Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker (17 page)

One more phone call, again to Circus Circus. I explained I would be arriving late and needed to make sure the front desk would hold a FedEx that would be delivered before I checked in. “Certainly, Mr. Bishop. If it’s a large item, the bell captain will have it in the storage room. If it’s small, we’ll be holding it here at the registration desk.” No problem.

For the next call, I found my way to a quiet area and punched in the number for my favorite Circuit City store. When I reached a clerk in the cell phone department, I said, “This is Steve Walsh, LA Cellular. We’ve been having computer failures in our activation system. Have you activated any phones on LA Cellular in the last two hours?”

Yes, the store had sold four. “Well, look,” I said. “I need you to read me the mobile phone number and the ESN of each of those phones, so I can reactivate their numbers in the system. The last thing we need is unhappy customers, right?” I gave him a sarcastic chuckle, and he read off the numbers.

So now I had four ESNs and the phone numbers that went with them. For the rest of the afternoon, the wait was absolutely nerve-racking. I had no idea whether or not I would be able to pull this off. Would the Novatel people sense that something fishy was up, and never send the chips? Would there be FBI agents staked out in the hotel lobby, waiting to pick me up? Or would I, by the next afternoon, have the capability of changing the number of my cell phone as often as I wanted?

The next day, my longtime friend Alex Kasperavicius arrived. An intelligent, friendly guy, expert in IT and telephone systems, Alex liked the adventure of being included in some of my exploits, but he wasn’t really a hacking partner. I could doggedly stick to an effort for months and months until I finally succeeded. Alex wasn’t like that; he had other distractions. He kept busy working as a camp counselor in Griffith Park, playing classical music on his French horn, and looking for new girlfriends.

I filled him in on the situation. What a kick I got out of watching his
reaction! At first not believing it would be possible to get the manufacturer to send us the chips, then imagining how great it would be if we could really make calls masking our identities.

Kumamoto-san had provided me with the programming instructions for giving the phone a new ESN, using the special version of the firmware. Today, almost twenty years later, I can still remember the exact code. It was:

Function-key

Function-key

#

39

#

Last eight digits of the new ESN

#

Function-key

(For the technically curious, the ESN is actually eleven decimal digits long, the first three of which designate the phone’s manufacturer. With the chip and the code, I would only be able to reprogram any Novatel ESN into my phone, but not one from another cell phone manufacturer—though later on, when I got Novatel’s source code, I would gain that capability as well.)

By 3:00 p.m., we were pretty sure Federal Express would have delivered to Circus Circus already, and we couldn’t keep our impatience under control any longer. Alex volunteered to do the pickup, understanding without conversation that if I went in and there were cops waiting, I’d be on my way back to prison. I told him to give the name Mike Bishop, say he had to get the package directly over to the Convention Center and would be back later to register. I stayed out front.

In a situation like this, there was always a chance that someone could’ve seen through the ruse and alerted the Feds. We both knew that Alex could be heading into a trap. From the moment he walked in, he’d have to be scoping out the place for people who could be plainclothes cops. But he couldn’t be looking up and down every man and every woman who seemed to be just passing the time; that would be too suspicious. He had to scan.

I knew Alex was too cool to look over his shoulder or show any sign that he was nervous. If there was anything that looked wrong, he’d walk right out—not in an obvious hurry, but not dawdling, either.

With every minute that ticked by, I got more anxious. How long could it take to pick up a small package?
Okay
, I thought,
calm down, there are probably a lot of people in line at the registration desk, and he has to wait his turn
.

More minutes ticked by. I was beginning to think I’d have to walk in myself and see if there was a crowd of cops, or maybe ask a casino guest if there had been some kind of police action a few minutes before.

But there he was, coming out the door, sauntering casually over to me with a huge grin on his face.

Filled with anticipation, heart pumping, we stood right there on the street and opened the package. Inside, a clear white case contained, as promised, five cell phone 27C512 EPROMs. I had been social-engineering for years, but this was probably my biggest prize ever up to that time. If, that is, the chips really worked. We crossed Las Vegas Boulevard to the Peppermill, avoiding the tourist-filled cocktail lounge with its sexy waitresses in favor of a booth in the restaurant area, where we would be less conspicuous.

Lewis De Payne joined us. Yes, the guy who was now my ex-wife’s lover.

I’m not sure I can explain why I kept in contact with Lewis after he stole my wife. Obviously I never trusted or respected him again. But frankly, there were so few people I dared to stay in touch with at all that I needed someone who understood my predicament. And who could understand it better than Lewis? He had been my hacking buddy from the start. We’d been through a lot together.

It would’ve been easy to think of him with bitterness, as my arch-enemy. He certainly qualified. But at the same time, he was also genuinely one of my best friends. And Bonnie was another. Eventually, I had moved past the pain and begun seeing them again. We gradually became friends, like those divorced couples with kids who end up having picnics together with their new spouses on family holidays.

We’re often advised to “forgive and forget.” In this case, “forgiveness” may be too strong a word. I had to let go of the resentment for my own sake, but I couldn’t afford to forget. Although Lewis was a good
hacking partner and I valued his skill set, I hacked with him only when I had a failsafe—when we both stood to lose if he tried to turn me in.

Under these new conditions, Lewis and I had resumed our hacking together and created a new version of our old friendship that had changed forever.

Now, in our booth in the Peppermill, I thought Lewis’s eyes were going to pop out of his head when he saw those chips. He sat down without fanfare and started disassembling my phone, carefully arranging its parts on the table and jotting the details on a notepad so he’d know where each belonged when he was ready to put them all back together.

In less than five minutes, Lewis had the phone taken apart, down to the circuit board, revealing the chip held in place by a ZIF (“zero insertion force”) socket. I handed him one of the new chips. He slipped it into place and began his careful reassembly. I didn’t want to say anything that would throw him off, but I was growing antsy, wishing he’d work just a little faster so I could find out if we had hit a goldmine or not.

As soon as it was completely together, I snatched the phone from him and punched in the function code that Kumamoto-san had given me. For this test, I programmed the ESN and changed the phone number to match the ones for Lewis’s phone.

The phone turned itself off and rebooted. I could feel my every heartbeat at the front of my scalp. All three of our heads were bent over the table, focused on the phone’s little screen.

The display lit with the start-up screen. I punched in the function to display the phone’s ESN. The numbers that appeared were the ones for the ESN I had entered.

The three of us sent up a cheer, not caring that other customers were turning to stare.

It worked! It really worked!

Back then, some phone companies had a number you could call to get the accurate time. I punched in 213 853-1212 and put the phone down on the table. All three of us heard it together, that recorded lady’s voice saying, “At the tone the time will be…” My phone was now successfully making outgoing calls as a clone of Lewis’s—and the cell phone company would record these calls as having been made not by me but by Lewis from his own phone.

I had social-engineered Novatel and gained huge power. I could make phone calls that couldn’t be traced back to me.

But had I just fallen off the wagon for this one hack… or was I back into hacking all over again? At that moment, I could not have said for sure.

What I did know, though, was that I had achieved invisibility.

Y
ou look amazing.”

She answered, “You look amazing, too.”

What a boost to my ego! No one had ever said anything like that to me before, not even Bonnie. And certainly not an extremely hot chick like this one, with a body, face, and hair that made me picture her on stage in a casino somewhere, strutting in high heels and a skimpy costume. Or half a costume.

She was pumping on a StairMaster 6000, hard enough to work up a sweat. I climbed onto the one adjacent and struck up a conversation. She was friendly enough to give me hope. It didn’t last. She said she was a dancer with Siegfried and Roy—that pair of famous magicians who were doing large-scale illusions and working with live tigers in their act.

Wouldn’t I love to know how they did some of their tricks! Any magician would. I started asking questions. She gave me this cold “fuck you” look and said, “I had to sign a confidentiality agreement. I can’t tell you anything.” She was nice about it, but firm. The “Go away” message was all too clear.

Damn.

My cell phone rang, providing a handy escape from the embarrassment. “Hey, Kevin,” the voice said.

“Hi, Adam.” My half-brother—the person in the world I was closest to who wasn’t a hacker. In fact, he didn’t even use a computer.

After we had chatted for a bit, he said, “An ex-girlfriend of mine knows this big superhacker named Eric Heinz. She says he knows some phone company stuff you might not know about, and he told her he really needs to talk to you.”

And then he said, “Be careful, Kevin. I don’t think this girl is trustworthy.”

My first reaction to Adam’s call was to blow off the whole thing—just not follow up. I’d had enough problems even hacking with guys I had known for years and felt I could trust.

But resisting temptation had never been one of my virtues. I called the number Adam had given me.

The phone was answered not by Eric but by a guy who said his name was Henry Spiegel, which he pronounced “Shpeegel.” Spiegel was one of the most colorful characters I’ve ever run across, and my list includes, besides Ivan Boesky, people like famed palimony attorney Marvin Mitchelson, convicted of tax evasion, and ZZZZ Best scammer Barry Minkow. Spiegel was a case all his own, a guy who had a reputation for being on the periphery of everything from bank robbery to porno to ownership of a hot new Hollywood nightclub, one of those written-about places where young actors and wannabes line up outside every night.

When I asked Spiegel to put Eric on the phone, he said, “I’ll get him for you. I’ll have to page him and then conference you in. He’s really cautious.”

“Cautious”?
I
was cautious; this guy sounded way beyond that, more like superparanoid.

I waited. What was I doing, anyway? If this guy was really into hacking, even talking to him on the phone was a bad idea for me. The terms of my release said I couldn’t have any contact with hackers, and associating with De Payne was risky enough. One word from this Eric Heinz guy could be enough to send me back to a prison cell for up to another two years. Except for the Novatel cell phone hack, I had been mostly playing by the rules for the two years I had been back on the street. I had only another year of supervised release left. So why had I made this call?

Here I was, getting in touch with Eric while telling myself I was doing it out of courtesy to my half-brother.

How could I have known that this one innocent call would be the beginning of an insane adventure that would change my life forever?

When Eric came on the phone that first time, he busied himself by dropping enough hints to make sure I understood he knew a lot about phone phreaking and computer hacking.

He said something like, “I’ve been working with Kevin. You know—the other one, Kevin Poulsen.” He was trying to build cred with me on the shoulders of a hacker who had just been busted for rigging radio contests and supposedly stealing national security secrets.

He told me, “I’ve been on break-ins to telco offices with him.” If it was true that he had been inside telephone company offices, that was really interesting. It meant Eric had inside information from actually using and controlling the equipment in central offices and other telco facilities. So he definitely had my attention. Eric’s claim of knowing a bunch of Poulsen’s tactics was good bait.

To set the hook, he sprinkled his gab with details about phone company switches like the 1AESS, 5E, and DMS-100, and talked about systems like COSMOS, Mizar, LMOS, and the BANCS network, which he said he and Poulsen had accessed remotely. I could tell he wasn’t just bluffing his way through: he knew more than a little about how the systems worked. And he made it sound like he had been part of the small team that had worked with Poulsen to rig those radio contests, which newspaper articles said Poulsen had won a couple of Porsches from.