Searching for Susy Thunder
theverge.com
theverge.com
https://archive.org/stream/8BBSArchiveP1V1/8BBS_Archive_P1V1...
Seems it was digitized from dot-matrix printout by a packrat/historian who got the logs alongside some old gear they were buying.
http://silent700.blogspot.com/2014/12/is-this-something.html
Found this while poking around. Seems someone representing their self as one of the DEC employees that ran 8BBS dropped a short message about it on everything2 back in 2006.
https://everything2.com/title/8BBS
https://everything2.com/user/FTCnet
And here's a 1987 interview with the Tuc that acted as the contact at the beginning of the article.
The printouts were old 9-pin dot matrix, and somewhat faded in parts. The OCR I had access to does very poorly with that sort of type. There is an effort underway to transcribe all of the posts into an interactive web format. Someday!
Edit - the exact message is "Because of its privacy settings, this video cannot be played here." I'm guessing it's geo-locked.
It is because you turned off sending a referrer in Firefox (network.http.referer.XOriginPolicy in about:config).
The video is domain blocked, meaning it can only be played when you are on a specific domain. Because you disabled referrers, vimeo doesn't know you are on hackcur.io so it thinks you are opening it through a direct link.
I don't know. Charisma and looks are pretty much orthogonal, at least for some people. The canonical example is Hitler, somebody whom you'd think people would instinctively avoid at work or the neighborhood bar, yet who somehow ended up running Germany.
It never hurts to be hot or handsome -- would a young Donald Trump who looked and sounded like Hitler have gotten very far in life? -- but it clearly isn't an absolute requirement.
I disagree. For example, if you're made up gorgeous and this leads a security checkpoint guard to notice you, and then they're checking you out and realize that your shoes are unusually fashionable, and then they notice that your badge lanyard is the wrong color and your badge looks a bit crinkly, now your cover is blown — all because you drew their eye.
That's not to say that there is no value in attractiveness — it's just not a guaranteed upside that can be taken for granted as harmless. This also shows up in spycraft, where "unmemorable" can be a very strong asset.
While the company was downsizing (dot-com bust) the CTO told me to batten down the hatches while Susan was being laid off. I told him that I'm fairly confident she knows more about NT than I do and that I didn't think I could do enough to secure things, so we more or less shut things down for the night.
I sort of remember the whole company being scared of her in general. I don't know why though, she was always very nice to me and seemed pleasant in general. It was an overreaction to shut down the network that night, Susan never attempted revenge. In hindsight, she was probably an adult that understood that companies fail and it wasn't personal.
> No, I say, thinking back to a year previous — before the plague, before our phone calls, before I finally found Susan, when her name still meant nothing to me.
> “Because I never got caught,” she says. “All the best hackers, all the best phreakers in the world, we don’t know who they are because they never got arrested. And they never went to prison. This is why you don’t know who the best ones in the world are. This is the truth. Think about it.”
And it's that kind of arrogance and survivorship bias that gets you thinking you're better than you are. She was lucky she was not caught, or the others were unlucky they did get caught. The people around her that she considered as her fellow peers got caught after all.
> I went looking for the great lost female hacker of the 1980s. I should have known that she didn’t want to be found.
But then she _WAS_ found for the purpose of writing this article. So if not getting caught is the measure of being a good hacker... And she'll be incredibly easy to track down now.
> Kevin Mitnick publicly maintains that he had nothing to do with the destruction of the US Leasing files. In his autobiography, he characterizes Susan as a “wannabe hacker” who took revenge on him and Lewis using a backdoor into the US Leasing system that he had created.
I'm inclined to agree with Mitnick. There are numerous examples in this article alone of her acting in a vengeful manner, e.g.:
> But when one of her exasperated targets called her a small-brained little twerp, Susan got mad. In retribution, she called the phone company and, posing as the woman, had her phone number changed.
And really how likely is this to actually be true:
> She claims to be one of only three women to have slept with all four Beatles, securing the trickiest, Paul McCartney, through an elaborate pretext that involved having his wife Linda whisked away in a limo for a staged photoshoot.
It reads like the wishful thinking of somebody who had bigger dreams than their own reality, clinically delusional. Some of these things I could let go, but there is too much "it happened, trust me". Bare in mind that the _ENTIRE_ point of social hacking is to spin a lie so good that you believe it yourself.
Her friends were found. The journalist only got her email after Susan agreed for her friend to share it.
“All the best hackers, all the best phreakers in the world, we don’t know who they are because they never got arrested. And they never went to prison. This is why you don’t know who the best ones in the world are. This is the truth. Think about it.”
Mitnick really was quite the grifter before he turned his life around.
Entertaining? Yes. Useful as a training? Ehhh...
"Nobody knows what a smart fish tastes like"
We invented ways to catch ALL SEALIFE. Not just smart fish.
And a really smart fish would hang out somewhere in the hadal zone, we don't even know half the species that exist there.
Unless by smart fish you mean either unhatched fish -OR- fish too small to be caught.
Fish have ranges. And hiding in the hadal zone is the fish equivalent "I'll hide in the hell desert". Not a smart plan.
That fish is so smart, it was never even spotted.
The Taiji Dolphin hunt is cruel - close to or at par with the Faroese cruelty.
Dolphins trust humans. The Taiji fishermen hunt and Capture them for money.
This all assumes that getting caught is a bad thing. For some hackers it leads to respect and eventually government / private jobs. This is obviously not true for non-technical criminals.
Errrr, should we tell you about Blackwater, Thalès, BAE Systems, Bolloré, Nestlé, Coca-Cola, Alexandre Benalla, Serge Dassault, NSA? They are just some examples of very famous people/corporations engaging in high-level criminal activities ranging from basic corruption to actual slavery to wide-scale murder.
We live under capitalism, a system which glorifies criminal activity as the path to success and social recognition. Sometimes, this criminal activity is legal and you can't believe how that's even possible, but many times it's illegal but when people/organizations become too influential they are far above the law.
Don't even get me started on law enforcement engaging in criminal activity such as organizing drugs trade like in USA's crack epidemics or with France's chief anti-drug cop leading the biggest smuggling ring for cocaine/hashish for years. One could even say in some circles, being ready to defy the law is a sign you're part of this circle. For example, in France at least, murderous cops are more likely to get promotions than to get kicked out of police, because once they took part in murder and held their mouth shut through the shitstorm without compromising colleagues/higher-ups, they have successfully demonstrated their loyalty to the establishment.
Of course, you're free to not research scandals involving the people/organizations i mentioned, take the blue pill and go back to dreaming about elections and free market and how fair our society is.
And even though I'd tend to agree, I absolutely don't understand why you're making a connection to capitalism. Any other more socialist system was nothing else but much worse, and the social democracies of today have just the same issues with police etc you're talking about.
That's not entirely wrong, but "criminal" is often used figuratively to refer to morally-abhorrent behavior. I took the liberty to employ the word this way to address the blind spots of our respective legal systems. I personally wouldn't call a weed smoker a criminal but would call a murderous cop a criminal: that France's legal system does not agree with me is unfortunate but irrelevant.
> Any other more socialist system was nothing else but much worse, and the social democracies of today have just the same issues
That's a debatable point of view, but my opinion is that what you refer to as "socialism" or "social democracy" is in fact just another brand of capitalism. For example, in anarchist circles, the USSR was widely criticized as "State capitalism" [0]. In this mental framework, laissez-faire capitalism (Randt/Hayek ideals) is yet another brand of capitalism, although it has yet to be proven that capitalism can exist without nation states to enforce it, while stateless communism has a varied history throughout the ages.
[0] https://theanarchistlibrary.org/library/emma-goldman-there-i...
Ad brands of capitalism - well OK, but any place that tried any brand of anarchism failed even harder than any brand of capitalism ever did, and the end result was much worse for the individual people who lived there. The US was always a heaven on Earth in comparison, even during its worst era of unregulated capitalism.
USSR is the largest example but it was a poor country. There were rich countries that voted for true communism democratically and even there it devolved into a catastrophe in less than a year (after WW2, or after a few years for the more recent examples). IMHO human nature makes it absolutely impossible to make communism work, because it will be immediately taken over by power hungry people for their own benefit. Any anarchism that might be desired will never be allowed to develop, these power hungry people will make sure they control it.
At the other end, Native American tribes for example would capture people effectively taking slaves but they integrated them into their tribes. Similar practices where fairly widespread in many cultures without firm centralized governments. The captured wife/sex slave divide is historically nuanced. Keeping people under lock and key takes effort and limits the forms of manual labor they can do. Mines where often extremely horrific because they where so easily managed. Hunting on the other hand requires significant freedom of movement.
> widespread institutions run into real limits.
The only limit of European feudal lords was how many people they could kill/cause death before there was nobody left to do slave work and fight in wars for them. America was a heaven for the serfs.
They may have owed their lord specific quantities of uncompensated labor, but conversely that meant they had socially and legally protected free time.
Also, Serfdom largely disappeared in Western Europe well before America was a thing. “In England, the end of serfdom began with the Peasants' Revolt in 1381. It had largely died out in England by 1500 as a personal status and was fully ended when Elizabeth I freed the last remaining serfs in 1574” “ Serfdom was de facto ended in France by Philip IV, Louis X (1315), and Philip V (1318).[6][7] With the exception of a few isolated cases, serfdom had ceased to exist in France by the 15th century. In Early Modern France, French nobles nevertheless maintained a great number of seigneurial privileges over the free peasants that worked lands under their control. Serfdom was formally abolished in France in 1789.” https://en.wikipedia.org/wiki/History_of_serfdom. Various exceptions did exist but it simply wasn’t that common in Western Europe.
That is indeed the history in USSR/Spain for example, however i don't think it has to be this way. Many smaller-scale societies could be considered anarchist. In our 21st century, the only large-scale example i can think of is the zapatistas caracoles in Chiapas. Very interesting to read about if you're curious: millions of people living in autonomous communes without central government (although there's a central army to protect communities from the Nation State, it does not hold *any* political power). Money has not been abolished but its significance has been reduced due to collective work/property (cooperatives). Their judicial system is also very interesting, as it's based on reparations not punishment which appears to work great if you take murder/rape as a metrics which has almost entirely disappeared since the revolution in 1994.
I'm not saying the exact same model is applicable everywhere, but examples like this demonstrate that anarchism is possible on a wide scale. Although to be fair most zapatistas would not label themselves "anarchist", despite claiming to be from the anti-authoritarian/bottom left (the historical definition of anarchism).
To make my statement more correct I should have distinguished between crimes that are discovered and those that are prosecuted. For example, I wouldn't have considered the murderous police to have been "caught" if they didn't face prosecution, but that is simply semantics.
Just saying...
LOL
then probably yea, but when it comes to skills?
I'd say that they're not really that unknown - https://ctftime.org/
That's fair, but just take a look at how complex latest biggest hacks are like
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
I suppose I shouldn't be so judgmental, they often seem to have pretty fucked up childhoods and are no doubt a product of that. I just don't see any good that comes from idolizing them.
It may be true for the early hackers, but there are many famous hackers that have not been in prison. Just think of the people like Dan Kaminsky.
This is still true today, and of more hunted groups than just hackers.
It's underappreciated just how tolerant society was, with respect to 80s and 90s hacking culture.
We had the war on drugs, but pre-9/11, secrecy and hacking were... novelties. As in, people couldn't conceptualize the worst results of bad people using bad methods.
You can see this in the legal filings of early computer prosecutions. Much of it is spent trying to explain to a jury just why phone phreaking or computer hacking is bad. E.g. "Could launch nukes from a payphone!" Or Tron, WarGames, etc.
Now, network intrusion brings to mind ransomware, and a hop, skip, and jump away from helping ISIS, in terms of jury sentiment.
On the other hand, there's an entire white and grey hat culture that wasn't really as defined in that period, so it's fair to say there are also more legimate paths for someone deeply interested in systems.
Uhuh, yeah, ok
> It’s not lost on me, as she tells these stories, that I’m on the phone with a phone phreaker or that I’m attempting to tell the true story of an expert deceiver
You mean, they were socially engineered into revealing themselves? Hoisted by their own petard.
> Back then, everyone had a landline, but people in the public eye kept their phone numbers out of the Yellow Pages.
The Yellow Pages were for company/business numbers, the phonebook (or part of the phonebook) with the personal phone numbers was plain white. Makes me feel old (and wonder how young the author is). Or is "keeping your number out of the Yellow Pages" a commonly-used expression I'm not familiar with?
As in "Did you look him up in the phone book?" which might be answered "I couldn't find him in the White Pages, but the phone's probably in his mom's name and I think she has a different last name, so that might be why. I think she has a business but I don't even know what industry so the Yellow Pages don't help here."
It's funny how these weird pieces of knowledge stick even with almost zero exposure. Every time I got a phone book or yellow pages dropped on my doorstep in some flimsy transparent bag, I'd throw it directly into the recycle.
https://www.peoplefinders.com/assets/img/header/headterms/pr...
Sun Microsystems developed a directory service now called "Network Information Services" (or NIS), however it was originally called "Yellow Pages".
They obviously didn't realise that the "Yellow Pages" were already a thing, so they renamed. All of their commands still begin with yp (ypbind, ypcat and others from what memory serves)
Just thought it was interesting. Also source[0].
[0]: https://en.wikipedia.org/wiki/Network_Information_Service
I always thought it was called that way on purpose.
If true, then why pick the name "Yellow Pages" at all?
Of course they knew what it was named after.
This is almost certainly not true. More likely legal decided they could get into IP trouble, or marketing decided they didn't want the association.
That's... not very private?
When Terminator wanted to find Sarah Connor, he just went to the phonebook and found her. (Well, all the other Sarah Connors, anyway.) Nowadays, he would need to get into Facebook HQ first!
That was the white pages, not the yellow pages (which were paid advertisements).
White pages had name and number for every customer, typically you were in there unless you opted to have an unlisted phone (and paid an extra fee for that, most likely).
The thing to think about is this is pre-internet technology for finding how to contact someone. There were reverse listing books too but not generally available (given a number, who owned it).
These pages go back to pure analog telephone systems (no caller ID, no call-back, no voicemail, nothing). Oh, and in some places it was common to share a number between multiple houses (party line).
Natwest around the same time also had a dialup system, where you could do banking transactions over a dialup modem. It worked on the pretense you knew the account numbers you wanted to shift money to, its main security was the bank transfers were done offline, then their app, a frontend for a DUN terminal, uploaded the batch of bank transfers and then logged off within 30seconds or something like that. Now it was possible to access the Natwest system without using their frontend app on Win95, and just dial in and make the transfers yourself, your only constraint was the time limit and having a password to access the system in the first place. Security wasnt their strong point from what I could tell.
The Project Zero and APT type stuff that hits the news is the exception, not the rule, which is why it hits the news in the first place.
To me hacking entails a thorough understanding of the environment.
[Good] social engineering [Bad] hacking
The vast majority of hacking and social engineering are pedestrians.
If anything it‘s people like you worshipping technology itself and ignoring their users why social engineers are so effective.
To be honest even I didn't have a high opinion of social engineering conmen, until I watched "Catch Me If You Can" and read about Frank Abagnale[1].
That said, most of the big hacks do involve social engineering angle. It's a cocktail of tech hacking + social engineering + good old plain con.
https://news.ycombinator.com/item?id=27048793 "New book contends that Catch Me If You Can is mostly made up"
Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee.
Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.
That's like saying running a brute password cracker or port scanner requires no skill or hard work at all, so lumping software work under hacking is really an insult to all the "real hackers" (whatever real means).
Social engineering often requires you to get someone else to do something that they should not, don't want to and often are trained not to do. Very often in direct interactions, not only is it hard (depending on target you might also need a lot of background knowledge, needing significant prework), but it typically involves much higher direct risk (which makes it even harder).
Yet when you receive a phishing email, you can usually find clues it's not legit (such as typos). It takes craft to make a convincing one. Pretending to work somewhere sounds even more hacky: i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket.
Understanding human systems to infiltrate an organization is pretty much like reverse-engineering. As someone who's not practicing either, i would say social engineering looks even more complicated for one reason: when you're reverse-engineering a program/API, you usually take some steps to protect yourself. Either you run the program on an isolated network, or you borrow someone else's network (VPN/Tor/etc) to attack an API.
When you're attacking a corporation via social engineering, you're on the front line smiling to the people at the front desk asking why your work badge isn't working anymore or pretending to be the toilet repair crew. Every probing step you take can unmask you, and the consequences of that can be much more quick/severe than if you leaked a random IP address trying some weird request.
If you can recognize them easily, then you could create them easily too. The problem isn't acquiring skills or knowledge, its having weak morals and being desperate.
Its an insult for a very good reason: Con men are dangerous. In the same way actual hackers see computers as targets, they see people as targets, not as human beings. They usually end up with some degree of psychopathy.
This is handy when youa re selling your consulting services.
One of our consultants will con .. We have sone of the best con artists ....
The term itself is a con.
“Conning" is just hacking systems consisting of one or more people.
> People have been doing it since the beginning of time and one can do it with very little technical skill.
People do other kinds of hacking with very little skill and a few focussed tricks (often borrowed form others), too. OTOH, deep knowledge of social systems allows doing original hacks of more complex social systems with greater theoretical safeguards (often, they are just as weak if you can identify the right point of attack, but that's where the knowledge comes in; just as with systems composed of things other than humans.)
> It's an insult to those who work hard for deep knowledge and technical ability, to call social engineering "hacking".
No, it's not.
So the effect repeats as you scroll through the document, even after the images are first lazy loaded.
[1] https://developer.mozilla.org/en-US/docs/Web/API/Intersectio...
elinks <url>
elinks -dump <url> | lpr
It's great design when a telex machine can read your article as well than a modern HD screen. It's odd design when the telex becomes better at doing so.
The way the images appear/disappear while scrolling makes me dizzy.
In a way, if it is supposed to be interactive, this is a great success from my point of view. Despite being interactive, it's not an article as an application type deal where no content will load without 10 XHRs and 15 JS scripts. It's a fully working article, whether you look at it on a macbook screen or telex paper.
EDIT: Just went and printed it out.
elinks -dump <url> | lpr.
I have trouble getting past this sentence. Did they mean “digital”?
Also she ratted on Mitnick, those people are called informants, not hackers.
There is a difference between a pentester and a con man.
A con man with technical skills is still a con man. A hacker is more similar to a modern-day wizard commanding computers to do his bidding.
This is a tangent but it's mind-boggling that this piece of pseudoscientific garbage [1][2][3] is still used by supposedly legitimate government agencies.
[1]: https://www.apa.org/monitor/julaug04/polygraph
It was mind-boggling, to me, the argument on the iPad zooming feature[1]. This was three people — with no technical knowledge at all — arguing about a technology which, ultimately, could influence the rest of the life of a fourth person…
How often does this happen and is not recorded by a camera?!
Almost all lawyers and judges that I've met have no computer expertise.
Guessing there's a chance this might be her? https://www.thesprucecrafts.com/susan-headley-768108
It sounds like the real Susan H. had a fairly intense life. A lot of the stuff that she’s credited with, does not age well.
I’m hoping that she has managed to find some modicum of happiness and peace.
The article says she had a coin hobby.
In any case, she wants to be left alone. I have no interest in doxxing her.