We're gonna talk today a little bit about what hacking was like, and freaking
was like, and what the what the whole scene was kind of like back in the 80s
and 90s. You know, how did this start? What was it like back then? And how does that
lead us to where we're at today? And what does that mean for us kind of going
forward? All these views and opinions are obviously my own. You know, everybody's
experience might be a little bit different. So if anybody during the talk
wants to, you know, bring something up or interject something, by all means. You
know, this is a very a very social talk, right? So feel free to interject things
and to jump in if you like. So the talk is hacking the day, playing words for
back in the day, right? So who am I? My name is Brad Swanson. You can find me on
Twitter is Digital Templar or you can just shoot me an email at gmail. I am the
incident response lead currently for a SAS provider based out in California.
Formerly I've been with Amazon with Thermo Fisher Scientific in a variety of
security or audit related roles. A lot of PCI, a lot of SOX, a lot goodness. I've
been doing security stuff for about 25 years now. Most of it as a good guy. The
early years were a little sketchy, obviously, as many of us had. I got started
in the 80s. My folks bought me an Osborne back in the day and I got the Osborne in
January. I had a colossal caves adventure. Was sick of the pirate killing me in the
twisty passages. So by February I was learning how to take it apart and fix
the software so the pirate wouldn't kill me all the time.
Careered back in the day for frozen crew at a really, really slow baud rate which
led to a recreational interest in how phone systems worked to help cut down on
my electric or my phone bill. Some of the things I like... social engineering. I love
social engineering stuff. I just find it fascinating how you can hack
people's brains. Red teaming. I want to be a red teamer when I grow up. And I also
like romantic walks on the beach while sniffing Wi-Fi. So the standard
disclaimer. These are my experiences. These are my views, my opinions. They do
not reflect any stance of my employer, any stance of the team that I
work with, etc. etc. My views only. My employer wouldn't even know that I'm here
except my boss is in the audience right now. So everybody clap when we're
done here. Not now. Not now. Just when we're done. Yeah. Also some other just
extra information. If anybody has peanut allergies, look out for me. I'm like
peanut dust. It's not good. So we're gonna cover basically three different kind of
areas at a very, very high level here. We're gonna look at the social aspects.
You know, what was it like back then and how is it now? Obviously, hacking has
become a very social thing. We're all here. You know, we're all at CypherCon.
We're all interacting with each other. It's not just, you know, I'm in my own
little area with my head down, hacking away on a keyboard. We're talking with
each other. We're learning from each other. We are, you know, interacting and
interfacing as humans rather than just, you know, a name on a screen in green
font. We're also gonna look at hacking. What are some differences between hacking
back then and hacking now? And we'll touch a little bit on freaking as well
and what the good old days were like versus what it's like today. So the
social aspect. Back in the day, hacking was not as, I guess, anonymous, if you
will, as it is now. It was started by friends. It was groups of friends that
had something that brought them together other than hacking. So we have like the
414s, for example, right here in Milwaukee. The 414s were actually a
group of friends. They were Explorer Scouts. You know, they knew each other and
they had an interest in computers. Sure. So they would kind of go with the, you
know, go out and explore things and then they found out that they could explore
with their computers. And so that led to a little bit of trouble. They hacked a
bunch of systems. They got into Sloan-Kettering. I went to touch the log
files to make sure that they didn't get caught and did a little bit of damage
financially. About $1,500, I believe. And that's what got them popped. They ended
up on the cover of Newsweek. People had not really been exposed mainstream to
hackers before, right? So it was a big deal. People didn't know how to
deal with them. A couple of them were charged with like a toll fraud type of
charge. But there were no computer crime laws really back then. So yeah. So then
again, a group of friends that started out. You know, there was the firm. They
were initially called Kilobot. They did a lot of sys-opping of bulletin board
systems. If it was a hacker board, a lot of times it'd be somebody from the firm
that would help out with the sys-opping of that. There was the Loft. Loft
Heavy Industries out in Boston. That started as roommates. It was a
couple of guys that were roommates. Their girlfriends, they had a loft area
in Boston. And their girlfriends had a hat company. They sold hats out of this
loft. They, you know, made hats and sold them. They used the other half of the
loft to store equipment that they got from the flea market at MIT. So they
would get all this equipment. They'd bring it in. They'd hack around on it.
They'd fix stuff up. They'd do cool things. And then they'd flip it. And it
turned into basically what was the equivalent of the first hacker space.
Where, you know, their friends would come over and hack around on hardware. We had
Cult of the Dead Cow down in Lubbock, Texas. There were a bunch of friends that
worked together at a meatpacking plant. Hence the name Cult of the Dead Cow. They
dealt with dead cows all day. And so again, you know, groups of friends that
were friends before they were a hacking group, right? Then it expanded a little
bit, right? So you've got these friends that you're hanging out with and doing
computer coolness with. What if we could meet more people? Well, how do we do that?
How do we spread the word? How do we get the word out there? BBSes. Let's advertise
on BBSes. Let's spin up a hacker BBS. Let's have some some text files that we
can, you know, have people come and read and learn a little bit. You know, we had
things like the Legion of Doom, which was run by FiberOptic. There was Masters of
Deception with Eric Bloodaxe, who used to be part of Legion of Doom that are falling
out and they split off. You know, there are courier groups like Fairlight, Frozen
Crew, you know, and they were, you know, they started as friends and then they
expanded out. They brought in people that they didn't know that weren't part of
that core group of friends. Now it's a it's a hacker friend. It's my online
friends, my BBS friend. And then, you know, how do we how do we advance that? How do
we grow that? How do we take that another step further? Let's meet people face to
face. You know, kind of scary, but let's let's give it a shot and see what
happens. So there were things like the Chaos Communications Congress. This
took place in Germany. It was run by the the CCC, the Chaos Computer Club, and it
basically brought European hackers together to kind of learn from each
other and share things. We had the Hackers Conference. There was a book
that was written, I don't recall the name of the book specifically right now, my
apologies, but there was a book that was written that talked about a bunch of
hackers and somebody said, hey, let's let's have a conference in California
and let's invite these hackers that this book talked about and get them all in
the same room. Let's see, once we put all these people together, what they can come
up with. That might be kind of cool. We had DEF CON. DEF CON was 1994 and it was
meant to be a one-shot deal. It was supposed to be like a big farewell blow
out party to say goodbye to BBSs because BBSs started to die out in the mid
90s with the advent of the Internet, right? So, you know, Jeff said, hey, let's
let's have a big party, say goodbye to the BBSs and we're done. We move on.
Well now DEF CON continues and continues and continues and it's it's grown into
something very large and cool. So and then we have Hackers of Planet Earth.
It's a New York conference that gets that's been around since I want to say
95. Another, you know, another conference where let's just get people in the room
and talk to each other about what we're doing. What are we, what are we
hacking on today? So that's changed. Now what we have is a much more direct
experience kind of, right? A lot less, a lot less of the anonymous communication, a
lot more face-to-face. So there's a lot of regular meetups. We have things like
MilSec, we have BurbSec for, you know, these are some of the local, local get-togethers
where people get together and they talk about things. Hey, I figured out how to do
A, B, and C. Or, hey, I'm trying to figure out how to stop this person from, you
know, coming in and doing horrible things through my OWA portal. You know, it's a
it's a way that we can bounce ideas off each other and and learn from each other.
There's local 2600 groups that get together. You know, there's, there's local
DEFCON groups. There's the DC414 group, which is phenomenal. There are, you know,
DEFCON groups pretty much all over the country, all over the world. Twitter.
Twitter has become a huge thing. There is some, there's a lot of noise on Twitter.
There's a lot of shit posting. But there's also a lot of really good
information. You know, looking out just in this room, I see a couple of people in
this room that I follow. A couple of people that have really good info. And
it's, it's nice to be able to hop on and check a spot and see what's going on in
the world. Sometimes it's bad if it's a Friday afternoon and Tavis Orvandy posts
something and you're like, oh, I'm not going home tonight. But, you know, it's,
it's a good way for various people to be able to stay in touch. So, you know,
hackers will use Twitter. Companies will, will post things. You know, maybe a
company is coming out with a new product. Zero-day announcements, you know,
that Tavis seems fond of on Fridays. And so, you know, it's, it's a good, it's kind
of a good way to kind of keep your pulse on things almost, almost real-time. And
then we have conferences, right? Conferences have become kind of a big
thing now. There are a lot of conferences, a lot of people go to. There's obviously
CypherCon, right? There's Black Hat. There's DEFCON. DEFCON actually made it
25 years before being canceled this year. I'm not sure if anybody heard that that was
canceled. But there's, you know, there's ThoughtCon in Chicago. So there's a lot
of kind of face-to-face, meet the people you're talking to that are on the other side
of the keyboard. In the old BBS days, you could talk to somebody for years and not
know what they look like. Not know who they were with, with the conferences and
stuff. It kind of puts a face to the name, which is nice.
ANSI art, right? Some people have to remember ANSI art. ANSI art was awesome.
It was like a, like a bulletin board for your BBS. The cooler your ANSI art, the
cooler your bulletin board. Well, at least that's what people thought back then
anyway. So ANSI art was a big deal. And people would get on BBSs sometimes just
to grab ANSI packs and move them around and, you know, find something cool on this
BBS. Oh, I want that on my BBS. I'll download it and install it. BBSs were
really kind of the lifeblood in the growth of hacking. You know, it was, it was
a way that you could get outside of, you know, your, your, your basement or your
bedroom or wherever your computer was and, and talk to people. You know, you
could, you could trade wares on a BBS. You could download e-zines. There were a
lot of communications that people started putting together. There was FRAC.
There was CDC communications. There were, you know, several different groups that
would write up these e-zines about these hacks that they were doing or these
projects they're working on. And then those would be distributed throughout
the BBSs, you know, via couriers and people, you know, grabbing it from one
uploading it to another. BBSs really started to die around 94 when the
internet took off. There's still a push. There's still some old people like
me that are diehards, right? You can still download BBS software and run it on
your servers. You know, instead of dialing in, people will tell not to. And,
and, you know, it still has the same functionality. You can run Dora games
and, you know, download files and everything. The thing with BBSs is you
had to bring skills to the table back in the day, right? You had to be leaked,
right? Otherwise, you weren't welcome. You know, it was kind of looked at as we
have this hacking group, we have our BBS set up. What can you give us? What can we
take from you? What skills are you bringing to make us stronger as a hacking
group? You know, we're, we're LOD and we have, we have this big beef right now
with MOD. And so we want better things and they've got what have you, what do
you have that you're gonna contribute to us? If you had nothing to contribute,
that was it. Forget it. Don't worry about it. You know, go somewhere, go, go hop on,
you know, Prodigy or something. If you had skills, if you were good, you could get
vouched for. You know, and a lot of times it required somebody that was already a
member to say, oh yeah, I know Ed, I know Sarah, they're good people. Let them in.
They know what they're doing. They're, they're really super elite hackers. And it
was, in my opinion, it was kind of crappy because it kind of stagnated that talent
pool. You might have somebody very intelligent that doesn't have that
skill set yet that wants to learn it. They weren't able to, you know, unless
they did a lot, a lot of work on their own to try and figure it out. So part of
the reason was they wanted those bragging rights that our, our BBS is
awesome. Our hacking club is awesome. But they also were very worried. There are a
lot of busts that were going on for hacking and for, you know, piracy, things
like that. There were a lot of people that when they would get arrested back
then, the first thing they would do is, hey, do you have a notepad and a piece of
paper? I will give you the name of everybody on that board and all the
stuff that they're doing. So a lot of people kept it a very small, close-knit
community just for a safety factor. Just to keep from, from getting arrested
themselves. So now, I mean, it's really grown how we, how we do our communications.
You know, we use websites and Twitter and Tor and YouTube. You know, we have, you
know, different file sharing networks that, that we use. And it's really kind
of expanded the reach, right? So BBS's used to be mostly your local area code,
right? You'd have, you know, like, people will dial into this 414, but they're not
gonna dial into a, you know, a 702 Las Vegas BBS because, well, that's long
distance. That's gonna rack up a huge phone bill, unless you do weird trickery,
which we'll get to in a bit. You know, so it was, it was local. Whereas now with the
Internet, it's worldwide. You know, you, you know, one, one minute I'm talking to
somebody on Twitter that's sitting two desks away from me that I work with, and
two minutes later I'm talking to somebody in Turkmenistan who I've never
met before, but has some good information. We're having a good
conversation about stuff. So it's really kind of expanded that world to us. It's
really opened things up. And you can do it from anywhere. It used to be, oh, what
are you doing tonight? I'm gonna go home, boot up my computer, get on the BBS. Now,
I'm gonna whip my phone out of my pocket and check Twitter quick. You know, it's,
it's become with, you know, with smartphones, it's become much easier for
us to stay in touch and to communicate with each other. Now, instead of having to
be elite and having skills that you bring to the table, you need to bring
that desire and that drive. And that's, that's all that you really need for
somebody to reach out and say, hey, you know, I like the fact that you want to
learn. I'm more than happy to teach you. I will teach you whatever you want to
know. And we see that a lot. We see a lot of security groups within companies
bringing on people that maybe don't have security experience, but they want to
learn about it, right? We want those people. Those people have that drive. They
have that, that ability to learn. We can teach security. We can't teach drive,
right? You know, and it's, it's a lot easier for these people to learn stuff
too. They don't have to get access to a board to get all this information. It's
all out there. It's all over the internet. You know, you go out to YouTube, you
watch a video, you can learn how things work. You know, you can go and, you know,
buy something at DEF CON and then get on YouTube, learn all about it. And, you
know, now you're able to go in and pop boxes. Which, good and bad, depending on
what side of the fence that you're on. You know, it used to be that this
knowledge would die out with people, right? But now that we're able to teach
the new generation and the younger people that are coming up through the
ranks that maybe don't have that skill set, it keeps it alive. And that's kind
of the point of this talk. Is we want to keep this, this past in this history. We
want to keep this alive and remember, you know, where we came from. Because that
helped us get to where we are today. And where we are today is gonna determine
where we're going tomorrow. And so, it's very important to not only talk about
the past, but to talk about what we're doing today and in the future. You know,
30, 30 years ago we're on BBS is doing this stuff. Where are we gonna be 30
years from now? Probably talking about how I remember back when we used to use
Twitter and, you know, communicated with each other. So, yeah. So, it's opened us up
to a very nurturing type of environment. Which, which is good. You know, the more
people will learn about this, the better off we're gonna be. So, hacking back then.
Hacking back then was super easy, in my opinion, compared to now. You could do
simple things. There, there are a lot of issues with things like file
permissions, processes having way too many rights. One of my favorite things
back then was you could link the password file to the dead letter file
and then just send an email from nobody to nobody that contained a password file
entry. In less than a minute, you've got a root account on the box and you can
pretty much do what you like on it at that point. You know, password management.
People didn't really give a lot of thought about that back then. You know, in
the 80s, as long as you had a password, that thing was super secure. Never mind
the fact that the password is 1, 2, 3. You know, once you got a password, nobody
will get into that. Security, then more so even than now, I think, was an
afterthought. I mean, it's still, in some companies, kind of an afterthought. You
know, oh, we rolled out this new product. Did you secure it? Well, what can we do to
secure it now that it's rolled out? That was a lot more prevalent back then. And
as I mentioned, a lot of programs that ran as root had a lot of
issues. You know, you could get a program running as root and then
just crash it and take over that process space. You could overwrite files.
SendMail. SendMail was the bane of security people's existence for years
and years and years and years. So back then, if a system had a password, it was
probably super easy to guess. It was probably 1, 2, 3, 4, 5, 6 or it was
password or, you know, the the person's birthday or their wife's name or their
husband's name or the dog's name. Complexity wasn't forced back then, like
it is now. Exploits were a lot simpler. Somebody's got bad permissions, let's
just exploit that. Bam, we're in. You know, or processes had way too much
privilege available to them. There's no reason that a process that maybe
writes a, writes a file, that it needs root access to everything. Servers sat
alone and in the dark. They were neglected. They were like mushrooms. If it
was a night or a weekend, odds are that server is locked away and nobody's
looking at it. You know, the sysadmins went home. You know, we didn't have
things like a sock that were watching over all these servers. They were
lonesome and sad. And modems were plugged into everything. You know, war dialing was
a big thing. War dialing is where you set your modem to just dial every number
in a list until it finds a carrier and then it logs that number. Hey, I found
something living here. And then you go back, you look at your list and you call
them up. You see what lives there. A lot of servers had modems plugged in for
maintenance modes. If you had like a like a big HP 9000, odds are there's a modem
plugged in the back so that when you have problems, HP can dial in and fix it
for you. Exploring humans can also dial into that and try and unfix it for you
as well. We also didn't have things like bug brownie programs. So if there's an
exploit, it didn't get reported right away to the company all the time, right?
That exploit might live on for months or a year or years. You know, it was the type
of thing where finally a good person would see that and would notify the
company, hey, there's a problem with this. Or they would write, you know, write their
own updated drivers or updated code that fixed it. But there weren't official ways
really back then to report these bugs that were found. Nowadays, the difference
is being that a lot of the vulnerabilities can be very technical.
You know, Spectre and Meltdown are good recent examples of vulnerabilities that
are tougher to exploit. It's not as easy as something having bad permissions or
being able to overwrite a config file. You know, you have to jump through a lot
of hoops if you want to exploit Meltdown and Spectre compared to, you know, the old
days. Nowadays, it really, really helps if you can program. You don't have to be like
an uber developer, but if you know some Python and know PowerShell, if you've
used Metasploit a bunch and know some of the better modules, it really makes
life easier from a security perspective. And sometimes now, instead of being a
one-shot deal where, okay, I'm going to link this file and send an email. We're
done. We're in. Now there might be several steps required. Okay, I'm gonna create this
config and now I've got to link these files. And now I've got to move this file
over here. A lot more, a lot more of a process now to get this kind of all
pushed through. Blue teams. Blue teams have really thrown a monkey wrench into
hackers trying to get into systems. We have socks. We have blue teams. Blue teams
are very skilled. Blue teams have all kinds of training. There's a lot of
knowledge that's shared so that they're able to detect things quickly. Systems
are monitored 24-7. Even if you don't have a human sitting there looking at it,
we have things like Nagios and various monitoring tools that will let us
know the minute something goes a little screwy with that box. And as soon as it
does, somebody's getting a page, getting woken up, and they're hopping on to see
what's going on. So nights and weekends are no longer the sweet spot. We also
have new technologies available to us. We have, you know, we have SIEMS. We have
IDS IPS. You know, we mentioned like infrastructure and system monitoring. And
they're gonna tell on you. They're gonna call somebody. They're gonna
wake somebody up in the middle of the night. That person's gonna be mad about
being woken up in the middle of the night. And they're gonna come and look
for you. You know, again, back in the old days, wasn't quite like that. They might
find out that you were in there on Monday when they come in. So the one thing
that stays the same is that humans are involved. Humans are always involved.
There's always a human somewhere in the chain, right? And humans are unpredictable,
unpatchable, and under deadlines. Now you'll notice that unpatchable has an
asterisk after it. And this is really small print. I apologize for that. But the
the disclaimer is, humans can be patched through continuous security education.
Unfortunately, a lot of companies don't do this. But it's a very good point that
that was was brought up. I believe Jason, you had mentioned that recently. That
humans are patchable. Saying a human is unpatchable is not exactly accurate. The
thing that we need to do as companies is make sure that we do patch our humans.
So we continue a continuous security education kind of regimen. People are
helpful. It's just in our nature. We, you know, it's the golden rule, do unto
others. If I need something, I want somebody to help me. Likewise, if somebody
else needs something, I'm going to help them. But it's this helpfulness that can
be exploited. Humans can bypass two-factor every time. So I worked for a
company previously that we had our red team came in to do a pen test. They
couldn't get in through the conventional means. They were just popping through our
firewall. They called one of our users up. Hey, we need your password. User gives it
out. Yeah, we're cool. We got two-factor, right? Saves everybody. They hit the
two-factor. They called the user back. Hey, you know, we tried logging in as you to
fix this problem, you know. They post as IT. You know, you logged in to fix this
problem. We're getting this two-factor thing. Could you do me a favor and read
me the code off your phone? And they did. Five times in one day. Yeah, it wasn't, it
wasn't a good day for us when we had to report to the sea levels about that. The
good thing is, is that person still works for the company. The company did not come
down on that person and say, oh, you're a horrible person. You gave out your
two-factor code. You're fired. The company used it as a training opportunity. They
said, hey, here's an, here's a, an opportunity for us to provide more
education to this individual. Let's explain to this person why what they did
was wrong and how to not fall for this in the future. Which I think really needs
to be the path that's taken. So often companies like, oh, you know, Ed screwed up.
Let's can him. That's, that's not the solution because you're just gonna get
another Ed in. Who's gonna fall for it? Improve your, your, your training posture.
And that's, that's how you fix that. Humans can forget the details of your
social engineering attack. You know, that's the, that's the old thing of be
likable and forgettable. You want that person to like you, but you want them to
forget about you as soon as you're out of their sight. Humans can make you
appear legitimate to others. They provide that legitimacy. So if I want to get in, I
want to get information off the, the CISO at a company, I'm not gonna go straight
to the CISO and, and try, you know, just saying, hi, my name is Bill and, you know,
I'm with your, your cloud service provider, but I'm gonna go to some of that
CISO's underlings. I'm gonna get in good with them. That might be an easier avenue.
Once they are vouching for me, that gives me credibility with that CISO. And humans
are everywhere. You know, like I said, if, if it's a company, there's probably a
human at it somewhere in that food chain, right? Eventually, you'll find that
human and you can try and exploit that. Systems rely on logic, right? Very
logical, you know, one zero. Humans rely on emotion. If you can play to somebody's
emotions, it's done. You're in. And that's, this has stayed the same. In the, in the
80s, people were pretty much guaranteed way in. In the 90s, it was that way. Now,
it's still that way. You know, how do we fix it? Again, education. Let's, let's
train folks and let's show them the right way to do things rather than scold
and fire and be growly and mean. So, I'm sure some of you have seen the movie
Hackers. Norm was my absolute favorite. Norm was the security guard. So, so
basically what happens is, Dave calls him up, says, you know, hey, the file I was
working on is lost. My, my, my BLT drive went AWL. He looks around his room and he
sees an empty food container and he thinks, a BLT drive. Norm doesn't have the
education he should, as far as security stuff. So, he doesn't know that this is a
line of crap that he's being fed. He doesn't, yeah, he doesn't understand that,
you know, it's, it's not a real thing, a BLT drive. And back then, people were not
comfortable around computers. In the 80s and 90s, computers were still, you know,
in the mid 80s, not every house had a computer. I mean, computers were
expensive. I had to beg my parents for years to get one and it took my friend
getting a K-Pro before I got an Asborne. I was like, ah. People were very scared of
breaking things and very scared of being in trouble. You call somebody at work and
you're like, you screwed up your computer. Yeah, this, this is Frank from IT and you
just broke your junk. They're gonna panic, right? They're gonna freak out. I'm
gonna get fired. It's that, that same fear thing. They're, they're a little more
comfortable with computers now. Everybody pretty much has a computer at home, or I
should say a lot of people. They're more comfortable with doing things on it. But
back then, it was real easy to have people fearful of their terminal. So, you
could get them to do bad things and they wouldn't be suspicious. Yeah, hi, I'm from
IT and you did something wrong. They'll do whatever you want then at that point.
I'll just fix it, make it go away. So, that brings us to freaking. So, freaking, back
in the, back in the old days, back in the 80s, the phone systems used something
called SS5. SS5 was a, like a signaling system that the phones used. And it used
what was referred to as in-band signaling. So, the phones had to be able
to, to talk back to the central office and, and kind of say, hey, this is what's
going on. This person's trying to make a phone call and they've put two quarters
into me. Is that enough money? Well, they would do this with, with very faint tones
that if you listen close, you could hear it. And that was in-band signaling
because it was in the same band as your, as your voice traffic, right? So, you could
actually record those tones, play them back to the phone, or make a device that
would play those tones to the phone. And the phone would be like, oh, they just put
a quarter in because I heard the, I heard the sounds, even though you put nothing
in it. So, there are things like blue boxes, red boxes. These enabled free calls.
They made it harder to trace calls. You could, you know, you could stack trunks
across the country. Some very famous people in the computer industry,
financed their way through college by selling blue boxes. It kind of really took off in
the late 60s, early 70s, and had a really good run through the, the mid 90s when
they switched to a new system called SS7. With the advent of SS7, they moved to
out-of-band signaling. So, these, these codes and these tones didn't go through
the phone line anyway. They went through the phone line, but not through the voice
channel. So, you couldn't just do craziness. Just a little bit of, I don't know, trivia,
if you will. There are red boxes and blue boxes in these badges. That's just
one of the, one of the things you can figure out on them. Kind of, kind of neat
stuff to be able to hear that. It won't work on a real phone, but, you know, kind
of, kind of neat for history's sake. The phone system, it was a new frontier, right?
So, hackers are inquisitive, right? We want to know how things work. You know, I'm
sure a lot of us, when we were young, took stuff apart. My mom hated it. I would take
things apart and never put it back together again, right? I would have crap
strewn from one end of the table to the other. And my mom would be like, what are you
doing? I'm done with that. I already took it apart. I know how it works. I'm done.
Bored. The phone system was like that, right? It was, it was this new world that,
you know, what does this do? How does it work? What does, where does this go? And we,
you know, we had that inquisitive mindset that made it such a wonderful thing.
Telephone companies would often leave trucks unlocked. Trucks contained service
manuals. They would also throw old manuals into dumpsters. So, you know, late
at night, you're bored, you're out cruising around. Hey, there's the telco. I wonder
what's in the dumpster. Oh, it comes with a set of bell manuals. Now, you know how a
lot of that stuff works. So, there were, there were a lot of late-night dumpster
runs back, back in the day. So, back to the boxes here. So, red boxes generated a
coin tone, right? And like a quarter tone, as an example, was kind of what? It was
like five high-pitched beeps. You could use them on Fortress phones or CoCot.
CoCot is a customer-owned, coin-operated telephone. Basically, a person could buy a
payphone, install it at their business, and then they got all the money out of it.
You can play nickels, dimes, quarters. I don't know why you'd ever play a nickel
or a dime, unless you're just trying to make it look legitimate. We always just
did quarters. And you can make it super easy. If you went to Radio Shack, Radio
Shack had a pocket dialer. We could program phone numbers in, and then you
push a memory button, and it would play it back, so you didn't have to be
troubled with pushing the buttons on the phone. Because that was a lot of work
back then, right? So, if you replace the crystal inside that pocket dialer, and
then programmed, like, I think it was five asterisks into a memory location, that's
a quarter. And so then you go and you call somebody in, I don't know, Algeria,
and you just start hitting the button, and it starts racking up quarters, and
now you've got a free phone call. Blueboxes basically allowed you to be an
operator console. You could stack trunks, you could, with the right combination of
things, you could, you know, there are ways you become like a directory
assistance operator. You know, there are a lot of different things you could do
with a blue box. Black boxes would set it so that if somebody called you, so
maybe, maybe you got a BBS, right? But you're in the middle of nowhere, but you
want people to call your BBS without racking up long-distance charges. The
black box would turn off the ringing. You could set your BBS to then pick up, but
it wouldn't trip. There are two relays, one controlled ringing, one controlled
billing. It shuts off the ringing relay, never trips the billing relay, so the
person's never, never billed. The phone company in the phone system, the CEO,
thinks that you never picked the phone up, even though you did. So a lot of these
boxes were pretty heavily used up until about the mid-90s. When, again, they
rolled out SS7, where the in-band signaling made life a lot easier for the
phone companies at that point. And they had things in place that they could
detect things before SS7, but it was not as sketchy, or I'm sorry, not as
reliable. It was a little more, a little more sketchy. There are times that, you
know, you crank out three or four dollars in quarters, and all of a sudden you have
an operator on the line. Sir, how many coins did you put in the phone? Yeah, 400
buy. Then you'd move on to the next phone before anybody in a Bell truck shows up.
So with the, with phreaking, there are a lot of interesting, cool phone numbers
that were out there. And these phone numbers would be traded on BBS. If
somebody finds a cool number, you hop on your local phreaking BBS. Hey, I found
this, you know. Feel free to use it. Or I found this. I don't know what the hell
this is. Can somebody figure it out? There are loop numbers. What a loop number was,
there, there's a high side and a low side. You could dial into one side, somebody
dials into the other, and you could talk to each other. Conference bridges. That
was a big thing, like the late 80s, early 90s. Everybody was dialing into conference
bridges. And what that was is, a business would have a conference bridge for doing
conference calls. It was just a phone to recall into, and you enter a password, and
now everybody can dial in, you can all talk to each other. Well, the passwords
were, you know, four or five digits long. Doesn't take much to brute-force that. So
the hackers would find them. They're not being used on nights and weekends, because
it's owned by a business, right? That business turned off the lights in the
server room, and they all went home. So the hackers would brute-force these
conference bridges. They'd log in, have their, their conversations. They'd talk
about hacker stuff, and freaker stuff, and just kind of hang out, and do
nefarious things. A&I numbers. A&I numbers were very handy. If I want to hack into
my local Pizza Hut, and play around with their supply ordering system, but I don't
know the number, I go outside of the DMART, the little phone box on the wall
out back. I open it up, I plug in a butt set, and I call what's called A&I,
automatic number identification. It's kind of what drives caller ID, and I could
find out what their phone number. I'd read back the number I'm calling from.
Now I know what the phone numbers are for this Pizza Hut on this line that I
dialed out, and I'm gonna go home, start calling around that area with my modem,
until I find a carrier. Now I know I'm into their, their supply system, and next
week they're getting 30,000 pounds of mozzarella, which usually leads to a
sale on, like, pizzas, which is nice. And then there are interesting numbers too.
You might find a number that's really bizarre and weird, and these still exist
out there. You know, government installations, there might be a
voicemail box that's weird. You know, there's a voicemail box for a long time
that was just a duck quacking, like you'd call this number, and a duck would quack
and beep, and you can leave a message. Nobody really knew what it was, it was just a
duck. Government installation, there are numbers you'd call, and they would rattle
off weird numbers, you know, Bravo, 6, Alpha, 9, 12. Okay, what is that? You know, so
then you'd share that number with your friends. They'd be calling, you'd all try
and figure out what it was, and it was neat. It was, again, it was that
exploring kind of mindset. And then there were sweep tones. So sweep tones were a
number that you would call, and it was just a sweeping tone. It's like, right, all
the way up, like super high-pitched. Sweep tones were the thing of urban legend.
They existed. It was just a test, a test tone, a test number. The rumor was that it
could detect a bug on your line. Not true. Not true. So if you think your line is
tapped, don't call a sweep tone because it won't really tell you anything. So
basically, in closing, you know, there have been a lot of changes over the last 30
years. A lot of things that have advanced, but a lot of things that kind of
stayed the same, too, right? You know, we all kind of started out with that
inquisitive mindset. You know, some of us were black hats, some of us were white
hats, some of us were gray hats. You know, it all brought us here today. You know, no
matter, I'm sure we have a wide variety in the audience, you know, everybody's
experiences have kind of made the whole community what it is. So that's a
that's a good thing. Who knows what we've got for the next 30 years. It's exciting
to think about with how fast things are going. It's important to remember where we
came from and to pass that on to the next generation as they come up. We need
to remember our history and to keep that going forward so that we don't don't
forget who we are.