Underground: Tales of Hacking, Madness and Obsession from the Electronic Frontier (61 page)

Is he addicted to computers? SKiMo says no, but the indications are there. By his own estimate, he has hacked between 3000 and 10000

computers in total. His parents--who have no idea what their son was up to day and night on his computer--worry about his behaviour. They pulled the plug on his machine many times. In SKiMo’s own words, ‘they tried everything to keep me away from it’.

Not surprisingly, they failed. SKiMo became a master at hiding his equipment so they couldn’t sneak in and take it away. Finally, when he got sick of battling them over it and he was old enough, he put his foot down. ‘I basically told them, "Diz is ma fuckin’ life and none o’

yer business, Nemo"--but not in those words.’

SKiMo says he hasn’t suffered from any mental illnesses or instabilities--except perhaps paranoia. But he says that paranoia is justified in his case. In two separate incidents in 1996, he believed he was being followed. Try as he might, he couldn’t shake the tails for quite some time. Perhaps it was just a coincidence, but he can never really be sure.

He described one hacking attack to me to illustrate his current interests. He managed to get inside the internal network of a German mobile phone network provider, DeTeMobil (Deutsche Telekom). A former state-owned enterprise which was transformed into a publicly listed corporation in January 1995, Deutsche Telekom is the largest telecommunications company in Europe and ranks number three in the world as a network operator. It employs almost a quarter of a million people. By revenue, which totalled about $A37 billion in 1995, it is one of the five largest companies in Germany.

After carefully researching and probing a site, SKiMo unearthed a method of capturing the encryption keys generated for DeTeMobil’s mobile phone conversations.

He explained: ‘The keys are not fixed, in the sense that they are generated once and then stored in some database. Rather, a key is generated for each phone conversation by the company’s AUC

[authentication centre], using the "Ki" and a random value generated by the AUC. The Ki is the secret key that is securely stored on the smart card [inside the cellphone], and a copy is also stored in the AUC. When the AUC "tells" the cellphone the key for that particular conversation, the information passes through the company’s MSC [mobile switching centre].

‘It is possible to eavesdrop on a certain cellphone if one actively monitors either the handovers or the connection set-up messages from the OMC [operations and maintenance centre] or if one knows the Ki in the smart card.

‘Both options are entirely possible. The first option, which relies on knowing the A5 encryption key, requires the right equipment. The second option, using the Ki, means you have to know the A3/A8

algorithms as well or the Ki is useless. These algorithms can be obtained by hacking the switch manufacturer, i.e. Siemens, Alcatel, Motorola ...

‘As a call is made from the target cellphone, you need to feed the A5

key into a cellphone which has been modified to let it eavesdrop on the channel used by the cellphone. Normally, this eavesdropping will only produce static--since the conversation is encrypted. However, with the keys and equipment, you can decode the conversation.’

This is one of the handover messages, logged with a CCITT7 link monitor, that he saw:

13:54:46"3 4Rx< SCCP 12-2-09-1 12-2-04-0 13 CR

BSSM HOREQ

BSSMAP GSM 08.08 Rev 3.9.2 (BSSM) HaNDover REQuest (HOREQ)

-------0 Discrimination bit D BSSMAP

0000000- Filler

00101011 Message Length 43

00010000 Message Type 0x10

Channel Type

00001011 IE Name Channel type

00000011 IE Length 3

00000001 Speech/Data Indicator Speech

00001000 Channel Rate/Type Full rate TCH channel Bm 00000001 Speech Encoding Algorithm GSM speech algorithm Ver 1

Encryption Information

00001010 IE Name Encryption information

00001001 IE Length 9

00000010 Algorithm ID GSM user data encryption V. 1

******** Encryption Key C9 7F 45 7E 29 8E 08 00

Classmark Information Type 2

00010010 IE Name Classmark information type 2

00000010 IE Length 2

-----001 RF power capability Class 2, portable

---00--- Encryption algorithm Algorithm A5

000----- Revision level

-----000 Frequency capability Band number 0

----1--- SM capability present

-000---- Spare

0------- Extension

Cell Identifier

00000101 IE Name Cell identifier

00000101 IE Length 5

00000001 Cell ID discriminator LAC/CI used to ident cell

******** LAC 4611

******** CI 3000

PRIority

00000110 IE Name Priority

00000001 IE Length 1

-------0 Preemption allowed ind not allowed

------0- Queueing allowed ind not allowed

--0011-- Priority level 3

00------ Spare

Circuit Identity Code

00000001 IE Name Circuit identity code

00000000 PCM Multiplex a-h 0

---11110 Timeslot in use 30

101----- PCM Multiplex i-k 5

Downlink DTX flag

00011001 IE Name Downlink DTX flag

-------1 DTX in downlink direction disabled 0000000- Spare

Cell Identifier

00000101 IE Name Cell identifier

00000101 IE Length 5

00000001 Cell ID discriminator LAC/CI used to ident cell

******** LAC 4868

******** CI 3200

The beauty of a digital mobile phone, as opposed to the analogue mobile phones still used by some people in Australia, is that a conversation is reasonably secure from eavesdroppers. If I call you on my digital mobile, our conversation will be encrypted with the A5

encryption algorithm between the mobile phone and the exchange. The carrier has copies of the Kis and, in some countries, the government can access these copies. They are, however, closely guarded secrets.

SKiMo had access to the database of the encrypted Kis and access to some of the unencrypted Kis themselves. At the time, he never went to the trouble of gathering enough information about the A3 and A8

algorithms to decrypt the full database, though it would have been easy to do so. However, he has now obtained that information.

To SKiMo, access to the keys generated for each of thousands of German mobile phone conversations was simply a curiosity--and a trophy. He didn’t have the expensive equipment required to eavesdrop. To an intelligence agency, however, access could be very valuable, particularly if some of those phones belonged to people such as politicians. Even more valuable would be ongoing access to the OMC, or better still, the MSC. SkiMo said he would not provide this to any intelligence agency.

While inside DeTeMobil, SKiMo also learned how to interpret some of the mapping and signal-strength data. The result? If one of the company’s customers has his mobile turned on, SKiMo says he can pinpoint the customer’s geographic location to within one kilometre.

The customer doesn’t even have to be talking on the mobile. All he has to do is have the phone turned on, waiting to receive calls.

SKiMo tracked one customer for an afternoon, as the man travelled across Germany, then called the customer up. It turned out they spoke the same European language.

‘Why are you driving from Hamburg to Bremen with your phone on stand-by mode?’ SKiMo asked.

The customer freaked out. How did this stranger at the end of the phone know where he had been travelling?

SKiMo said he was from Greenpeace. ‘Don’t drive around so much. It creates pollution,’ he told the bewildered mobile customer. Then he told the customer about the importance of conserving energy and how prolonged used of mobile phones affected certain parts of one’s brain.

Originally, SKiMo broke into the mobile phone carriers’ network because he wanted ‘to go completely cellular’--a transition which he hoped would make him both mobile and much harder to trace. Being able to eavesdrop on other people’s calls-- including those of the police--was going to be a bonus.

However, as he pursued this project, he discovered that the code from a mobile phone manufacturer which he needed to study was ‘a multi-lingual project’. ‘I don’t know whether you have ever seen a multi-lingual project,’ SKiMo says, ‘where nobody defines a common language that all programmers must use for their comments and function names? They look horrible. They are no fun to read.’ Part of this one was in Finnish.

SKiMo says he has hacked a number of major vendors and, in several cases, has had access to their products’ source codes.

Has he had the access to install backdoors in primary source code for major vendors? Yes. Has he done it? He says no. On other hand, I asked him who he would tell if he did do it. ‘No-one,’ he said, ‘because there is more risk if two people know than if one does.’

SKiMo is mostly a loner these days. He shares a limited amount of information about hacking exploits with two people, but the conversations are usually carefully worded or vague. He substitutes a different vendor’s names for the real one, or he discusses technical computer security issues in an in-depth but theoretical manner, so he doesn’t have to name any particular system.

He doesn’t talk about anything to do with hacking on the telephone.

Mostly, when he manages to capture a particularly juicy prize, he keeps news of his latest conquest to himself.

It wasn’t always that way. ‘When I started hacking and phreaking, I had the need to learn very much and to establish contacts which I could ask for certain things--such as technical advice,’ SKiMo said.

‘Now I find it much easier to get that info myself than asking anyone for it. I look at the source code, then experiment and discover new bugs myself.’

Asked if the ever-increasing complexity of computer technology hasn’t forced hackers to work in groups of specialists instead of going solo, he said in some cases yes, but in most cases, no. ‘That is only true for people who don’t want to learn everything.’

SKiMo can’t see himself giving up hacking any time in the near future.

Who is on the other side these days?

In Australia, it is still the Australian Federal Police, although the agency has come a long way since the early days of the Computer Crimes Unit. When AFP officers burst in on Phoenix, Nom and Electron, they were like the Keystone Cops. The police were no match for the Australian hackers in the subsequent interviews. The hackers were so far out in front in technical knowledge it was laughable.

The AFP has been closing that gap with considerable alacrity. Under the guidance of officers like Ken Day, they now run a more technically skilled group of law enforcement officers. In 1995-96, the AFP had about 2800 employees, although some 800 of these worked in ‘community policing’--serving as the local police in places like the ACT and Norfolk Island. The AFP’s annual expenditure was about $270 million in that year.

As an institution, the AFP has recently gone through a major reorganisation, designed to make it less of a command-and-control military structure and more of an innovative, service oriented organisation.

Some of these changes are cosmetic. AFP officers are now no longer called ‘constable’ or ‘detective sergeant’--they are all just ‘federal agents’. The AFP now has a ‘vision’ which is ‘to fight crime and win’.3 Its organisational chart had been transformed from a traditional, hierarchical pyramid of square boxes into a collection of little circles linked to bigger circles--all in a circle shape. No phallo-centric structures here. You can tell the politically correct management consultants have been visiting the AFP.

The AFP has, however, also changed in more substantive ways. There are now ‘teams’ with different expertise, and AFP investigators can draw on them on an as-needed basis. In terms of increased efficiency, this fluidity is probably a good thing.

There are about five permanent officers in the Melbourne computer crimes area. Although the AFP doesn’t release detailed budget breakdowns, my back-of-the-envelope analysis suggested that the AFP

spends less than $1 million per year on the Melbourne computer crimes area in total. Sydney also has a Computer Crimes Unit.

Catching hackers and phreakers is only one part of the unit’s job.

Another important task is to provide technical computer expertise for other investigations.

Day still runs the show in Melbourne. He doesn’t think or act like a street cop. He is a psychological player, and therefore well suited to his opponents. According to a reliable source outside the underground, he is also a clean cop, a competent officer, and ‘a nice guy’.

However, being the head of the Computer Crimes Unit for so many years makes Day an easy target in the underground. In particular, hackers often make fun of how seriously he seems to take both himself and his job. When Day appeared on the former ABC show ‘Attitude’, sternly warning the audience off hacking, he told the viewers, ‘It’s not a game. It’s a criminal act’.

To hackers watching the show, this was a matter of opinion. Not long after the episode went to air, a few members of Neuro-cactus, an Australian group of hackers and phreakers which had its roots in Western Australia, decided to take the mickey out of Day. Two members, Pick and Minnow, clipped Day’s now famous soundbite. Before long, Day appeared to be saying, ‘It’s not a criminal act. It’s a game’--to the musical theme of ‘The Bill’. The Neuro-cactus crowd quickly spread their lampoon across the underground via an illicit VMB connected to its own toll-free 008 number.

Although Day does perhaps take himself somewhat seriously, it can’t be much fun for him to deal with this monkey business week in and week out. More than one hacker has told me with great excitement, ‘I know someone who is working on getting Day’s home number’. The word is that a few members of the underground already have the information and have used it. Some people think it would be hilarious to call up Day at home and prank him. Frankly, I feel a bit sorry for the guy. You can bet the folks in traffic operations don’t have to put up with this stuff.

But that doesn’t mean I think these pranksters should be locked up either.