_______________________________________________________

GUIDE TO (mostly) HARMLESS HACKING

Vol. 1 Number 3

Hacking tip of the day: how finger can be used as one of the most common
ways to crack into non-public parts of an Internet host.
_______________________________________________________

Before you get too excited over learning how finger can be used to crack an
Internet host, will all you law enforcement folks out there please relax.
I'm not giving step-by-step instructions. I'm certainly not handing out code
from those publicly available canned cracking tools that any newbie could
use to gain illegal access to some hosts.

What you are about to read are some basic principles and techniques behind
cracking with finger. In fact, some of these techniques are fun and legal as
long as they aren't taken too far. And they might tell you a thing or two
about how to make your Internet hosts more secure.

You could also use this information to become a cracker. Your choice. Just
keep in mind what it would be like to be the "girlfriend" of a cell mate
named "Spike."

*********************************
Newbie note #1: Many people assume "hacking" and "cracking" are synonymous.
But "cracking" is gaining illegal entry into a computer. "Hacking" is the
entire universe of kewl stuff one can do with computers, often without
breaking the law or causing harm.
*********************************

What is finger? It is a program which runs on port 79 of many Internet host
computers. It is normally used to provide information on people who are
users of a given computer.

For review, let's consider the virtuous but boring way to give your host
computer the finger command:

	finger Joe_Blow@boring.ISP.net

This causes your computer to telnet to port 79 on the host boring.ISP.net.
It gets whatever is in the .plan and .project files for Joe Blow and
displays them on your computer screen. 

But the Happy Hacker way is to first telnet to boring.ISP.net port 79, from
which we can then run its finger program:

	telnet boring.ISP.net 79

If you are a good Internet citizen you would then give the command:

	Joe_Blow

or maybe the command:

	finger Joe_Blow

This should give you the same results as just staying on your own computer
and giving the command "finger Joe_Blow@boring.ISP.net."

But for a cracker, there are lots and lots of other things to try after
gaining control of the finger program of boring.ISP.net by telnetting to
port 79.

Ah, but I don't teach how to do felonies. So we will just cover general
principles of how finger is commonly used to crack into boring.ISP.net. You
will also learn some perfectly legal things you can try to get finger to do.

For example, some finger programs will respond to the command:

	finger @boring.ISP.net

If you should happen to find a finger program old enough or trusting enough
to accept this command, you might get something back like:

 [boring.ISP.net]
 Login      Name            TTY  Idle     When    Where
 happy  Prof. Foobar        co   1d  Wed 08:00  boring.ISP.net

This tells you that only one guy is logged on, and he's doing nothing. This
means that if someone should manage to break in, no one is likely to notice
-- at least not right away.

Another command to which a finger port might respond is simply:

	finger

If this command works, it will give you a complete list of the users of this
host. These user names then can be used to crack a password or two.

Sometimes a system will have no restrictions on how lame a password can be.
Common lame password habits are to use no password at all, the same password
as user name, the user's first or last name, and "guest." If these don't
work for the cracker, there are widely circulated programs which try out
every word of the dictionary and every name in the typical phone book.

********************************
Newbie Note #2: Is your password easy to crack? If you have a shell account,
you may change it with the command:

	passwd

Choose a password that isn't in the dictionary or phone book, is at least 6
characters long, and includes some characters that are not letters of the
alphabet.

A password that is found in the dictionary but has one extra character is
*not* a good password.
********************************

Other commands which may sometimes get a response out of finger include:

	finger @
	finger 0
	finger root
	finger bin
	finger ftp
	finger system
	finger guest
	finger demo
	finger manager

Or, even just hitting  once you are into port 79 may give you
something interesting.

There are plenty of other commands that may or may not work. But most
commands on most finger programs will give you nothing, because most system
administrators don't want to ladle out lots of information to the casual
visitor. In fact, a really cautious sysadmin will disable finger entirely.
So you'll never even manage to get into port 79 of some computers

However, none of these commands I have shown you will give you root access.
They provide information only. 

************************
Newbie note #3: Root! It is the Valhalla of the hard-core cracker. "Root" is
the account on a multi-user computer which allows you to play god. It is the
account from which you can enter and use any other account, read and modify
any file, run any program. With root access, you can completely destroy all
data on boring.ISP.net. (I am *not* suggesting that you do so!)
*************************

It is legal to ask the finger program of boring.ISP.net just about anything
you want. The worst that can happen is that the program will crash.

Crash...what happens if finger crashes?

Let's think about what finger actually does. It's the first program you meet
when you telnet to boring.ISP.net's port 79. And once there, you can give it
a command that directs it to read files from any user's account you may choose.

That means finger can look in any account. 

That means if it crashes, you may end up in root.

Please, if you should happen to gain root access to someone else's host,
leave that computer immediately! You'd better also have a good excuse for
your systems administrator and the cops if you should get caught! 

If you were to make finger crash by giving it some command like ///*^S, you
might have a hard time claiming that you were innocently seeking publicly
available information.

*****************
YOU CAN GO TO JAIL TIP #1: Getting into a part of a computer that is not
open to the public is illegal. In addition, if you use the phone lines or
Internet across a US state line to break into a non-public part of a
computer, you have committed a Federal felony. You don't have to cause any
harm at all -- it's still illegal. Even if you just gain root access and
immediately break off your connection -- it's still illegal.
***************

Truly elite types will crack into a root account from finger and just leave
immediately. They say the real rush of cracking comes from being *able* to
do anything to boring.ISP.net -- but refusing the temptation.

The elite of the elite do more than just refrain from taking advantage of
the systems they penetrate. They inform the systems administrator that they
have cracked his or her computer, and leave an explanation of how to fix the
security hole.

************************************
YOU CAN GO TO JAIL TIP #2: When you break into a computer, the headers on
the packets that carry your commands tell the sysadmin of your target who
you are. If you are reading this column you don't know enough to cover your
tracks. Tell temptation to take a hike!
************************************

Ah, but what are your chances of gaining root through finger? Haven't
zillions of hackers found all the crashable stuph? Doesn't that suggest that
finger programs running on the Internet today are all fixed so you can't get
root access through them any more?

No.

The bottom line is that any systems adminstrator that leaves the finger
service running on his/her system is taking a major risk. If you are the
user of an ISP that allows finger, ask yourself this question: is using it
to advertise your existence across the Internet worth the risk?

OK, I'm signing off for this column. I look forward to your contributions to
this list. Happy hacking -- and don't get busted!

__________________________________________________________________

Want to share some kewl stuph? Tell me I'm terrific? Flame me? For the first
two, I'm at cmeinel@techbroker.com. Please direct flames to
dev/null@techbroker.com. Happy hacking!
_______________________________________________________
Copyright 1996 Carolyn P. Meinel. You may forward the GUIDE TO (mostly)
HARMLESS HACKING as long as you leave this notice at the end. To subscribe,
email cmeinel@techbroker.com with message "subscribe hacker
" substituting your real email address for Joe Blow's. 
___________________________________________________________________