💾 Archived View for gemini.spam.works › mirrors › textfiles › magazines › TOLMES › tns10 captured on 2022-06-12 at 14:45:11.

View Raw

More Information

-=-=-=-=-=-=-

#######################################
#                                     #
#                                     #
#     ========   =\    =   ======     #
#        ==      = \   =   =          #
#        ==      =  \  =   ======     #
#        ==      =   \ =        =     #
#        ==      =    \=   ======     #
#                                     #
#                                     #
#         <Tolmes News Service>       #
#         '''''''''''''''''''''       #
#                                     #
#                                     #
#  > Written by Dr. Hugo P. Tolmes <  #
#                                     #
#                                     #
#######################################


Issue Number: 10
Release Date: November 19, 1987


Most of this issue will detail with the events concerning the bust of Shadow
Hawk. First there will be an article that describes the bust. Here it is:


$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


TITLE: Youth is a Suspect in Theft of Software
FROM: The Chicago Tribune
DATE: September 17, 1987


     A 17-year-old North Side youth is under investigation by the U.S. Secret
Service and the U.S. attourney's office for allegedly breaking into AT&T
computers across the nation and stealing sophisticated software valued
in the thousands of dollars. The youth is also suspected of advertising AT&T's
security devices over a network in Texas that is used as a "bulletin
board" by computer enthusiasts. The sole purpose of the computer network in
Texas, known as "Phreak Class-2600" is  "to educate computer enthusiasts ... to
penetrate industrial and government sector computer systems," according to
a sworn affidavit filed in U.S. District Court by Assistant U.S. Atty.
William J. Cook.
     On Sept. 4, Secret Service agents carrying a search warrant raided the
home of the youth, identified as Herbert D. Zinn Jr., of 6211 N. Artersian Ave.
The agents confiscated computers and the software that was stolen during the
break-ins, according to a U.S. Atty. Anton R. Valukas. A sworn affidavit
filed in U.S. District Court by Secret Service Agent Patrick Convery said the
the youth, using the code-name "Shadow Hawk" is suspected of breaking into an
AT&T computer at NATO Maintenance and Supply Headquarters in Burlington, N.C.
and an AT&T computer at Robins Air Force Base, Georgia, during the last
five months.
     In addition, he also broke into AT&T computers at Bell Labs in
Naperville and New Jersey, according to the affidavit. Among the software
stolen during the break-ins was an artificial intelligence program that is
not yet on the market, the affidavit said. A single copy of the software is
valued at $5,000, but AT&T told the Secret Service that the program has an
estimated market value of $1 million.
     An analysis of long distance calls made from Zinn's telephone disclosed
that attempts also were made to gain access to computers at the accounts
payable department of the Washington Post newspaper, a hostpital in South
Bend, Ind.; and computers in Colombus, Ohio; Rye, N.Y., and Pipe Creek, Tex.,
according to the government.  Zinn's father, Herbert D. Zinn Sr., declined
to comment.
     However, the affidavit said, the elder Zinn had recently retired from an
auto radio installationfederal investigators
that Zinn's son was "a bright boy" whose father had bragged at work that
his son's interest in computers "had just taken off."
     "We consider this to be very serious," Valukas said. "We have said
from the beginning that we would take an aggressive stance in this area. We
are currently reviewing the matter and no charges have been filed." A
17-year-old is considered a juvenile under federal law. Valudas
characterized the software taken from NATO and the Air Force base as "low
level in terms of sensitivity."
     Kathyryn Clark, a spokesman for AT&T, said "I'm aware of it. Our
security systems alert us when there is this type of break. It's in the hands
of the U.S. attorney."
     Last June 6, Henry Kluepfel, an AT&T corporate security official tuned
into the Phreak Class-2600 and spotted messages from Shadow Hawk, the
affidavit said. Shadow Hawk braged in the messages that he had successfully
gained access to AT&T computer files and said he was interested in creating
some "Trojan horses" in the AT&T network.  A Trojan horse, in computer
lingo, is an unauthorized computer program placed into a computer.  Later
that month, another AT&T corporate security official spotted a statement
made by Shadow Hawk on another computer bulletin board in Chicago.
     In that message, Shadow Hawk provided the names, telephone numbers,
passwords and other critical information needed to gain access to
seven different AT&T computers, according to the affidavit. On July 7,
a computer break-in at the Bell Labs computer in Naperville was discovered
and a record of the intruder's telephone number was spotted on the
compromised computer, the affidavit said. Illinois Bell then began using a
device known as a dial number recorder to log all calls made from the
telephone number, the affidavit said.  From July 17 through July 19, the Zinn
computer gained access to the NATO computer by using and unauthorized
passowrd, according to the government.
     The Zinn computer transferred software packages valued at $21,000
from the NATO computer, the affidavit said. On July 23, the AT&T software
program with an estimated $1 million market value vanished from the Bell
Labs computer in New Jersey. And, on July 27, $3,000 worth of software was
taken from Bell Labs. On July 31, the Zinn computer, according to the
affidavit, entered an AT&T computer that was holding a software program
used by the regional Bell System companies to record telephone service
requirements for customers.
     That program, "if manipulated can give free telephone service and it can
be used to disrupt or halt telephone communications," the affidavit said.
On Aug. 1 and Aug. 3, 16 entries into the Naperville computer were made and
$40,000 worth of software used to support AT&T's electronic switching
system was stolen, according to the government.
     On Aug. 28, the Zinn computer broke into the AT&T computer at Robins
Air Force Base and stole software that was used to back up a switching system
used by the Department of Defense, the affidavit said.


$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

NOTA:

It seems that Shadow Hawk was severely busted for hacking. If he does not go
back into the hacking world, he should be remembered as one of the better
hackers (much better than most hackers). Shadow Hawk made several scans
of local exchanges and was known to have broken into many computers. He was
very good with the Unix operating system and definitely knew what he was
doing. As I said before, he should be remembered as one of the better hackers
of the hack/phreak world. Now I will go into the article in detail with some
explanations on different things mentioned.

======================================



"The sole purpose of the computer network in Texas, known as 'Phreak
Class-2600' is  'to educate computer enthusiasts ... to penetrate industrial
and government sector computer systems.'"-

     The bbs described as "Phreak Class-2600" is actually "Phreak Klass
Room 2600." The current number to this bulletin board is (806) 799-0016. The
board isn't the greatest but it does have some very knowledgable people on it.
As described in the article, Phreak Klass is meant to educate people to
phreaking and hacking. If you would like to learn more about phreaking and
hacking, then please call. The current login is: EDUCATE. The board is public
and does not print codes or passwords to systems. The board is up for
educational purposes and codes or passwords are not tolerated.



======================================



"Henry Kluepfel, an AT&T corporate security official, tuned into the
Phreak Class-2600 and spotted messages from Shadow Hawk"-

     This would indicate that there is currently an AT&T security official
on Phreak Klass. It is also likely that this security official, named Henry
Kluepfel, is on other bulletin boards related to the topics of phreaking and
hacking. Although this security official was/is monitoring messages on
Phreak Klass, it is unknown whether or not he had anything to do with the bust
of Shadow Hawk. He might still be there and it is not known by which handle he
goes by.

Although many names are definitely not the informant, it should be assumed
that one of the users on this list is Henry Kluepfel (PK Userlist):


     1.    D,DR.
     2.    EWING,JR -
     3.   !,DOC PHUN
     4.   !,FUSION
     5.   !,KARATE KID
     6.   !,ZACK
     7.   (TUFF),TRACKER
     8.   -----,OMEGA
     9.   ., EVADER
     10.  .,BAUHAUS
     11.  .,EASTWIND
     12.  .,EVADER
     13.  .,LOKI
     14.  .,MERLIN
     15.  .,OBERHIEMAN
     16.  .,RYCHE
     17.  .,SABRO
     18.  .,THE SHUFFLER
     19.  .,WOLFMAN
     20.  ...,PENDRAGON
     21.  0PERATOR,THE
     22.  1,VANDAL
     23.  666,LUCIFER
     24.  ADAM,MIKE
     25.  ADEPT,BLUE
     26.  ADEPT,MAGNUS
     27.  ADVENGER,DEMON
     28.  AGENT,ADEPT
     29.  ALAND,PATRICK
     30.  ANARCHIST,ARMCHAIR
     31.  ANDREX,THE
     32.  ANGEL,DEATH
     33.  ANONYMOUS,RODNEY
     34.  ASHAD,ABDUL
     35.  ASSAULT,SILENT
     36.  ASSOCIATES,BREW
     37.  ATLANTIC,BILL
     38.  ATTACK!,OPERATIO AVOCADO,THE FLYING
     40.  AXIS,AGENT
     41.  BACARDI,DR
     42.  BAND,REZ
     43.  BANDIT,THE
     44.  BANDIT,TIME-
     45.  BARD,THE
     46.  BARON,RED
     47.  BARON,THE BAUD
     48.  BEEBLEBROX,ZAPHOD
     49.  BELLCON,MR
     50.  BERSITUS,BEN
     51.  BLACK,MR.
     52.  BLASTER,BYTE
     53.  BLIP,MR
     54.  BOBO,BOBO
     55.  BOUDREAUX,SMASHER
     56.  BREAKER,CIRCUIT
     57.  BREAKER,CODE
     58.  BREAKER,THE
     59.  BRIGGS,SIR
     60.  BROWN,DAVE
     61.  BUDMAN,THE
     62.  BULT,BUCKWEAT
     63.  BUM,DIGITAL
     64.  C,CTRL
     65.  CHANGE,RECENT
     66.  CHARLIE,COSMIC
     67.  CHEMIST,RENEGADE
     68.  CHEUNG,SLYDE
     69.  CHICKEN,THUNDER
     70.  CHOUINARD,JAY
     71.  CITIZEN,CONCERNED
     72.  COIL,VERTICAL
     73.  COLONEL,THE
     74.  CONNECT,CROSS
     75.  COOL J,LL
     76.  COOL,FIRECRACKER
     77.  COUNT,THE
     78.  CRACKER,THE
     79.  CRACKER,THE UNKNOWN
     80.  CREAPER,DARK
     81.  CRIMINAL,CORPORATE
     82.  CULPRIT,CARRIER
     83.  D MEN TOR,THE
     84.  DARKONE,THE
     85.  DEATH,COMMANDER
     86.  DEATH,CREEPING
     87.  DEATH,CRIMSON
     88.  DEATH,DRUIDIC
     89.  DECEIVER,THE
     90.  DELETE THIS.,THE DRUID
     91.  DEMON,DISK
     92.  DEMON,THE GUARDIAN
     93.  DENT,ARTHUR
     94.  DEVIL,ARCH
     95.  DIAMOND, KING
     96.  DOG,THE JUNKYARD
     97.  DRAKE,SIR FRANCIS
     98.  DROW,THE
     99.  DUDE,THE
     100. DUKE,THE
     101. DUTCHMAN,THE
     102. EDGE,THE
     103. ELIMINATOR,THE
     104. ELITE,PURE
     105. EQUALIZER,THE
     106. ERICKSON,S.K.
     107. EVANS,MARK
     108. EXECUTIONER,THE
     109. EXORCIST,THE
     110. EXTERMINATOR,THE
     111. FACTOR,DOMINANT
     112. FALCON,GREY
     113. FALCON,THE
     114. FINGERS,FINEOUS
     115. FLASH,GRANDMASTER
     116. FLINT,CAPTAIN
     117. FLOYD,PHREAKY
     118. FLYER,MIDNIGHT
     119. FOG,SINISTER
     120. FOREHEAD,PORCELAIN
     121. FOUL,LORD
     122. FREAKER,PHILLIPPINO
     123. FREEZE,THE
     124. FRESH,DOUG
     125. FUGATIVE,THE
     126. FUGITIVE,THE
     127. FUGITIVE-,-THE
     128. GAMELORD,SIR
     129. GHOST,GREY
     130. GIBE,FRANKEN
     131. GRAHAM,MICHAEL
     132. GREEL,MAGNUS
     133. GREEN,TYRONE
     134. GREYHOUND,GRANTIN
     135. GRIFFIN, THE
     136. GRIFFIN,THE
     137. GUARDIAN,THE
     138. HACK,MULTI
     139. HACK,TRASH
     140. HALEN,VAN
     141. HARRY,DIRTY
     142. HATTER,MAD
     143. HAVOC,MAJ.
     144. HAWK,NIGHT
     145. HAWK<_),(_>SHADOW
     146. HEADROOM,MAX
     147. HEART,PURPLE
     148. HEARTS,JACK OF
     149. HELIX,DOUBLE
     150. HIEROPHANT,THE ARCANE
     151. HOFFMAN,GREG
     152. HOLMES,SHERLOCK
     153. HORSE,CRAZY
     154. I AM,SAM
     155. ICOM,MR.
     156. IDAP,IOWD
     157. IDLE,BILLY
     158. III,EPSILON
     159. INSIDER,THE
     160. INSTRUCTOR,THE
     161. JACK,CRACKA
     162. JAGGERS,BOB
     163. JAMES,JESSE
     164. JAY,EVIL
     165. JENI,JINN
     166. JOE,G.I.
     167. JOHN,CRACKER
     168. JOHNSON,FRED
     169. KAY,DR.
     170. KEY,DEGARMO &
     171. KHAN,KERRANGHT,BLACK
     173. KNIGHT,THE CELESTIAL
     174. KNIGHT,WHITE
     175. KODIAK <-,->
     176. KOMMISAR,DER
     177. KOUSIDIS,IVAN
     178. KRACKER,THE
     179. LAMBO,PIRATESOFT
     180. LAWLESS,LORD
     181. LEFTIST,THE
     182. LEMIEUX,MARIO
     183. LESTAT,VAMPIRE
     184. LIGHT,BUD
     185. LIGHTNING, KNIGHT
     186. LOGIC,DIGITAL
     187. LOOP,DEAD
     188. LORD,SHADOW
     189. LOVER,THE EGYPTIAN
     190. LUCAS, THE 0PERATOR
     191. LUTHOR,LEX
     192. M.D.,DR. CRAZY
     193. MAC,SIR
     194. MACK,T-
     195. MAD,MR
     196. MAGICIAN,ZORLOFF
     197. MAIDEN,IRON
     198. MAN,HAC
     199. MAN,TERMINAL
     200. MAN,THE PHONE
     201. MANIPULATOR,CODE
     202. MARAUDER,THE
     203. MARTYR,THE
     204. MASTER, HATCHET
     205. MASTER,CODES
     206. MASTER,DELTA-
     207. MASTER,STAR
     208. MAX,MAD
     209. MECHANIC,CHIEF
     210. MENTOR,THE
     211. MIDNITE,CAPTAIN
     212. MINDED,ABSENT
     213. MIRANDA,QUINTON J.
     214. MONGREL,SPLIFF
     215. MONK,CHIP
     216. MUAD'DIB,PAUL
     217. MURDERER,AX
     218. MYRIAD,LORD
     219. NELSON,_-STYLE-_
     220. NICE,MR.
     221. NOTCH,TOP
     222. NUDITY,FRONTAL
     223. OF IMRRYR,ELRIC
     224. OF REALITY,MASTER
     225. OIL,EWING
     226. OMEN,THE
     227. ONE,HANDSOMEST
     228. ONE,KATO
     229. OPPOSITION,PSYCHOTIC
     230. ORACLE,THE
     231. OUTRIDER,THE
     232. OUTWORLD,FLINT OF
     233. OVERLORD,THE
     234. PANDEMONIUM,WASTED
     235. PECHACEK,JOHN
     236. PENGUIN,THE
     237. PETRA, ACE
     238. PEZ,MR.
     239. PHLASH,JUMPIN' JACK
     240. PHONESUCKER,THE
     241. PHREAK,NYNEX
     242. PHREAK-A-ZOID,THE
     243. PHREAKER,PHANTOM
     244. PHREAKO,PHREAKO
     245. PIRATEER,BADGER
     246. POLTERGEIST,ASTABULA
     247. POPE,THE
     248. PREFICT,FORD
     249. PRODIGAL,THE
     250. PROPHET,DOOM
     251. PROPHET,THE
     252. PSYCHEDELIC,THE
     253. QUEST,ORYAN
     254. QUITO,DON
     255. RADIX,OTHO
     256. RAVEN,STAR
     257. RANGER,THE
     258. RAT,SWAMP
     259. REAPER,CHROMATIC
     260. REQUEST,INTERRUPT
     261. RIDER,GHOST
     262. RIDER,MIDNIGHT
     263. ROLLOVR,DETH
     264. ROTTEN,JOHNNY
     265. RUNNER,BLADE
     266. RUNNER,SHADOW
     267. RUSSO,FRANK
     268. SALERNO,MIKE
     269. SAXON,ANGLO
     270. SECTOR,TWISTED
     271. SENSEI,NINJA
     272. SENSEI,THE
     273. SEVEN,CONRAD
     274. SHARP,FARLEY
     275. SHERMAN,ROBERT
     276. SHERWOOD,JOHN
     277. SINISTAR,SILICON
     278. SLASHER,MASTER
     279. SMITH,BOOMER
     280. SMITH,WINSTON
     281. SQUIRE,THE
     282. STALKER,DEATH
     283. STARR,DAVE
     284. STATE,SOLID
     285. STEIN,PHREAKEN
     286. STERN,HOWARD
     287. STEVENS,FRANKLIN
     288. STYLE,MR.
     289. SWANN, DAVID
     290. SWINDLER,SILICON
     291. T. DISASTER,MAJOR
     292. TERMINATOR,THE
     293. THE DUCK,HOWARD
     294. THE HACK,ZACK
     295. THE PROLONGED,AGRAJAG
     296. THE RIPPER,JACK
     297. THIEF,THE
     298. TONE,DIAL
     299. TRADER,THE
     300. TUCBBS,TUC
     301. VICIOUS,SID
     302. VIGILAN WAR,WIZARD OF
     304. WARLOCK LORD,THE
     305. WATCHER,THE
     306. WATCHER,WOMAN
     307. WATCHER,WOMEN
     308. WATSON,SHITHEAD
     309. WAVE,SHOCK
     310. WAVE,SHORT
     311. WEED,TUMBLE
     312. WILLIAMS,REMO
     313. WIZ KID,COMPUTER
     314. WOLF,LONE
     315. WONDERFUL,MR.
     316. XEROX,MR.
     317. YOUNG,TODD
     318. ZAP,CAPT


This security agent "spotted messages from Shadow Hawk". Here are some of
Shadow Hawk's posts from Phreak Klass:







Numb: 31
Subj: SHIT.
From: SHADOW HAWK
Date: MON MAY 11  2:08:53 AM

Looks like I've got a lot to learn as far as the TELE part of telecom goes...
I've got a question about trunks: Would someone mind explaining just how they
work, how you can 'drop into' a trunk w/2600, what a physical trunk (assuming
its just wires) looks like, etc.
Also, around here there are these weird green manholes that look more like
portholes to tanks than manhole covers. They usually are accompanied by a box
of the same shade, which usually has a red light (enclosed) as an appendage.
My question is, what the hell are they? There are none close enough to my
locale for me to actually attempt to enter one, but if their 'insides' are as
hi-tech as the outside looks... you get the picture
Later,
(_>Shadow Hawk<_)







Numb: 32
Subj: Boxing
From: SHADOW HAWK
Date: FRI MAY 22  1:24:56 PM

I don't think it would be THAT hard. Probably just a small sequencer & about 16
bits of DRAM, as well as a timer & of course the tone generator and keyboard
encoder. Now that may sound complicated but with todays electronics it could
all be done with probably around 6 ICs.

I had something like this in mind a while ago, the ultimate Telecom/computer
tool. IT goes something like this: a 1 MHZ A/D and a 1 MHZ D/A converter (16
bit resolution each) are connected basically to whatever you want, and to the
computer via an RS-232 interface. 'Whatever you want' is your phone line, your
ham radio, or even your LAN. It's basically a computer controlled
oscilliscope/waveform generator, except that there's no way it could run at
full 1mhz without about 16 megs of 16 bit ram & a REALLY fast coprocessor to
convert the raw waveform data into more easily convertable data. I've been
looking for a tech to help me out with this one for a long time, but to no
avail.

(the purpose, in case it wasn't readily apparent from the above, is to
1) tone dial, 2) MF dial, 3) generate ANY modem standard, 4) FAX, 5) 'scope,
6) voice recognition? The list goes on and on...)

Enough ramblings;Later, Fnord,
                      (_>Shadow Hawk<_)







Numb: 36
Subj: Autovon
From: SHADOW HAWK
Date: MON JUN  1  9:20:07 PM

Executioner: I'm fairly certain that the '*' (I'm assuming that you mean the D
key on a modified touch tone keypad) connects you only to a testing device of
some sort. If my assumption was wrong, would you please explain how to do it?
It sounds interesting...

                                   (_>SH



Numb: 35
Subj: mail? what mail?
From: SHADOW HAWK
Date: MON JUN  1  9:25:28 PM

I know of the multitude orating TH's, but that method was(is)
for a particular system where I can't even chown; I've got access to everything
else though.
Mail: As the title says, what mail? I thought I'd responded to your last mail,
but I guess not... Call me!

                            (_>Shadow Hawk<_)







Numb: 7
Subj: Reply to Question/Mercenary
From: SHADOW HAWK
Date: FRI MAY 22  1:09:44 PM

I've never had any problems with just dialing straight through 1 (one) sprint
950. Call me crazy, stupid, or an excessive taker of risks, but I've never even
had a run in with Sprint Security. Probably because I don't hack the codes out
myself, but that's another story.
(_>Sh







Numb: 33
Subj: BUGS
From: SHADOW HAWK
Date: MON MAY 11  2:17:12 AM

This should really go on the phreak board, BUT...
If you're referring to the bugs that are sold by deco industries, and you can
tell by their ads: they always compare their bugs to a dime or a quarter,
they're actually not that bad a deal. The phone line bug that they sell will
trasmit about a quarter to a half a block, and is powered completely from the
phone line. Their other bug, the one that's powered by (I think) a 9 volt
battery & is itself the size of a quarter, will go about 1-2 blocks. This is
without any real antenna, (except of course the phone line, or the battery
wires, respectively) which would be pretty good, except that they transmit on
the FM band. If you can find a spot on FM where theres no station, and can tune
both your receiver and the bug-transmitter to the same frequency, then you've
got it made.

As to construction, they're actually pretty easy to build if you've ever used a
soldering iron in your life. If not, make friends with a tech. and ask her/him
to do it, it is little more than a 5 minute assembly job for anyone with ANY
experience.

Later, (_>Shadow Hawk<_)



======================================


 "Shadow Hawk braged in the messages that he had successfully gained access
to AT&T computer files and said he was interested in creating some 'Trojan
horses' in the AT&T network."-


     This statement in the article refers to the following messages that
this security official read on Phreak Klass. Here are the messages posted by
Shadow Hawk as well as the appropriate responses (all from PK, of course):







Numb: 39
Subj: another 'stuff' already.
From: SHADOW HAWK
Date: MON MAY 11  2:21:47 AM

I better make this quick, 2 minutes left.
I've got all this source code (Notesfiles, UnAxcess, *ALL system 5 source) as
well as this list (399K) of AT&T Unixes on their net, and nothing to do with
them. Anyone out there wanna help me make some serious 'trojans?' I REALLY like
abusing the net...
Later,
(_>Shadow Hawk<_)







Numb: 38
Subj: uucp
From: SHADOW HAWK
Date: SUN MAY 31  2:16:59 AM

I've got this idea for a trojan horse type of deal...
A shellscript, run under nohup, with the 'victim' tty being the one I'm on, and
linked to the nohup.out file. I log out, and the nohup starts doin' it's thing.
I think you can figure out the rest for yourself. The question is, will itit rig
ht now but I'm doing an 8 meg uucp transfer through it
at the moment.

Later,
           (_>SH







Numb: 30
Subj: my first born...
From: DRUIDIC DEATH
Date: WED MAY 13  2:36:54 PM

I7ll trade you my first born for a
chance to hack those systems.  I'm
pretty good at TH and decoy
programming, so sure I'll help you.
I'd love to download the 399K
list for you too.  Let's work out
a deal, how about it?

DRU'







Numb: 31
Subj: unix from the top down
From: THE PROPHET
Date: THU MAY 14  6:17:23 AM

I'd like to point out one thing about my file first... A rather embarrassing
errr. In the original version, I said "chown"
 was used to change file modes, when the correct command is "chmod". This was
purely a typo, as I know the difference between the two commands. The format
for the command, though, was correct.
SState- there is one slight flaw in your trojan shell script. If the LOGNAME
variable is not set by root, it will not unprotect the password file when it is
run by the superuser. It's better to check the logname by using the logname
command, which is accomplished by using logname in place of $LOGNAME in the
script.
Shadow Hawke was asking about less easily detectable trojan horses. An easy way
to subvert a utility that normally has the uid bit set, like su, is to make a
copy of the utility and hide it in an out of the way directory, with the uid
bit NOT set. Then make a c program which does the following:
if a certain argument is given to the program (which replaces the real
utility), it executes the shell using the execvp C command.
otherwise, execute the copy of the utility.
Then set change ownership of the file to root, and set the uid bit, and name it
"su" (or whatever), and replace the real utility with it. Since su always has
the uid bit set and is always owned by root, it will be less easily detected,
unless the administrators notice the file size. This is easy to do, requires
only a minimal knowledge of C, and does not require the source code for the
subverted utility.
  -TP







======================================


"Kathyryn Clark, a spokesman for AT&T, said 'I'm aware of it. Our
security systems alert us when there is this type of break'".-

     I'm so sure. Shadow Hawk broke into many more systems than the ones
they busted him for.


======================================


"Later that month, another AT&T corporate security official spotted a
statement made by Shadow Hawk on another computer bulletin board in
Chicago."-

     This bulletin board is most likely Ripco (Ripco International). Shadow
Hawk was a user at this bulletin board and took part in phreak/hack discussions
(and possibly posted hacked computers). Do not quote me on this. This is only
an assumption and has not been verified. The current telephone number to
Ripco is (312) 528-5020. It should also be noted that this was a different
AT&T corporate security official. A DIFFERENT one.... as if AT&T has been
monitoring all phreak/hack bulletin boards??? Both of these security
officials are being paid to monitor boards. Is it poss
security officials monitor phreak/hack bulletin boards?? Henry Kluepfel and
this security official are certainly monitoring bulletin boards!


======================================

"In that message, Shadow Hawk provided the names, telephone numbers, passwords
and other critical information needed to gain access to seven different AT&T
computers"-

     It is not certain if any of these computers were the ones that Shadow
Hawk was busted for breaking into. And of course an AT&T security official
(one of those paid to monitor boards) read Shadow Hawk's message.


======================================