170: Phrack

0:28Hey, this is Jack, host of the show. two episodes before this, before doing this one, just to have the context, but you don't have to if you'd rather not. But the thing is, is that in this episode, I interviewed two of the FRAC staff. The magazine just celebrated their 40th anniversary, and I'm pretty sure if you run a hacker magazine for 40 years, there's got to be some interesting stories in there somewhere.

0:54These are true stories from the dark side of the internet.

1:00I'm Jack Recider. This is Darknet Diaries.

1:30sensitive data and digital assets vulnerable. But imagine a world where your cybersecurity strategy could prevent these threats. And that's the power of ThreatLocker Zero Trust Endpoint Protection Platform. Robust cybersecurity is a non-negotiable to safeguard organizations from cyber attacks. ThreatLocker implements a proactive, deny-by-default approach to cybersecurity, blocking every action, process, and user unless specifically authorized by your team. This least-privileged strategy mitigates the exploitation of trusted applications and ensures 24-7, 365 protection for your organization. The core of ThreatLocker is its Protect Suite, including application allow listing, ring fencing, and network control.

2:10Additional tools like the ThreatLocker Detect EDR, Storage Control, Elevation Control, and Configuration Manager, enhance your cybersecurity posture, and streamline internal IT and security operations. To learn more about how ThreatLocker can help mitigate unknown threats in your digital environment and align your organization with respected compliance frameworks, visit threatlocker.com. That's threatlocker.com.

2:57leaders like you. Drada automates the tedious task, security questionnaire responses, continuous evidence collection, and much more, saving you hundreds of hours each year. With Drada, you can spend less time chasing documents and more time solving real security problems. With Drada, you also get access to a powerful trust center, a live, customizable product that supports you in expediting your never-ending security review requests in the deal process. It's perfect for sharing your security posture with stakeholders or potential customers, cutting down on back and forth questions and building trust at every interaction.

3:30Ready to modernize your GRC program and take back your time? Visit drata.com slash darknet diaries to learn more. That's spelled D-R-A-T-A, drata.com slash darknet diaries.

3:46Okay, first, let's start out with some introductions. Hi, my name is Skyper. I used to be the editor of the Frack magazine in the year 2000 to 2005. and I've joined the FRAC staff recently again as an advisor. Hey, I'm Tim Zee. I'm one of the current staff managers of FRAC Magazine. In your words, can you tell us what is FRAC Magazine? So FRAC stands for freaking and hacking. It's a combination of these two words and it used to be the manipulation of the phone lines. Effectively, the main goal was to get you free phone calls that are very hard to trace. Frack Magazine. This is all sorts of things, hacking related, to be honest.

4:33I think there is the infamous article on how to make a bomb as well from the past. Yeah, I mean, I think I saw that even in issue one. There was a balloon that had acetylene in it that we put like snap caps or pop caps on it and throw some rocks together. And you throw the balloon off like a roof and when it hits the ground, the snap pops, the little popper snap and then it creates a little explosion. I think that was issue one. And so it's interesting how anarchy kind of shows up in frack. Like bombs, what is this doing in a hacker magazine? I think we have to put this into a different context of where we were 40 years ago.

5:18Terrorism didn't really happen, at least not in most countries. And so building bombs was not seen as necessarily something evil or criminal, but was just young kids exploring things. What can they do? They didn't mean to do any harm with them. They were just experimenting.

5:40In my opinion, FRAC seems to capture some kind of counterculture. It's notes from the underground type stuff. Because back in the 90s, cybersecurity wasn't quite a mainstream profession yet. Like schools didn't teach you how to secure networks or how to hack. But nowadays, almost every major university has a major in cybersecurity. So back in the 90s, there was just this underground group of people breaking computers, basically, and talking about it in chat rooms and on forums. You had freakers, hackers, rippers, crackers, seeders, which welcomed in artists and musicians who were making things on their computers.

6:15And this was collectively known as the scene back then. And I think it was this underground scene that FRAC was born out of and has its roots in. So the scene was made by largely people trying things out with their new hardware that they found or trying to make something do something that was not supposed to be doing or there was not engineered to do. So that's what the original hacker was all about. I think if you summarize it, then FRAC contains condensed, hardcore technical articles without any bullshit. The stuff works and it's practical. I'm fascinated by these two cultures, the cybersecurity professional and the scene hacker.

6:55One does it for money and it's their career. And one does it for fun. It's their hobby. But they are both passionate about it. One tries to do it in the light. One wants to do it in the shadows. But they both like sharing what they know. What's the difference, honestly? Attitude? Style? But as computers grew more mainstream, becoming more common in every house, more interest grew in hacking. I mean, I'm sure you've gotten some kind of new electronic at some point in your life, and you sat down and you said to yourself, what are all the cool things that this thing can do? So imagine getting a computer and learning that it can print stuff and play games and make sounds, but then also hearing about some of the secret stuff it can do, like hack other people's computers.

7:44Some more people got fascinated with hacking and were contributing to things like FRAC, submitting articles on how to do cool secret stuff on your computer. But also, along with the rise of computers, the cybersecurity profession became popular, which sort of brought in a whole new culture of hackers. These weren't the rollerblading, cargo pants-wearing Mohawk kids. The cybersecurity professional wears a collared shirt and sometimes a tie. You can see the stark contrast of these two cultures when you go to conferences like Black Hat and DEF CON. At Black Hat, you see people wearing suits and ties.

8:21They say they're geeks and nerds, but they don't look it. At DEF CON, there's a lot of people wearing cargo shorts, black shirts, hoodies, having mohawks. At Black Hat, I feel like those people have to be there for work. But at DEF CON, I feel like those people want to be there for the fun. And because I grew up in the scene, my heart is still there. We were the kids who tried stuff with no manual or tutorial. We built things that weren't possible. We did it without permission or rules. We pushed the boundaries and explored a new frontier. Which also, like a lot of those things, they actually paved the ground for like a lot of the security industry exists now.

9:02So a lot of people's job, they exist because of some of the articles that were written there, which is very interesting. At this point, we're 40 years into FRAC, and some of the articles have historical significance. Historical significance has the article of the E911 documentation that was released in 1989, I believe. I think it was issue 24. And it was the documentation that detailed how the emergency 911 system works in America. and it was the first time that FRAC got into some legal problems with the authorities. I think that has some significance because it happened right after Operation Sun Devil with the Secret Service hunting hackers.

9:46And it also sparked the creation of the Electronic Frontier Foundation because the FRAC person who released that article was so unfairly treated by the government and by the corporates. Yeah, I think that article solidified Frack as the coolest hacker magazine ever because the founder, Night Lightning, or one of the early founders, got arrested for publishing that article and then fought the law and won. And so it's like, well, I got arrested for hacking and I, and I beat it and I got off scot-free. And that, that was just such a, such a middle finger to the, to the establishment of like, no, we're, we're, we're hackers and we can beat you.

10:30And we did beat you in your court, in your arena, in your court of law. We still won. We didn't do anything wrong. Screw off and leave us alone. And that must have been just like the most amazing, epic moment for the time to beat the law. And I know there were some other FRAC contributors that weren't so successful with that E911 article. They pled guilty before they could fight it. But the fact that that happened, and one of the only times anyone ever has been arrested for a CFAA violation and got off, it's only like I can count on one hand, I think, how many times that's happened. and FRAC was one of them.

11:09So yeah, that was definitely quite an article. Yeah, Night Lightning faces 60 years in prison and$122 ,000 in fine. That's a lot more money nowadays, I think. Another article which made big waves was titled Smashing the Stack for Fun and Profit. So Smashing the Stack for Fun and Profit, issue 49 was the first article that told to the wider audience how buffer overflows work. So in the olden days, buffer overflows were used to trigger a computer, a target, to execute a program that is not intended to execute, to break into a computer system, so to say. And this article detailed it, how to do it yourself, how you can do it.

11:55It was not the first time it was used on the Internet. The first time was probably by Robert T. Morris, who wrote the very first Internet worm. And there were other articles around how to manipulate the stack. But it was never that detailed in that clarity and reaching such a wide audience. When this article came out, Buffer Overflows became the new favorite way hackers would break a system. And it was a favorite because of how successful it was to do. Programs just weren't designed to stop this from happening. And so many things were vulnerable. I think the race just started with source code reviews and finding vulnerabilities, disclosing them, irresponsibly disclosing them in the olden days, and then slowly getting an idea of what responsible disclosure is, that not every corporate is your enemy, and trying to work together with them, trying to find common ground, how we can make the internet a better place for everybody.

12:52This is one of those cases that this was like a very elite and underground technique, known probably just by governments or things like this, that when the article was written, it just clicked in so many people's minds. So there was this media of software that's abundantly available and most likely vulnerable. They could just fool around with it everywhere. So just to put this into perspective, when I started out with computer security and hacking, When I wanted to learn how to break a computer system, I've been told what you have to do is you have to go to the library. You have to find the book about Robert T.

13:36Morris. You have to find and read the articles, the news articles, to piece together information how he did it. And then when FRAC came out with Smashing Stack and Fun and Profit, it was all clear immediately. Back then, hackers weren't very respected. Companies would try to ignore the vulnerabilities that they were told about. almost with the audacity of being upset that somebody would buy their software and then try to break it as if hackers were the problems, like they were just some punk kids trying to jab their fingers in somebody's eye. I think that has flipped. And I always like to compare it against the early companies who did safety assessment for cars.

14:17The car industry tried to sue them and outlaw them and says, What are you doing? You can't show the people how dangerous it is to drive without seatbelts. But they did. And now everybody has learned that it is right to have a seatbelt. It's good to have a seatbelt. And the same thing happened with this article and with the exploit development. In the beginning, they were hesitant. They were blaming the hackers for releasing such destructive technology. But if the hackers hadn't released it, then other governments surely would have exploited these holes anyway. True. Now they don't do this only for the fun.

14:54They do this mainly for the profit. And it 100 % became a business and a career. People are hired now to hack companies to assess their security. You see this every day. There's a lot of episodes that you covered already about companies that they hire people to do penetration testing and their physical security and all those things. This was unthinkable back then, I think. There are so many good articles on FRAC. I think the NMAP won the art of port scanning from issue 51 by Fjodor, which followed the release of the NMAP tool. NMAP was the grandfather of all port scaners out there. Oh, wow. Yeah.

15:36NMAP is the de facto tool, almost the standard for how we do port scanning today. It's a super simple command line tool. And the person who made NMAP published how to effectively port scan using the tool on FRAC. and that taught millions of people how to port scan. Even today, NMAP is still highly used by just about everyone in cybersecurity. And there's another article in FRAC which goes into detail of how to do GPS jamming. I like that this article is in there because it shows that GPS jamming is not really cybersecurity, but it is GPS in itself is a technology that everybody uses and that nobody ever really thought about how vulnerable it is.

16:19And because it is already a very weak signal coming from the satellites, of course you can jam it. But it was not apparent to everybody until we released the article. And then you could buy jammers. Two years later, you could jammers all over the place from China and whatnot for very low money. But it was Frag First who released that article and got this idea out there that, hey, GPS is actually very easy to jam. No one ever thought about that. That's a good point. I don't always know where the line is on whether something is a cybersecurity problem or not. I published an episode recently about a credit card skimmer, and a lot of you complained and said that episode had nothing to do with cybersecurity.

17:00And it made me wonder, okay, well, if it's not a cybersecurity problem, whose problem is it? I mean, if you've got articles on Frack, Hacker Magazine, that shows you how to exploit a technology and compromise the integrity of it, then maybe that is a cybersecurity problem. And of course, we had the Hackers Manifesto article from 1986. For me, this is the most significant article in all of FRAC, just because it sets out the baseline and the conduct, how hackers should behave and what hackers should do and should not do and how we think. Oh yeah, I told you about the Hacker Manifesto in one of the previous episodes.

17:39One of the Legion of Doom members wrote it and published it first on FRAC. And I'll give you a short excerpt from it. I'm reading from Frack here. This is our world now. The world of the electron and the switch. The beauty of the bod. We explore and you call us criminals. We seek after knowledge and you call us criminals. We exist without skin color, without nationality, without religious bias. And you call us criminals? You build atomic bombs. You wage wars. You murder. You cheat and lie to us and try to make us believe it's for our own good. Yet we're the criminals? Yes, I am a criminal. My crime is that of curiosity.

18:16My crime is that of judging people by what they say and think, not what they look like. I am a hacker, and this is my manifesto. You may stop this individual, but you cannot stop us all. After all, we're all alike. Yeah, these things are still valid today, maybe perhaps even more valid today than they were back then. That we are all equal, that we don't care about skin color, religion, our nationality. And a lot of criminals forget this. And that's why they are criminals, they are not hackers. If you hack for a nation, you're not a hacker. You're actually more concerned about your nationality than about the hacker manifesto, where we don't care about that.

18:58We only care about skills. Correct. Yeah, I wrote a little bit about it in the last FRAC, FRAC72. We're going to take a quick ad break here, but stay with us, because when we get back, we're going to get into my favorite FRAC stories. This episode is sponsored by Meter, the company building networks from the ground up. If you employ and work with IT engineers, you're going to know how hard it is for them to do their job well. What your business wants is performant, reliable, secure networking infrastructure. But what you get is IT resource constraints, unpredictable pricing and fragmented tools.

19:31You and your engineers need a modern platform that you can all trust to support your business. Enter Meter. Meter delivers a complete networking stack, wired, wireless and cellular. in one solution that's built for performance and scale. Alongside their partners, Meter designed the hardware, writes the firmware, builds the software, manages deployments, and runs support. That means less time your employees spend writing to multiple vendors and more time working on improving your IT systems. Meter's full-stack solution covers everything from first site survey to ongoing support, giving you a single partner for all your connectivity needs.

20:03Thanks to Meter for sponsoring this show. Go to meter.com slash darknet to book a demo now. That's spelled M-E-T-E-R. meter.com slash darknet and book a demo now.

20:19The first issue of FRAC was published in 1985 before websites were popular. So it was just hosted on a BBS and you had to like use your home phone and dial into it and read it that way. And they wanted the articles to spread so they encouraged people to mirror it on other people's BBSs and other towns. But eventually when websites became popular Frack moved to Frack.com, and that became its new home. But it didn't stay that way. I think Frack.com got hacked at least once. The web server was often down, not reachable. Somewhere around 1998, Frack.com went offline. It stopped publishing articles for two years and was down most of the time.

21:01I should also mention that Frack changed owners quite a bit. The original founders went off and did something else. New people came in and they were doing stuff, but it's a free magazine and they never tried to make money. So it relied on volunteers to keep it going and they could only spend so many years of their life before going off and doing something else. By 2000, the site looked dead. The website had been mostly offline for the past few years and no new articles for two years. And at that point, it was ran by Mike Schiffman, aka Rout. Skype wasn't involved at all. And Mike didn't even know who Skyper was, but Skyper had a plan.

21:39He wanted to revive FRAC and needed to do something epic to prove his worthiness. And so I decided to steal a domain, which was frac.org, which back then was not owned by the FRAC staff. It was owned by somebody who probably didn't even know about FRAC. How did you steal a domain? I mean, luckily in the olden days, these things were rather easy. You would go to the domain registrar. In this example, it was a French one, Gandhi.net. And you would initiate a domain transfer. And it would ask you that you need the authorization code to transfer it. And you would right-click on the web page and save a few source code of the web page.

22:23And the authorization code would be written there in a hidden HTML tag, in a form tag. And that was all you needed back then to do hacking. Wow, so just by looking at the view source of a website, it would show you the authorization code that it was expecting in order to prove that you're the owner of the site. I mean, it has to compare the authorization code you type in with something, right? So there's some logic on the back end somewhere. It just happened to be right there in the source code of the site. It was as simple as just doing view source, and then you could take over anyone's domain.

22:55But you also have to put this into perspective. Back then, not many browsers had a feature to actually view the source code. So, Skyper had frac.org and wanted to use it to revive frac.com. But he wasn't doing this alone. He actually was involved with a few hacking groups, specifically HERT and Tesso. So, HERT stands for the Hackers Emergency Response Team. And HERT was founded around the same time when the CERTs were founded, the Computer Emergency Response Team. And it was meant to be a counterweight to the CERT because the community felt that often the CERT, the computer emergency response team, didn't really know what they were doing and the publications were often not technically correct.

23:41And so the community created the hackers emergency response team where the hackers published their version of the vulnerability and their exploits and their assessment of the risk. And yeah, that was what Hurt was. And TESO was a German slash Austrian hacker group who later became more internationally and went by the name of Team TESO. So with frack.org in hand and with TESO and Hurt behind him, Skyper got busy recreating the site to show he can manage a website like that. And then I spent many days and many nights to recreate all the articles. I put them in an SQL database that was searchable and copied all the data.

24:24I created the webpage and then put it online and then called Mike Schiffman, who was the editor-in-chief back then. I caught him doing breakfast. He was literally saying, I'm just having breakfast, but what you're saying sounds great, so let's do it. There was no hesitation. And it was a combination of people from Tesso and Hurt who took over the FRAC magazine in 2000 or revived the FRAC magazine in the year 2000. So Skyper was now in control of FRAC and it officially moved from FRAC.com to FRAC.org, which is where it remains today. And it was a whole new fresh team. Nobody from the old FRAC staff was around to write any articles or to help.

25:08So this new team got busy with a fresh new issue, issue 57. Yeah, well, the first one already was the first hardcover release ever. So we decided we want to land with a big bang and decided for our very first release, not just are we going to write all the articles ourselves, we also create the first hardcover release, which we released at a hack conference, a physical copy. So in 2001 was the first time Frack had a hard copy created, elevating it to the next level. It was fantastic. It was a fantastic success. I think we printed 800 hard copies or so. We all picked them up with a car, with a rented car.