STAFFBOX

Editor and Publisher

Eric Corley 110

Office Manager

Production

Bobby Arwatt

Mike DeVoursney

Writers: John Drake, Paul Estev, Mr. French, Emmanuel

Goldstein, Chester Holmes, Lex Luthor, Phantom Phreaker,
Bill from RNOC, David Ruderman, Bernie S., Mike Salerno,
Silent Switchman, Mike Yuhas, and the usual anonymous
bunch.

Cartoonists: Dan Holder, Mike Marshall.

Reader: John Kew.
Editor Emeritus l::'H

260() ( I. \ S

()7/'J-385I )

1.1

l'lIl>li.lh,.d /"",,/Id, /" .!M)(II.II/( 'I",\(I III,

II('Iuit",!!. of S('taUh('1. \('\\ } or/..

. 7 .\/f<)lIg:- 11111l". .\'/Oll/'U. \

. \ (()lld (/a\.\ l'o.\llIgc 1'( nJllf

I'OS I :\1.\S I FI{: Scnd addrc" chanc, III _'f>()(). P.O. Bll'
Cllr1\nhl

i earl\

\1,ddk

hl,lIld. :\ i II'IS.1.{)752.

I'IX7. 2/l(XI I nl errr"c, In c

,uh'LT'rtrlln: I .S. and ('"nada

(hL'rL'a,

752.

S:=;

lIldl\ H.luaL

Back ",ue, ,l\,,!Iahk

1m

))

::, IS

corpurate

I'iX-l. I'IXS. I'iX/l al

IIl dl\ Idual.

::,-l() Cmrmalc.

2S per \ear. S.'U

pcr \car mer,ca, .

. \DDI{ESS .\1.1. SI8S(I{II'IH)' (OI{I{ES"O'DF'(F TO: _'IJII(J Suh,crrr1,"n Dcrt..

\llddk 1,lan,1.

HlI{

:\ i

UT I FI{S .\'D .\1{ 11<1.1-: Sl B'IISSIO'S.

.!/')(I(J

Oillee I 'Ill'

BBS

:: 2

I'.D. Bll' 752.

11'1).'-07)2.

) 1(1-/) 12(XI

BBS ::IIOSI :\i I 'i1-l-12)-4(1(1

I l " 1 :\ IJ{ \1

OIIICI I

ISI:\1 I \llIJJ{1 SS

'JI-l-2.Q-.'2hO

2NXud;I,\,I.1 I (I'

\J{I'.\:\I I \1>1 JJ{I SS. phl,',b,,,1 '2(X)\u nlll

Page 2

} 11733 .

December. 19117

260()

\\ I{I!

FlO:

.!()(I() I dnlllrall >crt..

P.O. Bn.' '1'1. \1Jddlc

Important News
A number oj circumstances have
Jorced

us

to make some changes in the

way 2600 is published. As oj /988, we

will become a quarterly publication
imtead oj a monthly publication.
We've been printing 2600 under the
"new "Jormat Jor a year now. And one
thing we can't help but notice is that it:5
Jrightfully expensive. We adopted this
Jormat so that we could pre'ent longer
articles and al'O become a little more
visible. And we have succeeded in both
oj these ambitions. Ilowever, if we were
to continue at this pace, we would run
out oj Junds entirely. The 5/5 we charge
Jor an individual subscription is actually
less than what it costs to produce one
issue Jor a year. This is why we charge
more to th(He that can afJord more,
namely corporations and large
organizations where the magazine is
passed around to many people. And this
is why we continue to 'ell back issues.
By providing alternate sources oj
income, we are able to continue to keep
the magazine going at a low cost.
By raising the price to cover the casts
oj printing, mailing, and running an
oJJice, we could easily put the magazine
out oj the reach oj mmt oj our
suh.5criben. We've seen publications
smaller and less inJormative than oun
with annual price' oj over $/OO! We
don't want to take that road.
By reducing the amount oj times we
publish during the year (at the same time
increasing the .5ize oj each issue slightly),
we can keep the price down, keep
ounelves out oj Jinancial problems, and
hopeJully give ourselves more time to
make each issue mean a little more.
Ihis bring' us to the time Jactor. We
put a !!,reat deal oj time into putfing out
the magazine. But 26()0 is more than just
a magazine. We're constantly tryin!!, to
educate the populace on the u\'es and
abus'es oj technolo!!.}'. We're told that a.\
a result oj our campaign to abolish the

touch tone fee in .Vew l'ork, a bill may

be introduc{ Ii in the slate le!!,islature
proposing just that. Our growing
bulletin board network will do much to
ensure Jreedom oj speech Jor all
computer users. A nd, oj coune, we want
to make sure that people see and hear
about this magazine and our
organization, either by getting maximwlI
exposure ill the media or by getting
international distribution. A t our
current Jren::ied pace, we just don't have
the time to adequate(v pursue these
goak At a more relaxed pace, we Jeel
we'll be better able to put out a quality
publication :lnd make it more
memorable overall.
Vatural/y, we don't expect everyone to
agree with our conc/us;oll.5. IJ you Jeel
strongly negative about this change or
about anything el5e, we'll certainly give
you a reJund Jor the balance oJ your
subscription We hope, though, that
you '/I stick. il out at least to the Jirst
issue oj our quarterly Jormat to see if we
live up to your expectatioll.5.
Our spring issue will be mailed on or
around ,Hareh 15, 1 988. Subsequent
mailing date\' are scheduled Jor June /5.
.\'eptember 15, and December 15. Your
expiration date will he adjusted in the
Jollowing manner: January, Fehruary,
and .Harch will end with the .5pring
is.\ue; April, ,\tay, and Jw;e-sununer;
Ju(v, A ugust, and Septemher-Jall; and
October, .Vovemher, and
December-1vinter.
A number oj subscribers have
complained about their issues arriving
late or sometimes not at all. It appean
we must become militant in convincing
the po.\'j

oJJice to

do their job. IJ you do

not get an issue within a week. oj when

we 'end it out, you should call us and
call your pm! oJJice. Usually it is the
post oJJic(' on the reeeilin!!. end thaI i.\ at
fault.
A ,\ alwajl.\. we welcome vour !('t'libuek
:
on what H e re doing. We h ope (hi,
('lianlte results ;n a betler publication
and a llronger Twenty Six Hundred.
2600

December, 19117

Page J

HACKING IBM'S

by Lex Luthor
and The Legion 01 H ackers
Command Interpretation Chart: The following
chart shows some VM/CMS commands with

t h e i r equi v alent UNI X a n d VA X /VM S

commands. This will allow those readers who are
familiar with other operating systems to quickly
reference the CMS counterparts.
VAXIVMS

NOIPL

QUERY NAMES onli.. _Iiltilll

DIRECTORY

wtIO
II

TYPE Iii.....

cat hilnlml

EDIT

M or v. or IX

SHOW USERS

.Il0<1l !olin "'"

VM/CMS

UNIX

INOCOMMAND 'NONE'

lISTFILE

or FILELIST
TYPE m...
Itypo 1m
XEOIT

m...

DELETE iii.

rlOllMl Ii.... ERASE

PHONE user

write user

TEll _ill

CI1IaI:ksI1Ih

Hrink

Control Y

I1J1IIIm

II10w cumnl dir.

lilt or viIW lila

&yIIIm MilOI'
..... hla

user c:ornnIIIIiaIion

u.. HX

Corresponding f ties
U.. lisI /1_

SYSUAFOAT

IETCIPASSWO USER DIRECT

MAILIXT

USR/MAlll

user

USERID NOTE ElodnInic

LOGIN.COM

.PROFILE

PROFILE EXEC U.. .. in

inlormltion

..ilhla

COIII1IMd lila

Local Commands:
Local commands are written for an individual
system, and customized to suit a facility's needs
(These commands are execs which are either not
available from IBM or are cheaper to write on
your own.) I will mention a few which may be
found on other systems, as these are rather
common.

In most cases, the only way to change a user's

password is by having the system operator or
someone with high privileges do it. This is one
reason why many passwords remain the same for
long periods of time. These programs allow users
to change their logon password (SYSPASS) ,
read access minidisk password (READPW), and
write access minidisk password (WRITEPW) .
You may find these or similar programs on some
systems.
Privileged Commands
As tar as I know, there is no command to
determine which privilege class the userid you
are using is. The only way to find out is to check
in the CP Directory. The tollowing are some
privileged commands and what privilege class is
needed to run them. From what I've seen, the
system keeps no records of tailed attempts at
running privileged commands. Successful uses of
these commands are most likely recorded, either
In a log or by sending a message to the system
console or both, especially when using FORCE.
FORCE userid (Class A)

This command will forcibly log off the userid

you specify. I really can see no reason other than
to be a total idiot for abusing this command.
D ISABLE raddr (Dr) all (Class A Dr B)

This command gives a little information about

any user that you specify who IS on the system.
This IS similar to the UNI X command "finger".

This is used to prevent specific terminals or all

terminals from logging onto the system. Again,
there is no real reason to use this or most other
privileged commands unless you want to be
kicked off of the machine. If you do DISABLE a
terminal, simply use EN A BLE to repair the
damage.

. W H O I S MAINT BACKU P MAILER B U B BA R ELAY

D ETACH raaladdr ( F ROM) whalaver (C lass B)

WHO I S

VMUTIL
U .. . d
MAINT
BACKUP
MAILER
6UBBA
RELAY
VMUTIL

N ...
SysIIm

M.i_ ACCIIIIftt

VM SysIIm I\autI nI R-V MlChi ..

BITNET 1m. Node M.il Procasilll MlChi..

Buillll B. __ P ........ I .. 1yII Exlroldillliro

BITNET 1_ Chit

fKility

VM Ut.lililion SlJtislics

WAR N ING userid (or) operator Dr all (Class A Dr B)

SYSPASS
REAOPW
WRITEPW
I'agl' ..

This is used to detach real devices from the

system. These can be terminals, printers, disk
packs, tape drives, etc. You must know the real
address of the device, and "whatever" can be the
system name, or a userid.

Decemhl'r. 19K7

16()()

VM/CMS-PART TWO
Waming will send a priority message to a user,
operator, or all users on the system. It will
interrupt anything they happen to be doing.
Obviously sending a msg to all users stating they
are BONEHEADS is not recommended.

.lISTF
NOTE

BUBBA
MISC
PROFILE

WHATEVER
EXEC

AI
AI
AO

Minidisks

A minidisk is a subdivision of consecutive

cylinders on a real DASD volume. The real DASD
device is the actual disk the information is stored
on. This can be compared to a hard drive for an
IBM PC. Before the drive can be used, it must be
formatted. Once formatted, it is divided up into
directories called minidisks. Minidisks are
measured in cylinders, which are the standard
memory storage units. There can be many
minidisks on a DASD. Associated with each CMS
disk, is a file directory, which contains an entry
for every CMS file on the disk. A minidisk can be
defined for R/W or R/O (read/write or read/only)
access. It can also be used for storage of files.
Each minidisk has a virtual address which can be
from 001 -5FF ( hexadecimal) in basic control
mode, and 001 -FFF in ECMODE (Extended
Control Mode).
CMS minidisks are commonly accessed by a
letter of the alphabet (A-Z). For example, let's
assume we are logged onto a VM/CMS system
under the userid of JOE. We want to see what
minidisks we have access to. We use the au ERY
SEARCH command to determine which disks we
are ATIACHed to.

FilBIype Description
DATA Data lor programs or simply TYPE-able text.
EXEC User written programs or IBM procedures
written in REXX.
HELP System HELP files.
HELPCMS System HElP files.
LANGUAGE One of the languages that the system
supports. such as ASSEMBLE. COBOL. FORTRAN.
JCL. REXX. PlI. SNOBALL. BINARY. etc.
LISTING Program source code listings
LOADLIB Loading library
MAClIB Macro library
MODULE
NETlOG

System commands
Contains a list of all files which have been

SENT to other users.

. Q SEARCH
JOEOOI
JOE002
CMSI90
CMSI9E

This is a list of files on the A disk. The first

column is the filename, the second is the filetype,
and the third is the filemode. Filenames can be
anything you specify. Filetypes can also be
anything you specify, but commonly follow a
pattem which tells what type of file it is.
Filemodes are comprised of a filemode letter
(A-Z) and a filemode number (0-6).
Filenames can contain the following
characters: A-Z, 0-9, $ , # , +, -, : .
Here is an explanation of common filetypes:

NOTE
191

192
190
19E

D
S

YIS

RIW

RIO
RIO
RIO

Each minidisk has a volume name, virtual

address, filemode, and access mode. The A disk
is the default. Most accounts you gain access
with will have an A disk with a virtual address of
1 91 . The S disk is the System disk. This contains
the files and programs for running the system.
The same goes for the Y disk. The D disk is
another disk used by JOE.
You can view what each of these directories
, contains by issuing the LlSTFILE command.

Similar to E-MAIL on othar systems. a nota

sent from another user.

SOURCE SOURCE code for various programs.
TEXT Text file. Probably used lor programs and
when TYPEd yields little.
TXTLIB Text library

WHATEVER A nonstandard filetype which will

problbly be somewhat descriptive of its contents.
XEDIT A file which was crated using the XEDIT
utility.

Both filenames and filetypes must not exceed

eight characters in length.
Filemodes

Filemode numbers are classified as tollows:

Filemode 0: There is little file security on
VM/CMS. This may be due to the fact tlla!
directory security is very good. A file with a mode
(cr '111 illued Oil lleXI paKe)
26UU

December, \987

I'age:;

HACKING IBM'S
7' of zero makes that file invisible to other users

;-

unless they have Read/Write access to that disk.

When you LIN K to someone's disk in Read/Only
. mode and get a directory listing, files with a
mode of 0 will not be listed.
=:...
Filemode 1 : This is the default fdemode. When
reading or writing files, you do not have to
specify this fdemode number (unless you want
to) since it will default to it
.:,
Filemode 2: This is basically the same as a
fdemode of 1 . It is mainly assigned to files which
are shared by users who link to a common diSk,
like the system disk.
Filamoda 3: Be careful when you see thesel
These are automatically erased after they have
been read. If a file with a mode of 3 is printed or
read it will be erased Blindly reading files
without paying attention to the filemode numbers
can shorten your stay on a system. The main
reason for this filemode is so the files or programs
that are unimportant or have one-time use can be
automatically deleted to keep disk space and
maintenance to a minimum.
F i lemoda 4: This is used for files that simulate
OS data sets. They are created by OS macros in
programs running in CMS. I have not found any
files with this filemode, so for the time being, you
should not be concemed with it.
Filamoda 5: This is basically the same as
fi lemode 1 . It is different in that it's used for
groups of files or programs. It makes it easier for
deleting a number of files that a user wants to
keep for a certain period of time. You could just
enter: ERASE
A5. N ow all files on the A disk
with a filemode of 5 will be deleted.
Filamoda 6: Files with this mode are re-written
back to disk in the same place which is called
"update-in-place". I have no idea why this would
be specified, and have not found any files with a
filemode of 6.
F i lamode 7-9: These are reserved for IBM use.
Access i ng Information
Looking back at our Q SEARCH listing, let's

..:-

In this case, the D disk only contains one file

called N OTMUCH with a filetype of ON HERE.
But do not forget the fact that you only have
Read/Only access to the D minidisk! So there
may or may not be merely one file on the D disk.
Remember all filemodes of 0 (which in this case
would be DO) are invisible to anyone who does
not possess Read/Write access.
Y ou can access any disk that you are
A TI ACHed to by replacing the 0 in the above
example with the filemode letter (A-Z) you want
to access. As was shown previously, the QUERY
SEARCH command will give you a list of
minidisks that your userid is attached to upon
logging in. These command statements are
usually found in your PROFILE EXEC.
So you can access a few minidisks. There may
be hundreds on the system. Unlike UN IX and
VMS, and most other operating systems for that
matter. you cannot issue a command and some
wiIdcard characters to view the contents of every
user's directory. In order to access another users'
directory (minidisk) you must have the following
1 ) The USERID of the person whose disk you
wish to acce!;s; 2) The virtual address(es) (CUU)
that the USERID owns; 3) The Read, Write, or
Multi disk access password. depending on which
access mode you wish to use.
This would be accomplished by the following:
.LlNK TO BU BBA 19 1 AS 555 RR
Entar READ link password:
*************************
HHHHHHHHHHHHHHHHHHHHHHHHH
SSSSSSSSSSSSSSSSSSSSSSSSS
.RBUBBA
R; 1=0.01/0.111 21:58:48
.ACCESS 555 B
R; 1=0.01/0.01 21:59;03
.0 SEARCH

see what is on the D disk:

.LlSTF * * 0
N01MUCH ONHERE 01

Page 6

December, 1987

2600

JOEOOI
BUBOOI
JOE002

191

CMS190

190

CMS19E

19E

555
192

A
B
o
S
Y/S

RIW
RIO
RIO
RIO
RIO

VM/CMS-PART TWO
.LlSTF * * 8
MISCFILE
P R O FILE

OATA
EXEC

81
81

.REl555
R: T= 0 0 1 / 0 0 1 22 0 2 0 1

N ow an explanat ion of the events which have

just occurred.
The L I N K command is used to access other
users' m l n i d isks. The format is
.Ll N K ITO ) USER I O VAD D R I lAS) VAD D R 2 IM ODE)
IIPASS= )pASSWORD)

B U B BA is the U S E R I D whose disk we w ish to

access . VADDR1 IS a v irtual address which
belongs to the B U BBA usend . If B U BBA was to
access our m i n i d isk whose userid is JO E , he
cou ld access either our 19 1 address or our 19 2
address . The 19 0 and 19E addresses are usually
au tomat i cally accessed by nearly a l l the users of
the syst em s i nce i t contains system commands.
We are assum i n g that B U B B A i ndeed has a
m i n l d isk w i th the v irt ual address of 19 1 Some
usend's may not have any or they may have
addresses w h i ch are somewhat obscure , say of
13A or 5 03. The only way we wou ld be able to
access those assum ing B U BBA d i d not g ive them
to us would be to guess them This wou!,d be
rather difficu l t, li me-consum ing !lild dangerous
as we w i l l soon see
V A D D R 2 is any address whi ch is not clliTemly
I n our contro l ( i . e . , I I I our 0 S earch which would
be 19 0 , 19 1, 192, 19E) and is i n the range of 001
to 5 F F i n Basic Contro l or F F F III Extended
Contro l . In this example , we chose to use 555.
We could have eas i ly used 1 0 4, 33F , 5FA , etc.
M O D E is the access mode which consists of up
to 2 let t ers . The f irst letter spec i f i es the pnmary
access mode . The second le tter is opt ional and
designates the a lternate access mode . If the
pnmary mode IS not ava i l able , the alternate IS
used
The access mode we used was RR Val id
access modes are
R: Pnmary Read /Only access This IS the
default . You can opt to not spec i fy an access
mode when linking to a user's diSk , and t h is i s the

mode w h ich IS used. it w i l l only work If n o other

l inks are In effect.
RR: This allows read access no maller what
l inks are i n effect to that user's d i sk
W: Primary Write access. This is only good i f
no other l i nks are i n effect.
WR: If Write is ava i l ab l e then ttle link w i l l be
made. If not it w i l l gG La Read.
M: Primary Multiple access.
MR: Resorts to Re<:d if M u l t i is unavailab le.
MW: This guarantees write access 110 matter
what.
I f another user has write access to one of your
disks when you log on your access will be forced
to R ead/On ly. For thL; reason , you should have
read access to other disks i nstead of write. If you
w ish to see what f i l es have a f i lernode of zero,
then l ink w i t h write access, view, or access those
f i les, then R E L EA S E the d i sk and re access it v i a
read t o avo i d suspi c i o n by Hldl us er o f
unaut h or ized i n d i v i dlElls g a i n i n g wri t e access to
his f i l es .
I f a user has write access to a disk, you cannot
gain write access unless you use a mode of MW.
I t is not recommenderl to have write access to
another's d isk if they themselves have write
access. C M S cannot guarantee the Integnty of
the data on a d i sk w h i ch has mom tilan one
person l inked to i t w ith w,ile access Now!f you
see that the u ser is in a d!sronnected (DSC) state
t h r o u g h t h e 0 N AMES rom manrl th e n I t
shouldn't b e 3 problem i f you also have write
access s i nce the person is not act Ive. I f that
person reconnects, however, then it i s adv isable
to R E L EA S E that d isk as soon as possible to
avo i d any chance of d"ta being destroyed.
PASS=PASSWORD. Like the logon p assword , It
can be a 1-8 character string that must match the
access mode passworrl for the VADD R1 of the
userid which you are attemptin g to gain access
t o . U p to three access mode passwords can ex ist
for each m l n i d isk-R, W, and M.
I f the i n st a l l a tio n uses t h e Password
Suppression Faci l i ty, ail I N VALI D F O R M AT
message w i l l be issued when YOII dttempt to
enter the passworrl for a d isk on tll(; ':lle line
t h at the LINK C0r11m a nd w a s entered on
O bVIOu s l y t h i S I S t o p re v e n t peop le f, om
"spoof i ng" the password oil the screen or frn;!l
pri n touts found i n the tr,'sh. I f this occurs, Ilist nit
2600

December. 1987

Page 7

:::'

'
':2

the telecom informer

I \()u\e ,uddenl" iOlgotten hO\\ to

Ihe

it

11l1'" ,II Suuth\\c,\ern Bell h<l\c a

Ildlllh

" ..'11

Associalion 01 I-aidax, Virginia havc

endllr'.cd thi, ncw scrvicc .... Police hope

lthtOll1 t-.IIlill!c !edttHe" the

tecnage computer

"\I hi/kid"

arre,[ed

tor thell and interceptlllg computer data

ICC lIn you. It\ a 'peel:.d

Illtc'II(tl\e !lulllhn that gives you

in Burlington, ('anada will help them

IIlI()lllllllillil 1)[1 hOI\ to ll',e certain

katllll" I"pll'" I lor clil w;utlllg into, 2

cntire provillce of Untand. Ihc

I"i ,Iili IUI\\,lIcilllg. etc."). lhe !lumher

II1\L"tlgatjdn started

i i,-fl,' i-,"q'i. Kcep 111 nllJl(L though,

thill

lli'll

lIClI lllh tOI lhing cu,tOlll calling

i1

\Ideo pirate

[ucili ,til til 111'

diC'Nd

ill

IOl,:!

,[;[11<111 ,'!1

til

tile'!

()ICrpO\ICl a

111Il'l"()II;lIC

\ ltll" thl' t

.tpLllll

II

ill

ill' CiIU.:.:iIt h,'Cdll'l' apparcntl" thl'rl'

ill) 1l.
. 1i \\,l i)! tLI-'liil Ul'il all actioll.

C'\c'1
1.\

nthl'l tllilll h;l\Ing

1(l

,'\n,

111Ie',e,. \\"l' hllrc

Iti-.c

'llllll'

lllil Iil",

itill'<ld .. \ I,\: I ,lllll Indlil!liI Bel! hilll'

Illlk,',1 I"l,'c"
11.111(1

I hC11

to .... lIlih,lt

Illn dhtillln'

11,'11 ,,'1\ ICC. c alled

thc

j{"\l'llll" I'l"lL"LlI<III S\\i,'1ll (tillc,n't t h ill

".'lIlId il" ,I !III,h,tcl tCrlll.') 11I1(l\"

111!c'IC\cll,lllgl'
!

ill ill' 1),11 [I'll

ldllll'l' tIl ,h,lrc

(111

Ill'! II( Ilk 11l1'U'C

ill](1

cledll hl,((lIIL'\. (dIIlCI' \\tli he ilhlc to

Ilh!:1111 dat,l 1111 ,'liI" tll illH! Ir,lnl

P;lItiLlJ!al 1H1I!lhl'!' til tlacc tlaud nlllrc

lil,lh. l'illtlllPdtlllg l(lllg cll,tillllT
l'Oll1pilllll"

1111I,t Iced thclr ncdlt

IIIIIllllliltl'lll Illlll

the diltaha,e nn\

1I1(lllth. I kpClldll\ lin thcll Illlll

1IL'l11"1 1.,', till''''

C(lIllj1illllC'

clnlld thcn

dl'l'l .... ', till'

.... .... ic!ll

dn'Il.li.

1'1 11,1lL" Itill' 11 lib, 'licil a, thc

\111,'1.

''i

h lhlll ;lll.t1o!2-linL',

1',Iei-,e( \llltliIl'll 'lt\\\llk

111,,' 1"lk'.I1 tilL' 11,lll(l11,i1

( Ul1!1Hirlll'ttlOlh I LJllti ( \)[llrdl

I kn'mlll'r, I <iX 7

!600

lL'lcpl](lllL tab could rClch S I (),()()O hllt

III

\1 ill

thc courh. I'lllicc ,aid

thc \ol/th Ilil' w,ing il ha'il' CUlllputer, a

(ol11llwdorc (>4, to Incilj., thrllugh
"ophl,tIt'a ted ,ccllrit\'1 ,tUll'>. I he tccn"
rcc'ortis ,IHl\\cd lile other computer

",tem,

thrcc belonging to Illultl

national Cllrporatlolh In Southern

hl' ;lhle t(l :et Ill(\IC 'pc'Cilll'

Inlllllll;ltlllll. It jl)(If"

hulletln hoard,," hc ,ald. I hl' I lila I

,cck rcstitutlon

\ ll dl l l g h t 'pcctallc.

pc'uple- h"It,,'lc' thl' hilildit

"lie \lao, u,lI1g our Cl)IllputCl

Wl'stinghlllhc ha'Il't del'ldcd it it

link,

tlie 1',',11 lrll "III)(illlg thl'lr path.

I!<>i !!Ltlil

\\ urld.

,\,tcm to lhC othn com[1l1tu, ilnd

to 110v; it \\d\

d,)[,,:. \1""t Id lh,'cc' 'lTIll tIl agln tklt

It', Ildll,Ji"1.hl\ I.'ih\

thc C()lllpa Il\. A Wcstinghollsc

i!llHlIlg cUI1lj1utn hackn, alound thc

l'lll' Fl .... 1UIL'\, \Vc\l' heard

illd,,- 1.11 thl'O!ll'"

S 1,000 in long-dl,tallcc computer calb to

"ull,elfi,h ", pa",ing thc cntlv code

diI !ercnt nighh,

\1.[\. 11"ddll"111l gcar and

:ll,t, li!!__: dt:\\

,t:,

Ull

Ilamiitoll police that illl outsider had

'pOke'lllilll ,aid the youth \la,

',(lllH'illl\\ ,IIUPU\lCIL'd thl' 'Igndb ot

t \\ \ 1

Oetoher when

Lxdlill1bC (PH'\) and hilled Illore than

\\c' prohahlv all heard

'1l11ietllln" !lhout thl' "Max Headroom"

Il lll d e n t III (hleagu

III

Wcstinghouse Canada complained to

hroken into their Privatc Branch

katllTc, \,11\ Illlm L'Ilinpany tn

l\"npilll\

hust a hacker !lctwork that spall, the

Onti\110

\Ierc clltL'lcd hut c n III lila I

cilargc, wercn't lilld hccau,c thc

L"lllllpanlc, \Inl'n't awarl' of thc
Illtru'lons. ..11'1 ha, an!luullccd that Ih
l(lng dl,t;lncc unit, l'S. Iran,mi"lo!l
S\,klm 11K. (l SIS),

II ill

drop thc

surchargc lUI "9)11" c;i11s placcd h\

,'u,tll!lln,

II ith

II I Giliing cards.

\lllLIitll\ all illng dlstancc carner,

chargc sllb,LTlhn, a Icc to :tcce" "Y)()"

,ell ICC,. I'IC\ IOllsl\, liT card cu'-,toillers
paid a )()-ccnt ,ml'hargc lor cach call
plaecd over the I l'I
llet\lork ... BcIISollth

\1 ill

hc the tir,t

Rcgional Bcll ()peratlllg ("oillpam to tr\

(lilt \I hat PIllillIse, to hc

it

,lgllJlicallt

1ll'\1 "T\ICl' kn()\\11 ii' the 111lL"lllgelll

'c'tllllik. I ill, Ilct l\ o l k 11111 hl ahle to
hilildk;1 \arict\ III ta,k, h\ Illtcrilctlng

\Iith

Ii

tclllllJ1 (It Belkoll'-dclclopcd

'PCClilll/L'li diltilha'l" .. \cL"llldlng to C'O

.\fagaIII[" the I ntelligent :\ctwork will

lami!) tie, pol itical attitude"

IInprme Bell Operating Company

i m olvel1lent in illegal activities,

(HOC)

equipment elficiencie, in the

lice m, iIH !,

handing ott of X()() cu s tomers to

c' on , p mption

patterns, and

oecup at'io m 01 Arab reside nts of the

interexchange carners, enhance

Wcst Bank and (JaiL\. It is particularl)

intere x e hange c O l n petition, and cnable

dangerous , the report says, because the

cu,tomer;, to easily change their

110rmal braeli I,IWS and checks and

interexchange carriers without changing

their X(}O numbers. What this means is
that cu,tomer;, won't have

to

halanees governing the usc of databases

do l1llt apply tu the occupied tcrritorie,.

change

By pressing a key on a computer

their X(}O numbcrs if they decide to

tcrminaL any braeli official working in

,witch long distance companies, Call

the occupie

handling willllllt bc limitcd to switches.

gain acccss to hts of names of those

d te rritorie s

will be able to

Calb \\ill hc handlcd hj' the rcmotely

Arabs who arc "positive" and those who

located datahase and distrihutcd

are "hostile". I [lis informa tion could be

thnlllghout thc network .... Hritish

used to decide lhe late of their

lelecom is markcting as part of ib

applica tion, for anything from car

"advanced bw,mcss systems" a product

licenses to travel documents.

kllll\\n a;, QWER I Yphonc. It's a desk

t,)P terminal

\1

ith alphanumeric,

I ullction and te l c phone number kcys

plu , lour-linc LCD. It's being
dellHH1strated as a low-{;ost computer

OS'UNY

and s pe ech terminal. Ihcy abo arc

pro m oti ng I.iK lOR, a higlHccurity
data cneryption unit that protcct, data

2600 BBS #1

agamst ea v esdroppers, providc, user

authcnt ieation , and offers a simplified

ke\'

m a na gem e nt

,ystel11. And of course,

thnc\ SkyplhlllC, c na h lin g travclers to

kecp in touch while thcy'rc in t hc ,ky
\Iith thc rc,t of us d ll\l n here on the

gr<\lll1d. All pa id lor by credit cani. of

cour,e. I'llpular features

on

ne\\ British

24 hours a day with a wide

range of information on computers,
telepholles, and hackitl;:;.

,4 vailable

CALI. l'()DA Y!
914-725-4060

le!ccom phone s : tcn l1urr,!,cr memory,

;,ecrecy bu t t o n , last-numbe,' rc:dial :JIld

dual , i g naling, plus

onc

huttol

a"c's, I'l

network and PBX L.h.:ilitle:-. . . . . brac! i,

creating a cOlllputeri71:d database \Iith

wide range of personal information

about Arab res id en b of the West Ba nk
and GalLi Strip. Accordmg to a report
by the \Vest Bank Data Base Project, a
widely respected lsral'li research in,titutc
monitOring developments

III

the

occupied terrilnrtcs, the new hrdcli

M inls(n of Defense datahase
tll

:t!ll(\lil''''

'\.:om!1uter<; .'d clfrot-an<i-,ti':f

operation" and

;1

potenli.d "hig b',ltner"

for the \\et B"nk and Ciani Str!p. I he

c()mputcr. \\lrieh b e ga n operating
the ,ummeL

IS

THE CENTRAL OFFICE

A full range of telephone.
radio, com p uter . and satellite

info plus

whole lot more!

2600 BOS #2

914-234-3260

,lilT

b e ing programmed with

lI1formati()n un property. real estate,

26(jIJ

December, \987

all about BL V
Verification and emergency interrupts are two
operator functions that have always fascinated
the pho ne phreak wor l d. Here then is an
explanation of just how it all really works. (Note:
this article is written solely on the A T& T TSPS
process of verification.)

Let's say Smith needs to get ahold of his

friend, Jones. Jones' telephone line is busy, and
Smith must talk to Jones immediately. He calls
the operator, by dialing 00 for an AT&T TSPS
Operator ( or in some areas, 0 still gets TSPS).
The operator answers, and asks if she can help
him. Smith replies that he needs to Interrupt a
call in progress so he can get through. He tells the
operator Jones' number. After a few seconds, he
is connected to Jones and they talk.
The name for this process is Busy Line
Verification, or BLV. BLV is the telco tenn for
this process, but it has been called "Verification",
"Autoverify", "Emergency Interrupt", "Break into
a line", "REMOB", and others. BLV is the result
of a TSPS that uses a Stored Program Control
System ( SPCS) called the Generic 9 program.
Before the rise of TSPS In 1969, cordboard
operators did the verification process. The
introduction of BLV via TSPS brought about
more operator security features. The Generic 9
SPCS and hardware was first installed in Tucson,
Daytona, and Columbus, Ohio in 1 979. By now
virtually every TSPS has the Generic 9 program.
A TSPS operator does the actual verification.
If Jones was in the 314 Area code and Smith was
in the 815 Area code, Smith would dial 00 to
reach a TSPS that served him. Now, Smith, the
customer, would tell the operator he needed an
emergency interrupt on a given number,
31 4+555+12 1 2. The 815 TSPS operator who
answered Smith's call cannot do the interrupt
outside of her own area code, ( her service area),
so she would call an Inward Operator for Jones'
area code, 314, with KP+314+TIC+121+ST,
where TIC is an optional Tenninating Toll Center
code that is necessary in some areas. Now a
TSPS operator in the 314 area code would
receive the 81 5 TSPS operator's call, but a lamp
on the 314 operator's console would tell iler she
was being reached with an Inward routing. The
815 operator then would say something along the
lines of she needed an interrupt on
Page 1 0

December, 1987

2600

31 4+555+1 212, and her customer's name was

J. Smith. The 31 4 Inward ( which is really a
TSPS) would then dial Jones' number, in a
nonnal Direct Distance Dialing ( DOD) fashion.
( DOD by an operator is really called 00 0 0, for
Operator Direct Distance Dialing.) If the line was
not busy, then the 31 4 Inward would report this
to the 81 5 TSPS, who wou Id then report to the
customer ( Smith) that 314+555+1 21 2 was not
busy and he could call as nonna!. However, if the
given number ( in this case, 314+555+1 21 2 ) was
busy, then the process of an Emergency Interrupt
would begin.
The 31 4 Inward would seize a verification
trunk ( or BLV trunk) to the toll office that served
the local loop of the requested number
( 555+1 21 2 ) . A feature of the TSPS checks the
line asked to be verified against a list of lines that
should not be verified, such as radio station
call-in lines, police station lines, etc. If the line
number a customer gives is on this software list.
then the verification cannot be done, and the
operator notifies the customer. The 31 4 Inward
would then press her VFY ( VeriFY) key on her
TSPS console, and the equipment would
outpulse ( onto the BLV trunk )
KP+OXX+N XX+ XXXX+ST. The KP signal
prepares the trunk to accept MF tones, the OXX
is a "screening code" to protect against trunk
mismatching, the NXX is the exchange or prefix
of the requested number ( 555), the XXXX is the
last four digits of the requested number ( 1 212 ) ,
and the S T i s the STart signal which tells the
verification trunk that no more MF digits follow.
The screening code is there to keep a nonnal Toll
Network ( used in regular calls) trunk from
accidentally connecting to a verification trunk. If
this screening code wasn't present, and a trunk
mismatch did occur, someone calling a friend in
the same area code might just happen to be
connected to his friend's line, and find himself in
the middle of a conversation. But the verification
trunk is waiting for an OXX sequence, and a
nonnal call on a Toll Network trunk does not
outpulse an OXX first. ( Example: You live at
9 1 4 + 5 5 5 + 1 0 00 a n d w i s h t o c a l l
91 4+666+0000. The routing for your call would
be KP+666+0000+ST. The BLV trunk cannot
accept a 666 in place of the proper OXX routing,

busy line verification

and thus wou l d give the cal ler a re-order t one. )

aclivates an a l e rtll19 tone t hat

A l so, n o t e that the outpu l sing sequence onto a

the ca l led customer evelY 10 seconds. rhls tone

can

be tleJrd by

BLV trunk cannot contain an area code. This is

tells the c ustorner that an operdtor

the reason why if 'J customer requests an

S o m e are a s d o n t h a v e t h e a l e rti n g t Oile.

interru p t outside of his own N PA, the TSPS

however Now, the o per ato r wouln say 'Is tillS

IS

o n the Ilile.

operator rnust cal l an I nward for the area code

N XX-XXXX?" where N XX-XXXX would be t he

that can outp u l se onto the proper t ru n k . If a

prefix and suffix oj the number that the

TSPS in 8 1 5 tned to do an IIl terru p t on a t ru n k in

c ust o m e r request r n g tile I n t e r r u pt g a ve t h e

3 1 4, it wou l d not work. ThiS p roves that there IS

orig i n al TSPS. T h e customer wo u ld COnll1lT1 the

01 iglnal

a BLV netwo rk for each NPA. and If you

operator had the correct line. Then the operator

somehow g ained access to a BL V tru nk, you

wou l d say ,

cou l d o n l y use it f o r interru p t s within the N PA

( cu s t orner Ilarne ) Wil l you acce p t ? " This gives

that the trunk was l ocated In.

the customer the cI ,ance to say 'yes" and let the

BLV t runks "hu nf to fin d the correct t ru n ks to

the right C l ass 5 end office that serves the given

prevIous p a rty vI'u.l l d b e d i s conn ect ed . I f the

'You have

cal l w<1ltlng from

calling party be c'lIlllected to hll11, while the

local loop . The same outp u l slng sequence is

called customer says "no'. then the uperator tel l s

passed a l o ng BLV trunk; u n t i l the t runk serving

t h e person WllO requested the internlpt that the

tile to l l otfrce that serves the given elld office is

cal led custornel wo(ilci 110t accept Thr O[,eralOr

can Just Infon11 the lJusy ,.!.lrty tlia: ,00neo'le

found
There

IS

usually 0118 BLV t ru n k per 10,000

lines ( exchan ge) So. if a t o l l office selved tell

Ileeded to contact !'II1"

ler, and ildve Imnliler

or

[1allQ up. and then Intlfy the requestlllg CUSt(lIner

cen t l al offices, t h at to l l office wou l d have ten

that the 1IIIe IS free. Jr, the operator can connect

BLV trunks rUllillng frolll

tile ca lling party aillJ the Intem!ptp,d party

(l

TSPS site to that to!1

Withou t loss of cOllllectlOri

office.

Scrambling the Audio

The o pe r at o r ( Ill uSing the VFY key) can hear
what IS going on on tile Illle ( modern, VOice , or t1
dial tone, I ndicating a phone off-hook). iJut In a
scram b l ed state

If a customer lequested

an

line WIHlIil hiS [10lile NPA

()rlyina! ;::mswerinJ

'i '" tii,

SPS Clper .:tur V/OL:ll1 d tr,:

entire \"/f;(:flcat;ur: p:(H:r;,(;c;

T' ';C;.'-){;t

The ctl:lrges ;:,1 '!ll

A speech scramllier Circuit

Interrupt u,JOn a

(HPi\i.

(;f; i'

:bH
"/ area Clt

wlthlll the operator console generates a scrt1mb!r,

least) rllil $100

on the line whi l e the operator IS do!:,] a VFY Tilt:

Inte'Tjpt

s c rarn b le IS there to keep opelator:, ;rol1ll:steI11Ilg

Thel e IS an 80 cellt char c , : you ,b t: I llperator

l'lr

phone I.'ai:

1,K':I,j tiie
'ill

YJU

ell!'

a:,'

:\1

f/ :hrrlligh

In on peop l e , but It is not enough to keer' Hl

to verify w hetlier the pholle YOllre tryli1(j to reach

operator frorn being abl e to tel l if a converSdr,Of:

'"

modem sig n a l , or a dia l tone IS present upon the

of aCOllVersatlofl II tilt !11!el,asnocollversatlon

line If the operator hears a dial tone. she can

011

busy because of

it, there Wil l be

,I 'iCN IiY

nu

P'OIJ!eI11 or because

charqe for the venflcatioll

The Aftermath
Wilen t1e CUSlOrner w h o IIl l tlated the
phone IS off-hook, or there is a pro b l em with the
line, and she can't do anything about it. ThiS emergency I n t err u p t gets hiS tel ephone bil l , the

o n l y report back to the custorner t h a t either the

speech scram b ling fea t u re IS located in t h e TSPS

charges fur the Iflterrupt cal l wi!1 l ook similar to

conso l e, and not on verification trunks . I n the

thiS

case of Jones and S rnlth , the 314 Inward wou l d

te l l the 815 TSPS, and the 8 1 5 TSPS wou l d t e l l
t h e custorner. I f there IS a convelsation o n lille,
the operator presses

key marked EMER INl

(EMERgency INTerru p t ) on Iler conso l e

c a u s es the operator to be added !ilto

ThiS

three way

12-1

530P

INTERRUPT C'-

3 1 45551212

00

1.00

The121 is Decer1.iJer Filet of 'tHe CUllcnt vear. 5:30P :s the tllne 'ile Cdl: WdS InC.(j,' to the .::
opelator requesting an !I:\errupl IN TtRRUPT CI
'.?
IS whdt took p l! ce , t h at I". illi II1t81111pt (i!! 314

port orl the busy ililP The EMER I N r key a lso

5551212 IS tile number Ihiuested OC,ta!l(;"

deactiv ates the sp eech SCI amb ling clleull ana

Operator dSslsted, Daytlr!lc rill

26tH)

the 1

IS

i,;,

tiw

Page II

D ECEMB E R 'S
I f y o u h a v e a p e n r e g i s t e r o n yo u r l i n e ,

Switch -Hoole Dialing

S t r a n g e t h lll g s h a v e b e e n h a p pe n lll g

D e a r 2600 :

o n m y I lI1 e , a n d I w a s w o n d e r i n g i f

A f t e r r E c e n t l y [ f'Cl ci i n g s o m e o l d

t c x t f ! l f s

s W i t c h h o o k d i a l i n g , I ' ve

on

there
l ill e

IS

IS

a n y s u re w a y o f t e l l i n g i f yo u r

b e l ll g m o n i t o r e d o r t a pped by

hee n t rV l n q t o pract ice my speed .

good old Ma

SW l l c h - 1 10 0 k d l a i l lHJ c o m e s I n h i m d y

s u g g e s t i o n s wo u l d b e a pp r e c i a ted .

Bel l .

w l l ( n y o u j l l s ! I w p p e ll t o be a t a p h o n e

l l ) a t i l Cl S

Any help or

N o rm a n Bates

d i d ! lock o r some other

First o ff, we ha ve two b u lletin boards

d e v i c e r e ,; t r I C ! 1 1 1 l d i a l i n g . I c a n now
sW l t e l l h o o i' d i d l 0 11 a l m o s t a n y p h o n e

3260 a n d q U i t e a fe w o thers tha t h a ve

h il t w l l t! l ) i tr Y t u d o I t o n a p a y p h o n e , I t
h imi l y

w or k s p r o p e r l y

PVt"

b u lle t lfl b o a r ds . We W i ll a n n o u n c e

JS

their n umbers when the tim e comes.

S o m e p e op le c la im t h e y can t e ll

D a l l a s , TX

when there 's a pen register on their

We s r e r n

I/lle hy h ea li ng s trange c licks or tones.

/1 I g T / ) , 1 Y / J h n f ) e h a s il
" ,v i l e !.: I f ) I I The wa y ti l lS

In S or l l t! cases tIl l S m a y very we ll b e

, t ( l) IlonA

t / 1' (' (

fi e

f l lt.' f e u r ,;

work s

IS

d / !yli'

In

:. VI I I' I l [ h i ' I i n u k

S Wi t ch IS

,1 1 .I f )

sl I l , / 11 h <l // flf lIIercury ro lls

!lO W ! ! of l lo I Vii l (.' l l n / d O s If y o u were 1 0

!

expressed interest in be comllJg 2600

Why I S

tl)IS}

Ti

on line at 9 1 4 - 725 -4060 a n d 9 1 4 - 234 -

af l l , lly riC' 1!! e s s f li t .' ,c'- lv/ l c h h o ok {) n

fhl ,P,' ! ()l l I '

11 " u l / /d t a k e Iltne for Ihe

h a ll (I t m e n ' { H Y I ( )

n il hack a n d for t h

t r U f.' b u t c e r t a l f ) l y n o t in a ll.
e x a mp le , s o m e o n e c o u ld p l ug

For
In

RadiO Shack pen register a n y where on

y o u r Ime a n d it w o u ld n o t make an y

strange n O ises o ver ti le phone.

The

phone compan y I ts e lf I S one of the

easier culprtts to track do wn. If the y

! i l l l S 1/I ,' [ i I ! h ! l Il J ' h I' f l l l l l n g o f y o u r

have

di d / l i l Y

can o ft e n fm d (J u t h y h e fr ie n dl n g

!I i /! l i l l i e I I ta k e s fO f t h e

I I l t ' f C {If Y l u 1 /) <1 1: "

h e /unij
Ih a /I I I !] d

ilt 'W

pen register o n your Ime, you

iJ l t!aA (' un til c t C iJ n

s o m e o n e I n t h e s W l t c h r o o rn . I t ' s a

I u d/lfl e d r thil t you are

(/" j l t vVh y , /0 / Ja Y p h o n e s

a c q u a ! f ) tances you h a v e there whe ther

Of

h a v e t l i e s /? m e rC U f Y S Vi l l c h e s In t h e

firs t ( i /ill l: ) liVe

tl l tT tend til h I'
W i lY

,(s b e c a use

d S S l1 n )f'
! I Iore

du ra b le B y the

t h e IJI's t Wil Y t o rie fe a t

(J

(ha l lu c k

S i mp le

matter

o f a s k in g

any

or n o t there IS s o m e th ing s trange

a t t a ch e d to y o u r Im e. Wh en t h e phone
compan y does I f lega ll y, the y 're o ften

IS

r e q U ired t o t e ll y o u a t some pOin t. The

t o ,'.' Imp lv c a r r y ,) t o u ch ( o n e pa d (also

harder culprtts are those tha t are dO ing

I t o u t S i de t h e la w wh e r e t h e

k n o vv f )

as , /

iJ u x ')

' " wi l l i e

posslblltties are a lm o s t endless. A s

Pen Regis ters

m i c r o w a v e a n d s a t e l l i t e h a c k in g

D e a r 2600 :
I was wonde r i ng

If

I t wou l d be

p O S S i b l e f n r y o u t o h a v e a I l sl l 1l g o f a l l
t h e 2 6 00 s u p p o r t B B S s a r o u n d t h e
c o u n t r y ! I f u r (m e w o u l d b e e x t r e m e l y

I n t f r p s tp d , d l 1 rl i n l

S L i fe

otiw r s o u t t h e f t' i : k (;

i\ i s o . Ill y s e h o u l
pen

0 1.1

r p l l s t f r

t h e r e d r e m a ny

Ine

11as

'

reg u l at i on

a l l t h P l f i lil e s . I

'

il m

c u r r P I1 t l v t r V m q t o (J d l l l a n y i n f o r m a t i o n

f r o rn 1 1 1 1 1 d t I

call

k n ow 1 f t I ii, I , ;
P a gt. 1 2

B u t for

I S a Il Y

11 0 W ,

n eed

to

w a y of d e t e r lTl l ll l n q

261W

becomes more commonp lace, it 's likely

t h a t p a s s i v e e a v e s dr opp ing W i l l
in crease. Smce no direct contact With a
p a r t i c u l a r lin e I S n e c e s s a r y, t h is
m e th o d is comp le t e ly untraceable. A n d
n a turally, you won ' l hear an y t e llt a le
cltck s on your Im e

Evil Happ enings

Dea r 2600 :
T h e r e rea l l y I S a b i g "brot h e r " . They

a re

the

C F R.

a nd

t h e T r i l a tera l

LEITE R S
A v e n u e,

B r o a d w a y; S o h o Z a t . 3 0 7 W e s )

sy stem C o m p u te r s w i l l p l a y a key r o l e .
T h i s i s w h y t h e c r a c kdown o n h a c k i n g

Broadwa y, Hudson Ne ws -Kiosk, 753

a n d b i l l boa rds I S o n .

Spring Street. Papyrus Books, 29 1 5

P a i a J o nes

C o l is e u m B o o k s ,

' 77 I

C o m m i s s i o n . T h e i r g o a l a o n e wo r l d
gove r n m e n t a n d a o n e wo r l d m o n ey

1 69

Broadwa y, Spring Street Books,

Broadwa y; St. Mark 's B o okshop,

13

St. Mark Street; Shakespeare Books,

2259

B r o a d w a y,

B.

D a lto n 's

B o o k s e llers, 3 9 6 6 t h A ve n u e, a n d
College Stationery, 295 1 Broadwa y

The Truth Revealed

Dear

2600 :

W h a t ' s t h e d i ff e r e n c e betwee n B o x
99 a n d Box 7 5 2 7

C hesh i re Cata lyst

Besides being on separate ends of
the post o ffice with 652 other boxe:,
b e t we e n t h e m,

t h e r e is a v e r

fundamental difference: Box 752

IS

to:

subscription mformation and Box 99

I.)

for editoria l sU/Jmissions and let ters

You p la yed it safe by sending your
le tter to b o th boxes. This is a reply to
t h e le t t e r s e n t to the p r op e r b o x ,
Thanks for this in teresting bit o f
ne ws

Canadian Ques tions

D e a r 2600 :
I t h i n k y o u h a ve a g r e a t m a g . I s t h e r e
a

store t h a t I c a n g o t o ever ' rn o n t h t o

b u y yo u r m a g I n Ca n a d a I D o Y O ll k n o'N
a

C a n a d i a n a d d ress w h e r e I c a n g e t

h a c k i n g softw a r e f o r t h e C o m m od o r e
64 o r a n I B M c l o n e ? I wou l d l i ke bot h ,
most l i ke l y com m u n i cation a n d
d e p rotect l o n u t l l I t i e s .

namely B o x 99

The o ther le tter

sent to the wro/'g box and. as

was

res ult.

was rippe d to sl 'reds "lnd b urned.

Ingenious SOlution
Dear

2600 :

I m a y h a ve fo u nd t h e so l u t i o n to t h e
prob lem

of n o t be i n g a b l e t o sto r e

i s s u e s of 2 6 00 s i n c e you we n t to t h e
" bo o k l e t " fo r m a t . I f you t a k e a p l a s t i c
d i s k ette h o l d e r s u c h a s t h e o n e s p r e
p u n c h e d to f i t i n to t h e s m a l l 3 - r i n g
noteboo k s , y o u w i l l see t h a t 2600 I S

PG
Toronto

J u st a l i tt l e t o o b i g to f i t i n S i d e t h e

any dis trib u tor in

Canada s o you word find us in a n y

H oweve r , t a k e a b l ow d ryer a n d h e a t
t h e p l a s t i c i n s e r t . W h e n i t I S fa i r l y

st ores. A s far as soft ware, since w e

wa r m , g r a b e a c h s i d e a nd stretch t h e

We don 't ha ve

pocket d e s i g n e d for

the d i s kett e .

really don 't handle t h a t k ind of thing w e

i n s e r t ! N ow, 2 600 w i l l f i t n e a t l y i n S i de

suggest puttlfJg a free ad

t h e pocket a n d c a n be put in the 3 - r i n g

t h e 2600

M a rk e tp la c e or a s k i n g a r o u n d on

noteboo k . A w h o l e yea r w i l l f i t n i ce l y

bulletin boards.

6 p l a s t i c i n se r t s a nd n ow the notebook

in

Speaking of stores, here are the ones

ca n be p l a ce d in y o u r books h e l f a l o n g

yo u can fin d us in in Ne w York City:

w i t h you r ot h e r c l a s s i c books ! T h e s e

A pos trophes Books, 660 A msterdam

(mil I illued (ill paKe 1 ())

2600

December. 1987

P age U

H ACKIN G IBM' S

(COI ll iI /lied I W i l l paK' 7)

return after entering the access mode, and wait
for the enter password response .
Every disk password along w i t h every user's
p assword and other information is contai ned in
the CP D i rectory . If the password is "ALL" then a
password is not req u i red for any user so you w d l
n o t b e asked f o r one. Y o u w i l l t hen receive a
ready message i nd icat i ng that the t ransaction
has just been completed .
I f you receive the message: B U B BA 19 1 ' N OT
L I N K E D ; N O R E A D PA S SWO R D " , t hen w i t h i n
the C P D i rectory , there IS no read password at a l l .
T h i s means that the only way you can gain
access to B U B BA's d i rectory wou ld be by get t ing
his logon password . One note- I bel i eve that a
u ser's logon password cannot be any of h i s
access mode passwords . T h e reasons f o r this are
obvious. If B U B BA wants J O E to access a d i sk ,
then h e can g ive J O E the corresponding d i sk
password . I f t h i s was ident ical to h i s l ogon
password then J O E cou ld logon as BUBBA and
access a l l o f B UBBA 's d i sks w i t h no prob l em ,
a n d at t h e same t ime possess a l l of t h e privs that
B U B BA has . W i t h i n the CP d i rec t o ry , I f t here IS
no password en t ry for read access then there are
no entries for write or m u l t i I f there is no en t ry for
w r i t e then t here may or may 110t be an ently for
read , but def i n i tely not one for m u l t i . And f i n a l l y ,
i f t here is no e n t ry f o r mu l t i then there may or
may not be entries for read and w r i t e
The m e t h o d s for o b t a i n i n g d i s k a c c e s s
passwords are the same a s anything else.
C o m m o n sense and " P a s s w o r d P s y c h o l o g y "
come IIltO accoun t along w i t h t h e elemen t o f
l uck .
Assume the userid is VMTEST and you are
hack ing the R E A D password . Passwords may be :
RVMTEST, RVM , RTEST , RTESTV M . O t hers
may be R EA D , R EADVM , VMREA D ,
R EA D T E S T , T E S T R EA D , and even V M T E S T . O f
course i t cou l d b e someth ing l ike J 2 *ZS. M any
t imes the same p assword w i l l be used for R , W ,
a n d M a c c e s s I n s t e a d o f t h ree s e p a r a t e
passwords.
C P keeps t rack of unsuccess f u l LI N K attempts
due to inva l i d p asswords . When you exceed the
m a x i m u m n u m b e r of I n c o r r e c t p a s s w o r d
a t tempts, w h i c h usua l l y defau l t s to 1 0 , t h e l i nk
command W i l l be disabled for t h e rema i nder o f
"

Page 1

Decem ber. 1 9117

261)0

your stay on the system . A l l you have to do is

re- Iogon and you w i l l have fu l l use o f L I N K aga i n .
I f t he L O G O N / A U T O L O G / L I N K jou m a l i ng
fac i l ity is act ivated , unsuccessfu l l ink attempts
due to the above are recorded . When the
thresho ld is reached the userid whose password
you are trying to hack i s sen t a message.
Therefore , keep t rack o f the number of attempts
you make and keep just short of the system
threshold
A fter successfully l inking to a user's d i sk , you
must issue the ACC E S S command in order to get
a d i rectory l isting or access any f i l es on that d isk .
Th i s is accom p l ished by
.ACCESS VAD D R 2 B

V A D D R2 IS the address after ' A S " in you r l i n k

cornrna.ld l ine, a n d "B" is t h e I demode letter
w h ich you wish to access the disk as . T h i s can be
any t h i n g but the let ters which you have a l ready
ass igned up to a total of 26 ( A - Z )
A I t e r access ing t h e d i sk to your heart's
con t en t , you can then R E L EA S E it. When you
l o g o f l , the d i s k I S a u t o m a t i c a l l y re l e a se d .
Releasing the disk is n o t necessary u n l ess you
al ready are a t t ached to 26 m i n ldisks, and you
want to access more. You wou ld then release
whatever d isks you wish and l i nk to access
ot hers . A f t er releasulg a d isk , t o re- access it you
do not have to issue anot her l i n k command but
mere l y the ACCess command and what f i lemode
you W ish it t o be .
The Q U E R Y D A S D command w i l l l is t the
m i n i d i sks t ha t most everyone on the system has
access to. A l l of t h ese may or may not be
automat i c a l l y accessed upon logon For this
reaso n , you shou ld i ssue i t . Then a l l you have to
do is ACCess the v i rt ual address and def ine the
f i lemode.

.0 DASD
3 2 Cn

DASD

1 90

3380

S Y S R ES

RIO

DASD

191

3380

SYS R ES

R IW

1 cn

DASo

1 92

3380

S Y S R ES

RIO

2 Cn

DASD
DASD

1 93

3380
3380

S Y S R ES

1 94

S YS R ES

RIO
RIO

1 9 Cn
2 1 cn

DASD

1 9E

3380

S Y S R ES

RIO

27 cn

VM/CMS-PART TWO
I n o u r Q S E A R C H l is t , w e have access to 19 0 M D l S K : C hange access mode, change. add , or
as the system d isk , 19 1 as our A d i s k , 19 2 as our delete p asswords .
D d isk , 19 E as the system's Y d i sk . Both 19 3 and L I N K : C ause an automa t i c l i n k . at logon , to
19 4 are access i b l e but have not been accessed another user's m l n i d i sk .
F O R : Enter a D I R M a i n t command lor another user
by us. Thus:
i l authorized .
Things You Want

.ACC 1 93 B

B ( 1 93 ) R IO

N ow the 19 3 disk is our B d i sk and accessible

by us. We can perfonn the same proced u re lor the
19 4 disk .
D l R MAINT

The D i rectory M a i n tenance u t i l i ty can be

f o u n d on s o m e s y s t em s . I I it is r u n n i n g .
D I R M A I N T shou l d b e a v a l i d user i d . The
D I RM A I N T userid is automat ically i n i t i al ized
when the system i s started u p . It remains i n
" d i sconnected" mode awa i t i n g t ransact i o n s
which con t a i n d i rectory maintenance commands .
I I you come across a system w i t h D I R M A I N T ,
i t w i l l prov ide you w i t h a l l the i nlonnation you
need t o know about i t . A lew commands are
importan t , at least to the hacker:
M O PW: This displays access p asswords lor one
or all 01 that userid's m i n idisks.
. D l R M M O PW
OVH D l R 00 5 R ENTER C U R R ENT CP PASSWO R D TO
VALIDATE COMMAND OR A N U L L TO EX IT:
R ; T -=0. 1 210. 1 5 1 9:33:34
DVH M D F30 1 1 M I N I D I S K 1 9 1 :
WBUBBA
DVHMOF30 1 1 M I N I D ISK 1 92 :
BONEHEAD

R B U BBA
M B UBBA
R B U BPW
M U LTIBUB

The reason you must enter the user's logon

password i s obv ious. II someone walks u p t o a
user's tenn i n a l and wants to know what the guy's
d isk p asswords are all he wou l d have t o do i s
enter t h i s command and he would g e t them ,
except lor the lact that i t does ask lor the user' s
l o g o n p a s sw o r d . t h u s p r o t e c t i n g t h e d i s k
p asswords .
Help: Get more info on D I R M commands .
PW: This changes a user's logon password .
PW?: F i nd o u t how long i t was s i nce the user
changed his logon p assword .

T h i ngs you want are : more v a l i d userid's to t ry

passwords o n , actual logon p asswords , a n d d i sk
access p asswords . O b t a i n i ng userid's can be
accom p l i shed by using the Q N A M E S command
every t ime you logon . O b t a i n i ng logon p asswords
isn't as s i m p l e . There are a couple 01 p l aces that
you w i l l want to exp lore .
T h e A U TO L O G 1 or A U T O G P v i rtual machines
( userid's) usu a l ly auto- logon other userid's . N ow ,
i n order t o d o t h i s they must have those users'
passwords. These are con t a i ned w i t h i n various
EXECs w i t h i n their user d i rectory . II you can
o b t a i n a v a l i d d i s k access p assword l o r
w h i chever o n e 01 these i s run n i ng o n your
part i cu l ar system , you can get more p asswords
and poss i b l y some d isk acc e ss p asswords lor
about 10 other userid's . This shou l d a l low you to
get more d i s k access passwords and hopefu l l y
more logon p asswords. N evertheless , hav i n g
obtai ned a few more p asswords . and not u s i n g
t hem u n t i l the original one y o u hClcked d ies , w i l l
great ly extend your stay G n the system .
EX EC f i les l rom any user 1l1ay contain more
disk access p asswords for other users and those
users d i rectories may con t a i n EXECs which have
more passwords, and so on. 0 1 course many
other types of f i les may contain this type of
i n fonnat ion .
The C P d i rect o ry- t h i s is s i m i l ar to a b i g
bu l l seye on a t arget . This d i rectory , a s previously
exp l a i ned . contains users' p asswords , various
system i n lonnat i o n , and m i n i d isk passwords .
T h e d i re c t o ry u s u a l l y g o e s u n d e r t h e
f i lename / f i letype 0 1 U S E R D I R ECT I t can be
anyw here on the system , and can have a d ifferent
n am e , which i n my v i ew wou ld add t o syst em
secu r i t y . I t is usua l l y found in e i ther or both of
two users' d i rectories w h i c h I leave to you to f i n d
( sorry ) . T h i s is a very big weakness In C M S due
to the fact that i f you can lind what userid the
d i rectory is i n , and i t s d i s k access password ,
you've got the system by the b a l l s . Tile f i l e may
2600

December,

1 9117

Page

15

"2

:::

:2

HACKING VM/CMS

-;: also have a f i l etype of I N D EX which is a

compi lat ion or sort ing of pert i nent infonnat ion
? used for speeding up various procedures the
. system carries out constan t l y . A typical entry in
f the USER D I R ECT f i le wou ld look l i ke
:::...

. ...

USER B U B BA BU BAPASS I M 3M BG

-.

S VM U O I OOO

ACCOUNT 1 0 1 SYSPROG

VMU O I O I O
I P L CMS
V M U O I 020
CONSOLE ODD 32 1 5
VM U O I 030
SPOOL DOC 2540 R EAD ER
VM U O I 040
SPOOL ODD 2540 PUNCH

l i nes of what d i sks shou l d be automat ical ly

l i nked to upon logon . And finally the m i n idisk
( M D I S K ) v i rtual addresses and corresponding
passwords.
Conclusion

As usual , there is a lways more I cou ld add to

an a rt i cle l ike this one. I did riot want to keep
wri t i n g part after part so I w rote a "complete"
art i c l e on H acking V M /CM S . I apo log ize for the
length but I wanted to ment ion everything you
needed to become f am i l iar with the operating
system and i t s security / i nsecurity. I inten t i onally
"forgot" to ment ion various bits of infonnation
w h i c h w o u l d p u t s e n s i t i v e and d e s t ru c t i v e
i n fonnat ion i n the hands o f anyone who reads
t h i S art ic l e . The infonnation w i t h i n t h i s art i c l e
c a n a n d w i l l b e d i f feren t from system to system
so don't take anyt h i n g too l i tera l l y . This art icle is
c o m p r i s e d o f 8 0 % i n f o r m a t i o n from a c t u a l
syst em use . 10% e M S help f i les , and 10% from
various C M S documentation . I may write a
fol lowup art i cle of shorter length as more people
become fam i l iar w i t h C M S .

VM U O I 050

D E C E M B E R 'S LETT E R S

SPOOL ODE 1 403 A

i n serts can be p u r c h a sed a t m a n y

VM U O I 060
LINK MAINT 1 90 1 90 RR

;;::; off i ce s u p p l y sto res, d i sc o u n t c e n t e r s ,

-=

VMUO I 0 7 0
L I N K MAINT 1 90 1 90 R R

a n d d e p a r t m e n t sto r e s . I a m e n c l os i n g

s:

a s a m p l e i n sert f o r you to try o u t . H e a t ,

" a l te r n a t ive tec h n o l og y " ?

::- stretc h , a n d store !

VM U O I 080

::s

LINK MAINT 1 9E 1 9E RR

H ow i s t h a t f o r

S g t . Pepper of Texas
We ' r e g la d to s e e s o m e of o u r
readers work ing imagina tively t o solve
this problem of storage. Perhaps the

VMUO I 090
-:: fo lk s at R e a de r s D ig e s t w o u ld b e
MDiSK 1 9 1 3 3 5 0 1 5 2 003 V M P K O I M R RBUBBA
interested as well.
WBUBBA MBUBBA
Ho w Do Inma tes Do It?
M D i S K 1 92 3350 1 5 2 003 VMPKO I M R R B U BPW
B O N E H EA D M U LTIBUB

2600 :

G ot a co u p l e of n ewsp a p e r c l i p p i n g s

VMU O I I OO

for y o u . W h a t I ' d l i ke to k n ow i s h ow t h e

c o u n t y j a i l i n m a tes got a h o l d o f a l l

The f i rst l ine g ives the userid of B U B BA .

password B U BAPA S S , 1 and 3 M egs o f v i rtual
mem o ry , and Privi lege C l asses B and G. The next
l i ne g i ves the account nUlllber and department or
owner of the account . The next few l i nes def ine
m i scel l aneous system infomlat ion . N ex t . three
I)age I II

D ea r

December. I 'JI17

260(1

t h o s e l o n g d i st a n c e cod e s . I J u st ca n ' t
p i c t u r e a n A p p l e I I w i t h a u t od i a l
m o d e m a t t a c k i n g a d i a l - u p n od e f r o m a
j a i l ce l l .

The H ooded C l aw
The y didn 't need one. A /I the y need is
human contact with the outside world

( ((J i l l illul:'J

(ill pUJil'

:!:!)

BL V facts
(( Ol l l il1l1cd Iml l I I){I,!!,C I I )
length o f the cal l ( 111 minutes ) , and t h e 1 00 I S the
charge for the Interru p t . The format may be
d i f f ere n t , d e p e n d i n g u p o n y o u r a r e a a n d
telephone company
Veri f ication seems to be on a closed network ,
o n l y acceSS i b l e b y t h e TSPS . H owever, t here
have been c l aims of people doing BLV's w i t h blue
boxes . I don ' t know how to accornpl lsh BLV
w i thout the assistance of all operator, nor do I
know I f I t can be done. But hopef u l ly t h i s art i c l e
11as hel ped people unders t and h o w em operator
does Busy L i ne Venflcal i on and Ernergency
I nterrupts.

social in teraction
with phones
by Dave Taylor
An i n t eres t ing t h i n g has been happen ing t o O U I
telephones t hroughOilt the worl rJ -- t hey've bee!1
t r clll s i t i o n i n g f r o ll) b e lll Q Zl p e r s o n 1 0 p e r s o n
commun icat ions deV ice t o being a l u l ! - b l oWJl
I n format i on p rovider
ConSider, W i thout leaV ing illy eil a i r I c a n , l o t
only ca l l up people I know ( the easy part ) but I
can a l so t rack down people by dea l i n g W i t h
I llfoima t i o n ( o b t a i n in g their addresses a s w e l l <1:;
their phone Ilumbers ) , get stock quotes , Iny
horoscope, the rac ing resu l t s , summaries of the
l atest instal lments of varrous pop u l a r t e l "V ! S Il) I ;
serres [Ju t , mucll illore I n teres t l n g ! y cal' a c t u a ! l y
m ee t new people too .
The phone has been ext er'," ',_' to tv; t he
lI l t l lll a t e I II safe SOC i a l Il1 t e,ac t l ,n sv::t'I1lS---
W i t h the ra l l Y i n g cry of "profit t b " ; hene
company and the FCC has been l i c e nSi n g '1 0 ' , u s t
976 numbers , but a l so IS now offerrng 900
serv ice W i t h a vengeance
1 97 6 numbers , for t hose that don't know , are :1
s p e C i a l c l a s s o f p h o n e n u m b e r s l e a s ed t o
I n d i v i d u a l s for Just about any legal purpose . T ile
person cal l i ng I S charged tYPica l l y a connect cost
( usual l y abou t S1 7 5 ) and t hen a per m illu t e
charge too T il e p h o n e company pockets a
S i g n i f i c a n t percen t age of t h i s reven u e . and the
owner o f thf'
sr:fv i ce g e t s the rest /1, gOO
num ber I S s l m : 1 il r t o a n 800 nUITlber ( P . g . t n e , u i i
f ree p h o ne number a rea code l but the c a l ler :s
charged a flat S 50 per cal l to access I t . The
n umbers opera t e t h ro u g h o u t t i l e con t i n en t a l U S
and t h e person who owns t h e eq u i pment pockets
5 cen t s for each ca l l p l aced I

S o m ew h a t S U p l : S ::l l l y t tl O lHl h I
England and F rance a w h i l e back and I
that t hey're catch i n g on t l lere t o o l T hten.
c o l o rf u l adverts a l l over t ile Tube I i i I
advert iSing a t eel ! party I l lI e , for exan :p'"
What's a l so I Il t erestlng t il a t not
have "ca l l a recor d i rlCj' sys tem:; ( a lso
the name "d1 a l - il- porn ' due to the prl:\: ; I :,1I 1 , '
that type o f record i n g being a (l I ! , i i ! ' I
syst ems where \I O U c a n c a l l u p and
" p e r s o n a ! a d " , il l s o h e e F I n \l s o rn e Cli l i
( randolTl ly ) , but : I s been exter-Icled to p;\II ,;
l i ke t hey had in t i l e ea r l y days of
A frrend o f ITl I W: runs a 976 ' ch;J j I n
he l eases 1 2 phOl l'; I I lles f rom the p h one
,md peop l e c a l l 1 l1 u (;illl r: onnecl t o ' I : ) to )
peo p l e a l l 1 11 o n e \) 1 (1 C0nk': f;llce ca l :
;ome

bU i l t I n I l ln i l a \ i ol !,

!) ! '

t ll[;

i a w -- t hey ,1 1 i must i ernl l l l Cl T I' w l t il!l '

i
connect cl n d by
to gil I e
m ake" rt sOli n d lw f u l )
I t h l il k 1 11 :1' Hw rJevel opl1 l C,nt Le;
(l ilumber of li l t t e l ;rlt reaS()Ils above (l I d !
tile f u rt her u t ! l l/a ! : Or1 of t h i tel e p h o ne
I I s a l so an exc e l l ' m t eX iul1 p l e o f HlP
: n s l d l o u s Ci l o w t h a ll d e Il U ' , ' ! I , ,
tec h n o l o gy ()Il OUI ever/d:I '! ' I J(,:;
r t !l"
But most of I I I I I

:, f

s t a l CIlIt?ll l l") i I ; Ilt ;'. ..)\: 1 (1 1

paced

SOC l e t v

sat V.' I H I r n v h" l el i d 1 < r'1c ! ! ) t r;r l l

o t lier l i nes :0 ! I,;a! Ii;)w t f l tl\'
and enost o f a l i I 'm st ru c k W i t h t ilf; \ :1'
rJ e sp a i r and l o n e l i l :!ss t h a t '1 1 1 the e;1 1 1 111 ',
have. U ndeill eatil t l l e l l il a t i tJ ! e ( ,m it I !l(li,:
surp r i s i n g t ha t peJp le pay so mudl t o
l i t t l e ) I S a g ro u p o f .Jeo p l e w h o are
unable t o su cceed SOC i a l l y I II our
I k n o w of a w o m a ll . q U i t e a t t i d '
person a b l e , anrl flln to spend l ime W i t h . W i .! 1
used [ he 976 persona l s record ing 11Ul11 tler ' ,
Ill eet m,n S h e ' s actua l l y enjoyed
W i t h t h e peo p l e she's u l t ! m ;l t e ! y ITI I : t I " :,
i J l ! t t h e y a l ! S8P,rn t n va!1 i -J vV ! l h i n a '}jj.fk , i t
Yet ;mot her person i know C ! ;J I I I : :, [ ( ; ,o t
o n l y f r i el1d h e h a s ! I 'lat i 1 P hasl1 1 ;i;[
' p ll orH' con feren c l ng " a n d t ha t ill' f l [lri , : .
d i f f i cu l t to make f r i ends a t par t lee, l i n d c, ' : '
S o l il (l rather ClrCLl l i ol l S w ;; y I S Ci i
I've

' r il e , or c a l l s

26{)()

( , , ' l 1 l l 1 l 11l'd ( 1 1 1 1 1 ( ' \ /

December. 1 9S 7

I'i

P"l:" .i i

so cial in teraction
(, ( il l i l l l l led /'-(11 1 / ! ' n T /OIl I ! !Ilgcj
we l e 1 1 0 t seeing the usage o f t hese new phone

foreign c o n t r i b u t o r s , so I h o p e t o t e l l y o u some

selV l ces ( an d they are used an astoun d i n g

t h i ngs that cou l d be I n t erest i n g

amoun t , I I I excess o f a b i l l i on d o l l ars wortil o f

I n E u rope we st i l l have t he p u l se d i a l system

p h o n e l ev e n u e per year I n t h e U S ) as I n d i ca t i v e

a n d 111 I t a l y we p r o b a b l y h a v e t h e o l d e s t

o f l il e gradual chan ges t h a t a r e t l ansform l n g our

t e lephone system i n E u rope I n my COUll try w e

cu l t u re and soc iety

make every effort t o be compared w i t h t h e rest o f

I II some sense , t iley're a d i rect para l l e l to

t h e w o rl d . S o even i f we do h a v e a b a d t e l ephone

com p u t er bu l l e t r n board systems-a few years

organ iza t i o n , we m i racu l o u s l y have a l o t o f

d90 w hen t hey s t arted t o become popu lar a group

serv i ces and our f a n t as i es make u p for the fau l t s

o f p eo p l e sprung u p t ll a t used t h em as t h e i r

o f t h e Govemmen t .

p l l ll l c HY p l ace f O I

m a k i n g new f ri ends

p a l d l l e l s are l ea l l y q U i t e s t l l k l n g .

W e h a v e s u c cessf u l l y created

The

good

(And t h e

organ izat i o n of peop l e w h o use a modem and

C U l l e n t com p u t e r confel ence systems , l i k e t ile

t h rough thiS orgall i z a t i o n we successf u l l y hack a

U S l N ET , are an o u t g row t h of t hese early B B S ' s

l o t of t h i n g s .

I O U , w l l h s l i n r i a r deI l 1 0 l1 r Cl p ll I CS . )

F i rs t o f a l l , dS descrr bed r n t h e M ay 19 87

f i l e o l h e r quest i o n t h el t a r i ses . and I tlel l eve I S

I s su e , we learned how t o eas i l y ca l l f ree from t h e

l i l 8 C I U X o f d l f o f 1 11 1 S , I S where (lid tillS clique

p il o n e boo t h s . f l l S t u S i n g a l i t t l e t o o l ( an electric

fI UI I I ) I s It d new group of peop l e , t ilese

; l l d t u s e l e c l m o l o g y a s a v eh i c l e f o r SOC i a l

w i re ) and then W i t h o u t any toolS-Simply by

( 1 ) 1 I 1t:

I l l t c r ac l l o n ,

I S I I a n a l u l el i O U t g l O W t ll o f o t hel

01

h a n g i n g t h e h a n d s e t up q U i c k l y , t h e r e b y
' u il l o c k l ll g ' t h e l i ll e f O I c a l l i n g everyw here
U n fort u ll a t e l y OUI company locked a l i of t h e

I delOI s 7

M y S I : SP I C I O l l I S t h a t I t s al l Ullsurp l l s l Il g resu l t

uf t il e C X p elil S I O l l o f med i a a n d t he consequen l

, t l cn g t i l el1 1 1 1 9 of t he Illed l a s

boo t h s I I I J u l y so we're t ry i n g t o f i n d anot her

way
We a l e a l so a b l e t o u s e " b l ack boxes" when

peri ec t per son

T i l e t; X p e c Ll t l o l l s I II s o c i e t y l e a l l y h a v e

rece i v i n g a c a l l If someo n e c a l l s , you can SW i t c h

1' l l d l l CJ ed q U i t e d r dm a t l c a l l y III t il e l a s t few yea l s

on t i l l S e l ec t l l c b o x cOllnec t ed t o t he I r n e , 1 1 f t u p

I Il(; l l c v e (l I te I l l u s t e l tll e l tJC p a l t o f t ile popu l a l

t he lece l ve r an d t a l k w h i l e t h e p h o n e is s t i l i

( I

11 I l l (; s o

c d l l e et

I n ed l a s t e l (.J t ypes ) 0 1

I l ll g l ll g ' 1 11 t h i S case t h e person w h o has ca l l ed

I l l e y W i l l I l d v e a d i f f i c u l t t l ill e s u c c e e d l ll (j

you doesn t pay clily t h l ll g bec ause t il l S box makes

,(l i i d i l y

t il e t e l eplloll e exchange be l i eve t h a t you dJdn t

( ul lll! "

;, ". C l i V I : B d l kt;r

( d l l ec t o l O f t i l e I l ew f l l l l l

1 1 f t t il e l ec e l v e r So t il e exc h a n g e b e l i eves t h e

ti t'lll , i /SCI ) , d y I I I t i l e I l l d CJ d2 1 n e S lgM c i l l O

t e l e p t1 0 l l e I II y o u r Il o u s e

:; , ll I l I e l

S O l l l c t l i l i es you lTlay h a v e to p u t u p W i t h a l i g h t

Id

1 11 1 1 1 < ' 1 c ll a r d e l ( : 1 I I I t i l e ll l l Q l l l il l h a s

: ) (; e l , I U l f l e r! I l l t O t il l: s " c o n d l e a cl I I I t il e
d l i d p l , l \ I O I I ,J l I Li p o i l siled l ! fJ (lS

Ill o r e o r l ess

I lJ l 1V(l l I l tl l l a l l 1 t: I O l ll e I I l i k e d t il e l a c t t h a t I II t h e
' I u v e i l d I l le (j I l l w a s a t o t a l l o:;el

W l t ll

S tl i l l eOI 1 C

Y ULI

CUI

t fOI

You call l i v e

l i k e t l l a t f O I t ile l e ll g t h of a nove l l a
d

I l li g w h i l e you t a l k O n l o c a l c d l l s you can t a l k

dS

long

do

f O l evel

y o u wan t because t h e p h o n es c a l l l i n g

O ll

. ex t r a u l ban

ex t l a l o c a l " c a l l s ( w e c a l l t h em
ca l l s ) , t h e l i ne W i l l b e c u t after

t h ree m i ll u t es a n d you W i l t have t o dial aga r n

1110V le

Hacking via M odem

W h a t eXdc t l y I S t i l l S say l l l C) a bOu l OlJl c u l t u l e 7

stl

IS s t i l i l i n g l n g l

We a l so have a network for l o n g d l s t allce c a l l s

but I

v i a m o d elTl W h i l e t rl e U n i t ed S t a t es h a s Telene1 .

,v tlll l lj De 1 11 0 S t I l l t e r es t e d l ll i l ear r n g a b o u t o t ller

T y m ne t , e t c , we fortuna t ely h a v e o n l y one

I ve

ay e d

il l t o f f t il e bea t en p a t h

p t: l l jJ l e S l lliJ lI g il t s a l l t il l S

e S fJ e c l a l l y t h o s e

Ron l an /fackers
TlIf' fo !loWlIlfj ,llt l c le
1 ' \' 1 ; 1 , , :. 1\

IS

d l i o t lJcr III

ci

seues o f

tdle , u ( IJdcklllfj d n d pIJledk,llfj

IJy

Hal from Rome

I Il d V t: see l l t l l a t sOlll e ! l i j 1 P' you g i v e space to

I ' a gl'

IX

I h' ( " l l l h e r . I IJX 7

n e t w o l k tl e c a u s e t h e t e l e p h o n e s y s t e m I S
c on t ro l l e d b y t il e Government

ilu t s l cte o f tile U i l i t e d S t d t (:S

0 1.1 1 network I S

c a l led I TA PAC and , a s you can I Im g l n e once

you e t

p a ss w o l d to lise It you '.' all ca l l all of t h e

lJ l g g e s t C O l l i p u t el s I I I t i l e w O l l d i. B I X , D I A L O G ,

C O M P U S E R V E e t c ) alld oil l y spenrJ money f o r a

l uc a l ca l l

W e I l a v e :, V t; 1 el l u f t hese P d S S W O I d s a n d w e re
q U i t e s U l e t iley w o n t c h el n g e s o u ll lJecause t hey

( , I ' / I I / I I / I < d ( I I / ! '<ig < , _'I I )

Z600 marketplace
8038 C H I P WITH S P E C S H E ET,

S U M M E R C O N ' 8 8-com i ng to NYC .

b l ock d i a g r a m a n d p i n o u t-very l i m i t e d

W a t c h t h i s s p a c e for m o r e i n fo.

q u a n . $ 1 5 . 00 e a c h postpa i d , c h ecks,

FOR S A LE : R a d i O S h a c k C PA - lOoo

m . o . to P E L , c a s h , m . o . s h i p ped sa m e

P e n R eg i ste r . J u s t l i ke new. $ 7 0 . 00 .

d a y , c h e c ks m u st c l e a r . Pete G , P . O .

J . C . D e v e n d o r f , 2 9 2 6 1 B u ck h a ve n ,

Box 4 6 3 , M t . La u r e l , N J 080 5 4 .

Lag u n a N i g u e l , CA 9 2 6 7 7 - 1 6 1 8 .

WA N T E D : A n y h a c k e r a n d p h r e a k e r

F O R S A L E : E x - B e l l b l u e boxe s , o l d a n d

softw a r e f o r I B M c o m p a t i b l e a n d H a yes

sty l i s h , m a y eve n wo r k ! A l so a w i d e

c o m p a t i b l e mod e m . I f you are se l l i n g o r

r a n g e of o l d B e l l c o m m s eq u i pm e n t .

k n ow a n y o n e w h o i s , s e n d r e p l i e s to

C a l l ( 5 1 4 ) 3 9 3 - 1 840 a n d a s k f o r R i ck

M a r k H , P O Box 70 5 2 , Port H u ro n , M I
4830 1 - 705 2 .

for deta i l s .

FOR SALE : O k i data M icro l l ne 92

i n te l l i g e n t v i d eo t e r m i n a l . C o m p l e t e l y

F O R S A L E : SW f P C M od e l CT - 8 2

p e r so n a l p r i n te r . I n c l u d e s m a n u a l for

programmable

i n st r u c t i o n s . H a rd l y u s e d . M a ke a n
offer a n d I f i t ' s r e a so n a b l e , I w i l l pa y

f u n ct i o n s ) , R S - 2 3 2 C & p a r a l l e l p r i n t e r

posta g e . M a tt K e l l y , 3 1 0 I s be l l , H owe l l ,

control pad, 9 " P- 3 1 CRT w/7x1 2 dot

( 1 50 separate

p o rt s , f u l l A S C I I keyboa rd w / c u r s o r

M 1 48843 .

m a t r i x- u p to 9 2 c o l u m n c a pa b i l ity, 3 2

TA P BAC K I S S U E S . C o m p l ete s e t ,
vo l . # 1 t o a n d i n c l u d i n g vo l . # 9 1 ,

Exce l l e n t cond i t i on w i t h fu l l

baud

r a t e s to 3 8 . 400-- m u c h m o r e .

i nc l ud i ng schematics a n d spec i a l

d oc u m e n t a t i o n . O r i g i n a l l y $ 800, se l l

repo r t s . C o p i e s i n g ood to exce l l e n t

c o n d i t i o n . $ 50 . 00 , n o c h ec k s , i n c l u d e s

for $ 1 2 5 o r best offe r . B e r n i e S p i nde l ,

1 44 W . E a g l e R d . , S u i t e 1 08 , H averto n ,

posta g e . T . G e n e s e , 2 1 9 N . 7 t h Ave . ,

P A 1 908 3 .

M t V e r n o n , N Y 1 05 50 .

2600 M E ET I N G S . F r i d a ys from 5 - 8

D O C U M E N TAT I O N o n e l ectro n i c a n d

p m a t t h e C i t i c o r p C e n t e r i n t h e M a rket

d i g i ta l sw i t c h i n g syste m s a n d P B X ' s .

( l obby where the t a b l es a re }-- 1 5 3 E a s t

W i l l i n g to p u r c h a s e / t r a d e . A l s o

5 3 rd S t r e e t . N ew Y o r k C i ty. C o m e b y ,

l oo k i n g f o r o t h e r p a ra p h e r n a l i a s u c h a s

d r o p o f f a rt i c l e s , a s k q u est i o n s . C a l l

B e l l S y s t e m P r a c t i c e s . W r i te to B i l l , c / o
B ox 7 5 2 C , M i d d l e I s l a n d ,

NY 1 1 95 3 .

5 1 6 - 7 5 1 - 2 600 for m o r e i nf o .
G OT S O M ETH I N G TO S E LL? Look i n g
f o r s o m et h i n g to b u y ? O r t r a d e ? T h i s i s

B LU E B O X I N G ? Let ' s exc h a n g e I n fo

t h e p l a c e ! T h e 2 600 M a r ketp l a ce i s

2 6 00 , P O

on

p h o n e n u m be r s , pa rts, a n d etc .

free t o s u bs c r i be r s ! J u st send us

W r i t e t o : B l u e B o x , P . O . B o x 1 1 700 3 ,

w h ateve r y o u wa nt t o s a y ( w i t h o u t

B u t i i n g a m e , CA 940 1 1 , Atte n t i o n D . C .

m a k i n g i t too l o n g ) a nd we ' l l p r i n t i t !

F O R S A L E : 8038 m u l t i - p u r pose tone

g e n e ra t o r c h i ps , p r i m e q u a l ity $ 7 . 50
each ppd . I nc l udes com prehens ive

Add r e s s : 2 600 M a rket p l a c e , P . O . B o x

appl ications data . Two c h ips w i l l

yo u r address l a be l .

g e n e r a t e a n y d u a l t o n e fo r m a t . T h e s e

D ea d l i n e for S p r i n g issue: 2 / 1 5 / 8 8 .

O n l y peop l e p l e a s e ,

n o b u s i nesse s .

9 9 , M i dd l e I s l a n d , N Y 1 1 9 5 3 . I n c l u d e

a r e n o l o n g e r i n p r od u ct i o n . G et ' e m
w h i l e t h e y l a s t . B r u c e , P . O . Box 8 8 8 ,
S t i n so n B e a c h , C A 9 4 9 7 0 .

2600

Drcember, 1 987

Page 1 9

Ranzan Hackers
(coll t illued/roll l page 18)
belong to the telephone company ! S trange but
true: in I taly i t is easier to f i n d passwords that
belong t o the telephone company i nstead of
hack ing pri vate passwords . This is because our
t e l ep h o n e c o m p a n y ( c a l l e d " S I P " ) d o esn ' t
bel i eve there are very many hackers and so i t
doesn 't care too much about keeping their
passwor ds secret !
N ow using ITA PAC , I very often use systems
in the U n i ted States and one of my favorite ones
is an outdial system-one that you can cal l and
say , "O K , now dial t h is number i n the U S A . " So
using this outdial l can connect to every number
via modem in the U n i ted S tates and I can join a
lot of B B S 's nonnally not connected on the
network.
I hope this is of interest to those of you in the
U n i ted S tates. P lease contact me on B I X (write
to "capoccia" and if you want I can g i ve you my
password for a w h i l e so you don't have to spend
anyth ing and so we can write to each other) or
wri t e me a number of a B B S at wh ich I can reach
you
In I taly, there isn't actually any law against
hackers , so you can use this infonnat ion as you
wan t . I 'm not airaid at a l l and you can publ ish my
address.
H a l ( from Rome)
c/o Enrico Ferrari
V i a G i useppe Valmarana 43
00 1 39 Roma
I taly
Phone 0 1 1 -39-6-8 1 0761

access numbers. H owever, the person who

answered the telephone w as i nsistent upon trying
to get me to sign up with US Sprint as my equal
access carrier. I didn't want Sprint as my equal
access carrier. But one of their travel cards wou l d
cost me $ 1 0 a m o n t h plus charges incurred i f I
d idn't choose them as my Equal Access carrier. I
d i d n ' t want to have to fork over this ridicu lous
charge j ust for a simple code which cou l d be
hacked for free . They lost a prospect ive customer
by being so stubbom about get t ing my Equal
Access dol lar ( this is understandab le, as Sprint
has i nvested a huge amount of money in their
Equal Access campaign) . Another bad point
c o n cern i n g U S S pr i n t i s t h e fact t h a t i t s
authorizat ion codes have been w idely abused and
posted on electronic bu l let i n board systems,
where they are t hen spread t o more and more
people who are poten t i a l abusers. I rarely saw an
M C I code , or an A LC code posted on a B B S , and
w h e n I d i d , t h e y w e n t b a d v ery q u i c k l y ,
espec i a l l y i n the case o f A l l net. This i s due to
A LC hav ing the c i ty name of the general area that
you cal led from included in their records. When
calls come from d i fferent po i n ts at the same or
close to the same t ime in excess , the customer
c a n b e c o n t a c t e d a n d t h e c o d e c h a n g e d.
Anyway , back t o the pushy representat ive : I
hope this experience opens the eyes of any
p o t e n t i a l U S S pr i n t c u s t o m ers . O h , a n d
i n c i den t a l l y , GT E , w h i c h owns U S Sprin t , is a
n u c l e ar weapons c o n t r a c t o r w i t h t h e
govemment . Another bad po int ( see 2600,
M arch , 1 987 ) .
Because of existing laws in the United S ta tes
N ext , I decided t o t ry M C I . A q u i ck call t o 800
a n d b e c a u s e we a re a / w a y s w a ry o f
D A revealed their 800 customer serv ice number
overconfidence, we have omitted any references
to be 8006246240 . I knew this number was
to specific hacking on specific systems.
incorrec t . I recogn ized the 624 exchange as the
More Long Distance
o n e w h ere M e I had a n o d e , w h i c h w as
Unpieasantries
80062 4 1 022 and has since been repl aced w i t h
Recen t l y I dec ided I w ished to have legal another 800 number (8009501 022 ) t h a t belongs
access to a long d istance carrier's fac i l i t i es, so I to MC I and also recei ves A N I ( the phone number
began to gather t o l l - free 800 customer service you 're cal l ing from) when you cal l it ( see 2600,
numbers to the major interexchange carriers that J u l y 1 987 ) . Anyway , I then dec i ded to get
served my area. A quick cal l to 800 DA got me "assistance" from a local Bell TOPS operator,
the correct number t o US Sprint Customer who was q u i t e friend ly, and completed several
S erv ice for my area ( 80053 1 4646 ) , and the calls for me i n an effort to f i n d the right customer
c o rrec t n u m b er for A L C C o m m u n i c a t i o n s , serv ice number. The TOPS called 800 D A for me
otherw ise known as A l lnet ( 80052 1 0297 ) . I then and I requested any other numbers t hey might
cal led US Sprint and inqu ired about get t ing a have for MC I , expl aining that the number t hey
trave lcard , or a code on one of their 950 or 800 had w as no longer val i d . They gave me a number
Page 20

December, 1987

2600

more long distance horrors

l i sted as M C I Sales' , which was 8006242222 .
The T O P S (who d i d not d isconnect) then d ialed
KP FWO +8006242222 +ST III an attempt to
reach M C I Sales . This number was answered by a
B e l l O N I I n t e r c e p t O perat o r ( a n i n t e r c e p t
operator w h o d idn't know t h e number I was
cal l 1 rl Q : I had to verbal ly tel l i t to her) S he then
to l d me that the new number was 8004442222 .
S o , after three attempts, I f i nally received t il e
correct number t o r MCI Customer Serv i ce. or so I
thought I cal led this numbel and Infonned them
of the t rouble I had Irl gettlrlg the new customer
serv i ce number, and the woman who answered
the phone sai d she wou l d look i nto I t . I wandel
why AT&T was so slow In get t i ng the new
customer serv ice number for one of the i r major
com p et i tors? U pdates to the 800 D i rectory are
s u p p o s e d to be h an d l e d a u t o m a t i ca l l y , b y
com p u ter I t seems t hat someone p u t a low
prrori ty U P O ll this part Icu lar company , as I had n o
problem W ith any of the others. Anyway , I t il ell
began ask ing the wOlllan some general quest ions
about their serv ice, and only w hen she asked me
my area code was I told t hat I needed to talk to
t h e S o u t h w e s t D i v i S i o n , r e a c h a b l e at
8004 441 2 1 2 . So, after al l this hassl e , I f i nally
cal l ed and had a chat W i t h w hat sounded l ike a
J ap a n e se- s p eak i n g p e r s o n w h o s o u n d e d
i ntox i cated . I leamed several Interesting thillgS
f rom tal k ing to thiS person . O ne such thing IS that
M C I Customer Selv ice reps have access to rate
Informat ion v ia a computer. T h ey enter the
, orrglnat ing N PA - N X X , and the terrnillatlllg N PA
N XX , and the computer d isp lays rate i nfolll lation
tor a II three rate c lass i f i cat ions ( day , evel l i n g ,
a n d n i g h t / h o l i day ) I also discovered t hat to get
a t ravel card W ith M C I , you usual l y have t o pay a
one- t i me fee of $1 0 30, but they had some sort of
spec ial gOing where you cou ld get the t ravel card
f ree at t h i s spec i f i C pOint rn t ime. I also asked
aboLJ t M C I operators , assuming that they wou l d
b e Implem ented short l y . The man told m e they
wou l d be there by the end of 1 987 . T h i S was al l
f i ne and wel l , but i t w o u l d then take tilem 1 0- 1 4
work i ng days to act i vate my serv ice I found out
other I nterest I ll g th rngs about theni t hat I p l a l1 Oil
rncl LJdlng III a separate art i c l e which w i l l be
rel eased at a later date. O lle last bad pO i n t about
M C I - t hey , l i ke GTE, are a nuclear weapons
cont ractor ( see 2600. Marc h . 1 987 ) , so I
d ec ided not to deal with them

T h e n ex t

vai ner up was A l l lle! . or 1 11 t ru t il , A LC

( formed when A l l net merged
With L ex ! t c l ) H owever, 800 0,\ d l d n l have any
I I St l l1 g for A L C C on:nu i l l c d t l oll S . bu t t hey d i d
have a number k" A l l net C u s t omer S elv l c e' I
cal led t h i S IlLlll r )p,r a n d t l18 t e l e ilCllle was
allswel ed by a [it W
T h , :, pe[ " oll w as
velY h e l p f u l a n d dllswcl ed a i l o t ' f :y Q I I(;:; l l o n s
w ith fl O h a ss l e 1\ I n c t h a c ! h-)
l j rUldrge
' o r thf: LJ':e o f l : i " Jei car d dilli
(i ! c1 flul : ry to
p u sh I ll ) IlltO S I \ F I n g up w i t h t ile ; 1 " " my Equal
A ccess camer S'l I II other word s , I was able to
get a code 0 1 1 A l l r e t eas i l y W ithou t much hassle
F r om the t h r ee e a r ll ers I s Jlll p l ed , A l l n e t was by
far tfle most h el p l : J I I f you a l e t ll ! r l k l ll g of get t i n g
y o u l OWll t l (lVeICaf d , I w o u l e! 3uggest A l i ne!
They are , of course , a m a j o r r esel i e r of othel
COll1 p a n l eS' l i nes T h a I I S tD s a y t hey do n o t have
t heir own networ k l i k e M e l 0 1 U S S p . i l l t Thus
you w ! 1 1 have to D i ; t u p w i t h s l i g h t l y l o w e l
l i nes , b u t t hey el l ,) s t i l i III ore tharl allequ ,lte f O I
vOice and d a t a \ 1 c:11Slll iSS lons
When ChOOSlllCi , be s u re t o cOlll pare t h e lon\)
d i s t ance serv i ces :hat are avai lable I II your arc;;
before you dec r , Ie to p i c k one Ask them
ques t i o n s but dOll t be rude M C I I II part iculal
has the l l custoiliel serv ice numbers set " p I I I ttlel !
O W Il 8 0 0 exchall(J8 ,m d c a l l s t o l il l s exchange
w r l l receive A N I So being po l i te '1nr j t a c t f u l IS
adV i sable w hen clea l l llCj W i t h ! rlen l from a hOlll e

COlll m LJ l1 l c a t ! 0I1S

telephone .

A l so keep In ITl lnd t h a t i l l e Cli s t Dmer serv i ce

numbers l i sted here are for !ny area code You w i l l
have to get your own number s for you I area code
If you W ish to enCJ l neer t h{;se compan ies
O n e l a s t 11 0 t e r e a n e r s , s h a r e y o u r
ex p e r i e n c e s I O n l y t h r o u g h a n I ll t e i l i g e n t
COInrnUll l catlons forum l i ke 2 6 0 0 call w e I n f o rm
each other and the general pub l ic of the good / bad
aspec ts of telephol18 systems here and abroad .

SOME N U M BERS
1 00 4 1 - 1 -700777 7777
conference l i n e i n

N Y -- $ 1

ALLNET
a m i n ute

1 0 2 2 0 1 7 00 6 1 1 6 1 1 6

Western U n io n

, 800 - 9 8 8 0000

Western U n io n

H e l p Line
Long D i stance C u stomer Service
1 - 800 9 8 8 - 47 2 6
Western U n i o n
Teleg r a m O perator

260()

I ) ecrnber, 1 9X 7

Page 2 1

(( ( !l I l il llll'li jrul l l /)(Jgc 1 6 )

D E C E M B E R ' S L E ITE R S
A r r o w E l e c t r o n i c s , S c h we b e r
H a m l iton /Avnet

G u a r ds c a n p r e v e n t v is it o rs fr om

(I e

brmgmg in kmves and guns, but so far

E lectron ics,

the y 've been unable to keep people

E l e ct r o n i c s ) o r t o t h e " h obb i e s t " f r o m

J a m eco E l ectro n i c s , 1 3 5 5 S h oreway

from recitlf7g n umbers. Someone could

also easily set up a voice mailbox to

Road, B e l m o n t , CA 9400 2 , (4 1 5 ) 5 9 2 -

read out this month 's Sprint codes. A ll

809 7 , FAX 4 1 5 - 5 9 2 - 2 50 3 , Te l e x

an inmate has to do IS call that n umber

1 7 604 3 ( l C L8038CCJ D $ 3 . 9 5 w/ $ 20

and write do wn the codes. But isn 't it

m i n i m u m orde r )

true that a ll ca lls from a prison h a ve to

Ye t A n o ther Telco Ripoff

be collecr? That 's no problem -Simply

mak e

th e

fir s t p a r t

o f the

v o ic e

m e s s a g e s a y " S u r e , I ' ll a c c ep t " o r

something slfnilar.

2600 :

H a ve y o u e v e r bee n t a l k i n g o n a
p a y p h o n e a n d h a d yo u r t i m e r u n o u t ?
F i r st t h e p h o n e c o l l e c t s yo u r m o n ey

BBS Tho ugh ts

a n d t h e n t h e n i ce m a n asks you to

2600 :

Dear

D ea r

depO S i t a n i cke l for a no t h e r f i ve

F i r st off, I ' d l i ke to c o m p l l fn e n t y o u o n
yo u r m a g a z i n e

m i n u t e s . Y o u r e a c h I n t o yo u r p o c k e t

I t r e a l l y s h ows how

a n d a l l y o u h a ve I S a q u a rt e r . Y o u

l i t t l e t h e a v e r a g e p e r s o n k n ows o f

d e p O S i t yo u r q u a r t e r a n d a re l eft a l o n e

w h a t ' s h a p pe n i n g I n o u r t e c h n o wor l d .

f o r o n l y a n ot h e r f i ve m i n u tes ! I t s e e m s

S e c o n d l y , I s a w yo u r c o m m e n t a bo u t

q U i t e u n fa i r t h a t n o m a tte r w h a t y o u

wa n t i n g t o s e t u p a n etwo r k o f safe

d e p O S i t i s t re a t e d a s a n i c ke l . I c a n

B B S ' s . J u s t In t l rn e - I w a s t h i n k i n g

u nde rsta nd t h a t u nd e r p r i m i t i ve

a b o u t r e - o pe n l n g m i n e , yet a b h o r t h e

c e n t r a I off i ce e q u i p m e n t t h e p h o n e J u st

t h o u g h t of r u n n i n g a p i r a t e B B S a g a i n

c h e c k s to see If t h e re I S a co i n g ro u n d .

( a s I n softwa r e h a c k i n g ) . I ' d l ove t o r u n

B u t t o d a y s i n c e m ost b i g c i t i e s h a ve a
m a j o r i t y of t h e i r ce n t r a l off i c e s c u t ove r

a " 2 600 a u t h o r i z e d B B S " . I wo u l d be

r u n n i n g on an Am l g a 1 CXlO , 3 ' /L I n c h

to E S S , w h y c a n ' t s o m e o n e at t h e

d r i v e , a n d 300/ 1 200 B PS . I t wo u l d be

p h o n e c o m p a n y m o d i fy t h e i r SW i t c h e s

2 4 h o u r s a d a y . I ' m s t i l i l ook i n g f o r t h e

to a cc e p t d i m e s a s d i m e s a n d q u a r t e r s

r i g h t s o f tw a r e t o r u n , b u t a n y t h a t I

a s q u a rt e r s 7

c h oose wou l d e a S i l y meet yo u r

M a ry M ,

req u I r e m e n t s

C o r n l a n d , I owa
P.A.Z.

Wh y in de e d ? L e t ' s h e a r s o m e

We ha ve some additIOnal reqUire

"explana tions " for thiS one from the

ments tha t we can go o ver with you at a

folks on the InSide. If

fu ture da te. We expect to start addmg

s a t is fa c t o r y a n s w e r,

n e w b o a rds s o m e t im e in Ja n u a r y.

looking a t next years project to comb a t

A n yone

consumer fraud.

e ls e

wh o 's

I n t e r e s t e d in

We

don 't get a

you ma y be

running a 2600 board should contact

us

The Missing Chip

2600 :

Dear

As p e r t h e " : ost " 8 03 8 c h i p for trl e

box plans

I C L8038 prec I s i o n

wavefo r m g e n e ra t o r
osc i l l a t o r ,
GE

vo l t a g e cont

m a d e b y I n t e r s l i - n ow

RCA a n d ava i l a b l e from the

, C O Ill ITl O n " ' d l s t l l b u t o r s I n m o s t c i t i e s

P a g e .2 2

DccclII llI'r,

I 'IX 7

26()()

The correct address

to send a le tter
or to forward an article
IS:

2600 Editorial D ep t.
P. O. Box 99
Middle Island, N Y 1 1 953

Attention Readers !

2600

is a lways l ook i n g f or i n f o r m a t i o n t h a t we c a n pass o n

to yo u . W h et h e r i t i s a n a rt i c l e , d a t a , o r a n i nterest i n g n ews
item-i f you h a v e somet h i ng to o ff e r , s e n d i t to u s !

Remember, much of 2600

is written by YOU, our readers.

N01E: WE WIll.. ONLY PRINT A BYUNE IF SPEClFlCALl..Y RE.GX.IES1ED .

Ca l l o u r off ice or B B S to a r r a n g e a n u p l oa d . Send US m a i l to

2600 Ed ito r i a l Dept .

Box 99
M id d l e I sl a n d , N Y 1 1 9 5 3 -0099
( 5 1 6 ) 7 5 1 - 2 600

The Telecom Secu rity Group

S E C U R ITY PE R S O N N E L :

H a ckers p l ay a ro l e i n v i o l at i ng

YO U R com p u t e r ' s sec u r ity.

LET OUR TEAM PUT YOUR FEARS TO REST

with ou r complete "system penetration"
services. We'l l a l so keep you up to date
on what hackers know about yOU .
CA LL OR WRI TE FOR MORE INFORMA TION.

The Telecom Secu rity Group

366 Washington Street
Newbu rgh, NY 1 2550

Office : 9 1 4-564-04J7
Fax: 9 1 4-564-5332
Telex: 70-3848

2600

December. 1987

Page B

CONTENTS
I M PORTANT N EWS . . . . . 3
IBM'S VM/CMS SYSTEM . 4
TELECOM I N FORM ER . 8
.
.. . 1 0
B LV
LETTERS. . . . . . . . . . . .
........................ 1 2
. . . . . .

. . . .

. . . .

. . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . .. . _ .

. . .

. .

SOCIAL INTERACTION 1 7
ROMAN HACKING . . . 1 8
2600 MARKETPLACE . 1 9
L .D . HORROR TALES
. 20
. . .

. . . . . . . .

. . . . . .

2600 Magazine
PO Box 752
M idd le Island, NY 1 1 953 U SA.
Forward i ng and Address Correction Requested

WARN ING:
M ISSING LABel

. . . . . . . .

S E C O N O CLASS POST A G E

Permll Pendln9 t
E iI,t S e l l u k e-t. N Y .
1 1 733
ISSN 0 1 4 38S'