archive:news:leftist
This article appeared in the August 22,1990 Wall Street Journal
Open Sesame
--------------
In the Arcane Culture Of Computer Hackers, Few Doors Stay Closed
--------------
Frank Darden Easily Broke Into BellSouth's Network
Trading Tips With Others
--------------
Entering the Legion of Doom
--------------
By John R. Wilke, staff reporter of The Wall Street Journal
ATLANTA- Frank Darden got his first computer at the age of 16, a
Christmas present from his parents. Sitting on a desk in his bedroom,
it opened a window on a world he found so consuming that he quit high
school and spent most days and nights at the keyboard.
His parents often wondered what their son found so compelling in the
endless hours he spent alone in his room. Then one afternoon last
summer, a dozen Secret Service agents burst into the family's suburban
home. Agents held Edward and Lou Darden at gunpoint as they swarmed
into their son's room, seizing scores of disks mloads of files and
three computers.
When Frank got home an hour later, the terrified young man confessed that he had used his home computer to break into BellSouth Corp.'s telephone network. In February, Mr. Darden and two others were indicted on felony charges of conspiracy and wire fraud.
"I guess now my parents know what I was doing in my room." says a remorseful Mr. Darden, a bright, impatient 24-year-old with shoulder-length hair and a tie-dyed T-shirt.
Just Passing Through
Mr. Darden thus became another of the growing number of "hackers" nabbed by federal agents. For a long time, these high-tech trespassers operated in relative obscurity, using their computers and phone lines to go where few people were meant to go. But lately, in a string of highly publicized cases, hacking has moved towards the forefront of white-collar crime. Increasingly, banks, businesses, credit bureaus and telephone companies are discovering that someone, often in the dead of night, has wandered into their computer systems- and left his mark.
As Mr. Darden's experience reveals, hacking has developed its own subculture, rich with literature and legend and peopled by electronic vandals, voyeurs and explorers known by fanciful code names. "Any business that has a computer hooked to a phone is vulnerable," warns Mr. Darden, who calls himself the "The Leftist." Before the bust, he was one of the best.
Starting Early
An early target in the crackdown was the Legion of Doom, an elite clique of hackers that included Mr. Darden and was targeted by the Secret Service because of its members' notable skills. "The Legion of Doom had the power to jeopardize the entire phonetwork," says Kent B. Alexander, an assistant U.S. attorney prosecuting Mr. Darden's case in Atlanta.
In a Secret Service affidavit filed in U.S. District Court in Atlanta, BellSouth investigators call the Legion of Doom "a severe threat to U.S. financial and telecommunications industries." Federal agents suspect the Legion was responsible for software " time bombs" - destructive programs designed to shut down major switching hubs-planted in telephone company computers in Denver, Atlanta and New Jersy last year. The programs were defused before causing damage, investigators say, but the intrusions, which weren't disclosed by the phone companies, could have knocked out service to hundreds of thousands of customer phone lines.
The government sweep so far has bagged a motley band, mostly loners and young rebels in their teens or early twenties. In past cases, many of the hackers who have admitted breaking into computers have insisted that they didn't damage the systems they penetrated. They did it for sport.
"There's no thrill quite the same as getting into your first system," says Phrack, an electronic magazine run out of a University of Missouri dorm and accessed by computer. Before it was shutdown in the latest sweep, Phrack (for phone-freak hacking) published tips on cracking computer security. One issue offers a "hacker's code of ethics," which advises, "Do not intentionally damage any system" or alter files "other than the ones you need to ensure your escape." Another rule: "Don't be afraid to be paranoid. Remember, you are braking the law." Mr. Darden says he strictly adhered to the code.
But the hackers' creed means nothing in court. There, hacking is treated much like any other form of criminal trespass under a law Congress passed in 1988. The law persuaded many hackers to end their illicit forays. But it turned other hobbyists into criminals.
During his hacker days, Mr. Darden's world was an oddly solitary one. For hours on end he sat in front of the computer screen, finding his only human contact in the words and arcane code that arrived via computer from other hackers. "Once he got into ubject, there was no stopping," recalls his mother. "he was always studying up on something. He read encyclopedias as a pastime."
Geography was meaningless; friends from around the world were just a few keystrokes away, thanks to modems that connect computers through the phone lines. Mr. Darden says he has struck up many lasting friendships on-line with people he has never met in person.
In this silent, cerebral world, age is also irrelevant. Only computer skills count. Once on-line, a hacker can be anyone he or she wants to be. "No one knows if you're fat, pimply, or scared to talk to girls," says Sheldon Zenner, a Chicago attorney w recently defended an editor of Phrack on felony wire-fraud charges. "Suddenly you're no longer just the shy adolescent, but Knight Lightning or The Prophet."
Tough Choice
"It's a compulsion for some of these people," adds Mr. Alexander, the Atlanta prosecutor. "I'm convinced that if Lotus 1-2-3 was behind Door No. 1, and Cheryl Tiegs was standing behind Door No. 2, a hacker would go for the software.
Mr. Darden recounts his hacking days with disapproval- and just a touch of pride. He broke into his first system at the age of 17, dialing his way into a big computer at Hayes Microcomputer Products Inc., in Norcross, Ga., and nosing around the system I didn't take anything, I was just trying to see if it could be done," he says now. Hayes uncovered the breach and quickly tightened security, he says.
Hacking sessions often stretched into the early morning hours. He would start by checking lists of computer phone numbers collected by his computer the night before through an automatic process called "war dialing." That's the brute force approach to king, when the computer runs through the night, methodically dialing every number in a telephone exchange. It records the number whenever it hits a "carrier tone" signaling a computer is on the other end.
In a typical night of war dialing, in which the computer might check thousands of numbers, perhaps 100 computer carrier tones would be unearthed, "each one a potential treasure chest," Mr. Darden says. He would then begin calling down the "hit list" with his computer, each time trying to determine what kind of system was on the other end. Fax machines were a problem, because they emit a tone that sounds like a computer, so he wrote software that ignored them.
Hello, Are You There?
Each kind of computer had a distinctive response to his call, so he would tailor his approach to the type of system he encountered. Computers that used the Unix software operating system were especially easy to break into, while Digital Equipment Corp.'s VAX computers, which have multiple levels of security, presented a bigger challenge. But he says he was fond of the VAX because of its widely used software. "For a hacker, the VAX is like putting on an old Jimi Hendrix record in a bar- it's a real clasic." Using purloined telephone credit-card numbers, which his computer generated through a trial and error, he got into computers all over the world, including an encounter with a VAX that spoke Finnish.
He devised password-cracking programs that automated the hacking
process. He also devised a program that let him capture legitimate
users' passwords as they logged onto the system. When he found a
password the target computer recognized, his screen wo typically
respond with a prompt, such as a sign. "Once you get that, you have an
open door," he says. Often he would play "cat-and-mouse games" with a
company's computer operators. "I'd send a little greeting to their
printer, to let them know I was there. It drove them crazy."
Credit bureaus were a favorite target. And, despite the warnings of
other hackers that it might give him away, his first move was to look
up his own credit report. "Naturally, I didn't have one," he says. He
found his parents' report, and looked up ot s for friends.
To make the process more efficient, and to show off, Mr. Darden and other hackers traded phone numbers and system-cracking tips on pirate "bulletin boards"- computer systems that store and forward text and electronic mail over phone lines. "Black Ice" is one such board. Access was tightly limited to an elite circle.
No Busy Signal Here
Mr. Darden's biggest thrill as a hacker- and ultimately his downfall-
came when he broke into a big BellSouth computer in Atlanta used by
technicians to maintain and control the phone system. He learned how to
navigate within the system by asking questions of BellSouth's own
on-line "help" program. Once inside, he found he had the ability to
reroute telephone calls or bring down switching centers, neither of
which he says he did. Mr. Darden did, however, listen in on a few phone
lines, but only those of other hackers, he insists, and only to prove
his prowess.
"If we wanted to, we could have knocked out service across the Southeastern U.S.," he says. "The fact that I could get into the system amazed me. But we were careful not to damage anything."
Not surprisingly, when BellSouth discovered hackers were rummaging
through its computer, it reacted swiftly. It put 42 investigators on
the task of tracking the intruders down, and spent $1.5 million on the
effort. Once it found the source of the intrusions, it called the
Secret Service, which enforces computer-crime laws.
In the indictment, Mr. Darden and two co-defendants, Robert J. Riggs, 21, a.k.a. The Prophet, and Adam E. Grant, 22, a.k.a. The Urvile, were charged with taking copies of proprietary software from BellSouth during their ramblings in the system, and with unauthorized intrusion, possessing illegal phone credit-card numbers with intent to defraud, and conspiracy. Messrs. Darden and Riggs pleaded guilty to conspiracy and face a maximum of five years in prison and a $250,000 fine. Mr. Grant pleaded guilty to possessing BellSouth computer access codes with the intent to defraud and faces a maximum of 10 years in prison and a $250,000 fine. Sentencing is scheduled for Sept. 14.
The only good thing to come out of the whole experience, Mr. Darden muses, is that after he was indicted, his high-school sweetheart- whom he often spurned in favor of his computer- saw his picture on the front page of the local paper and got back in ch.
Mr. Darden, who now works installing systems for a local computer
company, views himself as a purist, hacking for the thrill of exploring
the forbidden. He looks down on those who use their skills simply to
steal phone and credit-card numbers. But in thi s game, information is
everything, and not even Mr. Darden can control its spread. During
their sweep, federal agents have found some hackers using code-cracking
information dug up by the Legion of Doom to perpetrate their own
practical jokes and fraud.
For a few days last year, for example, phone calls to the Delray Beach, Fla., probation office were mysteriously rerouted to a dial-a-porn line in New York. Secret Service agents say it's the kind of thing the Legion might have done.
And in Elwood, Ind., a 15-year-old calling himself Fry Guy allegedly used information he got from the Legion to carry out an elaborate fraud. Secret Service agents say he used his computer to break into a credit rating service in Maryland to pilfer VISA and MasterCard credit information. He then entered BellSouth's control network and altered a pay phone on a street corner in nearby Paducah, Ky., to residential status. Next, he called Western Union and had cash wired out of credit-card accounts to the Pa ducah Western Union office. When Western Union called the credit-card holders to verify the transactions, the calls were forwarded to the pay phone and then to the youth's home phone, where he posed as the credit-card holders and gave approval. The cash w as then picked up at the Western Union window, investigators say.
In all, Fry Guy siphoned more than $10,000 in cash and purchases from
credit-card accounts, alleges William M. Gleason, the Secret Service
investigator. He also found evidence that Fry Guy, whose name hasn't
been released, hacked his way into a payrol computer for a local
McDonalds Corp. outlet, giving pay raises to his friends working at
the restaurant.
Fry Guy's case is being handled by state and federal juvenile authorities and, because of his age, it is unclear what punishment he might get. At the very least, his parents are likely to watch the family phone bill more closely. In a recent meeting w federal prosecutors, Fry Guy's exasperated father wore a baseball cap bearing the legend "Kids: They'll drive you crazy."
Federal agents admit that, when they detect an intruder inside a computer, there isn't any way of telling if it's a precocious teenager or a crook out to commit fraud. So they simply execute the law.
"When a hacker gets into a system, it's no different from a burglar breaking into your home or office," says Secret Service agent James Cool. If the door is open, the law treats a trespasser differently, he adds. But if a hacker cracks a password to g into a system, "it's the same as kicking in a locked door- and we're going to come after them."
Ed Darden wishes he had known all of this before he gave his son that Apple II for Christmas eight years ago. "I'd have thought twice about it," he says. "Maybe we should have given him a bicycle."
- end of file*
/data/webs/external/dokuwiki/data/pages/archive/news/leftist.txt · Last modified: 1999/08/01 17:08 by 127.0.0.1