will be explained in a
2040separate note. DO NOT DISCLOSE WHERE YOU GOT THESE FREQUENCIES TO
2041ANYONE!
2042Msg#: 936 *EREWHON*
204309/20/83 01:34:43 (Read 89 Times)
2044From: xxxxxxxxxxxx
2045To: ALL
2046Subj: UK PHONE FREAKING
2047The UK System also uses a 2 out of 5 tone pattern.
2048The Master Frequency is 2280 Hz
2049>I = 1380 & 1500 Hz
2050>2 = 1380 & 1620 Hz
2051>3 = 1500 & 1620 Hz
2052>4 = 1380 & 1740 Hz
2053>5 = 1500 & 1740 Hz
2054>6 = 1620 & 1740 Hz
2055>7 = 1380 & I860 Hz
2056>8 = 1500 & 1860 Hz
2057>9 = 1620 & 1860 Hz
2058>0 = 1740 & 1860 Hz
2059>Start Key = 1740 & 1980 ; End Keying = 1860 & 1980 Hz
2060>Unused I think 11 = 1380 & 1980 ; 12 = 1500 & 1980 Hz
2061This is from the CCITT White Book Vol. 6 and is known as SSMF No. 3
2062to some B.T. Personnel.
2063The 2280 Hz tone is being filtered out at many exchanges so you may
2064need quite high level for it to work.
2065** Page 45
2066Msg#: 951 *EREWHON*
206709/21/83 17:44:28 (Read 79 Times)
2068From: xxxxxxxxxx
2069To: PHONE FREAK's
2070Subj: NEED YOU ASK ?
2071In two other messages you will find the frequencies listed for the
2072Internal phone system controls. This note is intended to explain how
2073the system could be operated. The central feature to realise is that
2074Hacker's Handbook
2075file:///E|/Books/Hackers Handbook.htm (44 of 133) [11/28/2000 5:58:49 AM]
2076( especially in the (USA) the routing information in a call is not in
2077the Dialled Code. The normal sequence of a call is that the Area Code
2078is received while the Subscriber No. Is stored for a short period.
2079The Local Exchange reads the area code and selects the best route at
2080that time for the call. The call together with a new "INTERNAL"
2081dialling code Is then sent on to the next exchange together with the
2082subscriber number. This is repeated from area to area and group to
2083group. The system this way provides many routes and corrects itself
2084for failures.
2085The Technique. make a Long Distance call to a number which does not
2086answer. Send down the Master Tone. (2600 or 22080 Hz) This will
2087clear the line back, but leave you in the system. You may now send
2088the "Start key Pulse" followed by the Routing Code and the Subscriber
2089No. Finish with the "End keying Pulse". The system sees you as being
2090a distant exchange requesting a route for a call.
2091Meanwhile back at the home base. Your local exchange will be logging
2092you in as still ringing on the first call. There are further problems
2093in this in both the USA and the UK as the techniques are understood
2094and disapproved of by those in authority. You may need to have a
2095fairly strong signal into the system to get past filters present on
2096the line. Warning newer exchanges may link these filters to alarms.
2097Try from a phone box or a Public Place and see what happens or who
2098comes.
2099Example:- To call from within USA to Uk:
2100> Ring Toll Free 800 Number
2101> Send 2600 Hz Key Pulse
2102> When line goes dead you are in trunk level
2103> Start Pulse 182 End Pulse = White Plains N.Y. Gateway continued in
2104next message
2105Hsg#: 952 *EREWHON*
210609/21/83 18:03:12 (Read 73 Times)
2107From: xxxxxxxxxx
2108To: PHONE FREAKS
2109Subj: HOW TO DO IT PT 2
2110> Start Pulse 044 = United Kingdom
2111> 1 = London ( Note no leading O please )
2112> 730 1234 = Harrods Department Store.
2113Any info on internal address codes would be appreciated from any
2114callers.
2115Msg#: 1028 *EREWHON*
211609/25/83 23:02:35 (Read 94 Times)
2117From: xxxxxxxxxxxx
2118To: ALL
2119Subj: FREEFONE PART I
2120The following info comes from a leaflet entitled 'FREEFONE':
2121"British Telecom's recent record profits and continuing appalling
2122Hacker's Handbook
2123file:///E|/Books/Hackers Handbook.htm (45 of 133) [11/28/2000 5:58:49 AM]
2124service have prompted the circulation of this information. It
2125comprises a method of making telephone calls free of charge."
2126Circuit Diagram:
2127O---o------- -------o----O
2128: ! ! :
2129: ! ! :
2130L o-------- --------o P
2131I ! ! H
2132N ! ! O
2133E o-- ------ ----o N
2134: ! ! E
2135I ! ! :
2136N o------- -------o :
2137: :
2138: :
2139: :
2140O---------------------------O
2141** Page 46
2142S1 = XXX
2143C1 = XXX
2144D1 = XXX
2145D2 = XXX
2146R1 = XXX
2147Continued...
2148MSG#: 1029 *EREWHON*
214909/25/83 23:19:17 (Read 87 Times)
2150From xxxxxxxxxxx
2151To: ALL
2152Subj: FREEFONE PART 2
2153Circuit Operation:
2154The circuit inhibits the charging for incoming calls only. When a
2155phone is answered, there is normally approx. IOOmA DC loop current
2156but only 8mA or so is necessary to polarise the mic In the handset.
2157Drawing only this small amount is sufficient to fool BT's ancient
2158"Electric Meccano".
2159It's extremely simple. When ringing, the polarity of the line
2160reverses so D1 effectively answers the call when the handset is
2161lifted. When the call is established, the line polarity reverts and
2162R1 limits the loop current while D2 is a LED to indicate the circuit
2163is in operation. C1 ensures speech is unaffected. S1 returns the
2164telephone to normal.
2165Local calls of unlimited length can be made free of charge. Long
2166distance calls using this circuit are prone to automatic
2167disconnection this varies from area to area but you will get at least
21683 minutes before the line is closed down. Further experimentation
2169Hacker's Handbook
2170file:///E|/Books/Hackers Handbook.htm (46 of 133) [11/28/2000 5:58:49 AM]
2171should bear fruit in this respect.
2172Sith the phone on the hook this circuit is completely undetectable.
2173The switch should be cLosed if a call is received from an operator,
2174for example, or to make an outgoing call. It has proved extremely
2175useful, particularly for friends phoning from pay phones with jammed
2176coin slots.
2177*Please DO NOT tell ANYONE where yoU found this information*
2178Msg#: 1194 *EREWHON*
217910/07/83 04:50:34 (Read 81 Times)
2180From: xxxxxxxxxxxx
2181To: ALL
2182Subj: FREE TEST NUMBERS
2183Free Test Numbers
2184Here are some no's that have been found to work:
2185Dial 174 <last 4 figs of your no>: this gives unobtainable then when
2186you replace handset the phone rings.
2187Dial 175 <last 4 figs of your no: this gives start test...start
2188test...
2189then when you hang-up
2190the phone rings. pick it up and
2191either get dial tone which indicates ok or will a recording
2192i.e poor insulation b linetelling whats wrong. if can immediately 1305 to do further
2193test
2194might say faulty pulsesother numbers try
2195are 182184
2196185. i have discovered my exchange (pontybodkin) ring for 1267.
2197these all depend on local so pays experiment starting with 1
2198as
2199functions. discover something interest let me know sig.
2200msg: 2241 *erewhon*
220112/04/83 20:48:49 (read 65 times)
2202from: sysop
2203to: serious freaks
2204subj: usa info
2205there is company (?) in called loopmaniacs unlimitedpo box 1197port townsend.wa98368
2206who publish books
2207telephone hacking.
2208some circuits even. write m. hoy there. one their publications steal book at s5.95
2209plus about $4
2210post. its worth stealing but dont show customs!** page 47
2211msg#: 3266
221201/22/84 06:25:01 53 xxxxxxxxxx university
2213computers already described getting onto ucl pad allows various calls.
2214via network access many university/research full
2215Hacker's Handbook
2216file:///E|/Books/Hackers Handbook.htm (47 of 133) [11/28/2000 5:58:49 AM]
2217list use
2218call 40 helpselect guide.
2219typing view prompt listing addresses. host be used by addrwhere
2220address. passwords demo etc. find anything interesting report here.
2221hint: aviod hanging end each
2222logon command - name pwd. seems
2223trick. another number: tel: (0235) 834531. data
2224exchange. bit harder wake up. must send break
2225level start. done using software maplin
2226just momentarily pull out rs232 com. returns. classes could manchesters help:-
22271020300user:demo pwd:demo enre pacx. 3687 *hacker club*
222802/05/84 14:41:43 416 xxxxxxxxxxxx hackers following collected sig:
2229commodore bbs (finland) 358 61 116223
2230gateway 01 600 1261
2231prestest (1200/75) 583 9412 useful prestel nodes 640..res.d (martlesham experiments
2232dynamic drcscept standardspicture601
2233(mailboxtelemessagingtelex link maybe telecom gold)651
2234(scratchpad -always changing). occasionally parts 650 (ip news) not properly cuged
2235off. 190 sometimes well. boards specialised lonely hearts services ! an asterisk bell
2236tones
2237*fairbanksak907-479-0315
2238*burbank ca213-840-8252213-842-9452
2239*clovis209-298-1328
2240*glendale213-242-l882
2241*la palma714-220-0239
2242*hollywood213-764-8000
2243*san francisco415-467-2588
2244*santa monica213-390-3239
2245*sherman oaks213-990-6830
2246*tarana213-345-1047
2247*crystal rivers fl*atlantaga912-233-0863
2248*hammond219-845-4200
2249*clevelandoh216-932-9845
2250*lynnefieldma6l7-334-6369
2251*omahane402-571-8942
2252*freeholdnj201-462-0435
2253*new yorkny212-541-5975
2254*carync919-362-0676
2255*newport newsva 804-838-3973
2256*vancouver200-250-6624
2257marseillesfrance 33-91-91-0060
2258both nos. prefix (0101)
2259a) daily x-rated doke service 516-922-9463
2260b) auto-biographies young ladies normally work
2261unpublishable magazines 212-976-2727.
2262c)dial wank0101 48 3688 14:44:51 393 xxxxxxxxxxx cont...
2263hertford pdp 11/70 bbs: 0707-263577 110 baud selected. type: set speed 300crafter
2264hitting switch baud. hello 124
2265!password: hae4 ><cr>
2266When logged on type: COMMAND HACKER <cr>
2267Use: BYE to log out
2268*********
2269Hacker's Handbook
2270file:///E|/Books/Hackers Handbook.htm (48 of 133) [11/28/2000 5:58:49 AM]
2271EUCLID 388-2333
2272TYPE A COUPLE OF <cr> THEN PAD <cr>
2273ONCE LOGGED ON TO PAD TYPE CALL 40 <cr> TRY DEMO AS A USERID WHY NOT
2274TRY A FEW DIFFER DIFFERENT CALLS THIS WILL LET U LOG ON TO A WHOLE
2275NETWORK SYSTEM ALL OVER EUROPE!
2276YOU CAN ALSO USE 01-278-4355.
2277********
2278unknown 300 Baud 01-854 2411
227901-854 2499
2280******
2281Honeywell:From London dial the 75, else 0753(SLOUGH)
228275 74199 75 76930
2283Type- TSS
2284User id: D01003
2285password: Unknown (up to 10 chars long)
2286Type: EXPL GAMES LIST to list games
2287To run a game type: FRN GAMES(NAME) E for a fotran game.
2288Replace FRN with BRN for BASIC games.
2289******
2290Central London Poly 01 637 7732/3/4/5
2291******
2292PSS (300) 0753 6141
2293******
2294Comshare (300) 01 351 2311
2295******
2296'Money Box' 01 828 9090
2297******
2298Imperial College 01 581 1366
229901 581 1444
2300*******
2301These are most of the interesting numbers that have come up over the
2302last bit. If I have omitted any, please leave them in a message.
2303Cheers, xxxxx.
2304Msg#: 5156 *HACKER'S CLUB*
230504/15/84 08:01:11 (Read 221 Times)
2306From: xxxxxxxxxx
2307To: ALL
2308Subj: FINANCIAL DATABASES
2309You can get into Datastream on dial-up at 300/300 on 251 6180 - no I
2310don't have any passwords....you can get into Inter Company
2311Comparisons (ICC) company database of 60,000 companies via their
23121200/75 viewdata front-end processor on 253 8788. Type ***# when
2313asked for your company code to see a demo...
2314Msg#: 5195 *HACKER'S CLUB*
231504/17/84 02:28:10 (Read 229 Times)
2316From: xxxxxxxxxx
2317To: ALL
2318Subj: PSS TELEX
2319THIS IS PROBOBLY OLD HAT BY NOW BUT IF YOU USE PSS THEN A92348******
2320WHERE **=UK TELEX NO. USE CTRL/P CLR TO BET OUT AFTER MESSAGE. YOU
2321WILL BE CHARGED FOR USE I GUESS
2322Hacker's Handbook
2323file:///E|/Books/Hackers Handbook.htm (49 of 133) [11/28/2000 5:58:49 AM]
2324** Page 49
2325Msg#: 7468 *EREWHON*
232606/29/84 23:30:24 (Read 27 Times)
2327From: xxxxxxxxxx
2328To: PHREAKS
2329Subj: NEW(OLD..) INFO
2330TODAY I WAS LUCKY ENOUGH TO DISCOVER A PREVIOUSLY UNKNOWN CACHE OF
2331AMERICAN MAGAZINE KNOWN AS TAP. ALTHOUGH THEYRE RATHER OUT OF DATE
2332(1974-1981) OR SO THEY ARE PRETTY FUNNY AND HAVE A FEW INTERESTING
2333BITS OF INFORMATION, ESPECIALLY IF U WANT TO SEE THE CIRCUIT DIAGRAMS
2334OF UNTOLD AMOUNTS OF BLUE/RED/BLACK/??? BOXES THERE ARE EVEN A FEW
2335SECTIONS ON THE UK (BUT AS I SAID ITS COMPLETELY OUT OF DATE). IN THE
2336FUTURE I WILL POST SOME OF THE GOOD STUFF FROM TAP ON THIS BOARD
2337(WHEN AND IF I CAN GET ON THIS BLOODY SYSTEM''). ALSO I MANAGED TO
2338FIND A HUGE BOOK PUBLISHED BY AT&T ON DISTANCE DIALING (DATED 1975).
2339DUNNO, IF ANYBODY'S INTERESTED THEN LEAVE A NOTE REQUESTING ANY INFO
2340YOU'RE ARE CHEERS PS ANYBODY KNOW DEPRAVO THE RAT?? DOES HE STILL
2341LIVE?
2342Msg#: 7852 t*ACKER'S CLUB*
234308/17/84 00:39:05 (Read 93 Times)
2344From: xxxxxxxxxx
2345To: ALL USERS
2346Subj: NKABBS
2347NKABBS IS NOW ONLINE. FOR ATARI & OTHER MICRO USERS. OPERATING ON 300
2348BAUD VIA RINGBACK SYSTEM. TIMES 2130HRS-2400HRS DAILY. TEL :0795
2349842324. SYSTEM UP THESE TIMES ONLY UNTIL RESPONSE GROWS. ALL USERS
2350ARE WELCOME TO ON. EVENTUALLY WE WILL BE SERVING BBC,COMMODORE VIC
235120/64 OWNERS.+NEWS ETC.
2352Msg#:8154 *EREWHON*
235308/02/84 21:46:11 (Read 13 Times)
2354From: ANON
2355To: ALL
2356Subj: REPLY TO MSG# :1150 (PHREAK BOARDS)
2357PHREAK BOARD NUMBERS
2358ACROSS THE U.S.
2359IF YOU KNOW OF A BOARD THAT IS NOT LISTED HERE, PLEASE LET ME KNOW
2360ABOUT IT.
2361JOLLY ROGER 713-468-0174
2362PIRATE'S CHEST 617-981-1349
2363PIRATE'S DATA CENTER 213-341-3962
2364PIRATE'S SPACE STATION 617-244-8244
2365PIRATE'S OUTHOUSE 301-299-3953
2366PIRATE'S HANDLE 314-434-6187
2367PIRATE'S DREAM 713-997-5067
2368PIRATE'S TRADE 213-932-8294
2369PIRATE'S TREK 914-634-1268
2370PIRATE'S TREK III 914-835-3627
2371Hacker's Handbook
2372file:///E|/Books/Hackers Handbook.htm (50 of 133) [11/28/2000 5:58:49 AM]
2373PIRATE-80 305-225-8059
2374SANCTUARY 201-891-9567
2375SECRET SERVICE ][ 215-855-7913
2376SKELETON ISLAND 804-285-0041
2377BOCA HARBOR 305-392-5924
2378PIRATES OF PUGET SOUND 206-783-9798
2379THE INSANITARIUM 609-234-6106
2380HAUNTED MANSION 516-367-8172
2381WASTELANDS 513-761-8250
2382PIRATE'S HARBOR 617-720-3600
2383SKULL ISLAND 203-972-1685
2384THE TEMPLE 305-798-1615
2385SIR LANCELOT'S CASTLE 914-381-2124
2386PIRATE'8 CITY 703-780-0610
2387PIRATE-S GALLEY 213-796-6602
2388THE PAWN SHOPPE 213-859-2735
2389HISSION CONTROL 301-983-8293
2390BIG BLUE MONSTER 305-781-1683
2391THE I.C.'S SOCKET 213-541-5607
2392THE MAGIC REALM 212-767-9046
2393PIRATE'S BAY 415-775-2384
2394BEYOND BELIEF 213-377-6568
2395PIRATE's TROVE 703-644-1665
2396CHEYANNE MOUNTAIN 303-753 1554
2397ALAHO CITY 512-623-6123
2398CROWS NEST 617-862-7037
2399PIRATE'S PUB ][ 617-891-5793
2400PIRATE'S I/0 201-543-6139
2401SOUNDCHASER 804-788-0774
2402SPLIT INFINITY 408-867-4455
2403CAPTAIN'S LOG 612-377-7747
2404THE SILHARILLION 714-535-7527
2405TWILIGHT PHONE 313-775-1649
2406THE UNDERGROUND 707-996-2427
2407THE INTERFACE 213-477-4605
2408THE DOC BOARD 713-471-4131
2409SYSTEM SEVEN 415-232-7200
2410SHADOW WORLD 713-777-8608
2411OUTER LIMITS 213-784-0204
2412METRO 313-855-6321
2413MAGUS 703-471-0611
2414GHOST SHIP 111 - PENTAGON 312-627-5138
2415GHOST SHIP - TARDIS 312-528-1611
2416DATA THIEVES 312-392-2403
2417DANGER ISLAND 409-846-2900
2418CORRUPT COMPUTING 313-453-9183
2419THE ORACLE 305-475-9062
2420PIRATE'S PLANET 901-756-0026
2421CAESER S PALACE 305-253-9869
2422CRASHER BBS 415-461-8215
2423PIRATE'S BEACH 305-865-5432
2424PIRATE'S COVE 516-698-4008
2425PIRATE'S WAREHOUSE 415-924-8338
2426PIRATE'S PORT 512-345-3752
2427PIRATE'S NEWSTAND ][ 213-373-3318
2428Hacker's Handbook
2429file:///E|/Books/Hackers Handbook.htm (51 of 133) [11/28/2000 5:58:49 AM]
2430PIRATE'S GOLDMINE 617-443-7428
2431PIRATE'S SHIP 312-445-3883
2432PIRATE'S MOUNTAIN 213-472-4287
2433PIRATE'S TREK ][ 914-967-2917
2434PIRATE'S TREK IV 714-932-1124
2435PORT OR THIEVES 305-798-1051
2436SECRET SERVICE 213-932-8294
2437SHERWOOD FOREST 212-896-6063
2438GALAXY ONE 215-224-0864
2439R.A.G.T.I.H.E. 217-429-6310
2440KINGDOM OF SEVEN 206-767-7777
2441THE STAR SYSTEM 516-698-7345
2442ALPHANET 203-227-2987
2443HACKER HEAVEN 516-796-6454
2444PHANTOM ACCESS 814-868-1884
2445THE CONNECTION 516-487-1774
2446THE TAVERN 516-623-9004
2447PIRATE'S HIDEAWAY 617-449-2808
2448PIRATE'S PILLAGE 317-743-5789
2449THE PARADISE ON-LINE 512-477-2672
2450MAD BOARD FROM MARS 213-470-5912
2451NERVOUS SYSTEM 305-554-9332
2452DEVO 305-652-9422
2453TORTURE CHAMBER 213-375-6137
2454HELL 914-835-4919
2455CRASHER BBS 415-461-8215
2456ALCATRAZ 301-881-0846
2457THE TRADING POST 504-291-4970
2458DEATH STAR 312-627-5138
2459THE CPU 313-547-7903
2460TRADER'S INN 618-856-3321
2461PIRATE'S PUB 617-894-7266
2462BLUEBEARDS GALLEY 213-842-0227
2463MIDDLE EARTH 213-334-4323
2464EXIDY 2000 713-442-7644
2465SHERWOOD FOREST ][ 914-352-6543
2466WARLOCK~S CASTLE 618-345-6638
2467TRON 312-675-1819
2468THE SAFEHOUSE 612-724-7066
2469THE GRAPE VINE 612-454-6209
2470THE ARK 701-343-6426
2471SPACE VOYAGE 713-530-5249
2472OXGATE 804-898-7493
2473MINES OF MORIA ][ 408-688-9629
2474MERLIN'S TOWER 914-381-2374
2475GREENTREE 919-282-4205
2476GHOST SHIP ][ - ARAGORNS 312-644-5165
2477GENERAL HOSPITAL 201-992-9893
2478DARK REALM 713-333-2309
2479COSMIC VOYAGE 713-530-5249
2480CAMELOT 312-357-8075
2481PIRATE'S GUILD 312-279-4399
2482HKGES 305-676-5312
2483MINES OF MORIA 713-871-8577
2484A.S.C.I.I. 301-984-3772
2485Hacker's Handbook
2486file:///E|/Books/Hackers Handbook.htm (52 of 133) [11/28/2000 5:58:49 AM]
2487** Page 50
2488If Anybody is mad enough to actually dial up one (or more') of these
2489BBs please log everything so thAt others may benefit from your
2490efforts. IE- WE only have to register once, and we find out if this
2491board suits our interest. Good luck and have fun! Cheers,
2492Msg#: 8163 *HACKER'S CLUB*
249308/30/84 18:55:27 (Read 78 Times)
2494From: XXXXXXXXXX
2495To- ALL
2496Subj: XXXXXX
2497NBBS East is a relatively new bulletin board running from lOpm to
24981230am on 0692 630610. There are now special facilities for BBC users
2499with colour, graphics etc. If you call it then please try to leave
2500some messages as more messages mean more callers, which in turn means
2501more messages Thanks a lot, Jon
2502Msg#: 8601 *HACKER'S CLUB*
250309/17/84 10:52:43 (Read 57 Times!
2504From: xxxxxxxxxx
2505To: xxxxxxxxx
2506Subj: REPLY TO Msg# 8563 (HONEYWELL)
2507The thing is I still ( sort of I work for XXX so I don't think they
2508would be too pleased if I gave out numbers or anything else. and I
2509would rather keep my job Surely you don't mean MFI furniture ??
2510Msg#: 8683 *HACKER'S CLUB*
251109/19/84 19:54:05 (Read 63 Times)
2512From: xxxxxxxxx
2513To: ALL
2514Subj: DATA NODE
2515To those who have difficulty finding interesting numbers. try the UCL
2516Data Node on 01-388 2333 (300 baud).When you get the Which Service?
2517prompt. type PAD and a couple of CRs. Then, when the PAD> prompt
2518appears type CALL XOOXOOX, where is any(number orrange of numbers.
2519Indeed you can try several formats and numbers until you find
2520something interesting. The Merlin Cern computer is 9002003 And it's
2521difficult to trace You through aq data exchange! If anyone finds any
2522interesting numbers, let me know on this board, or Pretsel mailbox
2523012495225.
2524Msg has replies, read now(Y/N)' Y
2525Msg#: 9457 *HACKER'S CLUB*
252610/11/84 01:52:56 (Read 15 Times)
2527From: xxxxxxxxxxx
2528To: xxxxxxxxxxx
2529Subj: REPLY TO MSG# 8683 (DATA NODE)
2530IF YOU WANT TO KNOW MORE ABOUT THIS xxxxx PHONE PHONE xxxx xxxxxx
2531ON 000 0000
2532Msg#: 8785 *HACKER'S CLUB*
253309/21/B4 20-28-59 (Read 40 Times)
2534Hacker's Handbook
2535file:///E|/Books/Hackers Handbook.htm (53 of 133) [11/28/2000 5:58:49 AM]
2536From xxxxxxxxxxxxxx
2537Subj: NEW Number
2538NEW Computer ON LINE TRY RINGING 960 7868 SORRY THAT'S 01 (IN LONDON) IN FRONT.
2539good LUCK!
2540** Page 51
2541Please note that none of these hints, rumours, phone numbers and
2542passwords are likely to work by the time you are reading this...
2543However, in the case of the US credit agency TRW, described in the
2544previous chapter, valid phone numbers and passwords appear to have
2545sat openly on a number of bulletin boards for up to a year before the
2546agency realised it. Some university mainframes have hacker's boards
2547hidden on them as well.
2548It is probably bad taste to mention it, but of course people try
2549to hack bulletin boards as well. An early version of one of the most
2550popular packages could be hacked simply by sending two semi-colons
2551(;;) when asked for your name. The system allowed you to become the
2552Sysop, even though you were sitting at a different computer; you
2553could access the user file, complete with all passwords, validate or
2554devalidate whomever you liked, destroy mail, write general notices,
2555and create whole new areas...
2556Research Sources
2557The computer industry has found it necessary to spend vast sums on
2558marketing its products and whilst some of that effort is devoted to
2559'image' and 'concept' type advertising--to making senior management
2560comfortable with the idea of the XXX Corporation's hardware because
2561it has 'heard' of it--much more is in the form of detailed product
2562information.
2563This information surfaces in glossies, in conference papers, and
2564in magazine journalism. Most professional computer magazines are
2565given away on subscription to 'qualified' readers; mostly the
2566publisher wants to know if the reader is in a position to influence a
2567key buying decision--or is looking for a job.
2568I have never had any difficulty in being regarded as qualified:
2569certainly no one ever called round to my address to check up the size
2570of my mainframe installation or the number of employees. If in doubt,
2571you can always call yourself a consultant. Registration is usually a
2572matter of filling in a post-paid card. My experience is that, once
2573you are on a few subscription lists, more magazines, unasked for,
2574tend to arrive every week or month--together with invitations to
2575expensive conferences in far-off climes. Do not be put off by the
2576notion that free magazines must be garbage. In the computer industry,
2577as in the medical world, this is absolutely not the case. Essential
2578regular reading for hackers are Computing, Computer Weekly, Software,
2579Datalink, Communicate, Communications Management, Datamation,
2580Mini-Micro Systems, and Telecommunications.
2581Hacker's Handbook
2582file:///E|/Books/Hackers Handbook.htm (54 of 133) [11/28/2000 5:58:49 AM]
2583** Page 52
2584The articles and news items often contain information of use to
2585hackers: who is installing what, where; what sort of facilities are
2586being offered; what new products are appearing and what features they
2587have. Sometimes you will find surveys of sub-sets of the computer
2588industry. Leafing through the magazine pile that has accumulated
2589while this chapter was being written, I have marked for special
2590attention a feature on Basys Newsfury, an electronic newsroom package
2591used, among others, by ITN's Channel Four News; several articles on
2592new on-line hosts; an explanation of new enhanced Reuters services; a
2593comparison of various private viewdata software packages and who is
2594using them; some puffs for new Valued Added Networks (VANs); several
2595pieces on computer security; news of credit agencies selling
2596on-line and via viewdata; and a series on Defence Data Networks.
2597In most magazines, however, this is not all: each advertisement is
2598coded with a number which you have to circle on a tear-out post-paid
2599'bingo card': each one you mark will bring wads of useful
2600information: be careful, however, to give just enough information
2601about yourself to ensure that postal packets arrive and not
2602sufficient to give the 'I was just passing in the neighbourhood and
2603thought I would call in to see if I could help' sales rep a 'lead' he
2604thinks he can exploit.
2605Another excellent source of information are exhibitions: there are
2606the ubiquitous 'product information' sheets, but also the actual
2607machines and software to look at and maybe play with; perhaps you can
2608even get a full scale demonstration and interject a few questions.
2609The real bonus of exhibitions, of course, is that the security sense
2610of salespersons, exhausted by performing on a stand for several days
2611and by the almost compulsory off-hours entertainment of top clients
2612or attempted seduction of the hired-in 'glamour' is rather low.
2613Passwords are often written down on paper and consulted in your full
2614view. All you need is a quick eye and a reasonable memory.
2615At both exhibitions and conferences it is a good idea to be a
2616freelance journalist. Most computer mags have relatively small
2617full-time staff and rely on freelancers, so you won't be thought odd.
2618And you'll have your questions answered without anyone asking 'And
2619how soon do you think you'll be making a decision? Sometimes the lack
2620of security at exhibitions and demonstrations defies belief. When ICL
2621launched its joint venture product with Sinclair, the One-Per-Desk
2622communicating executive work- stations; it embarked on a modest
2623road-show to give hands-on experience to prospective purchasers. The
2624demonstration models had been pre-loaded with phone numbers...of
2625senior ICL directors, of the ICL mainframe at its headquarters in
2626Putney and various other remote services....
2627** Page 53
2628Beyond these open sources of information are a few murkier ones.
2629The most important aid in tackling a 'difficult' operating system or
2630applications program is the proper documentation: this can be
2631obtained in a variety of ways. Sometimes a salesman may let you look
2632Hacker's Handbook
2633file:///E|/Books/Hackers Handbook.htm (55 of 133) [11/28/2000 5:58:49 AM]
2634at a manual while you 'help' him find the bit of information he can't
2635remember from his sales training. Perhaps an employee can provide a
2636'spare', or run you a photocopy. In some cases, you may even find the
2637manual stored electronically on the system; in which case, print it
2638out. Another desirable document is an organisation's internal phone
2639book...it may give you the numbers for the computer ports, but
2640failing that, you will be able to see the range of numbers in use
2641and, if you are using an auto-dial modem coupled with a
2642search-and-try program, you will be able to define the search
2643parameters more carefully. A phone book will also reveal the names of
2644computer managers and system engineers; perhaps they use fairly
2645obvious passwords.
2646It never ceases to astonish me what organisations leave in refuse
2647piles without first giving them a session with the paper shredder.
2648I keep my cuttings carefully stored away in a second-hand filing
2649cabinet; items that apply to more than one interest area are
2650duplicated in the photocopier.
2651Inference
2652But hackers' research doesn't rely simply on collecting vast
2653quantities of paper against a possible use. If you decide to target
2654on a particular computer or network, it is surprising what can be
2655found out with just a little effort. Does the organisation that owns
2656the system publish any information about it. In a handbook, annual
2657report, house magazine? When was the hardware and software installed?
2658Did any of the professional weekly computer mags write it up? What do
2659you know about the hardware, what sorts of operating systems would
2660you expect to see, who supplied the software, do you know anyone with
2661experience of similar systems, and so on.
2662By way of illustration, I will describe certain inferences it is
2663reasonable to make about the principal installation used by Britain's
2664Security Service, MI5. At the end, you will draw two conclusions:
2665first that someone seriously interested in illicitly extracting
2666information from the computer would find the traditional techniques
2667of espionage--suborning of MI5 employees by bribery, blackmail or
2668appeal to ideology--infinitely easier than pure hacking; and second,
2669that remarkable detail can be accumulated about machines and
2670systems, the very existence of which is supposed to be a secret--and
2671by using purely open sources and reasonable guess-work.
2672** Page 54
2673The MI5 databanks and associated networks have long been the
2674subject of interest to civil libertarians. Few people would deny
2675absolutely the need for an internal security service of some sort,
2676nor deny that service the benefit of the latest technology. But,
2677civil libertarians ask, who are the legitimate targets of MI5's
2678activities? If they are 'subversives', how do you define them? By
2679looking at the type of computer power MI5 and its associates possess,
2680it possible to see if perhaps they are casting too wide a net for
2681Hacker's Handbook
2682file:///E|/Books/Hackers Handbook.htm (56 of 133) [11/28/2000 5:58:49 AM]
2683anyone's good. If, as has been suggested, the main installation can
2684hold and access 20 million records, each containing 150 words, and
2685Britain's total population including children, is 56 million, then
2686perhaps an awful lot of individuals are being marked as 'potential
2687subversives'.
2688It was to test these ideas out that two journalists, not
2689themselves out-and-out hackers, researched the evidence upon which
2690hackers have later built. The two writers were Duncan Campbell of the
2691New Statesman and Steve Connor, first of Computing and more recently
2692on the New Scientist. The inferences work this way: the only
2693computer manufacturer likely to be entrusted to supply so sensitive a
2694customer would be British and the single candidate would be ICL. You
2695must therefore look at their product range and decide which items
2696would be suitable for a really large, secure, real-time database
2697management job. In the late 1970s, the obvious path was the 2900
2698series, possibly doubled up and with substantive rapid-access disc
2699stores of the type EDS200.
2700Checking through back issues of trade papers it is possible to see
2701that just such a configuration, in fact a dual 2980 with a 2960 as
2702back-up and 20 gigabytes of disc store, were ordered for classified
2703database work by the Ministry of Defence'. ICL, on questioning by
2704the journalists, confirmed that they had sold 3 such large systems
2705two abroad and one for a UK government department. Campbell and
2706Connor were able to establish the site of the computer, in Mount Row,
2707London W1, and, in later stories, gave more detail, this time
2708obtained by a careful study of advertisements placed by two
2709recruitment agencies over several years. The main computer, for
2710example, has several minis attached to it, and at least 200
2711terminals. The journalists later went on to investigate details of
2712the networks--connections between National Insurance, Department of
2713Health, police and vehicle driving license Systems.
2714In fact, at a technical level, and still keeping to open sources,
2715You can build up even more detailed speculations about the MI5 main
2716computer.
2717** Page 55
2718ICL's communication protocols, CO1, C02, C03, are published items;
2719you can get terminal emulators to work on a PC, and both the company
2720and its employees have published accounts of their approaches to
2721database management systems, which, incidentally, integrate software
2722and hardware functions to an unusually high degree, giving speed but
2723also a great deal of security at fundamental operating system level.
2724Researching MI5 is an extreme example of what is possible; there
2725are few computer installations of which it is in the least difficult
2726to assemble an almost complete picture.
2727** Page 56
2728Hacker's Handbook
2729file:///E|/Books/Hackers Handbook.htm (57 of 133) [11/28/2000 5:58:49 AM]
2730CHAPTER 6
2731Hackers' Techniques
2732The time has now come to sit at the keyboard, phone and modems at
2733the ready, relevant research materials convenient to hand and see
2734what you can access. In keeping with the 'handbook' nature of this
2735publication, I have put my most solid advice in the form of a
2736trouble-shooting appendix (I), so this chapter talks around the
2737techniques rather than spelling them out in great detail.
2738Hunting instincts Good hacking, like birdwatching and many other
2739pursuits, depends ultimately on raising your intellectual knowledge
2740almost to instinctive levels. The novice twitcher will, on being told
2741'There's a kingfisher!', roam all over the skies looking for the
2742little bird and probably miss it. The experienced ornithologist will
2743immediately look low over a patch of water, possibly a section shaded
2744by trees, because kingfishers are known to gulp the sort of flies
2745that hover over streams and ponds. Similarly, a good deal of skilful
2746hacking depends on knowing what to expect and how to react. The
2747instinct takes time to grow, but the first step is understanding that
2748you need to develop it in the first place.
2749Tricks with phones
2750If you don't have a complete phone number for a target computer,
2751then you can get an auto-dialler and a little utility program to
2752locate it for you. You will find a flow-chart for a program in
2753Appendix VII. An examination of the phone numbers in the vicinity of
2754the target machine should give you a range within which to search.
2755The program then accesses the auto-dial mechanism of the modem and
2756'listens' for any whistles. The program should enable the phone line
2757to be disconnected after two or three 'rings' as auto-anSwer modems
2758have usually picked up by then.
2759Such programs and their associated hardware are a little more
2760Complicated than the popularised portrayals suggest: you must have
2761software to run sequences of calls through your auto-dialler, the
2762hardware must tell you whether you have scored a 'hit' with a modem
2763or merely dialled a human being, and, since the whole point of the
2764exercise is that it works unattended, the process must generate a
2765list of numbers to try.
2766** Page 57
2767Logging on
2768You dial up, hear a whistle...and the VDU stays blank. What's gone
2769wrong? Assuming your equipment is not at fault, the answer must lie
2770either in wrong speed setting or wrong assumed protocol. Experienced
2771hackers listen to a whistle from an unknown computer before throwing
2772the data button on the modem or plunging the phone handset into the
2773rubber cups of an acoustic coupler. Different tones indicate
2774Hacker's Handbook
2775file:///E|/Books/Hackers Handbook.htm (58 of 133) [11/28/2000 5:58:49 AM]
2776different speeds and the trained ear can easily detect the
2777difference--appendix III gives the common variants.
2778Some modems, particularly those on mainframes, can operate at more
2779than one speed; the user sets it by sending the appropriate number of
2780carriage returns. In a typical situation, the mainframe answers at
2781110 baud (for teletypewriters), and two carriage returns take it up
2782to 300 baud, the normal default for asynchronous working.
2783Some hosts will not respond until they receive a character from
2784the user. Try sending a space or a carriage return.
2785If these obvious things don't work and you continue to get no
2786response, try altering the protocol settings (see chapters 2 and 3).
2787Straightforward asynchronous protocols with 7-bit ASCII, odd or even
2788parity and surrounded by one stop and one start bit is the norm, but
2789almost any variant is possible.
2790Once you start getting a stream from the host, you must evaluate
2791it to work out what to do next. Are all the lines over-writing each
2792other and not scrolling down the screen? Get your terminal software
2793to insert carriage returns. Are you getting a lot of corruption?
2794Check your phone connections and your protocols. The more familiar
2795you are with your terminal software at this point, the more rapidly
2796you will get results.
2797Passwords
2798Everyone thinks they know how to invent plausible and acceptable
2799passwords; here are the ones that seem to come up over and over
2800again:
2801HELP - TEST - TESTER - SYSTEM - SYSTEM - MANAGER - SYSMAN - SYSOP -
2802ENGINEER - OPS - OPERATIONS - CENTRAL - DEMO - DEMONSTRATION - AID -
2803DISPLAY - CALL - TERMINAL - EXTERNAL - REMOTE - CHECK - NET - NETWORK
2804- PHONE - FRED
2805** Page 58
2806Are you puzzled by the special inclusion of FRED? Look at your
2807computer keyboard sometime and see how easily the one-fingered typist
2808can find those four letters!
2809If you know of individuals likely to have legitimate access to a
2810system, find out what you can about them to see if you can
2811second-guess their choice of personal password. Own names, or those
2812of loved ones, or initials are the top favourites. Sometimes there is
2813some slight anagramming and other forms of obvious jumbling. If the
2814password is numeric, the obvious things to try are birthdays, home
2815phone numbers, vehicle numbers, bank account numbers (as displayed on
2816cheques) and so on.
2817Sometimes numeric passwords are even easier to guess: I have found
2818myself system manager of a private viewdata system simply by offering
2819Hacker's Handbook
2820file:///E|/Books/Hackers Handbook.htm (59 of 133) [11/28/2000 5:58:49 AM]
2821it the password 1234567890 and other hackers have been astonished at
2822the results obtained from 11111111, 22222222 etc or 1010101, 2020202.
2823It is a good idea to see if you can work on the mentality and known
2824pre-occupations of the legitimate password holder: if he's keen on
2825classic rock'n'roll, you could try ELVIS; a gardener might choose
2826CLEMATIS; Tolkien readers almost invariably select FRODO or BILBO;
2827those who read Greek and Roman Literature at ancient universities
2828often assume that no one would ever guess a password like EURIPIDES;
2829it is a definitive rule that radio amateurs never use anything other
2830than their call-signs.
2831Military users like words like FEARLESS and VALIANT or TOPDOG;
2832universities, large companies and public corporations whose various
2833departments are known by acronyms (like the BBC) can find those
2834initials reappearing as passwords.
2835One less-publicised trick is to track down the name of the top
2836person in the organisation and guess a computer identity for them;
2837the hypothesis is that they were invited to try the computer when it
2838was first opened and were given an 'easy' password which has neither
2839been used since nor wiped from the user files. A related trick is to
2840identify passwords associated with the hardware or software
2841installer; usually the first job of a system manager on taking over a
2842computer is to remove such IDs, but often they neglect to do so.
2843Alternatively, a service engineer may have a permanent ID so that, if
2844the system falls over, it can be returned to full activity with the
2845minimum delay.
2846Nowadays there is little difficulty in devising theoretically
2847secure password systems, and bolstering them by allowing each user
2848only three false attempts before the disconnecting the line, as
2849Prestel does, for example. The real difficulty lies in getting humans
2850to follow the appropriate procedures. Most of us can only hold a
2851limited quantity of character and number sequences reliably in our
2852heads.
2853** Page 59
2854Make a log-on sequence too complicated, and users will feel compelled
2855to write little notes to themselves, even if expressly forbidden to
2856do so. After a while the complicated process becomes
2857counter-productive. I have a encrypting/decrypting software pack- age
2858for the IBM PC. It is undoubtedly many times more secure than the
2859famous Enigma codes of World War II and after. The trouble is that
2860that you need up to 25 different 14-digit numbers of your
2861specification, which you and your correspondent must share if
2862successful recovery of the original text is to take place.
2863Unfortunately the most convenient way to store these sequences is
2864in a separate disk file (get one character wrong and decryption is
2865impossible) and it is all too easy to save the key file either with
2866the enciphered stream, or with the software master, in both of which
2867locations they are vulnerable.
2868Hacker's Handbook
2869file:///E|/Books/Hackers Handbook.htm (60 of 133) [11/28/2000 5:58:49 AM]
2870Nowadays many ordinary users of remote computer services use
2871terminal emulator software to store their passwords. It is all too
2872easy for the hacker to make a quick copy of a 'proper' user's disk,
2873take it away, and then examine the contents of the various log-on
2874files--usually by going into an 'amend password' option. The way for
2875the legitimate user to obtain protection, other than the obvious one
2876of keeping such disks secure, is to have the terminal software itself
2877password protected, and all files encrypted until the correct
2878password is input. But then that new password has to be committed to
2879the owner's memory....
2880Passwords can also be embedded in the firmware of a terminal.
2881This is the approach used in many Prestel viewdata sets when the user
2882can, sometimes with the help of the Prestel computer, program his or
2883her set into an EAROM (Electrically Alterable Read Only Memory). If,
2884in the case of Prestel, the entire 14-digit sequence is permanently
2885programmed in the set, that identity (and the user bill associated
2886with it) is vulnerable to the first person who hits the 'viewdata'
2887button on the keypad. Most users only program in the first 10 digits
2888and key in the last four manually. A skilful hacker can make a
2889terminal disgorge its programmed ID by sticking a modem in
2890answer-mode on its back (reversing tones and, in the case of
2891viewdata, speeds also) and sending the ASCII ENQ (ctrl-E) character,
2892which will often cause the user's terminal to send its identity.
2893A more devious trick with a conventional terminal is to write a
2894little program which overlays the usual sign-on sequence. The program
2895captures the password as it is tapped out by the legitimate user and
2896saves it to a file where the hacker can retrieve it later.
2897** Page 60
2898People reuse their passwords. The chances are that, if you obtain
2899someone's password on one system, the same one will appear on another
2900system to which that individual also has access.
2901Programming tricks
2902In most longish magazine articles about electronic crime, the
2903writer includes a list of 'techniques' with names like Salami, Trap
2904Door and Trojan Horse. Most of these are not applicable to pure
2905hacking, but refer to activities carried out by programmers
2906interested in fraud.
2907The Salami technique, for example, consists of extracting tiny
2908sums of money from a large number of bank accounts and dumping the
2909proceeds into an account owned by the frauds man. Typically there's
2910an algorithm which monitors deposits which have as their last digit
2911'8'; it then deducts '1' from that and then £1 or $1 is siphoned off.
2912The Trojan Horse is a more generalised technique which consists of
2913hiding away a bit of unorthodox active code in a standard legitimate
2914routine. The code could, for example, call a special larger routine
2915under certain conditions and that routine could carry out a rapid
2916Hacker's Handbook
2917file:///E|/Books/Hackers Handbook.htm (61 of 133) [11/28/2000 5:58:49 AM]
2918fraud before wiping itself out and disappearing from the system for
2919good.
2920The Trap Door is perhaps the only one of these techniques that
2921pure hackers use. A typical case is when a hacker enters a system
2922with a legitimate identity but is able to access and alter the user
2923files. The hacker than creates a new identity with extra privileges
2924to roam over the system, and is thus able to enter it at any time as
2925a 'super-user' or 'system manager'.
2926Hardware tricks
2927For the hacker with some knowledge of computer hardware and
2928general electronics, and who is prepared to mess about with circuit
2929diagrams, a soldering iron and perhaps a voltmeter, logic probe or
2930oscilloscope, still further possibilities open up. One of the most
2931useful bits of kit consists of a small cheap radio receiver (MW/AM
2932band), a microphone and a tape recorder. Radios in the vicinity of
2933computers, modems and telephone lines can readily pick up the chirp
2934chirp of digital communications without the need of carrying out a
2935physical phone 'tap'.
2936Alternatively, an inductive loop with a small low-gain amplifier in
2937the vicinity of a telephone or line will give you a recording you can
2938analyse later at your leisure.
2939** Page 61
2940By identifying the pairs of tones being used, you can separate the
2941caller and the host. By feeding the recorded tones onto an
2942oscilloscope display you can freeze bits, 'characters' and 'words';
2943you can strip off the start and stop bits and, with the aid of an
2944ASCII-to-binary table, examine what is happening. With experience it
2945is entirely possible to identify a wide range of protocols simply
2946from the 'look' of an oscilloscope. A cruder technique is simply to
2947record and playback sign-on sequences; the limitation is that, even
2948if you manage to log on, you may not know what to do afterwards.
2949Listening on phone lines is of course a technique also used by
2950some sophisticated robbers. In 1982 the Lloyds Bank Holborn branch
2951was raided; the alarm did not ring because the thieves had previously
2952recorded the 'all-clear' signal from the phone line and then, during
2953the break-in, stuffed the recording up the line to the alarm
2954monitoring apparatus.
2955Sometimes the hacker must devise ad hoc bits of hardware trickery
2956in order to achieve his ends. Access has been obtained to a
2957well-known financial prices service largely by stringing together a
2958series of simple hardware skills. The service is available mostly on
2959leased lines, as the normal vagaries of dial-up would be too
2960unreliable for the City folk who are the principal customers.
2961However, each terminal also has an associated dial-up facility, in
2962case the leased line should go down; and in addition, the same
2963Hacker's Handbook
2964file:///E|/Books/Hackers Handbook.htm (62 of 133) [11/28/2000 5:58:49 AM]
2965terminals can have access to Prestel. Thus the hacker thought that it
2966should be possible to access the service with ordinary viewdata
2967equipment instead of the special units supplied along with the annual
2968subscription. Obtaining the phone number was relatively easy: it was
2969simply a matter of selecting manual dial-up from the appropriate
2970menu, and listening to the pulses as they went through the regular
2971phone.
2972The next step was to obtain a password. The owners of the terminal
2973to which the hacker had access did not know their ID; they had no
2974need to know it because it was programmed into the terminal and sent
2975automatically. The hacker could have put a micro 'back-to-front'
2976across the line and sent a ENQ to see if an ID would be sent back.
2977Instead he tried something less obvious.
2978The terminal was known to be programmable, provided one knew how
2979and had the right type of keyboard. Engineers belonging to the
2980service had been seen doing just that. How could the hacker acquire
2981'engineer' status? He produced the following hypothesis: the keyboard
2982used by the service's customers was a simple affair, lacking many of
2983the obvious keys used by normal terminals; the terminal itself was
2984manufactured by the same company that produced a range of editing
2985terminals for viewdata operators and publishers. Perhaps if one
2986obtained a manual for the editing terminal, important clues might
2987appear. A suitable photocopy was obtained and, lo and behold, there
2988were instructions for altering terminal IDs, setting auto-diallers
2989and so on.
2990** Page 62
2991Now to obtain a suitable keyboard. Perhaps a viewdata editing
2992keyboard or a general purpose ASCII keyboard with switchable baud
2993rates? So far, no hardware difficulties. An examination of the back
2994of the terminal revealed that the supplied keypads used rather
2995unusual connectors, not the 270° 6-pin DIN which is the Prestel
2996standard. The hacker looked in another of his old files and
2997discovered some literature relating to viewdata terminals. Now he
2998knew what sort of things to expect from the strange socket at the
2999back of the special terminal: he pushed in an unterminated plug and
3000proceeded to test the free leads with a volt-meter against what he
3001expected; eight minutes and some cursing later he had it worked out;
3002five minutes after that he had built himself a little patch cord
3003between an ASCII keyboard, set initially to 75 baud and then to 1200
3004baud as the most likely speeds; one minute later he found the
3005terminal was responding as he had hoped...
3006Now to see if there were similarities between the programming
3007commands in the equipment for which he had a manual and the equipment
3008he wished to hack. Indeed there were: on the screen before him was
3009the menu and ID and phone data he had hoped to see. The final test
3010was to move over to a conventional Prestel set, dial up the number
3011for the financial service and send the ID.
3012The hacker himself was remarkably uninterested in the financial
3013world and, after describing to me how he worked his trick, has now
3014Hacker's Handbook
3015file:///E|/Books/Hackers Handbook.htm (63 of 133) [11/28/2000 5:58:49 AM]
3016gone in search of other targets.
3017Operating Systems
3018The majority of simple home micros operate only in two modes--
3019Basic or machine code. Nearly all computers of a size greater than
3020this use operating systems which are essentially housekeeping
3021routines and which tell the processor where to expect instructions
3022from, how to identify and manipulate both active and stored memory,
3023how to keep track of drives and serial ports (and Joy-sticks and
3024mice), how to accept data from a keyboard and locate it on a screen,
3025how to dump results to screen or printer or disc drive, and so on.
3026Familiar micro-based operating systems lnclude CP/M, MS-DOS, CP/M-86
3027and so on, but more advanced operating systems have more
3028facilities--capacity to allow several users all accessing the same
3029data and programs without colliding with each other, enlarged
3030standard utilities to make fast file creation, fast sorting and fast
3031calculation much easier. Under Simple operating systems, the
3032programmer has comparatively few tools to help him; often there is
3033just the Basic language, which elf contains no standard
3034procedures--almost everything must be written from scratch each time.
3035** Page 63
3036But most computer programs rely, in essence, on a small set of
3037standard modules: forms to accept data to a program, files to keep
3038the data in, calculations to transform that data, techniques to sort
3039the data, forms to present the data to the user upon demand, the
3040ability to present results in various graphics, and so on. So
3041programs written under more advanced operating systems tend to be
3042comparatively briefer for the same end-result than those with Basic
3043acting not only as a language, but also as the computer's
3044housekeeper.
3045When you enter a mainframe computer as an ordinary customer, you
3046will almost certainly be located in an applications program, perhaps
3047with the capacity to call up a limited range of other applications
3048programs, whilst staying in the one which has logged you on as user
3049and is watching your connect-time and central processor usage.
3050One of the immediate aims of a serious hacker is to get out of
3051this environment and see what other facilities might be located on
3052the mainframe. For example, if access can be had to the user-log it
3053becomes possible for the hacker to create a whole new status for
3054himself, as a system manager, engineer, whatever. The new status,
3055together with a unique new password, can have all sorts o f
3056privileges not granted to ordinary users. The hacker, having acquired
3057the new status, logs out in his original identity and then logs back
3058with his new one.
3059There is no single way to break out of an applications program
3060into the operating system environment; people who do so seldom manage
3061it by chance: they tend to have had some experience of a similar
3062mainframe. One of the corny ways is to issue a BREAK or ctrl-C
3063Hacker's Handbook
3064file:///E|/Books/Hackers Handbook.htm (64 of 133) [11/28/2000 5:58:49 AM]
3065command and see what happens; but most applications programs
3066concerned with logging users on to systems tend to filter out
3067'disturbing' commands of that sort. Sometimes it easier to go beyond
3068the logging-in program into an another 'authorised' program and try
3069to crash out of that. The usual evidence for success is that the
3070nature of the prompts will change. Thus, on a well-known mini family
3071OS, the usual user prompt is
3072COMMAND ?
3073or simply
3074>
3075** Page 64
3076Once you have crashed out the prompt may change to a simple
3077.
3078or
3079*
3080or even
3081:
3082it all depends.
3083To establish where you are in the system, you should ask for a
3084directory; DIR or its obvious variants often give results. Directories
3085may be hierarchical, as in MS-DOS version 2 and above, so that at
3086the bottom level you simply get directories of other directories.
3087Unix machines are very likely to exhibit this trait. And once you get
3088a list of files and programs...well, that's where the exploration
3089really begins.
3090In 1982, two Los Angeles hackers, still in their teens, devised
3091one of the most sensational hacks so far, running all over the
3092Pentagon's ARPA data exchange network. ARPAnet was and is the
3093definitive packet-switched network (more about these in the next
3094chapter). It has been running for twenty years, cost more than $500m
3095and links together over 300 computers across the United States and
3096beyond. Reputedly it has 5,000 legitimate customers, among them
3097NORAD, North American Air Defence Headquarters at Omaha, Nebraska.
3098Ron Austin and Kevin Poulsen were determined to explore it.
3099Their weapons were an old TRS-80 and a VIC-20, nothing
3100complicated, and their first attempts relied on password-guessing.
3101The fourth try, 'UCB', the obvious initials of the University of
3102California at Berkeley, got them in. The password in fact was little
3103used by its legitimate owner and in the end, it was to be their
3104downfall.
3105Hacker's Handbook
3106file:///E|/Books/Hackers Handbook.htm (65 of 133) [11/28/2000 5:58:49 AM]
3107Aspects of ARPAnet have been extensively written up in the
3108text-books simply because it has so many features which were first
3109tried there and have since become 'standard' on all data networks.
3110From the bookshop at UCLA, the hackers purchased the manual for UNIX,
3111the multi-tasking, multi-user operating system devised by Bell
3112Laboratories, the experimental arm of AT&T, the USA's biggest
3113telephone company.
3114** Page 65
3115At the heart of Unix is a small kernel containing system primitives;
3116Unix instructions are enclosed in a series of shells, and very
3117complicated procedures can be called in a small number of text lines
3118simply by defining a few pipes linking shells. Unix also contains a
3119large library of routines which are what you tend to find inside the
3120shells. Directories of files are arranged in a tree-like fashion,
3121with master or root directories leading to other directories, and so
3122on.
3123Ron and Kevin needed to become system 'super-users' with extra
3124privileges, if they were to explore the system properly; 'UCB' was
3125merely an ordinary user. Armed with their knowledge of Unix, they set
3126out to find the files containing legitimate users' passwords and
3127names. Associated with each password was a Unix shell which defined
3128the level of privilege. Ron wrote a routine which captured the
3129privilege shell associated with a known super-user at the point when
3130that user signed on and then dumped it into the shell associated with
3131a little-used identity they had decided to adopt for their own
3132explorations. They became 'Jim Miller'; the original super-user lost
3133his network status. Other IDs were added. Captured privilege shells
3134were hidden away in a small computer called Shasta at Stanford, at
3135the heart of California's Silicon Valley.
3136Ron and Kevin were now super-users. They dropped into SRI,
3137Stanford Research Institute, one of the world's great centres of
3138scientific research; into the Rand Corporation, known equally for its
3139extensive futurological forecasting and its 'thinking about the
3140unthinkable', the processes of escalation to nuclear war; into the
3141National Research Laboratory in Washington; into two private research
3142firms back in California and two defence contractors on the East
3143Coast; and across the Atlantic to the Norwegian Telecommunications
3144Agency which, among other things, is widely believed to have a
3145special role in watching Soviet Baltic activity. And, of course,
3146NORAD.
3147Their running about had not gone unnoticed; ARPAnet and its
3148constituent computers keep logs of activity as one form of security
3149(see the section below) and officials both at UCLA (where they were
3150puzzled to see an upsurge in activity by 'UCB') and in one of the
3151defence contractors sounded an alarm. The KGB were suspected, the FBI
3152alerted.
3153One person asked to act as sleuth was Brian Reid, a professor of
3154electrical engineering at Stanford. He and his associates set up a
3155series of system trips inside a Unix shell to notify them when
3156Hacker's Handbook
3157file:///E|/Books/Hackers Handbook.htm (66 of 133) [11/28/2000 5:58:49 AM]
3158certain IDs entered an ARPAnet computer. His first results seemed to
3159indicate that the source of the hacking was Purdue, Indiana, but the
3160strange IDs seemed to enter ARPAnet from all over the place.
3161** Page 66
3162Eventually, his researches lead him to the Shasta computer and he had
3163identified 'Miller' as the identity he had to nail. He closed off
3164entry to Shasta from ARPanet. 'Miller' reappeared; apparently via a
3165gateway from another Stanford computer, Navajo. Reid, who in his
3166sleuthing role had extremely high privileges, sought to wipe 'Miller'
3167out of Navajo. A few minutes after 'Miller' had vanished from his
3168screen, he re- appeared from yet another local computer, Diablo. The
3169concentration of hacking effort in the Stanford area lead Reid to
3170suppose that the origin of the trouble was local. The most effective
3171way to catch the miscreant was by telephone trace. Accordingly, he
3172prepared some tantalising, apparently private, files. This was bait,
3173designed to keep 'Miller' online as long as possible while the FBI
3174organised a telephone trace. 'Miller' duly appeared, the FBI went
3175into action--and arrested an innocent businessman.
3176But back at UCLA they were still puzzling about 'UCB'. In one of
3177his earliest sessions, Ron had answered a registration questionnaire
3178with his own address, and things began to fall into place. In one of
3179his last computer 'chats' before arrest, Kevin, then only 17 and only
3180beginning to think that he and his friend might have someone on their
3181trail, is supposed to have signed off: 'Got to go now, the FBI is
3182knocking at my door.' A few hours later, that is exactly what
3183happened.
3184Computer Security Methods
3185Hackers have to be aware of the hazards of being caught: there is
3186now a new profession of computer security experts, and they have had
3187some successes. The first thing such consultants do is to attempt to
3188divide responsibility within a computer establishment as much as
3189possible. Only operators are allowed physical access to the
3190installation, only programmers can use the operating system (and
3191under some of these, such as VM, maybe only part of it.). Only system
3192managers are permitted to validate passwords, and only the various
3193classes of users are given access to the appropriate applications
3194programs.
3195Next, if the operating system permits (it usually does), all
3196accesses are logged; surveillance programs carry out an audit, which
3197gives a historic record, and also, sometimes, perform monitoring,
3198which is real-time surveillance.
3199In addition, separate programs may be in existence the sole
3200purpose of which is threat monitoring: they test the system to see if
3201anyone is trying repeatedly to log on without apparent success (say
3202by using a program to try out various likely passwords).
3203** Page 67
3204Hacker's Handbook
3205file:///E|/Books/Hackers Handbook.htm (67 of 133) [11/28/2000 5:58:49 AM]
3206They assess if any one port or terminal is getting more than usual
3207usage, or if IDs other than a regular small list start using a
3208particular terminal--as when a hacker obtains a legitimate ID but one
3209that normally operates from only one terminal within close proximity
3210to the main installation, whereas the hacker is calling from outside.
3211Increasingly, in newer mainframe installations, security is built
3212into the operating system at hardware level. In older models this was
3213not done, partly because the need was not perceived, but also because
3214each such 'unnecessary' hardware call tended to slow the whole
3215machine down. (If a computer must encrypt and decrypt every process
3216before it is executed, regular calculations and data accesses take
3217much longer.) However, the largest manufacturers now seem to have
3218found viable solutions for this problem....
3219** Page 68
3220CHAPTER 7
3221Networks
3222Until ten years ago, the telecommunications and computer
3223industries were almost entirely separate. Shortly they will be almost
3224completely fused. Most of today's hackers operate largely in
3225ignorance of what goes on in the lines and switching centres between
3226the computer they own and the computer they wish to access.
3227Increasingly, dedicated hackers are having to acquire knowledge and
3228experience of data networks, a task made more interesting, but not
3229easier, by the fact that the world's leading telecommunications
3230organisations are pushing through an unprecedented rate of
3231innovation, both technical and commercial. Apart from purely local
3232lowspeed working, computer communications are now almost
3233exclusively found on separate high-speed data networks, separate that
3234is from the two traditional telecommunications systems telegraphy and
3235telephone. Telex lines operate typically at 50 or 75 baud with an
3236upper limit of 110 baud.
3237The highest efficient speed for telephone-line-based data is 1200
3238baud. All of these are pitifully slow compared with the internal
3239speed of even the most sluggish computer. When system designers first
3240came to evaluate what sort of facilities and performance would be
3241needed for data communications, it became obvious that relatively few
3242lessons would be drawn from the solutions already worked out in voice
3243communications.
3244Analogue Networks
3245In voicegrade networks, the challenge had been to squeeze as many
3246analogue signals down limited-size cables as possible. One of the
3247earlier solutions, still very widely used, is frequency division
3248Hacker's Handbook
3249file:///E|/Books/Hackers Handbook.htm (68 of 133) [11/28/2000 5:58:49 AM]
3250multiplexing (FDM): each of the original speech paths is modulated
3251onto one of a specific series of radio frequency carrier waves; each
3252such rf wave is then suppressed at the transmitting source and
3253reinserted close to the receiving position so that only one of the
3254sidebands (the lower), the part that actually contains the
3255intelligence of the transmission, is actually sent over the main data
3256path. This is similar to ssb transmission in radio.
3257The entire series of suppressed carrier waves are then modulated onto
3258a further carrier wave, which then becomes the main vehicle for
3259taking the bundle of channels from one end of a line to the other.
3260** Page 69
3261Typically, a small coaxial cable can handle 60 to 120 channels in
3262this way, but large cables (the type dropped on the beds of oceans
3263and employing several stages of modulation) can carry 2700 analogue
3264channels. Changing audio channels (as they leave the telephone
3265instrument and enter the local exchange) into rf channels, as well as
3266making frequency division multiplexing possible, also brings benefits
3267in that over long circuits it is easier to amplify rf signals to
3268overcome losses in the cable.
3269Just before World War II, the first theoretical work was carried
3270out to find further ways of economising on cable usage; what was then
3271developed is called Pulse Code Modulation (PCM).
3272There are several stages. In the first, an analogue signal is
3273sampled at specific intervals to produce a series of pulses; this is
3274called Pulse Amplitude Modulation, and takes advantage of the
3275characteristic of the human ear that if such pulses are sent down a
3276line with only a very small interval between them, the brain smoothes
3277over the gaps and reconstitutes the entire original signal.
3278In the second stage, the levels of amplitude are sampled and
3279translated into a binary code. The process of dividing an analogue
3280signal into digital form and then reassembling it in analogue form is
3281called quantization. Most PCM systems use 128 quantizing levels, each
3282pulse being coded into 7 binary digits, with an eighth added for
3283supervisory purposes.
3284OPERATION OF A CHARACTER TDM
3285+-----+-----+-----+-----+-----+-----+-----+--
3286<------| SYN | CH1 | CH2 | CH3 | CH4 | SYN | CH1 |
3287+-----+-----+-----+-----+-----+-----+-----+--
3288+-----------------+ +-----------------+
32891 | | | |1
3290--+ | +---+ +---+ | +--
32912 | | | | | | | |2
3292--+ MULTIPLEXER |==+ M +--\/\/--+ M +==--+ MULTIPLEXER +--
32933 | | | | | | | |3
3294--+ | +---+ +---+ | +--
32954 | | | |4
3296Hacker's Handbook
3297file:///E|/Books/Hackers Handbook.htm (69 of 133) [11/28/2000 5:58:49 AM]
3298--+-----------------+ +-----------------+--
3299--+-----+-----+-----+-----+-----+-----+----+
3300| CH1 | SYN | CH4 | CH3 | CH2 | CH1 |SYN |------->
3301--+-----+-----+-----+-----+-----+-----+----+
3302<---------------------------->
3303ONE DATA FRAME
3304** Page 70
3305By interleaving coded characters in a highspeed digital stream it
3306is possible to send several separate voice channels along one
3307physical link. This process is called Time Division Multiplexing
3308(TDM) and together with FDM still forms the basis of most of the
3309globe's voicegrade communications.
3310Digital Networks
3311Elegant though these solutions are, though, they are rapidly being
3312replaced by totally digital schemes. Analogue systems would be very
3313wasteful when all that is being transmitted are the discrete audio
3314tones of the output of a modem. In a speech circuit, the technology
3315has to be able to 'hear', receive, digitize and reassemble the entire
3316audio spectrum between 100 Hz and 3000 Hz, which is the usual
3317passband of what we have come to expect from the audio quality of the
3318telephone. Moreover, the technology must be sensitive to a wide range
3319of amplitude; speech is made up of pitch and associated loudness. In
3320a digital network, however, all one really wants to transmit are the
3321digits, and it doesn't matter whether they are signified by audio
3322tones, radio frequency values, voltage conditions or light pulses,
3323just so long as there is circuitry at either end which can encode and
3324decode.
3325There are other problems with voice transmission: once two parties
3326have made a connection with each other (by the one dialling a number
3327and the other lifting a handset), good sense has suggested that it
3328was desirable to keep a total physical path open between them, it not
3329being practical to close down the path during silences and re-open it
3330when someone speaks. In any case the electromechanical nature of most
3331of today's phone exchanges would make such turning off and on very
3332cumbersome and noisy.
3333But with a purely digital transmission, routing of a 'call'
3334doesn't have to be physical--individual blocks merely have to bear an
3335electronic label of their originating and destination addresses, such
3336addresses being 'read' in digital switching exchanges using chips,
3337rather than electromechanical ones. Two benefits are thus
3338simultaneously obtained: the valuable physical path (the cable or
3339satellite link) is only in use when some intelligence is actually
3340being transmitted and is not in use during 'silence'; secondly,
3341switching can be much faster and more reliable.
3342Hacker's Handbook
3343file:///E|/Books/Hackers Handbook.htm (70 of 133) [11/28/2000 5:58:49 AM]
3344Packet Switching
3345These ideas were synthesised into creating what has now become
3346packet switching. The methods were first described in the mid-1960's
3347but it was not until a decade later that suitable cheap technology
3348existed to create a viable commercial service.
3349** Page 71
3350The British Telecom product is called Packet SwitchStream (PSS) and
3351notable comparable US services are Compuserve, Telenet and Tymnet.
3352Many other countries have their own services and international packet
3353switching is entirely possible--the UK service is called,
3354unsurprisingly, IPSS.
3355International Packet Switched Services and DNICs
3356INTERNATIONAL NETWORKS
3357Datacalls can be made to hosts on any listed International Networks.
3358The NIC (Data Network Identification Code) must precede the
3359international host's NUA. Charges quoted are for duration (per hour)
3360and volume (per Ksegment) and are raised in steps of 1 minute and 10
3361segments respectively.
3362Country Network DNIC
3363Australia Midas 5053
33648elgium Euronet 2062
3365Belgium Euronet 2063
3366Canada Datapac 3020
3367Canada Globedat 3025
3368Canada Infoswitch 3029
3369Denmark Euronet 2383
3370France Transpac 2080
3371French Antilles Euronet 3400
3372Germany (FDR) Datex P 2624
3373Germany (FDR) Euronet 2623
3374Hong Kong IDAS 4542
3375Irish Republic Euronet 2723
3376Italy Euronet 2223
3377Japan DDX-P 4401
3378Japan Venus-P 4408
3379Luxembourg Euronet 2703
3380** Page 72
3381Netherlands Euronet 2043
3382Country Network DNIC
3383Norway Norpak 2422
3384Portugal N/A 2682
3385Singapore Telepac 5252
3386South Africa Saponet 6550
3387Spain TIDA 2141
3388Hacker's Handbook
3389file:///E|/Books/Hackers Handbook.htm (71 of 133) [11/28/2000 5:58:49 AM]
3390Sweden Telepak 2405
3391Switzerland Datalink 2289
3392Switzerland Euronet 2283
3393U.S.A. Autonet 3126
3394U.S.A. Compuserve 3132
3395U.S.A. ITT (UDTS) 3103
3396U.S.A. RCA (LSDS) 3113
3397U.S.A. Telenet 3110
3398U.S.A. Tymnet 3106
3399U.S.A. Uninet 3125
3400U.S.A. WUI (DBS) 3104
3401Additionally, Datacalls to the U.K. may be initiated from:
3402Bahrain, Barbados, Bermuda, Israel, New Zealand and the United Arabs
3403Emirates.
3404Up to date Information can be obtained from IPSS Marketing on
340501-9362743
3406In essence, the service operates at 48kbits/sec full duplex (both
3407directions simultaneously) and uses an extension of time division
3408multiplexing Transmission streams are separated in convenient- sized
3409blocks or packets, each one of which contains a head and tail
3410signifying origination and destination. The packets are assembled
3411either by the originating computer or by a special facility supplied
3412by the packet switch system. The packets in a single transmission
3413stream may all follow the same physical path or may use alternate
3414routes depending on congestion. The packets from one 'conversation'
3415are very likely to be interleaved with packets from many Other
3416'conversations'. The originating and receiving computers see none of
3417this. At the receiving end, the various packets are stripped of their
3418routing information, and re-assembled in the correct order before
3419presentation to the computer's VDU or applications program.
3420** Page 73
3421PACKET ASSEMBLY/DISASSEMBLY
3422+-------------------------
3423|
3424| PSS
3425+-----+
3426o> o> o> o> o> o> o> o> o> o> | | O> O> O>
3427Terminal D================================-+ PAD +-==========
3428<o ><o ><o ><o ><o ><o ><o ><o ><o ><o | || ><o ><o ><o
3429+-----+
3430+-------------------------
3431key:
3432o> CHARACTERS O> PACKETS
3433<o ><o all public data networksusing packet switching seek to be
3434compatible with each other at least a considerable degree. the international
3435standard they have implement is called ccitt x.25. this multi-layered protocol
3436covering (potentially) everything from electrical connections user interface. levels
3437Hacker's Handbook
3438file:///E|/Books/Hackers Handbook.htm (72 of 133) [11/28/2000 5:58:49 AM]
3439work like this:
34407 application interface
34416 presentation formatting & code conversion
34425 session co-ordination between processes
34434 transport control of quality service
34443 network set up and maintenance
34452 link reliable transfer
3446terminalphysical bitstream
3447** page 74 moment agreement has only been reached on lowest three network. above that
3448there battle in progressibm
3449which solutions
3450problems under name sna (systems architecture)
3451most remainder
3452principal main- frame manufacturerswhose
3453solution osi (open systems interconnection).
3454single so much for background explanation. how does affect
3455user? users can accessone two ways. use special
3456terminals able create packets an appropriate form--called
3457(in original book diagram showing
3458dial-up termials connecting
3459pad system directly
3460connected pss. note added by electronic images) 75
3461jargon--and these sit
3462switch circuitaccessing it via nearest pss
3463exchange permanent dataline modems operating speeds 240048009600or 48k bauddepending
3464level traffic. alternatively customer ordinary asynchronous without packet-creating
3465capabilities
3466connect into facility handles assembly him.such devices are assembler/ disassemblers
3467pads. jargon said character terminals. pads accessed either leased line 300 1200
3468thosebut also 110 1200/75. readers if used will done their own computers
3469as dialling pad. phone numbers uk found directory
3470published telecom national networks. order you individual need identity (nui)
3471registeredyour local (pse).
3472pse throw off dont give recognisable nui. extremely flexible configure ports suit
3473equipmentboth speed screen addressingrather bulletin board (though
3474accurate mimics pad). speed: (std) 1200/75 duplex
3475aberdeen (0224) 642242 642484 642644
3476birmingham (021) 2145139 2146191 241 3061
3477bristol (0272) 216411 216511 216611cambridge (0223)
347882511 82411 82111
3479edinburgh (031) 337 9141 9121 9393
3480glasgow (041) 204 2011 2031 2051
3481leeds (0532) 470711 470611 470811
3482Hacker's Handbook
3483file:///E|/Books/Hackers Handbook.htm (73 of 133) [11/28/2000 5:58:49 AM]
3484liverpool (051) 211 0000 212 5127 213 6327
3485london (01) 825 9421 407 8344 928 2333 9111 3399 1737
3486luton (0582) 8181 8191 8101
3487manchester (061) 833 0242 0091 0631
3488newcastle/tyne (0632) 314171 314181 314161
3489nottingham (0602) 881311 881411 881511
3490portsmouth (0705) 53011 53911 53811
3491reading (0734) 389111 380111 384111
3492(*)slough (0753) 6141 6131 6171
3493(*)local area slough not available. modem/dataphone receipt tone. 76
3494next address (nua) host
3495calling. available same directory:
3496university computing servicess nua 234 222339399blaise
3497219200222istel 252724241 on. first four known dnic (data identification code) country
3498( identifier)
3499last specificsignifying get prestelthough purposes academic exercise: a9 1100 2018
3500gives
3501graphics (a9 indicates teletype
3502terminal).
3503once routed
3504computer choicethen exactly were entering direct dial password requested. costs
3505governed number
3506exchanged than distance actual time call. typical
3507thus contain following running costs: call (on
3508regular billtime-related) charges (dependent sent) bills (which could time-related
3509per record fixed subscription). techniques confined uses them
3510its mini-network
3511various retrieval (the ones into)
3512update mailbox handle gateway connections. newer private switched. 77
3513valued (vans) basic telecoms facilities some additional service--data processing
3514hosting publishing ventures example--has added. offering easier cheaper boon hacker.
3515no longer hacker worry about protocols normally expects see
3516users. x.25 adaptability mean even comms talk
3517anything tariff structurefavouringmeans any anywhere
3518world target.
3519austin poulsen arpanet hackersmade dramatic packet-switched net milwaukee 414s ran
3520around gte
3521telenet biggest us.
3522self-adopted comes telephone
3523city chiefly hitherto centre american beer
3524industry.during spring summer 1983 publicly directories usual guessing games
3525pass-numbers pass-words dropped security
3526pacific bank
3527los angeles sloan-kettering cancer clinic newyork (it still clear me actually altered
3528patients
3529records merely looked them) canadian cement company alamos research laboratory
3530mexicohome atomic
3531bomb where
3532nuclear weapons continues day.
3533believed saw sensitive classifiedfiles.
3534Hacker's Handbook
3535file:///E|/Books/Hackers Handbook.htm (74 of 133) [11/28/2000 5:58:49 AM]
3536commenting activities prominent
3537consultantjoesph coatessaid: babies great
3538kind kids anyone would - be...there nothing
3539wrong kids. problem idiots who sold ignorant people bought it. nobody should buy
3540knowing . built in....you timid dealing foolish. couple months 1984british carried
3541out thorough exploration sercnet sponsored science engineering council
3542centred rutherford appleton cambridge. linkstogether technology universities
3543polytechnics united kingdom gateways cern (european research). 78
3544almost every type mainframelarge mini-computer discovered hanging 3032 370
3545itselfprime 400s550s 750s over placevax 11/780s
3546oxforddaresbury vaxs durhameast anglia newcastle gec 4000 family members odd
3547pdp11 unix.
3548penetration was achieved when appeared popular hobbyist suggestion instruction
354940might results. soon typed demo asked establishmentthings started happen. several
3550days left
3551messagesreporting
3552lack eventually became obvious supposed suggests limited demonstration
3553casual had insecurely up. i remember night pulled down manual filewatching after
3554scroll my vdu baud. do word
3555guide fetching lists addresses
3556mnemonics members. included extensive
3557descriptions relationpss-style complete chapter know certain forms shut appears
3558continue. best stories definite
3559ending. offer brief extracts captured sessions.
356003eoehaae node 3. service?
3561com
3562fad>CALL 40
3563Welcome to SERCNET-PSS Gateway. Type HELP for help.
3564Gatew::~cInkging in
3565user HELP
3566ID last used Wednesday, 18 January 1984 16:53
3567Started - Wed 18 Jan 19a4 17:07:55
3568Please enter your name and establishment DEMO
3569Due to a local FTP problem messages entered via the HELP system
3570during the last month have been lost. Please resubmit if
3571problem/question is still outstanding 9/1/84
3572No authorisation is required for calls which do not incur charges at
3573the Gateway. There is now special support for TELEX. A TELEX service
3574may be announced shortlY.
3575Copies of the PSS Guide issue 4 are available on request to Program
3576Advisory Office at RAL, telephone 0235 44 6111 (direct dial in) or
35770235 21900 Ext 6111. Requests for copies should no longer be placed
3578in this help system.
3579The following options are available:
3580** Page 79
3581Hacker's Handbook
3582file:///E|/Books/Hackers Handbook.htm (75 of 133) [11/28/2000 5:58:49 AM]
3583NOTES GUIDE TITLES ERRORS EXAMPLES HELP QUIT
3584Which option do you require? GUIDE
3585The program 'VIEW' is used to display the Gateway guide
3586Commands available are:
3587<cr> or N next page
3588p previous page
3589n list page n
3590+n or -n go forward or back n pages
3591S first page
3592E last page
3593L/string find line Containing string
3594F/string find line beginning string
3595Q exit from VIEW
3596VIEW Vn 6> Q
3597The following options are available:
3598NOTES GUIDE TITLES ERRORS EXAMPLES HELP OUIT
3599Which option do you require? HELP
3600NOTES replies to user queries & other notes
3601GUIDE Is the complete Gateway user guide (including the Appendices)
3602TITLES 1- a list of SERCNET L PSS addresses & mnemonics (Guide
3603Appendix 1)
3604ERRORS List of error codes you may receive EXAMPLES are ome examples
3605of use of the Gateway (Guide Appendix 2)
3606QUIT exits from this session
3607The following options are available:
3608NOTES GUIDE TITLES ERRORS EXAMPLES HELP QUIT
3609Which option do you require? TITLES
3610VIEW Vn o>
3611If you have any comments, please type them now, terminate with E
3612on a line on its own. Otherwise just type <cr>
3613CPU used: 2 ieu, Elapsed: 14 mins, IO: 2380 units, Break: 114
3614Budgets: this period = 32.000 AUs, used = 0.015 AU, left - 29.161 AUs
3615User HELP terminal 2 logged out Wed 18 Jan 1984 17:21:59
361684/04/18. 18.47.00.
3617I.C.C.C. NETWORK OPERATING SYSTEM. NOS 1.1-430.20A
3618USER NUMBER:
3619PASSWORD:
3620IMPROPER LOG IN, TRY AGAIN.
3621USER NUMBER:
3622PASSWORD:
3623>SCIENCE AND ENGINEERING RESEARCH COUNCIL
3624>RUTHERFORD APPLETON LABORATORY
3625COMPUTING DIVISION
3626>
3627Hacker's Handbook
3628file:///E|/Books/Hackers Handbook.htm (76 of 133) [11/28/2000 5:58:49 AM]
3629> ThE SERCNET - PSS Gateway
3630> User's Guide
3631A S Dunn
3632>Issue 4 16 February 1983
3633>Introduction
3634** Page 80
3635Frm 1; Next>
3636The SERCNET-PSS Gateway provides access from SERCNET to PSS and PSS
3637to SERCNET. It functions as a 'straight through' connection between
3638the networks, ie it is protocol transparant. It operates as a
3639Transport Level gateway, in accordance with the 'Yellow book'
3640Transport Service. However the present implementation does not have a
3641full Transport Service. and therefore there are some limitations in
3642the service provided. For X29 which is incompatible with the Yellow
3643book Transport Service. special facilities are provided for the input
3644of user identification and addresses.
3645No protocol conversion facilities are provided by the Gateway -
3646protocol conversion facilities (eg X29 - TS29) can be provided by
3647calling through a third party machine (usually on SERCNET).
3648The Transport Service addressing has been extended to include
3649authorisation fields, so that users can be billed for any charges
3650they incur.
3651The Gateway also provides facilities for users to inspect their
3652accounts and change their passwords, and also a limited HELP
3653facility.
3654User Interface
3655The interface which the user sees will depend on the local equipment
3656to
3657Frm 2; Next>
3658which he is attached. This may be a PAD in which case he will
3659probably be using the X29 protocol, or a HOST (DTE) in which case he
3660might be using FTP for example. The local equipment must have some
3661way of generating a Transport Service Called Address for the Gateway,
3662which also includes an authorisation field - the format of this is
3663described below. The documentation for the local system must
3664therefore be consulted in order to find out how to generate the
3665Transport Service Called Address. Some examples given in Appendix 2.
3666A facility is provided for the benefit of users without access to the
3667'Fast Select' facility, eg BT PAD users (but available to all X29
3668terminal users) whereby either a minimal address can be included in
3669Hacker's Handbook
3670file:///E|/Books/Hackers Handbook.htm (77 of 133) [11/28/2000 5:58:49 AM]
3671the Call User Data Field or an X25 subaddress can be used and the
3672Call User Data Field left absent.
3673The authorisation and address can then be entered when prompted by
3674the Gateway.
3675Unauthorised Use
3676Frm 5: Next>
3677No unauthorised use of the Gateway is allowed regardless of whether
3678charges are Incurred at the Gateway or not.
3679However, there is an account DEMO (password will be supplied on
3680request) With a small allocation which is available for users to try
3681out the Gateway but it should be noted that excessive use of this
3682account will soon exhaust the allocation thus depriving others of its
3683use.
3684Prospective users of the Gateway should first contact User Interface
3685Group In the Computing Division of the Rutherford Appleton
3686Laboratory.
3687Addressing
3688To connect a call through the Gateway the following information is
3689required in the Transport Service Called Address:
36901) The name of the called network
36912) Authorisation. consisting of a USERID, PASSWORD and ACCOUNT, and
3692optionally, a reverse charging request
36933) The address of the target host on the called network
3694The format is as follows:
3695<netname>(<authorisation>).<host address>
36961) <netname> is one of the following:
3697** Page 81
3698SERCNET to connect to the SERC network
3699PSS to connect to PSS
3700S an alias for SERCNET
370169 another alias for SERCNET
37022) <authorisation> is a list of positional or keyword
3703parameters or booleans as follows:
3704keyword Meaning
3705US User identifier
3706PW User's password
3707AC the account - not used at present - talen to be same as US
3708RF 'reply paid' request (see below)
3709Hacker's Handbook
3710file:///E|/Books/Hackers Handbook.htm (78 of 133) [11/28/2000 5:58:49 AM]
3711R reverse charging indicator (boolean)
3712keywords are separated from their values by '='.
3713keyword-value pairs positional parameters and booleans are separated
3714from each other by ','. The whole string is enclosed in parentheses:
3715().
3716Examples:
3717(FRED.XYZ R)
3718(US=FRED,PW=XYZ,R)
3719(R,PW=XYZ,US=FRED)
3720All the above have exactly the same meaning. The first form is the
3721most usual.
3722When using positionals, the order is: US,PW,AC,RP,R
37233)<host address> is the address of the machine being called on the
3724target network. It may be a compound address, giving the service
3725within the target machine to be used. It may begin with a mnemonic
3726instead of a full DTE address. A list of current mnemonics for both
3727SERCNET and PSS is given in Appendix 1.
3728A restriction of using the Gateway is that where a Transport Service
3729address (service name) is required by the target machine to identify
3730the service to be used, then this must be included explicitly by the
3731user in the Transport Service Called Address, and not assumed from
3732the mnemonic, since the Gateway cannot Inow from the mnemonic. which
3733protocol is being used.
3734Examples:
3735RLGS.FTP
37364.FTP
3737Both the above would refer to the FTP service on the GEC 'B' machine
3738at Rutherford.
3739RLGB alone would in fact connect to the X29 server, since no service
3740name is Frm 7; Next>
3741required for X29.
3742In order to enable subaddresses to be entered more easily with PSS
3743addresses, the delimiter '-' can be used to delimit a mnemonic. When
3744the mnemonic is translated to an address the delimiting '-' is
3745deleted so that the following string is combined with the address.
3746Eg:
3747SERC-99 is translated to 23422351919199
3748Putting the abovementioned three components together, a full
3749Transport Service Called Address might look like:
3750Hacker's Handbook
3751file:///E|/Books/Hackers Handbook.htm (79 of 133) [11/28/2000 5:58:49 AM]
3752S(FRED,XYZ,R).RLGS.FTF
3753** Page 82
3754Of course a request for reverse charging on SERCNET is meaningless,
3755but not illegal.
3756Reply Paid Facility (Omit at first reading)
3757In many circumstances it is necessary for temporary authorisation to
3758be passed to a third party. For example, the recipient of network
3759MAIL may not himself be authorised to use the Gateway, and therefore
3760the sender may wish to grant him temporary authorisation in order to
3761reply. With the Job Transfer and maniplulation protocol, there is a
3762requirement to return output documents from jobs which have been
3763executed on a remote site.
3764The reply paid facility is involved by including the RP keyword in the
3765authorisation. It can be used either as a boolean or as a
3766keyword-value pair. When used as a boolean, a default value of I is
3767assumed.
3768The value of the RP parameter indicates the number of reply paid
3769calls which are to be authorised. All calls which use the reply paid
3770authorisation will be charged to the account of the user who
3771initiated the reply paid authorisation.
3772Frm 9; Next:
3773The reply paid authorisation parameters are transmitted to the
3774destination address of a call as a temporary user name and password
3775in the Transport Service Calling Address. The temporary user name and
3776password are in a form available for use by automatic systems in
3777setting up a reply to the address which initiated the original call.
3778Each time a successful call is completed using the temporary user
3779name and password, the number of reply paid authorisations is reduced
3780by 1, until there are none left, when no further replies are allowed.
3781In addition there is an expiry date of I week, after which the
3782authorisations are cancelled.
3783In the event of call failures and error situations, it is important
3784that the effects are clearly defined. In the following definitions,
3785the term 'fail' is used to refer to any call which terminates with
3786either a non-zero clearing cause or diagnostic code or both,
3787regardless of whether data has been communicated or not. The rules
3788are defined as follows:
37891) If a call which has requested reply paid authorisation fails for
3790any reason, then the reply paid authorisation is not set up.
37912) If the Gateway is unable to set up the reply paid authorisation
3792for any reason (eg insufficient space), then the call requesting the
3793authorisation will be refused.
3794Hacker's Handbook
3795file:///E|/Books/Hackers Handbook.htm (80 of 133) [11/28/2000 5:58:49 AM]
37963) A call which is using reply paid authorisation may not create
3797another reply paid authorisation.
37984) If a call which is using reply paid authorisation fails due to a
3799network error (clearing cause non zero) then the reply paid count is
3800not reduced.
38015) If a call which is using reply paid authorisation fails due to a
3802host clearing (clearing cause zero, diagnostic code non-zero) then
3803the reply paid count is reduced, except where the total number of
3804segments transferred on the call is zero (ie call setup was never
3805completed).
3806Frm 11; Next?
3807X29 Terminal Protocol
3808There is a problem in that X29 is incompatible with the Transport
3809Service. For this reason, it is possible that some PAD
3810implementations will be unable to generate the Transport Service
3811Called Address. Also some PAD's, eg the British Telecom PAD, may be
3812unable to generate Fast Select calls - this means that the Call User
3813Data Field is only 12 bytes long - insufficient to hold the Transport
3814Service Address.
3815If a PAD is able to insert a text string into the Call User Data Field
3816beginning at the fifth byte, but is restricted to 12 characters
3817because of inability to generate Fast Select calls, then a partial
3818address can be included consisting of either the network name being
3819called, or the network name plus authorisation.
3820** Page 83
3821The first character is treated as a delimiter, and should be entered
3822as the character '7'. This is followed by the name of the called
3823network - SERCNET.
3824Alternatively, if the PAD is incapable of generating a Call User Data
3825Field, then the network name can be entered as an X25 subaddress. The
3826mechanism employed by the Gateway is to transcribe the X25 subaddress
3827to the beginning of the Transport Service Called Address, converting
3828the digits of the subaddress into ASCII characters in the process.
3829Note that this means only SERCNET can be called with this method at
3830present by using subaddress 69.
3831The response from the Gateway will be the following message:
3832Please enter your authorisation and address required in form:
3833(user,password).address
3834Reply with the appropriate response eg:
3835(FRED,XYZ).RLGB
3836There is a timeout of between 3 and 4 minutes for this response.
3837Hacker's Handbook
3838file:///E|/Books/Hackers Handbook.htm (81 of 133) [11/28/2000 5:58:50 AM]
3839after which the call will be cleared. There is no limit to the number
3840of attempts which may be made within this time limit - if the
3841authorisation or address entered is invalid, the Gateway will request
3842it again. To abandon the attempt. the call should be cleared from the
3843local PAD.
3844A restriction of this method of use of the Gateway is that a call
3845must be correctly authorised by the Gateway before charging can
3846begin, thus reverse charge calls from PSS which do not contain
3847authorisation in the Call Request packet will be refused. However it
3848is possible to include the authorisation but not the address in the
3849Call Request packet. The authorisation must then be entered again
3850together with the address when requested by the Gateway.
3851The above also applies when using a subaddress to identify the called
3852network. In this case the Call User Data Field will contain only the
3853authorisation in parentheses (preceded by the delimiter '@')
3854- 5 -
3855Due to the lack of a Transport Service ACCEPT primitive in X29 it will be
3856found, on some PADs, that a 'call connected' message will appear on the
3857terminal as soon as the call has been connected to the Gateway. The 'call
3858connected' message should not be taken to imply that contact has been made
3859With the ultimate destination. The Gateway will output a message 'Call
3860connected to remote address' when the connection has been established.
3861Frm 14; Next
3862ITP Terminal Protocol
3863The terminal protocol ITP is used extensively on SERCNET and some
3864hosts support only this terminal protocol. Thus it will not be
3865possible to make calls directly between these hosts on SERCNET and
3866addresses on PSS which support only X29 or TS29. In these cases it
3867will be necessary to go through an intermediate machine on SERCNET
3868which supports both x29 and ITP or TS29 and ITP, such as a GEC ITP.
3869This is done by first making a call to the GEC MUM, and then making
3870an outgoing call from there to the desired destination.
3871PTS29 Terminal Protocol
3872This is the ideal protocol to use through the Gateway. since there
3873should be no problem about entering the Transport Service address.
3874However, it is divisable first to ascertain that the machine to be
3875called will support
3876When using this protocol, the service name of the TS29 server should be
3877entered explicitly, eg:
3878** Page 84
3879S(FRED,XYZ).RLGB.TS29
3880Restrictions
3881Hacker's Handbook
3882file:///E|/Books/Hackers Handbook.htm (82 of 133) [11/28/2000 5:58:50 AM]
3883Due to the present lack of a full Transport Service in the Gateway,
3884some primitives are not fully supported.
3885In particular, the ADRESS, DISCONNECT and RESET primitives are not
3886fully supported. Howerver this should not present serious problems,
3887since the ADDRESS and REASET primitives are not widely used, and the
3888DISCONNECT primitive can be carried in a Clear Request packet.
3889IPSS
3890Access to IPSS is through PSS. Just enter the IPSS address in place
3891of the PSS address.
3892................ and on and on for 17 pages
3893** Page 85
3894CHAPTER 8
3895Viewdata Systems
3896Viewdata, or videotex, has had a curious history. At one stage, in
3897the late 1970s, it was possible to believe that it was about to take
3898over the world, giving computer power to the masses via their
3899domestic tv sets. It was revolutionary in the time it was developed,
3900around 1975, in research laboratories owned by what was then called
3901the Post Office, but which is now British Telecom. It had a
3902colour-and-graphics display, a user-friendly means of talking to it
3903at a time when most computers needed precise grunts to make them
3904work, and the ordinary layperson could learn how to use it in five
3905minutes.
3906The viewdata revolution never happened, because Prestel, its most
3907public incarnation, was mismarketed by its owners, British Telecom,
3908and because, in its original version, it is simply too clumsy and
3909limited to handle more sophisticated applications. All information is
3910held on electronic file cards which can easily be either too big or
3911too small for a particular answer and the only way you can obtain the
3912desired information is by keying numbers, trundling down endless
3913indices. In the early days of Prestel, most of what you got was
3914indices, not substantive information. By the time that viewdata sets
3915were supposed to exist in their hundreds of thousands, home
3916computers, which had not been predicted at all when viewdata first
3917appeared, had already sold into the millionth British home.
3918Yet private viewdata, mini-computers configured to look like
3919Prestel and to use the same special terminals, has been a modest
3920success. At the time of writing there are between 120 and 150
3921significant installations. They have been set up partly to serve the
3922needs of individual companies, but also to help particular trades,
3923industries and professions. The falling cost of viewdata terminals
3924has made private systems attractive to the travel trade, to retail
3925Hacker's Handbook
3926file:///E|/Books/Hackers Handbook.htm (83 of 133) [11/28/2000 5:58:50 AM]
3927stores, the motor trade, to some local authorities and to the
3928financial world.
3929** Page 86
3930The hacker, armed with a dumb viewdata set, or with a software
3931fix for his micro, can go ahead and explore these services. At the
3932beginning of this book, I said my first hack was of a viewdata
3933service. Viditel, the Dutch system. It is astonishing how many
3934British hackers have had a similar experience. Indeed, the habit of
3935viewdata hacking has spread throughout Europe also: the wonder- fully
3936named Chaos Computer Club of Hamburg had some well-publicised fun
3937with Bildschirmtext, the West German Prestel equivalent
3938colloquially-named Btx.
3939What they appear to have done was to acquire the password of the
3940Hamburger Sparkasse, the country's biggest savings bank group.
3941Whereas telebanking is a relatively modest part of Prestel --the
3942service is called Homelink--the West German banks have been a
3943powerful presence on Btx since its earliest days. In fact, another
3944Hamburg bank, the Verbraucher Bank, was responsible for the world's
3945first viewdata Gateway, for once in this technology, showing the
3946British the way. The 25-member Computer Chaos Club probably acquired
3947the password as a result of the carelessness of a bank employee.
3948Having done so, they set about accessing the bank's own, rather high
3949priced, pages, some of which cost almost DM10 (£2.70). In a
3950deliberate demonstration, the Club then set a computer to
3951systematically call the pages over and over again, achieving a
3952re-access rate of one page every 20 seconds. During a weekend in
3953mid-November 1984, they made more than 13,000 accesses and ran up a
3954notional bill of DM135,000 (£36,000). Information Providers, of
3955course, are not charged for looking at their own pages, so no bill
3956was payable and the real cost of the hack was embarrassment.
3957In hacking terms, the Hamburg hack was relatively trivial-- simple
3958password acquisition. Much more sophisticated hacks have been
3959perpertrated by British enthusiasts.
3960Viewdata hacking has three aspects: to break into systems and become
3961user, editor or system manager thereof; to discover hidden parts of
3962systems to which you have been legitimately admitted, and to uncover
3963new services.
3964Viewdata software structures
3965An understanding of how a viewdata database is set up is a great
3966aid in learning to discover what might be hidden away. Remember,
3967there are always two ways to each page--by following the internal
3968indexes, or by direct keying using *nnn#. In typical viewdata
3969software, each electronic file card or 'page' exists on an overall
3970tree-like structure:
3971** Page 87
3972Hacker's Handbook
3973file:///E|/Books/Hackers Handbook.htm (84 of 133) [11/28/2000 5:58:50 AM]
3974Page
39750
3976|
3977---------------------+----------------------- ...
39781 2 3 4 5 6 7 8
3979|
3980------------+-------------------------------- ...
398131 32 33 34 35 36 37 38
3982|
3983------------------------+-------------------- ...
3984351 352 353 354 355 356 357 358 3-digit
3985| node
3986-------------+------------------------------- ...
39873531 3532 3533 3534 3535 3536 3537 3538
3988|
3989-------------------------------------------+-- ...
3990Top pages are called parents; lower pages filials. Thus page 3538
3991needs parent pages 353, 35, 3 and 0 to support it, i.e. these pages
3992must exist on the system. On Prestel, the parents owned by
3993Information Providers (the electronic publishers) are 3 digits long
3994(3-digit nodes). Single and double-digit pages (0 to 99) are owned by
3995the 'system manager' (and so are any pages beginning with the
3996sequences 100nn-199nn and any beginning with a 9nnn). When a page is
3997set up by an Information Provider (the process of going into 'edit'
3998mode varies from software package to package; on Prestel, you call up
3999page 910) two processes are necessary--the overt page (i.e. the
4000display the user sees) must be written using a screen editor. Then
4001the IP must select a series of options--e.g. whether the page is for
4002gathering a response from the user or is just to furnish information;
4003whether the page is to be open for viewing by all, by a Closed User
4004Group, or just by the IP (this facility is used while a large
4005database is being written and so that users don't access part of it
4006by mistake); the price (if any) the page will bear--and the 'routing
4007instructions'. When you look at a viewdata page and it says 'Key 8
4008for more information on ABC', it is the routing table that is
4009constructed during edit that tells the viewdata computer: 'If a user
4010on this page keys 8, take him through to the following next page'.
4011Thus, page 353880 may say 'More information on ABC....KEY 8'. The
4012information on ABC is actually held on page 3537891. The routing
4013table on page 353880 will say: 8=3537891. In this example, you will
4014see that 3537891 i9 not a true filial of 353880--this does not
4015matter; however, in order for 3537891 to exist on the system, its
4016parents must exist, i.e. there must be pages 353789, 35378, 3537
4017etc.
4018** Page 88
4019P R E S T E L
4020PRESTEL EDITING SYSTEM
4021Input Details -
4022Update option o
4023Hacker's Handbook
4024file:///E|/Books/Hackers Handbook.htm (85 of 133) [11/28/2000 5:58:50 AM]
4025Pageno 4190100 Frame-Id a
4026User CUG User access y
4027Frame type i Frame price 2p
4028Choice type s
4029Choices
40300- * 1- 4196121
40312- 4196118 3- 4196120
40324- 4196112 5- 4196119
40336- 4196110 7- *
40348- 4190101 9- 4199
4035Prestel Editing. This is the 'choices' page which se s up the frame
4036before the overt page - the one the user sees - is prepared.
4037These quirky features of viewdata software can help the hacker
4038search out hidden databases:
4039* Using a published directory, you can draw up a list of 'nodes' and
4040who occupies them. You can then list out apparently 'unoccupied'
4041nodes and see if they contain anything interesting. It was when a
4042hacker spotted that an 'obvious' Prestel node, 456, had been unused
4043for a while, that news first got out early in 1984 about the Prestel
4044Micro computing service, several weeks ahead of the official
4045announcement.
4046* If you look at the front page of a service, you can follow the
4047routings of the main index--are all the obvious immediate filials
4048used? If not, can you get at them by direct keying?
4049** Page 89
4050* Do any services start lower down a tree than you might expect
4051(i.e. more digits in a page number than you might have thought)? In
4052that case, try accessing the parents and see what happens.
4053* Remember that you can get a message 'no such page' for two
4054reasons: because the page really doesn't exist, or because the
4055Information Provider has put it on 'no user access'. In the latter
4056case, check to see whether this has been done consistently--look at
4057the immediate possible filials. To go back to when Prestel launched
4058its Prestel Microcom- puting service, using page 456 as a main node,
4059456 itself was closed off until the formal opening, but page 45600
4060was open.
4061Prestel Special Features
4062In general, this book has avoided giving specific hints about
4063individual services, but Prestel is so widely available in the UK and
4064so extensive in its coverage that a few generalised notes seem
4065worthwhile.
4066Hacker's Handbook
4067file:///E|/Books/Hackers Handbook.htm (86 of 133) [11/28/2000 5:58:50 AM]
4068Not all Prestel's databases may be found via the main index or in
4069the printed directories; even some that are on open access are
4070unadvertised. Of particular interest over the last few years have
4071been nodes 640 (owned by the Research and Development team at
4072Martlesham), 651 (Scratchpad--used for ad hoc demonstration
4073databases), 601 (mostly mailbox facilities but also known to carry
4074experimental advanced features so that they can be tried out), and
4075650 (News for Information Providers--mostly but not exclusively in a
4076Closed User Group). Occasionally equipment manufacturers offer
4077experimental services as well: I have found high-res graphics and
4078even instruction codes for digitised full video lurking around.
4079In theory, what you find on one Prestel computer you will find on
4080all the others. In practice this has never been true, as it has
4081always been possible to edit individually on each computer, as well
4082as on the main updating machine which is supposed to broadcast to all
4083the others. The differences in what is held in each machine will
4084become greater over time.
4085Gateway is a means of linking non-viewdata external computers to
4086the Prestel system. It enables on-screen buying and booking, complete
4087with validation and confirmation. It even permits telebanking, Most
4088'live' forms of gateway are very secure, with several layers of
4089password and security. However, gateways require testing before they
4090can be offered to the public; in the past, hackers have been able to
4091secure free rides out of Prestel....
4092** Page 90
4093Careful second-guessing of the routings on the databases including
4094telesoftware(*) have given users free programs while the
4095telesoftware(*) was still being tested and before actual public
4096release.
4097Prestel, as far as the ordinary user is concerned, is a very
4098secure system--it uses 14-digit passwords and disconnects after three
4099unsuccessful tries. For most purposes, the only way of hacking into
4100Prestel is to acquire a legitimate user's password, perhaps because
4101they have copied it down and left it prominently displayed. Most
4102commercial viewdata sets allow the owner to store the first ten
4103digits in the set (some even permit the full 14), thus making the
4104casual hacker's task easier. However, Prestel was sensationally
4105hacked at the end of October 1984, the whole system Iying at the feet
4106of a team of four West London hackers for just long enough to
4107demonstrate the extent of their skill to the press. Their success was
4108the result of persistence and good luck on their side and poor
4109security and bad luck on the part of BT. As always happens with
4110hacking activities that do not end up in court, some of the details
4111are disputed; there are also grounds for believing that news of the
4112hack was deliberately held back until remedial action had taken
4113place, but this is the version I believe:
4114The public Prestel service consists of a network of computers,
4115Hacker's Handbook
4116file:///E|/Books/Hackers Handbook.htm (87 of 133) [11/28/2000 5:58:50 AM]
4117mostly for access by ordinary users, but with two special-purpose
4118machines, Duke for IPs to update their information into and Pandora,
4119to handle Mailboxes (Prestel's variant on electronic mail). The
4120computers are linked by non-public packet-switched lines. Ordinary
4121Prestel users are registered (usually) onto two or three computers
4122local to them which they can access with the simple three-digit
4123telephone number 618 or 918. In most parts of the UK, these two
4124numbers will return a Prestel whistle. (BT Prestel have installed a
4125large number of local telephone nodes and
4126(*)Tefesoftware is a technique for making regular computer programs
4127available via viewdata the program lines are compressed according to
4128a simple set of rules and set up on a senes of viewdata frames. Each
4129frame contains a modest error-checking code. To receive a program,
4130the user's computer, under the control of a 'download' routine calls
4131the first program page down from the viewdata host, runs the error
4132check on it, and demands a re transmission if the check gives a
4133'false' If it gives a 'true', the user's machine unsqueezes the
4134programmes and dumps them into the Computers main memory or disc
4135store. It then requests the next viewdata page unfil the whole
4136program is collected. You then have a text file which must be
4137Converted into program instructions. Depending on what model of
4138micro you have, and which telesoftware package, you can either run
4139the program immediately or expect it. Personally I found the
4140telesoftware experience interesting the first time I tried it, and
4141quite useless in terms of speed, reliability and quality afterwards.
4142** Page 91
4143leased lines to transport users to their nearest machine at local
4144call rates, even though in some cases that machine may be 200 miles
4145away). Every Prestel machine also has several regular phone numbers
4146associated with it, for IPs and engineers. Most of these numbers
4147confer no extra privileges on callers: if you are registered to a
4148particular computer and get in via a 'back-door' phone number you
4149will pay Prestel and IPs exactly the same as if you had dialled 618
4150or 918. If you are not registered, you will be thrown off after three
4151tries.
4152In addition to the public Prestel computers there are a number of
4153other BT machines, not on the network, which look like Prestel and
4154indeed carry versions of the Prestel database. These machines, left
4155over from an earlier stage of Prestel's development, are now used for
4156testing and development of new Prestel features. The old Hogarth
4157computer, originally used for international access, is now called
4158'Gateway Test' and, as its name implies, is used by IPs to try out
4159the interconnections of their computers with those of Prestel prior
4160to public release. It is not clear how the hackers first became aware
4161of the existence of these 'extra' machines; one version is that it
4162was through the acquisition of a private phone book belonging to a BT
4163engineer. Another version suggests that they tried 'obvious' log-in
4164pass-numbers--2222222222 1234--on a public Prestel computer and found
4165themselves inside a BT internal Closed User Group which contained
4166lists of phone numbers for the develop computers. The existence of at
4167least two stories suggests that the hackers wished to protect their
4168Hacker's Handbook
4169file:///E|/Books/Hackers Handbook.htm (88 of 133) [11/28/2000 5:58:50 AM]
4170actual sources. In fact, some of the phone numbers had, to my certain
4171knowledge, appeared previously on bulletin boards.
4172At this first stage, the hackers had no passwords; they could
4173simply call up the log-in page. Not being registered on that
4174computer, they were given the usual three tries before the line was
4175disconnected.
4176For a while, the existence of these log-in pages was a matter of
4177mild curiosity. Then, one day, in the last week of October, one of
4178the log-in pages looked different: it contained what appeared to be a
4179valid password, and one with system manager status, no less. A
4180satisfactory explanation for the appearance of this password
4181imprinted on a log-in page has not so far been forthcoming. Perhaps
4182it was carelessness on the part of a BT engineer who thought that, as
4183the phone number was unlisted, no unauthorised individual would ever
4184see it. The pass-number was tried and admission secured.
4185** Page 92
4186After a short period of exploration of the database, which
4187appeared to be a 'snapshot' of Prestel rather than a live version of
4188it--thus showing that particular computer was not receiving constant
4189updates from Duke--the hackers decided to explore the benefits of
4190System Manager status. Since they had between them some freelance
4191experience of editing on Prestel, they knew that all Prestel special
4192features pages are in the *9nn# range: 910 for editing; 920 to change
4193personal passwords; 930 for mailbox messages and so ...what would
4194pages 940, 950, 960 and so on do? It became obvious that these pages
4195would reveal details of users together with account numbers
4196(systelnos), passwords and personal passwords. There were facilities
4197to register and deregister users.
4198However, all this was taking place on a non-public computer. Would
4199the same passwords on a 'live' Prestel machine give the same
4200benefits? Amazingly enough, the passwords gave access to every
4201computer on the Prestel network. It was now time to examine the user
4202registration details of real users as opposed to the BT employees who
4203were on the development machine. The hackers were able to assume any
4204personality they wished and could thus enter any Closed User Group,
4205simply by picking the right name. Among the CUG services they swooped
4206into were high-priced ones providing investment advice for clients of
4207the stockbroker Hoare Govett and commentary on international currency
4208markets supplied by correspondents of the Financial Times. They were
4209also able to penetrate Homelink, the telebanking service run by the
4210Nottingham Building Society. They were not able to divert sums of
4211money, however, as Homelink uses a series of security checks which
4212are independent of the Prestel system.
4213Another benefit of being able to become whom they wished was the
4214ability to read Prestel Mailboxes, both messages in transit that had
4215not yet been picked up by the intended recipient and those that had
4216been stored on the system once they had been read. Among the
4217Mailboxes read was the one belonging to Prince Philip. Later, with a
4218newspaper reporter as witness, one hacker sent a Mailbox, allegedly
4219Hacker's Handbook
4220file:///E|/Books/Hackers Handbook.htm (89 of 133) [11/28/2000 5:58:50 AM]
4221from Prince Philip to the Prestel System Manager:
4222I do so enjoy puzzles and games. Ta ta. Pip! Pip!
4223H R H Hacker
4224Newspaper reports also claimed that the hackers were able to gain
4225editing passwords belonging to IPs, enabling them to alter pages and
4226indeed the Daily Mail of November 2nd carried a photograph of a
4227Prestel page from the Financial Times International Financial Alert
4228saying:
4229** Page 93
4230FT NEWSFLASH!!! Å“1 EQUALS $50
4231The FT maintained that, whatever might theoretically have been
4232possible, in fact they had no record of their pages actually being so
4233altered and hazarded the suggestion that the hacker, having broken
4234into their CUG and accessed the page, had 'fetched it back' onto his
4235own micro and then edited there, long enough for the Mail's
4236photographer to snap it for his paper, but without actually
4237retransmitting the false page back to Prestel. As with so many other
4238hacking incidents, the full truth will never be known because no one
4239involved has any interest in its being told.
4240However, it is beyond doubt that the incident was regarded with the
4241utmost seriousness by Prestel itself. They were convinced of the
4242extent of the breach when asked to view page 1, the main index page,
4243which bore the deliberate mis-spelling: Idnex. Such a change
4244theoretically could only have been made by a Prestel employee with
4245the highest internal security clearance. Within 30 minutes, the
4246system manager password had been changed on all computers, public and
4247research. All 50,000 Prestel users signing on immediately after
4248November 2nd were told to change their personal password without
4249delay on every computer to which they were registered. And every IP
4250received, by Special Delivery, a complete set of new user and editing
4251passwords.
4252Three weeks after the story broke, the Daily Mail thought it had
4253found yet another Prestel hack and ran the following page 1 headline:
4254'Royal codebuster spies in new raid on Prestel', a wondrous
4255collection of headline writer's buzzwords to capture the attention of
4256the sleepy reader. This time an Information Provider was claiming
4257that, even after new passwords had been distributed, further security
4258breaches had occurred and that there was a 'mole' within Prestel
4259itself. That evening, Independent Television News ran a feature much
4260enjoyed by cognoscenti: although the story was about the Prestel
4261service, half the film footage used to illustrate it was wrong: they
4262showed pictures of the Oracle (teletext) editing facility and of
4263some-one using a keypad that could only have belonged to a TOPIC set,
4264as used for the Stock Exchange's private service. Finally, the name
4265of the expert pulled in for interview was mis-spelled although he was
4266a well-known author of micro books. The following day, BBC-tv's
4267breakfast show ran an item on the impossibility of keeping Prestel
4268Hacker's Handbook
4269file:///E|/Books/Hackers Handbook.htm (90 of 133) [11/28/2000 5:58:50 AM]
4270secure, also full of ludicrous inaccuracies.
4271** Page 94
4272It was the beginning of a period during which hackers and hacking
4273attracted considerable press interest. No news service operating in
4274the last two months of 1984 felt it was doing an effective job if it
4275couldn't feature its own Hacker's Confession, suitably filmed in deep
4276shadow. As happens now and again, press enthusiasm for a story ran
4277ahead of the ability to check for accuracy and a number of Hacks That
4278Never Were were reported and, in due course, solemnly commented on.
4279BT had taken much punishment for the real hack--as well as causing
4280deep depression among Prestel staff, the whole incident had occurred
4281at the very point when the corporation was being privatised and
4282shares being offered for sale to the public--and to suffer an
4283unwarranted accusation of further lapses in security was just more
4284than they could bear. It is unlikely that penetration of Prestel to
4285that extent will ever happen again, though where hacking is
4286concerned, nothing is impossible.
4287There is one, relatively uncommented-upon vulnerability in the
4288present Prestel set-up: the information on Prestel is most easily
4289altered via the bulk update protocols used by Information Providers,
4290where there is a remarkable lack of security. All the system
4291presently requires is a 4-character editing password and the IP's
4292systel number, which is usually the same as his mailbox number
4293(obtainable from the on-system mailbox directory on page *7#) which
4294in turn is very likely to be derived from a phone number.
4295Other viewdata services
4296Large numbers of other viewdata services exist: in addition to the
4297Stock Exchange's TOPIC and the other viewdata based services
4298mentioned in chapter 4, the travel trade has really clutched the
4299technology to its bosom: the typical High Street agent not only
4300accesses Prestel but several other services which give up-to-date
4301information on the take-up of holidays, announce price changes and
4302allow confirmed air-line and holiday bookings.
4303Several of the UK's biggest car manufacturers have a stock locator
4304system for their dealers: if you want a British Leyland model with a
4305specific range of accessories and in the colour combinations of your
4306choice, the chances are that your local dealer will not have it
4307stock. He can, however, use the stock locator to tell him with which
4308other dealer such a machine may be found.
4309Stock control and management information is used by retail chains
4310using, in the main, a package developed by a subsidiary of Debenhams.
4311Debenhams had been early enthusiasts of Prestel in the days when it
4312was still being pitched at a mass consumer audience--its service was
4313called Debtel which wags suggested was for people who owed money or,
4314alternatively, for upper-class young ladies.
4315Hacker's Handbook
4316file:///E|/Books/Hackers Handbook.htm (91 of 133) [11/28/2000 5:58:50 AM]
4317** Page 95
4318Later it formed DISC to link together its retail outlets, and this
4319was hacked in 1983. The store denied that anything much had
4320happened, but the hacker appeared (in shadow) on a tv program
4321together with a quite convincing demonstration of his control over
4322the system.
4323Audience research data is despatched in viewdata mode to
4324advertising agencies and broadcasting stations by AGB market
4325research. There are even alternate viewdata networks rivalling that
4326owned by Prestel, the most important of which is, at the time of
4327writing, the one owned by Istel and headquartered at Redditch in the
4328Midlands. This network transports several different trade and
4329professional services as well as the internal data of British
4330Leyland, of whom Istel is a subsidiary.
4331A viewdata front-end processor is a minicomputer package which
4332sits between a conventionally-structured database and its ports which
4333look into the phone-lines. Its purpose is to allow users with
4334viewdata sets to search the main database without the need to
4335purchase an additional conventional dumb terminal. Some view- data
4336front-end processors (FEPs) expect the user to have a full alphabetic
4337keyboard, and merely transform the data into viewdata pages 40
4338characters by 24 lines in the usual colours. More sophisticated FEPs
4339go further and allow users with only numeric keypads to retrieve
4340information as well. By using FEPs a database publisher or system
4341provider can reach a larger population of users. FEPs have been known
4342to have a lower standard of security protection than the conventional
4343systems to which they were attached.
4344Viewdata standards
4345The UK viewdata standard--the particular graphics set and method
4346of transmitting frames -- is adopted in many other European countries
4347and in former UK imperial possessions. Numbers and passwords to
4348access these services occasionally appear on bulletin boards and the
4349systems are particularly interesting to enter while they are still on
4350trial. As a result of a quirk of Austrian law, anyone can
4351legitimately enter their service without a password; though one is
4352needed if you are to extract valuable information. However, important
4353variants to the UK standards exist: the French (inevitably) have a
4354system that is remarkably similar in outline but incompatible.
4355** Page 96
4356In North America, the emerging standard which was originally put
4357together by the Canadians for their Telidon service but which has
4358now, with modifications, been promoted by Ma Bell, has high
4359resolution graphics because, instead of building up images from block
4360graphics, it uses picture description techniques (eg draw line, draw
4361arc, fill-in etc) of the sort relatively familiar to most users of
4362modern home micros. Implementations of NALPS (as the US standard is
4363called) are available for the IBM PC.
4364Hacker's Handbook
4365file:///E|/Books/Hackers Handbook.htm (92 of 133) [11/28/2000 5:58:50 AM]
4366The Finnish public service uses software which can handle nearly
4367all viewdata formats, including a near-photographic mode.
4368Software similar to that used in the Finnish public service can be
4369found on some private systems. Countries vary considerably in their
4370use of viewdata technology: the German and Dutch systems consist
4371almost entirely of gateways to third-party computers; the French
4372originally cost-justified their system by linking it to a massive
4373project to make all telephone directories open to electronic enquiry,
4374thus saving the cost of printed versions. French viewdata terminals
4375thus have full alpha-keyboards instead of the numbers-only versions
4376common in other countries. For the French, the telephone directory is
4377central and all other information peripheral. Teletel/Antiope, as the
4378service is called, suffered its first serious hack late in 1984 when
4379a journalist on the political/satirical weekly Le Canard Finchaine
4380claimed to have penetrated the Atomic Energy Commission's computer
4381files accessible via Teletel and uncovered details of laser projects,
4382nuclear tests in the South Pacific and an experimental nuclear
4383reactor.
4384Viewdata: the future
4385Viewdata grew up at a time when the idea of mass computer
4386ownership was a fantasy, when the idea that private individuals could
4387store and process data locally was considered far-fetched and when
4388there were fears that the general public would have difficulties in
4389tackling anything more complicated than a numbers- only key-pad.
4390These failures of prediction have lead to the limitations and
4391clumsiness of present-day viewdata. Nevertheless, the energy and
4392success of the hardware salesmen plus the reluctance of companies and
4393organisations to change their existing set-ups will ensure that for
4394some time to come, new private viewdata systems will continue to be
4395introduced...and be worth trying to break into.
4396There is one dirty trick that hackers have performed on private
4397viewdata systems. Entering them is often easy, because high-level
4398editing passwords are, as mentioned earlier, sometimes desperately
4399insecure (see chapter 6) and it is easy to acquire editing status.
4400** Page 97
4401Once you have discovered you are an editor, you can go to edit
4402mode and edit the first page on the system, page 0: you can usually
4403place your own message on it, of course; but you can also default all
4404the routes to page 90. Now *90# in most viewdata systems is the
4405log-out command, so the effect is that, as soon as someone logs in
4406successfully and tries to go beyond the first page, the system logs
4407them out....
4408However, this is no longer a new trick, and one which should be
4409used with caution: is the database used by an important organisation?
4410Are you going to tell the system manager what you have done and
4411urge more care in password selection in future?
4412Hacker's Handbook
4413file:///E|/Books/Hackers Handbook.htm (93 of 133) [11/28/2000 5:58:50 AM]
4414** Page 98
4415CHAPTER 9
4416Radio Computer Data
4417Vast quantities of data traffic are transmitted daily over the
4418radio frequency spectrum; hacking is simply a matter of hooking up a
4419good quality radio receiver and a computer through a suitable
4420interface. On offer are news services from the world's great press
4421agencies, commercial and maritime messages, meteorological data, and
4422plenty of heavily-encrypted diplomatic and military traffic. A
4423variety of systems, protocols and transmission methods are in use and
4424the hacker jaded by land-line communication (and perhaps for the
4425moment put off by the cost of phone calls) will find plenty of fun on
4426the airwaves.
4427The techniques of radio hacking are similar to those necessary for
4428computer hacking. Data transmission over the airwaves uses either a
4429series of audio tones to indicate binary 0 and 1 which are modulated
4430on transmit and demodulated on receive or alternatively frequency
4431shift keying which involves the sending of one of two slightly
4432different radio frequency carriers, corresponding to binary 0 or
4433binary 1. The two methods of transmission sound identical on a
4434communications receiver (see below) and both are treated the same for
4435decoding purposes. The tones are different from those used on
4436land-lines--'space' is nearly always 1275 Hz and 'mark' can be one of
4437three tones: 1445 Hz (170 Hz shift--quite often used by amateurs and
4438with certain technical advantages); 1725 Hz (450 Hz shift--the one
4439most commonly used by commercial and news services) and 2125 Hz (850
4440Hz shift--also used commercially). The commonest protocol uses the
44415-bit Baudot code rather than 7-bit or 8-bit ASCII. The asynchronous,
4442start/stop mode is the most common. Transmission speeds include: 45
4443baud (60 words/minute), 50 baud (66 words/minute), 75 baud (100
4444words/ minute). 50 baud is the most common. However, many
4445interesting variants can be heard--special versions of Baudot for
4446non- European languages, error correction protocols, and various
4447forms of facsimile.
4448The material of greatest interest is to be found in the high
4449frequency or 'short wave' part of the radio spectrum, which goes from
44502 MHz, just above the top of the medium wave broadcast band, through
4451to 30 MHz, which is the far end of the 10-meter amateur band which
4452itself is just above the well-known Citizens' Band at 27 MHz.
4453** Page 99
4454The reason this section of the spectrum is so interesting is that,
4455unique among radio waves, it has the capacity for world-wide
4456propagation without the use of satellites, the radio signals being
4457bounced back, in varying degrees, by the ionosphere. This special
4458Hacker's Handbook
4459file:///E|/Books/Hackers Handbook.htm (94 of 133) [11/28/2000 5:58:50 AM]
4460quality means that everyone wants to use HF (high frequency)
4461transmission--not only international broadcasters, the propaganda
4462efforts of which are the most familiar uses of HF. Data transmission
4463certainly occurs on all parts of the radio spectrum, from VLF (Very
4464Low Frequency, the portion below the Long Wave broadcast band which
4465is used for submarine communication), through the commercial and
4466military VHF and UHF bands, beyond SHF (Super High Frequency, just
4467above 1000 MHz) right to the microwave bands. But HF is the most
4468rewarding in terms of range of material available, content of
4469messages and effort required to access it.
4470Before going any further, hackers should be aware that in a number
4471of countries even receiving radio traffic for which you are not
4472licensed is an offence; in nearly all countries making use of
4473information so received is also an offence and, in the case of news
4474agency material, breach of copyright may also present a problem.
4475However, owning the equipment required is usually not illegal and,
4476since few countries require a special license to listen to amateur
4477radio traffic (as opposed to transmitting, where a license is needed)
4478and since amateurs transmit in a variety of data modes as well,
4479hackers can set about acquiring the necessary capability without
4480fear.
4481Equipment
4482The equipment required consists of a communications receiver, an
4483antenna, an interface unit/software and a computer.
4484Communications receiver - This is the name given to a good quality
4485high frequency receiver. Suitable models can be obtained,
4486second-hand, at around £100; new receivers cost upwards of £175.
4487There is no point is buying a radio simply designed to pick up
4488shortwave broadcasts which will lack the sensitivity, selectivity and
4489resolution necessary. A minimum specification would be:
4490Coverage 500 kHz--30 MHz
4491Resolution >100 Hz
4492** Page 100
4493Modes AM, Upper Side Band, Lower Side Band,
4494CW (Morse)
4495Tuning would be either by two knobs, one for MHz, one for kHz, or
4496by keypad. On more expensive models it is possible to vary the
4497bandwidth of the receiver so that it can be widened for musical
4498fidelity and narrowed when listening to bands with many signals close
4499to one another.
4500Broadcast stations transmit using AM (amplitude modulation), but
4501in the person-to-person contacts of the aeronautical, maritime and
4502amateur world, single-side-band-suppressed carrier techniques are
4503Hacker's Handbook
4504file:///E|/Books/Hackers Handbook.htm (95 of 133) [11/28/2000 5:58:50 AM]
4505used--the receiver will feature a switch marked AM, USB, LSB, CW etc.
4506Side-band transmission uses less frequency space and so allows more
4507simultaneous conversations to take place, and is also more efficient
4508in its use of the power available at the transmitter. The chief
4509disadvantage is that equipment for receiving is more expensive and
4510must be more accurately tuned. Upper side band is used on the whole
4511for voice traffic, and lower side band for data traffic. (Radio
4512amateurs are an exception: they also use lower side-band for voice
4513transmissions below 10 MHz.) Suitable sources of supply for
4514communications receivers are amateur radio dealers, whose addresses
4515may be found in specialist magazines like Practical Wireless, Amateur
4516Radio, Ham Radio Today.
4517Antenna - Antennas are crucial to good shortwave reception--the sort
4518of short 'whip' aerial found on portable radios is quite insufficient
4519if you are to capture transmissions from across the globe. When using
4520a computer close to a radio you must also take considerable care to
4521ensure that interference from the CPU and monitor don't squash the
4522signal you are trying to receive. The sort of antenna I recommend is
4523the 'active dipole', which has the twin advantages of being small and
4524of requiring little operational attention. It consists of a couple of
45251-meter lengths of wire tied parallel to the ground and meeting in a
4526small plastic box. This is mounted as high as possible, away from
4527interference, and is the 'active' part. From the plastic box descends
4528coaxial cable which is brought down to a small power supply next to
4529the receiver and from there the signal is fed into the receiver
4530itself. The plastic box contains special low-noise transistors.
4531It is possible to use simple lengths of wire, but these usually
4532operate well only on a limited range of frequencies, and you will
4533need to cover the entire HF spectrum. Active antennas can be obtained
4534by mail order from suppliers advertising in amateur radio
4535magazines--the Datong is highly recommended.
4536** Page 101
4537Interface The 'interface' is the equivalent of the modem in landline
4538communications; indeed, advertisements of newer products actually refer to
4539radio modems. Radio tele-type, or RTTY, as it is called, is traditionally
4540received on a modified teleprinter or telex machine; and the early interfaces
4541or terminal units (TUs) simply converted the received audio tones into 'mark'
4542and 'space' to act as the equivalent of the electrical line conditions of a
4543telex circuit. Since the arrival of the microcomputer, however, the design
4544has changed dramatically and the interface now has to perform the following
4545functions:
45461 Detect the designated audio tones
45472 Convert them into electrical logic states
45483 Strip the start/stop bits, convert the Baudot code into ASCII
4549equivalents, reinsert start/stop bits
45504 Deliver the new signal into an appropriate port on the computer.
4551(If RS232C is not available, then any other port, e.g. Game, that
4552Hacker's Handbook
4553file:///E|/Books/Hackers Handbook.htm (96 of 133) [11/28/2000 5:58:50 AM]
4554is)
4555A large number of designs exist: some consist of hardware
4556interfaces plus a cassette, disc or ROM for the software; others
4557contain both the hardware for signal acquisition and firmware for its
4558decoding in one box.
4559Costs vary enormously and do not appear to be related to quality
4560of result. The kit-builder with a ZX81 can have a complete set-up for
4561under £40; semi-professional models, including keyboards and screen
4562can cost in excess of £1000.
4563The kit I use is based on the Apple II (because of that model's
4564great popularity in the USA, much hardware and software exists); the
4565interface talks into the game port and I have several items of
4566software to present Baudot, ASCII or Morse at will. There is even
4567some interesting software for the Apple which needs no extra
4568hardware--the audio from the receiver is fed direct into the cassette
4569port of the Apple, but this method is difficult to replicate on other
4570machines because of the Apple's unique method of reading data from
4571cassette.
4572** Page 102
4573Excellent inexpensive hard/firmware is available for many Tandy
4574computers, and also for the VlC20/Commodore 64. On the whole US
4575suppliers seem better than those in the UK or Japan-- products are
4576advertised in the US magazines QST and 73.
4577Setting Up Particular attention should be paid to linking all the
4578equipment together; there are special problems about using sensitive
4579radio receiving equipment in close proximity to computers and VDUs.
4580Computer logic blocks, power supplies and the synchronising pulses on
4581VDUs are all excellent sources of radio interference (rfi). RFI
4582appears not only as individual signals at specific points on the
4583radio dial, but also as a generalised hash which can blank out all
4584but the strongest signals.
4585Interference can escape from poorly packaged hardware, but also
4586from unshielded cables which act as aerials. The remedy is simple to
4587describe: encase and shield everything, connecting all shields to a
4588good earth, preferably one separate from the mains earth. In
4589practice, much attention must be paid to the detail of the
4590interconnections and the relative placing of items of equipment. In
4591particular, the radio's aerial should use coaxial feeder with a
4592properly earthed outer braid, so that the actual wires that pluck the
4593signals from the ether are well clear of computer-created rfi. It is
4594always a good idea to provide a communications receiver with a proper
4595earth, though it will work without one: if used with a computer, it
4596is essential.
4597Do not let these paragraphs put you off; with care excellent
4598results can be obtained. And bear in mind my own first experience:
4599ever eager to try out same new kit, I banged everything together with
4600great speed--ribbon cable, poor solder joints, an antenna taped
4601Hacker's Handbook
4602file:///E|/Books/Hackers Handbook.htm (97 of 133) [11/28/2000 5:58:50 AM]
4603quickly to a window in a metal frame less than two meters from the
4604communications receiver--and all I could hear from 500 kHz to 30
4605MHz, wherever I tuned, was a great howl-whine of protest...
4606Where to listen
4607Scanning through the bands on a good communications receiver, you
4608realise just how crowded the radio spectrum is. The table in Appendix
4609VI gives you an outline of the sandwich-like fashion in which the
4610bands are organised.
4611The 'fixed' bands are the ones of interest; more particularly, the
4612following ones are where you could expect to locate news agency
4613transmissions (in kHz):
4614** Page 103
46153155 -- 3400 14350 -- 14990
46163500 -- 3900 15600 -- 16360
46173950 -- 4063 17410 -- 17550
46184438 -- 4650 18030 -- 18068
46194750 -- 4995 18168 -- 18780
46205005 -- 5480 18900 -- 19680
46215730 -- 5950 19800 -- 19990
46226765 -- 7000 20010 -- 21000
46237300 -- 8195 21850 -- 21870
46249040 -- 9500 22855 -- 23200
4625ggoo -- 9995 23350 -- 24890
462610100 -- 11175 25010 -- 25070
462711400 -- 11650 25210 -- 25550
462812050 -- 12330 26175 -- 28000
462913360 -- 13600 29700 -- 30005
463013800 -- 14000
4631In addition, amateurs tend to congregate around certain spots on the
4632frequency map: 3590, 14090, 21090, 28090, and at VHF/UHF: 144.600,
4633145.300, MHz 432.600, 433.300.
4634Tuning In
4635Radio Teletype signals have a characteristic two-tone warble sound
4636which you will hear properly only if your receiver is operating in
4637SSB (single-side-band) mode. There are other digital tone-based
4638signals to be heard: FAX (facsimile), Helschcrieber (which uses a
4639technique similar to dot-matrix printers and is used for Chinese and
4640related pictogram-style alphabets), SSTV (slow scan television, which
4641can take up to 8 seconds to send a low-definition picture), and
4642others.
4643But with practice, the particular sound of RTTY can easily be
4644recognised. More experienced listeners can also identify shifts and
4645speeds by ear.
4646Hacker's Handbook
4647file:///E|/Books/Hackers Handbook.htm (98 of 133) [11/28/2000 5:58:50 AM]
4648You should tune into the signal watching the indicators on your
4649terminal unit to see that the tones are being properly captured--
4650typically, this involves getting two LEDs to flicker simultaneously.
4651The software will now try to decode the signal, and it will be up
4652to you to set the speed and 'sense'. The first speed to try is 66/7
4653words per minute, which corresponds to 50 baud, as this is the most
4654common. On the amateur bands, the usual speed is 60 words per minute
4655(45 baud); thereafter, if the rate sounds unusually fast, you try 100
4656words per minute (approximately 75 baud).
4657** Page 104
4658By 'sense' or 'phase' is meant whether the higher tone corresponds
4659to logical 1 or logical 0. Services can use either format; indeed
4660the same transmission channel may use one 'sense' on one occasion and
4661the reverse 'sense' on another. Your software can usually cope with
4662this. If it can't, all is not lost: you retune your receiver to the
4663opposite, side-band and the phase will thereby be reversed. So, if
4664you are listening on the lower side-band (LSB), usually the
4665conventional way to receive, you simply switch over to USB (upper
4666side-band), retune the signal into the terminal unit, and the sense'
4667will have been reversed.
4668Many news agency stations try to keep their channels open even if
4669they have no news to put out: usually they do this by sending test
4670messages like: 'The quick brown fox....' or sequences like
4671'RYRYRYRYRYRY...' such signals are useful for testing purposes, if
4672a little dull to watch scrolling up the VDU screen.
4673You will discover many signals that you can't decode: the
4674commonest reason is that the transmissions do not use European
4675alphabets, and all the elements in the Baudot code have been
4676re-assigned--some versions of Baudot use not one shift, but two, to
4677give the required range of characters. Straightforward en- crypted
4678messages are usually recognisable as coming in groups of five
4679letters, but the encryption can also operate at the bit- as well as
4680at the character-level -- in that case, too, you will get
4681gobbleydegook.
4682A limited amount of ASCII code as opposed to Baudot is to be
4683found, but mostly on the amateur bands.
4684Finally, an error-correction protocol, called SITOR, is
4685increasingly to be found on the maritime bands, with AMTOR, an amateur
4686variant, in the amateur bands, SITOR has various modes of operation
4687but, in its fullest implementation, messages are sent in blocks which
4688must be formally acknowledged by the recipient before the next one is
4689despatched. The transmitter keeps trying until an acknowledgement is
4690received. You may even come across, on the amateur bands, packet
4691radio, which has some of the features of packet switching on digital
4692land lines. This is one of the latest enthusiasms in amateur radio
4693with at least two different protocols in relatively wide use.
4694Discussion of SITOR and packet radio is beyond the scope of this
4695book, but the reader is referred to BARTG (the British Amateur Radio
4696Hacker's Handbook
4697file:///E|/Books/Hackers Handbook.htm (99 of 133) [11/28/2000 5:58:50 AM]
4698Teletype Group) and its magazine Datacom for further information. You
4699do not need to be a licensed radio amateur to join. The address is:
470027 Cranmer Court, Richmond Road, Kingston KT2 SPY.
4701Operational problems of radio hacking are covered at the end of
4702Appendix I, the Baudot code is given Appendix IV and an outline
4703frequency plan is to be found in Appendix VI.
4704** Page 105
4705The material that follows represents some of the types of common
4706transmissions: news services, test slips (essentially devices for
4707keeping a radio channel open), and amateur. The corruption in places
4708is due either to poor radio propagation conditions or to the presence
4709of interfering signals.
4710REVUE DE LA PRESSE ITALIENNE DU VENDREDI 28 DECEMBRE 1984
4711LE PROCES AUX ASSASSINS DE L~ POIELUSZKO, LA VISITE DE
4712M. SPADOLINI A ISRAEL, LA SITUATION AU CAMBODGE ET LA GUER-
4713ILLA AU MOZAMBIQUE FONT LES TITES DES PAGES POLITIQUES
4714MOBILISATION TO WORK FOR THE ACCOUNT OF 1985
4715- AT THE ENVER HOXHA AUTOMOBILE AND
4716TRACTOR COMBINE IN TIRANA 2
4717TIRANA, JANUARY XATA/. - THE WORKING PEOPLE OF THE ENVER HOXH~/
4718AUTOMOBILE AND TRACTOR COMBINE BEGAN THEIR WORR WITH VIGOUR
4719AND MOBILISATION FOR THE ACCOUNT OF 1985. THE WORK IN THIS
4720IMPROVOWNT CENTER FOR MECHANICAL INDUSTRY WAS NOT INTERRUPTED
4721FOR ONE MOMENT AND THE WORKING PEOPLE 8~S ONE ANOTHER FOR
4722FRESHER GREATER VICTORIES UNDER THE LEADERSHIP OF THE PARTY
4723WITH ENVER HOXHA AT THE HEAD, DURING THE SHIFTS, NEAR
4724THE FURNANCES~ PRESSES ETC.. JUST LIKE SCORES OF WORKING COLLE-
4725CTIVES OF THE COUNTRY WHICH WERE NOT AT HOME DURING THE NEW
4726YEAR B
4727IN THE FRONTS OF WORK FOR THE BENEFITS OF THE SOCI-
4728ALIST CONSTRUCTION OF THE COUNTRY.
4729PUTTING INTO LIFE THE TEACHINGS OF THE PARTY AND THE INSTRU-
4730CTIONS OF COMRADE ENVER HOXHA, THE WORKING COLLECTIVE OF THIS
4731COMBINE SCORED FRESH SUCCESSES DURING 1984 TO REALIZE THE
4732INDICES OF THE STATE PLAN BY RASING THE ECEONOMIC EFFECTIVE-
4733NESS. THE WORKING PEOPLE SUCCESSFULLY REALIZED AND OVERFUL
4734FILLED THE OBJECTIVE OF THE REVOLUTIONARY DRIVE ON THE HIGHER
4735EFFECTIOVENESS OF PRODUCTION, UNDERTAKEN IN KLAIDQAULSK SO~
4736WITHIN 1984 THE PLANNED PRODUCTIVITY, ACCORDING TO THE INDEX
4737OF THE FIVE YEAR PLAN, WAS OVERFULFILLED BY 2 PER CENT.
4738MOREOVER, THE FIVE YEAR PLAN FOR THE GMWERING OF THE COST OF
4739PRODUCTION WAS RAISED 2 MONTHS AHEAD OF TIME, ONE FIVE YEAR
4740PLAN FOR THE PRODUCTION OF MACHINERIES LAND EQUIPMENT AND
4741THE PRODUCTION OF THE TRACTORS WAS OVER-
4742FULFILLED. THE NET INCOME OF THE FIVE YEAR PLAN WAS REALIZED
4743WITHIN 4 YEARS. ETCM
4744Hacker's Handbook
4745file:///E|/Books/Hackers Handbook.htm (100 of 133) [11/28/2000 5:58:50 AM]
4746YRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRY
4747RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYR
4748** Page 106
4749YRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRY
4750YRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRY
4751RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYR~ u UL ~v_.~v
4752GJ4YAD GJ4YAD DE G4DF G4DF
4753SOME QRM BUT MOST OK. THE SHIFT IS NORMAL...SHIFT IS NORMAL.
4754FB ON YOUR RIG AND NICE TO MEET YOU IN RTTY. THE WEATHER HERE
4755TODAY IS FINE AND BEEN SUNNY BUT C9LD. I HAVE BEEN IN THIS MODE
4756BEFORE BUT NOT FOR A FEW YEARS HI HI.
4757GJ4YAD GJ4YAD DE G4DF G4DF
4758PSE KKK
4759G4ElE G4EJE DE G3IMS G3IMS
4760TNX FOR COMING BACk. RIG HERE IS ICOM 720A BUT I AM SENDING
4761AFSk; NOT FSk'. I USED TO HAVE A CREED BUT CHUCKED IT OUT IT WAS
4762TOO NOISY AND NOW HAVE VIC2D SYSTEM AND SOME US kIT MY SON
4763BROUGHT ME HE TRAVELS A LOT.
4764HAD LOTS OF TROUBLE WITH RFI AND HAVE NOT YET CURED IT. VERTY BAD
4765QRM AT MOMENT. CAN GET NOTHING ABOVE 1CI MEGS AND NOT MUCH EX-G ON
4766S(:). HI HI. SUNSPOT COUNT IS REALLY LOW.
4767G4EJE G4EJE DE G3IMS G3IMS
4768~I.Of;KKKk'KKKK
4769RYRYRYRYRYRYRYRYRYR
4770~K~fk'KKKKKKK
4771G3IMS G3IMS DE G4EJE G4EJE
4772FB OM. URM IS GETTING WORSE. I HAVE ALWAYS LIk.ED ICOM RIGS BUT
4773THEY ARE EXEPENSIVE. CAN YOU RUN FULL 1QCI PER CENT DUTY CYCLE ON
4774RTTY OR DO YOU HAVE TO RUN AROUND 50 PER CENT. I GET OVER-HEATING
4775ON THIS OLD YAESU lQl. WHAT SORT OF ANTENNA SYSTEM DO YOU USE.
4776HERE IS A TRAPPED VERTICAL WITH 8CI METERS TUNED TO RTTY SPOT AT
4777~;59(:1.
4778I STILL USE CREED 7 THOUGH AM GETTING FED UP WITH MECHANICAL
4779BREAK- W WN AND NOISE BUT I HAVE HEARD ABOUT RFI AND HOME
4780COMPUTER5. MY NEPHEW HAS A SPECTRUM, CAN YOU GET RTTY SOFTWARE
4781FOR THAT/.
4782G3IMs G3IMS DE G4EJE G4EJE
4783** Page 107
4784CHAPTER 10
4785Hacker's Handbook
4786file:///E|/Books/Hackers Handbook.htm (101 of 133) [11/28/2000 5:58:50 AM]
4787Hacking: the Future
4788Security is now probably the biggest single growth area within the
4789mainstream computer business. At conference after conference,
4790consultants compete with each other to produce the most frightening
4791statistics.
4792The main concern, however, is not hacking but fraud. Donn Parker,
4793a frequent writer and speaker on computer crime based at the Stanford
4794Research Institute has put US computer fraud at $3000 million a year;
4795although reported crimes amount to only $100 million annually. In
4796June 1983 the Daily Telegraph claimed that British computer-related
4797frauds could be anything between £500 million and £2.5 billion a
4798year. Detective Inspector Ken McPherson, head of the computer crime
4799unit at the Metropolitan Police, was quoted in 1983 as saying that
4800within 15 years every fraud would involve a computer. The trouble is,
4801very few victims are prepared to acknowledge their losses. To date,
4802no British clearing bank has admitted to suffering from an
4803out-and-out computer fraud, other than the doctoring of credit and
4804plastic ID cards. Few consultants believe that they have been immune.
4805However, to put the various threats in perspective, here are two
4806recent US assessments. Robert P Campbell of Advanced Information
4807Management, formerly head of computer security in the US Army,
4808reckons that only one computer crime in 100 is detected; of those
4809detected, 15 per cent or fewer are reported to the authorities, and
4810that of those reported, one in 33 is successfully prosecuted--a
4811'clear-up' rate of one in 22,000.
4812And Robert Courtney, former security chief at IBM produced a list
4813of hazards to computers: 'The No 1 problem now and forever is errors
4814and omissions'. Then there is crime by insiders, particularly
4815non-technical people of three types: single women under 35; 'little
4816old ladies' over 50 who want to give the money to charity; and older
4817men who feel their careers have left them neglected. Next, natural
4818disasters. Sabotage by disgruntled employees. Water damage. As for
4819hackers and other outsiders who break in, he estimates it is less
4820than 3 per cent of the total.
4821** Page 108
4822Here in the UK, the National Computing Centre says that at least
482390 per cent of computer crimes involve putting false information into
4824a computer, as opposed to sophisticated logic techniques; such crimes
4825are identical to conventional embezzlement: looking for weaknesses
4826in an accounting system and taking advantage. In such cases the
4827computer merely carries out the fraud with more thoroughness than a
4828human, and the print-out gives the accounts a spurious air of being
4829correct.
4830In the meantime, we are on the threshold of a new age of
4831opportunities for the hacker. The technology we can afford has
4832suddenly become much more interesting.
4833The most recent new free magazines to which I have acquired
4834Hacker's Handbook
4835file:///E|/Books/Hackers Handbook.htm (102 of 133) [11/28/2000 5:58:50 AM]
4836subscriptions are for owners of the IBM PC, its variants and clones.
4837There are two UK monthlies for regular users, another for corporate
4838buyers and several US titles.
4839The IBM PC is only partly aimed at small business users as a
4840stand-alone machine to run accounting, word processing, spread- sheet
4841calculation and the usual business dross; increasingly the marketing
4842is pitching it as an executive work-station, so that the corporate
4843employee can carry out functions not only local to his own office,
4844but can access the corporate mainframe as well--for data, messaging
4845with colleagues, and for greater processing power.
4846In page after page, the articles debate the future of this
4847development--do employees want work-stations? Don't many bosses still
4848feel that anything to do with typing is best left to their secretary?
4849How does the executive workstation relate to the mainframe? Do you
4850allow the executive to merely collect data from it, or input as well?
4851If you permit the latter, what effect will this have on the integrity
4852of the mainframe's files? How do you control what is going on? What
4853is the future of the DP professional? Who is in charge?
4854And so the articles go on. Is IBM about to offer packages which
4855integrate mainframes and PCs in one enormous system, thus effectively
4856blocking out every other computer manufacturer and software publisher
4857in the world by sheer weight and presence?
4858I don't know the answers to these questions, but elsewhere in
4859these same magazines is evidence that the hardware products to
4860support the executive workstation revolution are there--or, even if
4861one has the usual cynicism about computer trade advertising ahead of
4862actual availability, about to be.
4863The products are high quality terminal emulators, not the sort of
4864thing hitherto achieved in software--variants on asynchronous
4865protocols with some fancy cursor addressing--but cards capable of
4866supporting a variety of key synchronous communications, like 327x
4867(bisynch and SDLC), and handling high-speed file transfers in CICs,
4868TSO, IMS and CMS.
4869** Page 109
4870These products feature special facilities, like windowing or
4871replicate aspects of mainframe operating systems like VM (Virtual
4872Machine), giving the user the experience of having several different
4873computers simultaneously at his command. Other cards can handle IBM's
4874smaller mini- mainframes, the Systems/34 and /38. Nor are other
4875mainframe manufacturers with odd-ball comms requirements ignored:
4876ICL, Honeywell and Burroughs are all catered for. There are even
4877several PC add-ons which give a machine direct X.25; it can sit on a
4878packet-switched network without the aid of a PAD.
4879Such products are expensive by personal micro standards, but it
4880means that, for the expenditure of around £8000, the hacker can call
4881up formidable power from his machine. The addition of special
4882environments on these new super micros which give the owner direct
4883Hacker's Handbook
4884file:///E|/Books/Hackers Handbook.htm (103 of 133) [11/28/2000 5:58:50 AM]
4885experience of mainframe operating systems--and the manuals to go with
4886them--will greatly increase the population of knowledgeable computer
4887buffs. Add to this the fact that the corporate workstation market, if
4888it is at all succesful, must mean that many executives will want to
4889call their mainframe from home --and there will be many many more
4890computer ports on the PTSN or sitting on PSS.
4891There can be little doubt that the need for system security will
4892play an increasing role in the specification of new mainframe
4893installations. For some time, hardware and software engineers have
4894had available the technical devices necessary to make a computer
4895secure; the difficulty is to get regular users to implement the
4896appropriate methods--humans can only memorise a limited number of
4897passwords. I expect greater use will be made of threat monitoring
4898techniques: checking for sequences of unsuccessful attempts at
4899logging in, and monitoring the level of usage of customers for
4900extent, timing, and which terminals or ports they appear on.
4901The interesting thing as far as hackers are concerned is that it
4902is the difficulty of the exercise that motivates us, rather than the
4903prospect of instant wealth. It is also the flavour of naughty, but
4904not outright, illegality. I remember the Citizens Band radio boom of
4905a few years ago: it started quietly with just a handful of London
4906breakers who had imported US sets, really simply to talk to a few
4907friends. One day everyone woke up, switched on their rigs and
4908discovered overnight there was a whole new sub-culture out there,
4909breathing the ether. Every day there were more and more until no
4910spare channels could be found. Then some talented engineers found out
4911how to freak the rigs and add another 40 channels to the original 40.
4912And then another 40. Suddenly there were wholesalers and retailers
4913and fanzines, all selling and promoting products the using or
4914manufacturing of which was illegal under British law.
4915** Page 110
4916Finally, the government introduced a legalised CB, using different
4917standards from the imported US ones. Within six months the illegal
4918scene had greatly contracted, and no legal CB service of comparable
4919size ever took its place. Manufacturers and shop- keepers who had
4920expected to make a financial killing were left with warehouses full
4921of the stuff. Much of the attraction of AM CB was that it was
4922forbidden and unregulated. There is the desire to be an outlaw, but
4923clever and not too outrageous with it, in very many of us.
4924So I don't believe that hacking can be stopped by tougher
4925security, or by legislation, or even by the fear of punishment.
4926Don't get me wrong: I regard computers as vastly beneficial. But
4927they can threaten our traditional concepts of freedom, individuality
4928and human worth I like to believe hacking is a curious
4929re-assertion of some of those ideas.
4930The challenge of hacking is deeply ingrained in many computer
4931enthusiasts; where else can you find an activity the horizons of
4932which are constantly expanding, where new challenges and dangers can
4933Hacker's Handbook
4934file:///E|/Books/Hackers Handbook.htm (104 of 133) [11/28/2000 5:58:50 AM]
4935be found every day, where you are not playing a visibly artificial
4936'game', where so much can be accessed with so little resource but a
4937small keyboard, a glowing VDU, an inquisitive and acquisitive brain,
4938and an impish mentality?
4939** Page 111
4940APPENDIX I
4941Trouble Shooting
4942The assumption is that you are operating in the default mode of
4943300/300 baud asynchronous using CCITT tones, 7 bits, even parity, one
4944stop bit, full-duplex/echo off, originate. You have dialled the
4945remote number, seized the line and can hear a data tone. Something is
4946not working properly. This is a partial list of possibilities.
4947The screen remains blank.
4948* A physical link has failed -- check the cables between computer,
4949modem and phone line.
4950* The remote modem needs waking up--send a <cr> or failing that, a
4951ENQ (<ctrl>E), character.
4952* The remote modem is operating at a different speed. Some modems
4953can be brought up to speed by hitting successive <cr>s; they usually
4954begin at 110 baud and then go to 300,so two successive <cr>s should
4955do the trick.
4956* The remote modem is not working at V21 standards, either because
4957it is a different CCITT standard, e.g. V22, V22 bis, V23 etc or
4958operates on Bell (US) tones.
4959* Since different standards tend to have different 'wake-up' tones
4960which are easily recognised with practice, you may be able to spot
4961what is happening. It shouldn't need to be said that if you are
4962calling a North American service you should assume Bell tones.
4963* Both your modem and that of the remote service are in answer or in
4964originate and so cannot 'speak' to each other. Always assume you are
4965in the originate mode.
4966* The remote service is not using ASCII/International Alphabet No 5.
4967The screen fills with random characters
4968* Data format different from your defaults--check 7 or 8 bit
4969characters, even/odd parity, stop and start bits.
4970Hacker's Handbook
4971file:///E|/Books/Hackers Handbook.htm (105 of 133) [11/28/2000 5:58:50 AM]
4972* Mismatch of characters owing to misdefined protocol--check
4973start/stop, try alternately EOB/ACK and XON/XOF.
4974* Remote computer operating at a different speed from you-- try, in
4975order, 110, 300, 600, 1200, 75.
4976** Page 112
4977* Poor physical connection--if using an acoustic coupler check
4978location of handset, if not, listen on line to see if it is noisy or
4979crossed.
4980* The remote service is not using ASCII/International Alphabet No 5.
4981Every character appears twice
4982* You are actually in half-duplex mode and the remote computer as
4983well as your own are both sending characters to your screen--switch
4984to full-duplex/echo off.
4985All information appears on only one line, which is constantly
4986overwritten.
4987* The remote service is not sending line feeds--if your terminal
4988software has the facility, enable it to induce line feeds when each
4989display line is filled. Many on-line services and public dial-up
4990ports let you configure the remote port to send line feeds and vary
4991line length. Your software may have a facility to show control
4992characters, in which case you will see <ctrl>J if the remote service
4993is sending line feeds.
4994Wide spaces appear between display lines.
4995* The remote service is sending line feeds and your software is
4996inducing another one simultaneously--turn off your induced carriage
4997return facility. In 'show control character' mode, you will see
4998<ctrl>Js.
4999Display lines are broken awkwardly
5000* The remote service is expecting your screen to support more
5001characters than it is able. Professional services tend to expect 80
5002characters across whilst many personal computers may have less than
500340, so that they can be read on a tv screen. Check if your software
5004can help, but you may have to live with it. Alternatively, the
5005remote computer may let you reconfigure its character stream.
5006Most of the display makes sense, but every so often it becomes
5007garbled
5008Hacker's Handbook
5009file:///E|/Books/Hackers Handbook.htm (106 of 133) [11/28/2000 5:58:50 AM]
5010* You have intermittent line noise--check if you can command the
5011remote computer to send the same stream again and see if you get the
5012garbling.
5013* The remote service is sending graphics instructions which your
5014computer and software can't resolve.
5015** Page 113
5016The display contains recognisable characters in definite groupings,
5017but otherwise makes no sense The data is intended for an intelligent
5018terminal, which will combine the transmitted data with a local
5019program so that it makes sense.
5020* The data is intended for batch processing.
5021* The data is encrypted Although the stream of data appeared
5022properly on your vdu, when you try to print it out, you get
5023corruption and over-printing
5024* Most printers use a series of special control characters to enable
5025various functions--line feeds, back-space, double- intensity, special
5026graphics etc. The remote service is sending a series of control
5027characters which, though not displayed on your screen, are
5028'recognised' by your printer, though often in not very helpful ways.
5029You may be able to correct the worst problems in software, e.g. by
5030enabling line-feeds; alternatively many printers can be re-configured
5031in hardware by appropriate settings of DIL switches internally.
5032When accessing a viewdata service, the screen fills with squares.
5033* The square is the standard display default if your viewdata
5034terminal can't make sense of the data being sent to it.
5035* Check physical connections and listen for line noise.
5036* The viewdata host does not work to UK viewdata standards-- French
5037viewdata uses parallel attributes and has a number of extra features.
5038The CEPT standard for Europe contains features from both the UK and
5039French systems and you may be able to recognise some of the display.
5040North American videotex is alpha-geometric and sends line drawing
5041instructions rather than characters.
5042* The viewdata host has enhanced graphics features, perhaps for
5043dynamically redefined character sets, alphageometric instructions, or
5044alpha-photographic (full resolution) pictures. If the host has some
5045UK standard-compatible features, you will be able to read them
5046normally. If the cursor jumps about the screen, the host has dynamic
5047graphics facilities. If the viewdata protocol is anything at all like
5048the UK standard, you should see regular clear-screens as each new
5049page comes up; however, advanced graphics features tend to work by
5050suppressing clear-screens.
5051** Page 114
5052Hacker's Handbook
5053file:///E|/Books/Hackers Handbook.htm (107 of 133) [11/28/2000 5:58:50 AM]
5054* The service you have dialled is not using viewdata. PSS is
5055accessible at 75/1200, as are one or two direct-dial services. In
5056this case you should be seeing a conventional display or trying one
5057of the other suggestions in this appendix. It is usual to assume that
5058any subscriber dialling into a 75/1200 port has only a 40 character
5059display.
5060You can't see what you are typing
5061* The remote computer is not echoing back to you--switch to
5062half-duplex. If the remote computer's messages now appear doubled;
5063that would be unusual but not unique; you will have to toggle back to
5064full-duplex for receive.
5065Data seems to come from the remote computer in jerky bursts rather
5066than as a smooth stream.
5067* If you are using PSS or a similar packet-switched service and it
5068is near peak business hours either in your time zone or in that of
5069the host you are accessing, the effect is due to heavy packet
5070traffic. There is nothing you can do--do not send extra commands to
5071'speed things up' as those commands will arrive at the host
5072eventually and cause unexpected results.
5073* The host is pausing for a EOB/ACK or XON/XOF message-- check your
5074protocol settings--try sending ctrl-Q or ctrl-F.
5075You have an apparently valid password but it is not accepted.
5076* You don't have a valid password, or you don't have all of it.
5077* The password has hidden control characters which don't display on
5078the screen. Watch out for <ctrl>H -- the back-space, which will
5079over-write an existing displayed character.
5080* The password contains characters which your computer doesn't
5081normally generate--check your terminal software and see if there is a
5082way of sending them.
5083Most of the time everything works smoothly, but you can't get past
5084certain prompts
5085* The remote service is looking for characters your computer doesn't
5086normally generate. Check your terminal software and see if there is a
5087way of sending them.
5088A list or file called up turns out to be boring--can you stop it?
5089* Try sending <ctrl>S; this may simply make the remote machine
5090Hacker's Handbook
5091file:///E|/Books/Hackers Handbook.htm (108 of 133) [11/28/2000 5:58:50 AM]
5092pause, until a <ctrl>Q is sent--and you may find the list resumes
5093where it left off. On the other hand it may take you on to a menu.
5094* Send a BREAK signal (<ctrl>1). If one BREAK doesn't work, send
5095another in quick succession.
5096** Page 115
5097You wish to get into the operating system from an applications
5098program.
5099* Don't we all? There is no standard way of doing this, and indeed
5100it might be almost impossible, because the operating system can only
5101be addressed by a few privileged terminals, of which yours (and its
5102associated password) is not one. However, you could try the
5103following:
5104* Immediately after signing on, send two BREAKs (<ctrl>1).
5105* Immediately after signing on, try combinations of ESC, CTRL and
5106SHIFT. As a desperate measure, send two line feeds before signing
5107on--this has been known to work!.
5108* At an options page, try requesting SYSTEM or some obvious
5109contraction like SYS or X. If in the Basic language, depending on the
5110dialect, SYSTEM or X in immediate mode should get you the operating
5111system.
5112You are trying to capture data traffic from a short-wave radio and are having
5113little success
5114* Your computer could be emitting so much radio noise itself that
5115any signal you are attempting to hear is squashed. To test: tune your
5116radio to a fairly quiet short-wave broadcast and then experiment
5117listening to the background hash with the computer switched first
5118on, then off. If the noise level drops when you turn off the
5119computer, then you need to arrange for more rf suppression and to
5120move the computer and radio further apart. Another source of rf noise
5121is the sync scan in a tv tube.
5122* If you can hear the two-tones of rtty traffic but can't get
5123letters resolved, check that your terminal unit is locking on to the
5124signal (often indicated by LEDs); you should then at least get some
5125response on your screen, if it doesn't make immediate sense.
5126* Once you have letters on screen, try altering the speed at which
5127you are receiving (see chapter 10); check also that you are reading
5128in the right 'sense', ie that mark and space have not been reversed.
5129* In addition to signals sent with the conventional International
5130Telegraphic Code No 2 (Baudot), variants exist for foreign letter
5131sets, like Cyrillic, which your software may not be able to resolve.
5132* There are other data-type services which sound a little like RTTY,
5133Hacker's Handbook
5134file:///E|/Books/Hackers Handbook.htm (109 of 133) [11/28/2000 5:58:50 AM]
5135but are not: they include FAX (facsimile) hellschreiber ( a form of
5136remote dot-matrix printing), SITOR (see chapter 10) and special
5137military/diplomatic systems.
5138** Page 116
5139APPENDIX II
5140Glossary
5141This glossary collects together the sort of name, word, abbreviation
5142phrase you could come across during your network adventures
5143and for which you may not be able to find a precise definition
5144ACK
5145Non--printing character used in some comms protocols to indicate that
5146a block has been received and that more can be sent; used in
5147association with EOB.
5148ANSI
5149American National Standards Institute--one of a number of standards
5150organizations.
5151Answer mode
5152When a modem is set up to receive calls--the usual mode for a host.
5153The user's computer will be in originate.
5154ARQ
5155Automatic Repeat Request--method of error correction.
5156ASCII
5157American Standard Code for Information Interchange--alternate name
5158for International Telegraph Alphabet No 5: 7-bit code to symbolise
5159common characters and comms instructions, usually transmitted as
51608-bit code to include a parity bit.
5161ASR
5162Automatic Send Receive--any keyboard terminal capable of generating a
5163message into off-line storage for later transmission; includes
5164paper-tape telex machines as well as microcomputers.
5165Asynchronous
5166Description of communications which rely on 'start' and 'stop' bits
5167to synchronise originator and receiver of data--hence asynchrnous
5168protocols, channels, modems, terminals etc.
5169** Page 117
5170Backward channel
5171Supervisory channel, not used as main channel of communication; in
5172viewdata the 75 baud back from the user to the host.
5173Hacker's Handbook
5174file:///E|/Books/Hackers Handbook.htm (110 of 133) [11/28/2000 5:58:50 AM]
5175Baud
5176Measure of the signalling rate on a data channel, number of
5177signalling elements per second.
5178Baseband
5179Modulation is direct on the comms line rather than using audio or
5180radio frequencies; used in some local area networks. A baseband or
5181'short-haul' modem can be used to link computers in adjacent offices,
5182but not over telephone lines.
5183Baudot
51845-bit data code used in telegraphy, telex and RTTY--also known as
5185International Telegraph Alphabet No 2.
5186Bell
5187(1) non-printing character which sounds a bell or bleep, usually
5188enabled by <ctrl> G; (2) Common name for US phone company and, in
5189this context, specifiers for a number of data standards and services,
5190e.g. Bell 103a, 202a, 212a, etc--see Appendix V
5191Bit Binary digit
5192value 0 or 1.
5193Broadband
5194Broadband data channels have a wider bandwidth than ordinary
5195telephone circuits--12 times in fact, to give a bandwidth of 48kHz,
5196over which may simultaneous high-speed data transfers can take place.
5197Broadcast service
5198Data service in which all users receive the same information
5199simultaneously, without the opportunity to interrogate or query;
5200e.g. news services like AP, Reuters News, UPI etc. See also on-line
5201service.
5202Bisynchronous
5203IBM protocol involving synchronous transmission of binary coded data.
5204** Page 118
5205BLAISE
5206British Library Automated Information Service-- substantial
5207bibliographic on-line host.
5208BREAK
5209Non-printing character used in some data transmission protocols and
5210found on some terminals--can often be regenerated by using <ctrl> 1.
5211BSC
5212Binary Synchronous Communications--see bisynchronous.
5213I Byte
5214Group of bits (8) representing one data character.
5215Call accept
5216In packet-switching, the packet that confirms the party is willing to
5217Hacker's Handbook
5218file:///E|/Books/Hackers Handbook.htm (111 of 133) [11/28/2000 5:58:50 AM]
5219proceed with the call.
5220Call redirection
5221In packet-switching, allows call to be automatically redirected from
5222original address to another, nominated address.
5223Call request
5224In packet-switching, packet sent to initiate a datacall.
5225CCITT
5226Comite Consultatif International Telephonique et Telegraphique
5227--committee of International Telecommunications Union which sets
5228international comms standards. Only the US fails to follow its
5229recommendations in terms of modem tones, preferring 'Bell' tones. The
5230CCITT also sets such standards as V21, 24, X25 etc.
5231Character terminal
5232In packet-switching, a terminal which can only access via a PAD.
5233Cluster
5234When two or more terminals are connected to a data channel at a
5235single point.
5236Common Carrier
5237A telecommunications resource providing facilities to the public.
5238** Page 119
5239Connect-time
5240Length of time connected to a remote computer, often the measure of
5241payment. Contrast with cpu time or cpu units, which measures how
5242much 'effort' the host put into the communication.
5243CPS
5244Characters Per Second.
5245Cpu Time
5246In an on-line session, the amount of time the central processor
5247actually spends on the interaction process, as opposed to connect-
5248time; either can be used as the basis of tariffing.
5249CRC
5250Cyclic Redundancy Check--error detection method.
5251CUG
5252Closed User Group--group of users/terminals who enjoy privacy with
5253respect to a public service.
5254Datacall
5255In packet-switching, an ordinary call, sometimes called a 'switched
5256virtual call'.
5257Dataline
5258In packet-switching, dedicated line between customer's terminal and
5259packet-switch exchange (PSE).
5260Hacker's Handbook
5261file:///E|/Books/Hackers Handbook.htm (112 of 133) [11/28/2000 5:58:50 AM]
5262DCE
5263Data Circuit-terminating Equipment--officialese for modems.
5264DTE
5265Data Terminal Equipment--officialese for computers.
5266EBCDIC
5267Extended Binary Coded Decimal Interchange Code--IBM's alternative to
5268ASCII, based on an 8-bit code, usually transmitted synchronously. 256
5269characters are available.
5270Emulator
5271Software/hardware set-up which makes one device mimic another, e.g. a
5272personal computer may emulate an industry-standard dumb terminal like
5273the VT100. Compare simulator, which gives a device the attributes of
5274another, but not necessarily in real time, e.g. when a large mini
5275carries a program making it simulate another computer to develop
5276software.
5277** Page 120
5278Euronet-Diane
5279European direct access information network.
5280Datel
5281BT's name for its data services, covering both the equipment and the
5282type of line, e.g. Datel 100 corresponds to telegraph circuits, Datel
5283200 is the usual 300/300 asynchronous service, Datel 400 is for
5284one-way transmissions e.g. monitoring of remote sites, Datel 600 is
5285a two- or four-wire asynchronous service at up to 1200 baud, Datel
52862400 typically uses a 4-wire private circuit at 2400 baud
5287synchronous, etc. etc.
5288DES
5289Data Encryption Standard--a US-approved method of encrypt- ing data
5290traffic, and somewhat controversial in its effectiveness.
5291Dialog
5292Well-established on-line host available world-wide covering an
5293extensive range of scientific, bibiographic and news services. Also
5294known as Lockheed Dialog.
5295Dial-up
5296Call initiated via PTSN, no matter where it goes after that; as
5297opposed to service available via permanent leased line.
5298Duplex
5299Transmission in two directions simultaneously, sometimes called
5300full-duplex; contrast half-duplex, in which alternate transmissions
5301by either end are required. NB this is terminology used in data
5302communications over land-lines. Just to confuse matters, radio
5303technology refers to simplex, when only one party can transmit at a
5304time and a single radio frequency is used; two-frequency-simplex or
5305half-duplex when only one party can speak but two frequencies are
5306Hacker's Handbook
5307file:///E|/Books/Hackers Handbook.htm (113 of 133) [11/28/2000 5:58:50 AM]
5308used, as in repeater and remote base working; and full-duplex, when
5309both parties can speak simultaneously and two radio frequencies are
5310used, as in radio-telephones.
5311Echo
5312(1) When a remote computer sends back to the terminal each letter as
5313it is sent to it for confirming re-display locally. (2) Effect on
5314long comms lines caused by successive amplifications
5315--echo-suppressors are introduced to prevent disturbance caused by
5316this phenomenon, but in some data transmission the echo- suppressors
5317must be switched off.
5318** Page 121
5319EIA
5320Electronic Industries Association, US standards body.
5321ENQ
5322Non-printing character signifying 'who are you?' and often sent by
5323hosts as they are dialled up. When the user's terminal receives ENQ
5324it may be programmed to send out a password automatically.
5325Corresponds to <esc> E.
5326EOB
5327End Of Block--non-printing character used in some protocols, usually
5328in association with ACK.
5329Equalisation
5330Method of compensation for distortion over long comms channels.
5331FDM
5332Frequency Division Multiplexing--a wide bandwidth transmission
5333medium, e.g. coaxial cable, supports several narrow band- width
5334channels by differentiating by frequency; compare time division
5335multiplexing.
5336FSK
5337Frequency Shift Keying--a simple signalling method in which
5338frequencies but not phase or amplitude are varied according to
5339whether '1' or '0' is sent--used in low-speed asynchronous comms both
5340over land-line and by radio.
5341Handshaking
5342Hardware and software rules for remote devices to communicate with
5343each other, supervisory signals such as 'wait', 'acknowledge',
5344'transmit', 'ready to receive' etc.
5345HDLC
5346In packet-switching, High Level Data Link Control procedure, an
5347international standard which detects and corrects errors in the
5348stream of data between the terminal and the exchange--and to provide
5349flow control. Host The 'big' computer holding the information the
5350user wishes to retrieve.
5351** Page 122
5352Hacker's Handbook
5353file:///E|/Books/Hackers Handbook.htm (114 of 133) [11/28/2000 5:58:50 AM]
5354Infoline
5355Scientific on-line service from Pergamon.
5356ISB
5357see sideband.
5358ISO
5359International Standards Organisation.
5360LAN
5361Local Area Network--normally using coaxial cable, this form of
5362network operates at high speed over an office or works site, but no
5363further. May have inter-connect facility to PTSN or PSS.
5364LF
5365Line Feed--cursor moves active position down one line--usual code is
5366<ctrl>J; not the same as carriage return, which merely sends cursor
5367to left-hand side of line it already occupies. However, in many
5368protocols/terminals/set-ups, hitting the <ret> or <enter> button
5369means both <lf> and <cr>.
5370Logical Channel
5371Apparently continuous path from one terminal to another.
5372LSB
5373see sideband.
5374KSR
5375Keyboard Send Receive--terminal with keyboard on which anything that
5376is typed is immediately sent. No off-line preparation facility, e.g.
5377teletypewriter, 'dumb' terminals.
5378Macro software
5379Facility frequently found in comms programs which permits the
5380preparation and sending of commonly-used strings of information,
5381particularly passwords and routing instructions.
5382Mark
5383One of the two conditions on a data communications line, the other
5384being 'space'; mark indicates 'idle' and is used as a stop bit.
5385** Page 123
5386Message switching
5387When a complete message is stored and then forwarded, as opposed to a
5388packet of information. This technique is used in some electronic mail
5389services, but not for general data transmission.
5390Modem
5391Modulator-demodulator.
5392Multiplexer
5393Device which divides a data channel into two or more independent
5394channels .
5395Hacker's Handbook
5396file:///E|/Books/Hackers Handbook.htm (115 of 133) [11/28/2000 5:58:50 AM]
5397MVS
5398Multiple Virtual Storage--IBM operating system dating from mid-70s.
5399NUA
5400Network User Address, number by which each terminal on a
5401packet-switch network is identified (character terminals don't have
5402them individually, because they use a PAD). In PSS, it's a 10-digit
5403number.
5404NUI
5405Network User Identity, used in PSS for dial-up access by each user.
5406Octet
5407In packet-switching, 8 consecutive bits of user data, e.g. 1
5408character.
5409On-line service
5410Interrogative or query service available for dial-up. Examples
5411include Lockheed Dialog, Blaise, Dow Jones News Retrieval, etc;
5412leased-line examples include Reuters Monitor, Telerate.
5413Originate
5414Mode-setting for a modem operated by a user about to call another
5415computer.
5416OSI
5417Open Systems Interconnect--intended world standard for digital
5418network connections--c.f. SNA. Packet terminal Terminal capable of
5419creating and disassembling packets, interacting with a
5420packet-network, c.f. character terminal.
5421** Page 124
5422PAD
5423Packet Assembly/disassembly Device--permits 'ordinary' terminals to
5424connect to packet switch services by providing addressing, headers,
5425(and removal), protocol conversion etc.
5426Parity checking
5427Technique of error correction in which one bit is added to each data
5428character so that the number of bits is always even (or always odd).
5429PDP/8 & /11
5430Large family of minis, commercially very sucessful, made by DEC. the
5431PDP 8 was 12-bit, the PDP 11 is 16-bit. The LSI 11 have strong family
5432connections to the PDP 11, as have some configurations of the
5433desk-top Rainbow.
5434Polling
5435Method of controlling terminals on a clustered data network, where
5436each is called in turn by the computer to see if it wishes to
5437transmit or receive.
5438Protocol
5439Hacker's Handbook
5440file:///E|/Books/Hackers Handbook.htm (116 of 133) [11/28/2000 5:58:50 AM]
5441Agreed set of rules.
5442PSE
5443Packet Switch Exchange--enables packet switching in a network.
5444PTSN
5445Public Switched Telephone Network--the voice-grade telephone network
5446dialled from a phone. Contrast with leased lines, digital networks,
5447conditioned lines etc.
5448PTT
5449jargon for the publicly-owned telecommunications authority/ utility
5450PVC
5451Permanent Virtual Circuit--a connection in packet switching which is
5452always open, no set-up required.
5453** Page 125
5454Redundancy checking
5455Method of error correction.
5456RS232C
5457The list of definitions for interchange circuit: the US term for
5458CCITT V24--see Appendix III.
5459RSX-ll
5460Popular operating system for PDP/11 family.
5461RTTY
5462Radio Teletype -- method of sending telegraphy over radio waves.
5463RUBOUT
5464Back-space deleting character, using <ctrl>H.
5465Secondary channel
5466Data channel, usually used for supervision, using same physical path
5467as main channel; in V23 which is usually 600 or 1200 baud
5468half-duplex, 75 baud traffic is supervisory but in viewdata is the
5469channel back from the user to the host, thus giving low-cost full
5470duplex.
5471Segment
5472Chargeable unit of volume on PSS.
5473Serial transmission
5474One bit at a time, using a single pair of wires, as opposed to
5475parallel transmission, in which several bits are sent simultaneously
5476over a ribbon cable. A serial interface often uses many more than two
5477wires between computer and modem or computer and printer, but only
5478two wires carry the data traffic, the remainder being used for
5479supervision, electrical power and earthing, or not at all.
5480Sideband
5481In radio the technique of suppressing the main carrier and limiting
5482Hacker's Handbook
5483file:///E|/Books/Hackers Handbook.htm (117 of 133) [11/28/2000 5:58:50 AM]
5484the transmission to the information-bearing sideband. To listen at
5485the receiver, the carrier is re-created locally. The technique, which
5486produces large economies in channel occupany, is extensively used in
5487professional, non-broadcast applications. The full name is single
5488side-band, supressed carrier. Each full carrier supports two
5489sidebands, an upper and lower, USB and LSB respectively; in general,
5490USB is used for speech, LSB for data, but this is only a
5491convention--amateurs used LSB for speech below 10 MHz, for example.
5492ISB, independent side-band, is when the one carrier supports two
5493sidebands with separate information on them, usually speech on one
5494and data on the other. If you listen to radio teletype on the 'wrong'
5495sideband, 'mark' and 'space' values become reversed with a consequent
5496loss of meaning.
5497** Page 126
5498SITOR
5499Error-correction protocol for sending data over radio-path using
5500frequent checks and acknowledgements.
5501SNA
5502System Network Architecture-- IBM proprietary networking protocol,
5503the rival to OSI.
5504Space
5505One of two binary conditions in a data transmission channel, the
5506other being 'mark'. Space is binary 0.
5507Spooling
5508Simultaneous Peripheral Operation On-Line--more usually, the ability,
5509while accessing a database, to store all fetched information in a
5510local memory buffer, from which it may be recalled for later
5511examination, or dumped to disc or printer.
5512Start/Stop
5513Asynchronous transmission; the 'start' and 'stop' bits bracket each
5514data character.
5515Statistical Multiplexer
5516A statmux is an advanced multiplexer which divides one physical link
5517between several data channels, taking advantage of the fact that not
5518all channels bear equal traffic loads.
5519STX
5520Start Text--non-printing character used in some protocols.
5521SVC
5522Switched Virtual Circuit--in packet switching, when connection
5523between two computers or computer and terminal must be set up by a
5524specific call.
5525** Page 127
5526SYN
5527Non-printing character often used in synchronous transmission to tell
5528Hacker's Handbook
5529file:///E|/Books/Hackers Handbook.htm (118 of 133) [11/28/2000 5:58:50 AM]
5530a remote device to start its local timing mechanism.
5531Synchronous
5532Data transmission in which timing information is super-imposed ~,n
5533pure data. Under this method 'start/stop' techniques are not used
5534and data exchange is more efficient, hence synchronous channel,
5535modem, terminal, protocol etc.
5536TDM
5537Time Division Multiplex--technique for sharing several data channels
5538along one high-grade physical link. Not as efficient as statistical
5539techniques.
5540Telenet
5541US packet-switch common carrier.
5542Teletex
5543High-speed replacement for telex, as yet to find much commercial
5544support.
5545Teletext
5546Use of vertical blanking interval in broadcast television to transmit
5547magazines of text information, e.g. BBC's Ceefax and IBA's Oracle.
5548Telex
5549Public switched low-speed telegraph network.
5550TOPIC
5551The Stock Exchange's market price display service; it comes down a
5552leased line and has some of the qualities of both viewdata and
5553teletext.
5554Tymnet
5555US packet-switch common carrier.
5556V-standards
5557Set of recommendations by CCITT--see Appendix III.
5558VAX
5559Super-mini family made by DEC; often uses Unix operating system.
5560** Page 128
5561Viewdata
5562Technology allowing large numbers of users to access data easily on
5563terminal based (originally) on modified tv sets. Information is
5564presented in 'page' format rather than on a scrolling screen and the
5565user issues all commands on a numbers-only keypad. Various standards
5566exist of which the UK one is so far dominant; others include the
5567European CEPT standard which is similar to the UK one, a French
5568version and the US Presentation Level Protocol. Transmission speeds
5569are usually 1200 baud from the host and 75 baud from the user.
5570Viewdata together with teletext is known jointly as videotex(t).
5571Virtual
5572Hacker's Handbook
5573file:///E|/Books/Hackers Handbook.htm (119 of 133) [11/28/2000 5:58:50 AM]
5574In the present context, a virtual drive, store, machine etc is one
5575which appears to the user to exist, but is merely an illusion
5576generated on a computer; thus several users of IBM's VM operating
5577system each think they have an entire separate computer, complete
5578with drives, discs and other peripherals--in fact the one actual
5579machine can support several lower-level operating systems
5580simultaneously.
5581VT52/100
5582Industry-standard general purpose computer terminals with no storage
5583capacity or processing power but with the ability to be locally
5584programmed to accept a variety of asynchronous transmission
5585protocols--manufactured by DEC. The series has developed since the
5586VT100
5587X-standards
5588Set of recommendations by CCITT--see Appendix III.
5589XON/XOF
5590Pair of non-printing characters sometimes used in protocols to tell
5591devices when to start or stop sending. XON often corresponds to
5592<ctrl>Q and XOF to <ctrl>S.
559380-80
5594Type of circuit used for telex and telegraphy--mark and space are
5595indicated by conditions of--or + 80 volts. Also known in the UK as
5596Tariff J. Usual telex speed is 50 baud, private wire telegraphy (news
5597agencies etc) 75 baud.
5598** Page 129
5599APPENDIX III
5600Selected CCITT Recommendations
5601V series: Data transmission over telephone circuits
5602V1 Power levels for data transmission over telephone lines
5603V3 International Alphabet No S (ASCII)
5604V4 General structure of signals of IA5 code for data
5605transmission over public telephone network
5606V5 Standardisation of modulation rates and data signalling
5607rates for synchronous transmission in general switched
5608network
5609V6 Ditto, on leased circuits
5610V13 Answerback simulator
5611V15 Use of acoustic coupling for data transmission
5612V19 Modems for parallel data transmission using telephone
5613signalling frequencies
5614V20 Parallel data transmission modems standardised for
5615universal use in the general switched telephone network
5616V21 200 baud modem standardised
5617V22 1200 bps full-duplex 2-wire modem for PTSN
5618V22bis 2400 bps full-duplex 2-wire modem for PTSN
5619Hacker's Handbook
5620file:///E|/Books/Hackers Handbook.htm (120 of 133) [11/28/2000 5:58:50 AM]
5621V23 600/1200 bps modem for PTSN
5622V24 List of definitions for interchange circuits between data
5623terminal equipment and data circuit-terminating equipment
5624V25 Automatic calling and/or answering equipment on PTSN
5625V26 2400 bps modem on 4-wire circuit
5626V26bis 2400/1200 bps modem for PTSN
5627V27 4800 bps modem for leased circuits
5628V27bis 4800 bps modem (equalised) for leased circuits
5629V27 4800 bps modem for PTSN
5630V29 9600 bps modem for leased circuits
5631V35 Data transmission at 48 kbits/sec using 60-108 kHz band
5632circuits
5633** Page 130
5634X series: recommendations covering data networks
5635X1 International user classes of services in public data networks
5636X2 International user facilities in public data networks
5637X3 Packet assembly/disassembly facility (PAD)
5638X4 General structure of signals of IA5 code for transmission
5639over public data networks
5640X20 Interface between data terminal equipment and data
5641circuit-terminating equipment for start-stop transmission
5642services on public data networks
5643X20bis V21-compatible interface
5644X21 Interface for synchronous operation
5645X25 Interface between data terminal equipment and data
5646circuit-terminating equipment for terminals operating in
5647the packet-switch mode on public data networks
5648X28 DTE/DCE interface for start/stop mode terminal equipment
5649accessing a PAD on a public data network
5650X29 Procedures for exchange of control information and user
5651data between a packet mode DTE and a PAD
5652X95 Network parameters in public data networks
5653X96 Call progress signals in public data networks
5654X121 International addressing scheme for PDNs
5655** Page 131
5656APPENDIX IV
5657Computer Alphabets
5658Four alphabets are in common use for computer communications:
5659ASCII, also known as International Telegraphic Alphabet No 5; Baudot,
5660used in telex and also known as International Telegraphic Alphabet No
56612; UK Standard videotex, a variant of ASCII; and EDCDIC, used by IBM.
5662ASCII
5663This is the standard, fully implemented character set. There are a
5664number of national variants: # in the US variant is £ in the UK
5665variant. Many micro keyboards cannot generate all the characters
5666Hacker's Handbook
5667file:///E|/Books/Hackers Handbook.htm (121 of 133) [11/28/2000 5:58:50 AM]
5668directly, particularly the non-printing characters used for control
5669of transmission, effectors of format and information separators. The
5670'keyboard' column gives the usual method of providing them, but you
5671should check the firmware/software manuals for your particular
5672set-up. You should also know that many of the 'spare' control
5673characters are often used to enable special features on printers.
5674HEX DEC ASCII Name Keyboard Notes
567500 0 NUL Null ctrl @
567601 1 SOH Start heading ctrl A
567702 2 STX Start text ctrl B
567803 3 ETX End text ctrl C
567904 4 EOT End transmission ctrl D
568005 5 ENQ Enquire ctrl E
568106 6 ACK Acknowledge ctrl F
568207 7 BEL Bell ctrl G
568308 8 BS Backspace ctrl H or special key
568409 9 HT Horizontal tab ctrl I or special key
5685OA 10 LF Line feed ctrl J
5686OB 11 VT Vertical tab ctrl K
56870C 12 FF Form feed ctrl L
5688** Page 132
5689OD 13 CR Carriage return ctrl M or special key
5690OE 14 SO Shift out ctrl N
5691OF 15 Sl Shift in ctrl O
569210 16 DLE Data link escape ctrl P
569311 17 DC1 Device control 1 ctrl Q also XON
569412 18 DC2 Device control 2 ctrl R
569513 19 DC3 Device control 3 ctrl S also XOF
569614 20 DC4 Device control 4 ctrl T
569715 21 NAK Negative acknowledge ctrl U
569816 22 SYN Synchronous Idle ctrl V
569917 23 ETB End trans. block ctrl W
570018 24 CAN Cancel ctrl X
570119 25 EM End medium ctrl Y
57021A 26 SS Special sequence ctrl Z spare
57031B 27 ESC Escape check manuals to
5704transmit
57051C 28 FS File separator
57061D 29 GS Group separator
57071E 30 RS Record separator
57081F 31 US Unit separator
570920 32 SP Space
571021 33 ~
571122 34 "
571223 35 # £
571324 36 $
571425 37 %
571526 38 &
571627 39 ' Apostrophe
571728 40 (
571829 41 )
5719Hacker's Handbook
5720file:///E|/Books/Hackers Handbook.htm (122 of 133) [11/28/2000 5:58:50 AM]
57212A 42 ~
57222B 43 +
57232C 44 , Comma
57242D 45 -
57252E 46 . Period
57262F 47 / Slash
572730 48 0
572831 49 1
572932 50 2
573033 51 3
573134 52 4
573235 53 5
573336 54 6
573437 55 7
5735** Page 133
573638 56 8
573739 57 9
57383A 58 : Colon
57393B 59 ; Semicolon
57403C 60 <
57413D 61
57423E 62 >
57433F 63 ?
574440 64 @
574541 65 A
574642 66 B
574743 67 C
574844 68 D
574945 69 E
575046 70 F
575147 71 G
575248 72 H
575349 73 1
57544A 74 J
57554B 75 K
57564C 76 L
57574D 77 M
57584E 78 N
57594F 79 O
576050 80 P
576151 81 Q
576252 82 R
576353 83 S
576454 84 T
576555 85 U
576656 86 V
576757 87 W
576858 88 X
576959 89 Y
57705A 90 Z
57715B 91 [
57725C 92 \ Backslash
57735D 93 1
5774Hacker's Handbook
5775file:///E|/Books/Hackers Handbook.htm (123 of 133) [11/28/2000 5:58:50 AM]
57765E 94 ^ Circumflex
57775F 95 _ Underscore
577860 96 Grave accent
577961 97 a
578062 98 b
5781** Page 134
578263 99 c
578364 100 d
578465 101 e
578566 102 f
578667 103 9
578768 104 h
578869 105 i
57896A 106 j
57906B 107 k
57916C 108 l
57926D 109 m
57936E 110 n
57946F 111 o
579570 112 p
579671 113 q
579772 114 r
579873 115 s
579974 116 t
580075 117 u
580176 118 v
580277 119 w
580378 120 x
580479 121 y
58057A 122 z
58067B 123 {
58077C 124
58087D 125 }
58097E 126 ~ Tilde
58107F 127 DEL Delete
5811Baudot
5812This is the telex/telegraphy code known to the CCITT as International
5813Alphabet No 2. It is essentially a 5-bit code, bracketed by a start
5814bit (space) and a stop bit (mark). Idling is shown by 'mark'. The
5815code only supports capital letters, figure and two 'supervisory'
5816codes: 'Bell' to warn the operator at the far end and 'WRU'--'Who are
5817you?' to interrogate the far end 'Figures' changes all characters
5818received after to their alternates and 'Letters' switches back. The
5819letters/figures shift is used to give the entire character set.
5820** Page 135
5821Viewdata
5822This is the character set used by the UK system, which is the most
5823widely used, world-wide. The character-set has many features in
5824common with ASCII but also departs from it in significant ways,
5825notably to provide various forms of graphics, colour controls,
5826Hacker's Handbook
5827file:///E|/Books/Hackers Handbook.htm (124 of 133) [11/28/2000 5:58:50 AM]
5828screen-clear (ctrl L) etc. The set is shared with teletext which in
5829itself requires further special codes, e.g. to enable sub-titling to
5830broadcast television, news flash etc. If you are using proper
5831viewdata software, then everything will display properly; if you are
5832using a conventional terminal emulator then the result may look
5833confusing. Each character consists of 10 bits:
5834Start binary 0
58357 bits of character code
5836Parity bit even
5837Stop binary 1
5838ENQ (Ctrl E) is sent by the host on log-on to initiate the
5839auto-log-on from the user's terminal. If no response is obtained, the
5840user is requested to input the password manually. Each new page
5841sequence opens with a clear screen instruction (Ctrl L, CHR$12)
5842followed by a home (Ctrl M, CHR$14).
5843Some viewdata services are also available via standard asynchronous
5844300/300 ports (Prestel is, for example); in these cases, the graphics
5845characters are stripped out and replaced by ****s; and the pages will
5846scroll up the screen rather than present themselves in the
5847frame-by-frame format.
5848** Page 136
5849*** Original contains a diagram of Viewdata Graphic Character Set.
5850** Page 137
5851If you wish to edit to a viewdata system using a normal keyboard,
5852or view a viewdata stream as it comes from a host using
5853'control-show' facilities, the table below gives the usual
5854equivalents. The normal default at the left-hand side of each line is
5855alphanumeric white. Each subsequent 'attribute', i.e. if you wish to
5856change to colour, or a variety of graphics, occupies a character
5857space. Routing commands and signals to start and end edit depend on
5858the software installed on the viewdata host computer: in Prestel
5859compatible systems, the edit page is *910#, options must be entered
5860in lower case letters and end edit is called by <esc>K.
5861esc A alpha red esc Q graphics red
5862esc B alpha green esc R graphics green
5863esc C alpha yellow esc S graphics yellow
5864esc D alpha blue esc T graphics blue
5865esc E alpha magenta esc U graphics magenta
5866esc F alpha cyan esc V graphics cyan
5867esc G alpha white esc W graphics white
5868esc H flash esc I steady
5869esc L normal height esc M double height
5870esc Y contiguous graphics esc Z separated graphics
5871esc ctrl D black background esc-shift M new background
5872(varies)
5873esc J start edit esc K end edit
5874Hacker's Handbook
5875file:///E|/Books/Hackers Handbook.htm (125 of 133) [11/28/2000 5:58:50 AM]
5876EBCDIC
5877The Extended Binary Coded Decimal Interchange Code is a 256-state
58788-bit extended binary coded digit code employed by IBM for internal
5879purposes and is the only important exception to ASCII. Not all 256
5880codes are utilised, being reserved for future expansion, and a number
5881are specially identified for application- specific purposes. In
5882transmission, it is usual to add a further digit for parity checking.
5883Normally the transmission mode is synchronous, so there are no
5884'start' and 'stop' bits. The table shows how EBCDIC compares with
5885ASCII of the same bit configuration.
5886** Page 138
5887IBM control characters:
5888EBCDIC bits Notes
5889NUL 0000 0000 Nul
5890SOH 0000 0001 Start of Heading
5891STX 0000 0010 Start of Text
5892ETX 0000 0011 End of Text
5893PF 0000 0100 Punch Off
5894HT 0000 0101 Horizontal Tab
5895LC 0000 0110 Lower Case
5896DEL 0000 0111 Delete
58970000 1000
5898RLF 0000 1001 Reverse Line Feed
5899SMM 0000 1010 Start of Manual Message
5900VT 0000 1011 Vertical Tab
5901FF 0000 1100 Form Feed
5902CR 0000 1101 Carriage Return
5903SO 0000 1110 Shift Out
5904Sl 0000 1111 Shift In
5905DLE 0001 0000 Data Link Exchange
5906DC1 0001 0001 Device Control 1
5907DC2 0001 0010 Device Control 2
5908TM 0001 0011 Tape Mark
5909RES 0001 0100 Restore
5910NL 0001 0101 New Line
5911BS 0001 0110 Back Space
5912IL 0001 0111 Idle
5913CAN 0001 1000 Cancel
5914EM 0001 1001 End of Medium
5915CC 0001 1010 Cursor Control
5916CU1 0001 1011 Customer Use 1
5917IFS 0001 1100 Interchange File Separator
5918IGS 0001 1101 Interchange Group Separator
5919IRS 0001 1110 Interchange Record Separator
5920IUS 0001 1111 Interchange Unit Separator
5921DS 0010 0000 Digit Select
5922SOS 0010 0001 Start of Significance
5923FS 0010 0010 Field Separator
59240010 0011
5925BYP 0010 0100 Bypass
5926Hacker's Handbook
5927file:///E|/Books/Hackers Handbook.htm (126 of 133) [11/28/2000 5:58:50 AM]
5928LF 0010 0101 Line Feed
5929ETB 0010 0110 End of Transmission Block
5930** Page 139
5931EBCDIC bits Notes
5932ESC 0010 0111 Escape
59330010 1000
59340010 1001
5935SM 0010 1010 Set Mode
5936CU2 0010 1011 Customer Use 1
59370010 1100
5938ENQ 0010 1101 Enquiry
5939ACK 0010 1110 Acknowledge
5940BEL 0010 1111 Bell
59410011 0000
59420011 0001
5943SYN 0011 0010 Synchronous Idle
59440011 0011
5945PN 0011 0100 Punch On
5946RS 0011 0101 Reader Stop
5947UC 0011 0110 Upper Case
5948EOT 0011 0111 End of Transmission
59490011 1000
59500011 1001
59510011 1010
5952CU3 0011 1011 Customer Use 3
5953DC4 0011 1100 Device Control 4
5954NAK 0011 1101 Negative Acknowledge
59550011 1110
5956SUB 0011 1111 Substitute
5957SP 0100 0000 Space
5958** Page 140
5959APPENDIX V
5960Modems and Services
5961The table below shows all but two of the types of service you are likely to
5962come across; V-designators are the world-wide 'official names given by the
5963CCITT; Bell-designators are the US names:
5964Service Speed Duplex Transmit Receive Answer
5965Designator 0 1 0 1
5966V21 orig 300(*) full 1180 980 1850 1650 -
5967V21 ans 300(*) full 1850 1650 1180 980 2100
5968V23 (1) 600 half 1700 1300 1700 1300 2100
5969V23 (2) 1200 f/h(**) 2100 1300 2100 1300 2100
5970V23 back 75 f/h(**) 450 390 450 390 -
5971Bell 103 orig 300(*) full 1070 1270 2025 2225 -
5972Hacker's Handbook
5973file:///E|/Books/Hackers Handbook.htm (127 of 133) [11/28/2000 5:58:50 AM]
5974Bell 103 ans 300(*) full 2025 2225 1070 1270 2225
5975Bell 202 1200 half 2200 1200 2200 1200 2025
5976(*)any speed up to 300 baud, can also include 75 and 110 baud
5977services
5978(**)service can either be half-duplex at 1200 baud or asymmetrical
5979full duplex, with 75 baud originate and 1200 baud receive (commonly
5980used as viewdata user) or 1200 transmit and 75 receive (viewdata
5981host)
5982The two exceptions are:
5983V22 1200 baud full duplex, two wire
5984Bell 212A The US equivalent
5985Both these services operate by detecting phase as well as tone.
5986British Telecom markets the UK services under the name of Datel as
5987follows--for simplicity The list covers only those services which use
5988the PTSN or are otherwise easily accessible--4-wire services, for
5989example are excluded.
5990** Page 141
5991Datel Speed Mode Remarks
5992100(H) 50 async Teleprinters, Baudot code
5993100(J) 75-110 async News services etc, Baudot code
599450 async Telex service, Baudot code
5995200 300 async full duplex, ASCII
5996400 600 Hz async out-station to in-station only
5997600 1200 async several versions exist--for 1200
5998half-duplex; 75/1200 for viewdata
5999users; 1200/75forviewdata hosts; and
6000a rare 600 variant. The 75 speed is
6001technically only for supervision but
6002gives asymetrical duplex
6003BT has supplied the following modems for the various services-- the
6004older ones are now available on the 'second-user' market:
6005Modem No Remarks
60061200 half-duplex--massive
60072 300 full-duplex--massive
600811 4800 synchronous--older type
600912 2400/1200 synchronous
601013 300 full-duplex--plinth type
601120(1) 1200 half-duplex--'shoe-box' style
6012(2) 1200/75 asymetrical duplex--'shoe-box' style
6013(3) 75/1200 asymetrical duplex--'shoe-box' style
601421 300 full-duplex--modern type
601522 1200 half-duplex--modern type
601624 4800 synchronous--modern type (made by Racal)
601727A 1200 full duplex, sync or async (US made &
6018modified from Bell 212A to CCITT tones)
6019Hacker's Handbook
6020file:///E|/Books/Hackers Handbook.htm (128 of 133) [11/28/2000 5:58:50 AM]
602127B 1200 full duplex, sync or async (UK made)
6022You should note that some commercial 1200/1200 full duplex modems
6023also contain firmware providing ARQ error correction protocols;
6024modems on both ends of the line must have the facilities, of course.
6025** Page 142
6026BT Line Connectors
6027Modems can be connected directly to the BT network ('hard- wired')
6028simply by identifying the pair that comes into the building. Normally
6029the pair you want are the two outer wires in a standard 4 x 2 BT
6030junction box. (The other wires are the 'return' or to support a
6031'ringing' circuit.)
6032A variety of plugs and sockets have been used by BT. Until
6033recently, the standard connector for a modem was a 4-ring jack, type
6034505, to go into a socket 95A. Prestel equipment was terminated into a
6035similar jack, this time with 5 rings, which went into a socket type
603696A. However, now all phones, modems, viewdata sets etc, are
6037terminated in the identical modular jack, type 600. The corresponding
6038sockets need special tools to insert the line cable into the
6039appropriate receptacles.
6040Whatever other inter-connections you see behind a socket, the two
6041wires of the twisted pair are the ones found in the centres of the
6042two banks of receptacles. North America also now uses a modular jack
6043and socket system, but not one which is physically compatible with UK
6044designs...did you expect otherwise?
6045** Page 143
6046APPENDIX VI
6047The Radio Spectrum
6048The table gives the allocation of the radio frequency spectrum up
604930 MHz. The bands in which radio-teletype and radio-data traffic are
6050most common are those allocated to 'fixed' services, but data traffic
6051is also found in the amateur and maritime bands.
6052LF,MF,HF, RADIO FREQUENCY SPECTRUM TABLE
60539 -- 14 Radionavigation
605414 -- 19.95 Fixed/Maritime mobile
605520 Standard Frequency & Time
605620.05 -- 70 Fixed & Maritime mobile
605770 -- 90 Fixed/Maritime mobile/Radionavigation
605890 -- 110 Radionavigation
6059Hacker's Handbook
6060file:///E|/Books/Hackers Handbook.htm (129 of 133) [11/28/2000 5:58:50 AM]
6061110 -- 130 Fixed/Maritime mobile/Radionavigation
6062130 -- 148.5 Maritime mobile/Fixed
6063148.5 -- 255 Broadcasting
6064255 -- 283.5 Broadcasting/Radionavigation(aero)
6065283.5 -- 315 Maritime/Aeronautical navigation
6066315 -- 325 Aeronautical radionavigation/Maritime
6067radiobeacons
6068325 -- 405 Aeronautical radionavigation
6069405 -- 415 Radionavigation (410 = DF)
6070415 -- 495 Aeronautical radionavigation/Maritime mobile
6071495 -- 505 Mobile (distress & calling) > 500:cw&rtty
6072505 -- 526.5 Maritime mobile/Aeronautical navigation
6073526.5 -- 1606.5 Broadcasting
60741606.5 -- 1625 Maritime mobile/Fixed/Land mobile
60751625 -- 1635 Radiolocation
60761635 -- 1800 Maritime mobile/Fixed/Land mobile
60771800 -- 1810 Radiolocation
60781810 -- 1850 Amateur
60791850 -- 2000 Fixed/Mobile
6080** Page 144
60812000 -- 2045 Fixed/Mobile
60822045 -- 2160 Maritime mobile/Fixed/Land mobile
60832160 -- 2170 Radiolocation
60842170 -- 2173.5 Maritime mobile
60852173.5 -- 2190.5 Mobile (distress & calling) >2182--voice
60862190.5 -- 2194 Maritime & Mobile
60872194 -- 2300 Fixed & Mobile
60882300 -- 2498 Fixed/Mobile/Broadcasting
60892498 -- 2502 Standard Frequency & Time
60902502 -- 2650 Maritime mobile/Maritime radionavigation
60912650 -- 2850 Fixed/Mobile
60922850 -- 3025 Aeronautical mobile (R)
60933025 -- 3155 Aeronautical mobile (OR)
60943155 -- 3200 Fixed/Mobile/Low power hearing aids
60953200 -- 3230 Fixed/Mobile/Broadcasting
60963230 -- 3400 Fixed/Mobile/Broadcasting
60973400 -- 3500 Aeronautical mobile (R)
60983500 -- 3800 Amateur/Fixed/Mobile
60993800 -- 3900 Fixed/Aeronautical mobile (OR)
61003900 -- 3930 Aeronautical mobile (OR)
61013930 -- 4000 Fixed/Broadcasting
61024000 -- 4063 Fixed/Maritime mobile
61034063 -- 4438 Maritime mobile
61044438 -- 4650 Fixed/Mobile
61054650 -- 4700 Aeronautical mobile (R)
61064700 -- 4750 Aeronautical mobile (OR)
61074750 -- 4850 Fixed/Aeronautical mobile (OR)/
6108Land mobile/Broadcasting
61094850 -- 4995 Fixed/Land mobile/Broadcasting
6110Hacker's Handbook
6111file:///E|/Books/Hackers Handbook.htm (130 of 133) [11/28/2000 5:58:50 AM]
61124995 -- 5005 Standard Frequency & Time
61135005 -- 5060 Fixed/Broadcasting
61145060 -- 5450 Fixed/Mobile
61155450 -- 5480 Fixed/Aeronautical mobile (OR)/Land mobile
61165480 -- 5680 Aeronautical mobile (R)
61175680 -- 5730 Aeronautical mobile (OR)
61185730 -- 5950 Fixed/Land mobile
61195950 -- 6200 Broadcasting
61206200 -- 6525 Maritime mobile
61216525 -- 6685 Aeronautical mobile (R)
61226685 -- 6765 Aeronautical mobile ~OR)
61236765 -- 6795 Fixed/lSM
61247000 -- 7100 Amateur
61257100 -- 7300 Broadcasting
61267300 -- 8100 Maritime mobile
6127** Page 145
61288100 -- 8195 Fixed/Maritime mobile
61298195 -- 8815 Maritime mobile
61308815 -- 8965 Aeronautical mobile (R)
61318965 -- 9040 Aeronautical mobile ~OR)
61329040 -- 9500 Fixed
61339500 -- 9900 Broadcasting
6134ggoo -- 9995 Fixed
61359995 -- 10005 Standard Frequency & Time
613610005 -- 10100 Aeronautical mobile (R)
613710100 -- 10150 Fixed/Amateur(sec)
613810150 -- 11175 Fixed
613911175 -- 11275 Aeronautical mobile (OR)
614011275 -- 11400 Aeronautical mobile (R)
614111400 -- 11650 Fixed
614211650 -- 12050 Broadcasting
61432050 -- 12230 Fixed
614412230 -- 13200 Maritime mobile
614513200 -- 13260 Aeronautical mobile (OR)
614613260 -- 13360 Aeronautical mobile (R)
614713360 -- 13410 Fixed/Radio Astronomy
614813410 -- 13600 Fixed
614913600 -- 13800 Broadcasting
615013800 -- 14000 Fixed
615114000 -- 14350 Amateur
615214350 -- 14990 Fixed
615314990 -- 15010 Standard Frequency & Time
615415010 -- 15100 Aeronautical mobile (OR)
615515100 -- 15600 Broadcasting
6156Hacker's Handbook
6157file:///E|/Books/Hackers Handbook.htm (131 of 133) [11/28/2000 5:58:50 AM]
615815600 -- 16360 Fixed
615916360 -- 17410 Maritime mobile
616017410 -- 17550 Fixed
616117550 -- 17900 Broadcasting
616217900 -- 17970 Aeronautical mobile (R)
616317970 -- 18030 Aeronautical mobile (OR)
616418030 -- 18052 Fixed
616518052 -- 18068 Fixed/Space Research
616618068 -- 18168 Amateur
616718168 -- 18780 Fixed
616818780 -- 18900 Maritime mobile
616918900 -- 19680 Fixed
6170** Page 146
617119680 -- 19800 Maritime mobile
617219800 -- 19990 Fixed
617319990 -- 20010 Standard Frequency & Time
617420010 -- 21000 Fixed
617521000 -- 21450 Amateur
617621450 -- 21850 Broadcasting
617721850 -- 21870 Fixed
617821870 -- 21924 Aeronautical fixed
617921924 -- 22000 Aeronautical (R)
618022000 -- 22855 Maritime mobile
618122855 -- 23200 Fixed
618223200 -- 23350 Aeronautical fixed & mobile (R)
618323350 -- 24000 Fixed/Mobile
618424000 -- 24890 Fixed/Land mobile
618524890 -- 24990 Amateur
618624990 -- 25010 Standard Frequency & Time
618725010 -- 25070 Fixed/Mobile
618825070 -- 25210 Maritime mobile
618925210 -- 25550 Fixed/Mobile
619025550 -- 25670 Radio Astronomy
619125670 -- 26100 Broadcasting
619226100 -- 26175 Maritime mobile
619326175 -- 27500 Fixed/Mobile (CB) (26.975-27.2835 ISM)
619427500 -- 28000 Meteorological aids/Fixed/Mobile (CB)
619528000 -- 29700 Amateur
619629700 -- 30005 Fixed/Mobile
6197Note: These allocations are as they apply in Europe, slight variations occur
6198in other regions of the globe.
6199** Page 147
6200APPENDIX VII
6201Port-finder Flowchart
6202Hacker's Handbook
6203file:///E|/Books/Hackers Handbook.htm (132 of 133) [11/28/2000 5:58:50 AM]
6204This flow-chart will enable owners of auto-diallers to carry out
6205an automatic search of a range of telephone numbers to determine
6206which of them have modems hanging off the back.
6207It's a flow-chart and not a program listing, because the whole
6208exercise is very hardware dependent: you will have to determine what
6209sort of instructions your auto-modem will accept, and in what form;
6210you must also see what sort of signals it can send back to your
6211computer so that your program can 'read' them.
6212You will also need to devise some ways of sensing the phone line,
6213whether it has been seized, whether you are getting 'ringing', if
6214there is an engaged tone, a voice, a number obtainable tone, or a
6215modem whistle. Line seizure detect, if not already available on your
6216modem, is simply a question of reading the phone line voltage; the
6217other conditions can be detected with simple tone decoder modules
6218based on the 567 chip.
6219The lines from these detectors should then be brought to a A/D
6220board which your computer software can scan and read.
6221** End of File
6222:-)
6223X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
6224Another file downloaded from: & the Temple of the Screaming Electron
6225NIRVANAnet(tm) HQ (510) 935-5845
6226! \ AREA CODE WILL BE (925) AS OF 03/98
6227-$- -------- *
6228! . / Raw Data for Raw Nerves
6229/_\ /-o-\ Information * Innuendo * Lies
6230(o..) | * Full access for first-time callers
6231+ |:| /^\ /~\ Thousands of text files * Multi-line Chat
6232! |:|/\ _| |____|:| We don't want to know who you are, where you
6233/^\ / O |/...\ /_-_\ live, or what your phone number is
6234|@ \_| @ /:::::|/|- : -| We are not Big Brother
6235| | | /~ |/| _ |
6236|____|/~ @ /~\ |/|_(_)_| Free Speech * Anonymous Access * User-Supported
6237/_______|_|_|/ To make a $10 donation call (900)443-4227 x145
6238X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
6239Hacker's Handbook
6240file:///E|/Books/Hackers Handbook.htm (133 of 133) [11/28/2000 5:58:50 AM]