Underground: Hacking, madness and obsession on the electronic frontier Part 10

Positioning oneself to win an invite into the Inner Sanctum was a game of strategy; t.i.tillate but never go all the way. After a while, someone on the inside would probably notice you and put in a word with Bowen. Then you would get an invitation.

If you were seriously ambitious and wanted to get past the first inner layer, you then had to start performing for real. You couldn't hide behind the excuse that the public area might be monitored by the authorities or was full of idiots who might abuse valuable hacking information.

The hackers in the most elite area would judge you on how much information you provided about breaking into computer or phone systems. They also looked at the accuracy of the information. It was easy getting out-of-date login names and pa.s.swords for a student account on Monash University's computer system. Posting a valid account for the New Zealand forestry department's VMS system intrigued the people who counted considerably more.

The Great Rite of Pa.s.sage from boy to man in the computer underground was Minerva. OTC, Australia's then government-owned Overseas Telecommunications Commission,3 ran Minerva, a system of three Prime mainframes in Sydney. For hackers such as Mendax, breaking into Minerva was the test.

Back in early 1988, Mendax was just beginning to explore the world of hacking. He had managed to break through the barrier from public to private section of PI, but it wasn't enough. To be recognised as up-and-coming talent by the aristocracy of hackers such as The Force and The Wizard, a hacker had to spend time inside the Minerva system.

Mendax set to work on breaking into it.

Minerva was special for a number of reasons. Although it was in Sydney, the phone number to its entry computer, called an X.25 pad, was a free call. At the time Mendax lived in Emerald, a country town on the outskirts of Melbourne. A call to most Melbourne numbers incurred a long-distance charge, thus ruling out options such as the Melbourne University dial-out for breaking into international computer systems.

Emerald was hardly Emerald City. For a clever sixteen-year-old boy, the place was dead boring. Mendax lived there with his mother; Emerald was merely a stopping point, one of dozens, as his mother shuttled her child around the continent trying to escape from a psychopathic former de facto. The house was an emergency refuge for families on the run.

It was safe and so, for a time, Mendax and his exhausted family stopped to rest before tearing off again in search of a new place to hide.

Sometimes Mendax went to school. Often he didn't. The school system didn't hold much interest for him. It didn't feed his mind the way Minerva would. They Sydney computer system was a far more interesting place to muck around in than the rural high school.

Minerva was a Prime computer, and Primes were in. Force, one of the more respected hackers in 1987-88 in the Australian computer underground, specialised in Primos, the special operating system used on Prime computers. He wrote his own programs--potent hacking tools which provided current usernames and pa.s.swords--and made the systems fashionable in the computer underground.

Prime computers were big and expensive and no hacker could afford one, so being able to access the speed and computational grunt of a system like Minerva was valuable for running a hacker's own programs. For example, a network scanner, a program which gathered the addresses of computers on the X.25 network which would be targets for future hacking adventures, ate up computing resources. But a huge machine like Minerva could handle that sort of program with ease. Minerva also allowed users to connect to other computer systems on the X.25 network around the world. Better still, Minerva had a BASIC interpreter on it.

This allowed people to write programs in the BASIC programming language--by far the most popular language at the time--and make them run on Minerva. You didn't have to be a Primos fanatic, like Force, to write and execute a program on the OTC computer. Minerva suited Mendax very well.

The OTC system had other benefits. Most major Australian corporations had accounts on the system. Breaking into an account requires a username and pa.s.sword; find the username and you have solved half the equation. Minerva account names were easy picking. Each one was composed of three letters followed by three numbers, a system which could have been difficult to crack except for the choice of those letters and numbers. The first three letters were almost always obvious acronyms for the company. For example, the ANZ Bank had accounts named ANZ001, ANZ002 and ANZ002. The numbers followed the same pattern for most companies. BHP001. CRA001. NAB001. Even OTC007.

Anyone with the IQ of a desk lamp could guess at least a few account names on Minerva. Pa.s.swords were a bit tougher to come by, but Mendax had some ideas for that. He was going to have a crack at social engineering. Social engineering means smooth-talking someone in a position of power into doing something for you. It always involved a ruse of some sort.

Mendax decided he would social engineer a pa.s.sword out of one of Minerva's users. He had downloaded a partial list of Minerva users another PI hacker had generously posted for those talented enough to make use of it. This list was maybe two years old, and incomplete, but it contained 30-odd pages of Minerva account usernames, company names, addresses, contact names and telephone and fax numbers. Some of them would probably still be valid.

Mendax had a deep voice for his age; it would have been impossible to even contemplate social engineering without it. Cracking adolescent male voices were the kiss of death for would-be social engineers. But even though he had the voice, he didn't have the office or the Sydney phone number if the intended victim wanted a number to call back on.

He found a way to solve the Sydney phone number by poking around until he dug up a number with Sydney's 02 area code which was permanently engaged. One down, one to go.

Next problem: generate some realistic office background noise. He could hardly call a company posing as an OTC official to cajole a pa.s.sword when the only background noise was birds tweeting in the fresh country air.

No, he needed the same background buzz as a crowded office in downtown Sydney. Mendex had a tape recorder, so he could pre-record the sound of an office and play it as background when he called companies on the Minerva list. The only hurdle was finding the appropriate office noise. Not even the local post office would offer a believable noise level. With none easily accessible, he decided to make his own audible office clutter. It wouldn't be easy. With a single track on his recording device, he couldn't dub in sounds on top of each other: he had to make all the noises simultaneously.

First, he turned on the TV news, down very low, so it just hummed in the background. Then he set up a long doc.u.ment to print on his Commodore MPS 801 printer. He removed the cover from the noisy dot matrix machine, to create just the right volume of clackity-clack in the background. Still, he needed something more. Operators' voices mumbling across a crowded floor. He could mumble quietly to himself, but he soon discovered his verbal skills had not developed to the point of being able to stand in the middle of the room talking about nothing to himself for a quarter of an hour. So he fished out his volume of Shakespeare and started reading aloud. Loud enough to hear voices, but not so loud that the intended victim would be able to pick Macbeth. OTC operators had keyboards, so he began tapping randomly on his. Occasionally, for a little variation, he walked up to the tape recorder and asked a question--and then promptly answered it in another voice. He stomped noisily away from the recorder again, across the room, and then silently dove back to the keyboard for more keyboard typing and mumblings of Macbeth.

It was exhausting. He figured the tape had to run for at least fifteen minutes uninterrupted. It wouldn't look very realistic if the office buzz suddenly went dead for three seconds at a time in the places where he paused the tape to rest.

The tapes took a number of attempts. He would be halfway through, racing through line after line of Shakespeare, rap-tap-tapping on his keyboard and asking himself questions in authoritative voices when the paper jammed in his printer. d.a.m.n. He had to start all over again.

Finally, after a tiring hour of auditory schizophrenia, he had the perfect tape of office hubbub.

Mendax pulled out his partial list of Minerva users and began working through the 30-odd pages. It was discouraging.

'The number you have dialled is not connected. Please check the number before dialling again.'

Next number.

'Sorry, he is in a meeting at the moment. Can I have him return your call?' Ah, no thanks.

Another try.

'That person is no longer working with our company. Can I refer you to someone else?' Uhm, not really.

And another try.

Finally, success.

Mendax reached one of the contact names for a company in Perth. Valid number, valid company, valid contact name. He cleared his throat to deepen his voice even further and began.

'This is John Keller, an operator from OTC Minerva in Sydney. One of our D090 hard drives has crashed. We've pulled across the data on the back-up tape and we believe we have all your correct information. But some of it might have been corrupted in the accident and we would just like to confirm your details. Also the back-up tape is two days old, so we want to check your information is up to date so your service is not interrupted. Let me just dig out your details ...' Mendax shuffled some papers around on the table top.

'Oh, dear. Yes. Let's check it,' the worried manager responded.

Mendax started reading all the information on the Minerva list obtained from Pacific Island, except for one thing. He changed the fax number slightly. It worked. The manager jumped right in.

'Oh, no. That's wrong. Our fax number is definitely wrong,' he said and proceeded to give the correct number.

Mendax tried to sound concerned. 'Hmm,' he told the manager. 'We may have bigger problems than we antic.i.p.ated. Hmm.' He gave another pregnant pause. Working up the courage to ask the Big Question.

It was hard to know who was sweating more, the fretting Perth manager, tormented by the idea of loud staff complaints from all over the company because the Minerva account was faulty, or the gangly kid trying his hand at social engineering for the first time.

'Well,' Mendax began, trying to keep the sound of authority in his voice. 'Let's see. We have your account number, but we had better check your pa.s.sword ... what was it?' An arrow shot from the bow.

It hit the target. 'Yes, it's L-U-R-C-H--full stop.'

Lurch? Uhuh. An Addams Family fan.

'Can you make sure everything is working? We don't want our service interrupted.' The Perth manager sounded quite anxious.

Mendax tapped away on the keyboard randomly and then paused. 'Well, it looks like everything is working just fine now,' he quickly rea.s.sured him. Just fine.

'Oh, that's a relief!' the Perth manager exclaimed. 'Thank you for that. Thank you. I just can't thank you enough for calling us!' More grat.i.tude.

Mendax had to extract himself. This was getting embarra.s.sing.

'Yes, well I'd better go now. More customers to call.' That should work. The Perth manager wanted a contact telephone number, as expected, if something went wrong--so Mendax gave him the one which was permanently busy.

'Thank you again for your courteous service!' Uhuh. Anytime.

Mendax hung up and tried the toll-free Minerva number. The pa.s.sword worked. He couldn't believe how easy it was to get in.

He had a quick look around, following the pattern of most hackers breaking into a new machine. First thing to do was to check the electronic mail of the 'borrowed' account. Email often contains valuable information. One company manager might send another information about other account names, pa.s.sword changes or even phone numbers to modems at the company itself. Then it was off to check the directories available for anyone to read on the main system--another good source of information. Final stop: Minerva's bulletin board of news. This included postings from the system operators about planned downtime or other service issues. He didn't stay long. The first visit was usually mostly a bit of reconnaissance work.

Minerva had many uses. Most important among these was the fact that Minerva gave hackers an entry point into various X.25 networks. X.25 is a type of computer communications network, much like the Unix-based Internet or the VMS-based DECNET. It has different commands and protocols, but the principle of an extensive worldwide data communications network is the same. There is, however, one important difference. The targets for hackers on the X.25 networks are often far more interesting. For example, most banks are on X.25. Indeed, X.25 underpins many aspects of the world's financial markets. A number of countries' cla.s.sified military computer sites only run on X.25. It is considered by many people to be more secure than the Internet or any DECNET system.

Minerva allowed incoming callers to pa.s.s into the X.25 network--something most Australian universities did not offer at the time. And Minerva let Australian callers do this without incurring a long-distance telephone charge.

In the early days of Minerva, the OTC operators didn't seem to care much about the hackers, probably because it seemed impossible to get rid of them. The OTC operators managed the OTC X.25 exchange, which was like a telephone exchange for the X.25 data network. This exchange was the data gateway for Minerva and other systems connected to that data network.