Black Hat Exploits of the Stupid-Easy 80s

We didn't understand that we hadn't hacked anything, and neither did our teachers. Their misplaced awe at our ability to cloak our activities in anonymity was intoxicating.

Most of my cohort then are engineers now.

I worry that as security gets better, opportunities for creativity and exploration go away, which might not bode well for future generations.

BBS games started adding virtual currency that you could transfer between players. Some even participated in a network of BBS systems, allowing the movement of game currency from one BBS to another. These frequently didn't have input validation and you could transfer -1 to another player and they'd receive 4294967296 dollars. Unfortunately we were kids and kids do nasty things. We would completely upend a competitive game by giving all the underdogs huge wealth.

Pager numbers all fell in the same exchanges. Every number under 123-456-xxxx would be a pager. I wrote a program to war dial all these and leave the same victim's phone number on all the pagers. We did it to a friend and witnessed an endless stream of frustrated calls to their house for a few hours. Brutal.

A school system put their mechanical control systems on a modem. We acquired the software and directory that could access these control systems. Not only did they put all the HVAC systems on it, they also added things like emergency and off-hour lighting. Some of the stuff that was controllable through this remote interface was down right scary: boiler pressure measurements, boiler system valves, etc. We weren't stupid enough to mess with that but would have fun turning off all the lights at night, or turning up the heat before the Saturday morning recreation basketball games in the gym.

Start > Run, type "cmd", then:

    net send B131 "Hi there"

After a school wide DDoS from several students around me sending messages over and over like:

    net send * "this school is the worst"

Best story I remember there was this arrogant guy that worked with on the Unix department. He was into FreeBSD by that time and had an attitude towards the Linux guys. One day he left his table and forgot his machine open with a root prompt. They took the chance and modified inetd.conf to map a certain port to the shutdown program. People had so much fun shutting down his computer remotely and watching his reaction.

There was also this time working for a smaller company and we would prank each other all the time. I had admin access to the Linux router so I've created a NAT rule to redirect this guy's traffic to a transparent squid proxy running a perl script that relied on imagemagik to turn the images upside down. Got the script from a Slashdot post. Poor guy even tried to reinstall the OS to no avail. He eventually found out and had his revenge by going into my computer CMOS and setting disk access to PIO instead of DMA.

I also remember scaring people through Windows' net send commands and that one where you take a screenshot of the desktop then you remove all the icons and interface bars and set the screenshot as background image. Also randomly adding 'alias ls=exit' to some server /etc/profile.

One day I decided to mess with the egotistical teen teacher. I wrote a little TC++ program that ran from autoexec.bat. On bootup, it put out several seconds of a low frequency buzz from the PC speaker and then printed "Oh, Excuse me! I couldn't contain myself!" and then disappeared. At that point, the autoexec.bat removed the binary and then overwrite the old autoexec.bat over itself, removing any proof.

Nobody could say it was me, but the Librarian knew and said if I did it again I wouldn't be able to go back. But she also said he was really pissed by it and I get the feeling she got a kick out of it, too.

Poking around, my friend noticed a slightly hidden/obscured file that had a file size that matched the number of characters in the password. N char password, N byte file. The file didn't have the password in plaintext, so my friend asked the teacher of a common way to scramble a byte. The teacher quickly suggested, "XOR?"

So my friend decided to try XORing the bytes in the file with a few values to see what happend. His first guess was right: the password was "obscured" with:

  for (char *p = password_str; p != NULL; p++) {
    *p ^= 0xC9;
  }

https://memory-alpha.fandom.com/wiki/11001001_%28episode%29

I guess we know what show the author of the "security software" likes to watch...

Epilogue: my friend quickly did the obvious thing and made a boot floppy with a small program that printed out the password, so we had access to most of the computer in the school and discovered all the passwords we weren't supposed to know. I think we only used that to play bolo (early tank proto-battle-royale). However... several years later in my first year at university, I happened to talk to someone attending the local high school. The had a copy of my friend's boot floppy! I know we never bothered to upload it a BBS, but somehow it ended up in the hands of quite a few high school hackers in multiple cities.

My favorite was writing a fake/clone Windows 2000 login screen in Visual Basic and installing it on select library computers. It would capture the usernames and password and upload it to an FTP server. The login screen was pixel perfect.

My partner in crime took it too far one night and enabled the "snow day" version of the district website homepage for a few hours in the early morning. Half the kids didn't show up to school the next day. Some people insisted the website said snow day at one point but nobody could prove it.

I was 16 or 17 but thankfully I had the good sense to follow advice I'd heard from an older mentor: "don't do any harm because that's when someone starts investigating and you get caught"

Smoking drugs and hanging out with girls was way funner, completely zero regrets getting doing stuff like that out of my system early... considering the trajectory my life has been on I really didn't need post secondary. Can only imagine how stressful and expensive that would have been and to what depressing, indebted end.

There was a bunch of other fun stuff on that test prefix, but half of that is lost to the sands of time, the funnest I don't even know what the hell it was. I've asked random phone company linemen about it and they're basically just like "how the hell do you even know anything about this?", and can't tell me what this number I found was. I basically war-dialed it based on patterns from other numbers on the prefix and it'd give me 30 seconds and then a real dial tone (payphones around then actually used some recorded tone). Since I could call these numbers for free from the school payphone, it was easy to find, and that real dial tone was probably in the phone company HQ. We found this enormous list of interesting phone numbers from phonelosers.org (Wish those were archived!) and just started doing shit like calling the white house and the president of kenya's office. I think we only stopped after a friend of mine made a huge stupid mistake and tried to print the list out. The library printer just started spitting out REAMS of paper, the librarian was like what the hell and I just remember thinking damn he fucked up, and running away hahaha

So by just port scanning on the SMB port you’ll find a lot of computers and would have access to all their files.

I have walked onto MUDs and, annoyed at being killed by some wizard for saying "hi," (stupid n00b move on my part) figured out how to bring the game to a screeching halt in about fifteen minutes. They had to bring it all down and patch to make me go away. This wasn't a testament to my ability, it's just that nobody was thinking about this stuff in a defensive way.

Oh, your system won't let me email that file out, you'll just return it to me? Well, lemme just forge my send from so you give it to me anyway.

I got up to a lot of horsing around, almost all of it non-destructive because getting attention generally is not a great thing and it wasn't my stuff, I just wanted to see what was out there and you either had to hear about it from someone who knew it already or you had to stumble across it.

But for practical use, the old 0800 free calls trick of the early 80's was probably most favourite. Back then they introduced 0800 free calls, when landline calls in the UK wasn't cheap. These got used for marketing, so companies would have there 0800 sales etc. Now, outside office hours they would direct to a recorded message on the PBX. Then what you could do is after the message, if you stayed on the line it would drop you into the exchange and you then pressed 9 on tone dial pad and could dial any number you likes as if you was dialling from that exchange location. Most being in London so was nice for free calls. Had limited use for BBS access, case of all that routing and line quality at times as well initial set-up. But still fun.

If you ran SETUIC with no parameters, it set your UIC to [0,0], silently. Anyone, not just business students, could run it. The system environment variables pointed to it, like a big advertisement sign to a young CS student.

I learned many things about how the world works after accidentally discovering this fact. It is fortunate for me that a 2 year suspension was the extent of my punishment. They were hopping mad, not at my actions, but at those who I was foolish enough to share this knowledge with, and had acted far less conservatively than I had.

I later was a system administrator, elsewhere, for 15 years.

  - Pirate FTP sites were in plain sight with folders named with unprintable ASCII characters
  - My college-provided Telnet client for Windows included a backdoor FTP server with a plaintext user name and easily brute-forced password (unsalted hash that turned out to be a birthday of a school admin)
  - Admins had to resolve our network issues by connecting to network via modem, from our computers.  Of course terminal program had keylogging enabled...
  - Open SMTP relay was widespread and everywhere.  Spoofing and forging was as easy as a little Telnet and HELO

Win32 API and VB6 Subclassing. Open random chatrooms, collect all the screen names. Go to school. Computer dials AOL while parents at work. Tries Screen Names as password. 3 attempts before AOL Hangs up. Redials and tries next set of 3. Come home from school. Fresh Screen Names. Free AOL. Terrorize Hanson Chat Room with <font size = 9999999999999999> Instant Message. Everyone has left the chat

If you think cybersecurity is in a sorry state now, 80s and 90s were much, much worse.

Anatomy of a pirate

http://www.textfiles.com/piracy/anatomy.txt

The su binary was mine, she typed the root password and the cluster was mine.

I went to the administrators to say that I cracked the system and would like to be part of the administrators team. I was accepted.

I learned an awful lot over the next few years (as a student, and then as a PhD student) - this helped me to land a job at IBM, and then at another company that was expanding in Europe.

Of course we couldn't install games or our own software on the computers -- the `/Applications` folder was locked down and nothing would execute outside of it. They weren't totally stupid, they had some remote monitoring and privilege blocking software to prevent us from getting control of our own machines and doing silly things like playing games or even opening the Terminal. But eventually someone (not me, really, I wish I were this smart) figured out that inside of one of the pre-installed .app's there was a directory to which users still had write permission. So everyone in the entire school started playing Marble Blast Gold and, for some reason, Pokemon Red through an emulator, all just by dropping the programs inside the special fold `/Applications/SomeThingICantRemember.app/contents/special-folder/`. The games spread like wildfire because the school had also set up a system of shared network folders, one for each teacher, so that teachers could more easily share files with us. Turns out we could also use it to share files with each other. Lots of movies, as well. Eventually someone noticed and shut that all down.

Of course, highschool students want to play games instead of doing coursework, so one day someone (not me, really) realized that if you removed the battery from the laptop you could then unscrew the case and remove a stick of RAM, which would allow you to hold certain keys at boot to reset the PRAM or something like that. This would let you boot into safe mode, circumventing the remote monitoring and permissions software they had in place, and make your user account an administrator. Boom, games were back. I mostly used it to be able to work on software projects, of course, but I did end up playing a bit of Advance Wars.

I can't remember now but there was some issue where this didn't persist for very long -- maybe there were updates that the remote monitoring system would send that would reset your admin status? -- so you would have to go through the whole PRAM reset rigamarole, with a screwdriver, and that was a pain in the ass. I was out of school for a while my senior spring due to the flu and I figured out a way to totally disable the remote management software.

This was great, and I was having an awesome time working on software that would eventually get me my first programming job while I should have been focusing in class, when I got called down to the principal's office, where I was accused of being a computer hacker. I of course denied it, but they said that it certainly was odd that my computer had stopped communicating with the remote management software entirely. I think because I was so close to graduating and actually hadn't done anything wrong I got away with a week of detention and a firm promise to not do anything of the sort ever again.

Around that same time it had come out that certain administrators at the school were misusing the remote management software's features to spy on highschool students in their own homes, which was pretty absurd and of course a huge and expensive debacle, so I think they were somewhat more sympathetic to me disabling it than they might have been otherwise.

https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...

A little after someone logged in, the code would do something cute, like draw a crack on the screen. I once saw the guy next to me back away from the computer, and ask, "It's not supposed to be doing that is it?"

Perhaps not quite black hat, but I was amused at least. :)

knew where the school wrote down it's PPP dialup username/password for the entire school 10Base lan

war dialed the prefix to find the carrier in another town. free internet in high school. not a lot of modems. BBS software MSDOS

This piece brought a few memories and impressions forward.

One was hacking ULTIMA 2 and 3. Copy protection involved the bad sector technique. However, those programs did not do an in depth error check. Atari machines made a beep on each disk sector read.

To play a copy of the game, one just counted the beeps, open the drive door, wait for the error sound (how handy is all that?), then close the door and carry on.

Chain smoking... all through primary and most of high school, the teachers lounges were filled with tobacco smoke. To their credit, the educators did not reek in class, well one did, but those areas of the building did.

All grades were old school analog, in the grade book, in pen. Changes were done with a strike through, new value, initial.

One of my peers wrote a book report program in BASIC that would generate a fairly healthy set of variations. The seed was a wait for input loop. Was double digit report success before there were questions.

Someone plugged an expansion card into a running Apple ][ computer and killed it. Despite a dead CPU, it displayed video anyway. Was my first real experience with simple hardware vs custom chips. Those computers did not have the spiffy sprites, colors and sounds the C64 and Atari machines had, but they did have just enough of the things that really mattered when it came down to getting real work done. Someone looked the machine over, plugged in a replacement chip and it was running again. Nice.

At the local university there was a card operated photo copy machine. 5 cents a page or something like that. But, one could ask for a copy, and listen for a little wine as some part began to spin up, hit eject on the card and get a free page.

Most locked doors in my primary school could be opened with just hand manipulation of the doorknob. Turns out they were not mounted in their recommended orientation. A gravity based attack was possible and I found it one day bored just fiddling with the knob. Turns out, the more I moved it, the more motion was possible!

Reporting that got me into trouble too. I remember that clearly!

Of course they were angry at the doors being so easy, tried to assign blame to me, a 6th grader, amd were more concerned about the work and cost to fix the issue.

If only people would just avoid doing anything unexpected, there would not be a problem. In fact, there was not a problem, until you came along...

I remember looks on adult faces I did not see often when my response was, "How would you know?"

Some foreshadowing there for sure.

Heck, I even did responsible disclosure. Took it right to them first. Could have blabbed it to others and then what?

Yeah, got the look again.

One phone related one was super interesting too. A friend and I took an old pulse dial phone apart and were kind of stunned to see how simple it was. Then we made calls successfully without the dialer, just slapping the handset hook with anything close to the expected pulse rate. Cool.

Then we called one another and were doing it again, just interrupting one another. Soon, an operator was on the line asking how we did this call. So we told her.

Turns out we had dialed some test sequence or other. Of course it was not published and was not intended for use doing an actual, live call. Tech had to reset the whole thing, but we did get a super cool tour of the system later as that same tech was happy to show us how the robot like, electromechanical system worked. Amazing. These trees of open circuits! When one dialed a number, that number was an address that literally moved an rotated arms that closed the circuit to connect the intended phones!

Fun times. So much was human scale and could be directly seen, heard, felt and was slow enough to be explored directly.

My student ID in college was my SSN, and that was only 20 years ago. :(

I remember a few of these: "cust/custpw", "rcust/rcustpw", and "craft/craftpw" come to mind. Almost nobody removed or changed the password to these accounts.

We'd find the machines using a "wardialer" (named after the phone scanning scene in Wargames) app that would dial every number and look for modems. We used a DOS scanner called "ToneLoc." We lived in Cincinnati and could easily scan all kinds of local number prefixes for free that overlapped with areas that were likely to dredge up a rich PBX haul: downtown, near the airport, near universities, etc. A certain kind of weird 1200-bps answer with unusual parity settings (7E1 if I remember correctly) was a dead giveaway for one of these ridiculously vulnerable AT&T PBX machines.

Once you got in you could pull pranks, set up remote access lines to get "free" phone calls, set up party lines for you and your friends, etc.

I was like 14 or 15 at the time.

We also found other "phun" things with our wardialer including large outdoor signs with modems to allow remote configuration of the text they would display. If you saw "SMOKE POT EVERY DAY" and similar things a 15 year old would write on a highway or advertising sign in Cincinnati in the early 1990s that was us.

There was a real sense of exploration back then. When we scanned areas like downtown Cincinnati we'd find tons and tons of modems that would answer with mysterious (to us) prompts or blobs of binary spew that I'm sure represented protocols we didn't know how to emulate. A few times we managed to try obvious-sounding login/password pairs on some of these login prompts and find ourselves inside an Ultrix or a SunOS machine full of mysterious data. We really didn't bother anything on those machines, just looked around. We pulled pranks with things like signs but the only things we really ever messed with or possibly damaged were the PBXes. There were just too many fun things to do with those.

The weirdest thing I remember finding was something that initiated an Xmodem transfer and sent a black empty pixmap and then hung up. I wonder if it was some kind of camera or industrial monitor that was not actually working but was still on.

The most "alarming" thing we found was some kind of building controller that we assumed belonged to a downtown skyscraper and seemed to control elevators, which we didn't fuck with out of concern that it could actually hurt people. Don't know if you could have done anything dangerous with it but we didn't want to try so we just dropped that one.

There just wasn't a lot of security back then because it was all new and very few people knew how to do what we were doing. Even though Wargames popularized the idea of phone scanning people still seemed to assume that a live modem on a phone line was secure if the number was obscure.

All that started changing really rapidly in the late 1990s when tons of people got online.

Edit: found the scanner!

https://en.wikipedia.org/wiki/ToneLoc

https://archive.org/details/20040130-bbs-mthreat

net use \\123.45.6.78\

dir \\123.45.6.78\