94192ffirs.qxd 6/3/08 11:18 PM Page i The Best of 2600 A Hacker Odyssey Emmanuel Goldstein Wiley Publishing, Inc 94192ffirs.qxd 6/3/08 11:18 PM Page i The Best of 2600 A Hacker Odyssey Emmanuel Goldstein Wiley Publishing, Inc 94192ffirs.qxd 6/3/08 11:18 PM Page ii The Best of 2600: A Hacker Odyssey Published by Wiley Publishing, Inc 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-29419-2 Manufactured in the United States of America 10 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600 Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose No warranty may be created or extended by sales or promotional materials The advice and strategies contained herein may not be suitable for every situation This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services If professional assistance is required, the services of a competent professional person should be sought Neither the publisher nor the author shall be liable for damages arising herefrom The fact that an organization or Website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Website may provide or recommendations it may make Further, readers should be aware that Internet Websites listed in this work may have changed or disappeared between when this work was written and when it is read For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S at (800) 762-2974, outside the U.S at (317) 572-3993 or fax (317) 572-4002 Library of Congress Cataloging-in-Publication Data: Goldstein, Emmanuel, 1959The best of 2600 : a hacker odyssey / Emmanuel Goldstein p cm Includes bibliographical references and index ISBN 978-0-470-29419-2 (cloth) Computer security—History Computer crimes—History Computer hackers—History Telecommunication—Security measures—History Wiretapping—History I 2600 II Title III Title: Best of 2,600 QA76.9.A25G643 2008 005.8—dc22 2008018567 Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc and/or its affiliates in the United States and other countries, and may not be used without written permission All other trademarks are the property of their respective owners Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book Wiley also publishes its books in a variety of electronic formats Some content that appears in print may not be available in electronic books 94192ffirs.qxd 6/3/08 11:18 PM Page iii This book, and all of the articles contained herein, is dedicated to anyone who has in any way proclaimed themselves “different from the rest” and has had the courage to stand up against the forces of sameness which pervade our world You have always been my inspiration 94192ffirs.qxd 6/3/08 11:18 PM Page iv 94192ffirs.qxd 6/3/08 11:18 PM Page v About the Author Emmanuel Goldstein (emmanuel@goldste.in) has been publishing 2600 Magazine, The Hacker Quarterly, since 1984 He traces his hacker roots to his high school days in the late ’70s, when he first played with a distant computer over high-speed, 300-baud phone lines It didn’t take long for him to get into trouble by figuring out how to access something he wasn’t supposed to access He continued playing with various machines in his college days at the State University of New York at Stony Brook This resulted in an FBI raid as he once again gained access to something he really shouldn’t have It was in the midst of all of this excitement that he cofounded 2600 Magazine, an outlet for hacker stories and tutorials from all over the world The rapid growth and success of the magazine was both shocking and scary to Goldstein, who to this day has never taken a course in computers Since 1988, he has also hosted Off The Hook, a hacker-themed technology talk show on WBAI 99.5 FM in New York City In addition to making the hacker documentary Freedom Downtime, Goldstein hosts the Hackers On Planet Earth (HOPE) conferences in New York City every two years, drawing thousands of hackers from all over the world You can contact 2600 online at www.2600.com or by writing to 2600 Magazine, P.O Box 752, Middle Island, NY, 11953 94192ffirs.qxd 6/3/08 11:18 PM Page vi Credits Executive Editor Carol Long Development Editor Maureen Spears Production Editor Elizabeth Ginns Britten Copy Editors Kim Cofer Mildred Sanchez Editorial Manager Mary Beth Wakefield Production Manager Tim Tate Vice President and Executive Group Publisher Richard Swadley Vice President and Executive Publisher Joseph B Wikert Project Coordinator, Cover Lynsey Stanford Compositor Chris Gillespie, Happenstance Type-O-Rama Proofreader Sossity Smith Indexer Jack Lewis Cover Image ©Toledano/Stone+/Getty Images Cover Designer Michael E Trent 94192ffirs.qxd 6/3/08 11:18 PM Page vii Acknowledgments T his is far and away the toughest part of the book to write How I sum up in words what so many people have meant over so many years? I’ll undoubtedly forget someone, they’ll notice, words will be exchanged, and new enemies for life will be formed It’s a painful yet necessary part of the process From the beginning there have been people who have been there to encourage me in various endeavors, 2600 included And there have also been those who have actively sought to discourage me and painstakingly point out the many errors of my ways I would like to thank each of these groups equally The former gave me the positive reinforcement that helped convince me that this was all worth it and that it would eventually have a beneficial and lasting effect The latter gave me the obstinacy and unmitigated wrath to prove them wrong A positive outlook fueled by anger is really all you need to succeed in this world On to specifics First, I must thank three people who helped me wade through well more than 1,000 articles to sort out the ones that would eventually appear here: Tony Fannin, Mike McTeague, and Kevin Reilly It was a mountain of material, but I managed to scale it successfully thanks to their help The many people at Wiley who dealt with our rather unconventional way of piecing together a book deserve particular thanks, especially Carol Long and Maureen Spears The hard work of my agent, Cameron McClure, made this all come together with remarkable speed and clarity My cofounder, Dave Ruderman, deserves special gratitude for coming up with the name “2600”—which I initially hated—way back in 1983 Those late nights of plotting and scheming are among my most favorite memories on this planet My good friend Dave Buchwald defies any sort of description He’s done everything from office management to cover design and is somehow able to come up with new skills overnight like some sort of power computer We’ve also been blessed with some truly talented layout artists over the years—Ben Sherman, Scott Skinner, Terrence McGuckin, and Mark Silverberg—all of whom I’m honored to call my friends And without Mary Nixdorf, our office manager, 2600 would last about a day Her incredible dedication and attention to detail make the whole enterprise function smoothly—a feat that people to this day tell me is impossible Our previous office managers (Pete Kang and Fran Westbrook) also got us through some vital periods of our growth People like Mike Castleman, Carl Shapiro, Mike Kaegler, Ed Cummings, Rob Nixdorf, Nick Jarecki, Kevin Mitnick, and Mark Abene have always been there to offer encouragement, expertise, and words of advice for all sorts of projects over the years, no matter how crazy they may have actually been 94192ffirs.qxd 6/3/08 11:18 PM Page viii viii Acknowledgments And some of our projects have been pretty bizarre And, speaking of bizarre, the magazine covers, T-shirt art, web site work, and various designs for the HOPE conferences, put together by such artists as Frederic Guimont, Holly Kaufman Spruch, Kiratoy, Kerry Zero, Tish Valter, and Affra Gibbs, have been nothing short of eye-opening in every regard Oh, yes, the HOPE conferences—how could I forget? Since 1994, we’ve been holding hacker conferences in New York City called Hackers On Planet Earth, which have drawn thousands of people from all over the globe to the historic Hotel Pennsylvania And this has all been made possible by a phenomenal volunteer effort, which would take many more pages than I have to adequately acknowledge Nothing symbolizes the power of the hacker community more than seeing hundreds of people come together to pull off a feat like this every couple of years, a feat which is, of course, impossible Having these conferences is indeed a real motivation to keep doing what we’ve been doing It’s one thing to sit back and write stuff from some remote location; it’s quite another to actually meet the audience and hear their stories and realize that it all actually matters And none of this would have ever been possible (for me, at least) without the creative inspiration that I got from working at a magical place called WUSB, the noncommercial radio station at the college I went to: the State University of New York at Stony Brook My fondest memories of the station include cohosting the eclectic program “The Voice of Long Island” with my good friend Mike Yuhas back in the early ’80s That place (both the college and the station) taught me so much about diversity and imagination I was able to steer all of the creative energy from there to the various projects that I became involved in after graduation I can honestly say that none of this would have ever happened were it not for that initial inspiration This also led to my involvement with another magical place: WBAI-FM in New York City, a full-power noncommercial station that reaches four states, accepts no corporate money and basically exists to challenge the status quo (Do I even have to point out how impossible this is as well?) They gave us an outlet for the hacker perspective on technology and Off The Hook was thus born That radio show gave hackers a voice and served as a valuable staging ground for everything from the Free Kevin movement to our defense against the Motion Picture Association of America when they decided to sue us Particular thanks must go to past program director Andrew Phillips, who recognized this need before even I did Three of my very best friends in the world—Walter, Naftali, and Huey—have given me the spirit I needed when I needed it the most Inspiration also came from family, especially Patricia O’Flanagan, who taught me to think for myself, and Monica Clare, who always makes me remember the value of the small things in life There are many other relatives who I must also thank for just letting me my thing without trying too hard to stop me 94192bindex.qxd 6/3/08 3:29 PM Page 857 Index CampusWide server, 605 conducting simple transaction, 610–611 exploits, 611–612 getting into database through, 606 NPA (area code), pagers, 346 NSA (National Security Agency) Clipper Chip proposal, 556 cryptosystem of, 308 Digital Telephony Bill lobbying of, 561 Fortezza project, 310–312 invasion of citizen privacy, 552 secretive research of, 309–310 Nsfnet (National Science Foundation Network), 152 NTS Connection, MCI affiliation with, 169–170 Number Assignment Module see NAM (Number Assignment Module) number restriction, COCOTs, 452 numbering system, world phone zones, 467–468 numbers 800, 92–93, 111–112 976 (dial-it) numbers, 62 Automatic Number Identifier, 61 determining hot sets of lottery, 646–648 ESN see ESN (Electronic Serial Number) MIN see MIN (Mobile Identification Number) NAM see NAM (Number Assignment Module) numbers, COCOT phone call forwarding, 456–457 overview of, 453–454 numbers, stories about, 7–15 overview of, scariest number in world, 8–9 teleconferencing saga, 11–15 truth about 9999, 9–11 Nunn, Senator Sam, 257 NYCTA (New York City Transit Authority), 785 NYCWireless group, 737–738 NYNEX/New York Telephone as Baby Bell, 83 changes to pay phones, 482–483 competing with Ma Bell, 62 exposing, 175–176 mega-mergers, 482 sleazy practices of, 157–158 O @o command, ARPANET, 146–147 OGM (outgoing message), answering machines, 660–662 OLD command, RSTS/E, 128 omnidirectional antennas, radio piracy, 760 OmniMetrix, 436 Omnipoint, 483 OneCard system see CampusWide system op-diverting, ANI-fails, 665 OpenQubit, 288–289 Openwave, 747–749 Operation Sun Devil bittersweet victory, 501 crackdown, 493–496 hunt intensifies, 496–498 increased restrictions, 498–499 no time for complacency, 500–501 overview of, 492–493 operators Amateur Radio, 367–369 conferencing and, 81 enabling calls to special, 48–49 genesis of, 27 pagers sending out messages via, 341 types of, 47–48 Optim9000 see CampusWide system OptoComs, Chrome Box, 324–325 orangeboxing, 666 ORed (XORed) burst period, 432 Orinoco cards, 735 Orion, 436 OSUNY bulleting board, 23 outgoing message (OGM), answering machines, 660–662 out-of-band signaling, 27 overlay codes, 486 P Pacific Bell, wiretapping, 555 Pacific Telesis, 83 packet types, 802.11b, 734 pagefile.sys, 286 pagers, 339–345 decoding setup, 346–349 defined, 340 for free, 101–102 how messages are sent to, 340 how network works, 345–346 message length, 342 other questions, 342–345 sending out messages, 341 types of, 340 857 94192bindex.qxd 6/3/08 3:29 PM Page 858 858 Index PAI (public and international) accounts, Dell, 697, 699 Paketto Keiretsu, 701 PANI (Pseudo-ANI), 665 Pansat 2500A receivers, 763–764 paper clips, as lockpickers, 778 parabolic microphones, 350 ParadisePoker.com blackjack story, 644–646 parallel transmitters, 360 parasitic grids, 737–738 parole eligibility, military, 624–625 party lines, wiring for, 24 Passback Period, New York’s MTA, 786 passive detection, wireless networks, 734–735 passwords, 163 answering machine hacking, 660–662 Answers for Gateway, 730 COSMOS, 59 DEC-20, 124–125 electronic message center, 769 FirstClass, 617 IBM’s Audio Distribution System, 69–71 Internet radio stations, 306 MCI Mail, 160–161 military, 406–408 negative feedback on hacking, 503–504 printing password file, 60 Radio Shack screensaver, 706 RSTS/E, 127–128 Telemail, 122–124 UAPC, 135–136 VMS systems, 130 Watson system at T-Mobile stores, 676 patterns, lottery number, 784 pay phones, 35–43 see also COCOTs (Customer Owned Coin Operated Telephones) abuse of, 41–43 alternate designs, 38–40 charging for toll-free numbers from, 487 cheese box, 40–41 clear box working on post-pay, 32–33 hacking three holed, 652–655 history of, 36 in the nineties, 482–483 operation logic, 36–37 types of, 39 what happens to your money, 37–38 why redboxing doesn’t work, 446–448 pay TV descramblers, making, 332–333 PayPal, transaction reversals, 725–729 PBX (Private Branch eXchange) digital telephone abuse, 43 electronic pay phones, 39–40 multi-carrier toll abuse, 222–223 teleconferencing dangers, 79 teleconferencing using, 77 PCMCIA card, 310 PCP (PC Pursuit), 141–144, 164–165 PCS (Personal Communications Services), GSM, 428–429 PCs, Kmart, 715 peering, Internet, 302–305 pen registers, 183 Pengo, 235 Pentagon City Mall, 512 People Express, 166–168 Peripheral Interchange Program (PIP), RSTS/E, 128 peripheral nervous system, 826 Personal Communications Services (PCS), GSM, 428–429 personal identification code (PIC), Pronto, 164 Personal Identification Number (PIN), GSM SIM cards, 430 Personal Unblocking Key (PUK), 430 personalized info, XM Radio signal, 755 Pfaelzer, Mariana, 549 PHALSE (Phreakers, Hackers, and Laundromat Service Employees), 525 pharmacy computers, Wal-Mart, 714 phase-locked look (PLL) transmitter, radio piracy, 759–761 Phiber Optick case, 523, 526–527 philosophy see hackers, philosophy phone cards, Afghan, 659 phone phreaking, 21st century, 659–680 ANI and Caller ID spoofing, 664–669 answering machine hacking, 659–662 backspoofing, 672–675 feeding the frenzy of Internet threats, 662–663 fun of prosecuting for, 555 getting more from T-Mobile, 675–679 tracking any U.K GSM mobile phone, 679–680 Verizon’s Call Intercept, 669–672 phone phreaking, in 1980s access codes and, 106 antennas, 105 and bulletin boards, 223–227 94192bindex.qxd 6/3/08 3:29 PM Page 859 Index catching hackers for, 109–112 cellular phones, 91–92 equipment, 104–105 motivations for, 209 one interpretation of, 221–223 overview of, 103–104 programming CMT, 107 reflections on, 216 roaming, 108 social engineering story, 16–17 phone phreaking, in 1990s, 466–472 see also toll fraud; voicemail hacking getting started, 467 international signaling systems, 468–470 national signaling systems, 470–472 numbering plans for world zones, 467–468 in prison, 388–390 war dialing, 401–405 phone rates, 1990s, 483–484, 487 PhoneNet, 149–151 Phrack newsletter charges dropped against, 501 crackdown on, 493–496 facts of case, 500 no time for complacency, 501 views from a Fed, 384–385 Phreakers, Hackers, And Laundromat Service Employees (PHALSE), 525 phreakers, publicity and, 22 PIC (personal identification code), Pronto, 164 PICCs (Pre-subscribed Interexchange Carrier Codes), bypassing ACR, 669 Pick Up & Go service, People Express, 166–168 Pick-6 lottery, 647 PIN (Personal Identification Number), GSM SIM cards, 430 pin pads, Kmart, 714–716 pin pads, Wal-Mart, 710 pink noise, avoiding blue box detection, 30 PIP (Peripheral Interchange Program), RSTS/E, 128 piracy cellular phone, 103, 106 DVD, 576–580 radio, 758–761 television, 113 pizoelectric coaxial microphone, 357 PKCS (Public Key Cryptography Standard), 312 PKUNZIP.BAT file, 400–401 PKZIP, 416 PL tone, 366–367 Plain Old Telephone Service (POTS) backspoofing using, 672–675 VoIP using, 688–689 planning, to get into Central Office, 52–55 plasmids, 822–824 plausible credibility, 414–415 Playboy channel, XM Radio, 757–758 PLL (phase-locked look) transmitter, radio piracy, 759–761 PMSP (Pre Message Security Protocol), 310 POCSAG (Post Office Standards Advisory Group) pager setup, 346–347 point-of-sale (POS) hacking hardware, 709–711 readers, 610 Points of Presence (POPs), 303 political commentary, DeCSS case, 593 pop culture, 1990s crime waves, 266–268 entertainment see entertainment, 1990s hacker conventions, 271–276 media see media, in 1990s overview of, 233–234 threat of success, 268–271 POPs (Points of Presence), 303 portable hacking, 278–284 future of, 284 modems and couplers, 280–281 overview of, 278–280 planning, 283–284 where to go, 281–283 portable tape recorders, phreaking with, 222 ports and Back Orifice, 295 Internet radio station access, 306–307 POS (point-of-sale) hacking hardware, 709–711 readers, 610 Positive Roamer Verification (PRV), 108 Post Office Standards Advisory Group (POCSAG) pager setup, 346–347 post offices, and credit card fraud, 191 Postal Numeric Encoding Technique (POSTNET), 373, 377 POSTNET (Postal Numeric Encoding Technique), 373, 377 859 94192bindex.qxd 6/3/08 3:29 PM Page 860 860 Index post-pay phones activating, 677 clear box working on, 32–33 history of, 36 POTS (Plain Old Telephone Service) backspoofing using, 672–675 VoIP using, 688–689 power source, for radio piracy, 759–760 powerline carrier current devices, 357 Pre Message Security Protocol (PMSP), 310 PREOP account, COSMOS, 59 pre-pay phones, 36, 677 presets, 3D glasses, 813–816 Pre-subscribed Interexchange Carrier Codes (PICCs), bypassing ACR, 669 pretexts, and social engineering, 828–830 PRI (Primary Rate) ISDN line, spoofing Caller ID, 665 price tags, Circuit City, 702–703 printing Gulf War printer virus, 289–290 password file, 60 Priority*Call, 460 Prism2 cards, 735 prison letter from, 387–390 military sentences, 623–624 privacy Busy Line Verification vulnerability, 464–466 Digital Telephony Bill provisions, 560–561 Electronic Communications Privacy Act, 98–100 government invasion of, 115–116, 500, 505 MCI gimmicks, 463–464 negative feedback on hacking, 504–509 September 11, 2001 and America’s right to, 626–627 student databases and, 602–604 wiretapping and invasion of, 552 privacy hole, 464–466 Private Branch eXchange see PBX (Private Branch eXchange) Private Sector bulletin board system false charges against, 189–192 protecting Sysops, 192–194 returning online, 194–197 seizure by law enforcement, 184–187 threat to us all, 187–189 privileged accounts, VMS systems, 131 privs, DEC-20, 125 probe packets, 734 processes, Back Orifice, 295 Pronto, 158, 161–164 Proposition 21, 579 Prosecutor’s Brief publication, 555–556 PROTECTION files, RSTS/E, 129 PRV (Positive Roamer Verification), 108 PSAP (Public Safety Answering Point), 681–682 Pseudo-ANI (PANI), 665 pseudo-felon, making of, 630–634 PSTN (Public Switched Telephone Network), VoIP, 688 public and international (PAI) accounts, Dell, 697, 699 Public Key Cryptography Standard (PKCS), 312 public networks, wireless, 737–738 Public Safety Answering Point (PSAP), 681–682 public services, 140 Public Switched Telephone Network (PSTN), VoIP, 688 PUK (Personal Unblocking Key), 430 punch cards, UAPC, 134 push-button locks see Simplex locks Q Q VOICEMAIL system, 474 QAM standard, 762 QModem script, 404–405 QoS (Quality of Service), 634–636 Q.T (quick termination) service, 114 quantum hacking, 287–289 qubits (quantum bits), 288 Question Authority, 90 Quick-Scribe terminal, 710–711 Quittner, Josh, 239–242, 559 R R (ring) telephone wires, 24 R1 signaling system, 470–471 R2 signaling system, 469–470 radio, hacking amateur radio, 367–369 fast food fun, 365–367 Internet stations, 306–307 listening in see surveillance devices overview of, 361–362 pager, 101–102, 340, 342–343 pirating airwaves, 758–761 94192bindex.qxd 6/3/08 3:29 PM Page 861 Index RFID (Radio Frequency Identification) and, 749–751 trunking communications monitoring, 362–364 XM Radio, 753–758 Radio Common Carrier (RCC), 87 Radio Frequency Identification (RFID), 749–751 radio modem, electronic message centers, 769–770 Radio Shack fixing PRO-2004 scanner, 100–101 hacking into, 704–706 raids, 1980s conclusions, 205–207 FBI goes after ADS hackers, 181–184 Herbert Zinn, Jr., 203–204 Kevin Mitnick, 202–203 Private Sector BBS see Private Sector bulletin board system Sherwood Forest BBS, 197–198 at teenagers` houses, 198–200 raids, 1990s see Operation Sun Devil rainbow box, 445 rakes, lockpicking with, 780–781 RAM, 285, 425–427 RAND (random number), GSM, 432 Rappa, Charles, Sr., 536 RBOCs (Regional Bell Operating Companies), 21–22, 92 RCA cables, 347 RCC (Radio Common Carrier), 87 RCI, 222–223 readers CampusWide, 609–611 MetroCards, 787, 790 Real Encoder, 307 Real Networks, 306 Real Producer, 307 receipts, New York’s MTA, 788–789 receivers re-programming car remotes, 775–776 satellite, 763, 764 Recording Industry Association of America (RIAA), 591, 593 recycling bins, hacking FirstClass in, 617 red box Bernie S saga, 531–534 converting tone dialer into, 439–441 defined, 24, 221 operation of, 442–443 phreaking with, 41–43 portrayal of in Hackers, 244 why it doesn’t work, 446–448 Reduced-Fare MetroCard (RFM), 785, 788–789 Regional Bell Operating Companies (RBOCs), 21–22, 92 registers, Wal-Mart, 712–713 registry getting rid of Back Orifice on, 295 getting rid of files, 286–287 Relationship accounts, Dell, 697 remote activation transmitters, 354–355 remote connections, COCOTs, 453 remote functions, Cellemetry, 435–438 remote listening post infinity device, 359 remote modem (dialup), 770 remote secrets, hacking, 773–777 Remote Source Control System (RSCS) protocol, 149 Remote Switching Unit (RSU) class, 45 remotes hacking Mercedes Benz with universal, 772 re-programming car, 772–776 Reno, Janet, 260 Repeat*Call, 460 report cards, UAPC, 134 reporters, dealing with, 262–265 reputation, journalistic, 264–265 resistors, telephone voltage, 25 Resource System Time Sharing Environment (RSTS/E), 127–129 Restil, Ian, 248–249 restoration to active duty, military, 625 retail hacking, 691–730 802.11b at Kroger’s, 700–702 Answers for Gateway, 729–730 Best Buy, 692–695 Blockbuster, 695–696 Circuit City, 702–704 Clarion Hotel, 718–720 Dell computers, 697–700 electronic applications, 720–721 Hilton Hotel, 716–718 Home Depot, 696–697 PayPal hurts, 725–729 Radio Shack, 704–706 retail hardware, 709–711, 714–716 soda machines, 721–722 861 94192bindex.qxd 6/3/08 3:29 PM Page 862 862 Index Target, credit card fraud, 708–709 on vacation, 722–725 Wal-Mart, 711–714 retinal scans, biometrics, 810 Return*Call, 461 RFC822 mail addresses, 152–155 RFID (Radio Frequency Identification), 749–751 RFM (Reduced-Fare MetroCard), 785, 788–789 RHS (Right Hand Side), RFC822 mail addresses, 153–155 RIAA (Recording Industry Association of America), 591, 593 Riggs, Robert, 509–510 Right Hand Side (RHS), RFC822 mail addresses, 153–155 ring trip, 26 ringing, telephone distinctive, 114 overview of, 26–27 step office sounds, 50 roaming GSM, 433 phone phreaks and, 108 reconfiguring cell phone to, 427 Robinson, Jr., Clarence A, 248 robots, brain-driven, 826 “Rock” satellite, XM Radio, 754–755 Rockoff, Alan, 185–186, 195 Rockwell Wescom, 67 Roosevelt, President, ROOT account, 754–755 ROOT account, COSMOS, 59 Roscoe Gang, 203 rotary phones, 24, 49–52 roulette wheels, 646–647 routers, and China’s firewalls, 803 RS-232 interface, 607–608, 767 RS-485 drop lines, 607–609, 611–612 RSA cryptography, 312 RSCS (Remote Source Control System) protocol, 149 RSTS/E (Resource System Time Sharing Environment), 127–129 RSU (Remote Switching Unit) class, 45 S S., Bernie see Bernie S (Ed Cummings) safety pins, lock picks, 778–780 Safeware, 162 Sandza, Richard, 225 SAT (Supervisory Audio Tone), cell phones, 427–428 satellite dishes, satellite TV, 762–763 Satelliteguys FTA/MPEG forum, 765 satellites Afghan phone system, 658–659 charges against Private Sector BBS, 189–190 how paging networks work, 345–346 nationwide paging, 344 TV broadcasts, 761–765 XM Radio signal transmission, 754–755 SBDN (Southern Bell Data Network), 509–510 SBS (Skyline), 66–69, 170–171 Scan, McAfee Associates, 292 scandisk, 286 SCANFILE.BAT file, 400–401 Scanner World, 102 scanners eavesdropping with, 116–118 pager decoding with, 346–347 paging for free with, 101–102 trunk trackers, 363 VHF marine telephone frequencies and, 424 virus, 290–293 scanning, importance of thorough, 218 scariest number in world story, 8–9 Schindler, David, 545 school hacking stories, 602–618 CampusWide, 604–612 FirstClass hacking, 615–618 school ID numbers, 614–615 student databases, 602–604 university of insecurity, 612–614 Scorch, 285 Scorpion, 526 scrambled transmitters, 355 scrambling data, 193 Screaming Fist II virus, 398–401 screensaver passwords, Radio Shack, 706 script kiddies, 648–650 Sdu voting machine, 807 searches, military law, 621 Sears Watch Service, 710–711 Second World War eavesdropping story, 4–5 secret detector units, E-Z Pass system, 328 secret numbers, COCOTs, 453 Secret Service Bernie S and, 532–538, 540–543 94192bindex.qxd 6/3/08 3:29 PM Page 863 Index pseudo-felon story and, 631–634 raid on Sherwood Forest, 197–198 raids on computers at teenagers`houses, 198–200 Steve Jackson Games lawsuit against, 496–497, 511 underground bulletin boards, 226 Secret Service and 2600 meetings, 512–522 advice, 519–522 fallout, 515–516 lawsuit against Secret Service, 517–518 mall police actions, 512–514 mania, 518–519 our plans, 516–517 overview of, 512 what it was all about, 514–515 Secrets of Lockpicking (Hampton), 778–780 secure delete programs, 285–287 Secure program, 293 security see also cryptography 802.11b networks, 737, 738 Busy Line Verification vulnerability, 464–466 cable modem holes in, 333–335 calling card flaws, 423–424 CampusWide flaws see CampusWide system cellular user flaws, 98–100 eavesdropping story, 4–5 freedom of speech restricted in name of, 594–596 hacker bulletin boards and, 224 hackers as checks to, 210–211, 384–387 MCI flaws, 463–464 neighborhood gate flaws, 419–420 obsession of society with, 832 overview of, 675–679 Pronto electronics flaws, 163–164 scanning calls for, 117 Simplex lock flaws, 315 university of insecurity story, 612–614 Vonage broadband risk, 686–687 security readers, CampusWide, 609–610 Select*Forward, 460 selectors dialing and, 49 step switching and, 50 Self Service System Software, 767 self vending readers, 610–612 sensormatic handheld deactivators, Wal-Mart, 714 September 11, 625–627 September 11, 2001, 625–627 series transmitters, 360 servers Back Orifice, 294 CampusWide, 605 Internet radio stations, 306 Service Provider ID (SIDH), 427 service tags, Dell BIOS chip, 698 Session Initiation Protocol (SIP), VoIP, 688 Shamir, Adi, 309 Sherwood Forest BBS raid, 197–198 Shimomura, Tsutomu fabrications in Takedown , 249–252 false charges against Kevin Mitnick, 529–530 protesting Takedown screenplay, 255 Shor, Peter W., 288 shotgun microphones, 350 Shredder, 287 SID (System ID), 108 SIDH (Service Provider ID), 427 signal, XM Radio, 755–756 Signal magazine, 248 signal transmission, XM Radio, 754–755 Signaling System (SS7) protocol, 673 signaling systems, 469–472 signature verification, biometrics, 810 signed response (SRES), GSM, 432 silver box defined, 24, 221 how to use, 31–32 operation of, 445 SIM (Subscriber Identity Module) cards activating post-pay phones, 677 activating pre-pay phones, 677 adding line to someone’s existing account, 678 authentication and encryption, 432–433 mobile station made up of, 431 overview of, 429–430 Simple Mail Transfer Protocol (SMTP), ARPANET, 152 simple transaction, CampusWide, 610–611 Simplex locks, 314–323 hacking, 317–323 illusion of security in, 314–317 single-coil relay, pay phones, 38 Single-Track MetroCard, 786 SIP (Session Initiation Protocol), VoIP, 688 Site Management Guide, 129–130 863 94192bindex.qxd 6/3/08 3:29 PM Page 864 864 Index size, surveillance tape recorders, 361 Skipjack, 309, 310–311 Skylarov, Dmitry, 595, 597–598 Skyline (SBS), 66–69, 170–171 slaves, surveillance, 358–359 sliver band transmitters, 356 Sloane, W Evan, 90 slugs, pay phones, 653 smart cards, and biometrics, 811 SMART system access, Wal-Mart, 713–714 Smartcard Developer Association, 434 SmartFilter, circumventing DOD’s, 628–630 Smartnet, 363 SMTP (Simple Mail Transfer Protocol), ARPANET, 152 sniffing cable modem security and, 334–335 detecting 802.11b networks, 734–735 social engineering CN/A operator susceptibility to, 48 hacking FirstClass, 616 hacking UAPC with, 136 installing Back Orifice using, 294 phone phreak story, 16–17 and pretexts, 828–830 spoofing Caller ID and ANI, 667–668 Social Security Numbers (SSNs), 612–614, 677–678 Socotel, 471 soda machines, hacking, 721–722 software ATM, 767 electronic message center, 769, 771–772 Voter Enumeration System, 806 software hacks, pay phones, 655 Software Piracy Association (SPA), 238–239 Software Publishers Association, and crime, 553 soul, 825 SoundBlaster compatible sound cards, 346 Southern Bell Data Network (SBDN), 509–510 Southwestern Bell, 83, 92 Soviet Union phone system, 90–91 as a surveillance society, 683 SPA (Software Piracy Association), 238–239 Speaker-Verification API (SVAPI) standard, 811 special court-martial, military law, 621–622 Special MetroCard, 786 speech-scramblers, speed enforcement, vehicles, 328–330 speed number recording, long-distance, 67 spike microphones, 351 spoofing ANI and Caller ID, 664–669 cellular IDs, 91 spot beaming signals, 754 spread spectrum transmitters, 355 Sprint backbone provider, 303 Spyrus, 312 SRES (signed response), GSM, 432 SS Decoder, XM Radio, 756 SS7 (Signaling System 7) protocol, 673 SSID cloaking, 736–737 SSNs (Social Security Numbers), 612–614, 677–678 ST (STart) tone, in-band signaling, 28 STA450 source decoder, 755–756 standard cards MetroCards vs., 788 New York’s MTA, 786 standard readers, New York’s MTA, 786 standards 1987 FAX, 144–145 biometric, 811 standing wave ratio (SWR) meter, 760 Stasi secret police, 683 State Lottery Commission, 648 statistics, lottery, 781–783, 784–785 Steal This Book (Hoffman), 655 step crashing, 51 step offices, 49–52 Steve Jackson Games harrassment of, 492 lawsuit against Secret Service, 511 negative feedback on, 506–507 raid on, 496–497 Stevens, Fisher, 244–245 STM CD, Dell, 699 stories, 1980s, 3–19 American Express phone, 18–19 eavesdropping, 4–5 first atomic bomb, 5–7 friends in high places, 55–56 from hacker world, numbers see numbers, stories about phone phreak, 16–17 trashing, 17–18 94192bindex.qxd 6/3/08 3:29 PM Page 865 Index stories, 1990s birth of low-tech hacker, 382–384 confessions of beige boxer, 408–414 downsizing insurance, 414–418 Ghost Board, 397–398 growth of low-tech hacker, 390–392 hacker’s day, 398–401 hacking for the military, 405–408 letter from prison, 387–390 neighborhood security gates, 419–420 study of hackers, 392–396 view of Fed, 384–387 war dialing, 401–405 stories, 2000 and beyond, 601–650 aftermath of September 11, 625–627 Anna Kournikova virus, 639–640 backdoor exits from U.S Military, 627–628 CampusWide, 604–612 catching my cheating girlfriend, 637–639 circumventing DOD’s SmartFilter, 628–630 examining student databases, 602–604 FirstClass hacking, 615–618 future of computing, 642–644 getting busted military style, 619–625 hacker goes to Iraq, 618–619 ISP story, 648–650 looking back, 640–641 making of pseudo-felon, 630–634 observing lottery, 646–648 overview of, 601 ParadisePoker.com blackjack, 644–646 school ID numbers, 614–615 university of insecurity, 612–614 warning from caught uncapper, 634–636 strobe light, Chrome Box, 324 Strowger system, step office, 51–52 Student Database story, 602–604 Student ID stories CampusWide cards, 606–607 FirstClass hacking, 615–618 fun with numbers, 614–615 student databases, 602–604 university of insecurity, 612–614 stunts, teleconferencing, 80–81 subcarrier transmitters, 356 subdirectories, and viruses, 291 Subscriber Identity Module see SIM (Subscriber Identity Module) cards success, threat of, 268–271 Summercon, 512 Sun Microsystems, 549 Superpages, 748 Supervisory Audio Tone (SAT), cell phones, 427–428 support.dell.com, 699 surreptitious interception, 98 surveillance, Soviet Union, 683 surveillance devices, 349–362 carrier current devices, 356–357 Digital Telephony Bill, 559–561 hardwired room microphones, 351–352 infinity transmitters, 357–358 long-range listening devices, 350 miniature tape recorders, 361–362 reasons to learn, 349 slaves and loop extenders, 358–359 takeover of nation’s phone system, 559–561 telephone traps and transmitters, 359–360 through-wall listening devices, 350–351 transmitters (bugs), 352–356 in twenty-first century, 683–686 SVAPI (Speaker-Verification API) standard, 811 SWAGIMA, 66 swap files, 286 Swisscom, 434 switches Afghan phone system, 658 GSM, 431–432 long-distance, 67 satellite TV, 763 switching centers, 45–46 step switching and, 50 SWR (standing wave ratio) meter, 760 SYSNAM privilege, VMS systems, 132 Sysops charges against Private Sector BBS, 194–197 protecting themselves, 192–194 SYSTAT (SY), 124–125, 128 SYSTEM accounts, VMS systems, 131 System ID (System ID), 108 SystemOne software, 769 T T (tip) telephone wires, 24 “table ready” signal, 723–724 Takedown (film) fabrications in, 249–252 “Free Kevin” campaign, 252–253 865 94192bindex.qxd 6/3/08 3:29 PM Page 866 866 Index overview of, 250–253 re-writing of screenplay, 235, 254–255 Talk Cents, 484 Talkabout, 89 Talking Greeting Card, hacking, 339 tandem, 490 TAP publication, 229–230 phreakers and, 23 tapping modem lines, 136 TAPR (Tucson Amateur Packet Radio), 368–369 taps keyboard, 383 telephone, 359–360 Target, credit card fraud, 708–709 TASI (Time Assignment Speech Interpolation), 189–190 TCAP (Transaction Capabilities Application Part), 432 Tcimpidis, Tom, 211–213 TCP RST (reset connection), China’s Internet, 803–804 TCP/IP protocol, 148–149, 151–152, 771 TDMA (Time Division Multiple Access) frames, GSM, 431, 432 tech support Answers for Gateway, 729–730 Dell, 697–699 technology, 574 addressing side-effects of, 552 corporations scared by new, 581 hackers vs criminals, 553–554 positive developments towards, 596–599 restrictions on new, 565 teenagers, Secret Service raids on, 198–200 telecommunications and fraud, 221–223 privacy and, 115–116 Telecommunications Act of 1996, 581 telecommunications toys, 1980s 800 number allocation, 92–93 Airfone, 93 catching phone phreaks, 109–112 cellular phone companies, 92 cellular phones, fraud, 103–108 cellular phones, fraud bust, 97–98 cellular phones, how they work, 85–89 cellular phones, phreaking, 91–92 Electronic Communications Privacy Act, 98–100 equal access, 93–97 forbidden frequencies, 100–101 IBM audio distribution systems, 69–71 long distance, 66–69 Ma Bell breakup, 71–73 overview of, 65–66 paging for free, 101–102 phone choices, 89–92 Radio Shack PRO-2004 scanner, 100–101 results of divesture, 82–85 scanning for calls, 116–118 telecom informer, 113–116 teleconferences, 76–82 Travelnet, 73–76 telecommunications toys, 21st century, 732–830 31337SP34K, 816–817 3D glasses, 812–816 802.11b networks, 733–739 biometrics, 809–812 Captivate networks, 743–744 elections, 805–809 electronic message centers, 768–772 firewall of China, 801–805 genome, 820–824 Google AdWords, 795–801 honeypots, 818–820 lock picks, 777–780 lottery, 780–785 Mercedes Benz with universal remote, 772 NCR ATMs, 765–768 neighbors’ networks, 739–743 New York’s MTA see New York’s MTA overview of, 732 pirate radio primer, 758–761 real electronic brain implantation enhancement, 824–828 remote secrets, 773–777 RFID, 749–751 satellite TV broadcasts, 761–765 social engineering and pretexts, 828–830 WAP, 747–749 WiFi and MITM, 744–746 XM Radio, 753–758 teleconferences, 7, 11–15 teleconferences, running successful, 76–82 conference controls, 78–79 conference numbers, 76–78 dangers, 79 other conferences, 81 94192bindex.qxd 6/3/08 3:29 PM Page 867 Index overview of, 76–77 stunts, 80–81 Telemail see GTE Telemail Telemetrac, 436 Telemetry, 435 Telephone Exchange Name Project, 485 telephone line surveillance devices carrier current devices, 357 infinity transmitters, 357–358 microphones, 352 slaves and loop extenders, 358–359 taps and transmitters, 359–360 telephones making of pseudo-felon, 630–634 traps and transmitters, 359–360 telephones, in 1990s, 421–490 area code system, 486–487 Caller ID, 458–463 COCOTs see COCOTs (Customer Owned Coin Operated Telephones) long-distance charges, 487–490 MCI gimmicks, 463–464 mega-mergers, 482 naming exchanges, 484–486 overview of, 421–422 pay phones, 482–483 phone rates, 483–484, 487 phreaking in the nineties, 466–472 privacy hole, 464–466 special call numbers, 483 toll fraud, 478–481 voicemail hacking, 472–478 wireless see wireless communications telephones, in 21st century, 651–689 in Afghanistan, 657–659 ANI and Caller ID spoofing, 664–669 answering machine hacking, 659–662 backspoofing, 672–675 future of enhanced 911, 681–683 getting more from T-Mobile, 675–679 hacking three holed pay phones, 652–655 idiocy in the Telcos, 655–657 surveillance in twenty-first century, 683–686 tracking any U.K GSM mobile phone, 679–680 Verizon’s Call Intercept service, 669–672 VoIP cell phones, 687–689 Vonage broadband security risk, 686–687 telephones, stories see also Ma Bell 9999 numbers, 9–11 first atomic bomb, 5–7 hacking American Express, 18–19 phone phreak scores, 16–17 scariest number in world, 8–9 teleconferencing saga, 11–15 WW II eavesdropping, 4–5 Tele-Tria, 224–225 Telnet, 121–122, 152 @ Telnet prompt, 121–122 Temporary Mobile Subscriber Identity (TMSI) number, 430, 432, 433 terminals, pager, 341 terminology hacker, New York’s MTA, 785–786 Terms of Service (ToS), Google AdWords, 797–798 terrorism combating, 562 feeding frenzy of, 662–663 Tessera Cryptographic Card, 310 test calls, spoofing Caller ID and ANI, 667–668 TFPC (Toll Fraud Prevention Committee), 478–479, 480–481 The Art of Deception (Mitnick), 829 The Cuckoo’s Egg (Stoll), 235–236, 819 The Fugitive Game (Littman), 245–247 The Good, The Bad, and the Ugly (film), 239 The Hacker Crackdown (Sterling), 245 The Net (film), 242–243 The New Republic journal, 248 The New York Times web page hack, 255–256 The Phoenix Project (bulletin board), 496–497 The Point, 499 The Whiz Kids (TV program), 210 The Whole Spy Catalog, 532 third number billing fraud, 478 Thomas, Carleen, 559, 563 Thomas, Robert, 559, 563 threats, Internet, 662–663 three holed pay phones, hacking, 652–655 Three Strikes Law, California, 435, 579 through-wall listening devices, 350–351 TIA (Total Information Awareness), 598–599 Time Assignment Speech Interpolation (TASI), 189–190 Time Division Multiple Access (TDMA) frames, GSM, 431, 432 867 94192bindex.qxd 6/3/08 3:29 PM Page 868 868 Index time-to-live (TTL) parameter, China’s Internet, 803–804 tip (T) telephone wires, 24 TIPS system, 598 T-Mobile, 675–679 TMSI (Temporary Mobile Subscriber Identity) number, 430, 432, 433 toll fraud diverter, 62 incoming international collect, 479–481 Telco investigating, 25 Toll Fraud Prevention Committee, 478–479 Toll Fraud Prevention Committee (TFPC), 478–479, 480–481 toll passes (transponders or tags), 328 toll-free numbers charging owners for calls from pay phones, 487 spoofing ANI to, 668 tone dialer, converting into red box, 439–441 Tone*Block, 461 tones, coin signal pay phone, 36–37 ToS (Terms of Service), Google AdWords, 797–798 Total Information Awareness (TIA), 598–599 TouchPaks, 723–724 touch-tone decoders, 412 touch-tone entry, pagers, 341 touch-tone phones AUTOVON and silver boxes, 31–32 common control and, 49 hardwiring, 33–34 wiring, 24 traceroute, Internet peering, 303 Traffic Service Position System (TSPS) operators, 36, 47 Transaction Capabilities Application Part (TCAP), 432 transaction reversals, PayPal, 725–729 transceivers, cellular phone, 104 transcripts, UAPC, 134 transgenes, 821–823 transgenic organisms, creating, 820–823 transmitters, 352–358 advanced modulation, 355 advanced telephone, 360 battery-powered, 354 crystal-controlled, 354 free-running oscillators, 354 frequency hopping, 355 infinity, 357–358 mains powered, 354 narrow band, 356 parallel, 360 radio piracy using, 759–761 remote-activated, 354–355 re-programming car remotes, 775–777 scrambled, 355 series, 360 sliver band, 356 spread spectrum, 355 subcarrier, 356 UHF, 353 VHF, 353 VOX-activated, 354–355 wafer, 353 wideband, 355 trap and trace, step offices, 50 trashing story, 17–18 Travelnet, 73–76 Trillian Pro multinetwork chat program, 749 trojans see viruses and trojans trunking communications monitoring, 362–364 trunks, in-band signaling, 27–28 Truphone, VoIP, 688–689 trustees, military prisons, 624 TRW computer, 190, 211–213 TSK extension, RSTS/E, 129 TSPS (Traffic Service Position System) operators, 36, 47 TTL (time-to-live) parameter, China’s Internet, 803–804 TTY’s (Teletypewriters), 48 tube microphones, 351 Tucson Amateur Packet Radio (TAPR), 368–369 turnstiles, New York’s MTA, 789 TV broadcasts, hacking satellite, 761–765 two-way communication pagers, 345 TXT command, DEC-20, 124–125 U U K (United Kingdom), tracking GSM phones, 679–680 UAF (User Authorization File), hacking into VMS systems, 129 UAPC (University Applications Processing Center), 132–139 about Wylbur, 136–137 applications that run on, 137–138 94192bindex.qxd 6/3/08 3:29 PM Page 869 Index changing grades, 138–139 defining, 132–133 finding out if your school is on, 134 getting password, 135–136 location of, 133 logging onto, 134–135 technical information about, 133–134 U.C.M.J (Uniform Code of Military Justice), 620 UHF transmitters, 353 UMA (Unlicensed Mobile Access) chips, VoIP using, 688 uncapping, 634–636 Unican/Simplex locks see Simplex locks Uniden Bearcat trunked systems, 363 United Kingdom (U.K.), tracking GSM phones, 679–680 United States Court of Appeals for the Armed Forces, 623 United States Post Office see USPS (United States Postal Service) units, pager, 340 Universal Express tickets, hacking, 722–723 universal remotes, hacking Mercedes Benz, 772 Universal Studios/Islands of Adventure, 722–723 universities see school hacking stories University Applications Processing Center see UAPC (University Applications Processing Center) UNIX, imitating for hackers, 392–396 Unix to Unix Copy Programs (UUCP) network, 149–152, 154 UNREAD command, Telemail, 124 unshredding evidence, 378–379 UPS dropboxes, 316 Urban Fortress phones, 655 URL History, getting rid of files, 286 U.S Sprint, 222–223 U.S Telecom, 94 U.S West, 83 U.S.D.B (United States Disciplinary Barracks), 623–624 User Authorization File (UAF), hacking into VMS systems, 129 usernames accessing Internet radio stations, 306 DEC-20, 124–125 hacking into MCI Mail, 160–161 hacking into VMS systems, 130 Watson system at T-Mobile stores, 676 USNet system, 642–644 USPS (United States Postal Service), 372–377 Bar Code Sorter, 375 FIMs, 374 Letter Sorting Machine, 374–375 mail hacks and, 376–377 MARK-facer canceler, 373 Multiline Optical Character Reader, 375 overview of, 372–373 POSTNET, 373 UTF-8 format, and China’s firewalls, 804 UUCP (Unix to Unix Copy Programs) network, 149–152, 154 UUNet, 305 V V4 boxes, electronic message centers, 769 vacation, hacking on, 722–725 valet switch, programming car remotes, 774 Value Transfer Stations, 610–612 Varney, Thomas, 533, 540–541, 543 VAXes, 129–132, 159 VCO (voltage controller oscillator) transmitter, 759–761 Vectorone Cellular, 117 vending machines, New York’s MTA, 788 Verifone PinPad 1000, 709–710 Verizon anti-cybersquatting act and, 583–584 Call Intercept, 669–672 registration of 706 domain names, 583 VES (Voter Enumeration System), 806 VHF transmitters, 353 video enforcement of speed, 329 video standards, satellite TV, 762 Vietnam War, 221, 230 virtual memory, getting rid of files, 285 Virus: Protection, Prevention, Recovery (Commonwealth Films), 239 viruses and trojans, 289–296 Back Orifice tutorial, 294–296 Gulf War printer virus, 289–290 overview of, 289 virus scanners exposed, 290–293 Visitor Location Register (VLR), GSM, 431–434 VLR (Visitor Location Register), GSM, 431–434 VMBs (voice mailboxes) see voicemail hacking VMS systems, 129–132 869 94192bindex.qxd 6/3/08 3:29 PM Page 870 870 Index voice actuation circuit (VOX) transmitters, 354–355, 359 Voice over Internet Protocol see VoIP (Voice over Internet Protocol) cell phones voice pagers, 340 voice verification, biometrics, 810 voicemail hacking, 472–478 box takeover, 475 common defaults, 477–478 finding login sequence, 473 finding valid boxes on system, 472–473 finding virgin VMB system, 472 getting in, 474 scanning boxes from inside, 474–475 system identification, 475–477 voice-paging systems, for free, 101–102 VoIP (Voice over Internet Protocol) cell phones backspoofing using, 672–675 hackers and, 490 overview of, 687–689 Vonage broadband security risk, 686–687 voltage controller oscillator (VCO) transmitter, 759–761 voltages, telephone detecting black boxes, 25 overview of, 25 ringing and, 26 Vonage broadband security risk, 686–687 Voter Enumeration System (VES), 806 VOX (voice actuation circuit) transmitters, 354–355, 359 W wafer transmitters, 353 Walkman, pay phone abuse, 41 Wal-Mart Customer Activated Terminal, 711–712 hacking retail hardware at, 710 pharmacy computers, 714 registers, 712–713 sensormatic handheld deactivators, 714 SMART system access, 713–714 WAP (Wireless Access Protocol), 747–749 WAP Proxy, 747–748 War Games, 22, 211, 214, 223 war on drugs, 683 war zone stories see military and war zone hacking stories warranty, Dell computers, 698–700 Washburn, Mark, 293 WATS service, 111, 173–175 Watson system, T-Mobile stores, 675–679 WC (wire center), 59 WDW (Walt Disney World), Fast Pass, 722–723 We Lost Control: Illegal Software Duplication (Commonwealth Films), 238–239 Wellenreiter, 735 WEP (Wired Equivalence Protection) changing keys, 743 defined, 733–734 discovering with Kismet, 740 myth and truth of, 736 Western Electric/AT&T phones, 39 Western Union (Metrofone), 66–69, 94 white box, 445 wideband transmitters, 355 WiFi (wireless fidelity), 733, 744–746 Wildcat BBSs, 400–401 Wildfeeds, satellite TV, 764 WIN system, 76 win386.swp file, 285–286 WinAMP with AVS Studio, 812–816 Windows Active Directory policies, 746 Windows Help vulnerability, Best Buy, 693 Windows registry, 286 winks, step offices and, 50 wire center (WC), 59 Wired Equivalence Protection see WEP (Wired Equivalence Protection) Wireless Access Protocol (WAP), 747–749 wireless communications Cellemetry, 435–438 cellular phones, 425–428 coding scheme of boxes, 441–445 converting tone dialer into red box, 439–441 GSM see GSM (Global System for Mobile Communications) listening in, 423–424 news items, 434–435 overview of, 422 telephones see cellular phones why redboxing doesn’t work, 446–448 wireless fidelity (WiFi), 733, 744–746 Wireless Mapquest, 748 Wireless Markup Language (WML), 748 wireless mesh, 737–738 wireless toys of 21st century, 732–765 exploring neighbor’s network, 739–743 94192bindex.qxd 6/3/08 3:29 PM Page 871 Index guide to 802.11b networks, 733–739 hacking Captivate network, 743–744 overview of, 732 pirate radio primer, 758–761 RFID, 749–751 satellite TV broadcasts, 761–765 WAP, 747–749 WiFi and MITM, 744–746 XM Radio, 753–758 wires, worn for surveillance, 352–353 wiretapping building into digital phone systems, 552 honeypots akin to, 819 legalities of phone company, 555 obtaining evidence in hacker investigations, 524 surveillance using, 359–360 wiring, telephone, 24–25 WML (Wireless Markup Language), 748 workstations, CampusWide, 606 Worldnet, 151–155 ARPANET and, 151–152 basic concepts, 151 BITNET and, 151–152 others, 153 reading network addresses, 153–155 UUCP and, 152 Wozniak, Steve, 632–633 Wylbur shell, 133, 136–137 X XM Radio, 753–758 activation, 757 compression, 756 encryption, 756 exploitation, 757 further strain, 757–758 future of, 758 myths about, 754 signal, 755–756 signal transmission, 754–755 XORed (XORed) burst period, 432 Y yellow box, 443–444 YIPL (Youth Independent Party Line) newsletter, 221, 229 Z Zener diode, 25 ZIF (Zero Insertion Force) DIP socket, 107 Zinn Jr., Herbert, 203–206 ZIP+4 code, POSTNET, 373 zones, world phone, 467–468 Zudic Plea, 538 Zyklon, 567–569 ZZTop program, Dell, 699 871 ... that can often lead to great things There was a bit of a hacker in all of these great minds Of course, Alexander Graham Bell was another of those people that we all look up to, both inside and... sort of thing, a fact that hackers used to their advantage time and again In the hacker world, you can have adventures and obtain information on a whole variety of levels, using such methods as... the other staff members and found that there had been some confusion because of the rain None of them had been able to reach the others because the telephone operator had fallen asleep, and the