2600 Magazine - Volume 1, Number 2 2600 February, 1984 I l iiMi>"Ii.'iI iiikinl III l hi I S 1 1 .V .141 rtkL'IIMMflHIY Prilimi-r-PlHH. >pt'wmpihi'r* SHi „iKMultL WmI 4 111 ’NNIL Jhi» XU, MiihJk Island. XV I IWV ■ 1 ■ ' *0#D VOLUME ONE NUMtifUt TWO HACKING ON TELENET It’s as easy Telenet. Or, to be more specific, GTE Telenet. A massive net work formed by the people and technology that were 1 used to develop packet switching for the Department of Defense. Telenet wai purchased by GTE in 1979 and has been growing in ante and revenue ever since. * There are quite a few data networks in existence today. Datapac* Autonet, Tymnet* Arpanet; to name some of the better known. A data network is basically a collection of mainframes, specialized minis, and high-speed lines. Through Telenet, you can connect to literally thousands of computers* all over the country, even the world if you know the proper procedures. All this is possible by making a local phone call, in most parts of the country. [Telenet access numbers are made readily available to the public by Telenet and systems on the network, such as the Source. CompuServe, etc.] Once your modem is connected to Telenet, you have to hit two carriage returns. You'd see: telenet XXX XXX where the first 3 X’s are the area code you're connected to and the rest comprise the Telenet node identifier. You’ll then be asked fo^your terminal identifier Usually “Dl” works for most terminals, but a simple carriage return is also accepted: At this point you first receive the prompt, Before you type the next address, type "D" to disconnect from the computer you're still connected to. Hackers across the country hive for years programmed their computers to scan the system for interesting things. All that 1 has to be done is (his: Pick the city you want to scan— Id's say Boston. The -area code is 61 7. Have your computer start its search at address 61 TOOL [f you get connected to a ^-v computer. Telenet will skip a line and print 617 001 CONNECTED. If you don’t get connected, there are a variety of messages you could get. 617 00 i REJECTING, 617 001 NOT RESPONDING, 617 001 NOT REACH- ABLE. 617 001 REFUSED COLLECT CONNECTION iincr a few of them. They all mean basically the some thing— as 123456! there is no way to hook up to this address. At this point, several things can bedone. Naturally, you'll want to increment the address by one and search for a computer at address 617002. But how do you have your computer recognize when a connection has been made? This is necessary because you can't just keep entering OXXXXXX over and over— once you get connected, you have to enter the “(§T to get baekro the Telenet prompt, followed by a Of course* you could type C XX XX XX, followed by “©T followed by *‘D" for every attempt, but that can get rather time consuming. It's better simply to be able to save to disk or output to a printer the addresses of connections. And. fortunately for hackers, Telenet makes that very easy. You fan either search for a string that has the word "CONNECT" in it somewhere— the only time you’d End one would be when you got the CONNECTED message. But* as we mentioned earlier* an extra line is skipped right before the CONNECTED message, for some reason. Why hot simply look for that extra line? if you get it* record the address, send the and W D" and increment by L tfyou don’t get the extra line* simply increment by I. Naturally, you. will be collecting Telenet addresses for informational purposes only, to find out which computers are located where, in case you ever have to get onto one in an emergency of some sort.- Keep in mind that you are not entering any of these computers; you're merely connecting for a brief second or two. And there is no login procedure or identity check for Telenet, so you're not fraudulently using their system either. Also, the area code system is not the only system that works on Telenet. These are simply set up to be convenient, but an address qati actually have any kind of a number in it. For example* addresses beginning with 3 1 1 or 909 (the latter being Telenet’s own private "area code") aiso abound, and there are certain to be many more. Without a doubt, though, it’s the existence of the area code system that has helped Telenet become one of the easiest data networks to hack. And until they install some sort of a user idem! Hem ion program, or at least have the system disconnect after it becomes obvious that there* a strange person online* hackers will continue to be one or Telenet’s biggest problems. If you have information to share with us about this or any other data network, please send it in. Requests for anonymity will he respected. 1 ESS: ORWELL’S PROPHECY . There it as of course no way t?f knowing whether you were being watched at any given moment. Mow often, or on what system, the Thought Police plugged in on any individual wire was guesswork, it was even conceivable that they watched everybody all the time. But at any rate they could plug in your wire whenever they wanted to , You had to live— did five , from habit that became instinct— in the assumption that every sound you made was overheard \ and except in darkness, every movement scrutinized. From Nineteen Eighty-Four ESS is the big brother of the Bell family. Us very name strikes fear and apprehension into the hearts of most phreakers* and for a very good reason. ESS (Electronic Switching System) knowsthe full story on every telephone hooked into it. While it may be paranoid to say that all phreaking will come to a screeching halt under ESS, it's certainly realistic to admit that any phreak whose central office turns to ESS will have to be a lot more careful. Here’s why. With electronic switching, every single digit dialed is recorded. This is useful not only formatting phneaks but for -settling billing disputes. In the past, there has been no easy way for the phone company to show you what numbers you dialed locally. If you protested long enough and loud enough, they might have pui a pen register on your line to record everything and prove it to you. Under ESS, the actual, printout (which will be dug out of a vault somewhere if needed) shows every fast digit dialed. Every BOO call, every call to directory assistance, repair service, the operator, every rendition of the 1313 Overture, everything! Here is an example of a typical printout* which shows time of connect* length of connect, and number called. DATE TIME LENGTH UNITS NUMBER 0603 1511 3 l 4$t7*90 0603 1525 5 - 3 345-67*9 0603 16*1 1 0 ■000-411 0603 1603 l Y *00-555-1111 0(03 1*03 2.35* 112-345-67*9 0(03 I(J4 1 0 OSOC-OH (T5P5) A thousand calls to “BOO" will show tip adjust that— a thousand calls to "8