[00:00.000 --> 00:03.440]  Hacking international networks and systems using VoIP.
[00:04.080 --> 00:09.040]  And, I guess, can anybody identify what these old-timey things are?
[00:09.420 --> 00:10.260]  Oh, yeah!
[00:10.620 --> 00:11.240]  Perfect!
[00:11.760 --> 00:13.280]  All right, very good.
[00:14.220 --> 00:15.720]  Now, what's this thing?
[00:17.680 --> 00:18.960]  PAP2 VoIP.
[00:19.400 --> 00:19.460]  Right.
[00:20.900 --> 00:29.840]  So, traditionally, a lot of people believe that you can't really use modems and VoIP adapters very well together.
[00:30.600 --> 00:36.700]  Because there's a lot of problems, like... Lots of problems.
[00:37.220 --> 00:37.660]  Compression.
[00:38.920 --> 00:40.000]  Things dropping out.
[00:41.120 --> 00:42.780]  You can't maintain a carrier.
[00:43.680 --> 00:46.980]  You'll just sit there and try to renegotiate over and over and over again.
[00:47.760 --> 00:52.360]  And, you know, that's one of the things that we kind of worked on to try to solve.
[00:53.380 --> 00:54.840]  And, you know, plus...
[00:54.840 --> 00:56.180]  Besides... We don't even use modems anymore.
[00:56.900 --> 00:58.240]  What's this Internet thing, you know?
[00:58.240 --> 00:58.880]  Right, right.
[00:59.220 --> 01:01.200]  Everybody hooks everything up to the Internet now, right?
[01:01.380 --> 01:01.560]  Yeah.
[01:01.740 --> 01:02.620]  No one drops their carrier.
[01:02.840 --> 01:03.020]  Right.
[01:03.820 --> 01:06.000]  So... But there are some ways that you can actually fix this.
[01:06.140 --> 01:07.140]  That you can actually...
[01:07.140 --> 01:11.660]  There are some variables that you can set that'll make your connections a little bit better.
[01:12.080 --> 01:13.380]  And that's like...
[01:13.380 --> 01:14.380]  I guess we'll skip that one.
[01:15.360 --> 01:15.880]  Like what?
[01:16.520 --> 01:16.900]  This?
[01:17.120 --> 01:17.340]  Yeah.
[01:17.840 --> 01:18.220]  Well, here.
[01:18.320 --> 01:20.260]  We're going to show that it is actually possible.
[01:20.260 --> 01:24.840]  We have a whole bunch of video and stuff like that for you to kind of enjoy.
[01:25.120 --> 01:28.940]  I mean, because... I mean, really, you really can do modems over VoIP.
[01:29.180 --> 01:33.140]  And what's really kicking about it is you can get some good speeds.
[01:35.460 --> 01:36.360]  Like 28.8.
[01:36.460 --> 01:37.560]  I've gotten 33.6.
[01:41.190 --> 01:43.630]  And yes, my ANSI blows.
[01:44.830 --> 01:46.150]  My ANSI emulation.
[01:46.950 --> 01:48.010]  That's not my name.
[01:51.080 --> 01:51.700]  All right.
[01:52.040 --> 01:57.640]  Anyway, so as you can see, you can still get and maintain really fast modem connections.
[01:57.980 --> 02:00.100]  Now, where can we go with this here?
[02:00.220 --> 02:00.900]  I just quit that.
[02:01.480 --> 02:05.560]  As you can see, we're displaying all the BBSs that still exist in Texas.
[02:06.420 --> 02:07.860]  Are there actually BBSs in Texas?
[02:07.860 --> 02:08.760]  Yes, there are.
[02:10.800 --> 02:11.320]  All right.
[02:11.480 --> 02:14.100]  So you have to have compression disabled.
[02:14.220 --> 02:16.380]  So you have to use something like mu law or a law.
[02:16.620 --> 02:18.160]  Something that's, you know...
[02:18.160 --> 02:19.100]  GSM sucks.
[02:19.280 --> 02:19.460]  Yes.
[02:19.680 --> 02:22.580]  GSM will absolutely kill it.
[02:23.300 --> 02:23.700]  So...
[02:25.440 --> 02:28.960]  Some adapters, they have a special setting for fax machines.
[02:29.240 --> 02:30.660]  So you'll dial, like, star 99.
[02:31.040 --> 02:35.640]  And it'll kind of set up the modem in a pre-configuration so that you can send a fax over it.
[02:35.640 --> 02:40.460]  Like the PAP2, if you do star 99 on that, it'll automatically disable echo cancellation.
[02:40.740 --> 02:46.200]  But if your adapter doesn't do this, then you can, you know, manually go in and tweak it.
[02:46.280 --> 02:50.900]  And, of course, you use a provider that you have good latency between as best as possible.
[02:51.160 --> 02:54.760]  Consistent, yeah, and preferably not dropping every other frickin' packet.
[02:55.360 --> 03:03.240]  Like, for example, for the Telephreak project, we're using a VoIP provider based out of, what is it, France or...
[03:03.720 --> 03:04.160]  Someplace.
[03:04.420 --> 03:05.640]  Yeah, someplace in Europe.
[03:05.860 --> 03:09.700]  And so we have the transatlantic leg, which is always constant.
[03:10.160 --> 03:12.800]  So you're always going to get that constant latency going on there.
[03:13.000 --> 03:14.360]  So, you know, it evens things out.
[03:15.600 --> 03:19.120]  And then, of course, make sure you put AT&K.
[03:19.120 --> 03:26.020]  Yeah, you, the modem, a lot of times, you can use the error correction and whatnot to help you get and maintain a good, solid connection.
[03:26.660 --> 03:31.520]  But you want to, but what the AT&K does, it actually turns off data compression.
[03:31.760 --> 03:34.220]  You don't need data compression in a compressed stream.
[03:34.440 --> 03:36.120]  It just makes things worse.
[03:38.020 --> 03:45.160]  All right, and then there's some variables that you just can't really address with no AT command set.
[03:46.200 --> 03:48.480]  Like if you're dialing into India, for example.
[03:50.400 --> 03:51.720]  Did they have a cross talk there?
[03:52.120 --> 03:52.840]  Probably a little.
[03:54.140 --> 03:54.860]  I've heard it.
[03:55.880 --> 03:56.860]  So what can you do?
[03:57.000 --> 03:58.280]  So now we've got a modem hooked up.
[03:58.680 --> 04:00.320]  And what the hell are you going to do with it?
[04:00.360 --> 04:00.920]  Where are you going to call?
[04:01.080 --> 04:04.540]  Well, you could hook some stuff up to the modem.
[04:04.740 --> 04:07.620]  Maybe you could hook up a credit card machine and call over VoIP.
[04:07.740 --> 04:08.980]  That would be a terrible idea.
[04:10.180 --> 04:16.800]  You could, you know, maybe start up a BBS and not do very much of that.
[04:17.760 --> 04:20.920]  And you can see if your buddy still has that BBS or that old hacker BBS.
[04:20.940 --> 04:22.200]  Run FidoNet, yes.
[04:22.360 --> 04:22.580]  Yes.
[04:23.340 --> 04:23.780]  Right.
[04:24.620 --> 04:25.060]  Absolutely.
[04:25.060 --> 04:25.800]  Yes, absolutely.
[04:26.140 --> 04:27.600]  So you could do that.
[04:27.800 --> 04:34.640]  But there's an entire world out there of, you know, a lot of people don't typically dial outside of the United States.
[04:34.660 --> 04:36.920]  So there's lots of other things to dial out up there.
[04:36.920 --> 04:37.600]  But why?
[04:37.960 --> 04:38.760]  I mean, I would.
[04:39.340 --> 04:39.700]  Absolutely.
[04:39.960 --> 04:40.320]  That's why I'm here.
[04:40.600 --> 04:43.540]  Also, if you have a satellite TV box, it needs to call in for authorization.
[04:43.740 --> 04:44.780]  It could be useful for that, too.
[04:45.400 --> 04:46.140]  Exactly, yes.
[04:46.140 --> 04:47.440]  I thought you had TiVo and...
[04:47.440 --> 04:47.660]  Right, right.
[04:48.100 --> 04:48.460]  So...
[04:48.460 --> 04:51.020]  TiVo does it also, but also satellites and table boxes do it.
[04:51.300 --> 04:51.900]  Right, right.
[04:52.180 --> 04:52.340]  Correct.
[04:53.560 --> 04:56.680]  Now, the connections that you're making aren't exactly, you know, light speed.
[04:56.900 --> 04:57.980]  But we're not doing PPP.
[04:58.240 --> 05:00.680]  We're not trading wares or downloading porn.
[05:00.680 --> 05:01.480]  It's text.
[05:02.340 --> 05:02.820]  And...
[05:02.820 --> 05:03.500]  Or...
[05:03.500 --> 05:07.880]  I don't know of any X.25 networks doing porn, but...
[05:08.900 --> 05:10.880]  So, let's see what we have here.
[05:10.980 --> 05:16.640]  And these are mostly non-IP, typically, networks that we typically play on.
[05:16.880 --> 05:18.560]  And I think the next one is the...
[05:19.380 --> 05:19.460]  Oh.
[05:19.460 --> 05:20.900]  Oh, we're going into X.25.
[05:21.180 --> 05:21.260]  Okay.
[05:21.780 --> 05:25.920]  So, basically, one thing that me and Jay Falcon started talking about...
[05:25.920 --> 05:30.660]  In America, there used to be a lot of X.25 networks like Telenet and TimeNet and stuff like that.
[05:30.760 --> 05:33.720]  And we said, gosh, I wonder if there's still any of those out there.
[05:33.860 --> 05:36.340]  Kind of thinking, you know, I doubt it.
[05:36.600 --> 05:40.780]  Well, you know, a lot of these networks were around, you know, 70s, early...
[05:40.780 --> 05:42.440]  Or throughout the entire 80s.
[05:42.840 --> 05:42.940]  Right.
[05:42.940 --> 05:46.060]  You know, we used to call, you know, a thing called PC Pursuit.
[05:47.020 --> 05:47.280]  Right.
[05:47.280 --> 05:48.260]  And, you know...
[05:48.260 --> 05:49.380]  PCPursuit.com is mine.
[05:49.780 --> 05:50.420]  I don't bet.
[05:51.500 --> 05:51.940]  Nice.
[05:51.940 --> 05:52.700]  You know, it's...
[05:52.700 --> 05:58.100]  You know, you drop 20 bucks a month, and during the off hours between 6 p.m.
[05:58.300 --> 06:03.220]  to 7 a.m., you'd be able to call through other out-dial modems.
[06:03.220 --> 06:11.080]  And there are places in, like, you know, New York, Chicago, Denver, Seattle, all these different places.
[06:11.080 --> 06:15.680]  So you connect to the Sprint network, or Telenet.
[06:16.320 --> 06:18.640]  I don't think that's the one I totally thought, believe it or not.
[06:19.220 --> 06:22.320]  We've already dialed all the Sprint numbers, and they are gone.
[06:24.620 --> 06:25.300]  Oh, the X.25?
[06:25.660 --> 06:26.800]  I think you might be right.
[06:27.120 --> 06:27.340]  Yeah.
[06:27.860 --> 06:29.540]  So it's also being used...
[06:29.540 --> 06:30.220]  One or two out there.
[06:30.220 --> 06:31.700]  It's also being used...
[06:31.700 --> 06:36.860]  A lot of the countries, for instance, like in India and whatnot, they already have the network infrastructure in place.
[06:37.080 --> 06:48.240]  So it gives them a means, like, one of the providers, they use an X.25 network to piggyback PPP connections and stuff like that to get, you know, citizens and whatnot onto the Internet.
[06:48.400 --> 06:49.440]  So that's the piggybacking.
[06:49.520 --> 06:52.300]  Well, they've already put the money into the infrastructure, so...
[06:53.060 --> 06:53.260]  Right.
[06:53.480 --> 06:56.360]  You know, it's just a matter of, essentially...
[06:56.360 --> 06:57.920]  And X.25 networks are...
[06:57.920 --> 06:58.620]  You know, the big modem pool.
[06:58.620 --> 07:04.400]  Are used for all kinds of interesting things, banking, corporate systems, ATMs, of course.
[07:04.540 --> 07:04.860]  Scatter.
[07:05.060 --> 07:06.480]  Everybody likes to talk about that.
[07:06.900 --> 07:09.160]  So, let's see what's out there.
[07:10.120 --> 07:11.080]  Oh, I'm sorry.
[07:11.280 --> 07:16.380]  A lot of these networks have equipment hooked up and they're not usually terribly secured very well.
[07:16.920 --> 07:17.820]  We've seen some...
[07:17.820 --> 07:18.820]  Out of band stuff.
[07:18.980 --> 07:19.180]  Right.
[07:19.460 --> 07:20.100]  Kind of scary.
[07:20.260 --> 07:23.320]  You know, they think it's on an X.25 network that nobody knows about.
[07:23.320 --> 07:26.080]  So, why put a password on that router?
[07:26.860 --> 07:27.300]  Yeah, right?
[07:27.480 --> 07:27.700]  Right.
[07:28.300 --> 07:28.740]  Absolutely.
[07:29.420 --> 07:29.980]  All right.
[07:30.680 --> 07:32.480]  But this isn't an X.25 talk.
[07:32.660 --> 07:33.180]  I mean...
[07:33.180 --> 07:34.680]  We're just touching on it real quick.
[07:34.860 --> 07:36.840]  You know, we're just touching on some of the basic terminology.
[07:36.840 --> 07:48.560]  When you use X.25 networks as opposed to, you know, like AX.25 where everybody has a TMC which is their PAD and then they all talk whatever.
[07:49.380 --> 07:53.960]  On Rick or Telephone X.25 you have an X.28 which is called a PAD.
[07:55.340 --> 08:00.140]  And essentially that's your little base point and then that talks X.25 out.
[08:00.140 --> 08:07.100]  It's like a kind of a command table for you to enter addresses to connect to other machines within that particular network.
[08:07.260 --> 08:07.460]  Yeah.
[08:07.820 --> 08:08.660]  In a way.
[08:08.820 --> 08:10.360]  I would think it's more like a...
[08:10.660 --> 08:11.600]  Well, we could...
[08:11.600 --> 08:15.000]  Like X.28 is the PPP to talking to TCP.
[08:16.140 --> 08:16.880]  In a way.
[08:17.100 --> 08:17.600]  In a way.
[08:18.020 --> 08:18.040]  Okay.
[08:18.120 --> 08:18.500]  Well...
[08:19.180 --> 08:19.660]  Yeah.
[08:19.740 --> 08:21.320]  So, but when the...
[08:21.320 --> 08:26.020]  So, when you call these X.25 networks, instead of an IP address you have an NUA.
[08:26.020 --> 08:31.020]  And that's a network user address, just a string of numbers.
[08:31.260 --> 08:31.660]  Okay.
[08:32.380 --> 08:34.620]  Perfix by a DNIC.
[08:35.600 --> 08:38.500]  NUIs are essentially...
[08:38.500 --> 08:40.300]  They log you into the network that you want to use.
[08:40.300 --> 08:41.240]  Logins, passwords.
[08:42.120 --> 08:42.400]  Right.
[08:42.560 --> 08:43.800]  They aren't always necessary.
[08:44.100 --> 08:48.480]  A lot of systems will let you connect and use their network without an NUI.
[08:48.700 --> 08:59.160]  But then once you're connected, the systems connected on that X.25 network may or may not let you connect based on the fact that if you have an NUI or you don't have an NUI.
[08:59.860 --> 09:00.640]  That doesn't make any sense.
[09:00.920 --> 09:01.140]  But...
[09:01.860 --> 09:02.760]  And DNIC...
[09:02.760 --> 09:03.760]  I'll let you explain that.
[09:04.440 --> 09:06.180]  DNICs are essentially...
[09:06.180 --> 09:10.520]  Basically, what defines a subnet in an X.25 network?
[09:12.120 --> 09:13.720]  Essentially, you have...
[09:13.720 --> 09:24.720]  You know that a 12 dot dot dot slash 8 is going to be AT&T or NASA origin subnet.
[09:26.120 --> 09:26.140]  Right.
[09:26.180 --> 09:29.380]  For instance, if you can almost look at like area codes kind of.
[09:29.560 --> 09:30.060]  Because you know like...
[09:30.060 --> 09:30.400]  That too, yeah.
[09:30.720 --> 09:32.120]  310 is what?
[09:32.200 --> 09:32.440]  Canada?
[09:33.060 --> 09:33.660]  I think?
[09:33.800 --> 09:35.040]  Or is it 301?
[09:35.600 --> 09:35.940]  Well, anyways.
[09:36.520 --> 09:43.300]  So the first three numbers will be the country and then the last will typically be used for identifying other networks.
[09:43.460 --> 09:44.220]  But the first three...
[09:44.220 --> 09:45.140]  So you know what country...
[09:45.640 --> 09:46.120]  Almost...
[09:46.120 --> 09:48.480]  Every country has a DNIC associated with it.
[09:48.660 --> 09:49.420]  Like these DNICs.
[09:49.540 --> 09:49.680]  Right.
[09:49.940 --> 09:52.400]  So you can see like China is 460.
[09:52.880 --> 09:55.760]  And then 4603 is China PAC.
[09:56.100 --> 09:57.980]  So these are all the different X.25.
[09:58.240 --> 10:00.760]  I mean, the list is absolutely huge.
[10:01.420 --> 10:01.900]  So...
[10:01.900 --> 10:03.520]  We just included a few.
[10:04.360 --> 10:04.700]  So...
[10:06.160 --> 10:11.140]  So here we're going to show a little video of what you can actually connect up to.
[10:18.170 --> 10:19.860]  And I think there's still a few around.
[10:21.570 --> 10:22.690]  So this one's Japan.
[10:23.500 --> 10:25.600]  We haven't really explored this one that much.
[10:27.930 --> 10:29.450]  We don't really know a whole lot about it.
[10:29.500 --> 10:30.260]  That's the one thing too.
[10:30.360 --> 10:34.570]  You find all these weird networks and it's sometimes hard to find any documentation on them.
[10:35.070 --> 10:40.500]  Or you find these, you know, to find out how they're being used or what they're being used for.
[10:41.020 --> 10:46.830]  And usually, I mean, you Google them up and that's, I mean, a lot of the stuff we found is off Google essentially.
[10:47.220 --> 10:55.830]  And, you know, you might find like one place, one application that might give you a login to just to their service.
[10:56.160 --> 10:56.400]  Right.
[10:57.080 --> 11:00.020]  And the networks tend to be used for various things.
[11:00.020 --> 11:03.700]  Some of them deal more with like banking and stuff like that.
[11:04.600 --> 11:08.420]  Other ones, large corporations and stuff like that.
[11:09.860 --> 11:10.330]  So...
[11:10.330 --> 11:12.680]  And this is actually connecting to the PAD.
[11:13.200 --> 11:18.300]  Right there is the NUI command, but I didn't specify any ID that I wanted to use.
[11:18.400 --> 11:20.330]  I just wanted to show how you do it.
[11:20.330 --> 11:26.420]  So, as you can see, when you're connecting up to the PAD, it's kind of giving you just like a command layer to get connected.
[11:26.600 --> 11:29.400]  Now, this one right here is in South Africa.
[11:29.960 --> 11:30.500]  South Africa.
[11:30.920 --> 11:33.980]  Man, as you can see, it doesn't even let you on right up front.
[11:35.100 --> 11:36.380]  This one just died.
[11:36.620 --> 11:39.180]  Like, you probably can't dial into this network anymore.
[11:40.330 --> 11:41.160]  They just killed it.
[11:41.240 --> 11:41.800]  It was Australia.
[11:41.800 --> 11:44.800]  And the government used it a lot and they just recently shut it down.
[11:45.600 --> 11:47.680]  Actually, you can probably still dial into it.
[11:50.580 --> 11:53.260]  These are just some of the many prompts.
[11:53.400 --> 11:57.140]  And you can see that there's a difference for each country.
[11:57.420 --> 12:00.600]  Because usually these networks, they span the entire country.
[12:01.080 --> 12:06.830]  And, you know, they'll have prompts that are, you know, sort of fitting towards their language.
[12:07.140 --> 12:07.460]  Right.
[12:07.600 --> 12:13.620]  Now, on this one, you'll notice you keep doing the set command because I'm just trying to get some output from the PAD.
[12:13.620 --> 12:19.500]  What I'm going to do here is, on this particular network, they have these test NUA's that you can connect to.
[12:19.900 --> 12:23.200]  And it's just for testing out your terminal connections and whatnot.
[12:23.330 --> 12:25.100]  So, whatever you type in, it'll echo back.
[12:25.480 --> 12:30.960]  Now, while that's not very interesting in itself, it gives you an idea of the way the NUA is structured.
[12:30.960 --> 12:33.740]  Like, I can't see it from here, but I can look at that.
[12:33.740 --> 12:39.180]  And now, I might be able to use that in the future to scan out the rest of the network to see what other systems are out there.
[12:40.060 --> 12:40.380]  So...
[12:45.360 --> 12:48.800]  And I might have made some of these videos a little long, but...
[12:49.600 --> 12:50.960]  Here, I think it's almost done on this one.
[12:53.640 --> 12:54.160]  Yeah.
[12:54.160 --> 12:57.720]  So, as you can see, and remember, this is all over VoIP.
[12:59.840 --> 13:03.460]  It's really easy to dial into all these fun little networks.
[13:03.900 --> 13:09.000]  And we're just kind of showing the limited PAD stuff and just actually connecting.
[13:10.220 --> 13:14.820]  This one's used for air transport communications used by airliners.
[13:14.820 --> 13:16.760]  I think iPash uses them too.
[13:17.040 --> 13:17.340]  Oh, yes.
[13:17.500 --> 13:18.040]  I actually...
[13:18.040 --> 13:18.980]  I think it connect up.
[13:19.140 --> 13:19.960]  See, so I'm using...
[13:19.960 --> 13:26.240]  Actually, this is a public access NUI that people use to connect up to this ISP in Hong Kong.
[13:26.780 --> 13:29.140]  Now, so, I've logged in.
[13:29.260 --> 13:30.700]  I've entered the NUA.
[13:31.280 --> 13:33.100]  Well, I entered the wrong NUA.
[13:33.360 --> 13:34.080]  Or not...
[13:34.080 --> 13:34.200]  Yeah.
[13:35.100 --> 13:36.320]  Let's see what it does here.
[13:39.510 --> 13:39.950]  Okay.
[13:40.170 --> 13:43.650]  So, we connect up to Hong Kong and we get this nice little PPP connection.
[13:43.650 --> 13:45.430]  Now, you see it at the very top there.
[13:45.550 --> 13:47.270]  I think I actually highlight it in a second.
[13:48.470 --> 13:50.090]  Where it says call connected to.
[13:51.450 --> 13:51.850]  That's...
[13:51.850 --> 13:52.970]  It's kind of taking that...
[13:52.970 --> 13:58.090]  It's redirecting the original NUA that I put in and then connecting it to that NUA.
[13:58.310 --> 14:00.910]  So, basically, using that, I can now...
[14:00.910 --> 14:04.690]  I now know more about the network and I can actually scan it a little bit more.
[14:05.070 --> 14:06.290]  That part right up there.
[14:06.390 --> 14:08.110]  So, I think I just connect to it.
[14:10.810 --> 14:15.430]  And I've never actually tried to make a PPP connection to this server, but I don't really care.
[14:17.050 --> 14:19.610]  I'm gonna do PPP over VoIP to Hong Kong.
[14:19.770 --> 14:21.470]  That sounds like such a brilliant idea.
[14:21.890 --> 14:24.970]  But I've done much sillier stuff, so...
[14:26.930 --> 14:28.410]  I think this one's almost over.
[14:34.740 --> 14:36.280]  And this one's in India.
[14:36.600 --> 14:40.560]  And remember that picture that I showed you with their fun phone lines?
[14:40.720 --> 14:42.660]  It is incredibly difficult to connect.
[14:42.660 --> 14:44.000]  So, I just took a screenshot.
[14:45.460 --> 14:46.740]  And this is British Telecommunications.
[14:47.360 --> 14:48.920]  This one's used a lot for banking.
[14:50.560 --> 14:52.180]  And it's owned by the same...
[14:52.180 --> 14:52.960]  Well, actually...
[14:52.960 --> 14:55.920]  Yeah, it's owned by the same company who did TimeNet, I believe.
[14:56.060 --> 14:56.300]  Isn't it?
[14:56.480 --> 14:56.920]  Absolutely.
[14:57.300 --> 14:57.600]  Yeah, BT.
[14:57.600 --> 15:02.900]  So, it's good to see in Europe they're still doing lots of X.25.
[15:03.220 --> 15:04.400]  And that's another interesting thing, too.
[15:04.540 --> 15:05.660]  There's people all over...
[15:05.660 --> 15:09.220]  Like, we run into Russian hackers who are doing this kind of stuff.
[15:09.460 --> 15:13.320]  And on their own networks and across the world.
[15:13.780 --> 15:16.540]  There's another place that was hard to connect to.
[15:20.250 --> 15:20.650]  And...
[15:21.370 --> 15:21.770]  Digipec.
[15:21.870 --> 15:22.790]  This is a corporate...
[15:22.790 --> 15:26.850]  This is actually a private network owned by Quest.
[15:26.850 --> 15:31.250]  So, there are actually X.25 networks in America, believe it or not.
[15:32.410 --> 15:34.430]  And I think we're almost done with this video.
[15:40.290 --> 15:40.810]  ROPA.
[15:41.690 --> 15:42.730]  Or RPOA.
[15:43.590 --> 15:44.110]  Alrighty.
[15:47.250 --> 15:49.190]  So, binding this stuff.
[15:49.810 --> 15:50.410]  Yeah, absolutely.
[15:51.150 --> 15:55.650]  Like, for INET, you know, usually a lot of these countries still have...
[15:56.270 --> 15:57.950]  Basically, maybe like three digits.
[15:58.210 --> 16:03.270]  Like, you know, equivalent to our 800 numbers or 301, you know, 611.
[16:03.270 --> 16:04.730]  Or like 411 or something like that.
[16:04.770 --> 16:04.790]  Or 411.
[16:05.830 --> 16:10.410]  To call into their packet network, their X.25 network.
[16:11.070 --> 16:14.090]  And, you know, three digit dialing doesn't work for international calls.
[16:14.410 --> 16:18.690]  So, we were having to look for, well, a direct dial into their network.
[16:18.690 --> 16:24.610]  So, for India, for example, essentially went to their phone directory.
[16:25.170 --> 16:26.150]  Now, India...
[16:26.150 --> 16:29.110]  I don't know if I have an Internet connection here or I do, but...
[16:29.110 --> 16:29.530]  Well...
[16:29.530 --> 16:34.690]  You can go to that website up there and you can actually drill down all the way down to their city.
[16:34.990 --> 16:35.850]  And you can type in modem.
[16:36.270 --> 16:36.950]  And it'll show...
[16:36.950 --> 16:38.430]  They'll search and tell you where they are.
[16:39.150 --> 16:39.450]  Everything that says modem.
[16:39.670 --> 16:42.050]  You know, you type in, you know, dial-up.
[16:42.050 --> 16:46.190]  It'll show everything that has a dial-up notation in their phone directory.
[16:46.370 --> 16:47.150]  And a lot of this stuff...
[16:47.150 --> 16:47.810]  It's really kind of amazing.
[16:48.030 --> 16:48.190]  Right.
[16:48.310 --> 16:49.290]  Actually, it was kind of funny.
[16:49.510 --> 16:52.850]  I mean, you go to a place and search for modem and it just gives you all the dial-ups.
[16:52.950 --> 16:53.470]  That's awesome.
[16:55.190 --> 16:55.550]  The...
[16:56.950 --> 16:59.390]  So, a lot of times you can just search for, you know, key terms.
[16:59.750 --> 17:03.910]  You know, dial-up modem X.28 PAD or X.28 Russia.
[17:04.330 --> 17:11.290]  And then a lot of times you can find these or you'll find other hacking groups like getting together and talking about it and giving the numbers to each other.
[17:11.290 --> 17:13.130]  So, you can find hundreds of them.
[17:13.330 --> 17:19.190]  And it really helps to use the localized version of it because it gives the preference to whatever language...
[17:19.190 --> 17:19.610]  Right.
[17:19.630 --> 17:20.830]  ...that you're trying to explore.
[17:22.870 --> 17:23.410]  All right.
[17:23.570 --> 17:30.470]  So, now that we're connected up to the network, we can start, you know, looking for other things that are connected up to the network.
[17:30.610 --> 17:32.550]  So, you can use a thing called an NUA scanner.
[17:32.750 --> 17:33.610]  And it's pretty straightforward.
[17:33.750 --> 17:35.670]  The idea is to...
[17:35.670 --> 17:41.010]  You take a non-NPA and then you increment the NUA number.
[17:41.010 --> 17:45.150]  So, let's just say our target, we know something's at, you know, 10,000.
[17:45.390 --> 17:48.430]  Well, try 10,001, 10,002, pretty straightforward stuff.
[17:50.410 --> 17:52.890]  And also to research what's been done out there.
[17:53.850 --> 17:58.590]  You know, back in the 80s, we wrote a lot of e-zines.
[17:58.970 --> 18:01.070]  A lot of text files are out there.
[18:01.210 --> 18:04.170]  And all that information is feasibly still valid.
[18:04.590 --> 18:04.730]  Right.
[18:04.890 --> 18:05.990]  Like DatexP.
[18:06.230 --> 18:11.030]  I think there was one article in Phrack where it actually has a list of NUA's.
[18:12.190 --> 18:12.790]  And, you know...
[18:12.790 --> 18:13.250]  And you just go...
[18:13.250 --> 18:14.430]  And you just saw the network running.
[18:14.690 --> 18:15.730]  So, try them out.
[18:17.110 --> 18:18.550]  And you'd be very surprised.
[18:18.730 --> 18:19.150]  Absolutely.
[18:20.890 --> 18:24.850]  And the thing to remember about NUIs is...
[18:26.150 --> 18:27.810]  NUIs allow you to make...
[18:27.810 --> 18:30.150]  It's just sort of like a calling card, essentially.
[18:30.390 --> 18:31.190]  You know, you log in.
[18:31.390 --> 18:32.970]  You're actually going to pay for that call.
[18:33.130 --> 18:36.190]  Well, you can make a collect call just by dialing zero...
[18:36.190 --> 18:40.090]  And putting zero, your DNIC, and then the address that you...
[18:40.090 --> 18:41.970]  And the NUA that you want to look at.
[18:43.410 --> 18:45.270]  It actually works amazing like...
[18:45.270 --> 18:46.410]  A lot like the phone system.
[18:46.550 --> 18:48.070]  There is a situation where...
[18:48.070 --> 18:53.190]  When you're calling another computer system by NUA, they have to accept the charges for that call.
[18:53.650 --> 18:56.170]  And some places actually will say...
[18:56.170 --> 18:58.070]  Well, they refuse...
[18:58.070 --> 18:59.490]  You know, refuse the call altogether.
[18:59.770 --> 19:01.330]  Then you know right away there's something there.
[19:01.590 --> 19:03.250]  But it wants me to log in.
[19:03.390 --> 19:04.430]  And I don't really have a login.
[19:04.690 --> 19:07.430]  So, I guess I won't be seeing what kind of legacy gears on that.
[19:08.150 --> 19:08.590]  So...
[19:08.590 --> 19:08.990]  Yeah.
[19:09.470 --> 19:11.170]  And then, you know, like...
[19:11.170 --> 19:13.130]  You know, like for...
[19:14.250 --> 19:14.770]  DATAPAC.
[19:14.950 --> 19:16.610]  Every place has a topology.
[19:17.290 --> 19:19.190]  The Hack Canada guys, they...
[19:19.190 --> 19:22.150]  They really mapped out their X.25 network.
[19:22.410 --> 19:24.630]  And you can...
[19:24.630 --> 19:25.150]  By...
[19:25.150 --> 19:27.310]  They have it broken down by...
[19:27.310 --> 19:28.030]  By city.
[19:28.190 --> 19:28.710]  By city.
[19:28.850 --> 19:29.810]  Or city or...
[19:29.810 --> 19:31.770]  Or province or whatever they want to call them.
[19:32.430 --> 19:33.670]  And you can...
[19:35.290 --> 19:36.290]  This is the U.S.
[19:36.970 --> 19:37.510]  You...
[19:37.510 --> 19:38.190]  You...
[19:38.190 --> 19:38.870]  Blame Canada.
[19:39.690 --> 19:40.490]  Of course.
[19:40.830 --> 19:41.230]  You all.
[19:42.930 --> 19:44.130]  Essentially, you just...
[19:44.130 --> 19:45.390]  You would look at...
[19:45.390 --> 19:46.290]  You can say that...
[19:46.290 --> 19:47.540]  Well, anything that's inside of...
[19:48.530 --> 19:50.090]  These first three digits...
[19:50.110 --> 19:50.230]  Right.
[19:50.550 --> 19:52.250]  We know is in Ontario or whatever.
[19:52.470 --> 19:52.710]  Yeah.
[19:52.850 --> 19:52.890]  Exactly.
[19:54.950 --> 19:55.810]  And then the scanner.
[19:55.810 --> 19:56.370]  Oh, the scanner.
[19:56.610 --> 19:56.850]  Yeah.
[19:57.130 --> 19:57.790]  This is like...
[19:57.790 --> 20:01.670]  We're such dorks that we actually write software to scan these networks.
[20:01.670 --> 20:03.530]  And this is one of our pieces of software.
[20:03.790 --> 20:06.590]  And this is doing that one in Germany.
[20:08.150 --> 20:10.150]  Oh, it takes forever to connect, remember?
[20:10.350 --> 20:11.190]  Just skip to the middle.
[20:11.410 --> 20:11.670]  Yeah.
[20:11.670 --> 20:11.970]  There you go.
[20:12.590 --> 20:13.450]  That's what it looks like.
[20:13.570 --> 20:13.790]  Right.
[20:13.910 --> 20:14.170]  Well, here.
[20:14.390 --> 20:15.030]  There you go.
[20:15.070 --> 20:15.810]  Skipping, skipping.
[20:17.310 --> 20:18.610]  It goes really fast.
[20:18.770 --> 20:22.810]  And unfortunately, this network, if you enter four invalid NUAs, it disconnects you.
[20:22.950 --> 20:25.970]  Some networks you can connect up to, and they'll just let you stay on indefinitely.
[20:26.010 --> 20:29.770]  Like the Russian network, which I actually meant to put a video in here for.
[20:29.770 --> 20:33.210]  But as you can see, it's just trying to connect to when it dropped me off.
[20:33.370 --> 20:37.350]  But it just goes through sequentially looking for valid systems and whatnot.
[20:37.910 --> 20:38.410]  I think it's the end of that.
[20:38.410 --> 20:39.490]  You just keep on going over...
[20:39.490 --> 20:41.270]  But it does it so fast.
[20:41.550 --> 20:42.590]  I mean, it's not like...
[20:42.590 --> 20:46.470]  Especially if you can remain connected for any length of time.
[20:46.590 --> 20:51.230]  Like the Russian network, you can connect up and you can stay on for 12 hours if you want, scanning their network.
[20:51.610 --> 20:53.470]  And they typically won't drop you.
[20:53.610 --> 20:55.970]  And then you'll just find weird little interesting things.
[20:59.550 --> 21:00.950]  Yeah, it should just...
[21:01.270 --> 21:04.230]  As you can see, it just kind of gets blurry.
[21:04.370 --> 21:04.850]  A bit of a day.
[21:05.650 --> 21:05.730]  Yeah.
[21:09.440 --> 21:10.120]  Dive war video.
[21:10.380 --> 21:10.740]  Oh, yeah.
[21:11.140 --> 21:12.160]  All right, so what else can you do?
[21:12.280 --> 21:13.040]  That was, you know...
[21:13.040 --> 21:15.880]  So we're doing some X.25 stuff that's, you know, fairly interesting.
[21:16.280 --> 21:17.440]  So what else can you do here?
[21:20.380 --> 21:22.120]  Can anybody guess what is going on here?
[21:22.200 --> 21:24.900]  This is something traditionally 80s, but this is software that I've written.
[21:27.320 --> 21:28.180]  Oh, my God.
[21:28.320 --> 21:28.680]  Very good.
[21:29.140 --> 21:32.340]  So, you have this VoIP connection.
[21:32.340 --> 21:36.140]  You can make extremely cheap calls to anywhere in the world.
[21:36.780 --> 21:38.300]  You kind of get where this is going.
[21:38.420 --> 21:40.200]  Oh, and you can see I added the C name lookup.
[21:40.260 --> 21:41.160]  I really like that feature.
[21:41.740 --> 21:43.820]  Anyway, that's not about this talk.
[21:43.820 --> 21:46.600]  But anyways, so you can...
[21:46.600 --> 21:46.820]  Shameless plug.
[21:46.960 --> 21:49.020]  Yeah, shameless plug for my own software.
[21:49.260 --> 21:53.340]  So this is a piece of software called iWar that I wrote a few years ago.
[21:53.820 --> 21:58.000]  And it does a lot of the same features that ToneLoc and all that, which are awesome.
[22:00.920 --> 22:02.760]  And so you got all this VoIP connection.
[22:02.980 --> 22:04.520]  You can do tons of cheap calls.
[22:05.420 --> 22:08.220]  I marked that as a sex line for some reason, but it's all fake numbers.
[22:09.500 --> 22:10.420]  Let's go on through that.
[22:11.880 --> 22:12.800]  Yeah, it's right there.
[22:17.180 --> 22:17.540]  Here.
[22:17.540 --> 22:18.140]  Here, I'll let you take it.
[22:20.140 --> 22:21.360]  Why is this that many years?
[22:21.500 --> 22:24.440]  Well, you know, essentially you have all these VoIP providers.
[22:24.740 --> 22:26.480]  And we're talking...
[22:27.000 --> 22:31.040]  For a lot, you know, you slap down maybe 10 pounds or 10...
[22:31.040 --> 22:31.900]  Well, we're paying in euros.
[22:32.740 --> 22:34.600]  Yeah, well, let's just say 10 bucks, 20 bucks.
[22:34.860 --> 22:36.320]  Say 10 bucks, 20 bucks.
[22:37.080 --> 22:43.540]  And you can call a lot of these places for months on that 10 or 20 bucks.
[22:45.240 --> 22:51.020]  And usually a lot of these places will even have a list of countries, like 20, 30 countries that you can call for free.
[22:51.840 --> 22:53.520]  I mean, there's certain restrictions to it.
[22:53.520 --> 22:54.620]  There's certain landlines usually, yeah.
[22:54.700 --> 22:54.840]  Yeah.
[22:55.260 --> 22:56.400]  Certain restrictions to it.
[22:56.460 --> 22:57.460]  It has to be landlines.
[22:57.640 --> 22:58.940]  You can only call...
[22:58.940 --> 23:02.560]  You can only be connected to them 300 minutes every week.
[23:03.160 --> 23:04.440]  So you spend a little bit.
[23:04.660 --> 23:04.680]  Yeah, but you're...
[23:04.680 --> 23:05.080]  Well, yeah.
[23:06.700 --> 23:07.140]  So...
[23:07.140 --> 23:08.760]  And then, you know, you can...
[23:08.760 --> 23:10.180]  But these are places around the world.
[23:10.280 --> 23:11.360]  I mean, use VoIP.
[23:11.540 --> 23:11.940]  Why not?
[23:12.200 --> 23:12.940]  It's cheap.
[23:13.240 --> 23:21.540]  We're talking like fractions of a penny even if you call someplace like Iran, you know, which isn't on anybody's friendly list.
[23:22.720 --> 23:24.640]  Well, maybe North Korea, but who knows.
[23:24.940 --> 23:28.340]  But I think a big thing, too, here is that you can also...
[23:28.340 --> 23:30.040]  You don't have to use American VoIP providers.
[23:30.200 --> 23:32.220]  There's tons of ones in Europe that...
[23:32.220 --> 23:40.060]  Like, for instance, as he was pointing out, Iran, you know, we decided we want to dial Iran a lot.
[23:40.060 --> 23:44.520]  And we didn't want to go through an American company for some mysterious reason.
[23:44.700 --> 23:50.680]  So we decided to use European providers that wouldn't, you know, be as hostile to us.
[23:53.340 --> 23:53.780]  Supervision.
[23:54.040 --> 23:54.360]  Oh.
[23:55.460 --> 24:02.180]  So whenever you're calling a lot of these places, you know, you say you get a busy signal or you get an error message to them, whatever.
[24:02.680 --> 24:08.220]  If the call isn't completed, meaning somebody on the other end didn't pick it up, you're not being charged for it anyway.
[24:08.220 --> 24:13.780]  So when you're doing large amounts of dials, a lot of these places aren't going to pick up.
[24:13.980 --> 24:14.740]  It's going to ring out.
[24:14.840 --> 24:19.300]  And the ones that even do pick up, you're going to be on the phone with them for all of a few seconds.
[24:20.100 --> 24:20.500]  So...
[24:20.500 --> 24:20.900]  Yeah.
[24:21.100 --> 24:21.940]  It's going to be cheap.
[24:22.340 --> 24:23.660]  I mean, literally very cheap.
[24:23.740 --> 24:23.840]  Cheap, quick.
[24:24.240 --> 24:24.320]  Yeah.
[24:25.760 --> 24:27.620]  Does your provider use six-second billing?
[24:29.780 --> 24:30.580]  Does the...
[24:30.580 --> 24:31.320]  I don't...
[24:31.760 --> 24:35.860]  I think it's one-minute billing, but even still it's...
[24:35.860 --> 24:35.900]  Really?
[24:35.900 --> 24:36.060]  Oh.
[24:37.460 --> 24:38.180]  It might...
[24:38.180 --> 24:40.100]  But it'd have to answer.
[24:40.840 --> 24:41.500]  Right, right.
[24:41.640 --> 24:42.580]  So a lot of times...
[24:42.580 --> 24:42.740]  Yeah.
[24:43.140 --> 24:44.220]  A lot of times it didn't even answer.
[24:45.020 --> 24:45.380]  So...
[24:45.380 --> 24:47.620]  And this is actually with Tone Look, what he's about to show here.
[24:49.380 --> 24:53.460]  One of the things that was in Tone Look was a thing called Tone Maps.
[24:53.460 --> 25:05.940]  And I'm not sure if many people remember it or not, but it kind of gives you a graphical representation of what some of these prefixes outside the United States have.
[25:07.480 --> 25:08.680]  Kind of go into one here.
[25:09.240 --> 25:11.860]  So this is a map of the Kremlin.
[25:12.680 --> 25:15.980]  They're basically the prefix area for the Kremlin.
[25:16.260 --> 25:21.580]  And you can see what the yellow dots or the orange dots or whatever, those are the actual carriers.
[25:21.580 --> 25:25.540]  And then red's busy or not connecting or whatever.
[25:26.200 --> 25:29.480]  Some gray's in there, but you can see the density of modems.
[25:29.780 --> 25:40.020]  Yeah, it's kind of weird because sometimes you'll look at these Tone Maps and then you'll pick out like a weird pattern of where maybe it was like a big dial-up pool for some company or something like that.
[25:40.020 --> 25:43.140]  Like in the lower center, there's two that are sort of diagonal to each other.
[25:43.800 --> 25:50.960]  There's a chance there probably is like maybe a cluster of them sitting right there or at least within those two hundred blocks.
[25:51.220 --> 25:51.440]  Right.
[25:53.020 --> 25:58.120]  This one was a map of Buckingham Palace's prefix.
[25:58.520 --> 26:01.760]  He did it on the 4th of July because he thought it was appropriate.
[26:03.500 --> 26:05.780]  And you can see there's a lot more modem activity there.
[26:05.780 --> 26:11.000]  A lot of stuff that was actually in those were...
[26:11.000 --> 26:19.380]  Well, again, we found building management systems, dial-up pools, you know, all kinds of stuff.
[26:19.520 --> 26:22.900]  Routers that forgot to have passwords on them.
[26:23.320 --> 26:23.440]  Yes.
[26:23.600 --> 26:23.900]  Stuff like that.
[26:34.110 --> 26:37.670]  I'm not sure you'll have to actually ask Mucho Mass.
[26:38.110 --> 26:38.470]  Right.
[26:38.470 --> 26:41.210]  I like the yell... or the asshole one.
[26:41.370 --> 26:43.010]  That's when somebody picked up a yelling man.
[26:46.610 --> 26:48.010]  Yeah, the government of Hong Kong.
[26:48.970 --> 26:52.270]  And you can see where there's just a straight row of them.
[26:52.710 --> 26:52.750]  Right.
[26:52.850 --> 26:59.550]  And a lot of those were accent terminal servers through those trips.
[27:00.150 --> 27:05.490]  I think I found one in there that was like a secure fax.
[27:05.830 --> 27:07.570]  That's how it identified itself.
[27:07.910 --> 27:09.470]  It was an encrypted fax thingy.
[27:09.610 --> 27:10.190]  That was weird.
[27:10.430 --> 27:10.630]  Yeah.
[27:11.010 --> 27:11.470]  But...
[27:11.470 --> 27:12.710]  Yeah, it was something like that.
[27:13.790 --> 27:15.550]  You know, Zimbabwe.
[27:16.270 --> 27:17.510]  Not too many modems there.
[27:17.590 --> 27:19.330]  Maybe, what, two or three.
[27:20.990 --> 27:21.470]  But...
[27:21.470 --> 27:24.210]  Was that the one that came up with the type BBS now?
[27:24.570 --> 27:25.510]  Or is that the different country?
[27:25.710 --> 27:26.430]  Yes, that was.
[27:26.610 --> 27:26.770]  Okay, yeah.
[27:26.850 --> 27:28.270]  We kept calling up Zimbabwe.
[27:28.450 --> 27:30.750]  And it said, to log in, type BBS.
[27:30.930 --> 27:31.910]  And then you would type BBS.
[27:32.090 --> 27:33.930]  And then it would just hang up on you.
[27:34.170 --> 27:34.210]  Yeah.
[27:34.990 --> 27:36.650]  So I guess their BBS was down.
[27:38.950 --> 27:40.110]  And here's Iran.
[27:40.550 --> 27:41.850]  As you can see, it's...
[27:42.770 --> 27:43.170]  Pretty...
[27:43.790 --> 27:44.190]  Right.
[27:44.670 --> 27:45.070]  Empty.
[27:45.070 --> 27:57.030]  I think the case in a lot of countries that don't use Roman alphabet, Roman-based alphabet, is that, you know, they don't have the character set for it.
[27:57.210 --> 27:59.350]  So a lot of these probably have fax machines.
[28:00.070 --> 28:01.870]  And, well, you know, carriers are carrier.
[28:02.110 --> 28:03.450]  You can always have fun with carriers.
[28:04.570 --> 28:07.470]  So that's Iran, but we didn't really get a whole lot of dialogue.
[28:07.590 --> 28:12.170]  We got quite a bit done with Iran, but we were looking for things.
[28:12.550 --> 28:14.490]  And then Israel, just to balance things out.
[28:14.490 --> 28:14.770]  Right.
[28:14.890 --> 28:16.510]  Because we didn't want to just pick on Iran.
[28:16.930 --> 28:18.850]  So we did Israel for a while.
[28:19.090 --> 28:23.170]  And you can see where, you know, the black areas are where I haven't called.
[28:23.530 --> 28:25.930]  And then the gray areas are the ones that I actually have.
[28:26.150 --> 28:31.650]  And I did those as an example of, well, you know, you see a few that are starting to line up.
[28:31.650 --> 28:33.850]  And then you just really kind of call in there.
[28:33.950 --> 28:38.670]  And it really expands it out as far as, you know, the density of modems.
[28:40.330 --> 28:44.870]  And, actually, we're going to take some Q&A, but we actually have a question for you guys.
[28:45.270 --> 28:46.590]  Because we're not...
[28:46.590 --> 28:55.370]  If anybody knows what the hell this thing is, what is a BIOS command string?
[28:57.010 --> 28:58.470]  Has anybody ever seen this thing?
[28:59.530 --> 29:00.310]  I'm serious.
[29:00.450 --> 29:01.350]  We don't know what it is.
[29:02.670 --> 29:03.110]  So...
[29:03.110 --> 29:04.150]  And it's just...
[29:04.150 --> 29:04.410]  That's...
[29:04.410 --> 29:04.870]  It's open.
[29:05.030 --> 29:05.530]  This is...
[29:05.530 --> 29:07.250]  You connect and this is what it presents.
[29:07.470 --> 29:08.550]  We just don't know what they're...
[29:08.550 --> 29:09.590]  What they want from us.
[29:11.810 --> 29:13.190]  Well, I mean...
[29:13.190 --> 29:13.910]  Where was this?
[29:14.550 --> 29:15.970]  This was in the UK.
[29:18.810 --> 29:19.490]  Yeah, right?
[29:22.130 --> 29:22.570]  See?
[29:24.470 --> 29:26.170]  And that's one of the fun things, too.
[29:26.210 --> 29:27.470]  You find all these obscure things.
[29:27.610 --> 29:30.710]  Like, we couldn't even find on freaking Google very much about this damn thing.
[29:31.650 --> 29:32.170]  So...
[29:32.170 --> 29:33.590]  Global nuclear war.
[29:33.930 --> 29:34.090]  Yeah.
[29:34.570 --> 29:35.770]  Global nuclear war.
[29:35.990 --> 29:36.110]  Yeah.
[29:40.650 --> 29:45.330]  Anyways, we're open for any kind of Q&A and any questions if you have any.
[29:46.750 --> 29:47.150]  Uh-oh.
[29:48.030 --> 29:48.390]  T-Profit.
[29:48.490 --> 29:50.070]  Can you make it hot in the throne room?
[29:52.900 --> 29:53.760]  We're trying.
[29:54.460 --> 29:55.260]  Actually, yeah.
[29:55.460 --> 30:00.300]  There are environmental control systems that are still using dial-up modems.
[30:00.520 --> 30:01.160]  A lot of them.
[30:01.320 --> 30:02.600]  I think that's what that might be.
[30:02.600 --> 30:02.820]  That's what...
[30:02.820 --> 30:03.740]  I think that's what this is.
[30:04.200 --> 30:04.560]  Yeah.
[30:05.300 --> 30:06.520]  What's that around blinking handbells?
[30:06.580 --> 30:06.820]  Who knows?
[30:07.040 --> 30:07.400]  What's up?
[30:07.560 --> 30:07.680]  Maybe.
[30:07.720 --> 30:08.060]  I do...
[30:08.060 --> 30:09.300]  I do a lot of pen-testing.
[30:09.600 --> 30:09.720]  Right.
[30:10.020 --> 30:20.460]  With that, I do a lot of war dialing, and I found all kinds of interesting things with my phone bill that get really expensive, including what you're doing here.
[30:20.580 --> 30:20.800]  Yes.
[30:20.980 --> 30:21.020]  Yes.
[30:21.260 --> 30:22.040]  Can you...
[30:27.390 --> 30:27.750]  Um...
[30:27.750 --> 30:28.770]  We're using...
[30:29.790 --> 30:30.150]  Mostly...
[30:30.150 --> 30:35.630]  There's a company called VoIP Buster that we'll use occasionally, because they don't seem to care how many times we dial.
[30:36.170 --> 30:41.850]  Like, some companies, you know, like New Phone, they'll probably notice if you dial 8,000 numbers and kind of get pissed.
[30:43.150 --> 30:43.550]  Um...
[30:43.550 --> 30:45.970]  But some companies, I guess VoIP Buster's one of them.
[30:46.190 --> 30:49.070]  Flip Jet doesn't seem to mind, but I wouldn't recommend it with them.
[30:49.950 --> 30:50.350]  Um...
[30:50.350 --> 30:50.890]  Where's this at?
[30:51.470 --> 30:51.950]  Uh...
[30:51.950 --> 30:54.010]  This is just another one that, uh...
[30:54.010 --> 30:56.330]  I found out there that was just...
[30:56.330 --> 30:57.570]  Configuration errors.
[30:57.730 --> 30:57.990]  Detected.
[30:58.430 --> 30:58.590]  Yeah.
[30:58.590 --> 30:59.230]  I mean, this...
[30:59.230 --> 31:00.650]  Essentially, you see the...
[31:00.650 --> 31:02.250]  You see them calling, dial out.
[31:02.910 --> 31:04.430]  And it's just sort of open there.
[31:04.570 --> 31:05.050]  It's just a...
[31:05.050 --> 31:07.390]  Kind of requesting, uh... information.
[31:07.750 --> 31:09.630]  And there was something else about, um...
[31:09.630 --> 31:09.890]  Uh...
[31:09.890 --> 31:10.430]  What you were saying.
[31:10.950 --> 31:11.430]  Uh...
[31:11.430 --> 31:13.430]  I meant to put it in this talk, but, uh...
[31:13.430 --> 31:16.890]  The Department of Homeland Security has a great document, um...
[31:16.890 --> 31:17.610]  Um...
[31:17.610 --> 31:19.170]  Called, uh...
[31:19.670 --> 31:20.150]  Uh...
[31:20.150 --> 31:20.990]  Practical...
[31:20.990 --> 31:23.290]  Security for Modems, or something like that.
[31:23.730 --> 31:24.210]  And...
[31:24.210 --> 31:26.470]  They highly recommend my iWAR program.
[31:26.650 --> 31:27.650]  Which really, really...
[31:27.650 --> 31:28.690]  Just cracked me up.
[31:28.850 --> 31:30.110]  I was like, this is frickin' awesome.
[31:38.870 --> 31:39.350]  Uh...
[31:39.350 --> 31:39.370]  Uh...
[31:39.370 --> 31:39.470]  Uh...
[31:39.470 --> 31:39.830]  Right on.
[31:39.830 --> 31:40.130]  Just likely.
[31:40.410 --> 31:40.530]  Yeah.
[31:40.650 --> 31:41.390]  Wait a hat on.
[31:41.470 --> 31:42.850]  It's my suspicion looking at it.
[31:42.870 --> 31:44.490]  I wish I'd put some more Russia stuff.
[31:44.610 --> 31:47.390]  Because there's lots of fun stuff on Russia, but...
[31:47.390 --> 31:47.510]  Yeah.
[31:48.970 --> 31:49.450]  Um...
[31:49.450 --> 31:50.270]  You find...
[31:50.270 --> 31:51.750]  A lot of old legacy systems.
[31:52.170 --> 31:52.570]  Old...
[31:52.570 --> 31:54.910]  You'll sometimes even run into, like, old VAXes.
[31:55.270 --> 31:55.670]  Vanguard.
[31:56.050 --> 31:56.450]  Routers.
[31:56.510 --> 31:57.290]  I found in Russia.
[31:59.470 --> 31:59.870]  Um...
[31:59.870 --> 32:00.010]  And...
[32:00.010 --> 32:00.090]  We...
[32:00.090 --> 32:01.390]  You know, we've been trying to connect to...
[32:01.390 --> 32:03.570]  There's one called ChinaPak, I believe it is.
[32:04.510 --> 32:04.910]  And...
[32:04.910 --> 32:07.430]  That one, we haven't really had very much luck with.
[32:09.690 --> 32:10.090]  Oh...
[32:10.090 --> 32:10.650]  So...
[32:10.650 --> 32:11.410]  Yeah, this...
[32:13.130 --> 32:15.910]  Pretty much, this is stuff that we're finding in, like, Zimbabwe.
[32:16.170 --> 32:17.830]  If you go up a little bit...
[32:17.830 --> 32:17.970]  Yeah.
[32:18.090 --> 32:18.710]  You'll see that.
[32:19.090 --> 32:19.530]  Up where?
[32:19.530 --> 32:20.330]  Go up.
[32:20.650 --> 32:22.950]  You just passed by one that was interesting.
[32:23.230 --> 32:23.290]  Oh.
[32:23.290 --> 32:24.030]  That was Zimbabwe.
[32:24.230 --> 32:25.070]  Yeah, I see the...
[32:25.070 --> 32:25.830]  There's the...
[32:25.830 --> 32:26.150]  Yeah.
[32:26.570 --> 32:27.410]  Type BBS.
[32:27.810 --> 32:29.350]  That was the one we kind of touched on.
[32:29.570 --> 32:30.230]  Right, right.
[32:31.470 --> 32:31.910]  Um...
[32:31.910 --> 32:32.010]  Uh...
[32:32.010 --> 32:32.850]  What were you looking for?
[32:33.070 --> 32:34.410]  Oh, I can just look at your laptop.
[32:34.690 --> 32:35.290]  Oh, there you go.
[32:35.930 --> 32:36.570]  Is that one right here?
[32:37.650 --> 32:38.370]  An open router?
[32:38.950 --> 32:39.090]  Yeah.
[32:39.850 --> 32:40.290]  Um...
[32:40.290 --> 32:40.610]  Oops.
[32:41.710 --> 32:42.150]  Um...
[32:42.150 --> 32:42.690]  Don't do that.
[32:43.110 --> 32:44.270]  Yeah, that was in...
[32:44.270 --> 32:45.230]  That was actually in the Kremlin.
[32:45.230 --> 32:45.890]  Yeah.
[32:46.130 --> 32:46.190]  Yeah.
[32:46.430 --> 32:47.630]  So, that's great.
[32:47.970 --> 32:49.570]  Now we're going to mysteriously disappear.
[32:57.310 --> 32:57.730]  Um...
[32:57.730 --> 32:58.110]  Oh, yeah.
[32:58.290 --> 32:59.990]  The little dart thing, or whatever it was.
[33:02.710 --> 33:03.130]  Um...
[33:03.130 --> 33:04.610]  Anyways, you find all kinds of stuff.
[33:04.610 --> 33:07.850]  I mean, I always be thinking of X.25 whenever you ask that question.
[33:08.090 --> 33:18.670]  But you find a lot of old legacy, like, uh, equipment and systems and everything from, like, old VAXEs to, uh, RS6000s under AIX.
[33:18.750 --> 33:21.550]  I found Linux boxes on those X.25 networks.
[33:21.810 --> 33:23.130]  So, it's a great range.
[33:23.150 --> 33:25.310]  Some stuff that you're just like, what the hell is this?
[33:25.510 --> 33:27.610]  Back in the, um...
[33:28.230 --> 33:33.010]  When Telenet was still alive, uh, I used to have this great NUA that I would show my friends.
[33:33.010 --> 33:38.150]  And you know how when you go to the airport and it gives you a display of, like, you know, flights leaving and whatnot?
[33:38.430 --> 33:38.450]  Yeah.
[33:38.590 --> 33:40.850]  You would connect up to it and it would connect you to Hong Kong.
[33:40.990 --> 33:42.750]  And it would just display, like, that.
[33:43.050 --> 33:44.970]  And I would show my friends that, like, you know.
[33:45.110 --> 33:46.850]  And they're like, wow, you're a complete dork.
[33:47.450 --> 33:50.010]  So, I just thought it was really cool, so...
[33:51.590 --> 33:51.910]  Um...
[33:51.910 --> 33:53.850]  Oh, you should show them the BT banner.
[33:54.090 --> 33:55.450]  They have the best banners in the world.
[33:55.630 --> 33:56.890]  It makes you want to hang up.
[33:57.630 --> 33:59.310]  Like, we will hunt you down.
[33:59.810 --> 34:00.210]  Um...
[34:00.630 --> 34:02.990]  Oh, it kind of got cut off there.
[34:03.170 --> 34:04.570]  Any other type of, uh, questions?
[34:06.150 --> 34:06.550]  Anything?
[34:06.790 --> 34:07.130]  She...
[34:07.130 --> 34:08.030]  Have you ever
[34:13.350 --> 34:14.070]  lost kind of...
[34:14.070 --> 34:14.510]  Right, right.
[34:14.610 --> 34:16.870]  ...100 by dialing, like, 100 or...
[34:17.550 --> 34:19.470]  No, not, not very much so.
[34:20.430 --> 34:20.830]  Um...
[34:20.830 --> 34:30.110]  Typically, I think, like, for instance, India, they never met for us here in the United States to be able to connect up to their network and probably don't want us to be able to connect up to their network.
[34:30.110 --> 34:32.870]  So, we had to actually do a lot of research to find the modem.
[34:32.970 --> 34:34.790]  Or, actually, Jay Falcon had to do a lot of research.
[34:35.010 --> 34:37.270]  But if you have a dial-up in that local country...
[34:37.730 --> 34:38.150]  Oh, yeah.
[34:38.270 --> 34:39.030]  Then you'd be golden.
[34:40.150 --> 34:40.510]  Yeah.
[34:44.480 --> 34:44.920]  Right, right.
[34:45.060 --> 34:45.700]  Then you'd probably...
[34:45.700 --> 34:46.140]  We'd be golden.
[34:46.360 --> 34:46.440]  Yeah.
[34:49.420 --> 34:50.140]  Which are...
[34:50.740 --> 34:51.100]  Uh...
[34:51.100 --> 34:51.400]  What's that?
[34:53.640 --> 34:54.000]  Telephone...
[34:59.300 --> 35:02.280]  Oh, that one dial-up that we're showing, you mean?
[35:02.520 --> 35:03.220]  Yeah, that's the...
[35:03.220 --> 35:05.140]  That's the command interface to a PBX.
[35:06.040 --> 35:07.220]  It could very well be.
[35:08.940 --> 35:09.780]  Oh, it could be.
[35:10.020 --> 35:10.060]  Yeah.
[35:10.280 --> 35:11.280]  We're the same idea.
[35:11.740 --> 35:12.120]  Right.
[35:13.200 --> 35:14.660]  Not in Gawa, but...
[35:14.660 --> 35:17.380]  Let's try someplace a little more populated.
[35:17.380 --> 35:19.040]  Then you have to change the search option.
[35:19.120 --> 35:19.480]  I did.
[35:21.160 --> 35:21.620]  Um...
[35:21.620 --> 35:24.500]  Anyways, I don't know how much time...
[35:24.500 --> 35:25.740]  6-1, 6-38.
[35:25.960 --> 35:26.500]  We're way ahead.
[35:28.360 --> 35:28.820]  Figures.
[35:32.660 --> 35:33.120]  So...
[35:33.120 --> 35:34.140]  Directory search.
[35:37.120 --> 35:41.640]  And I actually still call into some BBSs, and they're kind of fun to read.
[35:41.760 --> 35:44.980]  There's always like two old guys who are still calling in and chatting with each other.
[35:46.720 --> 35:48.180]  If you, wouldn't that make three?
[35:48.440 --> 35:48.880]  What's that?
[35:49.080 --> 35:50.180]  If you, wouldn't that make three?
[35:50.220 --> 35:51.200]  Yeah, that would make three.
[35:51.520 --> 35:51.620]  Yeah.
[35:51.840 --> 35:52.400]  Actually, I don't...
[35:52.400 --> 35:54.020]  I just read what they say.
[35:54.520 --> 35:56.440]  I'm like, hey, Bob, you gonna meet me for beer tonight?
[35:56.640 --> 35:56.980]  I'm like...
[36:00.350 --> 36:03.110]  What's like the most insecure, craziest thing that you've found?
[36:03.390 --> 36:04.690]  Like, utilities or...
[36:05.430 --> 36:05.850]  Um...
[36:05.850 --> 36:06.510]  We can't comment.
[36:07.430 --> 36:08.810]  I don't think that would be...
[36:09.350 --> 36:09.770]  Um...
[36:09.770 --> 36:13.570]  We found lots of, like, on X.25 networks and stuff like that.
[36:13.630 --> 36:15.630]  We've seen routers that...
[36:16.610 --> 36:17.030]  Um...
[36:17.030 --> 36:17.990]  You know...
[36:17.990 --> 36:19.790]  That don't have any password.
[36:20.510 --> 36:20.930]  Or...
[36:21.490 --> 36:21.910]  Just...
[36:21.910 --> 36:22.850]  Have, like...
[36:22.850 --> 36:24.730]  You accidentally hit enter, and then it lets you on.
[36:24.850 --> 36:25.530]  You're like, holy crap.
[36:26.050 --> 36:26.690]  So you disconnect.
[36:26.690 --> 36:27.530]  You're like, shit.
[36:27.630 --> 36:28.330]  I didn't mean to do that.
[36:28.550 --> 36:29.930]  Well, it's late as 94.
[36:30.190 --> 36:31.230]  You can dial in a mosquito.
[36:31.610 --> 36:31.810]  And it was...
[36:32.610 --> 36:33.610]  System SDF on it.
[36:33.970 --> 36:34.290]  And...
[36:34.290 --> 36:34.790]  Oh, really?
[36:34.890 --> 36:38.020]  Just drop you in with no white phone number.
[36:38.100 --> 36:39.020]  Oh, that's nice.
[36:40.040 --> 36:41.060]  They did fix that.
[36:42.360 --> 36:43.260]  I'm sure they did.
[36:43.580 --> 36:45.760]  Actually, we thought we were gonna be fine on our time.
[36:45.880 --> 36:48.860]  The one other thing that we've done really silly over VoIP is...
[36:48.860 --> 36:49.620]  Anybody...
[36:49.620 --> 36:50.380]  Uh...
[36:50.380 --> 36:52.140]  Run NTP servers, by any chance?
[36:53.280 --> 36:53.580]  Okay.
[36:53.980 --> 36:54.140]  Um...
[36:54.140 --> 36:55.180]  Have you ever played with...
[36:55.180 --> 36:57.600]  NTP has a dialer function built into it?
[36:57.600 --> 36:58.020]  No way.
[36:58.080 --> 36:59.880]  So you can dial into the NIST.
[37:00.380 --> 37:01.840]  And they still run their dial-up.
[37:01.900 --> 37:03.080]  So you kind of see where this is going.
[37:03.500 --> 37:07.100]  You configure it to go over VoIP to call there to get your time.
[37:07.340 --> 37:11.340]  And then you can become a stratum on server, which is kind of ridiculous because the latency and whatnot.
[37:12.180 --> 37:14.600]  But that was one really bored afternoon.
[37:14.760 --> 37:16.760]  And I was like, I wonder if I can get this to work.
[37:16.780 --> 37:17.700]  Holy shit, it did.
[37:22.970 --> 37:24.630]  Well, I think we're about done.
[37:24.830 --> 37:25.090]  Yeah?
[37:25.090 --> 37:26.090]  Unless there's any more...
[37:26.090 --> 37:26.530]  Any more questions?
[37:26.790 --> 37:26.950]  Yeah.
[37:27.430 --> 37:28.570]  Sorry I ran so quick.
[37:30.250 --> 37:30.530]  Hmm?
[37:30.550 --> 37:31.350]  I've got another quick question.
[37:31.470 --> 37:31.690]  Shoot.
[37:31.690 --> 37:35.520]  You pick an adapter?
[37:35.820 --> 37:35.960]  Yes.
[37:36.200 --> 37:36.960]  Are they all...
[37:40.830 --> 37:42.870]  Well, how do you mean?
[37:43.290 --> 37:45.410]  I mean, they're just a VoIP adapter.
[37:45.710 --> 37:46.910]  They're just about as good.
[37:47.010 --> 37:48.910]  I mean, we use like a lot of different adapters.
[37:49.070 --> 37:52.850]  I use PAP2s and Digium's adapter and stuff like that.
[37:52.850 --> 37:56.570]  But I mean, as long as it does you law or me law and...
[37:56.570 --> 37:59.890]  I have about like 50 or 60 modems that I'm going to do with.
[37:59.890 --> 38:00.370]  Awesome.
[38:00.970 --> 38:02.370]  You're catching up with me.
[38:02.510 --> 38:02.730]  Yeah.
[38:04.630 --> 38:08.590]  I literally, kind of like you, I have a crap load of modems because I'm just...
[38:08.590 --> 38:11.590]  You know, some modems do certain tasks better than others.
[38:11.990 --> 38:12.130]  You know?
[38:14.330 --> 38:14.710]  Yeah.
[38:14.710 --> 38:14.730]  Yeah.
[38:14.730 --> 38:15.970]  What's your place over there?
[38:16.630 --> 38:17.110]  eBay.
[38:18.050 --> 38:18.770]  For trash.
[38:19.130 --> 38:19.410]  For trash.
[38:20.690 --> 38:21.030]  For trash.
[38:21.350 --> 38:22.690]  For Salvation Army, yeah.
[38:22.690 --> 38:23.730]  Yeah, Salvation Army.
[38:24.530 --> 38:25.410]  And those...
[38:25.410 --> 38:31.690]  The one that I particularly like to use is the USR Courier V Everything because it's pretty nice and makes styling really fast.
[38:31.890 --> 38:35.790]  So, if you can find on eBay like 10 or 15 of those, you'll be...
[38:35.790 --> 38:37.930]  My company said, oh, we don't really need this anymore.
[38:38.170 --> 38:38.590]  I do.
[38:38.710 --> 38:39.410]  Right, right.
[38:39.610 --> 38:41.070]  That's kind of what we end up doing.
[38:42.450 --> 38:42.890]  So...
[38:42.890 --> 38:43.310]  All right.
[38:44.470 --> 38:44.910]  Well...
[38:44.910 --> 38:44.990]  Oh.
[38:46.330 --> 38:47.190]  Shameless plug, Todd.
[38:47.190 --> 38:48.270]  Oh, yeah, we have a little shit.
[38:48.270 --> 38:48.310]  Shameless plug.
[38:48.570 --> 38:51.610]  Just selling Jason Scott's VBS documentary right here for 40 bucks.
[38:51.970 --> 38:53.450]  If you don't have it, you should get it.
[38:54.790 --> 38:55.570]  It's good stuff.
[38:55.990 --> 38:57.010]  It's a great coaster.
[38:57.730 --> 38:58.350]  Oh, yeah.
[38:58.490 --> 38:58.970]  Oh, yeah.
[39:00.770 --> 39:01.210]  All right.
[39:01.270 --> 39:03.470]  That price might too, so you can put both your glasses.
[39:04.810 --> 39:05.390]  All righty.
[39:05.550 --> 39:07.290]  Well, I guess we're done here unless there's any more questions.
[39:07.430 --> 39:08.870]  Thank you very much for coming out to our talk.
[39:08.930 --> 39:09.050]  Thank you.
[39:09.350 --> 39:09.710]  Thank you.
[39:09.710 --> 39:09.770]  Thank you.