[CONTACT]

[ABOUT]

[POLICY]

ANYNONMOUS DURING THE PAST EIGHT HA

Found at: 0x1bi.net:70/textfiles/file?hacking/stupidki.hac


FROM: A ANYNONMOUS SOURCE.

DURING THE PAST EIGHT YEARS, I HAVE BEEN HEAVILY INVOLVED WITH "BULLETIN
BOARD" SYSTEMS RUNNING ON MICROS AND MAINFRAMES. I'D LIKE TO GIVE A FEW
EXAMPLES OF THE DESTRUCTIVENESS OF MANY OF THESE "KIDS."

MOST HAVE PROBABLY HEARD OF OR CALLED AN RCP/M.  FIVE YEARS AGO, I WROTE A
SIMILAR TYPE SYSTEM FOR A TRS-80.  THIS SOFTWARE RAN FOR 3.5 YEARS WITHOUT
A PROBLEM.  BUT NOW, AS MORE AND MORE POTENTIAL CRACKERS HAVE ACCESS TO
COMMUNICATIONS EQUIPMENT, THIS SYSTEM HAS BEEN CRASHED REPEATEDLY.

WHEN I WAS BACK IN HIGH SCHOOL, THE BIG THING WAS TO FIND A BUG IN THE OS.
BUT, ONCE WE FOUND IT, INSTEAD OF USING IT TO KEEP THE SYSTEM FLAT ON ITS
BACK, WE DOCUMENTED IT AND SOMETIMES EVEN FIXED IT.  DOESN'T SEEM LIKE THAT

ON THIS SYSTEM, SOME CALLER BREAKS IN, DELETES ALL THE FILES, AND THEN
WRITES A PROGRAM WHICH KEEPS THE DRIVES SELECTED; THIS BURNS OUT THE MOTORS
ON 5.25" DRIVES, ESPECIALLY WHEN THEY RUN ALL NIGHT.  THIS WAS DONE SO
OFTEN, THE SYSTEM WAS BROUGHT DOWN FOR A LONG TIME (UNTIL A TRACE COULD BE

AND MESSAGE SYSTEM.  I HAVE SAT AND WATCHED CALLERS SYSTEMATICALLY ATTACK
THE SYSTEM.  THIS TAKES SEVERAL FORMS:


GET SOME UNEXPECTED RESULT.

THEY COULD GET SOMEWHERE.

  IF THAT DOESN'T WORK, THEY BEGIN TO CRACK PASSWORDS.  THEY KNOW WHAT THEY ARE
DOING...  IN ONE CASE, I WATCHED AS SOMEONE WENT THROUGH WHAT LOOKED LIKE THE
BEGINNING OF THE WEBSTER'S DICTIONARY TRYING TO GET SUPERUSER STATUS.  SINCE
MOST PEOPLE USE WORDS, NOT A BAD IDEA, RIGHT?  LESS INTELLIGENT ONES START WITH
A AND JUST TRY AND TRY AND TRY.

OH, BY THE WAY, THEY ARE DEFINITELY USING AUTO-DIAL MODEMS AND SOFTWARE TO
DO THIS.

  IF ALL ELSE FAILS, THEY SIMPLY TIE UP THE SYSTEM.  THEY CHOOSE THE MOST
OBVIOUSLY DISK INTENSIVE COMMAND, AND EXECUTE IT AGAIN AND AGAIN.  SINCE MANY
SYSTEMS ONLY TIMEOUT AFTER INACTIVITY, THIS COULD TIE UP THE SYSTEM FOR MANY
HOURS (NOT TO MENTION THE WEAR AND TEAR ON THE EQUIPMENT).

THESE LITTLE BASTARDS CERTAINLY AREN'T DOING ANYTHING CONSTRUCTIVE.

  SEVEN YEARS AGO, I CALLED UP MIT-MC AND GOT A TOURIST ACCOUNT WHICH I KEPT
FOR THREE YEARS UNTIL I GOT AN AUTHORIZED ONE.	IT WAS A FREE ACCOUNT ON AN
OPEN SYSTEM; THE ONLY STRINGS WERE THAT I USE IT AFTER HOURS AND NOT TIE UP TOO
MANY RESOURCES.  BUT THINGS HAVE CHANGED.  YOU CAN'T HAVE TOTALLY OPEN SYSTEMS
ANYMORE WITHOUT MANY PRECAUTIONS AND ALMOST CONSTANT SUPERVISION.

FOR EXAMPLE, I HAVE HAD TO ADD MANY SECURITY FEATURES TO THESE SMALL
SYSTEMS:

USERNAME WITHOUT A CORRECT LOGIN CAUSES A SUSPENSION . ANYONE TRYING TO
LOGIN UNDER THAT NAME IS IMMEDIATELY SUSPENDED (WITH SOME EXCEPTIONS).


FEATURES, OR EVEN USE THE SYSTEM.

THE POINT OF MODIFYING THE DOS TO HANG OR RESET WHEN NECESSARY.

  I DO HAVE ONE LITTLE "JOKE" UP MY SLEEVE.  THERE IS AN ACCOUNT ON THESE
SYSTEMS CALLED SYSOP.  NOW, IF I WAS GOING TO BREAK IN, THAT IS WHERE I WOULD
START.	I'VE PUT A LITTLE PATCH INTO MY HOST.  AFTER 39 INCORRECT TRIES ON THAT
ACCOUNT, IT ALLOWS THE CALLER THROUGH.	HE GETS A WELCOME MESSAGE AND SYSOP
COMMAND:.  HE CAN RENUMBER MESSAGES, CHANGE THE DATE AND TIME, EVEN DELETE FROM
THE DIRECTORY, CHANGE USERNAMES AND PASSWORDS.	HE CAN DO ALL THE THINGS THAT A
SYSOP CAN DO.  OF COURSE, HE ISN'T *REALLY* DOING ANYTHING (HE HE HE!) AFTER,
OH SAY, 10 MINUTES, OUTPUT STOPS.  24 LINEFEEDS ARE ISSUED AND THE FOLLOWING
APPEARS (SLOWLY, AS IF FROM A TTY):

    HELLO INTRUDER!  GEE, I WANT TO THANK YOU FOR HANGING AROUND FOR
    THE PAST TEN MINUTES WHILE WE HAD A CHANCE TO TRACE YOUR CALL.  IT
    IS TOO BAD THAT SOME PEOPLE JUST CAN'T LIVE RESPONSIBLY.  BUT, I
    GUESS THAT IS THE REASON WE HAVE THE POLICE AND FBI, RIGHT?
    [DISCONNECT]

  I DON'T KNOW WHAT THE ANSWER IS, BUT I DO KNOWS THAT TREATING THIS TYPE OF
BEHAVIOR CASUALLY MUST BE STOPPED.  THERE WILL ALWAYS BE PEOPLE WHO WILL TRY TO
CIRCUMVENT ALL SECURITY MEASURES, SOMETIMES OUT OF CURIOUSITY, BUT RECENTLY
MORE OFTEN WITH THE INTENTION OF DOING SOMETHING DESTRUCTIVE.

  IT'S TOO BAD THAT THE DAYS OF THE UNSECURED SYSTEMS IS COMING TO A CLOSE, BUT
WITH HUNDREDS OF PEOPLE SCANNING THE EXCHANGES WITH THEIR AUTO-DIAL MODEMS
LOOKING FOR CARRIERS, ARMED WITH 10 PAGES OF PIRATED MCI ACCESS CODES, WE DON'T
HAVE MUCH CHOICE.

Downloaded From P-80 International Information Systems 304-744-2253


AD: