This is
the official alt.ph.uk FAQ, the home of which
is at http://www.hackhull.com/phuk/.
Any other FAQs or documents are unofficial.
As of 12th November 1999 this document is now being rewritten. If you have any contributions you can make them online at http://www.hackhull.com/cgi-bin/contrib.cgi - these are then moderated and inserted into the FAQ.
2.1. Boxing
3.1. Unix
4.1. Acts of Parliament
8.1. On The Internet
This article is provided as is without any express or implied warranties.
While every effort has been taken to ensure the accuracy of the information contained in this article, the author and it contributors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.
The contents of this article might be totally inaccurate, inappropriate, misguided, or otherwise perverse. Much of this FAQ is based on the personal views of its contributors.
Copyright © 1996 - 1999 by Glenn Pegden, Joel Rowbottom, and all associated contributors. All rights reserved.
PH is formed from the initial letters of Phreak and Hack.
This FAQ is intended to reduce the bandwidth taken up with people asking the same questions over and over again. It is intended to complement other FAQs and not replicate them. To this end you are suggested to go and look at:
If anyone tries to ban it, it is obviously a group for the discussion of alternative philosophy in the UK.
1.0.2. What should and shouldn't be discussed in the group?
This group is primarily used to discuss the technical matters
surrounding hacking and phreaking in the UK and closely related topics.
This includes the UK phone system, hacking UK systems, issues relating
to the UK underground etc, the main thing to remember is this is a UK
group. Things to be avoided are those that can be dealt with better in
other groups (especially the kind of questions that alt.2600 is plagued
with such as sending fakemail/news, out of date boxes, IRC scripts, and
'where do I get kewl warez').
Check the newsgroups listed in section 5 of this faq for closely related newsgroups which may be more appropriate. Always try find the answer yourself first (see the list of references at the end of this FAQ), mentioning where you have looked for info often helps too.
Other things to avoid to save you getting flamed are questions such as:
The contributors to this FAQ are not omnipotent, we are capable of being wrong. Please tell us if we are.
Newbies please take note: People in this group aren't generally receptive to private mail asking questions like How can I get free calls, re-chip my moby, or hack my Uni's Unix boxes. Don't waste your time or theirs; go and try to find out yourself then ask for help, not the other way round. Ignoring this advice can find you on the end of an emailed coredump, hacking attacks on your box, and more.
Generally it is to be presumed that the group is read by people who are
actively involved in prosecuting hackers and phreaks, and thus if you *are*
going to post sensitive information, it's a good idea to use an anonymous
remailer if you're going to post the information at all (see the next
section).
A major part of Phreaking is attempting to obtain phone calls for free or
below the rate at which the phone company would like to charge. The alt.ph.uk news group is not here to teach people
how to defraud phone companies though, and most of the discussion is
likely to be of purely technical interest.
Connor has written an updated version of ColdFire's original Meridian VMB hacking document is available at
http://members.xoom.com/Gathering/meridian.html.
You may be able to obtain a copy of the UK-Info CD which has a reverse lookup system on it - this allows you to do the sort of thing you're after, but it does cost a bit of cash. You might be able to pick up copies at trade shows or radio rallies, alternatively take a look at http://www.192.com/ which has an online version.
A good dose of paranoia is always healthy when using such systems. If you do
insist on using a PBX, diverting is better than nothing, and when you connect
wait a few minutes before placing an outgoing call.
Henceforth follow some common misconceptions about the laws surrounding PBXing.
The old Green BT cards used an optical system. The apparently black
plastic is translucent in the infrared - hold a card up to a 60watt light
bulb and you will see the purple stripes either side of the charge band on
the printed side.
The mechanism , by Landis & Gyr shines an infrared laser onto the underside
("black") side of the card. The charging strip has a diffraction grating pattern moulded into it
which back scatters the light to a detector set at a certain angle. The
angle is different for each Telecom operator. Once the call units have been used up
a heating element melts the plastic on the printed surface sufficiently to leave a visible
mark and enough to destroy the diffraction pattern at that point. The mechanism then
makes a verifying read to check that this has worked and will not physically release
the card until then. Any ideas about nail varnish etc making any difference are fiction.
Simple, cheap, and hackproof so therefore the telecoms companies are
rushing away to use smart cards instead !
The new BT smart cards have both an expiry date and a serial number, with
presumably an audit trail of all the calls made using a particular card -
will all bomb hoaxers, drug dealers and obscene callers remember not to
use the same card to call home as well ?
Blue boxing in the UK is almost impossible now due to the fact that tones are
filtered out on many 0800 trunks. However, if you want to give it a go anyway
then grab a copy of BlueBeep,
which has a tutorial on Blueboxing included with it.
Any of the above the generate tones will have to be modified (see below).
Box schematics may be retrieved in a zip file from:
Mercury's country direct numbers are evenly distributed through out the
0500 xxxxxx range.
Country direct numbers are numbers which forwards calls to a regular
number in the remote country. I believe these numbers are arranged with
your local Telco, who rent a number of 0800/0500 lines from BT/Mercury
and pay BT/Mercury for incoming calls over them. The remote telco then
resells these numbers to company's requiring a toll-free number from the
UK. You are not charged for the call, the company you reach is paying
for the call, as with all 0800/0500 numbers.
For a more detailed discussion see 'Caller Display and Call Return' by William Dangerfield, Simon Garrett and Melv Bond in British Telecommunications
Engineering; Volume 12 part 3 (October 1993). Also See Supplies Information Note (SIN) 227, available on 0800 318601. BABT have issued a
specification, BABT/SITS/94/53 to replace the draft specifications BABT/TC/128 and BABT/TC/131. This specification is identical to the 131 draft and is
shorter and easier to meet than the 128 draft. A copy can be obtained from BABT on (01932) 222289.
You can block the sending of your phone number you are dialling by
prefixing it with 141. Your also have the number of the last person who
called (from a phone that supplies caller ID) by dialing 1471. 141 though
is by no means secure and just stops the data from being supplied to the
caller, not the exchange itself!
There is also an excellent UK Caller ID FAQ at http://www.ainslie.org.uk/callerid/cli_faq.htm.
If you're serious about doing some damage with Toneloc or the like, get a second line. Your parents/spouse/SO/flatmates will appreciate the line being free, and you don't have to have a schizoid embolism everytime they pick up midway through a nmap sweep.
Learn. Study various switching architectures. Grow to realise
their differences and nuances. Then get out there and turn some
poor clod's phone into a MicroMACS receiver circuit.
Breaking and entering is one fast-track way to learn, but advocating this would be advocating vandalism which ain't the way of the true hacker. Getting caught can land you in seriously hot shit right up to your lapels especially if the exchange has an important role. Not that I would know, and hopefully no-one ever will either.
Take a look at:
Now as you know, every vodaphone PAYT customer has two phone numbers:
The VBX range is from 07788 200 000 to 07788 450 999 If you want to target a specific individual, just type *#61# [enter/ok]
on his/her phone to get the VBX number, then dial it from your land line.
Once you have found a number, just listen to the message, if its the default "Welcome to the vodaphone recall service for <handset number>" then quickly key 9 and enter the default PIN of 3333
This also seems to work for non PAYT SIMs as well, except that the range of VBX numbers is different e.g. 0777 10x xxxx to ?
To learn about cracking read alt.ph.uk and sit
on various irc channels. Learning about hacking involves reading the
manual and everything else you can get your hands on, and have a desire to
understand (rather than break) the machine you are hacking.
Some BIOS's allow you to require a password be entered before the system
will boot. Some BIOS's allow you to require a password to be entered
before the BIOS setup may be accessed.
Every BIOS must store this password information somewhere. If you are
able to access the machine after it has been booted successfully, you
may be able to view the password. You must know the memory address
where the password is stored, and the format in which the password is
stored. Or, you must have a program that knows these things.
The most common BIOS password attack programs are for Ami BIOS. Some
password attack programs will return the AMI BIOS password in plain
text, some will return it in ASCII codes, some will return it in scan
codes. This appears to be dependent not just on the password attacker,
but also on the version of Ami BIOS.
To obtain Ami BIOS password attackers, ftp to oak.oakland.edu
and look in directory /simtel/msdos/sysutil/
If you cannot access the machine after if has been powered up, it is
still possible to get past the password. The password is stored in CMOS
memory that is maintained while the PC is powered off by a small
battery, which is attached to the motherboard. If you remove this
battery, all CMOS information will be lost. You will need to re-enter
the correct CMOS setup information to use the machine. The machines
owner or user will most likely be alarmed when it is discovered that the
BIOS password has been deleted.
1.0.3. Who reads alt.ph.uk?
It is beyond the scope of this document (as well as being downright unfair)
to name names in this document, but it is well known that aside from being
read by phreaks, hackers, etc. the newsgroup is also read (and has been
written to) by such people as BT Security as well as journalists and many
sysadmins.
1.0.4. Where to obtain this FAQ
You can always get the latest official HTML copy of this FAQ from
http://www.hackhull.com/phuk.
The FAQ is no longer available in text format, if you like ASCII then I suggest you use a copy of Lynx or something similar ;)
Section 2: Phreaking
2.0.1. What is Phreaking?
Phreaks are people who enjoy learning about the phone system,
especially the technical details, and the unpublished details that phone
companies would rather we didn't know about. Phreaks are also
interested in the workings of the phone company, and trying find ways
around the system, often the billing and accounting procedures.
2.0.2. What Are The UK DTMF Tones?
1209Hz 1336Hz 1477Hz 1633Hz 697Hz 1 2 3 A 770Hz 4 5 6 B 852Hz 7 8 9 C 941Hz * 0 # D 2.0.3. What is Voicemail (VMB) and what can I do with it?
VMB (Voice Mail Boxes) are used by company to help manage internal phone
systems. They offer a range of services from personal answer phones to
internal routing of calls. One facility often abused is the ability to
get an outside line.
2.0.4. Can I get the address of a person from their phone number?
You're talking about CNA numbers. CNA stands for customer name and addresses. A CNA number is a phone number for telephone company personnel to call and get the name and address for a phone line BT do have their own internal service, but AFAIK there are none available to the public (unlike the US).
2.0.5. What is PBXing?
PBX stands for Private Branch eXchange and is the term used to describe
in-office telephone systems (eg. Meridian). You mustn't get PBX confused with
VMB (although one can involve the other).
Yes! Cable companies have to co-operate under the law. Some cable companies
actually have stricter policies than BT themselves.
Yes! Prosecution is a different matter though. But people have got in trouble
for using 89/96x PBX's etc. in other countries.
WRONG! In fact, in these cases it might be worse, as they might choose to
charge you under general fraud laws.
No. Whilst it's much better than 'dialing direct' BT can trace things on
their own network fairly easily. Things just take more time. If they trace
you, they will put a monologue on your line.. It then doesnt matter how many
things you dial through, as they'll have every DTMF you dial!
2.0.6. How do UK Phone Cards work?
By now Mercury has probably phased out all their old Payphones which used
magnetic stripe cards. Some of their street sites have been taken over by
the Italian company Inter Phone who have reverted to coin operations.
2.1. Boxing
2.1.1. What is Boxing?
Phreaks may also be interested in 'boxes', there are many types of boxes
which have varying degrees of success, boxes are usually categorised by
colour and offer a variety of facilities from seizing operator control
of the line, and hence calling for free (Blue Box) and stopping calling
party being billed (Black Box) to a charging ni-cads with your phone
(Chartreuse Box), also various other add-ons such as amps, hold buttons,
in-use lights etc.
2.1.2. Which Boxes Work In The UK?
This list of boxes stolen from the alt.2600 FAQ and converted for the
UK: This is just an 'educated' guess of what will or will not work in the
UK, this is only in theory and any which I say will work will probably
need a lot of modification to work, that's if you can find a schematic
thats half way readable :)
Box Description UK? Acrylic Steal Three-Way-Calling, Call Waiting and programmable Call Forwarding on old 4-wire phone systems No Aqua Drain the voltage of the FBI lock-in-trace/trap-trace No Beige Linemans handset Yes Black Allow callers to dial in for free No Blast Phone microphone amplifier Yes Blotto Supposedly shorts every fone out in the immediate area Joke Blue Take operator control of a line (phone for free) Sometimes Brown Create a party line from 2 phone lines Yes Bud Tap into your neighbors phone line (similar to Beige) Yes Chartreuse Use the electricity from your phone line Yes Cheese Connect two phones to create a diverter Yes Chrome Alter traffic lights No Clear A telephone pickup coil and a small amp used to make free calls on Fortress Phones No Colour Line activated telephone recorder Yes Copper Cause crosstalk interference on an extender Unknown Crimson Hold button Yes Dark Re-route outgoing or incoming calls to another phone No Dayglo Connect to your neighbors phone line Yes Divertor Re-route outgoing or incoming calls to another phone No DLOC Create a party line from 2 phone lines Yes Gold Dialout router Unknown Green Emulate the Coin Collect, Coin Return, and Ringback tones No Infinity Remotely activated phone tap Yes Jack Touch-Tone key pad Yes Light In-use light Yes Lunch AM transmitter Yes Magenta Connect a remote phone line to another remote phone line No Mauve Phone tap without cutting into a line Unknown Neon External microphone Yes Noise Create line noise Yes Olive External ringer Yes Party Create a party line from 2 phone lines Yes Pearl Tone generator Yes Pink Create a party line from 2 phone lines Yes Purple Telephone hold button Yes Rainbow Kill a trace by putting 120v into the phone line Joke Razz Tap into your neighbors phone Yes Red Free calls from payphones Yes Rock Add music to your phone line Yes Scarlet Cause a neighbors phone line to have poor reception Yes Static Keep the voltage on a phone line high Yes Switch Add hold, indicator lights, conferencing, etc. Unknown Tan Line activated telephone recorder Yes Tron Reverse the phase of power to your house, causing the electricity meter to run slower Unknown TV Cable "See" sound waves on your TV Unknown Urine Create a capacitative disturbance between the ring and tip wires in another's telephone headset Unknown Violet Keep a payphone from hanging up No White Portable DTMF keypad Yes Yellow Add an extension phone Yes 2.1.3. What are the UK Red Box Tones?
Note: I have not tried these, they are rumoured to work - anyone got them to work OK? - J.
10p Length 200 milliseconds, Frequency 1000Hz. 20p 2 * The Above. 50p Length 350 milliseconds, Frequency 1000Hz. £1 2 * The Above. 2.2. Landline Telephony
2.2.1. War Dialling
War-Dialling (aka scanning) is the practise of repetitively dialling
phone numbers, to find out what is on the other end. These are mainly
voices, although sometimes you may find trunks, carriers (modems), VMBs,
FAXs, and other strange stuff. 'Tone-Loc' is a highly acclaimed package
to aid scanning. Normally you scan a block of numbers (the most common
scans are of 0800 / 0500 because they're free) and keep a log of
anything interesting you find for later attention. Scanning may be
illegal under the Computer Misuse Act [see Section 4.2].
2.2.2. Loops
See the alt.2600 FAQ for an explanation of what loops are and how the
can be used. There are virtually no known loops in the UK, mainly
because if the do exist, no-one scans for them (because unlike the US,
BT don't offer free local calls, so scanning is limited to 0800/0500
numbers).
2.2.3. How are 0800/0500 Numbers Used?
You pick up the phone, dial the number, and wait for them to answer :-).
Other than that they're used in blue boxing, using calling cards,
finding modems and voicemail/PBX abuse. The reason the get a lot of
attention from phreaks is they are FREE!
2.2.4. What are the 0800 89xxxx numbers for?
They are direct overseas lines (known as country direct numbers), most
will ask you for pin numbers. BTs originally lumped all it direct
overseas lines in this area, but it has now realised this wasn't such a
good idea and is distributing them more evenly
2.2.5. What is Caller-ID (CLID) and what can I do with it?
On modern exchanges BT sends the phone number of the number that called
you (when possible), just before the first ring - sometimes you can hear
the data packet if you have call-waiting enabled and CLID as well; the
packet is broadcast at 1200 baud (if you have call-waiting enabled you can sometimes hear the CLID packet being sent). BT will sell you a device to read these
(approx £50 at time of writing). Home-brew (obviously non BT Approved) are around, or take a look at http://www.solwise.co.uk/ who have various units for sale.
You also have to pay BT for the recieving the data - this is about a £10 a quarter.
Caller-ID modems are now also available which will transmit the data
packet to a serial port of a computer, as are devices to plug into your serial port.
2.2.6. BT Wiring Cabinets
Green BT wiring cabinets (also known as PCPs) - usually seen in the street - tend to be a "reasonably ordered mess"
inside, and are where you really need to beigebox from. A good guide by Connor is available
at http://members.xoom.com/Gathering/btwiring.txt.
2.2.7. How do I find out my BT phone bill before it comes?
There is an automated service on 0800 854608 which will give you your bill
amount, so you can start saving! When you call, dial ** followed by your
full number including STD code, then the first eight digits of your
account number (situated at the top of your last bill).
2.2.8. What are the risks of War-Dialling?
Heh. Good question; It can be answered several ways, dependant on the prefix your're operating within.
You may want to grab a copy of the OFTEL listings to determine who provides the services for your particular target as well; Soon you too will discover the beauty of subscriber leased DMS tekneeq. :-)
Interesting ranges are marked as Allocated, and classed with a provider name. Other particularly interesting ranges turn up as protected. Don't be fooled. These are the older 3 digit DDSN ranges, aka 0800-XXX-XXX. Scan them and be damned, you'll find lots of interesting stuff to play with. Strangely enough, the OFTEL docs are in an archive called codelist.zip. How Ironic.
Quite risky. Key points to remember are that your'e waking people up if you're scanning at night; You could be ringing consecutive DDI ports for a target company which will immediately alert them to your presence; Also, you're generating a lot of outgoing traffic for one sweep. Geographically, it's child's play to pinpoint your location unless your'e going via an outdial. Use your loaf - get to the library, pinpoint residential ranges, isolate the carrier providers for your NDC of interest, and take it from there.
Very Risky. No shit. The switching architecture in place within the DDSN is particularly good at logging, with AMA in place on each step and switch point in the net. Furthermore (for those of you mystified as to the protocol intricacies of CLID), your CLID is forwarded right up to the far end hop off switch, ie. your CLID is masked from the end user only by one bit determining its visibility status. Your target may not see it, but if you're dialling into hostile territory, don't be surprised if weird things happen. I managed to get NTL to shut down a whole prefix after I'd swept two the same week just to keep me out, dependant on CLID, so keep an eye on things the whole time.
2.2.9. What about FAXBACK systems, can they be abused in any way?
There are a number of attacks and ways of making free calls simply
using a faxback system. Attacks usually consist of making large numbers of calls to a samll selection of numbers. Free calls can be gained because the system dials out itself.
A guide can be found at:
http://members.xoom.com/Gathering/faxback.txt
2.2.10. I want to own my local exchange. How do I do it?
Firstly, calm down. Then take a reality check. A wise man once said that running before walking was sure to lead
to trouble. However, if you are willing to step into the digital
mire that is MMI Language, then take heed.
Number 3 is aided by the fact that all digital exchanges are connected by their own pseudo-private packet switching network. In rare cases, luck will shine on you (or your 10 phonelines and franken-dialler), and an access port for oft used reporting and test facilities through which valuable information may be gleaned, and the ATE status even
modified. This is truly, IMHO, digital fucking wizardry, and
it makes me stiff just thinking about it. *Ahem*
2.3. Mobile Telephony
2.3.1. Where can I get old mobile phones?
There are several places where you can obtain such beasts, usually dead (or disconnected) mobile handsets whose contract has expired. Digital phones can sometimes be used for Pay-As-You-Talk style services.
2.3.2. Vodaphone Voice Mail Boxes
Vodophone VBX Hack:
The handset diverts to the VBX number.
Section 3: Hacking
3.0.1. What is Hacking and Cracking?
In the sections below I frequently use the terms hackers and cracker,
the actual meaning of the words will always be debated, but here is how
I am using them. A Cracker is someone who breaks passwords, often
without the need for a great deal of knowledge of the systems they are
breaking into, just a few tools and techniques. A hacker on the other
hand will take a great deal of time to learn about the system (s)he is
hacking. A hacker will read all the manuals and documentation possible
and newsgroups such as comp.security.misc.
3.0.2. How do I crack BIOS passwords?
This depends on what BIOS the machine has. Common BIOS's include AMI,
Award, IBM and Phoenix. Numerous other BIOS's do exist, but these are
the most common.
| MOP | Management Operations Protocol, ala bootp |
| LAT Commonly used in Terminal Server Environs | |
| DDCMP | File transfer, task to task processing. DDCMP has its roots in HLDC IIRC. And yes, they even speak TCP/IP. |
| NICE | Network Management functions |
| DAP | File Transfer |
| NSP | Session Control |
Want a challenge? Want to put hairs on your chest? Hack VMS.
The net is full of unix security info, but a good starting point is
Arny's UNIX hacking page (see Section 5).
On other systems /etc/passwd doesn't store the password. It can be
stored in a shadow file (that is not normally readable to normal users).
To obtain the (encrypted) passwords you have to have a special program
to read it. The source for a program to do this is obtainable from the
alt.2600 FAQ.
A third method is to use NIS (which again may or may not be shadowed).
This may be readable by using the ypcat command. Again, see the alt.2600
FAQ again.
Remailers work by taking incoming messages from you, stripping off the
headers and sending them on, although this is good enough for most of the
time, the truly paranoid tend to string several remailers together to avoid
the possibility of traffic analysis giving away their identity. Other
options include PGP [see section 1.2.2] relay, random delays, random message
size alteration, and so on.
Web mail services provided by sites such as HotMail,
AltaVista and
Yahoo are not anonymous - they add an Originating-IP header which makes it easy for your
email to be traced back to your provider/establishment, sometimes further.
More info can be found from:
The latest versions of PGP are usually available by ftp from
ftp.ox.ac.uk in /pub/crypto/pgp. Most
internet service providers carry precompiled versions for various
platforms on their ftp servers also.
For more info read:
You will also find that many service providers also log accounting details from their authentication servers - data includes not just the CLID, but also bytes transferred, login times, etc.
Nowadays, with the advent of 0800 dialups and free connectivity, a sizeable proportion of the free industry are blocking any authentication for users who withhold their caller ID (notably, AOL and Compuserve are not among this lot).
In any event, it's not the best idea to hack on your own "doorstep" as it were.
JANET stands for Joint Academic NETwork.
LONAP is a privately-run alternative to LINX, for smaller ISPs.
Telecom law is less specific, in general defrauding an phone company is
illegal, connecting un-approved devices to a BT network is 'unlawful' and
'prohibited'. I am unsure whether this includes sending tones from a hand-held
dial or personal-stereo. Using BT test codes may not be illegal, but is probably
in breach of your contract with them. The Telecommunications Fraud Act 1997 introduced/clarified
the law that if you are found in posession of material (anything from a copy of 2600 to a sack of chipped P3's) with intent to defraud, you will be
taken to the cleaner's.
The following is ColdFire's interpretation of the Computer Misuse Act 1990:
Quote from the Computer Misuse Act (1990) Section 1:
As most voicemail system can be classified as computer systems war-
dialling for VMB's with the intent of gaining unauthorized access to
the VMB system is illegal. The same applies to PBX's
I believe, from my interpretation of the law, that war-dialling is
illegal under the Computer Misuse Act (1990). Of course to prosecute
you under this law it would have to be proven that you intended to
gain unauthorised access to a computer (note: computer is not defined
under the act).
Obviously this only applies to automated wardialing, dialling by hand
is not covered by this :)
At best log files are supporting evidence, in most cases they only
show logins, connections and other impersonal evidence, no log can say
BEYOND REASONABLE DOUBT that someone did something, if in doubt deny
everything, after all its the job of the prosecution to prove you
are guilty.
Things to check out are:
Another piece of sound advice came from the editor of Phrack Chris Goggans.
Don't hack on your own door step, prosecuting someone in another country is
such a problem it's often not worth the effort.
Be careful when skipdiving (or dumpster diving as it's also called), especially round the back of your local phone exchange. Most large companies are now using razor wire, infra-red CCTV, and sizeable dogs to stop culprits from making off with dead equipment and (more importantly) credit card carbons. Going trashing round the back of your local small businesses is more likely to reap rewards than getting yourself arrested digging through the contents of BT's wastebins.
There are also some bunker exploration accounts on the hackHull site, which may be of interest.
Firstly though, MANY cable companies only scramble SOME of their channels
(usually Premiums) and some apparently scramble NONE at all! (Though this
is becoming less and less common). However, these signals are usually
sent well out of the range of frequencies that your average TV can pick
up. All the cable box is there for in cases like this is to 'convert
down' these frequencies into something that most TV's can tune in to.
TV's vary wildly in what freq. range they can pick up. So the best bet
is to disconnect the cable from the box, plug it directly into the back
of your TV, and 'tune around' and see what you find!.. and try all your
TV sets if you have more than one. You should find a few unscrambled
channels if you're lucky.. 'The Box' (A music channel) is usually always
sent unscrambled, amongst others..
Some Televisions (Nokia make one) can tune into all of these higher
frequencies already. This type of TV is known in the USA as a 'cable
ready' television. I know that Maplin Electronics also sell something that
can convert down the higher frequencies used by the Cable signals for most
televisions to view. Take a look at http://www.hackhull.com/rediffusion/ for the
infamous Hull cable TV hack which uses this facility.
However, whilst just about everyone should be able to get some unscrambled
channels using this method, all the good stuff (yes, porno channels,
you shameless people), Sky One, etc. is usually scrambled.
If you thought that to let you view a particular channel cable companies
had to switch some thing externally, you are wrong. In fact in most
systems all the channels are present when they reach your box. It is
your box that is programmed to stop you seeing these channels, Not
something outside the home! The only exception to this is possibly
a very few companies who use 'filtering' methods, ie. they use
computerised 'smart filters' outside the home which filter out premium
channels etc. and control what you can and cannot see. If your cable co
uses this type of system (I know none that do in the UK) Then you are
screwed. (Either that or it's time to go pay a rich neighbour a visit
with some wire cutters, a spade, and a length of cable wire long enuff
to reach your house :) The one positive side to this method is that all
signals are sent in the clear, and the ones you dont pay for are
filtered out. And so, if you have a 'cable ready' TV, it eliminates
the need for a box.
All cable boxes contain a serial number. Your cable co. has this number
on record in their computers. When you phone and say "I'd like to
subscribe to the Racing Channel, Cause its great value at only 20 quid
a month" They simply type in the computer you are allowed to see that
channel. The cable co. then sends a signal to your box saying box
AB 1234567890 is allowed to see channel 33. Your cable box contains a
modem that receives data from the cable co. in the form of an FM signal.
The box specifically looks out for instructions to its serial number,
and obeys. It can be told where specific channels go, (Show BBC1 on
ch 21 etc) can disconnect your service, or can show what are called
'barker' channels in place of the premium channels (Unless it's told
different ;). This FM signal is known as the cable boxes 'data stream'.
However, cable companies dont just send the data stream to your box
the once and then thats it. They send instructions to everyones box
constantly looping around you all. And so, on a small system with a
few people your box might be updated every few minutes, or on a larger
one the box might be updated every 20 minutes etc. This ensures everyone
gets what they pay for.
And so, the point is that you don't build a descrambler - you trick
your cable box into thinking you're allowed to see the premium channels!
This can be done in two ways: 1. By Cube. 2. By Test chip. Both have
their advantages and disadvantages, much of which is outside ths scope of
this document and therefore you are encouraged to seek further information
elsewhere.
Finally, because there are no UK sources for this type of thing
EVERYONE must get cubes/test chips etc. from the USA. And the UK being
the UK has to be a bit awkward and do it slightly different from the US.
Data streams there are 99 times out of 100 one of four frequencies
between 88-108.5 FM. However, here the data stream is often found at
higher rates like 122.75Mhz etc. (ie. outside the normal FM wave band).
If unsure, get yourself a scanner that can tune that high, plug
your cable into it, and search around for your data stream. Once you
find it let the company know, and many will be happy to modify it for
you before shipping to the UK. You need to know this or your cube will
not work!
Also read rec.video.cable-tv for a while and you might pick up some stuff.
Both APIs translate to a bytecode format similar to the way Java is structured.
There are adverts around touting "chipped" OnDigital boxes for around £400 apiece, however we haven't seen one first-hand. Try hanging around the satellite newsgroups or do a search on Deja, as occasionally the groups do get spammed with this rubbish.
You may get quite a bit of mileage from keeping an eye on the uk.tech.digital-tv newsgroup, where firmware updates and other fun stuff is discussed on a regular basis.
3.1. Unix
3.1.1. General Info about Unix Hacking
Unix is a fully multi-tasking multi-user operating system written in
C; one of its strengths being its ability to network. There are versions of
Unix for most systems from DEC AXPs to 386 PCs. A very large proportion
of the hosts on the internet are running UNIX or Linux (the public-domain
flavour of Unix).
3.1.2. How do I crack a Unix password file?
On some systems /etc/passwd contains and encrypted copy of your passwd
Cracking programs (Alex Muffits 'crack' for UNIX, and CrackerJack for
OS/2 and DOS are just two) try to *guess passwords by encrypting each
word in a dictionary and comparing each encrypted word against each
entry into /etc/passwd
3.2. Microsoft Windows and NT
3.2.1. Hacking DOS-based PCs
PCs running single users OS's aren't normally passworded, the most
common passwords are bios passwords. Sometime systems will run some
software when they booted these can sometimes be halted (Under MSDOS try
ctrl-C, also F5/F8 on DOS 6 onwards). Other things to look for are
options to run software packages that often have a 'shell' option. Also
try booting from a floppy and manually mounting remote disks.
3.2.2. How do I crack the Windows Screen Saver password?
Windows 3.1/3.11:
To remove the password all together (presuming it hasn't locked already)
edit control.ini, edit the line that says PWProtected=1 to =0 and in the
[ScreenSaver] section, where it says Password=12345 (where 12345 is the
encrypted password) change it to
If it is active, drag the window prompting you for the password around with the
mouse (making the active window). Then press ctrl-alt-del (having 3 hands would
be a help :). This should then give you the option to quit active application.
3.2.3. Basic Windows NT Security Reports and Resources
3.3. Network Hacking
3.3.1. How do I do TCP/IP spoofing/packet sequence prediction?
Learn low level TCP/IP. Basically with IP you can pretend to be any
machine you want to be, i.e. you dont *have* to put your own IP address as
the 'source address' in the datagrams (or packets) that you send out.
Unfortunately though, any reply to your faked packets will normally go to
the real machine, which kinda makes it difficult to use TCP since TCP
envolves a two way flow of IP datagrams both to and from your machine.
However you can to some extent get round this by guessing some of the
contents (ie. the sequence numbers) of the lost datagrams that were sent
to the real machine.
3.3.2. Hacking Novell Networks
(Glenn writes...)
"I know next to nothing about Novell hacking, other than the passwords file is
stored in the bindery and older versions of Novell had a system call called
VerifyBindaryObjectPassword that when given an account and password wouth say if
they matched. This was very useful for knocking up quick Novell versions of
Crack. I believe also something clever can be done when you run Netware Lite
over the top of normal Netware."
3.3.3. What's a socket?
A socket is a way of defining a communication channel between nodes of a network. A socket consists of a host, port and transport protocol. For example, "127.0.0.1,80,TCP" refers to TCP port 80 on host 127.0.0.1 (your computers loopback IP address).
Windows provides the winsock.dll to allow use of sockets. Linux includes the relevant functions in /sys/socket.h.
3.4. Viruses
3.4.1. What's a Virus?
A virus is a piece of code which has the ability to "reproduce", infecting other executables with copies of itself (in the same way as a physical virus infects host cells).
Not all virii carry "payloads" (damaging portions of code, which could format the hard disk, for example), but all virii are undesirable as they eat up system memory and hard disk space.
3.5. Anonimity On The Internet
3.5.1. Anonymous Newsgroup Posting
There are a few ways of doing it properly, and thousands of ways of
doing it wrongly.
If you want to remain anonymous, make the effort, or suffer the ridicule of
your peers!
At time of writing, several anonymous remailers support posting to
newsgroups, plus you can also do it via DejaNews.
Any one of the high quality remailers can be used to send mail to
a mail2news gateway. There are a large number of these gateways,
finding them is left as an exercise to the reader.
Possible, but too much hassle for most, remember to test how 'fake'
your mail is first by sending a message to yourself paying special
attention to Message IDs and NNTP-Posting-Host headers.
There are stacks, heres a few.
3.5.2. Anonymous Mailers and Remailers
Contrary to the popular belief, there are stacks of anonymous
remailers out there.
There is also PrivacyX.com, who boast that they "can now give you complete email privacy and anonymity using the powerful encryption already built into your email program. PrivacyX.com is the first anonymous certificate authority. We operate like a Swiss bank,
even we don't know who you are. You get complete privacy and anonymity for all your communications. Best of all, true to the Internet tradition, the service is completely free."
3.5.3. PGP - Pretty Good Privacy
The whole PGP concept it too large to discuss in this document, so
heres a short summary from the docs that come with it.
"PGP (pretty good privacy) is a public key encryption package to
protect email and datafiles. It lets you communicate securely with
people you've never met, with no secure channels needed for prior
exchange of keys. It's well featured and fast, with sophisticated
key management, digital signatures, data compression, and ergonomic
design."
3.5.4. Can I hack from a free, disposable ISP account such as Freeserve?
You can hack, but bear in mind that most free ISPs log the caller-ID information so they will know where you are calling from. Most ISPs now have abuse departments to deal with these sort of attacks, but vary widely in terms of response speed. You should also consider this if you are using someone else's account.
3.5.5. Anonymous Web Browsing
It's true that when you go to a website, your originating IP address (among other things) are logged. Joskyn states that www.cotse.com do a public proxying service for collecting websites via their gateway (as well as a pile of security information and a public Usenet gateway) - mind the copious quantities of unnecessary Flash stuff though.
3.5.6. Anonymous proxy servers
Our informant tells us of two anonymous proxy services on the 'Net:
3.5.7. How can I telnet anonymously?
To telnet anonymously, you need to first telnet to port 23 of a WinGate. Once there you can type in the address of your destination and you'll be able to telnet to that address going through the wingate. To find wingates, you need a port scanner, such as WinScan (Win) or AG NetTools (Mac), and scan for addresses on port 1080 (make sure you only use TCP wingates, not UDP. Once you've found one, test it by telneting on port 23 to the wingate. It should display WinGate>
Whereafter you type your address. To be even more anonymous, you need to find several wingates and telnet trough each one progressively.
3.6. UK Internet Hacking
3.6.1. What is JANET/UKERNA?
Janet is the UK academic backbone, it was once an X25 network that was only
connected to the internet via a few (over worked and oftern hacked) gateways,
but now SuperJanet is a genuine internet backbone. JANET is managed from
machines at ukerna.ac.uk. A lot of hackers use university machines for several
reasons (lack of security, no phone bills, fast links, being at Uni, etc.).
3.6.2. What is LINX and LONAP?
LINX is the London Independent Network eXchange. It's a sizeable peering point for ISPs to talk to each other - most of the UK Internet traffic goes through this switch, which is based in Telehouse Docklands (London).
3.6.3. Are there any Internet-connected outdials in the UK?
Yes, but with local calls not being free in the UK these are obviously not made
public.
3.7. RM Network Hacking
Section 4: Legalities
4.0.1. What is and isn't illegal?
(Disclaimer: I'm not a legal boff...)
Unauthorised computer access (or simply attempting it) is now illegal
under the Computer Misuse Act 1990. The Act is being updated at the time of writing (presumably to CMA '98).
All the following is my opinion, as I have no legal qualifications DO
NOT rely on it to be the case. Until wardialing is tested in court no
one will know for sure, now, who wants to be the test case :)
Another comment that he made was on the use of system logs as evidence:
As you can see, causing a computer to perform any function with intent
to secure unauthorized access to a computer is illegal. If you are
wardialing to find carrier, and then intend to gain unauthorized
access, then war dialling IS illegal (In my opinion)
Log files make crap evidence, for a start they're easily forged, and
you're reliant upon computer generated evidence. What jury will
believe a computer over a human?
Most legal documents are available from HMSO.
4.0.2. What should I do to avoid getting caught?
Basically don't break the law! You can't be prosecuted for knowing
how to do things (can you?), but if you do hack/phreak, follow this advice,
don't get greedy, don't use any dodgy number / account for too long, don't go
boasting to your mates (especially on alt.ph.uk), when phreaking, try to route
your call so you are harder to trace, never dial direct from your own home. When
hacking, again try to cover you tracks, the more accounts/nodes you use the
harder you are to trace.
4.1. Acts of Parliament
4.2. Infamous Hackers and Phreaks
4.2.1. Steve Gold/Robert Schifreen
Steve Gold and Robert Schifreen were the first hacker/phreaks to
become well known in the UK (other than those in the old Bailey trail
but that was long before). They were responsible for hacking prestel
in 1984 and gained notoriety for hacking the Prince Phillips mailbox
through gaining system manager status on the prestel system. They were
raided on 10th April 1985 and were charged with forgery, there being
no anti-hacking laws in the UK at that time. Found guilty Schifreen
was fined £750 and Gold £650, with £1,000 costs each. On appeal they
were acquitted of all charges :) Neither continue to hack and are now
freelance journalists. Robert Schifreen was also known as Hex and
Triludan the Warrior
4.2.2. Nick Whitely (aka Alan Dolby)
Nick Whitely specialized in ICL mainframes, he committed
his first hack around January 1988 breaking into an ICL at Queen Mary
College, going on to take Hull, Nottingham, Bath and Belfast Universities,
always ICL's. He was raided on 6th July 1988, charged with Criminal Damage
and released on Bail. In 1990 he was tried for Criminal Damage and cleared
of criminal damage to computer hardware, but found guilty of two charges
of damaging disks. He was given 1 Year, 8 months suspended and served 2
months. His appeal was dismissed. Nick was known as Alan Dolby.
4.2.3. Paul Bedworth
A member of 8lgm, was arrested in June 1991
and has the privilege of being the first person to be tried under the
Computer Misuse Act 1990. He was acquitted of all charges in March 1993
after Bedworth when on to do a degree in artificial intelligence at
Edinburgh University. His handle was Wandii.
4.2.4. Neil Woods and Carl Strickland
Neil Woods and Karl Strickland, were and
still are the main members of 8lgm (8 Legged Groove Machine). As far as I
know they were arrested around the same time as Paul Bedworth, June 1991.
But didn't stand trial till May 1993. They both (I think) pleaded guilty,
and were convicted for six months each. They were the first people to be
jailed under the Computer Misuse Act 1990. They publish the 8lgm
security advisories, and act as computer security consultants. Neil Woods
is certainly an active security consultant. Neil Woods was also known as
pad and Karl Strickland as Gandalf.
4.2.5. Eddie Singh
Eddie Singh was first arrested in (approx) 1988 for breaking into the
University of Surrey terminal rooms. He used the nickname Camelot and
was arrested very soon after the Computer Misuse Act came into operation
for hacking the Ritz video chain. There is a book about him: Beating the
System (Hackers Phreakers and Electronic Spies) by Owen Bowcott and Sally
Hamiliton (ISBN: 7475 0513 6 published by Bloomsbury Press, 1990)
4.2.6. Michael J Bevan
Michael J Bevan (aka Kujii) and Richard Price allegedly broke into US Airforce computers from the UK (one source suggests that they were attempting to attack the US airforce systems 'looking for evidence of Area 51 UFO coverups' by blueboxing through an 0800 number in Colombia).
The case against Bevan was dropped as not being worth the money to pursue; there was serious US law enforcement pressure to get him extradited to the USA, but of course once the FBI had secured their $200 million budget allocation to counter foreign cyber terrorists, the pressure to prosecute was reduced.
Bevan has appeared recently on a couple of BBC TV programs as a "reformed hacker"/security expert.
Section 5: Urban Exploration
5.0.1. I found some cool stuff in a skip. Is it legal to take it?
In a word, no. Apparently the contents belong to the company which is responsible for dumping and/or recycling the goods, therefore that would be the owner of the skip (or the local council, if it's a bin). This is quite a fuzzy area in Britain - I'm sure someone will be able to clarify the actual act of parliament against it.
5.0.2. What's the huge underground structure near xxxx?
If you're into underground structures (bunkers, etc.) the best place to start is a group called Subterranea Britannica who are into all that sort of stuff (and more besides). Most MOD bunkers from the Cold War era are detailed by Richard and his associates.
Section 6: Hacking The Media
6.0.1. How do I build a Cable TV descrambler?
There are many different types of Cable box in use in the UK. This deals
with Jerrolds (The most common type), But also generally covers most
boxes (like Scientific Atlanta, etc). If anyone has any more specifics
on other types, please feel free to e-mail faq@hackhull.com
with updates, corrections etc. to this..
6.0.2. How do I descramble channels?
Some old boxes do simple things to the horizontal and vertical sync of the
picture, and don't touch the sound etc. In cases like this it is probably
feasible to try and build a descrambler if you know what you are doing.
However, most modern boxes use some fairly ackward techniques. So people
thought: "Hmm, instead of building a descrambler, how about making the
cable box (which already has the descrambler built in) do all the hard
work for you?". So the 'test chip' and 'Cube' where born.
6.0.3. How can I hack digital TV?
The two main digital TV systems in the UK are:
Both systems have new firmware downloaded over the air - the Sky box can have firmware forced upon it remotely, the OnDigital box usually requires a manual initiation before a firmware update. Wily thinkers may consider at this point that self-written firmware could be inserted into a digital stream using a MUX generator (of which one is shipped with the Sagem experimental box for instance) and sent to the set-top box itself.
Section 7: Miscellaneous
7.0.1. What does "xxxx" stand for?
Get the alt.2600 faq for an excellent list of acronyms. Also try the jargon
file (see Section 5).
| London |
London 2600 meet on the first Friday of each month, just like other 2600 groups around the world, 7pm to 8pm at the bottom of the escalators in the Trocadero shopping centre, then on elsewhere. There is an underground passageway directly from Picadilly Circus Tube station.
Web: www.london2600.org.uk ¦ Email: meetings@london2600.org.uk |
| Bristol | The payphones near the Almshouse pub (part of the Galleries). Starts 6:45pm to 7:00pm; Pay phone numbers are +44-(0)117-929-9011, 929-4437, 922-6897. |
| Manchester | Meet at Cyberia Cafe, Oxford Road, at around 7pm. Email chase@webspan.net for more info |
| Hull | Meet in the Old Grey Mare, Cottingham Road, at around 7pm. First Friday of every month. Email dcups@hackhull.com for more info or check out the hackHull web page. |
| Leeds | Meet on the first Friday of each month outside the payphones on Leeds Train Station (next to John Menzies). Email wazza@norad.demon.co.uk |
Computer fairs also sell MP3 CDs with several albums on one CD, although recent discussions with stallholders suggest that record companies are cracking down on illegal digital bootlegs of albums. Also try searching on mp3.lycos.com for artist names and track titles.
It's this last one which is responsible for actually 'busting' people
for nicking 0.00005v of electricity.
7.0.3. What's all this "k3w1 d00d2" business about?
One explanation offered is ...
"It all stems from warez, warez d00dz 'traffic' warez (pirated software). The
practice of intentionally miss-spelling words and changing letters for numbers
etc come partly from the necessity to 'hide' files. So if someone (especially a
sysadm) decides to search the entire disk for a known software title, they
wouldn't be found"
...others claim its just sad kiddies who think it cool (or is that kewl :-) )
7.0.4. Where can I get warez/MP3's?
Sunday markets seem to be doing a roaring trade in the various warez CDs, but asking where to get them on alt.ph.uk will not get a
sensible reply. Try hanging around on #warez on irc (and its many derivatives, although I believe you need to know the name of someone already on to get an invite) and alt.binaries.ibm-pc.warez.
7.0.5. Who are British Telecom Security?
BT security is basically made up of the following four sections:
The focal point for 'expertise' within the group.
Director Of Security & Investigation.
Room A740
BT Centre
81 Newgate Street
London EC1A 7AJ
Tel: 0171 356 4928. Fax: 0171 356 5909.
Room A169
BT Centre
81 Newgate Street
London EC1A 7AJ
Tel: 0171 356 5234. Fax: 0171 356 6068.
Libra House.
Sunrise Parkway.
Milton Keynes MK14 6PH.
Tel: 01908 693939. Fax: 01908 693961.
btcertcc@boat.bt.com, Tel. +44 1908 634 000, +44 1908 230 343
Libra House,
Sunrise Parkway,
Milton Keynes,
Buckinghamshire,
MK14 6PH
Libra House.
Sunrise Parkway.
Milton Keynes MK14 6PH.
Tel: 01908 693838/3839 ;'Help desk' Fax: 01908 693860.
Also : 01908 693800...
Section 8: Resources
8.1. On The Internet
8.1.1. Mailing Lists
Mail majordomo@greatcircle.com and put
Can someone provide me with info please?
The Access All Areas Mailing List - mail majordomo@access.org.uk with
the word
Reporting and tracking of bugs and exploits. Mail listserv@netspace.org with
the phrase
| EFNet | #hack #phreak #2600 #phrack #hackers #phuk |
|---|---|
| Undernet | #hack #phreak |
| IRCnet | #hack #phreak #2600 #phuk |
| DALnet | #hack #phreak #hackers |
| alt.ph.uk | This group! |
| alt.2600 | Hacking & Cracking (though much of the discussion has now turned into flame wars) |
| alt.dcom.telecom | Telecom |
| alt.hackers | Hacking (in the old sense of the word, as in hacking a bit of code to fit a purpose) |
| alt.cellular-phone-tech | Mobile Phones |
| alt.security | Computer Security |
| comp.dcom.telecom | Telecom [moderated] |
| comp.dcom.telecom.tech | Technical telecom |
| comp.dcom.cellular | Cellular telecom |
| comp.security.unix | Unix security |
| comp.security.misc | Computer Security |
| de.org.ccc | See what the German scene is up to courtesy of the Chaos Computer Club, who usually run a Congress around Christmas/New Year |
| uk.telecom | UK Telecom Issues |
8.2.1. Books about Hackers
3 Accounts in one book, Mitniks Early Years, widely discredited by people close to him. Pengo and The Chaos Computer Club (which ties in with The Cuckoo's Egg) and Robert 'Internet Worm' Morris
Techno Hippy gets compulsive about East German Hacker
Early days of Old-Style MIT hackers, not to be confused with the film Hackers
8.2.2. Books about Systems
8.2.3. Magazines and Periodicals
Still available, despite reports to the contrary. Available at
Tower Records (Picadilly Circus branch) London, or direct from
the UK distributors AK Press http://www.akpress.com/ or by phoning 0131-667-1507 [Edinburgh]). According to Gremlin, also available in Borders, Leeds (http://www.bordersstores.com/stores/269/)
Also available from Tower Records (see above).
This is a copy of Blacklisted, which seems to just be texts stolen from the 'Net - not recommended.
8.3. TV and Film