  k-23-(11)-02

  OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
      OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
                               OoO=o=oOO=o=O=>
  :    -`-             -`-      OoO=o=oOO=o=O=>
  ;  _|_--oOO--(_)--OOo--_|_      OoO=oOO==OoO=o=oOO=o=O=>
     |   ¡ K-1ine Zine !   |      OoO=o=oOO=o=O=>
      ! issue 23, volume 11¡      OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
         ---------O^O----        OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
  ;.              |__|__|       oOYourO=oO=oOO=Telstra=oSucks=o=O=>
                    || ||       OoO=o=oOO=o=O=OoO<FIDO>OO=<Is>o=O=<Dying>o=o=O=>
              ooO Ooo          OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
                          OoO=o=oOO=o=O=OoO=o=oOO=o=O=O=o=ooO=o=>
  
     ;`-.> January 2002 <=o=O=o=O=o=O

   
      'Heaps and Heaps of DTMF Beeps'


     "People demand freedom of speech to make up
      for the freedom of thought which they avoid." 
          
         - Soren Aabye Kierkegaard (1813-1855)

 _____________________________________________________________________________

 » .- Words from the Editor -. «                                              |

 *: [-] Introduction .......................................... The Clone    :*
 *: (-) Contact Information ................................... The Clone    :*
 *: (-) Advertisment .......................................... HackerSalvage:*
 *: (-) Link of the Month ..................................... The Clone    :*
 *: (-) K-1ine Mirrors ........................................ The Clone    :*
 *: (-) New Album Recommendation: Aphex Twin 'Drukqs' ......... Nettwerked   :*
 ____________________________________________________________________________

 » .- Documents -. «                                                          |

 *: (x) 'Canadian Packet Switching Networks' .................. The Clone    :*
 *: (x) 'Bell Express View... The Rest of The Story' .......... Absinth      :*
 *: (x) 'The GSM Security Technical Whitepaper for 2002' ...... The Clone/RT :*
 *: (x) 'How to rip off your local bookstore monopoly' ........ Diabolik
 _____________________________________________________________________________

 » .- Conclusion -. «                                                         |

 *: [-] Credits ............................................... The Clone    :*
 *: [-] Shouts ................................................ The Clone    :*
 _____________________________________________________________________________ 



  Introduction -

  Welcome to the newest issue of K-1ine... issue #23, volume number 11.
  We have a bunch of "great" article compilations for your liking. Take the
  time to read through them, and don't forget to submit something (relevant)
  - you might just be in the next issue (unlikely).
  
  I hope you enjoy this issue (you better)... see you next month (unlikely).

 -->

 Contact Information;
 =-=-=-=-=-=-==-=-=-=

 Comments/Questions/Submissions: theclone@hackcanada.com

 On IRC: irc.2600.net - #hackcanada, #cpu (key)

 Check out my site: (Nettwerked) http://www.nettwerked.net

 -->

                             -- Advertisment --

          +++              WWW.HACKERSALVAGE.COM               +++

           HackerSalvage.com is a non-profit website dedicated to
            keeping old hardware in circulation. Many of us have
           piles of it sitting around but can't just toss it out.
             Here you can post computer items for sale or post a
           want ad for items you are looking for. A perfect place
           to get rid of perfectly good junk.... and get some new
                         stuff to rebuild the pile.
          +++                                                  +++ 

 --


 --=[ LINK OF THE MONTH ]=--

 Every month I post one really great "link of the month" on every issue
 of K-1ine magazine. The link can be anything in the technology industry,
 music scene, rave scene, punk scene, or even a good article you read on a
 news site. I'll be taking submissions via e-mail or IRC right away;
 so get your links in and maybe you'll see it in the next issue of K-1ine!

 For the month of January, the link of the month is:

	    http://www.prisonangels.com/main.html
	  This is a free service for all inmates and
         penpals wanting to correspond with each other.

        

 [submitted by: The Clone]

--

 K-1ine Mirrors:

        http://the.wiretapped.net/security/info/textfiles/k1ine/


 "Wiretapped.net is an Australian site offering an archive of open
 source software, informational and advisory textfiles and radio/conference
 broadcasts covering the areas of network security, network operations,
 host integrity, cryptography and privacy. We aim to become the largest
 archive of this nature in the Asia/Pacific region through steady growth
 of our archives and regular updates to them (most updated nightly).
 We are proudly telehoused on a 10Mbit/sec connection by Connect.com.au using
 OneGuard hardware donated by eSec Limited. The archive, along with its
 sister site on the same machine, The AusMac Archive, generates between 10
 and 60 gigabytes of outbound traffic daily. Wiretapped.net is hosted in
                            Sydney, Australia."

 --


		  New Album Recommendation: Aphex Twin 'Drukqs'


    If you like experimental music, you'll like this album.
    Stuffed with all the experimental/classical/breakbeats
    you could ever want in your lonely pathetic lives.

    Buy it NOW: http://www.warprecords.com/mart/music/release.php?cat=WARP92
 

  --

				  Canadian Packet Switching Networks

 
     Last Updated: 01/15/02
     Compiled By: The Clone

     theclone@hackcanada.com
     http://www.nettwerked.net

     The following is a list of the currently
     known Packet Switching Networks in Canada.


   NAME:                     DEFINED:                              DNIC:        PROTOCOL:

   AGNPAC                    Government of Alberta                              X.25

   AT&T CANADA               Long Distance Services FasPac         3026         X.121

   AT&T CANADA               Packet Switched Public Data Network   3028         X.121

   CNCP PACKET NET           Unitel/AT&T Network                   3028         X.25

   CNCP INFO SWITCH          Unitel/AT&T Network                   3029         X.25

   DATAPAC                   Links Computers                       3020         X.25

   DATAROUTE                 Large Users

   DATALINK                  Small Users

   DIALCOM                   Worldwide Messaging

   ENVOY100                  Messaging

   EXTEN                     Voice Messaging

   FACSROUTE                 Facsimile

   FASPAC                    Links Computers                       3026         X.25

   FAXCOM                    Facsimile

   GLOBEDAT                  *UNKNOWN*                             3025         X.25

   GLOBEDAT-P                *UNKNOWN*                             3025         X.25

   GLOBEFAX                  Overseas Facsimile

   INET 2000                 Databases

   INFOGRAM                  *UNKNOWN*                             3028

   INFOSWITCH                *UNKNOWN*

   NORTH AMERICAN GATEWAY    ATM/Frame Relay Network               3035

   POSTPAC                   Canada Post                           3038         X.25

   SPRINT CANADA             Frame Relay Service                   3036         X.121

   STENTOR                   Data Network Gateway                  3022         X.121

   STENTOR                   Stentor ISDN Identification           3023         X.121

   TELECOM CANADA            Datapak Network                       3020         X.121

   TELECOM CANADA            PSTN Access                           3021         X.121

   TELEGLOBE CANADA          Globedat-C Circuit Switched Network   3024         X.121

   TELEGLOBE CANADA          Globedat-P Packed Switched            3025

   TELEPOST                  Messages At The Post Office

   TELESAT CANADA            Anikom 200                            3039         X.121

   TELETEX                   Text                                  2861

   TMI Communications        Mobile Data Service (MDS)             3037         X.25

   TRADEROUTE                Electronic Data Interchange

   TYMNET CANADA             WorldCom                              3106         X.25

   WPMAIL                    E-mail

  -

  .end

 -

 <Flopik> Why I have stupid quote on all klined.. sniff

 -


  Bell Express View... The Rest of The Story

  Hey just in case you wanted to know for the BEV hack on your page
  (http://www.hackcanada.com/canadian/scams/bell_xpress_vu.txt)
  most of it is right but, some people might get surprises...
  Small corrections/updates to apply :

 * Disclamer: I pass this to you for informational purposes only as it was
              passed to me.  Whatever you do with is your own responsibility *

 * Password is required only if system has been locked by user
   default password is 1234, if you don't know, err remember, password
   you're fucked, almost ( see later)

 * The phone line test is required everytime you want to order a pay per view
   whether it be a movie or an event like boxing or whatever.

 * All the information about pay per view is included on the smartcard. This
   information is written only when movie is watched, if you don't watch it,
   you don't pay for it.  Be careful however cuz if you order something you
   don't want and go channel surfing, even if you have the channel only for 1
   second it is as if you watched the whole thing.

 * That also means that if you loose signal (rain/snow fade) before ppv, change
   the channel and don't go back on it, order it again when everything is back
   up ok, cuz they don't credit anything in that way, even if you're a very
   lucrative customer.

 * If all receivers in same account order same ppv on same day at same time, it
   will only be billed once.

 * Smartcard has a built-in pay per view limit, should be around 50$ or
   something like 10 movies.  When you plug your phone line, all this is dumped
   to your bill and smartcard counter is reset to zero so you can order again.
   Yes that means you can be billed for stuff ordered over a year ago.

 * To know what is currently stored on your smartcard use remote and go to
   "menu - system setup - purchase info" (menu-6-5<4 if receiver is 1000>)

  Ok that's all good stuff to know you'll say but what about passwords ?
  It would be pretty dumb to have to buy a whole new receiver just cuz you or
  your friend lost a password and can't order pr0n anymore !!  Well you'll be
  happy to know that techies over there don't do it for nothing.  They ask you
  a bunch of questions like PIN (yeah they have that now on some accounts), full
  address, last bill ammount, programming, etc.  That's a lot of info and you
  probably don't remember it... but if you do they'll fix you up, set up a new
  pass and write it down in your file over there... But it's so much trouble.
  Now, they're not gods and can't control your receiver or your tv set over the
  phone so how do they reset they password ?  They don't !  They show you how
  and 98% of the time you'll forget how to do it again so it's not a big deal.
  Technically speaking, you don't reset the password, you "corrupt non volatile
  memory" which basically crashes the system and asks you to reboot it,
  restoring factory defaults. That means system is unlocked, password is 1!
  234, favorites lists and timers have been lost and the remote adress is back
  to 01 (now if you changed that before and you can't control the receiver
  anymore, remove the smartcard and press "record" on the remote (in sat mode
  of course) while on the "important system info" screen. putting the smartcard
  back in will just have the receiver reboot again). Now since most of this info
  is stored on the smartcard, I don't know if it clears the ppv list as well
  (feedback anyone ?). Yeah that's all good but "HOW" can you do this ????

 * Go in "menu - system setup - diagnostics" (menu-5 if 1000, menu 6-3 for all
   other receivers).  Now look at your remote, locate "info" "browse" "themes",
   see them ? no ?  info is under the "big circle" browse is to the right of
   select "small circle", theme is to the left. Now that you know where they
   are, press them in this order : info browse theme, withing 5 seconds. This
   should bring you to "memory dump & device status" window.  Check the 3rd box
   from the left in the top row, they call it "watchdog" and it is the number
   of times your system crashed or had a glitch.  If it is over 6 or has
   letters in it, you might considering replacing the receiver.  Now causing
   that memory crash causes some permanent damage to your receiver/card so do
   it at your own risk.  Ok so while you're on that same screen, press
   "tv/video", it will give you a message asking you to reboot.  Power off the
   receiver from the front pannel, it will turn back on by itself.  If you're
   stuck with a 1000, pull the plug, wait 30 secs and plug it back.  Voila !

   Hope this helps you all with your Bell Express View
 
   _Absinth_

   p.s. Did you know that they have over a million customers ? WOW ...

   12/20/2001

 -


			The GSM Security Technical Whitepaper for 2002


 Thursday January 10, 2002

 Researched, Written,
 and Compiled by:

       The Clone - theclone@hackcanada.com
              RT - r_t@mac.com

     Web-site: www.nettwerked.net


 A Brief Introduction to GSM

 The purpose of GSM Security

 GSM Encryption Algorithms

 GSM's Security Limitations

 A5 - Encryption Implementation

 GSM Security News Articles

 GSM Security Technical Papers

 Conclusion


   A Brief Introduction to GSM:

 Global System for Mobile communication (GSM) is a globally accepted standard for
 digital cellular communication. GSM is the name of a standardization group that was
 established in 1982 in an effort to create a common European mobile telephone standard
 that would formulate specifications for a pan-European mobile cellular radio system
 operating at 900 MHz. Today over 400 million people worldwide use GSM mobile phones
 to communicate with each other, via voice and short-message-service (SMS) text.

 This papers purpose was written to teach the masses currently known GSM Security
 Vulnerabilities, and to address concerns over some recently talked about (theoretical)
 GSM security vulnerabilities. We feel we need to address all security concerns in good faith,
 therefore this white paper was written to enlighten wireless carriers and end users. Please
 feel free to send all updates, questions, and concerns to The Clone and RT at their e-mail
 addresses (located on the top of the page).


   The purpose of GSM Security:

 Since all cases of GSM fraud against a specific wireless carrier will result in a
 substantial loss to the operator. This substantial loss may include the following:

 · No direct financial loss, where the result is lost customers and
   increase in use of the system with no revenue.

 · Direct financial loss, where money is paid out to others, such as
   other networks, carriers and operators of 'Value Added Networks'
   such as Premium Rate service lines.

 · Potential embarrassment, where customers may move to another
   service because of the lack of security.

 · Failure to meet legal and regulatory requirements, such as
   License conditions, Companies Acts or Data Protection Legislation.

    GSM Encryption Algorithms:

     A3 - The GSM authentication algorithm "placeholders" used in the GSM system.

     A5 - GSM stream cipher algorithm (GSM) / There are a series of implementations
          named A5/1, A5/2, ... The A5/1 is known as the strong over-the-air voice-
          privacy algorithm. A5/x (A5/2 ...) are weaker implementations targeted at
          foreign markets out side of Europe. There is also an A5/0 algorithm, which
          encloses no encryption at all. The A5 algorithm used for encrypting the
          over-the-air transmission channel is vulnerable against known-plain-text
          and divide-and-conquer attacks and the intentionally reduced key space is
          small enough to make a brute-force attack feasible as well.

COMP128 - one-way function that is currently used in most GSM networks for A3 and A8.
          Unfortunately the COMP128 algorithm is broken so that it gives away information
          about its arguments when queried appropriately. The COMP128 algorithm used in
          most GSM networks as the A3/A8 algorithm has been proved faulty so that the
          secret key Ki can be reverse-engineered at the SIM level (2^19 queries),
          and over-the-air in approximately eight hours.


COMP128-2 COMP128-2 algorithm out (revised A3/A8 reference algorithm)

  
    GSM's Security Limitations:

 Existing cellular systems have a number of potential weaknesses
 that were considered in the security requirements for GSM. 

 The security for GSM has to be appropriate for the system operator and customer:

 · The operators of the system wish to ensure that they could issue bills to the right
   people, and that the services cannot be compromised.

 · The customer requires some privacy against traffic being overheard.


  The countermeasures are designed to:

 · make the radio path as secure as the fixed network, which implies anonymity and
   confidentiality to protect against eavesdropping;

 · have strong authentication, to protect the operator against billing fraud;

 · prevent operators from compromising each others' security, whether inadvertently
   or because of competitive pressures.


  The security processes must not:


 · significantly add to the delay of the initial call set up or subsequent communication;

 · increase the bandwidth of the channel,

 · allow for increased error rates, or error propagation;

 · add excessive complexity to the rest of the system,

 · must be cost effective.

  The designs of an operator's GSM system should take into account,
  the environment and have secure procedures such as: 

 
 · the generation and distribution of keys, 

 · exchange of information between operators, 

 · the confidentiality of the algorithms. 

 
   Descriptions of the functions of the services:

  The security services provided by GSM are:

 · Anonymity So that it is not easy to identify the user of the system.

 · Authentication So the operator knows who is using the system for billing purposes.

 · Signaling Protection So that sensitive information on the signaling channel,
   such as telephone numbers, is protected over the radio path.

 · User Data Protection So that user data passing over the radio path is protected.


   Anonymity

 Anonymity is provided by using temporary identifiers. When a user first switches on
 his/her radio set, the real identity is used, and a temporary identifier is then issued.
 From then on the temporary identifier is used. Only by tracking the user is it possible
 to determine the temporary identity being used.

   Authentication

 Authentication is used to identify the user (or holder of a Smart Card) to the network
 operator. It uses a technique that can be described as a "Challenge and Response", based
 on encryption. Authentication is performed by a challenge and response mechanism. A random
 challenge is issued to the mobile, the mobile encrypts the challenge using the authentication
 algorithm (A3) and the key assigned to the mobile, and sends a response back. The operator
 can check that, given the key of the mobile, the response to the challenge is correct. 

 Eavesdropping the radio channel reveals no useful information, as the next time a new random
 challenge will be used. Authentication can be provided using this process. A random number is
 generated by the network and sent to the mobile. The mobile use the Random number R as the
 input (Plaintext) to the encryption, and, using a secret key unique to the mobile Ki, transforms
 this into a response Signed RESponse (SRES) (Ciphertext) which is sent back to the network.

 The network can check that the mobile really has the secret key by performing the same SRES
 process and comparing the responses with what it receives from the mobile.

  Implementation and Roaming

 The authentication algorithm A3 is an operator option, and is implemented within the smart card
 (known as the Subscriber Interface Module or SIM). So that the operators may inter-work without
 revealing the authentication algorithms and mobile keys (Ki) to each other, GSM allows triplets
 of challenges (R), responses (SRES) and communication keys (Kc) to be sent between operators over
 the connecting networks. The A5 series algorithms are contained within the mobile equipment, as
 they have to be sufficiently fast and are therefore hardware. There are two defined algorithms
 used in GSM known as A5/1 and A5/2. The enhanced Phase 1 specifications developed by ETSI allows
 for inter-working between mobiles containing A5/1, A5/2 and unencrypted networks. These algorithms
 can all be built using a few thousand transistors, and usually takes a small area of a chip within
 the mobile.

  World-wide use of the algorithms

 There are now three different possibilities for GSM, unencrypted, and use of the A5/1 algorithm or
 the A5/2 algorithm to secure the data. This arose because the GSM standard was designed for Western
 Europe, and export regulations did not allow the use of the original technology outside Europe.
 The uses of the algorithms in the network operator's infrastructure are controlled by the GSM
 Memorandum of Understanding Group (MoU) according to the formula below:

 · The present A5/1 algorithm can be used by countries which are members of CEPT.

 · The algorithm A5/2 is intended for any operators in countries that do not fall into the above category.

 Export controls on mobiles are minimal, and the next generation of mobiles will support A5/1, A5/2
 and no encryption. The protocols to support the various forms of A5 (up to seven) are available in GSM.

  Loss areas

 There are a number of areas that can be exploited, the most likely intention
 of all the techniques is the ability to make money at the lowest cost possible.

  Technical fraud

 Technical fraud is where a weakness of the system is exploited to make free calls.
 For example, Call Forwarding or Conference Call facilities may be used to give reduced
 price services to customers from a stolen mobile. These are often known as 'Call Sales Offices'.
 Hackers and phreakers are often able to gain access and exploit a weakness in the switching or
 billing system and gain the ability to make calls or financial advantage. In some cases hackers
 and phreakers can take over the entire billing system and routing system; thus causing convenience
 for customers and carriers.

  Procedural fraud

 Procedural fraud results from the exploitation of business processes, where a flaw or weakness can
 be used to gain money. It may be possible for example to get free calls from a stolen mobile, and
 sell the calls on for a lower cost than any legitimate network operator. This can be minimized by
 designing processes so that losses can be stopped by the use of correct and up to date policies,
 and by taking the opportunity to create a fraud away from the attacker or employee.

 Comparison with other frauds

 Many of the techniques that can be used to commit fraud on telecommunications networks can also
 be used for a mobile network. Analogue mobile phone systems (AMPS) were subject to being eaves-
 dropped (with conventional RF-Scanners available at electronics shops and Radio Shack), and the
 phones could be cloned (ESN snarfing over thin-air) so that bills were paid by the owner of the
 original mobile phone. Existing cellular systems have a number of potential weaknesses that were
 considered in the security requirements for GSM. Networks such as GSM, with international roaming
 and interactions with other operators (carriers), offer other opportunities for exploitation. GSM
 has been designed to offer various technical solutions to prevent misuse, such as strong authenti-
 cation, together with anonymity and encryption of the signaling and data over the radio. However,
 all systems are dependent on secure management deployment and special procedures; lapses in these
 areas have severe impact on the resilience of the business process to fraud. For example; many
 carriers still make use of the COMP128 encryption algorithm for both A3 (the authentication algorithm
 to prevent phone cloning) and A8 (the voice-privacy key-generation algorithm), which is fine for
 securing against simple over-the-air attacks. However we have determined, that the COMP128's voice-
 encryption algorithms only encrypt voice between the GSM wireless phone and the base station.
 It does not encrypt voice within the phone network, nor does it encrypt end to end. It only encrypts
 the over-the-air portion of the transmission. The attack on COMP128 takes just 2^19 queries to the GSM
 smart-card chip, which takes approximately 8 hours over the air. This attack can be tested on as many
 simultaneous phones in radio range as your rogue base station has channels.

  A5 - Encryption Implementation

 The documentation we have, which arrived anonymously in two brown envelopes,
 is incomplete; we do not know the feedback taps of registers 2 and 3, but we
 do know from the chip's gate count that they have at most 6 feedback taps
 between them. The following implementation of A5 is due to Mike Roe, and all
 comments and queries should be sent to him.


/*
 * In writing this program, I've had to guess a few pices of information:
 *
 * 1. Which bits of the key are loaded into which bits of the shift register
 * 2. Which order the frame sequence number is shifted into the SR (MSB
 *    first or LSB first)
 * 3. The position of the feedback taps on R2 and R3 (R1 is known).
 * 4. The position of the clock control taps. These are on the `middle' one, 
 *    I've assumed to be 9 on R1, 11 on R2, 11 on R3.
 */

/*
 * Look at the `middle' stage of each of the 3 shift registers.
 * Either 0, 1, 2 or 3 of these 3 taps will be set high.
 * If 0 or 1 or one of them are high, return true. This will cause each of
 * the middle taps to be inverted before being used as a clock control. In
 * all cases either 2 or 3 of the clock enable lines will be active. Thus,
 * at least two shift registers change on every clock-tick and the system
 * never becomes stuck.
 */

static int threshold(r1, r2, r3)
unsigned int r1;
unsigned int r2;
unsigned int r3;
{
int total;

  total = (((r1 >>  9) & 0x1) == 1) +
          (((r2 >> 11) & 0x1) == 1) +
          (((r3 >> 11) & 0x1) == 1);

  if (total > 1)
    return (0);
  else
    return (1);
}

unsigned long clock_r1(ctl, r1)
int ctl;
unsigned long r1;
{
unsigned long feedback;

 /*
  * Primitive polynomial x**19 + x**5 + x**2 + x + 1
  */

  ctl ^= ((r1 >> 9) & 0x1);
  if (ctl)
  {
    feedback = (r1 >> 18) ^ (r1 >> 17) ^ (r1 >> 16) ^ (r1 >> 13);
    r1 = (r1 << 1) & 0x7ffff;
    if (feedback & 0x01)
      r1 ^= 0x01;
  }
  return (r1);
}

unsigned long clock_r2(ctl, r2)
int ctl;
unsigned long r2;
{
unsigned long feedback;

  
 /*
  * Primitive polynomial x**22 + x**9 + x**5 + x + 1
  */   

  ctl ^= ((r2 >> 11) & 0x1);
  if (ctl)
  {
    feedback = (r2 >> 21) ^ (r2 >> 20) ^ (r2 >> 16) ^ (r2 >> 12);
    r2 = (r2 << 1) & 0x3fffff;
    if (feedback & 0x01)
      r2 ^= 0x01;
  }
  return (r2);
}

unsigned long clock_r3(ctl, r3)
int ctl;
unsigned long r3;
{
unsigned long feedback;

 /*
  * Primitive polynomial x**23 + x**5 + x**4 + x + 1
  */

  ctl ^= ((r3 >> 11) & 0x1);
  if (ctl)
  {
    feedback = (r3 >> 22) ^ (r3 >> 21) ^ (r3 >> 18) ^ (r3 >> 17);
    r3 = (r3 << 1) & 0x7fffff;
    if (feedback & 0x01)
      r3 ^= 0x01;
  }
  return (r3);
}

int keystream(key, frame, alice, bob)
unsigned char *key;   /* 64 bit session key              */
unsigned long frame;  /* 22 bit frame sequence number    */
unsigned char *alice; /* 114 bit Alice to Bob key stream */
unsigned char *bob;   /* 114 bit Bob to Alice key stream */
{
unsigned long r1;   /* 19 bit shift register */
unsigned long r2;   /* 22 bit shift register */
unsigned long r3;   /* 23 bit shift register */
int i;              /* counter for loops     */
int clock_ctl;      /* xored with clock enable on each shift register */
unsigned char *ptr; /* current position in keystream */
unsigned char byte; /* byte of keystream being assembled */
unsigned int bits;  /* number of bits of keystream in byte */
unsigned int bit;   /* bit output from keystream generator */

  /* Initialise shift registers from session key */

  r1 = (key[0] | (key[1] << 8) | (key[2] << 16) ) & 0x7ffff;
  r2 = ((key[2] >> 3) | (key[3] << 5) | (key[4] << 13) | (key[5] << 21)) & 0x3fffff;
  r3 = ((key[5] >> 1) | (key[6] << 7) | (key[7] << 15) ) & 0x7fffff;


  /* Merge frame sequence number into shift register state, by xor'ing it
   * into the feedback path
   */

  for (i=0;i> 1;
  }

  /* Run shift registers for 100 clock ticks to allow frame number to
   * be diffused into all the bits of the shift registers
   */

  for (i=0;iBob key stream */

  ptr = alice;
  bits = 0;
  byte = 0;
  for (i=0;i> 18) ^ (r2 >> 21) ^ (r3 >> 22)) & 0x01;
    byte = (byte << 1) | bit;
    bits++;
    if (bits == 8)
    {
      *ptr = byte;
      ptr++;
      bits = 0;
      byte = 0;
    }
  }
  if (bits)
    *ptr = byte;

  /* Run shift registers for another 100 bits to hide relationship between
   * Alice->Bob key stream and Bob->Alice key stream.
   */

  for (i=0;iAlice key stream */

  ptr = bob;
  bits = 0;
  byte = 0;
  for (i=0;i> 18) ^ (r2 >> 21) ^ (r3 >> 22)) & 0x01;
    byte = (byte << 1) | bit;
    bits++;
    if (bits == 8)
    {
      *ptr = byte;
      ptr++;
      bits = 0;
      byte = 0;
    }
  }
  if (bits)
    *ptr = byte;
 
  return (0);

}



 GSM Security News Articles:

 'Cracking GSM's Security Code (date unknown)' (Mobile Computing Online)
  http://www.mobilecomputing.com/showarchives.cgi?3:2

 'ZDNet News: Cell phone flaw opens security hole' (Sept 18, 2000)
  http://www.zdnet.com/zdnn/stories/news/0,4586,2628754,00.html


 GSM Security Technical Papers:

  Miscellaneous:

  Berkeley Website: GSM Cloning
  http://www.isaac.cs.berkeley.edu/isaac/gsm-faq.html

  Department of Computer Science and Engineering: GSM Interception
  http://www.dia.unisa.it/ads.dir/corso-security/www/CORSO-9900/a5/Netsec/netsec.html

 SIM Card Technology:

  SIM Cards: At the Heart of Digital Wireless Security (.pdf / 1,842 KB)
  http://www.uwcc.org/pdfs/smart_cards.pdf


  Conclusion:

 We have contacted several people from the GSM Association
 (www.gsm.org) and asked about receiving spec and source
 for the updated COMP128-2 encryption algorithm. We are
 now awaiting approval, and will post all relevant info about
 COMP128-2 in later releases of this GSM security paper.

 Also, we're doing extensive research involving security
 vulnerabilities with EIR databases the contain all known
 IMEIs (International Mobile Equipment Identity) numbers,
 as well as physical vulnerabilities that allow software
 and hardware IMEI cloning. This information will be made
 available on the next release of this GSM paper as well.

   This document is Copyright (c) 2002 by Nettwerked.
      And by the other respective owners.

 -

 <emmanuel> it's a fucking irc server and you're on fucking irc so fucking fuck the fuck off

 -

 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 How to rip off your local bookstore monopoly
 =-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                                    2001 diabolik
                                    -=-=-=-=-=-=-


 disclaimer : I wrote this to bring to light a rather glaring hole.  I wrote it in
 a howto-ish sort of form to display how the system could possibly be abused, not with
 the intent that the actions below would ever be enacted.  Do not do this.  It is
 most likely fraud, and more importantly, morally wrong.  Upon acting out these steps,
 you take full responsibility for your actions and release me, diabolik, from any
 responsibility.  Yeah.

 So.  Indigo owns Chapters.  Chapters owns Coles.  Until later 2002 when Barnes&Noble
 cross the border, nearly every major bookstore in Canada is owned by the same company.
 Not cool.

 Wait, it really is actually.  Once Indigo bought Chapters, Heather Reisman decided to 
 amalgamate a bunch of things.  Firstly, the annoying discount card program is now the
 same at chapters, coles, indigo, etc.. irewards program.

 So what.  Save 10% off of regular priced books.  Yeah.

 Now, Chapters and Coles, and presumably Indigo, have a very jolly Canadian return policy.
 Bring back an undamaged book without a receipt and exchange the book or get gift 
 certificates back.  You can probably see where this is going.  Make a $100 purchase with
 a iRewards card (pay $90) at Coles.  Bring the books back to Chapters and get $100 in 
 gift certificates.  Make a $111 purchase ($100/0.9) at chapters (or coles), paying $100,
 and bring the books back to either place and receive the full $111, which buys you $123 
 worth of books.

 You don't need both a Coles and a Chapters, but it helps - the more entities you can
 return the books, the less times you have to frequent either.  And you can be funny
 about it - buy all the copies of a certain book from Chapters and return them all to
 Coles (they'll catch on to this, the SIMS computer system at Coles will show a return
 of larger quantity than ever ordered, however that won't be noticed until days later.

 I'm not sure if Chapters' tills would notice the erroneous return sooner - however, just
 buy common books so that you're not the only sales of the title and therefore won't cause
 panic in the bookgeeks.  Be warned - Coles usually only employs around 10 people in their
 mall stores, and these people do have the mental capacity to remember people.  It would
 be suggested to do this ploy with multiple people, so that its less obvious.  Use New
 Release hardcover titles - about $50 apeice and are popular enough.  I'd suggest use
 audio cassetes but you wouldn't save 10% so it'd be useless.

 NOTE - register your iRewards card with fake info - they keep that in a main database and
 if they somehow correlated these returns without receipts with your purchases you would
 be in trouble.

 So, You've done this 7 times and doubled your money.  You still have only gift
 certificates, not real dough.  You can get the money out of this by -

 - buying books for people who were otherwise going to pay for them anyways.  You don't
 have to tell them your plan, you could just tell them granny gave you gift certificates
 and you wanna get rid of them.  However, this still forces you to involve more people.

 - when you order a book from Chapters, you have to often prepay for the book if its
 a rare title.  If this book cannot be ordered, you can go back and receive money for 
 the title because the computer doesn't keep track of if the book was prepaid with
 gift certificates or not.

 fuck corporations, eh?

 diabolik
 http://th.oughtpolice.net

 greetz - clox, hackcanada, nettwerked, heather herself, roy fans.

 flames - tron - stop killing me in LORD you bitch

 01/03/2002

-->

 -- Credits

    Without the following contributions this zine issue would be fairly
      delayed or not released, so thank you to the following people:

	    		 Absinth, Diabolik, RT, The Clone

  -- Shouts:

    Hack Canada (#HackCanada), Canadian Phreakers Union (#cpu), The Grasshopper Unit,
      Flippersmack, Pyrofreak, soapie, Françoise, `enjoy, Kybo_ren, Flopik, Pinguino,
       and lastly to everyone and anyone who contributes to the Canadian H/P scene.


                             ;.  .;..  ; ;. ;..
                           ;..   .;..; .;.; .;; ;..
                      .;..;. .;..;  .;.;...; ;..;..
                         .;.         A         .;. .;.
                       ;..   N E T T W E R K E D  ;..
                        ;..;.. P R O D U C T   ;..;..
                          .;..;               ;..;..
                     ;  .;..;.;..   .; .  .;. ..;..
                    .;..   . .;  ..;..;..;.. .;
                ;..;.   .;.. . .;.. .;.;.
              ..;. ..;.. .;.   ;.;..;;..;.;
                ;.;;..;..      ;.;.; .; .
                   ;.;..;. .;. ;.;:.;.
                     ,;....;.
               .;.;. .;.;
              .;.;.;
            .;.;
            ;..;.
           .;.;;.; .;. ..; ;. > > > > > > ... carpet beetles taste like chicken
