Underground: Hacking, madness and obsession on the electronic frontier Part 47

Mendax flipped through page after page of MILNET's security reports on his screen. Most looked like nothing--MILNET users accidentally stumbling over a security tripwire--but one notice from a US military site in Germany stood out. It was not computer generated. This was from a real human being. The system admin reported that someone had been repeatedly trying to break into his or her machine, and had eventually managed to get in. The admin was trying, without much luck, to trace back the intruder's connection to its point of origin. Oddly, it appeared to originate in another MILNET system.

Riffling through other files, Mendax found mail confirming that the attack had indeed come from inside MILNET. His eyes grew wide as he read on. US military hackers had broken into MILNET systems, using them for target practice, and no-one had bothered to tell the system admin at the target site.

Mendax couldn't believe it. The US military was hacking its own computers. This discovery led to another, more disturbing, thought. If the US military was hacking its own computers for practice, what was it doing to other countries' computers?

As he quietly backed out of the system, wiping away his footprints as he tip-toed away, Mendax thought about what he had seen. He was deeply disturbed that any hacker would work for the US military.

Hackers, he thought, should be anarchists, not hawks.

In early October 1991, Mendax rang Trax and gave him the dial-up and account details for NMELH1.

Trax wasn't much of a hacker, but Mendax admired his phreaking talents. Trax was the father of phreaking in Australia and Trax's Toolbox, his guide to the art of phreaking, was legendary. Mendax thought Trax might find some interesting detailed information inside the NorTel network on how to control telephone switches.

Trax invented multi-frequency code phreaking. By sending special tones--generated by his computer program--down the phone line, he could control certain functions in the telephone exchange. Many hackers had learned how to make free phone calls by charging the cost to someone else or to calling cards, but Trax discovered how to make phone calls which weren't charged to anyone. The calls weren't just free; they were untraceable.

Trax wrote 48 pages on his discovery and called it The Australian Phreakers Manual Volumes 1-7. But as he added more and more to the manual, he became worried what would happen if he released it in the underground, so he decided he would only show it to the other two International Subversive hackers.

He went on to publish The Advanced Phreaker's Manual,2 a second edition of the manual, in The International Subversive, the underground magazine edited by Mendax:

An electronic magazine, The International Subversive had a simple editorial policy. You could only have a copy of the magazine if you wrote an 'article'. The policy was a good way of protecting against nappies--sloppy or inexperienced hackers who might accidentally draw police attention. Nappies also tended to abuse good phreaking and hacking techniques, which might cause Telecom to close up security holes. The result was that IS had a circulation of just three people.

To a non-hacker, IS looked like gobbledygook--the phone book made more interesting reading. But to a member of the computer underground, IS was a treasure map. A good hacker could follow the trail of modem phone numbers and pa.s.swords, then use the directions in IS to disappear through secret entrances into the labyrinth of forbidden computer networks. Armed with the magazine, he could slither out of tight spots, outwit system admins and find the treasure secreted in each computer system.

For Prime Suspect and Mendax, who were increasingly paranoid about line traces from the university modems they used as launchpads, Trax's phreaking skills were a gift from heaven.

Trax made his great discovery by accident. He was using a phone sprinter, a simple computer program which automatically dialled a range of phone numbers looking for modems. If he turned the volume up on his modem when his computer dialled what seemed to be a dead or non-existent number, he sometimes heard a soft clicking noise after the disconnection message. The noise sounded like faint heartbeats.

Curious, he experimented with these strange numbers and soon discovered they were disconnected lines which had not yet been rea.s.signed. He wondered how he could use these odd numbers. After reading a doc.u.ment Mendax had found in Britain and uploaded to The Devil's Playground, another BBS, Trax had an idea. The posting provided information about CCITT #5 signalling tones, CCITT being the international standard--the language spoken by telephone exchanges between countries.

When you make an international phone call from Australia to the US, the call pa.s.ses from the local telephone exchange to an international gateway exchange within Australia. From there, it travels to an exchange in the US. The CCITT signalling tones were the special tones the two international gateway exchanges used to communicate with each other.

Telecom Australia adapted a later version of this standard, called R2, for use on its own domestic exchanges. Telecom called this new standard MFC, or multi-frequency code. When, say, Trax rang Mendax, his exchange asked Mendax's to 'talk' to Mendax's phone by using these tones. Mendax's exchange 'answered', perhaps saying Mendax's phone was busy or disconnected. The Telecom-adapted tones--pairs of audio frequencies--did not exist in normal telephone keypads and you couldn't make them simply by punching keys on your household telephone.

Trax wrote a program which allowed his Amstrad computer to generate the special tones and send them down the phone line. In an act many in the underground later considered to be a stroke of genius, he began to map out exactly what each tone did. It was a difficult task, since one tone could mean several different things at each stage of the 'conversation'

between two exchanges.

Pa.s.sionate about his new calling, Trax went tras.h.i.+ng in Telecom garbage bins, where he found an MFC register list--an invaluable piece of his puzzle. Using the list, along with pieces of overseas phreaking files and a great deal of painstaking hands-on effort, Trax slowly learned the language of the Australian telephone exchanges. Then he taught the language to his computer.

Trax tried calling one of the 'heartbeat' phone numbers again. He began playing his special, computer-generated tones through an amplifier. In simple terms, he was able to fool other exchanges into thinking he was his local Telecom exchange. More accurately, Trax had made his exchange drop him into the outgoing signalling trunk that had been used to route to the disconnected phone number.

Trax could now call out--anywhere--as if he was calling from a point halfway between his own phone and the disconnected number. If he called a modem at Melbourne University, for instance, and the line was being traced, his home phone number would not show up on the trace records. No-one would be charged for the call because Trax's calls were ghosts in the phone system.

Trax continued to refine his ability to manipulate both the telephone and the exchange. He took his own telephone apart, piece by piece, countless times, fiddling with the parts until he understood exactly how it worked. Within months, he was able to do far more than just make free phone calls. He could, for instance, make a line trace think that he had come from a specific telephone number.

He and Mendax joked that if they called a 'hot' site they would use Trax's technique to send the line trace--and the bill--back to one very special number. The one belonging to the AFP's Computer Crime Unit in Melbourne.

All three IS hackers suspected the AFP was close on their heels.

Roving through the Canberra-based computer system belonging to the man who essentially ran the Internet in Australia, Geoff Huston, they watched the combined efforts of police and the Australian Academic and Research Network (AARNET) to trace them.

Craig Warren of Deakin University had written to Huston, AARNET technical manager, about hacker attacks on university systems. Huston had forwarded a copy of the letter to Peter Elford, who a.s.sisted Huston in managing AARNET. The hackers broke into Huston's system and also read the letter:

From [email protected] Mon Sep 23 09:40:43 1991

Received: from [150.203.6.67] by jatz.aarnet.edu.au with SMTP id AA00265 (5.65+/IDA-1.3.5 for pte900); Mon, 23 Sep 91 09:40:39 +1000

Date: Mon, 23 Sep 91 09:40:39 +1000

Message-Id: [email protected]>

To: [email protected]

From: [email protected]

Subject: Re: Visitors log Thursday Night--Friday Morning

Status: RO

Date: Sun, 22 Sep 91 19:29:13 +1000

From: Craig Warren

Just to give you a little bit of an idea about what has been happening since we last spoke...

We have communicated with Sgt Ken Day of the Federal Police about 100 times in the last week. Together with our counterparts from Warrnambool traces have been arranged on dial-in lines and on Austpac lines for the capella.cc.deakin.OZ.AU terminal server which was left open to the world.

On Friday afternoon we were able to trace a call back to a person in the Warrnambool telephone district. The police have this persons name.

We believe others are involved, as we have seen up to 3 people active at any one time. It is 'suspected' students from RMIT and perhaps students from Deakin are also involved.

When I left on Friday night, there was plenty of activity still and the police and Telecom were tracking down another number.

Tomorrow morning I will talk to all parties involved, but it is likely we will have the names of at least 2 or 3 people that are involved. We will probably shut down access of 'cappella' to AARNet at this stage, and let the police go about their business of prosecuting these people.

You will be 'pleased' (:-)) to know you have not been the only ones under attack. I know of at least 2 other sites in Victoria that have had people attacking them. One of them was Telecom which helped get Telecom involved!

I will brief you all in the next day or so as to what has happened.