Where Did This All Start

Where Did This All Start?

A complete historical account of cracking is beyond the scope of this book. However, a
little background couldn't hurt. It started with telephone technology. Originally, a handful
of kids across the nation were cracking the telephone system. This practice was referred
to as phreaking. Phreaking is now recognized as any act by which to circumvent the
security of the telephone company. (Although, in reality, phreaking is more about
learning how the telephone system works and then manipulating it.)
Telephone phreaks employed different methods to accomplish this task. Early
implementations involved the use of ratshack dialers, or red boxes. (Ratshack was a term
to refer to the popular electronics store Radio Shack.) These were hand-held electronic
devices that transmitted digital sounds or tones. Phreakers altered these off-the-shelf tone
dialers by replacing the internal crystals with Radio Shack part #43-146.
_________________________________________________________________________________________
NOTE: Part #43-146 was a crystal, available at many neighborhood electronics stores
throughout the country. One could use either a 6.5MHz or 6.5536 crystal. This was used
to replace the crystal that shipped with the dialer (3.579545MHz). The alteration process
took approximately 5 minutes.
_________________________________________________________________________________________



Having made these modifications, they programmed in the sounds of quarters being
inserted into a pay telephone. From there, the remaining steps were simple. Phreaks went
to a pay telephone and dialed a number. The telephone would request payment for the
call. In response, the phreak would use the red box to emulate money being inserted into
the machine. This resulted in obtaining free telephone service at most pay telephones.
Schematics and very precise instructions for constructing such devices are at thousands of
sites on the Internet. The practice became so common that in many states, the mere
possession of a tone dialer altered in such a manner was grounds for search, seizure, and
arrest. As time went on, the technology in this area became more and more advanced.
New boxes like the red box were developed. The term boxing came to replace the term
phreaking, at least in general conversation, and boxing became exceedingly popular. This
resulted in even further advances, until an entire suite of boxes was developed. Table 3.1
lists a few of these boxes.


Table 3.1. Boxes and their uses.

_________________________________________________________________________________________
|Box What It Does
|
|Blue Seizes trunk lines using a 2600MHz tone, thereby granting the boxer the same |privileges as the
|
|average operator
|
|Dayglo Allows the user to connect to and utilize his or her neighbor's telephone line
|
|Aqua Reportedly circumvents FBI taps and traces by draining the voltage on the line
|
|Mauve Used to tap another telephone line
|
|Chrome Seizes control of traffic signals
|__________________________________________________________________________________________
There are at least 40 different boxes or devices within this class. Each was designed to
perform a different function. Many of the techniques employed are no longer effective.
For example, blue boxing has been seriously curtailed because of new electronically
switched telephone systems. (Although reportedly, one can still blue box in parts of the
country where older trunk lines can be found.) At a certain stage of the proceedings,
telephone phreaking and computer programming were combined; this marriage produced
some powerful tools. One example is BlueBEEP, an all-purpose phreaking/hacking tool.
BlueBEEP combines many different aspects of the phreaking trade, including the red
box. Essentially, in an area where the local telephone lines are old style, BlueBEEP
provides the user with awesome power over the telephone system.
It looks a lot like any legitimate application, the type anyone might buy at his or her localsoftware outlet. To its author's credit, it operates as well as or better than most
commercial software. BlueBEEP runs in a DOS environment, or through a DOS shell
window in either Windows 95 or Windows NT. I should say this before continuing: To
date, BlueBEEP is the most finely programmed phreaking tool ever coded. The author,
then a resident of Germany, reported that the application was written primarily in
PASCAL and assembly language. In any event, contained within the program are many,
many options for control of trunk lines, generation of digital tones, scanning of telephone
exchanges, and so on. It is probably the most comprehensive tool of its kind. However, I
am getting ahead of the time. BlueBEEP was actually created quite late in the game. We
must venture back several years to see how telephone phreaking led to Internet cracking.
The process was a natural one. Phone phreaks tried almost anything they could to find
new systems. Phreaks often searched telephone lines for interesting tones or connections.
Some of those connections turned out to be modems.
No one can tell when it was--that instant when a telephone phreak first logged on to the
Internet. However, the process probably occurred more by chance than skill. Years ago,
Point- to-Point Protocol (PPP) was not available. Therefore, the way a phreak would have
found the Internet is debatable. It probably happened after one of them, by direct-dial
connection, logged in to a mainframe or workstation somewhere in the void. This
machine was likely connected to the Internet via Ethernet, a second modem, or another
port. Thus, the targeted machine acted as a bridge between the phreak and the Internet.
After the phreak crossed that bridge, he or she was dropped into a world teeming with
computers, most of which had poor or sometimes no security. Imagine that for a moment:
an unexplored frontier.
What remains is history. Since then, crackers have broken their way into every type of
system imaginable. During the 1980s, truly gifted programmers began cropping up as
crackers. It was during this period that the distinction between hackers and crackers was
first confused, and it has remained so every since. By the late 1980s, these individuals
were becoming newsworthy and the media dubbed those who breached system security
as hackers.
Then an event occurred that would forever focus America's computing community on
these hackers. On November 2, 1988, someone released a worm into the network. This
worm was a self-replicating program that sought out vulnerable machines and infected
them. Having infected a vulnerable machine, the worm would go into the wild, searching
for additional targets. This process continued until thousands of machines were infected.
Within hours, the Internet was under heavy siege. In a now celebrated paper that provides
a blow-by-blow analysis of the worm incident ("Tour of the Worm"), Donn Seeley, then
at the Department of Computer Science at the University of Utah, wrote:
___________________________________________________________________________________________
November 3, 1988 is already coming to be known as Black Thursday. System administrators
around the country came to work on that day and discovered that their networks of computers
were laboring under a huge load. If they were able to log in and generate a system status listing,
they saw what appeared to be dozens or hundreds of "shell" (command interpreter) processes. If
they tried to kill the processes, they found that new processes appeared faster than they could kill
them.
___________________________________________________________________________________________

The worm was apparently released from a machine at the Massachusetts Institute of
Technology. Reportedly, the logging system on that machine was either working
incorrectly or was not properly configured and thus, the perpetrator left no trail. (Seely
reports that the first infections included the Artificial Intelligence Laboratory at MIT, the
University of California at Berkeley, and the RAND Corporation in California.) As one
might expect, the computing community was initially in a state of shock. However, as
Eugene Spafford, a renowned computer science professor from Purdue University,
explained in his paper "The Internet Worm: An Analysis," that state of shock didn't last
long. Programmers at both ends of the country were working feverishly to find a solution:

___________________________________________________________________________________________
By late Wednesday night, personnel at the University of California at Berkeley and at
Massachusetts Institute of Technology had `captured' copies of the program and began to analyze
it. People at other sites also began to study the program and were developing methods of
eradicating it.
___________________________________________________________________________________________


An unlikely candidate would come under suspicion: a young man studying computer
science at Cornell University. This particular young man was an unlikely candidate for
two reasons. First, he was a good student without any background that would suggest
such behavior. Second, and more importantly, the young man's father, an engineer with
Bell Labs, had a profound influence on the Internet's design. Nevertheless, the young
man, Robert Morris Jr., was indeed the perpetrator. Reportedly, Morris expected his
program to spread at a very slow rate, its effects being perhaps even imperceptible.
However, as Brendan Kehoe notes in his book Zen and the Art of the Internet:

___________________________________________________________________________________________
Morris soon discovered that the program was replicating and reinfecting machines at a much faster
rate than he had anticipated--there was a bug. Ultimately, many machines at locations around the
country either crashed or became `catatonic.' When Morris realized what was happening, he
contacted a friend at Harvard to discuss a solution. Eventually, they sent an anonymous message
from Harvard over the network, instructing programmers how to kill the worm and prevent
reinfection.
___________________________________________________________________________________________

Morris was tried and convicted under federal statutes, receiving three years probation and
a substantial fine. An unsuccessful appeal followed.

The introduction of the Morris Worm changed many attitudes about Internet security. A
single program had virtually disabled hundreds (or perhaps thousands) of machines. That
day marked the beginning of serious Internet security. Moreover, the event helped to
forever seal the fate of hackers. Since that point, legitimate programmers have had to
rigorously defend their hacker titles. The media has largely neglected to correct this
misconception. Even today, the national press refers to crackers as hackers, thus
perpetuating the misunderstanding. That will never change and hence, hackers will have
to find another term by which to classify themselves.
Does it matter? Not really. Many people charge that true hackers are splitting hairs, that
their rigid distinctions are too complex and inconvenient for the public. Perhaps there is
some truth to that. For it has been many years since the terms were first used
interchangeably (and erroneously). At this stage, it is a matter of principle only.