Reign of Terror [ R o T ] presents... ============================= the art of TRASHING -------------- a how to guide for one of the most useful tools in hacking today ================================================ Written by: Deicide /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ THEORY BEHIND TRASHING: The whole theory behind trashing is that us H/P/C guys need information. And a lot of VERY useful information is thrown out daily. It is not thrown out because it is no longer valid, it is thrown out because the owner of the material no longer needs it or has use for it. The key here is that while the OWNER no longer has use for this information, you just might. In fact, you might have a lot of use for it. The key is to get this information, in the form of trash. WHAT TRASHING IS USEFUL FOR(INTRO): I said earlier that trashing is one of the most useful tools in hacking today. I also based this statement on looking through other peoples trash. If you have been hacking/phreaking/carding for a long time then you know what i'm talking about. If not, you are probably a bit confused. If you don't already know what i mean by valuable items being thrown out then you are most likely scratching your head(ass?) right now. People don't throw out Dual Standards or sacks of cash, right? Well, not usually, but they do throw out something even more valuable to us. Information. The currency of the underworld. Daily, workers and administrators alike unwittingly throw out material which is potentially harmful and/or deadly to their business and its customers. This is because they a: don't realize the potential harmfulness of the information thrown out b: don't think a hacker would ever search through THEIR garbage Very few companies ever paper-shred sensitive information, a flaw which they might never discover and which you can exploit continually, for those two reasons mentioned above. Examples of places to trash & info you can find there is the subject of the next section. WHAT IS TRASHING USEFUL FOR(REGULAR BUSINESS): This section is based on businesses where you can apply trashing and what you might expect to find there. Deparment Stores: The main objective of trashing at departments stores is to obtain as many Credit Card carbon copy slips as possible. You will find huge amount of them, as 50-75% of the purchases made at the large department stores(such as Sears, JC Penney, etc..) are made with credit cards. A number of copies of each purchase made with a CC are kept on carbons, to my knowledge one is always thrown out. The carbons contain such useful info as - Credit Card Numbers - Expiration Date - Customers Signature. Credit card #'s are needed to card items(duh..) and are good for trading for AT&T's, system acct's, etc for people who are too lazy to go trashing themselves. Gas Stations : The same type of thing can be found at gas stations, but unfortunely quite a few stations accept only store specific cards, which aren't nearly as useful. But a lot less excess trash gets thrown out at gas stations, which makes the searching easier. Credit Bureau's : Famous for TRW printouts. If you hack at all you know about it. Not good for too much else, card numbers are display but the extra code which is standard on most credit bureau's is shadowed over. Other companies : You will be able to pick up CC carbons at many other stores as well, the possibilities are endless, but the main focus of this section is for the hacking aspect of trashing. A large number of small to major businesses run on computers. A large percentage of these computers have dialin data numbers. These numbers are frequently contained in printouts of the company's computers, look for them. Also, if you want to go farther as far as hacking, or you already have the modem number, you will often find workers & administrator names + home and office phone numbers. These are very useful for social engineering. Sometimes you will find entire username & pword lists written down, or even just one id + password thrown out by a careless employee, these will cut hacking time severly. WHAT IS TRASHING GOOD FOR(TELCO.): And now we come to one of my favorite subjects ever: trashing at the Telephone company. So many people/groups have gained fame from information gained by trashing at the local telco. you think they would have caught on by now and raised security measures. But no, it is a still applicable trade world wide. To name a few of the more famous trashers: LOD & Kevin Mitnick. Both gained information not accessible to the most accomplished social engineerer. You can expect to find many invaluable pieces of information, some examples are: - Calling Card Numbers : Usually written on memo's, phone #'s + 4 digit number - Misc. system dialins & PBXes, etc. : Written on memos - Telco. Dialins : Obviously very useful, usually the system/OS name accompanied by a phone # - Tech info : Miscallaneous technical info printed in manuals, user help sheets, admin help sheets, etc. Can be extremely useful to find system flaws, etc. - Telco system printout: These common finds can help you determine any number of things, including user names system types, etc. - Worker/Administrator names, phone numbers : Essential for social engineering. - Access codes/pwords : Occasionally a not-too-bright Telco. employee will write down his name and password on a sheet of paper. A very valuable find. - Security memos : Telco. security will often write each other and their superviors notes on what they are working on, what they have found, pending bust dates, etc. Or the other way round, with managers assigning cases. Although frequently boring/pointless memos will be found, this might just save your ass one day, if you see you or your friend's name/number with "being traced/tracked" or "bust/raid date" beside it then you can bury your notes/disks and run for your life knowing you did the right thing. WHERE TO(FINDING THE SITE): Now, while finding a department store/computer store to trash at may be pretty easy, finding a telco. installation can sometimes be more difficult. First of all, you normally want to hit the Telco. offices, as while the switching stations might have cool tech manuals they won't have much else. And i've found as a rule that for some reason switching stations are better secured. Sometimes the offices are clearly marked(a big AT&T sign is usual a signal that you found it), but occasionally your Telco. office will only be marked by a small sign, or none at all. If this is the case, you can either: a) Request a tour(they do give em) b) Request the land/building permit or whatever works in your town for your telco. offices from a local govt. building(they'll usually tell you where and what to ask for if you ask politely). Don't be all nervous and shit about this, it is completely legal and within your rights, so don't get worried. Just don't act suspicious and it'll go fine. The document will tell you the exact location of the building site. HOWTO(TRASHING!): - Plan it! : The most essential part to any plan is the planning stage. Without proper planning you are just asking for disaster, especially where crime is concerned. Plan it carefully! Scout the site first so you know what you need to carry out the operation. The first time is always the hardest, after that you know how it goes. Equipment you might need: Gloves, flashlight wire/bolt cutters, hammer, garbage bags. Have an escape plan set up if something goes wrong. Even the best plan can be fucked up by bad luck. The best vehicle to use would be a pickup truck, just throw the bags in the back and drive away. Other vehicles work as well, van's work equally as well. - Timing : Also essential for a smooth job, timing involves foresight,planning and luck. The luck part you can't help, but the foresight and planning you can. Go very late at night, you can't risk being spotted by a Telco. employee, or for that matter anyone else while trashing. (it IS a B&E which IS a crime). Don't go on bingo night or whatever when there are tons of people about. Plan it out before hand, so that it only takes you a minute to get what you want and get out. - People : Keep the number of people involved to a minimum, 3 involved is usually the best rule. One to jump the fence & grab the bags, one to receive the relays of the bags from the person behind the gate, and one to stay in the vehicle. This works out especially good as the person in the vehicle can signal to the others if someone is coming. The guy behind the gate can hide (easy at night if done quickly enough) and the relay man can pretend to be fixing the vehicle. If the person raises suspicions about your actions just tell them that you are fixing the vehicle. If he stills seems suspicious and wanders off to tell a cop (you can usually tell) then just get the fence-jumper to come back over, then just drive out normally, no tire squealing etc. - Fenced? : Although some installations have no fence at all, Barbwire?? many do, and it can be an unpleasant experience for the uninitiated during their first barbed-wire fence climbing. First of all, don't cut the fucking wire. I have seen so many people brag "we cut the bitchin wire right off" or "we made the hugest hole in da fence". Right on d00d! Now the security people think there has been a break in and they call the police. At the very least they usually install better security. Instead of wasting your time, just jump the fence. Take the most agile member of the group and either: a) back vehicle up against the fence so he can hurdle it. (be careful. barb wire + limb=pain) b) have him simply climb it. If the fence has the slanted barb wire then you might have a problem. The hurdling would be the best procedure then, but if climbing is a must, look for the corner of the installation. Frequently the barbedwire will go back straight right at the point of entry into the wall. Sometimes a post will be right there as well, aiding you in the climb. Straight barbed wire is much easier to climb. When you climb over, make sure the relay man is underneath you in case you fall/slip. - Locked? : If the dumpster's locked, it makes the job a whole lot less pleasant. If you or a friend can pick locks than your problem is solved, if not, there are tons of G-Philes out on lockpicking, although it takes a long time to learn the skill. If you want to do the job though, you are going to have to do it a lot less frequently. A sharp hammerblow to the top of the lock or a pair of boltcutters should do the job. When you are done take the broken lock with you. This will fool them once or twice(some joe blow employee lost the lock or something) but will eventually make even Telco. employees suspicious. - What to : There are two places to initially start your search, Look for the hardware bin and the dumpster. The hardware bin contains such things as wire's, broken hardware parts busted RS-232's etc. Kinda interesting for hardware buffs. The main score is in the dumpster. Pop it open and grab the bags. Throw em to the relay man. Leave. - Extra : Occasionally the installations will have extra Security security measures such as motion-detectors or cameras. To my knowledge if the video images are not valid as evidence in a court of law if a sign stating the presence of such cameras on the premise does not exist, as this violates the thief's rights. So you should know if they have a camera. If they don't have a sign, don't worry about it, they can't use it as evidence. A BAD EXAMPLE OF A TRASHING RUN(FROM RoT EXPERIENCE) 11:30 Scouted premises. Sign stating cameras + electronic sensors on premises noted. Good security. High fences with good quality barbed wire. Deicided to go through with it, just do it fast with masks. 11:45 Vehicles placed in position. Security forced an entry through multiple backyards to get to a fence which allowed us to avoid the security camera. 11:47 2 members made a run through the yards, made it to the fence. Ready. 11:50 Lord IBM jumped the fence, and was now waiting for Deicide to do the same. Deicide was half-way over when a figure stepped out from behind the furnace where he was doing maintenance(at 11:50????) and yelled "What the hell are you doing!". Luckily, Lord IBM is a top Canadian martial artist and responded with a sharp blow to temple. We proceeded to get the fuck outta there. Our not-so-bright rides took off with squealing tires(bad idea), but we made the escape. A GOOD EXAMPLE OF TRASHING RUN(FROM RoT EXPERIENCE) 11:30 Scouted premises. No signs noted. Fence with slanted barbed wire noted. Looked in corner of installation:Straight barbed wire. Garbage bin right near fence. Hardware bins right near fence. Jumping spot hidden by tree cover. Garbage bin unlocked. 11:50 Car + truck put in position. 11:54 Deicide jumps the fence. 11:54 Deicide looks in hardware bins, grabs wire and relays it to Lord IBM, who relays it to truck. 11:54 Car drives through lot, signal given, Deicide hides & Lord IBM pretends to work on truck. 11:55 All Clear signal given. 11:55 Deicide jumps in bin, throws 3 bags to Lord IBM who relays it to truck. 11:55 Deicide jumps out and climbs fence. The four participants leave site in the two vehicles. No problems. Time elapsed : 2 minutes Items recovered: Various maintenance phone #'s Technical sheets 1 system manual(small) 1 complete employee payroll list(w/phone #'s, addresses, SIN(SSN in the U.S.) and job function) Various administrator/manager names/phone numbers 1 Access Code Various system info 1 Telco. dialin CONCLUSION I hope you find this useful, give it a try, you won't regret it. For any questions or comments you can find me at the RoT HQ's. Call them for the latest in H/P/A/C/V + the [RoT] G-Philes and programs as they come out. --= RoT WHQ =-- --= RoT USHQ =-- 6 ���T ��D�R the Cellar [604] 824-0317 [401] PRI-VATE