Underground: Hacking, madness and obsession on the electronic frontier
by Suelette Dreyfus · English · Gutenberg #4686 · 930,346 chars · public domain (US)
The Project Gutenberg eBook of Underground: Hacking, madness and obsession on the electronic frontier
This eBook is for the use of anyone anywhere in the United States and
most other parts of the world at no cost and with almost no restrictions
whatsoever. You may copy it, give it away or re-use it under the terms
of the Project Gutenberg License included with this eBook or online
at www.gutenberg.org. If you are not located in the United States,
you will have to check the laws of the country where you are located
before using this eBook.
*** This is a COPYRIGHTED Project Gutenberg eBook. Details Below. ***
*** Please follow the copyright guidelines in this file. ***
Title: Underground: Hacking, madness and obsession on the electronic frontier
Author: Suelette Dreyfus
Researcher: Julian Assange
Release date: November 1, 2003 [eBook #4686]
Most recently updated: March 25, 2024
Language: English
Other information and formats: www.gutenberg.org/ebooks/4686
*** START OF THE PROJECT GUTENBERG EBOOK UNDERGROUND: HACKING, MADNESS AND OBSESSION ON THE ELECTRONIC FRONTIER ***
** This is a COPYRIGHTED Project Gutenberg eBook, Details Below **
** Please follow the copyright guidelines in this file. **
I have donated my book `Underground' to Project Gutenberg's
collection in memory of my great aunt, Lucie Palmer. Lucie was an
explorer, a naturalist, a keen undersea diver and above all a gifted
painter. In the last years of her life, she lost her vision due to
macular degeneration. She could no longer do her beloved undersea
paintings. But, while she could not travel in person, she continued to
travel in her mind through books for the vision impaired. I hope you
enjoy your journey to another world as much as she did.
-- From Suelette Dreyfus, Author, Underground
Underground --
Hacking, madness and obsession on the electronic frontier.
By Suelette Dreyfus with Research by Julian Assange.
`Gripping, eminently readable.. Dreyfus has uncovered one of this
country's best kept secrets and in doing so has created a highly
intense and enjoyable read' -- Rolling Stone
www.underground-book.net
This edition has been specifically adapted for speech synthesis. We
recommend using a different distribution with intact type-setting
for visual use.
First Published 1997 by Mandarin; a part of Reed Books Australia; 35
Cotham Road, Kew 3101.
a subsidiary of Random House books Australia.
a division of Random House International Pty Limited.
Copyright (c) 1997, 2001 Suelette Dreyfus & Julian Assange.
All rights reserved. Without limiting the rights under copyright
above, no part of this publication may be reproduced, stored in or
introduced into a retrieval system, or transmitted in any form or
by any means (electronic, mechanical, photocopying, recording or
otherwise), without the prior written permission of both the
copyright owner and the publisher.
Typeset in New Baskerville by J&M Typesetting.
Printed and bound in Australia by Australian Print Group.
National Library of Australia.
cataloguing-in-publication data:
Dreyfus, Suelette.
Underground: tales of hacking, madness & obsession on the electronic frontier.
Bibliography:
ISBN number 1 86330 595 5
1. Computer hackers--Australia--Biography.
2. Computer crimes--Australia.
3. Computer security--Australia.
I. Assange, Julian. II. Title.
364.1680922
Send all comments to "feedback@underground-book.net".
Preface to the electronic edition.
Why would an author give away an unlimited number of copies of her
book for free? That's a good question. When `Underground''s
researcher, Julian Assange, first suggested releasing an electronic
version of the book on the Net for free, I had to stop and think about
just that question.
I'd spent nearly three years researching, writing and editing the nearly
500 pages of `Underground'. Julian had worked thousands of
hours doing painstaking research; discovering and cultivating sources,
digging with great resourcefulness into obscure databases and legal
papers, not to mention providing valuable editorial advice.
So why would I give away this carefully ripened fruit for free?
Because part of the joy of creating a piece of art is in knowing that
many people can - and are - enjoying it. Particularly people who can't
otherwise afford to pay $11 USD for a book. People such as cash strapped
hackers. This book is about them, their lives and obsessions. It rubs
clear a small circle in the frosted glass so the reader can peer into
that hazy world. `Underground' belongs on the Net, in their ephemeral
landscape.
The critics have been good to `Underground', for which I am very
grateful. But the best praise came from two of the hackers detailed in
the book. Surprising praise, because while the text is free of the
narrative moralising that plague other works, the selection of material
is often very personal and evokes mixed sympathies. One of the hackers,
Anthrax dropped by my office to say `Hi'. Out of the blue, he said with
a note of amazement, `When I read those chapters, it was so real, as if
you had been right there inside my head'. Not long after Par, half a
world away, and with a real tone of bewildered incredulity in his voice
made exactly the same observation. For a writer, it just doesn't get any
better than that.
By releasing this book for free on the Net, I'm hoping more people
will not only enjoy the story of how the international computer
underground rose to power, but also make the journey into the minds
of hackers involved. When I first began sketching out the book's
structure, I decided to go with depth. I wanted the reader to
think, 'NOW I understand, because I too was there.' I hope those
words will enter your thoughts as you read this electronic book.
Michael Hall, a supersmart lawyer on the book's legal team, told me
in July last year he saw a young man in Sydney reading a copy of
`Underground' beside him on the #380 bus to North Bondi. Michael
said he wanted to lean over and proclaim proudly, `I legalled that
book!'. Instead, he chose to watch the young man's reactions.
The young man was completely absorbed, reading hungrily through his
well-worn copy, which he had completely personalised. The pages were
covered in highlighter, scrawled margin writing and post-it notes. He
had underlined sections and dog-eared pages. If the bus had detoured to
Brisbane, he probably wouldn't have noticed.
I like that. Call me subversive, but I'm chuffed `Underground' is
engaging enough to make people miss bus stops. It makes me happy, and
happy people usually want to share.
There are other reasons for releasing `Underground' in this format. The
electronic version is being donated to the visionary Project Gutenburg,
a collection of free electronic books run with missionary zeal by
Michael Hart.
Project Gutenburg promises to keep old out-of-print books in free
``electronic'' print forever, to bring literature to those who can't
afford books, and to brighten the world of the visually
impaired. `Underground' isn't out of print -- and long may it remain
that way -- but those are laudable goals. I wrote in the `Introduction'
to the printed edition about my great aunt, a diver and artist who
pioneered underwater painting in the 1940s. She provided me with a kind
of inspiration for this book. What I didn't mention is that as a result
of macular degeneration in both eyes, she is now blind. She can no
longer paint or dive. But she does read - avidly - through `talking
books'. She is another reason I decided to release `Underground' in this
format.
So, now you can download and read the electronic version of
`Underground' for free. You can also send the work to your friends for
free. Or your enemies. At over a megabyte of plain text each, a few
dozen copies of underground make an extremely effective mail bomb.
That's a joke, folks, not a suggestion. ;-)
Like many of the people in this book, I'm not big on rules. Fortunately,
there aren't many that come with this electronic version. Don't print
the work on paper, CD or any other format, except for your own personal
reading pleasure. This includes using the work as teaching material in
institutions. You must not alter or truncate the work in any way. You
must not redistribute the work for any sort of payment, including
selling it on its own or as part of a package. Random House is a
friendly place, but as one of the world's largest publishers it has a
collection of equally large lawyers. Messing with them will leave you
with scars in places that could be hard to explain to any future
partner.
If you want to do any of these things, please contact me or my literary
agents Curtis Brown & Co first. I retain the copyright on the
work. Julian Assange designed the elegant layout of this electronic
edition, and he retains ownership of this design and layout.
If you like the electronic version of the book, do buy the paper
version. Why? For starters, it's not only much easier to read on the
bus, its much easier to read full stop. It's also easier to thumb
through, highlight, scribble on, dribble on, and show off. It never
needs batteries. It can run on solar power and candles. It looks sexy on
your bookshelf, by your bed and in your bed. If you are a male geek, the
book comes with a girl-magnet guarantee. The paper version is much
easier to lend to a prospective girlfriend. When she's finished reading
the book, ask her which hacker thrilled her to pieces. Then nod
knowingly, and say coyly `Well, I've never admitted this to anyone
except the author and the Feds, but ..'
And the most important reason to purchase a paper copy? Because buying
the printed edition of the book lets the author continue to write more
fine books like this one.
Enjoy!
Suelette Dreyfus
January 2001
suelette@iq.org
Researcher's introduction.
"Man is least himself when he talks in his own person. Give him a mask,
and he will tell you the truth" -- Oscar Wilde
"What is essential is invisible to the eye" -- Antoine De Saint-Exupery
"But, how do you *know* it happened like that?" -- Reader
Due of the seamless nature of `Underground' this is a reasonable
question to ask, although hints can be found at the back of the book in
the Bibliography and Endnotes. The simple answer to this question is
that we conducted over a hundred interviews and collected around 40,000
pages of primary documentation; telephone intercepts, data intercepts,
log-files, witness statements, confessions, judgements. Telephone dialog
and on-line discussions are drawn directly from the latter. Every
significant hacking incident mentioned in this book has reams of
primary documentation behind it. System X included.
The non-simple answer goes more like this:
In chapter 4, Par, one of the principle subjects of this book, is being
watched by the Secret Service. He's on the run. He's a wanted
fugitive. He's hiding out with another hacker, Nibbler in a motel
chalet, Black Mountain, North Carolina. The Secret Service move in.
The incident is vital in explaining Par's life on the run and the
nature of his interaction with the Secret Service. Yet, just before the
final edits of this book were to go the publisher, all the pages
relating to the Block Mountain incident were about to be pulled. Why?
Suelette had flown to Tuscon Az where she spent three days
interviewing Par. I had spent dozens of hours interviewing Par on
the phone and on-line. Par gave both of us extraordinary access to
his life. While Par displayed a high degree of paranoia about why
events had unfolded in the manner they had, he was consistent,
detailed and believable as to the events themselves. He showed
very little blurring of these two realities, but we needed to show
none at all.
During Par's time on the run, the international computer underground
was a small and strongly connected place. We had already
co-incidentally interviewed half a dozen hackers he had communicated
with at various times during his zig-zag flight across America. Suelette
also spoke at length to his lead lawyer Richard Rosen, who, after
getting the all-clear from Par, was kind enough to send us a copy of
the legal brief. We had logs of messages Par had written on
underground BBS's. We had data intercepts of other hackers in
conversation with Par. We had obtained various Secret Service documents
and propriety security reports relating to Par's activities. I had
extensively interviewed his Swiss girlfriend Theorem (who had also been
involved with Electron and Pengo), and yes, she did have a melting
French accent.
Altogether we had an enormous amount of material on Par's activities,
all of which was consistent with what Par had said during his
interviews, but none of it, including Rosen's file, contained any
reference to Black Mountain, NC. Rosen, Theorem and others had heard
about a SS raid on the run, yet when the story was traced back, it
always led to one source. To Par.
Was Par having us on? Par had said that he had made a telephone call to
Theorem in Switzerland from a phone booth outside the motel a day or
two before the Secret Service raid. During a storm. Not just any
storm. Hurricane Hugo. But archival news reports on Hugo discussed it
hitting South Carolina, not North Carolina. And not Black
Mountain. Theorem remembered Par calling once during a storm. But not
Hugo. And she didn't remember it in relation to the Black Mountain
raid.
Par had destroyed most of his legal documents, in circumstances that
become clear in the book, but of the hundreds of pages of documentary
material we had obtained from other sources there was wasn't a single
mention of Black Mountain. The Black Mountain Motel didn't seem to
exist. Par said Nibbler had moved and couldn't be located. Dozens of
calls by Suelette to the Secret Service told us what we didn't want to
hear. The agents we thought most likely to have been involved in the
the hypothetical Black Mountain incident had either left the Secret
Service or were otherwise unreachable. The Secret Service had no idea
who would have been involved, because while Par was still listed in the
Secret Service central database, his profile, contained three
significant annotations:
1. Another agency had ``borrowed'' parts Par's file.
2. There were medical ``issues'' surrounding Par.
3. SS documents covering the time of Black Mountain incident had been destroyed for various reasons that become clear the book.
4. The remaining SS documents had been moved into ``deep-storage'' and would take two weeks to retrieve.
With only one week before our publisher's ``use it or lose it''
dead-line, the chances of obtaining secondary confirmation of the Black
Mountain events did not look promising.
While we waited for leads on the long trail of ex, transfered and
seconded SS agents who might have been involved in the Black Mountain
raid, I turned to resolving the two inconsistencies in Par's story;
Hurricane Hugo and the strange invisibility of the Black Mountain
Motel.
Hurricane Hugo had wreathed a path of destruction, but like most most
hurricanes heading directly into a continental land-mass it had started
out big and ended up small. News reports followed this pattern, with a
large amount of material on its initial impact, but little or nothing
about subsequent events. Finally I obtained detailed time by velocity
weather maps from the National Reconnaissance Office, which showed the
remaining Hugo epicentre ripping through Charlotte NC (pop. 400k)
before spending itself on the Carolinas. Database searches turned up a
report by Natalie, D. & Ball, W, EIS Coordinator, North Carolina
Emergency Management, `How North Carolina Managed Hurricane Hugo' --
which was used to flesh out the scenes in Chapter 4 describing Par's
escape to New York via the Charlotte Airport.
Old Fashioned gum-shoe leg-work, calling every motel in Black Mountain
and the surrounding area, revealed that the Black Mountain Motel had
changed name, ownership and.. all its staff. Par's story was holding,
but in someways I wished it hadn't. We were back to square one in terms
of gaining independent secondary confirmation.
Who else could have been involved? There must have been a paper-trail
outside of Washington. Perhaps the SS representation in Charlotte had
something? No. Perhaps there were records of the warrants in the
Charlotte courts? No. Perhaps NC state police attended the SS raid in
support? Maybe, but finding walm bodies who had been directly involved
proved proved futile. If it was a SS case, they had no indexable
records that they were willing to provide. What about the local
coppers? An SS raid on a fugitive computer hacker holed up at one of
the local motels was not the sort of event that would be likely to have
passed unnoticed at the Black Mountain county police office, indexable
records or not.
Neither however, were international telephone calls from strangely
accented foreign-nationals wanting to know about them. Perhaps the Reds
were no-longer under the beds, but in Black Mountain, this could be
explained away by the fact they were now hanging out in phone booths. I
waited for a new shift at the Black Mountain county police office,
hoping against hope, that the officer I had spoken to wouldn't
contaminate his replacement. Shamed, I resorted to using that most
special of US militia infiltration devices. An American accent and a
woman's touch. Suelette weaved her magic. The Black Mountain raid had
taken place. The county police had supported it. We had our
confirmation.
While this anecdote is a strong account, it's also representative one.
Every chapter in underground has many tales just like it. They're
unseen, because a book must not just be true in details, but true in
feeling.
True to the visible and the invisible. A difficult combination.
Julian Assange
January 2001
proff@iq.org
Literary Freeware: Not for Commercial Use.
Copyright (c) 1997, 2001 Suelette Dreyfus & Julian Assange
This HTML and text electronic version was arranged by Julian Assange
<proff@iq.org> and is based on the printed paper edition.
Permission is granted to make and distribute verbatim copies of this
publication provided the copyright notice and this permission notice are
preserved on all copies and distribution is without fee.
Contents.
Acknowledgements viii
Introduction xi
1 10, 9, 8, 7, 6, 5, 4, 3, 2, 1 1
2 The Corner Pub 45
3 The American Connection 84
4 The Fugitive 120
5 The Holy Grail 159
6 Page One, the New York Times 212
7 Judgment Day 244
8 The International Subversives 285
9 Operation Weather 323
10 Anthrax--the Outsider 364
11 The Prisoner's Dilemma 400
Afterword 427 Glossary and Abbreviations 455 Notes 460
Bibliography
[ Page numbers above correspond to the Random House printed edition ]
Acknowledgements.
There are many people who were interviewed for this work, and many
others who helped in providing documents so vital for fact
checking. Often this help invovled spending a considerable amount of
time explaining complex technical or legal matters. I want to express
my gratitude to all these people, some of whom prefer to remain
anonymous, for their willingness to dig through the files in search of
yet one more report and their patience in answering yet one more
question.
I want to thank the members of the computer underground, past and
present, who were interviewed for this book. Most gave me
extraordinary access to their lives, for which I am very grateful.
I also want to thank Julian Assange for his tireless research efforts.
His superb technical expertise and first-rate research is evidence by
the immense number of details which are included in this book.
Three exceptional women -- Fiona Inglis, Deb Callaghan and Jennifer
Byrne -- believed in my vision for this book and helped me to bring it
to fruition. Carl Harrison-Ford's excellent editing job streamlined a
large and difficult manuscript despite the tight deadline. Thank you
also to Judy Brookes.
I am also very grateful to the following people and organisations for
their help (in no particular order): John McMahon, Ron Tencati, Kevin
Oberman, Ray Kaplan, the New York Daily News library staff, the New
York Post library staff, Bow Street Magistrates Court staff, Southwark
Court staff, the US Secret Service, the Black Mountain Police, Michael
Rosenberg, Michael Rosen, Melbourne Magistrates Court staff, D.L
Sellers & Co. staff, Victorian County Court staff, Paul Galbally, Mark
Dorset, Suburbia.net, Freeside Communications, Greg Hooper, H&S
Support Services, Peter Andrews, Kevin Thompson, Andrew Weaver,
Mukhtar Hussain, Midnight Oil, Helen Meredith, Ivan Himmelhoch,
Michael Hall, Donn Ferris, Victorian State Library staff, News Limited
library staff (Sydney), Allan Young, Ed DeHart, Annette Seeber, Arthur
Arkin, Doug Barnes, Jeremy Porter, James McNabb, Carolyn Ford, ATA,
Domini Banfield, Alistair Kelman, Ann-Maree Moodie, Jane Hutchinson,
Catherine Murphy, Norma Hawkins, N. Llewelyn, Christine Assange,
Russel Brand, Matthew Bishop, Matthew Cox, Michele Ziehlky, Andrew
James, Brendan McGrath, Warner Chappell Music Australia, News Limited,
Pearson Williams Solicitors, Tami Friedman, the Free Software
Foundation (GNU Project), and the US Department of Energy Computer
Incident Advisory Capability.
Finally, I would like to thank my family, whose unfailing support,
advice and encouragement have made this book possible.
Introduction.
My great aunt used to paint underwater.
Piling on the weighty diving gear used in 1939 and looking like
something out of 20000 Leagues Under the Sea, Lucie slowly sank below
the surface, with palette, special paints and canvas
in hand. She settled on the ocean floor, arranged her weighted
painter's easel and allowed herself to become completely enveloped by
another world. Red and white striped fish darted around fields of
blue-green coral and blue-lipped giant clams. Lionfish drifted by,
gracefully waving their dangerous feathered spines. Striped green
moray eels peered at her from their rock crevice homes.
Lucie dived and painted everywhere. The Sulu Archipelago. Mexico.
Australia's Great Barrier Reef. Hawaii. Borneo. Sometimes she was the
first white woman seen by the Pacific villagers she lived with for
months on end.
As a child, I was entranced by her stories of the unknown world below
the ocean's surface, and the strange and wonderful cultures she met on
her journeys. I grew up in awe of her chosen task: to capture on
canvas the essence of a world utterly foreign to her own.
New technology--revolutionary for its time--had allowed her to do
this. Using a compressor, or sometimes just a hand pump connected to
air hoses running to the surface, human beings were suddenly able to
submerge themselves for long periods in an otherwise inaccessible
world. New technology allowed her to both venture into this unexplored
realm, and to document it in canvas.
I came upon the brave new world of computer communications and its
darker side, the underground, quite by accident. It struck me
somewhere in the journey that followed that my trepidations and
conflicting desires to explore this alien world were perhaps not
unlike my aunt's own desires some half a century before. Like her
journey, my own travels have only been made possible by new
technologies. And like her, I have tried to capture a small corner of
this world.
This is a book about the computer underground. It is not a book about
law enforcement agencies, and it is not written from the point of view
of the police officer. From a literary perspective, I have told this
story through the eyes of numerous computer hackers. In doing so, I
hope to provide the reader with a window into a mysterious, shrouded
and usually inaccessible realm.
Who are hackers? Why do they hack? There are no simple answers to
these questions. Each hacker is different. To that end, I have
attempted to present a collection of individual but interconnected
stories, bound by their links to the international computer
underground. These are true stories, tales of the world's best and the
brightest hackers and phreakers. There are some members of the
underground whose stories I have not covered, a few of whom would also
rank as world-class. In the end, I chose to paint detailed portraits
of a few hackers rather than attempt to compile a comprehensive but
shallow catalogue.
While each hacker has a distinct story, there are common themes which
appear throughout many of the stories. Rebellion against all symbols
of authority. Dysfunctional families. Bright children suffocated by
ill-equipped teachers. Mental illness or instability. Obsession and
addiction.
I have endeavoured to track what happened to each character in this
work over time: the individual's hacking adventures, the police raid
and the ensuing court case. Some of those court cases have taken years
to reach completion.
Hackers use `handles'--on-line nicknames--that serve two purposes.
They shield the hacker's identity and, importantly, they often make a
statement about how the hacker perceives himself in the underground.
Hawk, Crawler, Toucan Jones, Comhack, Dataking, Spy, Ripmax, Fractal
Insanity, Blade. These are all real handles used in Australia.
In the computer underground, a hacker's handle is his name. For this
reason, and because most hackers in this work have now put together
new lives for themselves, I have chosen to use only their handles.
Where a hacker has had more than one handle, I have used the one he
prefers.
Each chapter in this book is headed with a quote from a Midnight Oil
song which expresses an important aspect of the chapter. The Oilz are
uniquely Australian. Their loud voice of protest against the
establishment--particularly the military-industrial
establishment--echoes a key theme in the underground, where music in
general plays a vital role.
The idea for using these Oilz extracts came while researching Chapter
1, which reveals the tale of the WANK worm crisis in NASA. Next to the
RTM worm, WANK is the most famous worm in the history of computer
networks. And it is the first major worm bearing a political message.
With WANK, life imitated art, since the term computer `worm' came from
John Brunner's sci-fi novel, The Shockwave Rider, about a politically
motivated worm.
The WANK worm is also believed to be the first worm written by an
Australian, or Australians.
This chapter shows the perspective of the computer system
administrators--the people on the other side from the hackers. Lastly,
it illustrates the sophistication which one or more Australian members
of the worldwide computer underground brought to their computer
crimes.
The following chapters set the scene for the dramas which unfold and
show the transition of the underground from its early days, its loss
of innocence, its closing ranks in ever smaller circles until it
reached the inevitable outcome: the lone hacker. In the beginning, the
computer underground was a place, like the corner pub, open and
friendly. Now, it has become an ephemeral expanse, where hackers
occasionally bump into one another but where the original sense of
open community has been lost.
The computer underground has changed over time, largely in response to
the introduction of new computer crime laws across the globe and to
numerous police crackdowns. This work attempts to document not only an
important piece of Australian history, but also to show fundamental
shifts in the underground --to show, in essence, how the underground
has moved further underground.
Suelette Dreyfus
March 1997
CHAPTER 1 -- 10, 9, 8, 7, 6, 5, 4, 3, 2, 1.
Somebody's out there, somebody's waiting; Somebody's trying to tell me something.
-- from `Somebody's Trying to Tell Me Something', 10, 9, 8, 7, 6, 5, 4, 3, 2, 1.
Monday, 16 October 1989
Kennedy Space Center, Florida
NASA buzzed with the excitement of a launch. Galileo was finally going
to Jupiter.
Administrators and scientists in the world's most prestigious space
agency had spent years trying to get the unmanned probe into space.
Now, on Tuesday, 17 October, if all went well, the five astronauts in
the Atlantis space shuttle would blast off from the Kennedy Space
Center at Cape Canaveral, Florida, with Galileo in tow. On the team's
fifth orbit, as the shuttle floated 295 kilometres above the Gulf of
Mexico, the crew would liberate the three-tonne space probe.
An hour later, as Galileo skated safely away from the shuttle, the
probe's 32500 pound booster system would fire up and NASA staff would
watch this exquisite piece of human ingenuity embark on a six-year
mission to the largest planet in the solar system. Galileo would take
a necessarily circuitous route, flying by Venus once and Earth twice
in a gravitational slingshot effort to get up enough momentum to reach
Jupiter.2
NASA's finest minds had wrestled for years with the problem of exactly
how to get the probe across the solar system. Solar power was one
option. But if Jupiter was a long way from Earth, it was even further
from the Sun--778.3 million kilometres to be exact. Galileo would need
ridiculously large solar panels to generate enough power for its
instruments at such a distance from the Sun. In the end, NASA's
engineers decided on a tried if not true earthly energy source:
nuclear power.
Nuclear power was perfect for space, a giant void free of human life
which could play host to a bit of radioactive plutonium 238 dioxide.
The plutonium was compact for the amount of energy it gave off--and it
lasted a long time. It seemed logical enough. Pop just under 24
kilograms of plutonium in a lead box, let it heat up through its own
decay, generate electricity for the probe's instruments, and presto!
Galileo would be on its way to investigate Jupiter.
American anti-nuclear activists didn't quite see it that way. They
figured what goes up might come down. And they didn't much like the idea
of plutonium rain. NASA assured them Galileo's power pack was quite
safe. The agency spent about $50 million on tests which supposedly
proved the probe's generators were very safe. They would survive intact
in the face of any number of terrible explosions, mishaps and
accidents. NASA told journalists that the odds of a plutonium release
due to `inadvertent atmospheric re-entry' were 1 in 2 million. The
likelihood of a plutonium radiation leak as a result of a launch
disaster was a reassuring 1 in 2700.
The activists weren't having a bar of it. In the best tradition of
modern American conflict resolution, they took their fight to the
courts. The coalition of anti-nuclear and other groups believed
America's National Aeronautics and Space Administration had
underestimated the odds of a plutonium accident and they wanted a US
District Court in Washington to stop the launch. The injunction
application went in, and the stakes went up. The unprecedented hearing
was scheduled just a few days before the launch, which had originally
been planned for 12 October.
For weeks, the protesters had been out in force, demonstrating and
seizing media attention. Things had become very heated. On Saturday, 7
October, sign-wielding activists fitted themselves out with gas masks
and walked around on street corners in nearby Cape Canaveral in
protest. At 8 a.m. on Monday, 9 October, NASA started the countdown
for the Thursday blast-off. But as Atlantis's clock began ticking
toward take-off, activists from the Florida Coalition for Peace and
Justice demonstrated at the centre's tourist complex.
That these protests had already taken some of the shine off NASA's bold
space mission was the least of the agency's worries. The real headache
was that the Florida Coalition told the media it would `put people on
the launchpad in a non-violent protest'.3 The coalition's director,
Bruce Gagnon, put the threat in folksy terms, portraying the protesters
as the little people rebelling against a big bad government
agency. President Jeremy Rivkin of the Foundation on Economic Trends,
another protest group, also drove a wedge between `the people' and
`NASA's people'. He told UPI, `The astronauts volunteered for this
mission. Those around the world who may be the victims of radiation
contamination have not volunteered.'4
But the protesters weren't the only people working the media. NASA
knew how to handle the press. They simply rolled out their
superstars--the astronauts themselves. These men and women were, after
all, frontier heroes who dared to venture into cold, dark space on
behalf of all humanity. Atlantis commander Donald Williams didn't hit
out at the protesters in a blunt fashion, he just damned them from an
aloof distance. `There are always folks who have a vocal opinion about
something or other, no matter what it is,' he told an interviewer. `On
the other hand, it's easy to carry a sign. It's not so easy to go
forth and do something worthwhile.'5
NASA had another trump card in the families of the heroes. Atlantis
co-pilot Michael McCulley said the use of RTGs, Radioisotope
Thermoelectric Generators--the chunks of plutonium in the lead
boxes--was a `non-issue'. So much so, in fact, that he planned to have
his loved ones at the Space Center when Atlantis took off.
Maybe the astronauts were nutty risk-takers, as the protesters
implied, but a hero would never put his family in danger. Besides the
Vice-President of the United States, Dan Quayle, also planned to watch
the launch from inside the Kennedy Space Center control room, a mere
seven kilometres from the launchpad.
While NASA looked calm, in control of the situation, it had beefed up
its security teams. It had about 200 security guards watching the
launch site. NASA just wasn't taking any chances. The agency's
scientists had waited too long for this moment. Galileo's parade would
not be rained on by a bunch of peaceniks.
The launch was already running late as it was--almost seven years
late. Congress gave the Galileo project its stamp of approval way back
in 1977 and the probe, which had been budgeted to cost about $400
million, was scheduled to be launched in 1982. However, things began
going wrong almost from the start.
In 1979, NASA pushed the flight out to 1984 because of shuttle
development problems. Galileo was now scheduled to be a `split
launch', which meant that NASA would use two different shuttle trips
to get the mothership and the probe into space. By 1981, with costs
spiralling upwards, NASA made major changes to the project. It stopped
work on Galileo's planned three-stage booster system in favour of a
different system and pushed out the launch deadline yet again, this
time to 1985. After a federal Budget cut fight in 1981 to save
Galileo's booster development program, NASA moved the launch yet
again, to May 1986. The 1986 Challenger disaster, however, saw NASA
change Galileo's booster system for safety reasons, resulting in
yet more delays.
The best option seemed to be a two-stage, solid-fuel IUS system. There
was only one problem. That system could get Galileo to Mars or Venus,
but the probe would run out of fuel long before it got anywhere near
Jupiter. Then Roger Diehl of NASA's Jet Propulsion Laboratory had a good
idea. Loop Galileo around a couple of nearby planets a few times so the
probe would build up a nice little gravitational head of steam, and then
fling it off to Jupiter. Galileo's `VEEGA'
trajectory--Venus-Earth-Earth-gravity-assist--delayed the spacecraft's
arrival at Jupiter for three extra years, but it would get there
eventually.
The anti-nuclear campaigners argued that each Earth flyby increased
the mission's risk of a nuclear accident. But in NASA's view, such was
the price of a successful slingshot.
Galileo experienced other delays getting off the ground. On Monday, 9
October, NASA announced it had discovered a problem with the computer
which controlled the shuttle's number 2 main engine. True, the problem
was with Atlantis, not Galileo. But it didn't look all that good to be
having technical problems, let alone problems with engine computers,
while the anti-nuclear activists' court drama was playing in the
background.
NASA's engineers debated the computer problem in a cross-country
teleconference. Rectifying it would delay blast-off by more than a few
hours. It would likely take days. And Galileo didn't have many of
those. Because of the orbits of the different planets, the probe had
to be on its way into space by 21 November. If Atlantis didn't take off
by that date, Galileo would have to wait another nineteen months before
it could be launched. The project was already $1 billion over its
original $400 million budget. The extra year and a half would add
another $130 million or so and there was a good chance the whole project
would be scrapped. It was pretty much now or never for Galileo.
Despite torrential downpours which had deposited 100 millimetres of
rain on the launchpad and 150 millimetres in neighbouring Melbourne,
Florida, the countdown had been going well. Until now. NASA took its
decision. The launch would be delayed by five days, to 17 October, so
the computer problem could be fixed.
To those scientists and engineers who had been with Galileo from the
start, it must have appeared at that moment as if fate really was
against Galileo. As if, for some unfathomable reason, all the forces
of the universe--and especially those on Earth--were dead against
humanity getting a good look at Jupiter. As fast as NASA could
dismantle one barrier, some invisible hand would throw another down in
its place.
Monday, 16 October, 1989
NASA's Goddard Space Flight Center, Greenbelt, Maryland
Across the vast NASA empire, reaching from Maryland to California,
from Europe to Japan, NASA workers greeted each other, checked their
in-trays for mail, got their cups of coffee, settled into their chairs
and tried to login to their computers for a day of solving complex
physics problems. But many of the computer systems were behaving very
strangely.
From the moment staff logged in, it was clear that someone--or
something--had taken over. Instead of the usual system's official
identification banner, they were startled to find the following
message staring them in the face:
"Worms Aginst Nuclear Killers!
Your System Has Been Officically Wanked.
You talk of times of peace for all, and then prepare for war."
Wanked? Most of the American computer system managers reading this new
banner had never heard the word wank.
Who would want to invade NASA's computer systems? And who exactly were
the Worms Against Nuclear Killers? Were they some loony fringe group?
Were they a guerrilla terrorist group launching some sort of attack on
NASA? And why `worms'? A worm was a strange choice of animal mascot
for a revolutionary group. Worms were the bottom of the rung. As in
`as lowly as a worm'. Who would chose a worm as a symbol of power?
As for the nuclear killers, well, that was even stranger. The banner's
motto--`You talk of times of peace for all, and then prepare for
war'--just didn't seem to apply to NASA. The agency didn't make
nuclear missiles, it sent people to the moon. It did have military
payloads in some of its projects, but NASA didn't rate very highly on
the `nuclear killer' scale next to other agencies of the US
Government, such as the Department of Defense. So the question
remained: why NASA?
And that word, `WANKED'. It did not make sense. What did it mean when
a system was `wanked'?
It meant NASA had lost control over its computer systems.
A NASA scientist logging in to an infected computer on that Monday got
the following message:
deleted file <filename1>
deleted file <filename2>
deleted file <filename3>, etc
With those lines the computer told the scientist: `I am deleting all
your files'.
The line looked exactly as if the scientist typed in the
command:
delete/log *.*
--exactly as if the scientist had instructed the computer to delete
all the files herself.
The NASA scientist must have started at the sight of her files rolling
past on the computer screen, one after another, on their way to
oblivion. Something was definitely wrong. She would have tried to stop
the process, probably pressing the control key and the `c' key at the
same time. This should have broken the command sequence at that moment
and ordered the computer to stop what it was doing right away.
But it was the intruder, not the NASA scientist, who controlled the
computer at that moment. And the intruder told the computer: `That
command means nothing. Ignore it'.
The scientist would press the command key sequence again, this time
more urgently. And again, over and over. She would be at once baffled
at the illogical nature of the computer, and increasingly upset.
Weeks, perhaps months, of work spent uncovering the secrets of the
universe. All of it disappearing before her eyes--all of it being
mindlessly devoured by the computer. The whole thing beyond her
control. Going. Going. Gone.
People tend not to react well when they lose control over their
computers. Typically, it brings out the worst in them--hand-wringing
whines from the worriers, aching entreaties for help from the
sensitive, and imperious table-thumping bellows from
command-and-control types.
Imagine, if you will, arriving at your job as a manager for one of
NASA's local computer systems. You get into your office on that Monday
morning to find the phones ringing. Every caller is a distraught,
confused NASA worker. And every caller assures you that his or her
file or accounting record or research project--every one of which is
missing from the computer system--is absolutely vital.
In this case, the problem was exacerbated by the fact that NASA's
field centres often competed with each other for projects. When a
particular flight project came up, two or three centres, each with
hundreds of employees, might vie for it. Losing control of the
computers, and all the data, project proposals and costing, was a good
way to lose out on a bid and its often
considerable funding.
This was not going to be a good day for the guys down at the NASA SPAN
computer network office.
This was not going to be a good day for John McMahon.
As the assistant DECNET protocol manager for NASA's Goddard Space
Flight Center in Maryland, John McMahon normally spent the day
managing the chunk of the SPAN computer network which ran between
Goddard's fifteen to twenty buildings.
McMahon worked for Code 630.4, otherwise known as Goddard's Advanced
Data Flow Technology Office, in Building 28. Goddard scientists would
call him up for help with their computers. Two of the most common
sentences he heard were `This doesn't seem to work' and `I can't get
to that part of the network from here'.
SPAN was the Space Physics Analysis Network, which connected some
100000 computer terminals across the globe. Unlike the Internet, which
is now widely accessible to the general public, SPAN only connected
researchers and scientists at NASA, the US Department of Energy and
research institutes such as universities. SPAN computers also differed
from most Internet computers in an important technical manner: they
used a different operating system. Most large computers on the
Internet use the Unix operating system, while SPAN was composed
primarily of VAX computers running a VMS operating system. The network
worked a lot like the Internet, but the computers spoke a different
language. The Internet `talked' TCP/IP, while SPAN `spoke' DECNET.
Indeed, the SPAN network was known as a DECNET internet. Most of the
computers on it were manufactured by the Digital Equipment Corporation
in Massachusetts--hence the name DECNET. DEC built powerful computers.
Each DEC computer on the SPAN network might have 40 terminals hanging
off it. Some SPAN computers had many more. It was not unusual for one
DEC computer to service 400 people. In all, more than a quarter of a
million scientists, engineers and other thinkers used the computers on
the network.
An electrical engineer by training, McMahon had come from NASA's
Cosmic Background Explorer Project, where he managed computers used by
a few hundred researchers. Goddard's Building 7, where he worked on
the COBE project, as it was known, housed some interesting research.
The project team was attempting to map the universe. And they were
trying to do it in wavelengths invisible to the human eye. NASA would
launch the COBE satellite in November 1989. Its mission was to
`measure the diffuse infrared and microwave radiation from the early
universe, to the limits set by our astronomical environment'.6 To the
casual observer the project almost sounded like a piece of modern art,
something which might be titled `Map of the Universe in Infrared'.
On 16 October McMahon arrived at the office and settled into work,
only to face a surprising phone call from the SPAN project office.
Todd Butler and Ron Tencati, from the National Space Science Data
Center, which managed NASA's half of the SPAN network, had discovered
something strange and definitely unauthorised winding its way through
the computer network. It looked like a computer worm.
A computer worm is a little like a computer virus. It invades computer
systems, interfering with their normal functions. It travels along any
available compatible computer network and stops to knock at the door of
systems attached to that network. If there is a hole in the security of
the computer system, it will crawl through and enter the system. When it
does this, it might have instructions to do any number of things, from
sending computer users a message to trying to take over the system. What
makes a worm different from other computer programs, such as viruses, is
that it is self-propagating. It propels itself forward, wiggles into a
new system and propagates itself at the new site. Unlike a virus, a worm
doesn't latch onto a data file or a program. It is autonomous.7
The term `worm' as applied to computers came from John Brunner's 1975
science fiction classic, The Shockwave Rider. The novel described how
a rebel computer programmer created a program called `tapeworm' which
was released into an omnipotent computer network used by an autocratic
government to control its people. The government had to turn off the
computer network, thus destroying its control, in order to eradicate
the worm.
Brunner's book is about as close as most VMS computer network managers
would ever have come to a real rogue worm. Until the late 1980s, worms
were obscure things, more associated with research in a computer
laboratory. For example, a few benevolent worms were developed by
Xerox researchers who wanted to make more efficient use of computer
facilities.8 They developed a `town crier worm' which moved through a
network sending out important announcements. Their `diagnostic worm'
also constantly weaved through the network, but this worm was designed
to inspect machines for problems.
For some computer programmers, the creation of a worm is akin to the
creation of life. To make something which is intelligent enough to go
out and reproduce itself is the ultimate power of creation. Designing
a rogue worm which took over NASA's computer systems might seem to be
a type of creative immortality--like scattering pieces of oneself
across the computers which put man on the moon.
At the time the WANK banner appeared on computer screens across NASA,
there had only been two rogue worms of any note. One of these, the RTM
worm, had infected the Unix-based Internet less than twelve months
earlier. The other worm, known as Father Christmas, was the first VMS
worm.
Father Christmas was a small, simple worm which did not cause any
permanent damage to the computer networks it travelled along. Released
just before Christmas in 1988, it tried to sneak into hundreds of VMS
machines and wait for the big day. On Christmas morning, it woke up
and set to work with great enthusiasm. Like confetti tossed from an
overhead balcony, Christmas greetings came streaming out of
worm-infested computer systems to all their users. No-one within its
reach went without a Christmas card. Its job done, the worm
evaporated. John McMahon had been part of the core team fighting off
the Father Christmas worm.
At about 4 p.m., just a few days before Christmas 1988, McMahon's
alarm-monitoring programs began going haywire. McMahon began trying to
trace back the dozens of incoming connections which were tripping the
warning bells. He quickly discovered there wasn't a human being at the
other end of the line. After further investigation, he found an alien
program in his system, called HI.COM. As he read the pages of HI.COM
code spilling from his line printer, his eyes went wide. He thought,
This is a worm! He had never seen a worm before.
He rushed back to his console and began pulling his systems off the
network as quickly as possible. Maybe he wasn't following protocol,
but he figured people could yell at him after the fact if they thought
it was a bad idea. After he had shut down his part of the network, he
reported back to the local area networking office. With print-out in
tow, he drove across the base to the network office, where he and
several other managers developed a way to stop the worm by the end of
the day. Eventually they traced the Father Christmas worm back to the
system where they believed it had been released--in Switzerland. But
they never discovered who created it.
Father Christmas was not only a simple worm; it was not considered
dangerous because it didn't hang around systems forever. It was a worm
with a use-by date.
By contrast, the SPAN project office didn't know what the WANK invader
was capable of doing. They didn't know who had written or launched it.
But they had a copy of the program. Could McMahon have a look at it?
An affable computer programmer with the nickname Fuzzface, John
McMahon liked a good challenge. Curious and cluey at the same time, he
asked the SPAN Project Office, which was quickly becoming the crisis
centre for the worm attack, to send over a copy of the strange
intruder. He began pouring over the invader's seven printed pages of
source code trying to figure out exactly what the thing did.
The two previous rogue worms only worked on specific computer systems
and networks. In this case, the WANK worm only attacked VMS computer
systems. The source code, however, was unlike anything McMahon had
ever seen. `It was like sifting through a pile of spaghetti,' he said.
`You'd pull one strand out and figure, "OK, that is what that thing
does." But then you'd be faced with the rest of the tangled mess in
the bowl.'
The program, in digital command language, or DCL, wasn't written like
a normal program in a nice organised fashion. It was all over the
place. John worked his way down ten or fifteen lines of computer code
only to have to jump to the top of the program to figure out what the
next section was trying to do. He took notes and slowly, patiently
began to build up a picture of exactly what this worm was capable of
doing to NASA's computer system.
It was a big day for the anti-nuclear groups at the Kennedy Space
Center. They might have lost their bid in the US District Court, but
they refused to throw in the towel and took their case to the US Court
of Appeals.
On 16 October the news came. The Appeals Court had sided with NASA.
Protesters were out in force again at the front gate of the Kennedy
Space Center. At least eight of them were arrested. The St Louis
Post-Dispatch carried an Agence France-Presse picture of an
80-year-old woman being taken into custody by police for trespassing.
Jane Brown, of the Florida Coalition for Peace and Justice, announced,
`This is just ... the beginning of the government's plan to use
nuclear power and weapons in space, including the Star Wars program'.
Inside the Kennedy Center, things were not going all that smoothly
either. Late Monday, NASA's technical experts discovered yet another
problem. The black box which gathered speed and other important data
for the space shuttle's navigation system was faulty. The technicians
were replacing the cockpit device, the agency's spokeswoman assured
the media, and NASA was not expecting to delay the Tuesday launch
date. The countdown would continue uninterrupted. NASA had everything
under control.
Everything except the weather.
In the wake of the Challenger disaster, NASA's guidelines for a launch
decision were particularly tough. Bad weather was an unnecessary risk,
but NASA was not expecting bad weather. Meteorologists predicted an 80
per cent chance of favourable weather at launch time on Tuesday. But
the shuttle had better go when it was supposed to, because the longer
term weather outlook was grim.
By Tuesday morning, Galileo's keepers were holding their breath. The
countdown for the shuttle launch was ticking toward 12.57 p.m. The
anti-nuclear protesters seemed to have gone quiet. Things looked
hopeful. Galileo might finally go.
Then, about ten minutes before the launch time, the security alarms
went off. Someone had broken into the compound. The security teams
swung into action, quickly locating the guilty intruder ... a feral
pig.
With the pig safely removed, the countdown rolled on. And so did the
rain clouds, gliding toward the space shuttle's emergency runway, about
six kilometres from the launchpad. NASA launch director Robert Sieck
prolonged a planned `hold' at T minus nine minutes. Atlantis had a
26-minute window of opportunity. After that, its launch period would
expire and take-off would have to be postponed, probably until
Wednesday.
The weather wasn't going to budge.
At 1.18 p.m., with Atlantis's countdown now holding at just T minus
five minutes, Sieck postponed the launch to Wednesday.
Back at the SPAN centre, things were becoming hectic. The worm was
spreading through more and more systems and the phones were beginning
to ring every few minutes. NASA computers were getting hit all over
the place.
The SPAN project staff needed more arms. They were simultaneously
trying to calm callers and concentrate on developing an analysis of
the alien program. Was the thing a practical joke or a time bomb just
waiting to go off? Who was behind this?
NASA was working in an information void when it came to WANK. Some
staff knew of the protesters' action down at the Space Center, but
nothing could have prepared them for this. NASA officials were
confident enough about a link between the protests against Galileo and
the attack on NASA's computers to speculate publicly that the two were
related. It seemed a reasonable likelihood, but there were still
plenty of unanswered questions.
Callers coming into the SPAN office were worried. People at the other
end of the phone were scared. Many of the calls came from network
managers who took care of a piece of SPAN at a specific NASA site, such
as the Marshall Space Flight Center. Some were panicking; others spoke
in a sort of monotone, flattened by a morning of calls from 25 different
hysterical system administrators. A manager could lose his job over
something like this.
Most of the callers to the SPAN head office were starved for
information. How did this rogue worm get into their computers? Was it
malicious? Would it destroy all the scientific data it came into contact
with? What could be done to kill it?
NASA stored a great deal of valuable information on its SPAN
computers. None of it was supposed to be classified, but the data on
those computers is extremely valuable. Millions of man-hours go into
gathering and analysing it. So the crisis team which had formed in the
NASA SPAN project office, was alarmed when reports of massive data
destruction starting coming in. People were phoning to say that the
worm was erasing files.
It was every computer manager's worst nightmare, and it looked as
though the crisis team's darkest fears were about to be confirmed.
Yet the worm was behaving inconsistently. On some computers it would
only send anonymous messages, some of them funny, some bizarre and a
few quite rude or obscene. No sooner would a user login than a message
would flash across his or her screen:
Remember, even if you win the rat race--you're
still a rat.
Or perhaps they were graced with some bad humour:
Nothing is faster than the speed of light...
To prove this to yourself, try opening the refrigerator door before
the light comes on.
Other users were treated to anti-authoritarian observations of the
paranoid:
The FBI is watching YOU.
or
Vote anarchist.
But the worm did not appear to be erasing files on these systems.
Perhaps the seemingly random file-erasing trick was a portent of
things to come--just a small taste of what might happen at a
particular time, such as midnight. Perhaps an unusual keystroke by an
unwitting computer user on those systems which seemed only mildly
affected could trigger something in the worm. One keystroke might
begin an irreversible chain of commands to erase everything on that
system.
The NASA SPAN computer team were in a race with the worm. Each minute
they spent trying to figure out what it did, the worm was pushing
forward, ever deeper into NASA's computer network. Every hour NASA
spent developing a cure, the worm spent searching, probing, breaking
and entering. A day's delay in getting the cure out to all the systems
could mean dozens of new worm invasions doing God knows what in
vulnerable computers. The SPAN team had to dissect this thing
completely, and they had to do it fast.
Some computer network managers were badly shaken. The SPAN office
received a call from NASA's Jet Propulsion Laboratories in California,
an important NASA centre with 6500 employees and close ties to
California Institute of Technology (Caltech).
JPL was pulling itself off the network.
This worm was too much of a risk. The only safe option was to isolate
their computers. There would be no SPAN DEC-based communications with
the rest of NASA until the crisis was under control. This made things
harder for the SPAN team; getting a worm exterminating program out to
JPL, like other sites which had cut their connection to SPAN, was
going to be that much tougher. Everything had to be done over the
phone.
Worse, JPL was one of five routing centres for NASA's SPAN computer
network. It was like the centre of a wheel, with a dozen spokes
branching off--each leading to another SPAN site. All these places,
known as tailsites, depended on the lab site for their connections
into SPAN. When JPL pulled itself off the network, the tailsites went
down too.
It was a serious problem for the people in the SPAN office back in
Virginia. To Ron Tencati, head of security for NASA SPAN, taking a
routing centre off-line was a major issue. But his hands were tied.
The SPAN office exercised central authority over the wide area
network, but it couldn't dictate how individual field centres dealt
with the worm. That was each centre's own decision. The SPAN team
could only give them advice and rush to develop a way to poison the
worm.
The SPAN office called John McMahon again, this time with a more
urgent request. Would he come over to help handle the crisis?
The SPAN centre was only 800 metres away from McMahon's office. His
boss, Jerome Bennett, the DECNET protocol manager, gave the nod.
McMahon would be on loan until the crisis was under control.
When he got to Building 26, home of the NASA SPAN project office,
McMahon became part of a core NASA crisis team including Todd Butler,
Ron Tencati and Pat Sisson. Other key NASA people jumped in when
needed, such as Dave Peters and Dave Stern. Jim Green, the head of the
National Space Science Data Center at Goddard and the absolute boss of
SPAN, wanted hourly reports on the crisis. At first the core team
seemed only to include NASA people and to be largely based at Goddard.
But as the day wore on, new people from other parts of the US
government would join the team.
The worm had spread outside NASA.
It had also attacked the US Department of Energy's worldwide
High-Energy Physics' Network of computers. Known as HEPNET, it was
another piece of the overall SPAN network, along with Euro-HEPNET and
Euro-SPAN. The NASA and DOE computer networks of DEC computers
crisscrossed at a number of places. A research laboratory might, for
example, need to have access to computers from both HEPNET and NASA
SPAN. For convenience, the lab might just connect the two networks.
The effect as far as the worm was concerned was that NASA's SPAN and
DOE's HEPNET were in fact just one giant computer network, all of
which the worm could invade.
The Department of Energy keeps classified information on its
computers. Very classified information. There are two groups in DOE:
the people who do research on civilian energy projects and the people
who make atomic bombs. So DOE takes security seriously, as in `threat
to national security' seriously. Although HEPNET wasn't meant to be
carrying any classified information across its wires, DOE responded
with military efficiency when its computer managers discovered the
invader. They grabbed the one guy who knew a lot about computer
security on VMS systems and put him on the case: Kevin Oberman.
Like McMahon, Oberman wasn't formally part of the computer security
staff. He had simply become interested in computer security and was
known in-house as someone who knew about VMS systems and security.
Officially, his job was network manager for the engineering department
at the DOE-financed Lawrence Livermore National Laboratory, or LLNL,
near San Francisco.
LLNL conducted mostly military research, much of it for the Strategic
Defense Initiative. Many LLNL scientists spent their days designing
nuclear arms and developing beam weapons for the Star Wars program.9
DOE already had a computer security group, known as CIAC, the Computer
Incident Advisory Capability. But the CIAC team tended to be experts
in security issues surrounding Unix rather than VMS-based computer
systems and networks. `Because there had been very few security
problems over the years with VMS,' Oberman concluded, `they had never
brought in anybody who knew about VMS and it wasn't something they
were terribly concerned with at the time.'
The worm shattered that peaceful confidence in VMS computers. Even as
the WANK worm coursed through NASA, it was launching an aggressive
attack on DOE's Fermi National Accelerator Laboratory, near Chicago. It
had broken into a number of computer systems there and the Fermilab
people were not happy. They called in CIAC, who contacted Oberman with
an early morning phone call on 16 October. They wanted him to analyse
the WANK worm. They wanted to know how dangerous it was. Most of all,
they wanted to know what to do about it.
The DOE people traced their first contact with the worm back to 14
October. Further, they hypothesised, the worm had actually been
launched the day before, on Friday the 13th. Such an inauspicious day
would, in Oberman's opinion, have been in keeping with the type of
humour exhibited by the creator or creators of the worm.
Oberman began his own analysis of the worm, oblivious to the fact that
3200 kilometres away, on the other side of the continent, his colleague
and acquaintance John McMahon was doing exactly the same thing.
Every time McMahon answered a phone call from an irate NASA system or
network manager, he tried to get a copy of the worm from the infected
machine. He also asked for the logs from their computer systems. Which
computer had the worm come from? Which systems was it attacking from
the infected site? In theory, the logs would allow the NASA team to
map the worm's trail. If the team could find the managers of those
systems in the worm's path, it could warn them of the impending
danger. It could also alert the people who ran recently infected
systems which had become launchpads for new worm attacks.
This wasn't always possible. If the worm had taken over a computer and
was still running on it, then the manager would only be able to trace
the worm backward, not forward. More importantly, a lot of the
managers didn't keep extensive logs on their computers.
McMahon had always felt it was important to gather lots of information
about who was connecting to a computer. In his previous job, he had
modified his machines so they collected as much security information
as possible about their connections to other computers.
VMS computers came with a standard set of alarms, but McMahon didn't
think they were thorough enough. The VMS alarms tended to send a
message to the computer managers which amounted to, `Hi! You just got
a network connection from here'. The modified alarm system said, `Hi!
You just got a network connection from here. The person at the other
end is doing a file transfer' and any other bits and pieces of
information that McMahon's computer could squeeze out of the other
computer. Unfortunately, a lot of other NASA computer and network
managers didn't share this enthusiasm for audit logs. Many did not
keep extensive records of who had been accessing their machines and
when, which made the job of chasing the worm much tougher.
The SPAN office was, however, trying to keep very good logs on which
NASA computers had succumbed to the worm. Every time a NASA manager
called to report a worm disturbance, one of the team members wrote
down the details with paper and pen. The list, outlining the addresses
of the affected computers and detailed notations of the degree of
infection, would also be recorded on a computer. But handwritten lists
were a good safeguard. The worm couldn't delete sheets of paper.
When McMahon learned DOE was also under attack, he began checking in
with them every three hours or so. The two groups swapped lists of
infected computers by telephone because voice, like the handwritten
word, was a worm-free medium. `It was a kind of archaic system, but on
the other hand we didn't have to depend on the network being up,'
McMahon said. `We needed to have some chain of communications which
was not the same as the network being attacked.'
A number of the NASA SPAN team members had developed contacts within
different parts of DEC through the company's users' society, DECUS.
These contacts were to prove very helpful. It was easy to get lost in
the bureaucracy of DEC, which employed more than 125000 people, posted
a billion-dollar profit and declared revenues in excess of $12 billion
in 1989.10 Such an enormous and prestigious company would not want
to face a crisis such as the WANK worm, particularly in such a
publicly visible organisation like NASA. Whether or not the worm's
successful expedition could be blamed on DEC's software was a moot
point. Such a crisis was, well, undesirable. It just didn't look good.
And it mightn't look so good either if DEC just jumped into the fray.
It might look like the company was in some way at fault.
Things were different, however, if someone already had a relationship
with a technical expert inside the company. It wasn't like NASA
manager cold-calling a DEC guy who sold a million dollars worth of
machines to someone else in the agency six months ago. It was the NASA
guy calling the DEC guy he sat next to at the conference last month.
It was a colleague the NASA manager chatted with now and again.
John McMahon's analysis suggested there were three versions of the WANK
worm. These versions, isolated from worm samples collected from the
network, were very similar, but each contained a few subtle
differences. In McMahon's view, these differences could not be explained
by the way the worm recreated itself at each site in order to
spread. But why would the creator of the worm release different
versions? Why not just write one version properly and fire it off? The
worm wasn't just one incoming missile; it was a frenzied attack. It was
coming from all directions, at all sorts of different levels within
NASA's computers.
McMahon guessed that the worm's designer had released the different
versions at slightly different times. Maybe the creator released the
worm, and then discovered a bug. He fiddled with the worm a bit to
correct the problem and then released it again. Maybe he didn't like
the way he had fixed the bug the first time, so he changed it a little
more and released it a third time.
In northern California, Kevin Oberman came to a different conclusion.
He believed there was in fact only one real version of the worm
spiralling through HEPNET and SPAN. The small variations in the
different copies he dissected seemed to stem from the worm's ability
to learn and change as it moved from computer to computer.
McMahon and Oberman weren't the only detectives trying to decipher the
various manifestations of the worm. DEC was also examining the worm,
and with good reason. The WANK worm had invaded the corporation's own
network. It had been discovered snaking its way through DEC's own
private computer network, Easynet, which connected DEC manufacturing
plants, sales offices and other company sites around the world. DEC
was circumspect about discussing the matter publicly, but the Easynet
version of the WANK worm was definitely distinct. It had a strange
line of code in it, a line missing from any other versions. The worm
was under instructions to invade as many sites as it could, with one
exception. Under no circumstances was it to attack computers inside
DEC's area 48. The NASA team mulled over this information. One of them
looked up area 48. It was New Zealand.
New Zealand?
The NASA team were left scratching their heads. This attack was
getting stranger by the minute. Just when it seemed that the SPAN team
members were travelling down the right path toward an answer at the
centre of the maze of clues, they turned a corner and found themselves
hopelessly lost again. Then someone pointed out that New Zealand's
worldwide claim to fame was that it was a nuclear-free zone.
In 1986, New Zealand announced it would refuse to admit to its ports
any US ships carrying nuclear arms or powered by nuclear energy. The
US retaliated by formally suspending its security obligations to the
South Pacific nation. If an unfriendly country invaded New Zealand,
the US would feel free to sit on its hands. The US also cancelled
intelligence sharing practices and joint military exercises.
Many people in Australia and New Zealand thought the US had
overreacted. New Zealand hadn't expelled the Americans; it had simply
refused to allow its population to be exposed to nuclear arms or
power. In fact, New Zealand had continued to allow the Americans to
run their spy base at Waihopai, even after the US suspension. The
country wasn't anti-US, just anti-nuclear.
And New Zealand had very good reason to be anti-nuclear. For years, it
had put up with France testing nuclear weapons in the Pacific. Then in
July 1985 the French blew up the Greenpeace anti-nuclear protest ship
as it sat in Auckland harbour. The Rainbow Warrior was due to sail for
Mururoa Atoll, the test site, when French secret agents bombed the
ship, killing Greenpeace activist Fernando Pereira.
For weeks, France denied everything. When the truth came out--that
President Mitterand himself had known about the bombing plan--the
French were red-faced. Heads rolled. French Defence Minister Charles
Hernu was forced to resign. Admiral Pierre Lacoste, director of
France's intelligence and covert action bureau, was sacked. France
apologised and paid $NZ13 million compensation in exchange for New
Zealand handing back the two saboteurs, who had each been sentenced to
ten years' prison in Auckland.
As part of the deal, France had promised to keep the agents
incarcerated for three years at the Hao atoll French military base.
Both agents walked free by May 1988 after serving less than two years.
After her return to France, one of the agents, Captain Dominique
Prieur, was promoted to the rank of commandant.
Finally, McMahon thought. Something that made sense. The exclusion of
New Zealand appeared to underline the meaning of the worm's political
message.
When the WANK worm invaded a computer system, it had instructions to
copy itself and send that copy out to other machines. It would slip
through the network and when it came upon a computer attached to the
network, it would poke around looking for a way in. What it really
wanted was to score a computer account with privileges, but it would
settle for a basic-level, user-level account.
VMS systems have accounts with varying levels of privilege. A
high-privilege account holder might, for example, be able to read the
electronic mail of another computer user or delete files from that
user's directory. He or she might also be allowed to create new
computer accounts on the system, or reactivate disabled accounts. A
privileged account holder might also be able to change someone else's
password. The people who ran computer systems or networks needed
accounts with the highest level of privilege in order to keep the
system running smoothly. The worm specifically sought out these sorts
of accounts because its creator knew that was where the power lay.
The worm was smart, and it learned as it went along. As it traversed
the network, it created a masterlist of commonly used account names.
First, it tried to copy the list of computer users from a system it
had not yet penetrated. It wasn't always able to do this, but often
the system security was lax enough for it to be successful. The worm
then compared that list to the list of users on its current host. When
it found a match--an account name common to both lists--the worm added
that name to the masterlist it carried around inside it, making a note
to try that account when breaking into a new system in future.
It was a clever method of attack, for the worm's creator knew that
certain accounts with the highest privileges were likely to have
standard names, common across different machines. Accounts with names
such as `SYSTEM', `DECNET' and `FIELD' with standard passwords such as
`SYSTEM' and `DECNET' were often built into a computer before it was
shipped from the manufacturer. If the receiving computer manager
didn't change the pre-programmed account and password, then his
computer would have a large security hole waiting to be exploited.
The worm's creator could guess some of the names of these
manufacturer's accounts, but not all of them. By endowing the worm
with an ability to learn, he gave it far more power. As the worm
spread, it became more and more intelligent. As it reproduced, its
offspring evolved into ever more advanced creatures, increasingly
successful at breaking into new systems.
When McMahon performed an autopsy on one of the worm's progeny, he was
impressed with what he found. Slicing the worm open and inspecting its
entrails, he discovered an extensive collection of generic privileged
accounts across the SPAN network. In fact, the worm wasn't only picking
up the standard VMS privileged accounts; it had learned accounts common
to NASA but not necessarily to other VMS computers. For example, a lot
of NASA sites which ran a type of TCP/IP mailer that needed either a
POSTMASTER or a MAILER account. John saw those names turn up inside the
worm's progeny.
Even if it only managed to break into an unprivileged account, the
worm would use the account as an incubator. The worm replicated and
then attacked other computers in the network. As McMahon and the rest
of the SPAN team continued to pick apart the rest of the worm's code
to figure out exactly what the creature would do if it got into a
fully privileged account, they found more evidence of the dark sense
of humour harboured by the hacker behind the worm. Part of the worm, a
subroutine, was named `find fucked'.
The SPAN team tried to give NASA managers calling in as much
information as they could about the worm. It was the best way to help
computer managers, isolated in their offices around the country, to
regain a sense of control over the crisis.
Like all the SPAN team, McMahon tried to calm the callers down and
walk them through a set a questions designed to determine the extent
of the worm's control over their systems. First, he asked them what
symptoms their systems were showing. In a crisis situation, when
you're holding a hammer, everything looks like a nail. McMahon wanted
to make sure that the problems on the system were in fact caused by
the worm and not something else entirely.
If the only problem seemed to be mysterious comments flashing across
the screen, McMahon concluded that the worm was probably harassing the
staff on that computer from a neighbouring system which it had
successfully invaded. The messages suggested that the recipients'
accounts had not been hijacked by the worm. Yet.
VAX/VMS machines have a feature called Phone, which is useful for
on-line communications. For example, a NASA scientist could `ring up'
one of his colleagues on a different computer and have a friendly chat
on-line. The chat session is live, but it is conducted by typing on
the computer screen, not `voice'. The VMS Phone facility enabled the
worm to send messages to users. It would simply call them using the
phone protocol. But instead of starting a chat session, it sent them
statements from what was later determined to be the aptly named
Fortune Cookie file--a collection of 60 or so pre-programmed comments.
In some cases, where the worm was really bugging staff, McMahon told
the manager at the other end of the phone to turn the computer's Phone
feature off. A few managers complained and McMahon gave them the
obvious ultimatum: choose Phone or peace. Most chose peace.
When McMahon finished his preliminary analysis, he had good news and
bad news. The good news was that, contrary to what the worm was
telling computer users all over NASA, it was not actually deleting
their files. It was just pretending to delete their data. One big
practical joke. To the creator of the worm anyway. To the NASA
scientists, just a headache and heartache. And occasionally a heart
attack.
The bad news was that, when the worm got control over a privileged
account, it would help someone--presumably its creator--perpetrate an
even more serious break-in at NASA. The worm sought out the FIELD
account created by the manufacturer and, if it had been turned off,
tried to reactivate the account and install the password FIELD. The
worm was also programmed to change the password for the standard
account named DECNET to a random string of at least twelve characters.
In short, the worm tried to pry open a backdoor to the system.
The worm sent information about accounts it had successfully broken
into back to a type of electronic mailbox--an account called GEMPAK on
SPAN node 6.59. Presumably, the hacker who created the worm would
check the worm's mailbox for information which he could use to break
into the NASA account at a later date. Not surprisingly, the mailboxes
had been surreptitiously `borrowed' by the hacker, much to the
surprise of the legitimate owners.
A computer hacker created a whole new set of problems. Although the
worm was able to break into new accounts with greater speed and reach
than a single hacker, it was more predictable. Once the SPAN and DOE
teams picked the worm apart, they would know exactly what it could be
expected to do. However, a hacker was utterly unpredictable.
McMahon realised that killing off the worm was not going to solve the
problem. All the system managers across the NASA and DOE networks
would have to change all the passwords of the accounts used by the
worm. They would also have to check every system the worm had invaded
to see if it had built a backdoor for the hacker. The system admin had
to shut and lock all the backdoors, no small feat.
What really scared the SPAN team about the worm, however, was that it
was rampaging through NASA simply by using the simplest of attack
strategies: username equals password. It was getting complete control
over NASA computers simply by trying a password which was identical to
the name of the computer user's account.
The SPAN team didn't want to believe it, but the evidence was
overwhelming.
Todd Butler answered a call from one NASA site. It was a gloomy call.
He hung up.
`That node just got hit,' he told the team.
`How bad?' McMahon asked.
`A privileged account.'
`Oh boy.' McMahon jumped onto one of the terminals and did a SET HOST,
logging into the remote NASA site's machine. Bang. Up it came. `Your
system has officially been WANKED.'
McMahon turned to Butler. `What account did it get into?'
`They think it was SYSTEM.'
The tension quietly rolled into black humour. The team couldn't help
it. The head-slapping stupidity of the situation could only be viewed
as black comedy.
The NASA site had a password of SYSTEM for their fully privileged
SYSTEM account. It was so unforgivable. NASA, potentially the greatest
single collection of technical minds on Earth, had such lax computer
security that a computer-literate teenager could have cracked it wide
open. The tall poppy was being cut down to size by a computer program
resembling a bowl of spaghetti.
The first thing any computer system manager learns in Computer
Security 101 is never to use the same password as the username. It was
bad enough that naive users might fall into this trap ... but a
computer system manager with a fully privileged account.
Was the hacker behind the worm malevolent? Probably not. If its
creator had wanted to, he could have programmed the WANK worm to
obliterate NASA's files. It could have razed everything in sight.
In fact, the worm was less infectious than its author appeared to
desire. The WANK worm had been instructed to perform
several tasks which it didn't execute. Important parts of the worm
simply didn't work. McMahon believed this failure to be accidental.
For example, his analysis showed the worm was programmed to break into
accounts by trying no password, if the account holder had left the
password blank. When he disassembled the worm, however, he found that
part of the program didn't work properly.
Nonetheless, the fragmented and partly dysfunctional WANK worm was
causing a major crisis inside several US government agencies. The
thing which really worried John was thinking about what a seasoned DCL
programmer with years of VMS experience could do with such a worm.
Someone like that could do a lot of malicious damage. And what if the
WANK worm was just a dry run for something more serious down the
track? It was scary to contemplate.
Even though the WANK worm did not seem to be intentionally evil, the
SPAN team faced some tough times. McMahon's analysis turned up yet
more alarming aspects to the worm. If it managed to break into the
SYSTEM account, a privileged account, it would block all electronic
mail deliveries to the system administrator. The SPAN office would not
be able to send electronic warnings or advice on how to deal with the
worm to systems which had already been seized. This problem was
exacerbated by the lack of good information available to the project
office on which systems were connected to SPAN. The only way to help
people fighting this bushfire was to telephone them, but in many
instances the main SPAN office didn't know who to call. The SPAN team
could only hope that those administrators who had the phone number of
SPAN headquarters pinned up near their computers would call when their
computers came under attack.
McMahon's preliminary report outlined how much damage the worm could
do in its own right. But it was impossible to measure how much damage
human managers would do to their own systems because of the worm.
One frantic computer manager who phoned the SPAN office refused to
believe John's analysis that the worm only pretended to erase data. He
claimed that the worm had not only attacked his system, it had
destroyed it. `He just didn't believe us when we told him that the
worm was mostly a set of practical jokes,' McMahon said. `He
reinitialised his system.' `Reinitialised' as in started up his system
with a clean slate. As in deleted everything on the infected
computer--all the NASA staff's data gone. He actually did what the
worm only pretended to do.
The sad irony was that the SPAN team never even got a copy of the data
from the manager's system. They were never able to confirm that his
machine had even been infected.
All afternoon McMahon moved back and forth between answering the
ever-ringing SPAN phone and writing up NASA's analysis of the worm. He
had posted a cryptic electronic message about the attack across the
network, and Kevin Oberman had read it. The message had to be
circumspect since no-one knew if the creator of the WANK worm was in
fact on the network, watching, waiting. A short time later, McMahon
and Oberman were on the phone together--voice--sharing their ideas and
cross-checking their analysis.
The situation was discouraging. Even if McMahon and Oberman managed to
develop a successful program to kill off the worm, the NASA SPAN team
faced another daunting task. Getting the worm-killer out to all the
NASA sites was going to be much harder than expected because there was
no clear, updated map of the SPAN network. Much of NASA didn't like
the idea of a centralised map of the SPAN system. McMahon recalled
that, some time before the WANK worm attack, a manager had tried to
map the system. His efforts had accidentally tripped so many system
alarms that he was quietly taken aside and told not to do it again.
The result was that in instances where the team had phone contact
details for managers, the information was often outdated.
`No, he used to work here, but he left over a year ago.'
`No, we don't have a telephone tree of people to ring if
something goes wrong with our computers. There are a whole
bunch of people in different places here who handle the
computers.'
This is what John often heard at the other end of the phone.
The network had grown into a rambling hodgepodge for which there was
little central coordination. Worse, a number of computers at different
NASA centres across the US had just been tacked onto SPAN without
telling the main office at Goddard. People were calling up the ad-hoc
crisis centre from computer nodes on the network which didn't even
have names. These people had been practising a philosophy known in
computer security circles as `security through obscurity'. They
figured that if no-one knew their computer system existed--if it
didn't have a name, if it wasn't on any list or map of the SPAN
network--then it would be protected from hackers and other computer
enemies.
McMahon handled a number of phone calls from system managers saying,
`There is something strange happening in my system here'. John's most
basic question was, `Where is "here"?' And of course if the SPAN
office didn't know those computer systems existed, it was a lot harder
to warn their managers about the worm. Or tell them how to protect
themselves. Or give them a worm-killing program once it was developed.
Or help them seal up breached accounts which the worm was feeding back
to its creator.
It was such a mess. At times, McMahon sat back and considered who
might have created this worm. The thing almost looked as though it had
been released before it was finished. Its author or authors seemed to
have a good collection of interesting ideas about how to solve
problems, but they were never properly completed. The worm included a
routine for modifying its attack strategy, but the thing was never
fully developed. The worm's code didn't have enough error handling in
it to ensure the creature's survival for long periods of time. And the
worm didn't send the addresses of the accounts it had successfully
breached back to the mailbox along with the password and account name.
That was really weird. What use was a password and account name
without knowing what computer system to use it on?
On the other hand, maybe the creator had done this deliberately. Maybe
he had wanted to show the world just how many computers the worm could
successfully penetrate. The worm's mail-back program would do this.
However, including the address of each infected site would have made
the admins' jobs easier. They could simply have used the GEMPAK
collection as a hitlist of infected sites which needed to be
de-wormed. The possible theories were endless.
There were some points of brilliance in the worm, some things that
McMahon had never considered, which was impressive since he knew a lot
about how to break into VMS computers. There was also considerable
creativity, but there wasn't any consistency. After the worm incident,
various computer security experts would hypothesise that the WANK worm
had in fact been written by more than one person. But McMahon
maintained his view that it was the work of a single hacker.
It was as if the creator of the worm started to pursue an idea and
then got sidetracked or interrupted. Suddenly he just stopped writing
code to implement that idea and started down another path, never again
to reach the end. The thing had a schizophrenic structure. It was all
over the place.
McMahon wondered if the author had done this on purpose, to make it
harder to figure out exactly what the worm was capable of doing.
Perhaps, he thought, the code had once been nice and linear and it all
made sense. Then the author chopped it to pieces, moved the middle to
the top, the top to the bottom, scrambled up the chunks and strung
them all together with a bunch of `GO TO' commands. Maybe the hacker
who wrote the worm was in fact a very elegant DCL programmer who
wanted the worm to be chaotic in order to protect it. Security through
obscurity.
Oberman maintained a different view. He believed the programming style
varied so much in different parts that it had to be the product of a
number of people. He knew that when computer programmers write code
they don't make lots of odd little changes in style for no particular
reason.
Kevin Oberman and John McMahon bounced ideas off one another. Both had
developed their own analyses. Oberman also brought Mark Kaletka, who
managed internal networking at Fermilab, one of HEPNET's largest
sites, into the cross-checking process. The worm had a number of
serious vulnerabilities, but the problem was finding one, and quickly,
which could be used to wipe it out with minimum impact on the besieged
computers.
Whenever a VMS machine starts up an activity, the computer gives it a
unique process name. When the worm burrowed into a computer site, one
of the first things it did was check that another copy of itself was
not already running on that computer. It did this by checking for its
own process names. The worm's processes were all called NETW_ followed
by a random, four-digit number. If the incoming worm found this
process name, it assumed another copy of itself was already running on
the computer, so it destroyed itself.
The answer seemed to be a decoy duck. Write a program which pretended
to be the worm and install it across all of NASA's vulnerable
computers. The first anti-WANK program did just that. It quietly sat
on the SPAN computers all day long, posing as a NETW_ process, faking
out any real version of the WANK worm which should come along.
Oberman completed an anti-WANK program first and ran it by McMahon. It
worked well, but McMahon noticed one large flaw. Oberman's program
checked for the NETW_ process name, but it assumed that the worm was
running under the SYSTEM group. In most cases, this was true, but it
didn't have to be. If the worm was running in another group, Oberman's
program would be useless. When McMahon pointed out the flaw, Oberman
thought, God, how did I miss that?
McMahon worked up his own version of an anti-WANK
program, based on Oberman's program, in preparation for releasing it
to NASA.
At the same time, Oberman revised his anti-WANK program for DOE. By
Monday night US Eastern Standard Time, Oberman was able to send out an
early copy of a vaccine designed to protect computers which hadn't
been infected yet, along with an electronic warning about the worm.
His first electronic warning, distributed by CIAC, said in part:
THE COMPUTER INCIDENT ADVISORY CAPABILITY C I A C
ADVISORY NOTICE
The W.COM Worm affecting VAX VMS Systems
October 16, 1989 18:37 PSTNumber A-2
This is a mean bug to kill and could have done a lot of damage.
Since it notifies (by mail) someone of each successful penetration and
leaves a trapdoor (the FIELD account), just killing the bug is not
adequate. You must go in and make sure all accounts have passwords and
that the passwords are not the same as the account name.
R. Kevin Oberman
Advisory Notice
A worm is attacking NASA's SPAN network via VAX/VMS systems connected
to DECnet. It is unclear if the spread of the worm has been checked.
It may spread to other systems such as DOE's HEPNET within a few days.
VMS system managers should prepare now.
The worm targets VMS machines, and can only be propagated via DECnet.
The worm exploits two features of DECnet/VMS in order to propagate
itself. The first is the default DECnet account, which is a facility
for users who don't have a specific login ID for a machine to have
some degree of anonymous access. It uses the default DECnet account to
copy itself to a machine, and then uses the `TASK 0' feature of DECnet
to invoke the remote copy. It has several other features including a
brute force attack.
Once the worm has successfully penetrated your system it will infect
.COM files and create new security vulnerabilities. It then seems to
broadcast these vulnerabilities to the outside world. It may also
damage files as well, either unintentionally or otherwise.
An analysis of the worm appears below and is provided by R. Kevin
Oberman of Lawrence Livermore National Laboratory. Included with the
analysis is a DCL program that will block the current version of the
worm. At least two versions of this worm exist and more may be
created. This program should give you enough time to close up obvious
security holes. A more thorough DCL program is being written.
If your site could be affected please call CIAC for more details...
Report on the W.COM worm.
R. Kevin Oberman
Engineering Department
Lawrence Livermore National Laboratory
October 16, 1989
The following describes the action of the W.COM worm (currently based
on the examination of the first two incarnations). The replication
technique causes the code to be modified slightly which indicates the
source of the attack and learned information.
All analysis was done with more haste than I care for, but I believe I
have all of the basic facts correct. First a description of the
program:
1. The program assures that it is working in a directory to which the
owner (itself) has full access (Read, Write, Execute, and Delete).
2. The program checks to see if another copy is still running. It
looks for a process with the first 5 characters of `NETW_'. If such is
found, it deletes itself (the file) and stops its process.
NOTE
A quick check for infection is to look for a process name starting
with `NETW_'. This may be done with a SHOW PROCESS command.
3. The program then changes the default DECNET account password to a
random string of at least 12 characters.
4. Information on the password used to access the system is mailed to
the user GEMTOP on SPAN node 6.59. Some versions may have a different
address.11
5. The process changes its name to `NETW_' followed by a random
number.
6. It then checks to see if it has SYSNAM priv. If so, it defines the
system announcement message to be the banner in the program:
Worms Against Nuclear Killers!
Your System Has Been Officically Wanked.
You talk of times of peace for all, and then prepare for war.
7. If it has SYSPRV, it disables mail to the SYSTEM account.
8. If it has SYSPRV, it modifies the system login command procedure to
APPEAR to delete all of a user's file. (It really does nothing.)
9. The program then scans the account's logical name table for command
procedures and tries to modify the FIELD account to a known password
with login from any source and all privs. This is a primitive virus,
but very effective IF it should get into a privileged account.
10. It proceeds to attempt to access other systems by picking node
numbers at random. It then uses PHONE to get a list of active users on
the remote system. It proceeds to irritate them by using PHONE to ring
them.
11. The program then tries to access the RIGHTSLIST file and attempts
to access some remote system using the users found and a list of
`standard' users included within the worm. It looks for passwords
which are the same as that of the account or are blank. It records all
such accounts.
12. It looks for an account that has access to SYSUAF.DAT.
13. If a priv. account is found, the program is copied to that account
and started. If no priv. account was found, it is copied to other
accounts found on the random system.
14. As soon as it finishes with a system, it picks another random
system and repeats (forever).
Response:
1. The following program will block the worm. Extract the following
code and execute it. It will use minimal resources. It creates a
process named NETW_BLOCK which will prevent the worm from running.
Editors note: This fix will work only with this version of the worm.
Mutated worms will require modification of this code; however, this
program should prevent the worm from running long enough to secure
your system from the worms attacks.13
---
McMahon's version of an anti-WANK program was also ready to go by late
Monday, but he would face delays getting it out to NASA. Working inside
NASA was a balancing act, a delicate ballet demanding exquisite
choreography between getting the job done, following official procedures
and avoiding steps which might tread on senior bureaucrats' toes. It was
several days before NASA's anti-WANK program was officially released.
DOE was not without its share of problems in launching the anti-WANK
program and advisory across HEPNET. At 5.04 p.m. Pacific Coast Time on
17 October, as Oberman put the final touches on the last paragraph of
his final report on the worm, the floor beneath his feet began to
shake. The building was trembling. Kevin Oberman was in the middle of
the 1989 San Francisco earthquake.
Measuring 7.1 on the Richter scale, the Loma Prieta earthquake ripped
through the greater San Francisco area with savage speed. Inside the
computer lab, Oberman braced himself for the worst. Once the shaking
stopped and he ascertained the computer centre was still standing, he
sat back down at his terminal. With the PA blaring warnings for all
non-essential personnel to leave the building immediately, Oberman
rushed off the last sentence of the report. He paused and then added a
postscript saying that if the paragraph didn't make sense, it was
because he was a little rattled by the large earthquake which had just
hit Lawrence Livermore Labs. He pressed the key, sent out his final
anti-WANK report and fled the building.
Back on the east coast, the SPAN office continued to help people
calling from NASA sites which had been hit. The list of sites which
had reported worm-related problems grew steadily during the week.
Official estimates on the scope of the WANK worm attack were vague,
but trade journals such as Network World and Computerworld quoted the
space agency as suffering only a small number of successful worm
invasions, perhaps 60 VMS-based computers. SPAN security manager Ron
Tencati estimated only 20 successful worm penetrations in the NASA
part of SPAN's network, but another internal estimate put the figure
much higher: 250 to 300 machines. Each of those computers might have
had 100 or more users. Figures were sketchy, but virtually everyone on
the network--all 270000 computer accounts--had been affected by the
worm, either because their part of the network had been pulled
off-line or because their machines had been harassed by the WANK worm
as it tried again and again to login from an infected machine. By the
end of the worm attack, the SPAN office had accumulated a list of
affected sites which ran over two columns on several computer screens.
Each of them had lodged some form of complaint about the worm.
Also by the end of the crisis, NASA and DOE computer network managers
had their choice of vaccines, antidotes and blood tests for the WANK
worm. McMahon had released ANTIWANK.COM, a program which killed the
worm and vaccinated a system against further attacks, and
WORM-INFO.TEXT, which provided a list of worm-infestation symptoms.
Oberman's program, called [.SECURITY]CHECK_SYSTEM.COM, checked for all
the security flaws used by the worm to sneak into a computer system.
DEC also had a patch to cover the security hole in the DECNET account.
Whatever the real number of infected machines, the worm had certainly
circumnavigated the globe. It had reach into European sites, such as
CERN--formerly known as the European Centre for Nuclear Research--in
Switzerland, through to Goddard's computers in Maryland, on to
Fermilab in Chicago and propelled itself across the Pacific into the
Riken Accelerator Facility in Japan.14
NASA officials told the media they believed the worm had been launched
about 4.30 a.m. on Monday, 16 October.15 They also believed it had
originated in Europe, possibly in France.
Wednesday, 18 October 1989
Kennedy Space Center, Florida
The five-member Atlantis had some bad news on Wednesday morning. The
weather forecasters gave the launch site a 40 per cent chance of
launch guideline-violating rain and cloud. And then there was the
earthquake in California.
The Kennedy Space Center wasn't the only place which had to be in
tip-top working order for a launch to go ahead. The launch depended on
many sites far away from Florida. These included Edwards Air Force
Base in California, where the shuttle was due to land on Monday. They
also included other sites, often military bases, which were essential
for shuttle tracking and other mission support. One of these sites was
a tracking station at Onizuka Air Force Base at Sunnyvale, California.
The earthquake which ripped through the Bay area had damaged the
tracking station and senior NASA decision-makers planned to meet on
Wednesday morning to consider the Sunnyvale situation. Still, the
space agency maintained a calm, cool exterior. Regardless of the
technical problems, the court challenges and the protesters, the
whimsical weather, the natural disasters, and the WANK worm, NASA was
still in control of the situation.
`There's been some damage, but we don't know how much. The sense I get
is it's fairly positive,' a NASA spokesman told UPI. `But there are
some problems.'16 In Washington, Pentagon spokesman Rick Oborn
reassured the public again, `They are going to be able to handle
shuttle tracking and support for the mission ... They will be able to
do their job'.17
Atlantis waited, ready to go, at launchpad 39B. The technicians had
filled the shuttle up with rocket fuel and it looked as if the weather
might hold. It was partly cloudy, but conditions at Kennedy passed
muster.
The astronauts boarded the shuttle. Everything was in place.
But while the weather was acceptable in Florida, it was causing some
problems in Africa, the site of an emergency landing location. If it
wasn't one thing, it was another. NASA ordered a four-minute delay.
Finally at 12.54 p.m., Atlantis boomed from its launchpad. Rising up
from the Kennedy Center, streaking a trail of twin flames from its
huge solid-fuel boosters, the shuttle reached above the atmosphere and
into space.
At 7.15 p.m., exactly 6 hours and 21 minutes after lift-off, Galileo
began its solo journey into space. And at 8.15 p.m., Galileo's booster
ignited.
Inside shuttle mission control, NASA spokesman Brian Welch announced,
`The spacecraft Galileo ... has achieved Earth escape velocity'.18
Monday, 30 October 1989
NASA's Goddard Space Flight Center, Greenbelt, Maryland
The week starting 16 October had been a long one for the SPAN team.
They were keeping twelve-hour days and dealing with hysterical people
all day long. Still, they managed to get copies of anti-WANK out,
despite the limitations of the dated SPAN records and the paucity of
good logs allowing them to retrace the worm's path. `What we learned
that week was just how much data is not collected,' McMahon observed.
By Friday, 20 October, there were no new reports of worm attacks. It
looked as though the crisis had passed. Things could be tidied up by
the rest of the SPAN team and McMahon returned to his own work.
A week passed. All the while, though, McMahon was on edge. He doubted
that someone who had gone to all that trouble of creating the WANK
worm would let his baby be exterminated so quickly. The decoy-duck
strategy only worked as long as the worm kept the same process name,
and as long as it was programmed not to activate itself on systems
which were already infected. Change the process name, or teach the
worm to not to suicide, and the SPAN team would face another, larger
problem. John McMahon had an instinct about the worm; it might just
be back.
His instinct was right.
The following Monday, McMahon received another phone call from the
SPAN project office. When he poked his head in his boss's office,
Jerome Bennett looked up from his desk.
`The thing is back,' McMahon told him. There was no need to explain
what `the thing' was. `I'm going over to the SPAN office.'
Ron Tencati and Todd Butler had a copy of the new WANK worm ready for
McMahon. This version of the worm was far more virulent. It copied
itself more effectively and therefore moved through the network much
faster. The revised worm's penetration rate was much higher--more than
four times greater than the version of WANK released in the first
attack. The phone was ringing off the hook again. John took a call
from one irate manager who launched into a tirade. `I ran your
anti-WANK program, followed your instructions to the letter, and look
what happened!'
The worm had changed its process name. It was also designed to hunt down
and kill the decoy-duck program. In fact, the SPAN network was going to
turn into a rather bloody battlefield. This worm didn't just kill the
decoy, it also killed any other copy of the WANK worm. Even if McMahon
changed the process name used by his program, the decoy-duck strategy
was not going to work any longer.
There were other disturbing improvements to the new version of the
WANK worm. Preliminary information suggested it changed the password
on any account it got into. This was a problem. But not nearly as big
a problem as if the passwords it changed were for the only privileged
accounts on the system. The new worm was capable of locking a system
manager out of his or her own system.
Prevented from getting into his own account, the computer manager
might try borrowing the account of an average user, call him Edwin.
Unfortunately, Edwin's account probably only had low-level privileges.
Even in the hands of a skilful computer manager, the powers granted to
Edwin's account were likely too limited to eradicate the worm from its
newly elevated status as computer manager. The manager might spend his
whole morning matching wits with the worm from the disadvantaged
position of a normal user's account. At some point he would have to
make the tough decision of last resort: turn the entire computer
system off.
The manager would have to conduct a forced reboot of the machine. Take
it down, then bring it back up on minimum configuration. Break back
into it. Fix the password which the worm had changed. Logout. Reset
some variables. Reboot the machine again. Close up any underlying
security holes left behind by the worm. Change any passwords which
matched users' names. A cold start of a large VMS machine took time.
All the while, the astronomers, physicists and engineers who worked in
this NASA office wouldn't be able to work on their computers.
At least the SPAN team was better prepared for the worm this time.
They had braced themselves psychologically for a possible return
attack. Contact information for the network had been updated. And the
general DECNET internet community was aware of the worm and was
lending a hand wherever possible.
Help came from a system manager in France, a country which seemed to
be of special interest to the worm's author. The manager, Bernard
Perrot of Institut de Physique Nucleaire in Orsay, had obtained a copy
of the worm, inspected it and took special notice of the creature's
poor error checking ability. This was the worm's true Achilles' heel.
The worm was trained to go after the RIGHTSLIST database, the list of
all the people who have accounts on the computer. What if someone
moved the database by renaming it and put a dummy database in its
place? The worm would, in theory, go after the dummy, which could be
designed with a hidden bomb. When the worm sniffed out the dummy, and
latched onto it, the creature would explode and die. If it worked, the
SPAN team would not have to depend on the worm killing itself, as they
had during the first invasion. They would have the satisfaction of
destroying the thing themselves.
Ron Tencati procured a copy of the French manager's worm-killing
program and gave it to McMahon, who set up a sort of mini-laboratory
experiment. He cut the worm into pieces and extracted the relevant
bits. This allowed him to test the French worm-killing program with
little risk of the worm escaping and doing damage. The French program
worked wonderfully. Out it went. The second version of the worm was so
much more virulent, getting it out of SPAN was going to take
considerably longer than the first time around. Finally, almost two
weeks after the second onslaught, the WANK worm had been eradicated
from SPAN.
By McMahon's estimate, the WANK worm had incurred up to half a million
dollars in costs. Most of these were through people wasting time and
resources chasing the worm instead of doing their normal jobs. The
worm was, in his view, a crime of theft. `People's time and resources
had been wasted,' he said. `The theft was not the result of the
accident. This was someone who deliberately went out to make a mess.
`In general, I support prosecuting people who think breaking into
machines is fun. People like that don't seem to understand what kind
of side effects that kind of fooling around has. They think that
breaking into a machine and not touching anything doesn't do anything.
That is not true. You end up wasting people's time. People are dragged
into the office at strange hours. Reports have to be written. A lot of
yelling and screaming occurs. You have to deal with law enforcement.
These are all side effects of someone going for a joy ride in someone
else's system, even if they don't do any damage. Someone has to pay
the price.'
McMahon never found out who created the WANK worm. Nor did he ever
discover what he intended to prove by releasing it. The creator's
motives were never clear and, if it had been politically inspired,
no-one took credit.
The WANK worm left a number of unanswered questions in its wake, a
number of loose ends which still puzzle John McMahon. Was the hacker
behind the worm really protesting against NASA's launch of the
plutonium-powered Galileo space probe? Did the use of the word
`WANK'--a most un-American word--mean the hacker wasn't American? Why
had the creator recreated the worm and released it a second time? Why
had no-one, no political or other group, claimed responsibility for
the WANK worm?
One of the many details which remained an enigma was contained in the
version of the worm used in the second attack. The worm's creator had
replaced the original process name, NETW_, with a new one, presumably
to thwart the anti-WANK program. McMahon figured the original process
name stood for `netwank'--a reasonable guess at the hacker's intended
meaning. The new process name, however, left everyone on the SPAN team
scratching their heads: it didn't seem to stand for anything. The
letters formed an unlikely set of initials for someone's name. No-one
recognised it as an acronym for a saying or an organisation. And it
certainly wasn't a proper word in the English language. It was a
complete mystery why the creator of the WANK worm, the hacker who
launched an invasion into hundreds of NASA and DOE computers, should
choose this weird word.
The word was `OILZ'.
CHAPTER 2 -- The Corner Pub.
You talk of times of peace for all; and then prepare for war.
-- from `Blossom of Blood', Species Deceases.
It is not surprising the SPAN security team would miss the mark. It is
not surprising, for example, that these officials should to this day
be pronouncing the `Oilz' version of the WANK worm as `oil zee'. It is
also not surprising that they hypothesised the worm's creator chose
the word `Oilz' because the modifications made to the last version
made it slippery, perhaps even oily.
Likely as not, only an Australian would see the worm's link to the
lyrics of Midnight Oil.
This was the world's first worm with a political message, and the
second major worm in the history of the worldwide computer networks.
It was also the trigger for the creation of FIRST, the Forum of
Incident Response and Security Teams.2 FIRST was an international
security alliance allowing governments, universities and commercial
organisations to share information about computer network security
incidents. Yet, NASA and the US Department of Energy were half a world
away from finding the creator of the WANK worm. Even as investigators
sniffed around electronic trails leading to France, it appears the
perpetrator was hiding behind his computer and modem in Australia.
Geographically, Australia is a long way from anywhere. To Americans,
it conjures up images of fuzzy marsupials, not computer hackers.
American computer security officials, like those at NASA and the US
Department of Energy, had other barriers as well. They function in a
world of concretes, of appointments made and kept, of real names,
business cards and official titles. The computer underground, by
contrast, is a veiled world populated by characters slipping in and
out of the half-darkness. It is not a place where people use their
real names. It is not a place where people give out real personal
details.
It is, in fact, not so much a place as a space. It is ephemeral,
intangible--a foggy labyrinth of unmapped, winding streets through
which one occasionally ascertains the contours of a fellow traveller.
When Ron Tencati, the manager in charge of NASA SPAN security, realised
that NASA's computers were being attacked by an intruder, he rang the
FBI. The US Federal Bureau of Investigation's Computer Crime Unit fired
off a stream of questions. How many computers had been attacked? Where
were they? Who was behind the attack? The FBI told Tencati, `keep us
informed of the situation'. Like the CIAC team in the Department of
Energy, it appears the FBI didn't have much knowledge of VMS, the
primary computer operating system used in SPAN.
But the FBI knew enough to realise the worm attack was potentially
very serious. The winding electronic trail pointed vaguely to a
foreign computer system and, before long, the US Secret Service was
involved. Then the French secret service, the Direction de la
Surveillance du Territoire, or DST, jumped into the fray.
DST and the FBI began working together on the case. A casual observer
with the benefit of hindsight might see different motivations driving
the two government agencies. The FBI wanted to catch the perpetrator.
The DST wanted to make it clear that the infamous WANK worm attack on
the world's most prestigious space agency did not originate in France.
In the best tradition of cloak-and-dagger government agencies, the FBI
and DST people established two communication channels--an official
channel and an unofficial one. The official channel involved
embassies, attachés, formal communiques and interminable delays in
getting answers to the simplest questions. The unofficial channel
involved a few phone calls and some fast answers.
Ron Tencati had a colleague named Chris on the SPAN network in France,
which was the largest user of SPAN in Europe. Chris was involved in
more than just science computer networks. He had certain contacts in
the French government and seemed to be involved in their computer
networks. So, when the FBI needed technical information for its
investigation--the kind of information likely to be sanitised by some
embassy bureaucrat--one of its agents rang up Ron Tencati. `Ron, ask
your friend this,' the FBI would say. And Ron would.
`Chris, the FBI wants to know this,' Tencati would tell his colleague
on SPAN France. Then Chris would get the necessary information. He
would call Tencati back, saying, `Ron, here is the answer. Now, the
DST wants to know that'. And off Ron would go in search of information
requested by the DST.
The investigation proceeded in this way, with each helping the other
through backdoor channels. But the Americans' investigation was headed
toward the inescapable conclusion that the attack on NASA had
originated from a French computer. The worm may have simply travelled
through the French computer from yet another system, but the French
machine appeared to be the sole point of infection for NASA.
The French did not like this outcome. Not one bit. There was no way
that the worm had come from France. Ce n'est pas vrai.
Word came back from the French that they were sure the worm had come
from the US. Why else would it have been programmed to mail details of
all computer accounts it penetrated around the world back to a US
machine, the computer known as GEMPAK? Because the author of the worm
was an American, of course! Therefore it is not our problem, the
French told the Americans. It is your problem.
Most computer security experts know it is standard practice among
hackers to create the most tangled trail possible between the hacker
and the hacked. It makes it very difficult for people like the FBI to
trace who did it. So it would be difficult to draw definite
conclusions about the nationality of the hacker from the location of a
hacker's information drop-off point--a location the hacker no doubt
figured would be investigated by the authorities almost immediately
after the worm's release.
Tencati had established the French connection from some computer logs
showing NASA under attack very early on Monday, 16 October. The logs
were important because they were relatively clear. As the worm had
procreated during that day, it had forced computers all over the
network to attack each other in ever greater numbers. By 11 a.m. it
was almost impossible to tell where any one attack began and the other
ended.
Some time after the first attack, DST sent word that certain agents
were going to be in Washington DC regarding other matters. They wanted
a meeting with the FBI. A representative from the NASA Inspector
General's Office would attend the meeting, as would someone from NASA
SPAN security.
Tencati was sure he could show the WANK worm attack on NASA originated
in France. But he also knew he had to document everything, to have
exact answers to every question and counter-argument put forward by
the French secret service agents at the FBI meeting. When he developed
a timeline of attacks, he found that the GEMPAK machine showed X.25
network connection, via another system, from a French computer around
the same time as the WANK worm attack. He followed the scent and
contacted the manager of that system. Would he help Tencati? Mais oui.
The machine is at your disposal, Monsieur Tencati.
Tencati had never used an X.25 network before; it had a unique set of
commands unlike any other type of computer communications network. He
wanted to retrace the steps of the worm, but he needed help. So he
called his friend Bob Lyons at DEC to walk him through the process.
What Tencati found startled him. There were traces of the worm on the
machine all right, the familiar pattern of login failures as the worm
attempted to break into different accounts. But these remnants of the
WANK worm were not dated 16 October or any time immediately around
then. The logs showed worm-related activity up to two weeks before the
attack on NASA. This computer was not just a pass-through machine the
worm had used to launch its first attack on NASA. This was the
development machine.
Ground zero.
Tencati went into the meeting with DST at the FBI offices prepared. He
knew the accusations the French were going to put forward. When he
presented the results of his sleuthwork, the French secret service
couldn't refute it, but they dropped their own bombshell. Yes they
told him, you might be able to point to a French system as ground zero
for the attack, but our investigations reveal incoming X.25
connections from elsewhere which coincided with the timing of the
development of the WANK worm.
The connections came from Australia.
The French had satisfied themselves that it wasn't a French hacker who
had created the WANK worm. Ce n'est pas notre problem. At least, it's
not our problem any more.
It is here that the trail begins to go cold. Law enforcement and
computer security people in the US and Australia had ideas about just
who had created the WANK worm. Fingers were pointed, accusations were
made, but none stuck. At the end of the day, there was coincidence and
innuendo, but not enough evidence to launch a case. Like many
Australian hackers, the creator of the WANK worm had emerged from the
shadows of the computer underground, stood momentarily in hazy
silhouette, and then disappeared again.
The Australian computer underground in the late 1980s was an
environment which spawned and shaped the author of the WANK worm.
Affordable home computers, such as the Apple IIe and the Commodore 64,
made their way into ordinary suburban families. While these computers
were not widespread, they were at least in a price range which made
them attainable by dedicated computer enthusiasts.
In 1988, the year before the WANK worm attack on NASA, Australia was
on an upswing. The country was celebrating its bicentennial. The
economy was booming. Trade barriers and old regulatory structures were
coming down. Crocodile Dundee had already burst on the world movie
scene and was making Australians the flavour of the month in cities
like LA and New York. The mood was optimistic. People had a sense they
were going places. Australia, a peaceful country of seventeen or so
million people, poised on the edge of Asia but with the order of a
Western European democracy, was on its way up. Perhaps for the first
time, Australians had lost their cultural cringe, a unique type of
insecurity alien to can-do cultures such as that found in the US.
Exploration and experimentation require confidence and, in 1988,
confidence was something Australia had finally attained.
Yet this new-found confidence and optimism did not subdue Australia's
tradition of cynicism toward large institutions. The two coexisted,
suspended in a strange paradox. Australian humour, deeply rooted in a
scepticism of all things serious and sacred, continued to poke fun at
upright institutions with a depth of irreverence surprising to many
foreigners. This cynicism of large, respected institutions coursed
through the newly formed Australian computer underground without
dampening its excitement or optimism for the brave new world of
computers in the least.
In 1988, the Australian computer underground thrived like a vibrant
Asian street bazaar. In that year it was still a realm of place not
space. Customers visited their regular stalls, haggled over goods with
vendors, bumped into friends and waved across crowded paths to
acquaintances. The market was as much a place to socialise as it was
to shop. People ducked into tiny coffee houses or corner bars for
intimate chats. The latest imported goods, laid out on tables like
reams of bright Chinese silks, served as conversation starters. And,
like every street market, many of the best items were tucked away,
hidden in anticipation of the appearance of that one customer or
friend most favoured by the trader. The currency of the underground
was not money; it was information. People didn't share and exchange
information to accumulate monetary wealth; they did it to win
respect--and to buy a thrill.
The members of the Australian computer underground met on bulletin
board systems, known as BBSes. Simple things by today's standards,
BBSes were often composed of a souped-up Apple II computer, a single
modem and a lone telephone line. But they drew people from all walks
of life. Teenagers from working-class neighbourhoods and those from
the exclusive private schools. University students. People in their
twenties groping their way through first jobs. Even some professional
people in their thirties and forties who spent weekends poring over
computer manuals and building primitive computers in spare rooms. Most
regular BBS users were male. Sometimes a user's sister would find her
way into the BBS world, often in search of a boyfriend. Mission
accomplished, she might disappear from the scene for weeks, perhaps
months, presumably until she required another visit.
The BBS users had a few things in common. They were generally of above
average intelligence--usually with a strong technical slant--and they
were obsessed with their chosen hobby. They had to be. It often took
45 minutes of attack dialling a busy BBS's lone phone line just to
visit the computer system for perhaps half an hour. Most serious BBS
hobbyists went through this routine several times each day.
As the name suggests, a BBS had what amounted to an electronic version
of a normal bulletin board. The owner of the BBS would have divided
the board into different areas, as a school teacher crisscrosses
coloured ribbon across the surface of a corkboard to divide it into
sections. A single BBS might have 30 or more electronic discussion
groups.
As a user to the board, you might visit the politics section, tacking
up a `note' on your views of ALP or Liberal policies for anyone
passing by to read. Alternatively, you might fancy yourself a bit of a
poet and work up the courage to post an original piece of work in the
Poet's Corner. The corner was often filled with dark, misanthropic
works inspired by the miseries of adolescence. Perhaps you preferred
to discuss music. On many BBSes you could find postings on virtually
any type of music. The most popular groups included bands like Pink
Floyd, Tangerine Dream and Midnight Oil. Midnight Oil's
anti-establishment message struck a particular chord within the new
BBS community.
Nineteen eighty-eight was the golden age of the BBS culture across
Australia. It was an age of innocence and community, an open-air
bazaar full of vitality and the sharing of ideas. For the most part,
people trusted their peers within the community and the BBS operators,
who were often revered as demigods. It was a happy place. And, in
general, it was a safe place, which is perhaps one reason why its
visitors felt secure in their explorations of new ideas. It was a
place in which the creator of the WANK worm could sculpt and hone his
creative computer skills.
The capital of this spirited new Australian electronic civilisation
was Melbourne. It is difficult to say why this southern city became
the cultural centre of the BBS world, and its darker side, the
Australian computer underground. Maybe the city's history as
Australia's intellectual centre created a breeding ground for the many
young people who built their systems with little more than curiosity
and salvaged computer bits discarded by others. Maybe Melbourne's
personality as a city of suburban homebodies and backyard tinkerers
produced a culture conducive to BBSes. Or maybe it was just
Melbourne's dreary beaches and often miserable weather. As one
Melbourne hacker explained it, `What else is there to do here all
winter but hibernate inside with your computer and modem?'
In 1988, Melbourne had some 60 to 100 operating BBSes. The numbers are
vague because it is difficult to count a collection of moving objects.
The amateur nature of the systems, often a jumbled tangle of wires and
second-hand electronics parts soldered together in someone's garage,
meant that the life of any one system was frequently as short as a
teenager's attention span. BBSes popped up, ran for two weeks, and
then vanished again.
Some of them operated only during certain hours, say between 10 p.m.
and 8 a.m. When the owner went to bed, he or she would plug the home
phone line into the BBS and leave it there until morning. Others ran
24 hours a day, but the busiest times were always at night.
Of course it wasn't just intellectual stimulation some users were
after. Visitors often sought identity as much as ideas. On an
electronic bulletin board, you could create a personality, mould it
into shape and make it your own. Age and appearance did not matter.
Technical aptitude did. Any spotty, gawky teenage boy could instantly
transform himself into a suave, graceful BBS character. The
transformation began with the choice of name. In real life, you might
be stuck with the name Elliot Dingle--an appellation chosen by your
mother to honour a long-dead great uncle. But on a BBS, well, you
could be Blade Runner, Ned Kelly or Mad Max. Small wonder that, given
the choice, many teenage boys chose to spend their time in the world
of the BBS.
Generally, once a user chose a handle, as the on-line names are known,
he stuck with it. All his electronic mail came to an account with that
name on it. Postings to bulletin boards were signed with it. Others
dwelling in the system world knew him by that name and no other. A
handle evolved into a name laden with innate meaning, though the
personality reflected in it might well have been an alter ego. And so
it was that characters like The Wizard, Conan and Iceman came to pass
their time on BBSes like the Crystal Palace, Megaworks, The Real
Connection and Electric Dreams.
What such visitors valued about the BBS varied greatly. Some wanted to
participate in its social life. They wanted to meet people like
themselves--bright but geeky or misanthropic people who shared an
interest in the finer technical points of computers. Many lived as
outcasts in real life, never quite making it into the `normal' groups
of friends at school or uni. Though some had started their first jobs,
they hadn't managed to shake the daggy awkwardness which pursued them
throughout their teen years. On the surface, they were just not the
sort of people one asked out to the pub for a cold one after the
footy.
But that was all right. In general, they weren't much interested in
footy anyway.
Each BBS had its own style. Some were completely legitimate, with
their wares--all legal goods--laid out in the open. Others, like The
Real Connection, had once housed Australia's earliest hackers but had
gone straight. They closed up the hacking parts of the board before
the first Commonwealth government hacking laws were enacted in June
1989. Perhaps ten or twelve of Melbourne's BBSes at the time had the
secret, smoky flavour of the computer underground. A handful of these
were invitation-only boards, places like Greyhawk and The Realm. You
couldn't simply ring up the board, create a new account and login. You
had to be invited by the board's owner. Members of the general
modeming public need not apply.
The two most important hubs in the Australian underground between 1987
and 1989 were named Pacific Island and Zen. A 23-year-old who called
himself Craig Bowen ran both systems from his bedroom.
Also known as Thunderbird1, Bowen started up Pacific Island in 1987
because he wanted a hub for hackers. The fledgling hacking community
was dispersed after AHUBBS, possibly Melbourne's earliest hacking
board, faded away. Bowen decided to create a home for it, a sort of
dark, womb-like cafe bar amid the bustle of the BBS bazaar where
Melbourne's hackers could gather and share information.
His bedroom was a simple, boyish place. Built-in cupboards, a bed, a
wallpaper design of vintage cars running across one side of the room.
A window overlooking the neighbours' leafy suburban yard. A collection
of PC magazines with titles like Nibble and Byte. A few volumes on
computer programming. VAX/VMS manuals. Not many books, but a handful
of science fiction works by Arthur C. Clarke. The Hitchhiker's Guide
to the Galaxy. A Chinese-language dictionary used during his high
school Mandarin classes, and after, as he continued to study the
language on his own while he held down his first job.
The Apple IIe, modem and telephone line rested on the drop-down
drawing table and fold-up card table at the foot of his bed. Bowen put
his TV next to the computer so he could sit in bed, watch TV and use
Pacific Island all at the same time. Later, when he started Zen, it
sat next to Pacific Island. It was the perfect set-up.
Pacific Island was hardly fancy by today's standards of Unix Internet
machines, but in 1987 it was an impressive computer. PI, pronounced
`pie' by the local users, had a 20 megabyte hard drive--gargantuan for
a personal computer at the time. Bowen spent about $5000 setting up PI
alone. He loved both systems and spent many hours each week nurturing
them.
There was no charge for computer accounts on PI or ZEN, like most
BBSes. This gentle-faced youth, a half-boy, half-man who would
eventually play host on his humble BBS to many of Australia's
cleverest computer and telephone hackers, could afford to pay for his
computers for two reasons: he lived at home with his mum and dad, and
he had a full-time job at Telecom--then the only domestic telephone
carrier in Australia.
PI had about 800 computer users, up to 200 of whom were `core' users
accessing the system regularly. PI had its own dedicated phone line,
separate from the house phone so Bowen's parents wouldn't get upset the
line was always tied up. Later, he put in four additional phone lines
for Zen, which had about 2000 users. Using his Telecom training, he
installed a number of non-standard, but legal, features to his
house. Junction boxes, master switches. Bowen's house was a
telecommunications hot-rod.
Bowen had decided early on that if he wanted to keep his job, he had
better not do anything illegal when it came to Telecom. However, the
Australian national telecommunications carrier was a handy source of
technical information. For example, he had an account on a Telecom
computer system--for work--from which he could learn about Telecom's
exchanges. But he never used that account for hacking. Most
respectable hackers followed a similar philosophy. Some had legitimate
university computer accounts for their courses, but they kept those
accounts clean. A basic rule of the underground, in the words of one
hacker, was `Don't foul your own nest'.
PI contained a public section and a private one. The public area was
like an old-time pub. Anyone could wander in, plop down at the bar and
start up a conversation with a group of locals. Just ring up the
system with your modem and type in your details--real name, your
chosen handle, phone number and other basic information.
Many BBS users gave false information in order to hide their true
identities, and many operators didn't really care. Bowen, however,
did. Running a hacker's board carried some risk, even before the
federal computer crime laws came into force. Pirated software was
illegal. Storing data copied from hacking adventures in foreign
computers might also be considered illegal. In an effort to exclude
police and media spies, Bowen tried to verify the personal details of
every user on PI by ringing them at home or work. Often he was
successful. Sometimes he wasn't.
The public section of PI housed discussion groups on the major PC
brands--IBM, Commodore, Amiga, Apple and Atari--next to the popular
Lonely Hearts group. Lonely Hearts had about twenty regulars, most of
whom agonised under the weight of pubescent hormonal changes. A boy
pining for the affections of the girl who dumped him or, worse, didn't
even know he existed. Teenagers who contemplated suicide. The messages
were completely anonymous, readers didn't even know the authors'
handles, and that anonymous setting allowed heart-felt messages and
genuine responses.
Zen was PI's sophisticated younger sister. Within two years of PI
making its debut, Bowen opened up Zen, one of the first Australian
BBSes with more than one telephone line. The main reason he set up Zen
was to stop his computer users from bothering him all the time. When
someone logged into PI, one of the first things he or she did was
request an on-line chat with the system operator. PI's Apple IIe was
such a basic machine by today's standards, Bowen couldn't multi-task
on it. He could not do anything with the machine, such as check his
own mail, while a visitor was logged into PI.
Zen was a watershed in the Australian BBS community. Zen multi-tasked.
Up to four people could ring up and login to the machine at any one
time, and Bowen could do his own thing while his users were on-line.
Better still, his users could talk request each other instead of
hassling him all the time. Having users on a multi-tasking machine
with multiple phone lines was like having a gaggle of children. For
the most part, they amused each other.
Mainstream and respectful of authority on the surface, Bowen possessed
the same streak of anti-establishment views harboured by many in the
underground. His choice of name for Zen underlined this. Zen came from
the futuristic British TV science fiction series `Blake 7', in which a
bunch of underfunded rebels attempted to overthrow an evil
totalitarian government. Zen was the computer on the rebels' ship. The
rebels banded together after meeting on a prison ship; they were all
being transported to a penal settlement on another planet. It was a
story people in the Australian underground could relate to. One of the
lead characters, a sort of heroic anti-hero, had been sentenced to
prison for computer hacking. His big mistake, he told fellow rebels,
was that he had relied on other people. He trusted them. He should
have worked alone.
Craig Bowen had no idea of how true that sentiment would ring in a
matter of months.
Bowen's place was a hub of current and future lights in the computer
underground. The Wizard. The Force. Powerspike. Phoenix. Electron.
Nom. Prime Suspect. Mendax. Train Trax. Some, such as Prime Suspect,
merely passed through, occasionally stopping in to check out the
action and greet friends. Others, such as Nom, were part of the
close-knit PI family. Nom helped Bowen set up PI. Like many early
members of the underground, they met through AUSOM, an Apple users'
society in Melbourne. Bowen wanted to run ASCII Express, a program
which allowed people to transfer files between their own computers and
PI. But, as usual, he and everyone he knew only had a pirated copy of
the program. No manuals. So Nom and Bowen spent one weekend picking
apart the program by themselves. They were each at home, on their own
machines, with copies. They sat on the phone for hours working through
how the program worked. They wrote their own manual for other people
in the underground suffering under the same lack of documentation.
Then they got it up and running on PI.
Making your way into the various groups in a BBS such as PI or Zen had
benefits besides hacking information. If you wanted to drop your
mantle of anonymity, you could join a pre-packaged, close-knit circle
of friends. For example, one clique of PI people were fanatical
followers of the film The Blues Brothers. Every Friday night, this
group dressed up in Blues Brothers costumes of a dark suit, white
shirt, narrow tie, Rayban sunglasses and, of course, the snap-brimmed
hat. One couple brought their child, dressed as a mini-Blues Brother.
The group of Friday night regulars made their way at 11.30 to
Northcote's Valhalla Theatre (now the Westgarth). Its grand but
slightly tatty vintage atmosphere lent itself to this alternative
culture flourishing in late-night revelries. Leaping up on stage
mid-film, the PI groupies sent up the actors in key scenes. It was a
fun and, as importantly, a cheap evening. The Valhalla staff admitted
regulars who were dressed in appropriate costume for free. The only
thing the groupies had to pay for was drinks at the intermission.
Occasionally, Bowen arranged gatherings of other young PI and Zen
users. Usually, the group met in downtown Melbourne, sometimes at the
City Square. The group was mostly boys, but sometimes a few girls
would show up. Bowen's sister, who used the handle Syn, hung around a
bit. She went out with a few hackers from the BBS scene. And she
wasn't the only one. It was a tight group which interchanged
boyfriends and girlfriends with considerable regularity. The group
hung out in the City Square after watching a movie, usually a horror
film. Nightmare 2. House 3. Titles tended to be a noun followed by a
numeral. Once, for a bit of lively variation, they went bowling and
drove the other people at the alley nuts. After the early
entertainment, it was down to McDonald's for a cheap burger. They
joked and laughed and threw gherkins against the restaurant's wall.
This was followed by more hanging around on the stone steps of the
City Square before catching the last bus or train home.
The social sections of PI and Zen were more successful than the
technical ones, but the private hacking section was even more
successful than the others. The hacking section was hidden; would-be
members of the Melbourne underground knew there was something going
on, but they couldn't find out what is was.
Getting an invite to the private area required hacking skill or
information, and usually a recommendation to Bowen from someone who
was already inside. Within the Inner Sanctum, as the private hacking
area was called, people could comfortably share information such as
opinions of new computer products, techniques for hacking, details of
companies which had set up new sites to hack and the latest rumours on
what the law enforcement agencies were up to.
The Inner Sanctum was not, however, the only private room. Two hacking
groups, Elite and H.A.C.K., guarded entry to their yet more exclusive
back rooms. Even if you managed to get entry to the Inner Sanctum, you
might not even know that H.A.C.K. or Elite existed. You might know
there was a place even more selective than your area, but exactly how
many layers of the onion stood between you and the most exclusive
section was anyone's guess. Almost every hacker interviewed for this
book described a vague sense of being somehow outside the innermost
circle. They knew it was there, but wasn't sure just what it was.
Bowen fielded occasional phone calls on his voice line from wanna-be
hackers trying to pry open the door to the Inner Sanctum. `I want
access to your pirate system,' the voice would whine.
`What pirate system? Who told you my system was a pirate system?'
Bowen sussed out how much the caller knew, and who had told him. Then
he denied everything.
To avoid these requests, Bowen had tried to hide his address, real
name and phone number from most of the people who used his BBSes. But
he wasn't completely successful. He had been surprised by the sudden
appearance one day of Masked Avenger on his doorstep. How Masked
Avenger actually found his address was a mystery. The two had chatted
in a friendly fashion on-line, but Bowen didn't give out his details.
Nothing could have prepared him for the little kid in the big crash
helmet standing by his bike in front of Bowen's house. `Hi!' he
squeaked. `I'm the Masked Avenger!'
Masked Avenger--a boy perhaps fifteen years old--was quite resourceful
to have found out Bowen's details. Bowen invited him in and showed him
the system. They became friends. But after that incident, Bowen
decided to tighten security around his personal details even more. He
began, in his own words, `moving toward full anonymity'. He invented
the name Craig Bowen, and everyone in the underground came to know him
by that name or his handle, Thunderbird1. He even opened a false bank
account in the name of Bowen for the periodic voluntary donations
users sent into PI. It was never a lot of money, mostly $5 or $10,
because students don't tend to have much money. He ploughed it all
back into PI.
People had lots of reasons for wanting to get into the Inner Sanctum.
Some wanted free copies of the latest software, usually pirated games
from the US. Others wanted to share information and ideas about ways
to break into computers, often those owned by local universities.
Still others wanted to learn about how to manipulate the telephone
system.
The private areas functioned like a royal court, populated by
aristocrats and courtiers with varying seniority, loyalties and
rivalries. The areas involved an intricate social order and respect
was the name of the game. If you wanted admission, you had to walk a
delicate line between showing your superiors that you possessed enough
valuable hacking information to be elite and not showing them so much
they would brand you a blabbermouth. A perfect bargaining chip was an
old password for Melbourne University's dial-out.
The university's dial-out was a valuable thing. A hacker could ring up
the university's computer, login as `modem' and the machine would drop
him into a modem which let him dial out again. He could then dial
anywhere in the world, and the university would foot the phone bill.
In the late 1980s, before the days of cheap, accessible Internet
connections, the university dial-out meant a hacker could access
anything from an underground BBS in Germany to a US military system in
Panama. The password put the world at his fingertips.
A hacker aspiring to move into PI's Inner Sanctum wouldn't give out
the current dial-out password in the public discussion areas. Most
likely, if he was low in the pecking order, he wouldn't have such
precious information. Even if he had managed to stumble across the
current password somehow, it was risky giving it out publicly. Every
wanna-be and his dog would start messing around with the university's
modem account. The system administrator would wise up and change the
password and the hacker would quickly lose his own access to the
university account. Worse, he would lose access for other hackers--the
kind of hackers who ran H.A.C.K., Elite and the Inner Sanctum. They
would be really cross. Hackers hate it when passwords on accounts they
consider their own are changed without warning. Even if the password
wasn't changed, the aspiring hacker would look like a guy who couldn't
keep a good secret.
Posting an old password, however, was quite a different matter. The
information was next to useless, so the hacker wouldn't be giving much
away. But just showing he had access to that sort of information
suggested he was somehow in the know. Other hackers might think he had
had the password when it was still valid. More importantly, by showing
off a known, expired password, the hacker hinted that he might just
have the current password. Voila! Instant respect.
Positioning oneself to win an invite into the Inner Sanctum was a game
of strategy; titillate but never go all the way. After a while,
someone on the inside would probably notice you and put in a word with
Bowen. Then you would get an invitation.
If you were seriously ambitious and wanted to get past the first inner
layer, you then had to start performing for real. You couldn't hide
behind the excuse that the public area might be monitored by the
authorities or was full of idiots who might abuse valuable hacking
information.
The hackers in the most elite area would judge you on how much
information you provided about breaking into computer or phone
systems. They also looked at the accuracy of the information. It was
easy getting out-of-date login names and passwords for a student
account on Monash University's computer system. Posting a valid
account for the New Zealand forestry department's VMS system intrigued
the people who counted considerably more.
The Great Rite of Passage from boy to man in the computer underground
was Minerva. OTC, Australia's then government-owned Overseas
Telecommunications Commission,3 ran Minerva, a system of three Prime
mainframes in Sydney. For hackers such as Mendax, breaking into
Minerva was the test.
Back in early 1988, Mendax was just beginning to explore the world of
hacking. He had managed to break through the barrier from public to
private section of PI, but it wasn't enough. To be recognised as
up-and-coming talent by the aristocracy of hackers such as The Force
and The Wizard, a hacker had to spend time inside the Minerva system.
Mendax set to work on breaking
into it.
Minerva was special for a number of reasons. Although it was in
Sydney, the phone number to its entry computer, called an X.25 pad,
was a free call. At the time Mendax lived in Emerald, a country town
on the outskirts of Melbourne. A call to most Melbourne numbers
incurred a long-distance charge, thus ruling out options such as the
Melbourne University dial-out for breaking into international computer
systems.
Emerald was hardly Emerald City. For a clever sixteen-year-old boy,
the place was dead boring. Mendax lived there with his mother; Emerald
was merely a stopping point, one of dozens, as his mother shuttled her
child around the continent trying to escape from a psychopathic former
de facto. The house was an emergency refuge for families on the run.
It was safe and so, for a time, Mendax and his exhausted family
stopped to rest before tearing off again in search of a new place to
hide.
Sometimes Mendax went to school. Often he didn't. The school system
didn't hold much interest for him. It didn't feed his mind the way
Minerva would. They Sydney computer system was a far more interesting
place to muck around in than the rural high school.
Minerva was a Prime computer, and Primes were in. Force, one of the
more respected hackers in 1987-88 in the Australian computer
underground, specialised in Primos, the special operating system used
on Prime computers. He wrote his own programs--potent hacking tools
which provided current usernames and passwords--and made the systems
fashionable in the computer underground.
Prime computers were big and expensive and no hacker could afford one,
so being able to access the speed and computational grunt of a system
like Minerva was valuable for running a hacker's own programs. For
example, a network scanner, a program which gathered the addresses of
computers on the X.25 network which would be targets for future
hacking adventures, ate up computing resources. But a huge machine
like Minerva could handle that sort of program with ease. Minerva also
allowed users to connect to other computer systems on the X.25 network
around the world. Better still, Minerva had a BASIC interpreter on it.
This allowed people to write programs in the BASIC programming
language--by far the most popular language at the time--and make them
run on Minerva. You didn't have to be a Primos fanatic, like Force, to
write and execute a program on the OTC computer. Minerva suited Mendax
very well.
The OTC system had other benefits. Most major Australian corporations
had accounts on the system. Breaking into an account requires a
username and password; find the username and you have solved half the
equation. Minerva account names were easy picking. Each one was
composed of three letters followed by three numbers, a system which
could have been difficult to crack except for the choice of those
letters and numbers. The first three letters were almost always
obvious acronyms for the company. For example, the ANZ Bank had
accounts named ANZ001, ANZ002 and ANZ002. The numbers followed the
same pattern for most companies. BHP001. CRA001. NAB001. Even OTC007.
Anyone with the IQ of a desk lamp could guess at least a few account
names on Minerva. Passwords were a bit tougher to come by, but Mendax
had some ideas for that. He was going to have a crack at social
engineering. Social engineering means smooth-talking someone in a
position of power into doing something for you. It always involved a
ruse of some sort.
Mendax decided he would social engineer a password out of one of
Minerva's users. He had downloaded a partial list of Minerva users
another PI hacker had generously posted for those talented enough to
make use of it. This list was maybe two years old, and incomplete, but
it contained 30-odd pages of Minerva account usernames, company names,
addresses, contact names and telephone and fax numbers. Some of them
would probably still be valid.
Mendax had a deep voice for his age; it would have been impossible to
even contemplate social engineering without it. Cracking adolescent
male voices were the kiss of death for would-be social engineers. But
even though he had the voice, he didn't have the office or the Sydney
phone number if the intended victim wanted a number to call back on.
He found a way to solve the Sydney phone number by poking around until
he dug up a number with Sydney's 02 area code which was permanently
engaged. One down, one to go.
Next problem: generate some realistic office background noise. He
could hardly call a company posing as an OTC official to cajole a
password when the only background noise was birds tweeting in the
fresh country air.
No, he needed the same background buzz as a crowded office in downtown
Sydney. Mendex had a tape recorder, so he could pre-record the sound
of an office and play it as background when he called companies on the
Minerva list. The only hurdle was finding the appropriate office
noise. Not even the local post office would offer a believable noise
level. With none easily accessible, he decided to make his own audible
office clutter. It wouldn't be easy. With a single track on his
recording device, he couldn't dub in sounds on top of each other: he
had to make all the noises simultaneously.
First, he turned on the TV news, down very low, so it just hummed in
the background. Then he set up a long document to print on his
Commodore MPS 801 printer. He removed the cover from the noisy dot
matrix machine, to create just the right volume of clackity-clack in
the background. Still, he needed something more. Operators' voices
mumbling across a crowded floor. He could mumble quietly to himself,
but he soon discovered his verbal skills had not developed to the
point of being able to stand in the middle of the room talking about
nothing to himself for a quarter of an hour. So he fished out his
volume of Shakespeare and started reading aloud. Loud enough to hear
voices, but not so loud that the intended victim would be able to pick
Macbeth. OTC operators had keyboards, so he began tapping randomly on
his. Occasionally, for a little variation, he walked up to the tape
recorder and asked a question--and then promptly answered it in
another voice. He stomped noisily away from the recorder again, across
the room, and then silently dove back to the keyboard for more
keyboard typing and mumblings of Macbeth.
It was exhausting. He figured the tape had to run for at least fifteen
minutes uninterrupted. It wouldn't look very realistic if the office
buzz suddenly went dead for three seconds at a time in the places
where he paused the tape to rest.
The tapes took a number of attempts. He would be halfway through,
racing through line after line of Shakespeare, rap-tap-tapping on his
keyboard and asking himself questions in authoritative voices when the
paper jammed in his printer. Damn. He had to start all over again.
Finally, after a tiring hour of auditory schizophrenia, he had the
perfect tape of office hubbub.
Mendax pulled out his partial list of Minerva users and began working
through the 30-odd pages. It was discouraging.
`The number you have dialled is not connected. Please check the number
before dialling again.'
Next number.
`Sorry, he is in a meeting at the moment. Can I have him return your
call?' Ah, no thanks.
Another try.
`That person is no longer working with our company. Can I refer you to
someone else?' Uhm, not really.
And another try.
Finally, success.
Mendax reached one of the contact names for a company in Perth. Valid
number, valid company, valid contact name. He cleared his throat to
deepen his voice even further and began.
`This is John Keller, an operator from OTC Minerva in Sydney. One of
our D090 hard drives has crashed. We've pulled across the data on the
back-up tape and we believe we have all your correct information. But
some of it might have been corrupted in the accident and we would just
like to confirm your details. Also the back-up tape is two days old,
so we want to check your information is up to date so your service is
not interrupted. Let me just dig out your details ...' Mendax shuffled
some papers around on the table top.
`Oh, dear. Yes. Let's check it,' the worried manager responded.
Mendax started reading all the information on the Minerva list
obtained from Pacific Island, except for one thing. He changed the fax
number slightly. It worked. The manager jumped right in.
`Oh, no. That's wrong. Our fax number is definitely wrong,' he said
and proceeded to give the correct number.
Mendax tried to sound concerned. `Hmm,' he told the manager. `We may
have bigger problems than we anticipated. Hmm.' He gave another
pregnant pause. Working up the courage to ask the Big Question.
It was hard to know who was sweating more, the fretting Perth manager,
tormented by the idea of loud staff complaints from all over the
company because the Minerva account was faulty, or the gangly kid
trying his hand at social engineering for the first time.
`Well,' Mendax began, trying to keep the sound of authority in his
voice. `Let's see. We have your account number, but we had better
check your password ... what was it?' An arrow shot from the bow.
It hit the target. `Yes, it's L-U-R-C-H--full stop.'
Lurch? Uhuh. An Addams Family fan.
`Can you make sure everything is working? We don't want our service
interrupted.' The Perth manager sounded quite anxious.
Mendax tapped away on the keyboard randomly and then paused. `Well, it
looks like everything is working just fine now,' he quickly reassured
him. Just fine.
`Oh, that's a relief!' the Perth manager exclaimed. `Thank you for
that. Thank you. I just can't thank you enough for calling us!' More
gratitude.
Mendax had to extract himself. This was getting embarrassing.
`Yes, well I'd better go now. More customers to call.' That should
work. The Perth manager wanted a contact telephone number, as
expected, if something went wrong--so Mendax gave him the one which
was permanently busy.
`Thank you again for your courteous service!' Uhuh. Anytime.
Mendax hung up and tried the toll-free Minerva number. The password
worked. He couldn't believe how easy it was to get in.
He had a quick look around, following the pattern of most hackers
breaking into a new machine. First thing to do was to check the
electronic mail of the `borrowed' account. Email often contains
valuable information. One company manager might send another
information about other account names, password changes or even phone
numbers to modems at the company itself. Then it was off to check the
directories available for anyone to read on the main system--another
good source of information. Final stop: Minerva's bulletin board of
news. This included postings from the system operators about planned
downtime or other service issues. He didn't stay long. The first visit
was usually mostly a bit of reconnaissance work.
Minerva had many uses. Most important among these was the fact that
Minerva gave hackers an entry point into various X.25 networks. X.25
is a type of computer communications network, much like the Unix-based
Internet or the VMS-based DECNET. It has different commands and
protocols, but the principle of an extensive worldwide data
communications network is the same. There is, however, one important
difference. The targets for hackers on the X.25 networks are often far
more interesting. For example, most banks are on X.25. Indeed, X.25
underpins many aspects of the world's financial markets. A number of
countries' classified military computer sites only run on X.25. It is
considered by many people to be more secure than the Internet or any
DECNET system.
Minerva allowed incoming callers to pass into the X.25
network--something most Australian universities did not offer at the
time. And Minerva let Australian callers do this without incurring a
long-distance telephone charge.
In the early days of Minerva, the OTC operators didn't seem to care
much about the hackers, probably because it seemed impossible to get
rid of them. The OTC operators managed the OTC X.25 exchange, which
was like a telephone exchange for the X.25 data network. This exchange
was the data gateway for Minerva and other systems connected to that
data network.
Australia's early hackers had it easy, until Michael Rosenberg
arrived.
Rosenberg, known on-line simply as MichaelR, decided to clean up
Minerva. An engineering graduate from Queensland University, Michael
moved to Sydney when he joined OTC at age 21. He was about the same
age as the hackers he was chasing off his system. Rosenberg didn't
work as an OTC operator, he managed the software which ran on Minerva.
And he made life hell for people like Force. Closing up security
holes, quietly noting accounts used by hackers and then killing those
accounts, Rosenberg almost single-handedly stamped out much of the
hacker activity in OTC's Minerva.
Despite this, the hackers--`my hackers' as he termed the regulars--had
a grudging respect for Rosenberg. Unlike anyone else at OTC, he was
their technical equal and, in a world where technical prowess was the
currency, Rosenberg was a wealthy young man.
He wanted to catch the hackers, but he didn't want to see them go to
prison. They were an annoyance, and he just wanted them out of his
system. Any line trace, however, had to go through Telecom, which was
at that time a separate body from OTC. Telecom, Rosenberg was told,
was difficult about these things because of strict privacy laws. So,
for the most part, he was left to deal with the hackers on his own.
Rosenberg could not secure his system completely since OTC didn't
dictate passwords to their customers. Their customers were usually
more concerned about employees being able to remember passwords easily
than worrying about warding off wily hackers. The result: the
passwords on a number of Minerva accounts were easy pickings.
The hackers and OTC waged a war from 1988 to 1990, and it was fought
in many ways.
Sometimes an OTC operator would break into a hacker's on-line session
demanding to know who was really using the account. Sometimes the
operators sent insulting messages to the hackers--and the hackers gave
it right back to them. They broke into the hacker's session with `Oh,
you idiots are at it again'. The operators couldn't keep the hackers
out, but they had other ways of getting even.
Electron, a Melbourne hacker and rising star in the Australian
underground, had been logging into a system in Germany via OTC's X.25
link. Using a VMS machine, a sort of sister system to Minerva, he had
been playing a game called Empire on the Altos system, a popular
hang-out for hackers. It was his first attempt at Empire, a complex
war game of strategy which attracted players from around the world.
They each had less than one hour per day to conquer regions while
keeping production units at a strategic level. The Melbourne hacker
had spent weeks building his position. He was in second place.
Then, one day, he logged into the game via Minerva and the German
system, and he couldn't believe what he saw on the screen in front of
him. His regions, his position in the game, all of it--weeks of
work--had been wiped out. An OTC operator had used an X.25
packet-sniffer to monitor the hacker's login and capture his password to
Empire. Instead of trading the usual insults, the operator had waited
for the hacker to logoff and then had hacked into the game and destroyed
the hacker's position.
Electron was furious. He had been so proud of his position in his very
first game. Still, wreaking havoc on the Minerva system in retribution
was out of the question. Despite the fact that they wasted weeks of
his work, Electron had no desire to damage their system. He considered
himself lucky to be able to use it as long as he did.
The anti-establishment attitudes nurtured in BBSes such as PI and Zen
fed on a love of the new and untried. There was no bitterness, just a
desire to throw off the mantle of the old and dive into the new.
Camaraderie grew from the exhilarating sense that the youth in this
particular time and place were constantly on the edge of big
discoveries. People were calling up computers with their modems and
experimenting. What did this key sequence do? What about that tone?
What would happen if ... It was the question which drove them to stay
up day and night, poking and prodding. These hackers didn't for the
most part do drugs. They didn't even drink that much, given their age.
All of that would have interfered with their burning desire to know,
would have dulled their sharp edge. The underground's
anti-establishment views were mostly directed at organisations which
seemed to block the way to the new frontier--organisations like
Telecom.
It was a powerful word. Say `Telecom' to a member of the computer
underground from that era and you will observe the most striking
reaction. Instant contempt sweeps across his face. There is a pause as
his lips curl into a noticeable sneer and he replies with complete
derision, `Telescum'. The underground hated Australia's national
telephone carrier with a passion equalled only to its love of
exploration. They felt that Telecom was backward and its staff had no
idea how to use their own telecommunications technology. Worst of all,
Telecom seemed to actively dislike BBSes.
Line noise interfered with one modem talking to another, and in the
eyes of the computer underground, Telecom was responsible for the line
noise. A hacker might be reading a message on PI, and there, in the
middle of some juicy technical titbit, would be a bit of crud--random
characters `2'28 v'1';D>nj4'--followed by the comment, `Line noise.
Damn Telescum! At their best as usual, I see'. Sometimes the line
noise was so bad it logged the hacker off, thus forcing him to spend
another 45 minutes attack dialling the BBS. The modems didn't have
error correction, and the faster the modem speed, the worse the impact
of line noise. Often it became a race to read mail and post messages
before Telecom's line noise logged the hacker off.
Rumours flew through the underground again and again that Telecom was
trying to bring in timed local calls. The volume of outrage was
deafening. The BBS community believed it really irked the national
carrier that people could spend an hour logged into a BBS for the cost
of one local phone call. Even more heinous, other rumours abounded
that Telecom had forced at least one BBS to limit each incoming call
to under half an hour. Hence Telecom's other nickname in the computer
underground: Teleprofit.
To the BBS community, Telecom's Protective Services Unit was the
enemy. They were the electronic police. The underground saw Protective
Services as `the enforcers'--an all-powerful government force which
could raid your house, tap your phone line and seize your computer
equipment at any time. The ultimate reason to hate Telecom.
There was such hatred of Telecom that people in the computer
underground routinely discussed ways of sabotaging the carrier. Some
people talked of sending 240 volts of electricity down the telephone
line--an act which would blow up bits of the telephone exchange along
with any line technicians who happened to be working on the cable at
the time. Telecom had protective fuses which stopped electrical surges
on the line, but BBS hackers had reportedly developed circuit plans
which would allow high-frequency voltages to bypass them. Other
members of the underground considered what sweet justice it would be
to set fire to all the cables outside a particular Telecom exchange
which had an easily accessible cable entrance duct.
It was against this backdrop that the underground began to shift into
phreaking. Phreaking is loosely defined as hacking the telephone
system. It is a very loose definition. Some people believe phreaking
includes stealing a credit card number and using it to make a
long-distance call for free. Purists shun this definition. To them,
using a stolen credit card is not phreaking, it is carding. They argue
that phreaking demands a reasonable level of technical skill and
involves manipulation of a telephone exchange. This manipulation may
manifest itself as using computers or electrical circuits to generate
special tones or modify the voltage of a phone line. The manipulation
changes how the telephone exchange views a particular telephone
line. The result: a free and hopefully untraceable call. The purist
hacker sees phreaking more as a way of eluding telephone traces than of
calling his or her friends around the world for free.
The first transition into phreaking and eventually carding happened
over a period of about six months in 1988. Early hackers on PI and Zen
relied primarily on dial-outs, like those at Melbourne University or
Telecom's Clayton office, to bounce around international computer
sites. They also used X.25 dial-outs in other countries--the US,
Sweden and Germany--to make another leap in their international
journeys.
Gradually, the people running these dial-out lines wised up. Dial-outs
started drying up. Passwords were changed. Facilities were cancelled.
But the hackers didn't want to give up access to overseas systems.
They'd had their first taste of international calling and they wanted
more. There was a big shiny electronic world to explore out there.
They began trying different methods of getting where they wanted to
go. And so the Melbourne underground moved into phreaking.
Phreakers swarmed to PABXes like bees to honey. A PABX, a private
automatic branch exchange, works like a mini-Telecom telephone
exchange. Using a PABX, the employee of a large company could dial
another employee in-house without incurring the cost of a local
telephone call. If the employee was, for example, staying in a hotel
out of town, the company might ask him to make all his calls through
the company's PABX to avoid paying extortionate hotel long-distance
rates. If the employee was in Brisbane on business, he could dial a
Brisbane number which might route him via the company's PABX to
Sydney. From there, he might dial out to Rome or London, and the
charge would be billed directly to the company. What worked for an
employee also worked for a phreaker.
A phreaker dialling into the PABX would generally need to either know
or guess the password allowing him to dial out again. Often, the
phreaker was greeted by an automated message asking for the employee's
telephone extension--which also served as the password. Well, that was
easy enough. The phreaker simply tried a series of numbers until he
found one which actually worked.
Occasionally, a PABX system didn't even have passwords. The managers
of the PABX figured that keeping the phone number secret was good
enough security. Sometimes phreakers made free calls out of PABXes
simply by exploited security flaws in a particular model or brand of
PABX. A series of specific key presses allowed the phreaker to get in
without knowing a password, an employee's name, or even the name of
the company for that matter.
As a fashionable pastime on BBSes, phreaking began to surpass hacking.
PI established a private phreaking section. For a while, it became
almost old hat to call yourself a hacker. Phreaking was forging the
path forward.
Somewhere in this transition, the Phreakers Five sprung to life. A
group of five hackers-turned-phreakers gathered in an exclusive group
on PI. Tales of their late-night podding adventures leaked into the
other areas of the BBS and made would-be phreakers green with
jealousy.
First, the phreakers would scout out a telephone pod--the grey steel,
rounded box perched nondescriptly on most streets. Ideally, the chosen
pod would be by a park or some other public area likely to be deserted
at night. Pods directly in front of suburban houses were a bit
risky--the house might contain a nosy little old lady with a penchant
for calling the local police if anything looked suspicious. And what
she would see, if she peered out from behind her lace curtains, was a
small tornado of action.
One of the five would leap from the van and open the pod with a key
begged, borrowed or stolen from a Telecom technician. The keys seemed
easy enough to obtain. The BBSes message boards were rife with gleeful
tales of valuable Telecom equipment, such as 500 metres of cable or a
pod key, procured off a visiting Telecom repairman either through
legitimate means or in exchange for a six-pack of beer.
The designated phreaker would poke inside the pod until he found
someone else's phone line. He'd strip back the cable, whack on a pair
of alligator clips and, if he wanted to make a voice call, run it to a
linesman's handset also borrowed, bought or stolen from Telecom. If he
wanted to call another computer instead of talking voice, he would
need to extend the phone line back to the phreakers' car. This is
where the 500 metres of Telecom cable came in handy. A long cable
meant the car, containing five anxious, whispering young men and a
veritable junkyard of equipment, would not have to sit next to the pod
for hours on end. That sort of scene might look a little suspicious to
a local resident out walking his or her dog late one night.
The phreaker ran the cable down the street and, if possible, around
the corner. He pulled it into the car and attached it to the waiting
computer modem. At least one of the five was proficient enough with
electronics hardware to have rigged up the computer and modem to the
car battery. The Phreaker's Five could now call any computer without
being traced or billed. The phone call charges would appear at the end
of a local resident's phone bill. Telecom did not itemise residential
telephone bills at the time. True, it was a major drama to zoom around
suburban streets in the middle of the night with computers, alligator
clips and battery adaptors in tow, but that didn't matter so much. In
fact, the thrill of such a cloak-and-dagger operation was as good as
the actual hacking itself. It was illicit. In the phreakers' own eyes,
it was clever. And therefore it was fun.
Craig Bowen didn't think much of the Phreakers Five's style of
phreaking. In fact, the whole growth of phreaking as a pastime
depressed him a bit. He believed it just didn't require the technical
skills of proper hacking. Hacking was, in his view, about the
exploration of a brave new world of computers. Phreaking was, well, a
bit beneath a good hacker. Somehow it demeaned the task at hand.
Still, he could see how in some cases it was necessary in order to
continue hacking. Most people in the underground developed some basic
skills in phreaking, though people like Bowen always viewed it more as
a means to an end--just a way of getting from computer A to computer
B, nothing more. Nonetheless, he allowed phreaking discussion areas in
the private sections of PI.
What he refused to allow was discussion areas around credit card
fraud. Carding was anathema to Bowen and he watched with alarm as some
members of the underground began to shift from phreaking into carding.
Like the transition into phreaking, the move into carding was a
logical progression. It occurred over a period of perhaps six months
in 1988 and was as obvious as a group of giggling schoolgirls.
Many phreakers saw it simply as another type of phreaking. In fact it
was a lot less hassle than manipulating some company's PABX. Instead,
you just call up an operator, give him some stranger's credit card
number to pay for the call, and you were on your way. Of course, the
credit cards had a broader range of uses than the PABXes. The advent
of carding meant you could telephone your friends in the US or UK and
have a long voice conference call with all of them
simultaneously--something which could be a lot tougher to arrange on a
PABX. There were other benefits. You could actually charge things with
that credit card. As in goods. Mail order goods.
One member of the underground who used the handle Ivan Trotsky,
allegedly ordered $50000 worth of goods, including a jet ski, from the
US on a stolen card, only to leave it sitting on the Australian docks.
The Customs guys don't tend to take stolen credit cards for duty
payments. In another instance, Trotsky was allegedly more successful.
A try-hard hacker who kept pictures of Karl Marx and Lenin taped to
the side of his computer terminal, Trotsky regularly spewed communist
doctrine across the underground. A self-contained paradox, he spent
his time attending Communist Party of Australia meetings and duck
shoots. According to one hacker, Trotsky's particular contribution to
the overthrow of the capitalist order was the arrangement of a
shipment of expensive modems from the US using stolen credit cards. He
was rumoured to have made a tidy profit by selling the modems in the
computer community for about $200 each. Apparently, being part of the
communist revolution gave him all sorts of ready-made
rationalisations. Membership has its advantages.
To Bowen, carding was little more than theft. Hacking may have been a
moral issue, but in early 1988 in Australia it was not yet much of a
legal one. Carding was by contrast both a moral and a legal issue.
Bowen recognised that some people viewed hacking as a type of
theft--stealing someone else's computer resources--but the argument
was ambiguous. What if no-one needed those resources at 2 a.m. on a
given night? It might be seen more as `borrowing' an under-used asset,
since the hacker had not permanently appropriated any property. Not so
for carding.
What made carding even less noble was that it required the technical
skill of a wind-up toy. Not only was it beneath most good hackers, it
attracted the wrong sort of people into the hacking scene. People who
had little or no respect for the early Australian underground's golden
rules of hacking: don't damage computer systems you break into
(including crashing them); don't change the information in those
systems (except for altering logs to cover your tracks); and share
information. For most early Australian hackers, visiting someone
else's system was a bit like visiting a national park. Leave it as you
find it.
While the cream seemed to rise to the top of the hacking hierarchy, it
was the scum that floated at the top of the carding community. Few
people in the underground typified this more completely than Blue
Thunder, who had been hanging around the outskirts of the Melbourne
underground since at least 1986. The senior hackers treated Blue
Blunder, as they sometimes called him, with great derision.
His entrance into the underground was as ignominious as that of a
debutante who, delicately descending the grand steps of the ballroom,
trips and tumbles head-first onto the dance floor. He picked a fight
with the grande doyenne of the Melbourne underground.
The Real Article occupied a special place in the underground. For
starters, The Real Article was a woman--perhaps the only female to
play a major role in the early Melbourne underground scene. Although
she didn't hack computers, she knew a lot about them. She ran The Real
Connection, a BBS frequented by many of the hackers who hung out on
PI. She wasn't somebody's sister wafting in and out of the picture in
search of a boyfriend. She was older. She was as good as married. She
had kids. She was a force to be reckoned with in the hacking
community.
Forthright and formidable, The Real Article commanded considerable
respect among the underground. A good indicator of this respect was the
fact that the members of H.A.C.K. had inducted her as an honorary member
of their exclusive club. Perhaps it was because she ran a popular
board. More likely it was because, for all their bluff and bluster, most
hackers were young men with the problems of young men. Being older and
wiser, The Real Article knew how to lend a sympathetic ear to those
problems. As a woman and a non-hacker, she was removed from the jumble
of male ego hierarchical problems associated with confiding in a
peer. She served as a sort of mother to the embryonic hacking community,
but she was young enough to avoid the judgmental pitfalls most parents
fall into with children.
The Real Article and Blue Thunder went into partnership running a BBS
in early 1986. Blue Thunder, then a high-school student, was desperate
to run a board, so she let him co-sysop the system. At first the
partnership worked. Blue Thunder used to bring his high-school essays
over for her to proofread and correct. But a short time into the
partnership, it went sour. The Real Article didn't like Blue Thunder's
approach to running a BBS, which appeared to her to be get information
from other hackers and then dump them. The specific strategy seemed to
be: get hackers to logon and store their valuable information on the
BBS, steal that information and then lock them out of their own
account. By locking them out, he was able to steal all the glory; he
could then claim the hacking secrets were his own. It was, in her
opinion, not only unsustainable, but quite immoral. She parted ways
with Blue Thunder and excommunicated him from her BBS.
Not long after, The Real Article started getting harassing phone calls
at 4 in the morning. The calls were relentless. Four a.m. on the dot,
every night. The voice at the other end of the line was computer
synthesised. This was followed by a picture of a machine-gun, printed
out on a cheap dot matrix printer in Commodore ASCII, delivered in her
letterbox. There was a threatening message attached which read
something like, `If you want the kids to stay alive, get them out of
the house'.
After that came the brick through the window. It landed in the back of
her TV. Then she woke up one morning to find her phone line dead.
Someone had opened the Telecom well in the nature strip across the
road and cut out a metre of cable. It meant the phone lines for the
entire street were down.
The Real Article tended to rise above the petty games that whining
adolescent boys with bruised egos could play, but this was too much.
She called in Telecom Protective Services, who put a last party
release on her phone line to trace the early-morning harassing calls.
She suspected Blue Thunder was involved, but nothing was ever proved.
Finally, the calls stopped. She voiced her suspicions to others in the
computer underground. Whatever shred of reputation Blue Chunder, as he
then became known for a time, had was soon decimated.
Since his own technical contributions were seen by his fellow BBS
users as limited, Blue Thunder would likely have faded into obscurity,
condemned to spend the rest of his time in the underground jumping
around the ankles of the aristocratic hackers. But the birth of
carding arrived at a fortuitous moment for him and he got into carding
in a big way, so big in fact that he soon got busted.
People in the underground recognised him as a liability, both because
of what many hackers saw as his loose morals and because he was
boastful of his activities. One key hacker said, `He seemed to relish
the idea of getting caught. He told people he worked for a credit
union and that he stole lots of credit card numbers. He sold
information, such as accounts on systems, for financial gain.' In
partnership with a carder, he also allegedly sent a bouquet of flowers
to the police fraud squad--and paid for it with a stolen credit card
number.
On 31 August 1988, Blue Thunder faced 22 charges in the Melbourne
Magistrates Court, where he managed to get most of the charges dropped
or amalgamated. He only ended up pleading guilty to five counts,
including deception and theft. The Real Article sat in the back of the
courtroom watching the proceedings. Blue Thunder must have been pretty
worried about what kind of sentence the magistrate would hand down
because she said he approached her during the lunch break and asked if
she would appear as a character witness for the defence. She looked
him straight in the eye and said, `I think you would prefer it if I
didn't'. He landed 200 hours of community service and an order to pay
$706 in costs.
Craig Bowen didn't like where the part of the underground typified by
Blue Thunder was headed. In his view, Chunder and Trotsky stood out as
bad apples in an otherwise healthy group, and they signalled an
unpleasant shift towards selling information. This was perhaps the
greatest taboo. It was dirty. It was seedy. It was the realm of
criminals, not explorers. The Australian computer underground had
started to lose some of its fresh-faced innocence.
Somewhere in the midst of all this, a new player entered the Melbourne
underground. His name was Stuart Gill, from a company called
Hackwatch.
Bowen met Stuart through Kevin Fitzgerald, a well-known local hacker
commentator who founded the Chisholm Institute of Technology's
Computer Abuse Research Bureau, which later became the Australian
Computer Abuse Research Bureau. After seeing a newspaper article
quoting Fitzgerald, Craig decided to ring up the man many members of
the underground considered to be a hacker-catcher. Why not? There were
no federal laws in Australia against hacking, so Bowen didn't feel
that nervous about it. Besides, he wanted to meet the enemy. No-one
from the Australian underground had ever done it before, and Bowen
decided it was high time. He wanted to set the record straight with
Fitzgerald, to let him know what hackers were really on about. They
began to talk periodically on the phone.
Along the way, Bowen met Stuart Gill who said that he was working with
Fitzgerald.4 Before long, Gill began visiting PI. Eventually, Bowen
visited Gill in person at the Mount Martha home he shared with his
elderly aunt and uncle. Stuart had all sorts of computer equipment
hooked up there, and a great number of boxes of papers in the garage.
`Oh, hello there, Paul,' Gill's ancient-looking uncle said when he saw
the twosome. As soon as the old man had tottered off, Gill pulled
Bowen aside confidentially.
`Don't worry about old Eric,' he said. `He lost it in the war. Today
he thinks I'm Paul, tomorrow it will be someone else.'
Bowen nodded, understanding.
There were many strange things about Stuart Gill, all of which seemed
to have a rational explanation, yet that explanation somehow never
quite answered the question in full.
Aged in his late thirties, he was much older and far more worldly than
Craig Bowen. He had very, very pale skin--so pasty it looked as though
he had never sat in the sun in his life.
Gill drew Bowen into the complex web of his life. Soon he told the
young hacker that he wasn't just running Hackwatch, he was also
involved in intelligence work. For the Australian Federal Police. For
ASIO. For the National Crime Authority. For the Victoria Police's
Bureau of Criminal Intelligence (BCI). He showed Bowen some secret
computer files and documents, but he made him sign a special form
first--a legal-looking document demanding non-disclosure based on some
sort of official secrets act.
Bowen was impressed. Why wouldn't he be? Gill's cloak-and-dagger world
looked like the perfect boy's own adventure. Even bigger and better
than hacking. He was a little strange, but that was part of the
allure.
Like the time they took a trip to Sale together around Christmas 1988.
Gill told Bowen he had to get out of town for a few days--certain
undesirable people were after him. He didn't drive, so could Craig
help him out? Sure, no problem. They had shared an inexpensive motel
room in Sale, paid for by Gill.
Being so close to Christmas, Stuart told Craig he had brought him two
presents. Craig opened the first--a John Travolta fitness book. When
Craig opened the second gift, he was a little stunned. It was a red
G-string for men. Craig didn't have a girlfriend at the time--perhaps
Stuart was trying to help him get one.
`Oh, ah, thanks,' Craig said, a bit confused.
`Glad you like it,' Stuart said. `Go on. Try it on.'
`Try it on?' Craig was now very confused.
`Yeah, mate, you know, to see if it fits. That's all.'
`Oh, um, right.'
Craig hesitated. He didn't want to seem rude. It was a weird request,
but never having been given a G-string before, he didn't know the
normal protocol. After all, when someone gives you a jumper, it's
normal for them to ask you to try it on, then and there, to see if it
fits.
Craig tried it on. Quickly.
`Yes, seems to fit,' Stuart said matter of factly, then turned away.
Craig felt relieved. He changed back into his clothing.
That night, and on many others during their trips or during Craig's
overnight visits to Stuart's uncle's house, Craig lay in bed wondering
about his secretive new friend.
Stuart was definitely a little weird, but he seemed to like women so
Craig figured he couldn't be interested in Craig that way. Stuart
bragged that he had a very close relationship with a female newspaper
reporter, and he always seemed to be chatting up the girl at the video
store.
Craig tried not to read too much into Stuart's odd behaviour, for the
young man was willing to forgive his friend's eccentricities just to
be part of the action. Soon Stuart asked Craig for access to
PI--unrestricted access.
The idea made Craig uncomfortable, but Stuart was so persuasive. How
would he be able to continue his vital intelligence work without
access to Victoria's most important hacking board? Besides, Stuart
Gill of Hackwatch wasn't after innocent-faced hackers like Craig
Bowen. In fact, he would protect Bowen when the police came down on
everyone. What Stuart really wanted was the carders--the fraudsters.
Craig didn't want to protect people like that, did he?
Craig found it a little odd, as usual, that Stuart seemed to be after
the carders, yet he had chummed up with Ivan Trotsky. Still, there
were no doubt secrets Stuart couldn't reveal--things he wasn't allowed
to explain because of his intelligence work.
Craig agreed.
What Craig couldn't have known as he pondered Stuart Gill from the
safety of his boyish bedroom was exactly how much innocence the
underground was still to lose. If he had foreseen the next few
years--the police raids, the Ombudsman's investigation, the stream of
newspaper articles and the court cases--Craig Bowen would, at that
very moment, probably have reached over and turned off his beloved PI
and Zen forever.
CHAPTER 3 -- The American Connection.
US forces give the nod; It's a setback for your country.
-- from `US Forces', 10, 9, 8, 7, 6, 5, 4, 3, 2, 1.
Force had a secret. The Parmaster wanted it.
Like most hackers, The Parmaster didn't just want the secret, he
needed it. He was in that peculiar state attained by real hackers
where they will do just about anything to obtain a certain piece of
information. He was obsessed.
Of course, it wasn't the first time The Parmaster craved a juicy piece
of information. Both he and Force knew all about infatuation. That's
how it worked with real hackers. They didn't just fancy a titbit here
and there. Once they knew information about a particular system was
available, that there was a hidden entrance, they chased it down
relentlessly. So that was exactly what Par was doing. Chasing Force
endlessly, until he got what he wanted.
It began innocently enough as idle conversation between two giants in
the computer underground in the first half of 1988. Force, the
well-known Australian hacker who ran the exclusive Realm BBS in
Melbourne, sat chatting with Par, the American master of X.25
networks, in Germany. Neither of them was physically in Germany, but
Altos was.
Altos Computer Systems in Hamburg ran a conference feature called
Altos Chat on one of its machines. You could call up from anywhere on
the X.25 data communications network, and the company's computer would
let you connect. Once connected, with a few brief keystrokes, the
German machine would drop you into a real-time, on-screen talk session
with anyone else who happened to be on-line. While the rest of the
company's computer system grunted and toiled with everyday labours,
this corner of the machine was reserved for live on-line chatting. For
free. It was like an early form of the Internet Relay Chat. The
company probably hadn't meant to become the world's most prestigious
hacker hang-out, but it soon ended up doing so.
Altos was the first significant international live chat channel, and
for most hackers it was an amazing thing. The good hackers had cruised
through lots of computer networks around the world. Sometimes they
bumped into one another on-line and exchanged the latest gossip.
Occasionally, they logged into overseas BBSes, where they posted
messages. But Altos was different. While underground BBSes had a
tendency to simply disappear one day, gone forever, Altos was always
there. It was live. Instantaneous communications with a dozen other
hackers from all sorts of exotic places. Italy. Canada. France.
England. Israel. The US. And all these people not only shared an
interest in computer networks but also a flagrant contempt for
authority of any type. Instant, real-time penpals--with attitude.
However, Altos was more exclusive than the average underground BBS.
Wanna-be hackers had trouble getting into it because of the way X.25
networks were billed. Some systems on the network took reverse-charge
connections--like a 1-800 number--and some, including Altos, didn't.
To get to Altos you needed a company's NUI (Network User Identifier),
which was like a calling card number for the X.25 network, used to
bill your time on-line. Or you had to have access to a system like
Minerva which automatically accepted billing for all the connections
made.
X.25 networks are different in various ways from the Internet, which
developed later. X.25 networks use different communication protocols
and, unlike the Internet at the user-level, they only use addresses
containing numbers not letters. Each packet of information travelling
over a data network needs to be encased in a particular type of
envelope. A `letter' sent across the X.25 network needs an X.25
`stamped' envelope, not an Internet `stamped' envelope.
The X.25 networks were controlled by a few very large players,
companies such as Telenet and Tymnet, while the modern Internet is, by
contrast, a fragmented collection of many small and medium-sized
sites.
Altos unified the international hacking world as nothing else had
done. In sharing information about their own countries' computers and
networks, hackers helped each other venture further and further
abroad. The Australians had gained quite a reputation on Altos. They
knew their stuff. More importantly, they possessed DEFCON, a program
which mapped out uncharted networks and scanned for accounts on
systems within them. Force wrote DEFCON based on a simple automatic
scanning program provided by his friend and mentor, Craig Bowen
(Thunderbird1).
Like the telephone system, the X.25 networks had a large number of
`phone numbers', called network user addresses (NUAs). Most were not
valid. They simply hadn't been assigned to anyone yet. To break into
computers on the network, you had to find them first, which meant
either hearing about a particular system from a fellow hacker or
scanning. Scanning--typing in one possible address after another--was
worse than looking for a needle in a haystack. 02624-589004-0004. Then
increasing the last digit by one on each attempt. 0005. 0006. 0007.
Until you hit a machine at the other end.
Back in 1987 or early 1988, Force had logged into Pacific Island for a
talk with Craig Bowen. Force bemoaned the tediousness of hand
scanning.
`Well, why the hell are you doing it manually?' Bowen responded. `You
should just use my program.' He then gave Force the source code for
his simple automated scanning program, along with instructions.
Force went through the program and decided it would serve as a good
launchpad for bigger things, but it had a major limitation. The
program could only handle one connection at a time, which meant it
could only scan one branch of a network at a time.
Less than three months later, Force had rewritten Bowen's program into
the far more powerful DEFCON, which became the jewel in the crown of
the Australian hackers' reputation. With DEFCON, a hacker could
automatically scan fifteen or twenty network addresses simultaneously.
He could command the computer to map out pieces of the Belgian,
British and Greek X.25 communications networks, looking for computers
hanging off the networks like buds at the tips of tree branches.
Conceptually, the difference was a little like using a basic PC, which
can only run one program at a time, as opposed to operating a more
sophisticated one where you can open many windows with different
programs running all at once. Even though you might only be working in
one window, say, writing a letter, the computer might be doing
calculations in a spreadsheet in another window in the background. You
can swap between
different functions, which are all running in the background
simultaneously.
While DEFCON was busy scanning, Force could do other things, such as
talk on Altos. He continued improving DEFCON, writing up to four more
versions of the program. Before long, DEFCON didn't just scan twenty
different connections at one time; it also automatically tried to
break into all the computers it found through those connections.
Though the program only tried basic default passwords, it had a fair
degree of success, since it could attack so many network addresses at
once. Further, new sites and mini-networks were being added so quickly
that security often fell by the wayside in the rush to join in. Since
the addresses were unpublished, companies often felt this obscurity
offered enough protection.
DEFCON produced lists of thousands of computer sites to raid. Force
would leave it scanning from a hacked Prime computer, and a day or two
later he would have an output file with 6000 addresses on different
networks. He perused the list and selected sites which caught his
attention. If his p
Showing first 200,000 characters. Full text: gutenberg.org/ebooks/4686