Message-Id: <9109222340.AA00265@jatz.aarnet.edu.au> To: pte900@aarnet.edu.au From: G.Huston@aarnet.edu.au Subject: Re: Visitors log Thursday Night--Friday Morning Status: RO Date: Sun, 22 Sep 91 19:29:13 +1000 From: Craig Warren <C.Warren@deakin.OZ.AU> Just to give you a little bit of an idea about what has been happening since we last spoke... We have communicated with Sgt Ken Day of the Federal Police about 100 times in the last week. Together with our counterparts from Warrnambool traces have been arranged on dial-in lines and on Austpac lines for the capella.cc.deakin.OZ.AU terminal server which was left open to the world. On Friday afternoon we were able to trace a call back to a person in the Warrnambool telephone district. The police have this persons name. We believe others are involved, as we have seen up to 3 people active at any one time. It is `suspected' students from RMIT and perhaps students from Deakin are also involved. When I left on Friday night, there was plenty of activity still and the police and Telecom were tracking down another number. Tomorrow morning I will talk to all parties involved, but it is likely we will have the names of at least 2 or 3 people that are involved. We will probably shut down access of `cappella' to AARNet at this stage, and let the police go about their business of prosecuting these people. You will be `pleased' (:-)) to know you have not been the only ones under attack. I know of at least 2 other sites in Victoria that have had people attacking them. One of them was Telecom which helped get Telecom involved! I will brief you all in the next day or so as to what has happened. Regards, Craig The `other' people were, of course, the IS hackers. There is nothing like reading about your own hacking antics in some one's security mail. Mendax and Prime Suspect frequently visited ANU's computers to read the security mail there. However, universities were usually nothing special, just jumping-off points and, occasionally, good sources of information on how close the AFP were to closing in on the IS hackers. Far more interesting to Mendax were his initial forays into Telecom's exchanges. Using a modem number Prime Suspect had found, he dialled into what he suspected was Telecom's Lonsdale Exchange in downtown Melbourne. When his modem connected to another one, all he saw was a blank screen. He tried a few basic commands which might give him help to understand the system: Login. List. Attach. The exchange's computer remained silent. Mendax ran a program he had written to fire off every recognised keyboard character--256 of them--at another machine. Nothing again. He then tried the break signal--the Amiga key and the character B pressed simultaneously. That got an answer of sorts. : He pulled up another of his hacking tools, a program which dumped 200 common commands to the other machine. Nothing. Finally, he tried typing `logout'. That gave him an answer: