Grade "A" Hacking (Autumn 1989) ------------------------------- By The Plague What is UAPC? UAPC stands for University Applications Processing Center. This is a computing and data processing facility that deals with academic record keeping and processing. One of their jobs is to process student applications for CUNY (City University of New York) schools. Another job, and this is the part that interests us most, is to process student records for the New York City public high schools. Nearly all New York City public high schools are connected to UAPC. There are 116 public high schools in New York City (with several hundred thousand students). The reasons for interconnection are obvious. If every school had its own student data storage computer, its own proprietary software, and its own staff trained on that particular system, the cost would be too great. Not only that, but data transfer and statistical analysis would be impossible for the school system as a whole. As an example, there would be much paperwork, chaos, and confusion just to transfer a student from one school to another. Computing the drop-out rate and other valuable statistics like standardized test scores would involve every school sending in reports generated by its own computer system, and hence more paperwork, more bureaucrats, and more confusion. So now you understand why all NYC high schools are linked by modem to this one computer. All grades, attendance, course records, and schedules for every New York City high school student are stored and processed at UAPC. Where is UAPC? UAPC is located in Brooklyn at Kingsborough Community College (across from Sheepshead Bay at the far end of Manhattan Beach). The actual computers and personnel are in Building T-1 (or simply building ONE). If you happen to go trashing there sometime, building T-1 is a one-story tan colored aluminum shed. It looks sort of like a gigantic tool shed. Above the entry door is written "ONE" in large black plastic lettering. By the way, you re allowed to go in. Nobody is going to check ID or anything like that. If you look like a student, no problem. The reason for this is that T-1 connects to T-2, another shed (blue in color), which has many classrooms. The actual UAPC office is directly to your right as you enter T-1. In each New York City high school, there is something called a "program office." This room usually contains terminals and big printers and it's where each school creates class schedules for teachers and students, among other things. The staff that work in these offices are trained at UAPC. Technical Information about UAPC Enough background; here's the scoop. UAPC computers run on IBM mainframes (IBM 370 and 3090). The virtual operating system that is used is MVS (which is much like the familiar VM/CMS). On top of MVS runs Wylbur (pronounced will-burr, not while-birr), which is sort of like a command shell plus a batch language plus an editor all rolled into one. On top of Wylbur, run the actual applications (jobs) for processing of grade files. There are several applications for various tasks (entering grades, entering attendance, class scheduling, generating transcripts, and various other reports). These applications are written in a batch-like language and are stored on disk in source code format. The reason for this is that each school has its own way of doing things (i.e., naming conventions for classes and sections), and the batch programs can be modified by either UAPC or qualified people who work in each high school's program office. These applications are submitted to run on the IBM machines with the JCL code appended at the top of each application. Each school connects to UAPC via a terminal and modem and each school is allocated its own directory (or library as the batch-heads call them) on the system. This directory contains the applications (jobs) that the school uses each day for various activities. Data files are also contained in these directories. The data files are in a pretty much IBM standard format (although stored in EBCDIC instead of ASCII). Input records for each application are usually fed in using punch cards or scan-tron type readers at the local school. If you've ever gone to a New York City high school you'll know what I mean: The attendance punch cards are brought down each day from each homeroom to the program office. Also, each teacher would fill in attendance forms (used to detect class-cutting) using a number-2 pencil. These forms look like the test forms for the SATs. Sometimes, however, input is entered manually at the terminal in the program office, usually for query type jobs. For instance, if one student lost his class schedule and wanted a replacement, he would have to go to the program office and ask for one. They would run that application on the terminal, print up a schedule for that student, and give it to him. How Do You Know if Your School is on UAPC? If you go to a New York City public high school, then the chances are 95 percent that your school is on UAPC. If you are not sure, look for the telltale signs at your school. Does your homeroom teacher use punch cards? Is your transcript laser-printed on white paper and divided into nice columns grouped by academic subject? Does your school's program office contain terminals and printers? Is your class schedule (aka program card) printed on 5.5"x7" paper (either heavy-bond white or thin-bond blue)? Is your grade report (aka report card) printed on computer paper, about 5.5" high (regular width) with a blue Board of Ed logo in the middle, with explanation of grades (in blue) on the back? Do you get little yellow or white laser-printed cards in the mail when you play hooky or cut classes? Any of these sound familiar, boys and girls? They should, because almost every New York City public high school fits all these categories. If your school fits any of these (especially the punched cards and terminals in the program office), then you can be sure that your grades are lurking somewhere in the bowels of UAPC. Logging on to UAPC To get on, you're going to need a dialup. It's not too much work getting the dialup, if you do a little snooping and trashing around the program office at your school, you should find it written down somewhere. However, I will save you some time and tell you that there are at least 12 dialups for UAPC in the 718-332-51XX number range and several in the 718-332-55XX range. There are many more elsewhere (usually exchanges local to Kingsborough Community College). You should only connect to UAPC on school days during valid school hours. You can connect to UAPC at either 300 or 1200 baud. However, in an effort to thwart people for finding their dialups, UAPC will not print anything to the screen unless you connect at the right format and hit a few of the right keys. Therefore, you should use the following procedure in order to connect: Call at 300 or 1200 baud, using 7 data bits, even parity and 1 stop bit (7E1), and local echo (or half duplex). Once connected, hit the RUBOUT/DELETE key (ASCII code 127 or 255 [hex $7F or $FF]) three times, and then hit return twice. You will be greeted with the following: UAPC MVS390A LINE 10-TEN 11:59:02 03/22/89 11:59 Wednesday 89-03-22 You are signed on to U.A.P.C. Have a good day. TERMINAL? When you are prompted for the terminal, just enter a letter-two-digit combination (A99 works just fine). You will then be prompted for "USER?" which is your school's login ID. The format for the username is $HSxxn, where xx is a two-letter abbreviation for your school's name, and n is a digit from 1 through 9, indicating the particular account used by the school. N is usually 1, 2, or 3. An example of a user ID is $HSST1 or $HSST2, which are the user ID's for Stuyvesant High School in Manhattan. You can guess at your school's user ID (it's easy enough, for instance Sheepshead Bay High School would be $HSSB1 or South Shore High School would be $HSSS1, etc.), but a better way is to pick up the trash from the program office. You should find stacks of green and white printer paper that is 132 columns in width. The user ID will be almost everywhere throughout most printouts generated. Remember to look for the $HSxxn format. After entering a valid user ID, what you will see next depends on several things. Normally you should see the "PASSWORD?" prompt, but on some accounts you may also see a "JOB?" or "KEYWORD?" prompt. This simply depends on the school, however 90 percent of the accounts only ask for the PASSWORD. The JOB and KEYWORD are simply additional passwords. However, every user ID has a PASSWORD on it. Usually only $HSxx1 accounts have JOB or KEYWORD passwords. However most schools have several accounts (usually two or three), and the $HSxx2 and $HSxx3 will usually have only the "PASSWORD?" prompt. There is no difference in access privilege between the various accounts at each school. They are simply there so that more than one terminal at each school can be logged in at the same time. Getting the Password Naturally, you're going to need the password if you are serious about doing anything with UAPC. There are several options here. However, one option that I would not recommend is that you attempt to hack the password by brute force. UAPC has a nasty habit of allowing you four attempts at the password before it disables that account and notifies the security dudes at UAPC. If you disable your school's account, your school's program office must call UAPC by voice in order to reactivate it. There is a way around this, if you really want to brute-hack the account. After three password attempts, you should hang up and redial, and then do another three attempts, and so on. This will keep the counter from ever reaching 4 and disabling the account. Although it's a pain in the neck, there isn't much we can do about it. However, if you have no plans of ever getting into UAPC and just want to annoy your school, simply log on as them early each morning and disable their password. This will give them a headache to say the least, having to call up UAPC each day to reactivate their password. Other ways of getting the password include our old favorite, social engineering. Here there are two options. You can attempt to engineer UAPC by voice, thus saying that you are the school and that you need the password. Conversely, you can attempt to engineer the school by calling the program office by voice and saying that you are from UAPC and that you need them to change their password to a diagnostic password, which you will so kindly provide. If you're going to do social engineering, make sure you get some valid people's names at either UAPC or at your school. Yet another way to get the password is to do what was done in War Games, snooping around the program office. They usually do not have the password written down. But, and this is important, you can get the password if you can somehow manage to look over the shoulder of the terminal operator when he/she is logging in. Remember, they connect to UAPC at half duplex, and thus keys are echoed locally, meaning that you will see the password on the screen as it is typed. I know this for a fact. If you're hardware inclined, you can tap the line that connects to the modem and terminal. These lines are usually not connected to the schools switchboard, and can even be exposed outside the building itself. Use a tape recorder and a Radio Shack auto-pickup device to tape the transmission (which is usually 300 baud anyway). Play the tape into your own modem (set it on answer) and you'll be able to see the originate data (including the password) on your screen. If you haven't tapped modem lines before, I do not suggest using this method. Note that UAPC requires each school to change their password once a month, so make sure you get the password right after they change it. This will give you plenty of time to learn how to use UAPC before you attempt any stunts with modifying data. All About Wylbur Okay, you're in UAPC; what now? Well, once in you will be dealing with Wylbur. Like I said before, Wylbur is sort of like a command shell plus batch language and editor all built into one. You will know you're in Wylbur when you are given a "COMMAND?" prompt. There are some misconceptions about Wylbur that I would like to clear up right now. When most New York City hackers talk about the "grades computer" they simply refer to it as Wylbur. This is misleading because they are referring to UAPC. Wylbur is not synonymous with UAPC; the Wylbur shell is used at many different computing sites, which use MVS and IBM mainframes. It's sort of like equating VAX/VMS to the computers at DEC. VMS is an operating system and has very little to do with the machines at DEC headquarters. The same holds true for Wylbur and UAPC. Wylbur also runs on the other IBM machines at Kingsborough (which have different dialups, separate from UAPC). These machines have no affiliation with the UAPC machines. Therefore students using these other machines at Kingsborough must know Wylbur as well. Lucky for us, you or any student can purchase (no ID required) a Wylbur manual at the Kingsborough bookstore (Building U) for $4. Just ask the nice lady for the "Wylbur User's Guide," written by Ganesh Nankoo, and tell 'em I sent ya. If you do get into UAPC, I strongly suggest that you buy this manual. It is very informative and can keep your ass out of hot water. Some useful commands under Wylbur: RUN PRINT: run the exec program in your active area and print the output. RUN FETCH: same as above, but place output in fetch queue. FETCH*: fetch the last output and place into your active area. LIST: list current active area to screen. LIST OFF: list current active area to printer. LOCATE: locate all jobs submitted. LOCATE*: locate last job submitted. LOCATE 056: locate job 056. PURGE 056: purge job 056 which is on the output queue. COLLECT: input/enter data into your active area. CLEAR ACTIVE: clear your active file in memory. USE #name: load the file "name" from disk into your active area. SAVE #name: save your active area. SET PSW: change your password. SET KEY: change your keyword. SHOW DIR: show current files in your directory. SHOW USERS: show current users on UAPC. (Note: Your active file is a buffer used by the editor. You can list it, save it, clear it, load into it, run exec jobs from it, etc.) You can also get help on UAPC by typing HELP HELP (yes, twice. One HELP will not do the trick). Applications That Run on UAPC Once inside UAPC, you may have very little contact with Wylbur itself, and you will see a "WHICH JOB?" prompt instead of the "COMMAND?" prompt. The reason for this is because most of the time the applications are all automated and accessed from menus that are run by batch files, which execute when you log in. Thus, the system is very friendly. You may see a menu that asks you if you want to view a transcript, view a schedule, admit a student, dismiss a student, transfer a student, add classes, delete classes, etc. You simply choose what you want to do. Via these menus you will be able to do anything that the school administrators can do, including changing grades. Sometimes, however, there are no menus, and you will have to execute commands yourself. A list of these commands can be gotten using one of the HELP menus. Here are some of the jobs you can execute: ABSCOR, ABSINFO, ABSREP, ACADROP, ACAINFO, ACAMSTR, ADDSECT, ADDROP, ADRPLST, BATINFO, ABSINQ, CLASSLST, CODELIST, CUTINFO, CUTDEL, FIXCODES, FIXOFCL, HITRAN, GRDUPDT, LATCOR, LATINQ, MAIL, NGRUPDT, OFCLLIST, PUNRQST, REGISTER, REQADRP, REQINFO, REQUPDTE, SCAN, SCHEDULE, SKED, TRAN, TRANUPDT. You can drop straight into Wylbur by sending a . This will cause your menu shell program to stop executing. If you happen to leave the menu system and do drop into Wylbur (with its "COMMAND?" prompt) you can get back to the menu system by typing RUN. This will execute the menu shell program that is currently in your active area. Remember that each time you or your menu program submits a job (i.e., to change a grade), the job will be executed and the output will be placed on the fetch queue. If you don't want to leave a trail, then you must use one of the above Wylbur commands to find and PURGE the output of your completed jobs. If you do not PURGE the output, it has a good chance of being printed out at the program office when they print the output of all the jobs that they submitted. Changing Grades Clearly, this thought has crossed your mind in the past few minutes, so let me begin by saying that I do not recommend changing any records on UAPC. You can use UAPC to get all kinds of useful information on people and never get in trouble. If you do hope to change grades and get away with it, there are several things to consider. You must remember that your guidance counselor has physical backups of all your grades in his/her little notebook. If you've gone to your counselor for advice on which classes to take, you'll recognize the book of which I speak. The grades in this book are not generated by UAPC but instead entered into the books at the end of each grading period by the counselors using a pen or pencil. This physical record is only used as backup in case UAPC gets wiped out or something like that. Comparisons between UAPC transcripts and the physical record are almost never done, unless there is some kind of disagreement between the student and the school regarding the transcript itself. If you do plan to make a clean run, you had better cover all the angles. This means bribing some stupid kid to borrow the book for a little while so that you can make some modifications, give the dude $20, and make sure he doesn't know who you are. Guinea Pigs Before modifying either your physical record or your UAPC grades, I would strongly suggest using a guinea pig test subject. What this means is that you should pick some kid, any kid, who goes to your school and that you have never met and never plan to meet, change their grades, purge the output on the fetch queue, sit tight for a few days, and watch what happens. Keep a close eye on your test subject. If you notice the kid getting suspended or federal agents running around your school or something like that, you know that you better not mess with UAPC, at least not in your school anyway. If nothing happens, then you should decide whether to take the risk of changing your own grades. If you consider the use of innocent human guinea pigs to be distasteful, then you had better be prepared to risk your ass by using yourself instead. I do not consider it to be distasteful, but then again I am devoid of all ethics and morals anyway. You can still bail out at this point and your life will proceed normally. However, if you do change your grades (both physically and on UAPC) and nothing happens to you for several weeks, you can be almost 100 percent sure that you got away with it. Since both records (physical and UAPC) have been changed, there can be no discrepancies. Only your previous teachers will know what grades they gave you, and by now they will have forgotten who you are. Only your transcript speaks for them now. If you do get away with it, you can start mailing out those applications for Stanford and MIT.