Sysadmin cracked military PC’s security by reading the manual

Cars are fun too

Many years ago I had need to ask our graphics/marketing literature deaigner to move the nice Vauxhall Carlton hed bought newish sexondhand off the comaony.

As usual, it took ages for him to appear, by which time Id got bored, found a chunk of parcel strappimg, opened the car and was waiting for him.

His reaction: You camt have done that its an executive range car.

Another time, our admin lassie rang in from town, having locked herself out of her Datsun (it WAS a long time ago). Went to her rescue and managed to spring the catch on the back window then rwach in and unscrew the catch from the glass, open the window enough to reach the hinges, unscrew them, lift out the window and finally get at the door latxh.

Despite the two of us doing thus in the middle of a carpark and making no secret of it, no-one took the blindest notice of us.

Revealing weaknesses

What I don't understand is why so often when someone like "Guy" reveals a security shortcoming and shows it to his clients - they get so upset with him and give him a hard time. The article suggests he was completely open and IMHO should have been thanked immediately.

Bypass autoexec bat & config.sys..

Press F5 or F8 as soon as you see "Starting MS-DOS"?

I’m surprised that they did not just change the manuals to omit that part.

I crashed Windows.

Back when I was doing QA for Packard Bell/NEC in the era of Pentium 200MHz & Windows 95, I figured out how to crash the system using the registry editor & MS Paint. Open the editor, copy a bunch of text, open paint, paste in the text, edit the text (it didn't matter how only that you made some change), copy the edited text from paint, paste it back into the registry, & tell it to save. The system would promptly shit itself since paint did something wonky to the text that the registry editor didn't like & the whole thing keeled over like the Titanic.

I notified my boss whom contacted the software folks whom contacted MS; we got a visit from a bunch of MS geeks later that week & they had me repeat the issue. The computer wasn't the only thing to shit itself that day. The MS geeks left in disbelief because "That's not possible!" except they now had proof that not only was it but easily done.

It was at that point my fellow QA team handed me & my partner matching t-shirts: white background, black classic bomb-with-burning-fuze logo & black lettering proclaiming "QA Bomb Squad - if you want it to pass don't hand it to me!" I loved that shirt. I think I wore it to death.

AC because if my old boss is reading this he'll come smack me for all the hell I put him through. :-D

Excel security

In about the year 2007, a colleague had made a nifty spreadsheet that was password protected because he didn't want anyone to know how he'd done certain 'cool' effects. He had hidden columns and all sorts of stuff like that.

I renamed it as a .txt file and opened it in Notepad (which took a while). Near the start of the file was some text that looked very nuch like it was a password, it was his name plus some significant text. Sure enough, that was the password. I do hope the Excel password protection is more secure nowadays.

If the password protection was in the autoexec.bat, press F5 on boot, bypassed or F8 to step through each line, allowing it to be run or not.

“opened the skin of the PC system and replaced a ROM chip.” And with that, Guy’s exploit became impossible.

I'm sure copies of the original chip would have been available as spares from Zenith. Not impossible, just inconvenient.

Windows

1. Take hard disk out of PC

2. Hang on another PC

3. Copy cmd.exe over the top of utilman.exe (may need to fart about with permissions)

4. Put hard disk back in original PC and boot

5. Click on accessibility icon when Windows Logon screen appears

6. Marvel at the command prompt that appears running in the context of SYSTEM

7. Use command line tools to create a new user, as member of administrators group

8. Full logged-in admin access to operating system at your fingertips

Yes, Bitlocker generally thwarts this approach; but it's a fairly quick way to earn £50 for unlocking people's home PCs when they've managed to forget their password.

The best unlock ever

I’ve spent years hacking away at locks and passwords but my favourite is still the first. I was working in an old church used as a museum, we found the proverbial “old locked desk drawer”.

After much mucking round it finally gave in and contained nothing but forty year old stationery and a pair of old photo negatives. I had a quick look at the negatives “Queenstown 1912 april 11th” and two mid distance shots of a ship.

Yup, you guessed it, I was holding the last two photos of Titanic ever taken. As this was before Ballard found the wreck they were unique.

I’ve opened up lots of locks since then but only ever found crud, that day was a good day.

Fun with Android...

I recently bought a phone from Ebay (boxed and complete with all original accessories, so not freshly acquired by a teenager on a moped), only to discover that there's a new security feature on some Android phones: after a factory reset, you have to log in with the old account to verify that the phone hasn't been stolen.

Sadly, the seller had done the factory reset, but hadn't followed up with the verification, and completely failed to respond to my queries; I ended up raising a refund/return request, and still only got an automated "you can return it now" response on the very last day before Ebay would have auto-refunded me.

Thankfully, a bit of searching around threw up a solution. I can't remember the exact details, but it was something along the lines of: open the keyboard's accessibility options and click through things until you got to a help page where you could trigger the Youtube app, from which you could get into the phone's settings and trigger a full credential reset.

Then it turned out that the phone was locked to the wrong network. Fortunately, there's people selling unlock codes on Ebay for 99p, so I just bought one of those - far cheaper than the high street or dedicated unlock websites, and I'd pretty much given up on trying to get anything else at all from the seller!

Ah yes, the good old days before ebay! I bought just over a hundred Toshiba laptops in our local auction from a company that went bust. All were BIOS locked, so as no-one could get in to them I managed to pick them up for peanuts.

This was back in the time though all you had to do is have a spare parallel port connector and solder a couple of wires to the back of the connector. Plug it in to the laptop, turn it on and one wiped bios password.

There, I fixed the hotel wifi

Hanoi, 5 years ago, I think they hotel was Blue Lotus or something like that: I could connect to the hotel wifi with the phone but there was no Internet access. Bummer, because I needed it to find out what to do in the city (What, talk to someone?! In person? Pfft.) Well, I put the gateway IP in browser...nice, a router login page! Tried the usual default admin passwords and voilà, I'm in. Looked through the configuration, couldn't see anything wrong so I just selected the reboot option, waited for a minute... and Internet! Yay!

Turns out the tourist guides are not worth anything. Just go to the street side stalls with the small plastic chairs, you get the best food there!

Yes but unfortunately

Yes, but unfortunately they make you sign these pieces of paper saying you won't talk about it for twenty five years after you leave the org....that being said, there isn't a system that can't be breached.

Their part in his downfall

It's 1942. Artillery sergeant is teaching gunners how to fire a machine gun. Sgt asks if anybody has fired one before.

S. Milligan Esq continues the narrative: "I had but I said nothing. In the Army never volunteer for ANYTHING." - from "Adolf Hitler, My Part in his Downfall" by Spike Milligan (sorely missed).

Dbase IV

Remwmber back in the day cracking a password protected Dataease 4.whatever for Dos database. All you had to do was to make a new one with the same name and copy over the password file to the locked one ... convienently called something along the lines of PassAAAA.dbf...

Not impressive but....

...I was chuffed & know I was SUPER lucky.

Just been asked to get a password for Excel that was set to protect a sheet. Not the best of security I know but still. Normally use an article I found ages ago about the AllInternalPasswordMacro. Didn't use it this time, wanted to try something different.

I use Sysinternals software all the time. Didn't think it would help though, really need to look at memory I thought. So turned to Process Hacker. Ran Excel, got the Unprotect Sheet dialogue box up, put in anything, got the "The password you supplied is not correct" box up then looked in Process Hacker. Looked at the properties of Excel, looked at memory, then looked at Strings, did a filter for word "password" and only a few results back all related to the "The password you supplied is not correct" dialogue box. Double clicked it to show what was in memory at that moment in hex. Saw that wording and soon after saw

s.i.t.e-n.a.m.e

I wondered if this was some kind of hint prompt so put in the actual site name that the document was about. Sure enough it worked. I was in.

Nice.

I've tried to recreate it on the same document but can't. Haven't seen the s.i.t.e-n.a.m.e in the hex entries since. And playing with excel it appears when you set the password for the protection of a sheet, there is no option to give a password hint.

Got proper lucky on that one. Maybe I'll buy a lottery ticket tonight.

Where do I start...

My first proper job, not counting work experience during high school, was very late '70s to very early '80s. Working for a company that designed and built a S-100 computer. At one stage we had sold one of those computers to the company that ran the catering and housing for a mine site that was under construction. I got to live on site for a while, programming that computer, and then the second computer they bought.

At one stage they added some fancy security locks, two to keep the case locked, and eight front panel key switches to unlock various functions depending on what key you had. Some sort of unusual geometry of the keys, I think it was sorta 3D triangles or some such. Supposedly unpickable. So one day, I'm twiddling my thumbs while I wait for a compile, I have a medium sized screwdriver, and a gleam in my eye. I love a challenge. Stop me if you've heard this one before. Didn't take long to "pick" one of the case locks open, which was just shove the screwdriver in and jiggle it randomly a bit, barely any force needed. Close it up again, go get one of the bosses, demonstrate it to him.

Since the office computers where being used during business hours, I was often working on them during the night. Remember, this was early '80s, computers where rare. Since I was in the office of all night anyway, the client slung me a bit of extra cash to be the emergency accommodation officer. Late arrivals needing to sign in and get their rooms assigned, drunks coming home from the pub but lost their key so I had to cut them a new key, that sort of thing. The main accommodation was demountables with small rooms and cheap locks. Aluminium keys that would break off leaving half of it inside the lock, locks that would rust in the high tropical humidity and jam, etc. I became adept at pulling the pin out of hinges and opening the doors the other way, using needle nose pliers to grab the half key stuck in the lock and giving them a twist, and for those really hard cases, using a crowbar to break the seal on the windows and open them up, without actually breaking the windows. I've lost count of the number of places I have legally "broken and entered".

My next job was with the Department of Health. Usually I was in the IT offices, but once I had to go out to the head office, where they actually used the systems we developed. I should point out that up to that point, I had nothing to do with the IT security systems. For some reason or another I was in need of a real password to log onto some part of the system to check what ever they had sent me out to fix, something to do with patient records or billing I think. I didn't have a suitable real password, I only knew the test passwords. While someone went off to find a password for me, I pushed the return key for some reason. Once again, stop me if you've heard this one before. "Password" accepted, I was in. Repeat a few more times just to double check, indeed leaving the password field blank got past the password check. I reported this, and they asked me to fix it when I got back to my office.

Slightly off topic, but it did involve bypassing a security mechanism. At around about that time I had a game for my very own computer, on a floppy disk. It used the sort of copy protect mechanism where they use a laser to burn coded spots in the floppy disk. The idea is you write to those spots, of your can't read back what you wrote, the proper holes where in the disk, copy protection was in place, continue to boot the game. Naturally at some point the copy protection code managed to write to the wrong bits of disk, corrupting it so it would no longer boot. I'd paid good money for this game, and as state above, I love a challenge. Didn't take long at all to disassemble the boot code, find the call to the copy protection code, simply patch out the call, and boot my game. It was the copy protection code itself that had been corrupted. Some of the graphics had also been corrupted slightly, but it was still playable.

I'll stop now, the beginning of this comment is about to scroll off the top of my screen.

20-ton slabs of concrete... with a 2 dollars padlock.

I worked for a nuclear power plant, and one access to the reactor building was through a 20-ton slab of concrete on the yard outside. It had the tiniest padlock, the kind I wouldn't even use on my bicycle, securing it on the ground.

I laughed, but then I got the explanation: that was a SEAL, to show signs of TAMPERING, or signs that something inside the building had gone possibly VERY wrong. Like, "steam blast pushing 20 tons slabs out of place" wrong.

If you get past security with a 20-ton hydraulic arm truck and manage to lift that slab without proper authorization there would be some chewing around... and in an emergency, security can authorize the slab to be raised like the padlock wasn't even there.

I spent 4 years getting by that padlock snickering and thinking how clever it was afterwards...

While outside the plant, in the nearest neighborhood, distribution had a problem in their hands: the switchgear cabinets kept having their padlocks broken, but no gear or copper stolen from them... those were old-school brass padlocks, most valuable to junkyards. Once replaced with steel ones, nobody stole them anymore.

Not IT related, but I found parallel to these padlocks in computers, like those darned hardlocks used for CAD sofware...

This song could have been about me

Details differ, but this story is about 90% in sync with one of my own.

In the early 1980s, I was on a mainframe system that had a punchcard interface, and a terminal interface, which was actually just a terminal that simulated the punchcard system. This is important to the story.

The system used 8 different queues, and the terminal queue was only one of them. However, all terminal jobs, for all users, were using the same queue, queue #1. So if 200 users were using terminal jobs in queue #1, if you ran your job in queue #2, it would run much faster.

However, terminals could not use any queue other than queue #2. So, the secret (documented in the manual) was to use the SUBMIT command, to submit the job in another queue. Of course, you'd have to write all of the terminal inputs into the card deck ahead of time so your job didn't get stuck, but once you did, you'd find your job would run in 90 seconds rather than 90 minutes.

Now, at a terminal, you logged in with username/password. When you submitted a job to a queue, you needed to put /USER(username,password) card at the top so the job would log into the queue. A neat trick was that the card deck you submitted was the INPUT file, and you could play with it like a file pointer.

In other words, the following job:

/USER(username,password)

REWIND(INPUT)

COPY(INPUT,OUTPUT)

When submitted would result in the output to your job appearing in your queue, and you would see USERNAME(MYUSERNAME,MYPASSWORD) in clear text. Amusing, but not very useful.

However, the mainframe was networked to another, and when you changed your password on one, it would change it on the other... eventually. So you could run this job to see what your current password was, ie. if the change had propagated over the network yet.

But how does it propagate over the network, I wondered. It turned out it was done as another job in the queue, but was done with the site admin's credentials. So, I wrote a batch job that changed my password, that looked like

/USER

CHANGEPASSWORD(password,newpassword)

REWIND(INPUT)

COPY(INPUT,OUTPUT)

And lo and behold, the following appeared in my batch queue:

USERNAME(myusername,mynewpassword)

CHANGEPASSWORDREQUEST

USERNAME(adminname,adminpassword)

CHANGEUSERPASSWORD(myusername,mynewpassword)

USERNAME(myusername,mynewpassword)

**END JOB**

And lo, I had the adminpassword, in clear text, in my input queue.

The admins denied I could do this. So, I logged in using their password. I was called into the head of network security's office who said no, this was not possible, and then I logged in at a terminal in front of him. He still didn't believe me, and he changed the admin password. I told him I could get it in 10 minutes, and I did.

The end result was "tell anyone about this and you will not only be fired, I will have you killed" or words to that effect.

I had been hoping/expecting that I'd uncovered an implementation issue that they hadn't properly configured, which could be fixed now that they knew of it. Instead, I'd found a design flaw in the network security layer than required an operating system patch. This was $BIGNAME$ corporation, which had mainframes around the world, in sensitive areas (far more sensitive than in the industry I was using it in), and the idea that a low-level user could crack the admin password in under 10 minutes stopped several hearts in the boardroom.

Eight months later, I was called back into the head of network security, and told to try it again. The bug had been addressed in a patch, but it was still being rolled out worldwide, and I was still not to speak of it "ever again". Which, technically, I guess I am, except (a) this story is 30+ years old, (b) the mainframe I refer to is almost entirely obsolete, as is the network it ran on, and (c) the issue would only affect said mainframe whose patch levels aren't at 1982 or so level yet.

Exploit?

Does it count as an exploit when it was designed to it and is in the manual?

At a previous NHS...

...trust if I remember right they used Sophos encryption. I pointed out a flaw but was told "its a feature" because I "wasn't in with they boys" (c**ts more like. Harsh but fair description).

Sophos had a bad habit of locking us out of the laptops at boot. Would lock your account as well. But I had an old laptop I kept back that had my account on it that was unlocked. All I had to do was boot from the laptop with the unlocked account which would unlock the other laptop.

I gave up convincing them it was an issue. I left and later discovered someone else pointed it out. They finally listened and discovered they made the laptops overall the server instead of the other way round.

Dicks.

Lock Story 1: Bank Holiday Locksmith

Elderly neighbour locked herself out, distressed at the cost of a bank holiday locksmith (but not quite distressed enough for the police to break in for her) she mentioned there were keys inside in the lock of the other door.

Out we went with toolbox and a small mirror to make something to hook the keys out through the front door letterbox. Took maybe an hour, Victorian terrace street plenty of people passing and not one single person queried or even jokingly mentioned what we were doing.

I guess it was the toolbox. I'm told a hi-viz and a bucket of water will get you in just about anywhere.

Lock Story 2: Young, Dumb and (not) Full of Chips

Same street, fire engine turns up outside one teatime and their radio came right through the hi-fi (A&R A60). Turns out the young female student occupant (details that seemed important to the fire service) had locked herself out with a fryer going on the hob.