GUIDE TO (mostly) HARMLESS HACKING
Vol. 2 Number 1
Internet for Dummies -- skip this if you are a Unix wizard. But if you
read on you?ll get some more kewl hacking instructions.
____________________________________________________________
The six Guides to (mostly) Harmless Hacking of Vol. 1 jumped immediately
into how-to hacking tricks. But if you are like me, all those details of
probing ports and playing with hypotheses and pinging down hosts gets a
little dizzying.
So how about catching our breath, standing back and reviewing what the
heck it is that we are playing with? Once we get the basics under control,
we then can move on to serious hacking.
Also, I have been wrestling with my conscience over whether to
start giving you step-by-step instructions on how to gain root access to
other peoples? computers. The little angel on my right shoulder whispers,
?Gaining root without permission on other people?s computers is not nice.
So don?t tell people how to do it.? The little devil on my left shoulder
says, ?Carolyn, all these hackers think you don?t know nothin?! PROOVE
to them you know how to crack!? The little angel says, ?If anyone reading
Guide to (mostly) Harmless Hacking tries out this trick, you might get
in trouble with the law for conspiracy to damage other peoples? computers.?
The little devil says, ?But, Carolyn, tell people how to crack into root
and they will think you are KEWL!?
So here?s the deal. In this and the next few issues of Guide to (mostly)
Harmless Hacking I?ll tell you several ways to get logged on as the superuser
in the root account of some Internet host computers. But the instructions
will leave a thing or two to the imagination.
My theory is that if you are willing to wade through all this, you probably
aren?t one of those cheap thrills hacker wannabes who would use this knowledge
to do something destructive that would land you in jail.
*****************************
Technical tip: If you wish to become a *serious* hacker, you?ll need
Linux (a freeware variety of Unix) on your PC. One reason is that then
you can crack into root legally all you want -- on your own computer. It
sure beats struggling around on someone else?s computer only to discover
that what you thought was root was a cleverly set trap and the sysadmin
and FBI laugh at you all the way to jail.
Linux can be installed on a PC with as little as a 386 CPU, only 2 Mb
RAM and as little as 20 MB of hard disk. You will need to reformat your
hard disk. While some people have successfully installed Linux without
trashing their DOS/Windows stuff, don?t count on getting away with
it. Backup, backup, backup!
*****************************
*****************************
You can go to jail warning: Crack into root on someone else?s computer
and the slammer becomes a definite possibility. Think about this: when
you see a news story about some hacker getting busted, how often do you
recognize the name? How often is the latest bust being done to someone
famous, like Dark Tangent or se7en or Emmanuel Goldstein? How about, like,
never! That?s because really good hackers figure out how to not do stupid
stuff. They learn how to crack into computers for the intellectual challenge
and to figure out how to make computers safe from intruders. They don?t
bull their way into root and make a mess of things, which tends to inspire
sysadmins to call the cops.
*********************************
Exciting notice: Is it too boring to just hack into your own Linux
machine? Hang in there. Ira Winkler of the National Computer Security Association,
Dean Garlick of the Space Dynamics Lab of Utah State University and I are
working on setting up hack.net, a place where it will be legal to break
into computers. Not only that, we?re looking for sponsors who will give
cash awards and scholarships to those who show the greatest hacking skills.
Now does that sound like more phun than jail?
*****************************
So, let?s jump into our hacking basics tutorial with a look at the
wondrous anarchy that is the Internet.
Note that these Guides to (mostly) Harmless Hacking focus on the Internet.
That is because there are many legal ways to hack on the Internet. Also,
there are over 10 million of these readily hackable computers on the Internet,
and the number grows every day.
Internet Basics
No one owns the Internet. No one runs it. It was never planned to be
what it is today. It just happened, the mutant outgrowth of a 1969 US Defense
Advanced Research Projects Agency experiment.
This anarchic system remains tied together because its users voluntarily
obey some basic rules. These rules can be summed up in two words: Unix
and TCP/IP (with a nod to UUCP). If you understand, truly understand Unix
and TCP/IP (and UUCP), you will become a fish swimming in the sea of cyberspace,
an Uberhacker among hacker wannabes, a master of the Internet universe.
To get technical, the Internet is a world-wide distributed computer/communications
network held together by a common communications standard, Transmission
Control Protocol/Internet Protocol (TCP/IP) and a bit of UUCP. These standards
allow anyone to hook up a computer to the Internet, which then becomes
another node in this network of the Internet. All that is needed is to
get an Internet address assigned to the new computer, which is then known
as an Internet "host," and tie into an Internet communications link. These
links are now available in almost all parts of the world.
If you use an on-line service from your personal computer, you, too,
can temporarily become part of the Internet. There are two main ways to
hook up to an on-line service.
There is the cybercouch potato connection that every newbie uses. It
requires either a point-to-point (PPP) or SLIPconnection, which allows
you to run pretty pictures with your Web browser. If you got some sort
of packaged software from your ISP, it automatically gives you this sort
of connection.
Or you can connect with a terminal emulator to an Internet host. This
program may be something as simple as the Windows 3.1 ?Terminal? program
under the ?Accessories? icon. Once you have dialed in and connected
you are just another terminal on this host machine. It won?t give you pretty
pictures. This connection will be similar to what you get on an old-fashioned
BBS. But if you know how to use this kind of connection, it could even
give you root access to that host.
But how is the host computer you use attached to the Internet? It will
be running some variety of the Unix operating system. Since Unix is so
easy to adapt to almost any computer, this means that almost any computer
may become an Internet host.
For example, I sometimes enter the Internet through a host which is
a Silicon Graphics Indigo computer at Utah State University. Its Internet
address is fantasia.idec.sdl.usu.edu. This is a computer optimized for
computer animation work, but it can also operate as an Internet host. On
other occasions the entry point used may be pegasus.unm.edu, which is an
IBM RS 6000 Model 370. This is a computer optimized for research at the
University of New Mexico.
Any computer which can run the necessary software -- which is basically
the Unix operating system -- has a modem, and is tied to an Internet communications
link, may become an Internet node. Even a PC may become an Internet host
by running one of the Linux flavors of Unix. After setting it up with Linux
you can arrange with the ISP of your choice to link it permanently to the
Internet.
In fact, many ISPs use nothing more than networked PCs running Linux!
As a result, all the computing, data storage, and sending, receiving
and forwarding of messages on the Internet is handled by the millions of
computers of many types and owned by countless companies, educational institutions,
governmental entities and even individuals.
Each of these computers has an individual address which enables it to
be reached through the Internet if hooked up to a appropriate communications
link. This address may be represented in two ways: as a name or a number.
The communications links of the Internet are also owned and maintained
in the same anarchic fashion as the hosts. Each owner of an Internet host
is responsible for finding and paying for a communications link that will
get that host tied in with at least one other host. Communications
links may be as simple as a phone line, a wireless data link such as cellular
digital packet data, or as complicated as a high speed fiber optic link.
As long as the communications link can use TCP/IP or UUCP, it can fit into
the Internet.
Thus the net grows with no overall coordination. A new owner of an Internet
host need only get permission to tie into one communications link to one
other host. Alternatively, if the provider of the communications link decides
this host is, for example, a haven for spammers, it can cut this ?rogue
site? off of the Internet. The rogue site then must snooker some other
communications link into tying it into the Internet again.
The way most of these interconnected computers and communications links
work is through the common language of the TCP/IP protocol. Basically,
TCP/IP breaks any Internet communication into discrete "packets." Each
packet includes information on how to rout it, error correction, and the
addresses of the sender and recipient. The idea is that if a packet is
lost, the sender will know it and resend the packet. Each packet is then
launched into the Internet. This network may automatically choose a route
from node to node for each packet using whatever is available at the time,
and reassembles the packets into the complete message at the computer to
which it was addressed.
These packets may follow tortuous routes. For example, one packet may
go from a node in Boston to Amsterdam and back to the US for final destination
in Houston, while another packet from the same message might be routed
through Tokyo and Athens, and so on. Usually, however, the communications
links are not nearly so torturous. Communications links may include fiber
optics, phone lines and satellites.
The strength of this packet-switched network is that most messages will
automatically get through despite heavy message traffic congestion and
many communications links being out of service. The disadvantage is that
messages may simply disappear within the system. It also may be difficult
to reach desired computers if too many communications links are unavailable
at the time.
However, all these wonderful features are also profoundly hackable.
The Internet is robust enough to survive -- so its inventors claim -- even
nuclear war. Yet it is also so weak that with only a little bit of instruction,
it is possible to learn how to seriously spoof the system (forged email)
or even temporarily put out of commission other people's Internet host
computers (flood pinging, for example.)
On the other hand, the headers on the packets that carry hacking commands
will give away the account information from which a hacker is operating.
For this reason it is hard to hide perfectly when on the Internet.
It is this tension between this power and robustness and weakness and
potential for confusion that makes the Internet a hacker playground.
For example, HERE IS YOUR HACKER TIP YOU?VE BEEN WAITING FOR THIS ISSUE:
ftp://ftp.secnet.com
This ftp site was posted on the BUGTRAQ list, which is dedicated to
discussion of Unix security holes. Moderator is Aleph One, who is a genuine
Uberhacker. If you want to subscribe to the BUGTRAQ, email [email protected]
with message ?subscribe BUGTRAQ.?
Now, back to Internet basics.
History of Internet
As mentioned above, the Internet was born as a US Advanced Research
Projects Agency (ARPA) effort in 1969. Its inventors called it ARPANET.
But because of its value in scientific research, the US National Science
Foundation (NSF) took it over in 1983. But over the years since then it
gradually evolved away from any single source of control. In April 1995
NSF cut the last apron strings. Now the Internet is run by no one. It just
happens and grows out of the efforts of those who play with it and struggle
with the software and hardware.
Nothing at all like this has ever happened before. We now have a computer
system with a life of its own. We, as hackers, form a big part of the mutation
engine that keeps the Internet evolving and growing stronger. We also form
a big part of the immune system of this exotic creature.
The original idea of ARPANET was to design a computer and communications
network that would eventually become so redundant, so robust, and so able
to operate without centralized control, that it could even survive nuclear
war. What also happened was that ARPANET evolved into a being that has
survived the end of government funding without even a blip in its growth.
Thus its anarchic offspring, the Internet, has succeeded beyond the wildest
dreams of its original architects.
The Internet has grown explosively, with no end in sight. At its inception
as ARPANET it held only 4 hosts. A quarter of a century later, in 1984,
it contained only 1000 hosts. But over the next 5 years this number grew
tenfold to 10,000 (1989). Over the following 4 years it grew another tenfold
to 1 million (1993). Two years later, at the end of 1995, the Internet
was estimated to have at least 6 million host computers. There are probably
over 10 million now. There appears to be no end in sight yet to the incredible
growth of this mutant child of ARPANET.
In fact, one concern raised by the exponential growth in the Internet
is that demand may eventually far outrace capacity. Because now no entity
owns or controls the Internet, if the capacity of the communications links
among nodes is too small, and it were to become seriously bogged down,
it might be difficult to fix the problem.
For example, in 1988, Robert Morris, Jr. unleashed a "virus"-type program
on the Internet commonly known as the ?Morris Worm.? This virus would make
copies of itself on whatever computer it was on and then send copies over
communications links to other Internet hosts. (It used a bug in sendmail
that allowed access to root, allowing the virus to act as the superuser).
Quickly the exponential spread of this virus made the Internet collapse
from the communications traffic and disk space it tied up.
At the time the Internet was still under some semblance of control by
the National Science Foundation and was connected to only a few thousand
computers. The Net was shut down and all viruses purged from its host computers,
and then the Net was put back into operation. Morris, meanwhile, was put
in jail.
There is some concern that, despite improved security measures (for
example, "firewalls"), someone may find a new way to launch a virus that
could again shut down the Internet. Given the loss of centralized control,
restarting it could be much more time-consuming if this were to happen
again.
But reestablishing a centralized control today like what existed at
the time of the ?Morris Worm? is likely to be impossible. Even if it were
possible, the original ARPANET architects were probably correct in their
assessment that the Net would become more susceptible for massive failure
rather than less if some centralized control were in place.
Perhaps the single most significant feature of today's Internet is this
lack of centralized control. No person or organization is now able to control
the Internet. In fact, the difficulty of control became an issue as early
as its first year of operation as ARPANET. In that year email was spontaneously
invented by its users. To the surprise of ARPANET's managers, by the second
year email accounted for the bulk of the communication over the system.
Because the Internet had grown to have a fully autonomous, decentralized
life of its own, in April 1995, the NSF quit funding NSFNET, the
fiber optics communications backbone which at one time had given NSF the
technology to control the system. The proliferation of parallel communications
links and hosts had by then completely bypassed any possibility of centralized
control.
There are several major features of the Internet:
* World Wide Web -- a hypertext publishing network and now the fastest
growing part of the Internet.
* email -- a way to send electronic messages
* Usenet -- forums in which people can post and view public messages
* telnet -- a way to login to remote Internet computers
* file transfer protocol -- a way to download files from remote Internet
computers
* Internet relay chat -- real-time text conversations -- used primarily
by hackers and other Internet old-timers
* gopher -- a way of cataloging and searching for information. This
is rapidly growing obsolete.
As you port surfers know, there are dozens of other interesting but
less well known services such as whois, finger, ping etc.
The World Wide Web
The World Wide Web is the newest major feature of the Internet, dating
from the spring of 1992. It consists of "Web pages," which are like
pages in a book, and links from specially marked words, phrases or symbols
on each page to other Web pages. These pages and links together create
what is known as "hypertext." This technique makes it possible to tie together
many different documents which may be written by many people and stored
on many different computers around the world into one hypertext document.
This technique is based upon the Universal Resource Locator (URL) standard,
which specifies how to hook up with the computer and access the files within
it where the data of a Web page may be stored.
A URL is always of the form http://<rest of address>, where <rest
of address> includes a domain name which must be registered with an organization
called InterNIC in order to make sure that two different Web pages (or
email addresses, or computer addresses) don't end up being identical. This
registration is one of the few centralized control features of the Internet.
Here's how the hypertext of the World Wide Web works. The reader would
come to a statement such as "our company offers LTL truck service to all
major US cities." If this statement on the "Web page" is highlighted, that
means that a click of the reader's computer mouse will take him or her
to a new Web page with details. These may include complete schedules and
a form to fill out to order a pickup and delivery.
Some Web pages even offer ways to make electronic payments, usually
through credit cards.
However, the security of money transfers over the Internet is still
a major issue. Yet despite concerns with verifiability of financial transactions,
electronic commerce over the Web is growing fast. In its second full year
of existence, 1994, only some $17.6 million in sales were conducted over
the Web. But in 1995, sales reached $400 million. Today, in 1996, the Web
is jammed with commercial sites begging for your credit card information.
In addition, the Web is being used as a tool in the distribution of
a new form of currency, known as electronic cash. It is conceivable that,
if the hurdle of verifiability may be overcome, that electronic cash (often
called ecash) may play a major role in the world economy, simplifying international
trade. It may also eventually make national currencies and even taxation
as we know it obsolete.
Examples of Web sites where one may obtain ecash include the Mark Twain
Bank of St. Louis, MO (http://www.marktwain.com) and Digicash of Amsterdam,
The Netherlands (http://www.digicash.com).
The almost out-of-control nature of the Internet manifests itself on
the World Wide Web. The author of a Web page does not need to get permission
or make any arrangement with the authors of other Web pages to which he
or she wishes to establish links. Links may be established automatically
simply by programming in the URLs of desired Web page links.
Conversely, the only way the author of a Web page can prevent other
people from reading it or establishing hypertext links to it is to set
up a password protection system (or by not having communications links
to the rest of the Internet).
A problem with the World Wide Web is how to find things on it. Just
as anyone may hook a new computer up to the Internet, so also there is
no central authority with control or even knowledge of what is published
where on the World Wide Web. No one needs to ask permission of a central
authority to put up a Web page.
Once a user knows the address (URL) of a Web page, or at least the URL
of a Web page that links eventually to the desired page, then it is possible
(so long as communications links are available) to almost instantly hook
up with this page.
Because of the value of knowing URLs, there now are many companies and
academic institutions that offer searchable indexes (located on the Web)
to the World Wide Web. Automated programs such as Web crawlers search the
Web and catalog the URLs they encounter as they travel from hypertext link
to hypertext link. But because the Web is constantly growing and changing,
there is no way to create a comprehensive catalog of the entire Web.
Email
Email is the second oldest use of the Internet, dating back to the ARPAnet
of 1972. (The first use was to allow people to remotely log in to
their choice of one of the four computers on which ARPAnet was launched
in 1971.)
There are two major uses of email: private communications, and broadcasted
email. When broadcasted, email serves to make announcements (one-way broadcasting),
and to carry on discussions among groups of people such as our Happy Hacker
list. In the group discussion mode, every message sent by every member
of the list is broadcasted to all other members.
The two most popular program types used to broadcast to email
discussion groups are majordomo and listserv.
Usenet
Usenet was a natural outgrowth of the broadcasted email group discussion
list. One problem with email lists is that there was no easy way for people
new to these groups to join them. Another problem is that as the group
grows, a member may be deluged with dozens or hundreds of email messages
each day.
In 1979 these problems were addressed by the launch of Usenet. Usenet
consists of news groups which carry on discussions in the form of "posts."
Unlike an email discussion group, these posts are stored, typically for
two weeks or so, awaiting potential readers. As new posts are submitted
to a news group, they are broadcast to all Internet hosts that are subscribed
to carry the news groups to which these posts belong.
With many Internet connection programs you can see the similarities
between Usenet and email. Both have similar headers, which track their
movement across the Net. Some programs such as Pine are sent up to send
the same message simultaneously to both email addresses and newsgroups.
All Usenet news readers allow you to email the authors of posts, and many
also allow you to email these posts themselves to yourself or other people.
Now, here is a quick overview of the Internet basics we plan to cover
in the next several issues of Guide to (mostly) Harmless Hacking:
1. Unix
We discuss ?shells? which allow one to write programs (?scripts?) that
automate complicated series of Unix commands. The reader is introduced
to the concept of scripts which perform hacking functions. We introduce
Perl, which is a shell programming language used for the most elite of
hacking scripts such as SATAN.
3. TCP/IP and UUCP
This chapter covers the communications links that bind together the
Internet from a hackers' perspective. Extra attention is given to UUCP
since it is so hackable.
4. Internet Addresses, Domain Names and Routers
The reader learns how information is sent to the right places on the
Internet, and how hackers can make it go to the wrong places! How to look
up UUCP hosts (which are not under the domain name system) is included.
5. Fundamentals of Elite Hacking: Ports, Packets and File Permissions
This section lets the genie of serious hacking out of the bottle. It
offers a series of exercises in which the reader can enjoy gaining access
to almost any randomly chosen Internet host. In fact, by the end of the
chapter the reader will have had the chance to practice several dozen techniques
for gaining entry to other peoples' computers. Yet these hacks we teach
are 100% legal!
_________________________________________________________
Want to subscribe to this list? Email [email protected] with the
message ?subscribe happyhacker.? Want to share some kewl stuph with the
Happy Hacker list? Send your messages to [email protected]. To
send me confidential email (please, no discussions of illegal activities)
use [email protected]. Please direct flames to dev/[email protected].
Happy hacking!
Copyright 1996 Carolyn P. Meinel. You may forward the GUIDE TO (mostly)
HARMLESS HACKING as long as you leave this notice at the end..
________________________________________________________