Who's Hacking Whom? HOPE Springs in Manhattan
PETER WAYNER
August 11, 1997

Who's Hacking Whom?

HOPE Springs in Manhattan

By PETER WAYNER

Hackstock Home Page

Related Articles

Dutch Treat: a Woodstock for Hackers and Phreaks

(Aug. 7, 1997)

2,000 Hackers, 800,000 Watts, 6 Million bps, 12 Toilets

(Aug. 8, 1997)

Field of Wired Dreams: If You Build It, They Will Camp

(Aug. 9, 1997)

A Community Sprouts Amid a Culture That Resists It

(Aug. 10, 1997)

Melding Minds and Passions in the Global Bit Stream

(Aug. 11, 1997)

IN NEW YORK What Galls a Hacker Most? The Metrocard

(Aug. 11, 1997) Related Articles from The Times

Related Sites

he mixture of chest-puffing and spoofing that characterized the Beyond HOPE conference for computer hackers began early.

The literature promised that on Thursday evening, Garth Brooks would welcome the participants to New York with a concert in Central Park. The Web page advertising the conference said, "It took a lot of phone calls and favors that we'll be paying back for years. . . . This concert is FREE and is ONLY FOR HACKERS although it's possible some others may come by."

If a normal New Yorker made that boast, everyone would laugh. But the fear surrounding the mythical omnipotence of hackers is so great that even one of the 2,000 attendees had to ask Emmanuel Goldstein, the main organizer, if he had secretly performed some computer magic to bring the singer to the park.

"I'm sure that Garth Brooks doesn't know we're here," said Goldstein cryptically deflecting the question.

Goldstein is the nom de guerre of Eric Corley, the editor and publisher of the hacker quarterly 2600, which sponsored the conference. "Emmanuel Goldstein" is also the name of the leader of the resistance fighting Big Brother in 1984, the novel written by Eric Blair under the nom de plume George Orwell.

The conference is the second major event organized by the magazine. The first, held in 1994, was simply titled HOPE -- for "Hackers on Planet Earth." This version was scheduled to coincide with the Hacking In Progress (HIP) conference in large campsite on the outskirts of Amsterdam. The two conferences are linked via the Internet and some of the panels and sessions are viewable on both ends.

The Beyond HOPE conference was held in downtown Manhattan at the Puck Building in Soho. The main ballroom, often rented for weddings, was converted into a high-tech assembly hall seating about 600 at the busiest sessions.

Another large room was filled with tables and a large Ethernet that anyone could use to gain access. One company, the DataHaven Project, brought their network encryption equipment and used it to protect some of the terminals from attack. Matt Drown, the president of the company, whose name tag listed him as "Panzer Boy," said they came test their product. "We've told a few people, 'Why don't you try to do something.'"

Many people in the hall brought their own computers and proceeded to attack each other. A quick scan of the monitors showed that many were running versions of Linux set up to watch all traffic traveling the network.

Today in CyberTimes

ARTICLES AND COLUMNS

Where Food and Surfing Are Kosher

By Pamela Mendels

Cubicles Are Winning War Against Closed Offices

By Steve Lohr

Digital-Age Wiretap Plan by FBI Draws Opposition

By John Markoff

Betty Crocker Steps Into Cyberspace

By Stuart Elliott

Apple Sending Clone Makers Mixed Signals

By Laurie J. Flynn

Woes of EDS -- Top and Bottom Line

By Allen R. Myerson

Camping Trip Is Just a Click Away

By Shelly Freierman

Spoof E-Mail May Hurt Internet

By Denise Caruso

Museums Seek to Protect Art Images on Internet

By Geanne Rosenberg

TODAY'S SECTION FRONT

SEVEN-DAY INDEX

CYBERTIMES FORUMS

CYBERTIMES NAVIGATOR

The world of computer security is growing increasingly important as the Internet becomes an essential part of the world's economy. Bruce Schneier, the president of the security consulting firm Counterpane Systems, said he was considering hiring some of the people he met at the conference. "Remember," he said, "I need people who are good. The skill set here is something you can't find elsewhere."

One lawyer for a major law firm said: "I wish we could hire some of these guys. Our staff is barely competent." He refused to give his name nor the name of his firm.

The nature of the meeting is also growing more serious because of the targets available. The early hackers aimed at the phone company, which they characterized as sluggish monopoly more interested in guarding its profits than providing service. 2600 magazine drew its name from the fact that a tone of 2600Hz would act like the word "open sesame" on the phone system, allowing free calls.

While that generation of hackers often disrupted the phone system and used their skills to obtain free phone calls, they rarely cost the phone companies revenue. In most cases, the stolen calls ran over unused lines that never would have contributed to the gross revenues of the company.

Now that there is true commerce on the Internet, with real money, the stakes are growing higher. Real money can either be stolen or counterfeited with computers, and this means that a skillful attacker can gain more than just free long distance service.

This may be why one of the best attended sessions at the conference was one about the Metrocard payment, given by an anonymous employee of the New York City who spoke under the nom de guerre Red Balaklava. He also wore a red balaclava to hide his face.

Mr. Balaklava has apparently spent the last several years studying the guts of the Metrocard system and regaled the audience with a great amount of technical minutia. For instance, he said that each card has three tracks of data, which is why the hackers using more standard two-track credit card readers have failed to read the cards.

The magnetic stripe contains information about the expiration date of the card, a six digit "batch" number, a ten-digit serial number, the amount of the card and information about the card's last use. The stations on the N and the R line, for instance, have location codes between 1500 and 1530.

Each turnstile or bus toll box reads the batch number and serial number of cards as it is swiped and subtracts the fare for the card. The subway stations report the numbers as they are used to a central computer using a fiber optic network, while the buses use a radio network.

Mr. Balaklava continued stating that the central computer maintains a database tracking the use of each card and the value on the card. If the same serial number is used and the value on the card is not correct, then the central computer will add the serial number to a list of expired numbers. This list is downloaded to each turnstile and bus and the card will cease working.

This central administration controls counterfeiting. While it may be easy for someone with a three-track card writer to copy a card worth $80, both cards will stop working as soon as the central computer notices that the values aren't consistently dropping.

Of course, this approach is not without problems. Someone can still get one use out of a counterfeit card, a pay off of $1.50, which Mr. Balaclava contended was not worth the time. During a question session, he did agree that it might be possible to guess valid serial numbers and use them. It would also be possible to attack the system by cloning the cards of Transit Authority employees, who have cards that give them unlimited travel on the system as a perquisite.

This lead Mr. Balaklava to conclude, "It's a sloppy system; it's an expensive system; but surprisingly it's a good system." He also concluded that the easiest way to get a free subway ride was to counterfeit a token, not a Metrocard.

The entire conference was a mixture of technical highs and endless paranoia. Red Balaklava spent time pointing out how the Metrocard system could be used to track people's travel throughout New York City. A new plan for selling Metrocards by mail, he noted, would match serial numbers and addresses.

But, the paranoia came in layers. One questioner asked if the man in the red balaclava was a plant from the Transit Authority with the job of discouraging hackers from attacking the system.

Earlier, another 2600 staff member came up to Emmanuel Goldstein and asked if Goldstein had truly given permission. "I just wanted to make sure he wasn't social engineering me," he said using a hacker term for fooling someone into going along. Many hackers have discovered that it is easier to bluff people out of their passwords than actually find a weakness in the system.

This made it difficult to know when someone was telling the truth and when they were simply trying to 'engineer' the audience. For instance, Emmanuel Goldstein told the audience of 2600's attempt to get the Empire State Building lit with the conference's colors blue and white. When the building's management said that they only did that for national holidays, Goldstein discovered that Singapore celebrated a national holiday on August 9.

In order to improve believability, they created the "Singapore Cultural Center" and claim to have taken out a telephone line listed under that name. A call to the number played a voice mail message saying the office was closed. In the end, though, the tower stayed pure white.

Some hacks, however, succeeded. One attendee at the Beyond HOPE conference was able to modify one of the sites at the HIP conference in Europe. Several other attendees said that the attack was performed by overflowing the buffer of the server during an "IMAP request for email." IMAP is one of the standard ways that a program like Eudora or Netscape can request new email from a central server.

Credit: Leo Hsu for CyberTimes

Young HOPE participants trade their skills.

Overflowing buffers is one of the classic ways to attack machines. Normally, a computer program is responsible for accepting all information directed at it from the network. Most messages come in standard lengths. Sloppy programmers often assume that all packets of data will come in these lengths and don't plan for the possibility that a random error or a malicious attack will send too much information down the line. In these cases, the machine can crash.

The official Web site of the HIP conference, however, proclaimed that they were unimpressed with the attack because it wasn't directed at the main machine. The Web page announced, "So far Hope has proved that they do not know which is our webserver."

The conference and the attendees have grown increasingly self-aware. One session was devoted to asking media members to answer questions of the audience. The attendees are highly aware of how the media portrays them and is anxious to make sure they aren't demonized.

This instinct has even attracted academic attention. Sean Huss, a graduate student at the University of Tennessee, was circulating a questionnaire on "Media Portrayal of Hackers." He was planning on aggregating the information for his thesis. For instance, the questionnaire asked people to assess their agreement with statements like "Hackers strive for publicity" or "Hackers will exaggerate their activities to reporters to see if they are printed."

Even though most of the attendees wore T-shirts and jeans, appearance was obviously just as important for the attendees of the conference as it was at the wedding parties that normally fill the hall. Brash, arch and ironic commentary was common and more than a couple high school aged attendees wore hats embossed with terms like "FBI" or "Secret Service." One male teen-ager wore a shirt claiming, "Chicks Hate Me."

Several people and 2600 magazine sold T-shirts to the audience. One company raised money for a Hacker's Defense Fund emblazoned with words like "Silence my voice, I will find another. Make my voice a crime, I will create a new one."

Others did a better job of playing to the sophomoric level of humor that fit many of the attendees. One carried the tag line "Co-ed naked hacking." Another showed a picture of the suicides from the Heaven's Gate cult covered with the tag line stolen from Nike, "Just Do It."

One man, who identified himself as "Jim -- that'll do just fine," was selling shirts with phrase: "In wars past, you could tell the enemy by the uniforms they wore . . . It won't be that simple with the Information Warriors of Tomorrow."

Some people were proud of the pseudonyms they chose. "Shiloh" explained that she used that name because it was "the name my parents were going to give her." Her real name, Cassandra, is "too long." Other nom de guerres included Phakt0rE, Mudge, Dork, and Hobbit.

The best name, however, may have been "Major Hacking" -- and it was real. John Hacking used to serve in the Queen's Own Cameron regiment and is now running a cookie baking in East Hampton during his retirement. The snack bar sold his cookie along with Coke and Pepsi, but no Jolt, the traditional highly caffeinated drink of hackers.

Although most of the attendees were teen-agers, and even a few pre-teen-agers, the legendary John Draper, a.k.a. Cap'n Crunch, came for the hacking and the parties. In an interview on Sunday, he said he had not slept since Thursday night.

Draper, who is now 54, earned his name Cap'n Crunch after he discovered that a free plastic whistle distributed with the sugary cereal would produce the famous 2600Hz if one of the holes was plugged with glue. He spent the evenings at several of the parties known as raves that were loosely associated with the event.

He said: "I'm here to learn from the younger generation. The stuff I know is pretty outdated."

He is apparently learning quickly, however, because he is now traveling the country as the "Johnny Appleseed of the Web" setting up Web sites for people in 20 minutes.

Related Articles From The Times:

Kevin Mitnick and Tsutomu Shimomura

Cyberspace's Most Wanted: Hacker Eludes F.B.I. Pursuit

(July 4, 1994)

How a Computer Sleuth Traced a Digital Trail

(Feb. 16, 1995)

Hacker Case Underscores Internet's Vulnerability

(Feb. 17, 1995)

Phiber Optik and the Masters of Deception

Computer Savvy, With an Attitude: Young Working-Class Hackers Accused of High-Tech Crime

(July 23, 1992)

Reprogramming a Convicted Hacker: To His On-Line Friends, Phiber Optik Is a Virtual Hero

(Jan. 14, 1995)

Related Sites

Following are links to the external Web sites mentioned in this article. These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability. When you have finished visiting any of these sites, you will be able to return to this page by clicking on your Web browser's "Back" button or icon until this page reappears.