phrack/phrack26/5.txt

                                ==Phrack Inc.==

                     Volume Three, Issue 26, File 5 of 11

                                    COSMOS

                   COmputer System for Mainframe OperationS

                                   Part One

                                by King Arthur

Introduction
%%%%%%%%%%%%

     Throughout the last decade, computers have played an ever growing role in
information storage and retrieval.  In most companies, computerized databases
have replaced a majority of all paper records.  Where in the past it would take
10 minutes for someone to search through stacks of paper for some data, the
same information can now be retrieved from a computer in a fraction of a
second.

     Previously, proprietary information could be considered "safe" in a file
cabinet; the only way to see the data would be to have physical access to the
files.  Now, somebody with a computer terminal and a modem can make a quick
phone call and access private records.  It's unfortunate that there are
"hackers" who try to gain unauthorized access to computers.  Yet, it is just as
unfortunate that most reported computer break-ins could have been prevented if
more thought and common sense went into protecting computers.


Hackers
%%%%%%%
     There have been many cases of computer crime reported by the Bell
Operating Companies (BOCs), but it is hard to say how many actual break-ins
there are.  Keep in mind that the only reported cases are those which are
detected.  In an interview with an anonymous hacker, I was told of one of the
break-ins that may not have ever been reported.  "My friend got the number when
he misdialed his business office -- that's how we knew that it was the phone
company's.  It seems this Unix was part of some real big Bellcore computer
network," says the hacker.

     The hacker explains that this system was one of many systems used by the
various BOCs to allow large Centrex customers to rearrange their Centrex
groups.  It seems he found a text file on the system with telephone numbers and
passwords for some of Bellcore's development systems.  "On this Bellcore system
in Jersey, called CCRS, we found a list of 20 some-odd COSMOS systems....
Numbers, passwords, and wire centers from all over the country!"  He adds,
"Five states to be exact."

     The hacker was able to gain access to the original Unix system because, as
he says, "Those guys left all the default passwords working."  He was able to
login with a user name of "games" with the password being "games."  "Once we
were on we found that a large number of accounts didn't have passwords.  Mary,
John, test, banana, and system were some, to name a few."  From there he was
able to eventually access several COSMOS database systems -- with access to ALL
system files and resources.

COSMOS
%%%%%%
     COSMOS, an acronym for the COmputer System for Mainframe OperationS, is a
database package currently supported by Bellcore.  COSMOS is presently being
used by every BOC, as well as by Cincinnati Bell and Rochester Telephone.
COSMOS replaces paper record-keeping and other mechanized record systems for
plant administration.  COSMOS' original purpose was to alleviate congestion in
the Main Distributing Frame (MDF) by maintaining the shortest jumpers.

     It can now maintain load balance in a switch and assign office equipment,
tie pairs, bridge lifters and the like.  Additional applications allow COSMOS
to aid in "cutting-over" a new switch, or even generate recent change messages
to be input into electronic switches.  COSMOS is most often used for
provisioning new service and maintaining existing service, by the following
departments:  The frame room (MDF), the Loop Assignment Center (LAC), the
Recent Change Memory Assistance Center (RCMAC), the network administration
center, and the repair service.

     Next year COSMOS will celebrate its 15th birthday, which is quite an
accomplishment for a computer program.  The first version or "generic" of
COSMOS was released by Bell Laboratories in 1974.  In March 1974, New Jersey
Bell was the first company to run COSMOS, in Passaic, New Jersey. Pacific
Telesis, NYNEX,  Southern Bell, and many of the other BOCs adopted COSMOS soon
after.  Whereas Southwestern Bell waited until 1977, the Passaic, NJ Wire
Center is still running COSMOS today.

     Originally COSMOS ran on the DEC PDP 11/45 minicomputer.  The package was
written in Fortran, and ran the COSNIX operating system.  Later it was adapted
to run on the DEC PDP 11/70, a larger machine.  Beverly Cruse, member of
Technical Staff, COSMOS system design at Bellcore, says, "COSNIX is a
derivation of Unix 1.0, it started out from the original Unix, but it was
adapted for use on the COSMOS project.  It bears many similarities to Unix, but
more to the early versions of Unix than the current...  The COSMOS application
now runs on other hardware understandard Unix."

     "The newest version of COSMOS runs on the standard Unix System V operating
system.  We will certify it for use on particular processors, based on the
needs of our clients," says Ed Pinnes, the District Manager of COSMOS system
design at Bellcore.  This Unix version of COSMOS was written in C language.
Currently, COSMOS is available for use on the AT&T 3B20 supermini computer,
running under the Unix System V operating system.  "There are over 700 COSMOS
systems total, of which a vast majority are DEC PDP 11/70's.  The number
fluctuates all the time, as companies are starting to replace 11/70's with the
other machines," says Cruse.

     In 1981 Bell Laboratories introduced an integrated systems package for
telephone companies called the Facility Assignment Control System (FACS).  FACS
is a network of systems that exchanges information on a regular basis.  These
are: COSMOS, Loop Facilities Assignment and Control System (LFACS), Service
Order Analysis and Control (SOAC), and Work Manager (WM).  A service order from
the business office is input in to SOAC.  SOAC analyzes the order and then
sends an assignment request, via the WM, to LFACS.  WM acts as a packet switch,
sending messages between the other components of FACS.  LFACS assigns
distribution plant facilities (cables, terminals, etc.) and sends the order
back to SOAC.  After SOAC receives the information form LFACS, it sends an
assignment request to COSMOS.  COSMOS responds with data for assigning central
office equipment:  Switching equipment, transmission equipment, bridge lifters,
and the like.  SOAC takes all the information from LFACS and COSMOS and appends
it to the service order, and sends the service order on its way.

Computer Security
%%%%%%%%%%%%%%%%%
     Telephone companies seem to take the brunt of unauthorized access
attempts.  The sheer number of employees and size of most telephone companies
makes it very difficult to keep tabs on everyone and everything.  While
researching computer security, it has become evident that COSMOS is a large
target for hackers.  "The number of COSMOS systems around, with dial-ups on
most of the machines... makes for a lot of possible break-ins,"  says Cruse.
This is why it's all the more important for companies to learn how to protect
themselves.

     "COSMOS is power, the whole thing is a big power trip, man. It's like Big
Brother -- you see the number of some dude you don't like in the computer.  You
make a service order to disconnect it; COSMOS is too stupid to tell you from a
real telco dude," says one hacker.  "I think they get what they deserve:
There's a serious dearth of security out there.  If kids like us can get access
this easily, think about the real enemy -- the Russians," jokes another.

     A majority of unauthorized access attempts can be traced back to an
oversight on the part of the system operators; and just as many are the fault
of the systems' users.  If you can keep one step ahead of the hackers,
recognize these problems now, and keep an eye out for similar weaknesses, you
can save your company a lot of trouble.

     A hacker says, "In California, a friend of mine used to be able to find
passwords in the garbage.  The computer was supposed to print some garbled
characters on top of the password. Instead the password would print out AFTER
the garbled characters."   Some COSMOS users have half duplex printing
terminals.  At the password prompt COSMOS is supposed to print a series of
characters and then send backspaces.  Then the user would enter his or her
password.  When the password is printed on top of the other characters, you
can't see what it is.  If the password is being printed after the other
characters, then the printing terminal is not receiving the back space
characters properly.

     Another big problem is lack of password security.  As mentioned before,
regarding CCRS, many accounts on some systems will lack passwords.  "On COSMOS
there are these standardized account names.  It makes it easier for system
operators to keep track of who's using the system.  For instance: all accounts
that belong to the frame room will have an MF in them.  Like MF01, you can tell
it belongs to the frame room.  (MF stands for Main Frame.)  Most of these names
seem to be common to most COSMOS systems everywhere.  In one city, none of
these user accounts have passwords.  All you need is the name of the account
and you're in.  In another city, which will remain unnamed, the passwords are
the SAME AS THE DAMN NAMES!  Like, MF01 has a password of MF01.  These guys
must not be very serious about security."

     One of the biggest and in my eyes one of the scariest problems around is
what hackers refer to as "social engineering".  Social engineering is basically
the act of impersonating somebody else for the sake of gaining proprietary
information.  "I know this guy.  He can trick anybody, does the best BS job
I've ever seen.  He'll call up a telco office, like the repair service bureau,
that uses COSMOS.  We found that most clerks at the repair service aren't too
sharp."  The hacker said the conversation would usually take the following
course:

Hacker:  Hi, this is Frank, from the COSMOS computer center.   We've had a
         problem with our records, and I'm wondering if you could help me?

Telco:   Oh, what seems to be the problem?

H:  We seem to have lost some user data.  Hopefully, if I can correct the
    problem, you people won't lose any access time today.  Could you tell me
    what your system login name is?

T:  Well, the one I use is RS01.

H:  Hmm, this could present a problem.  Can you tell me what password and wire
    center you use that with?

T:  Well, I just type s-u-c-k-e-r for my password, and my wire centers are: TK,
    KL, GL, and PK.

H:  Do you call into the system, or do you only have direct connect terminals?

T:  Well, when I turn on my machine I get a direct hook up.  It just tells me
    to login.  But I know in the back they have to dial something.  Hold on,
    let me check.  (3 Minutes later...)  Well, she says all she does is call
    555-1212.

H:  OK, I think I have everything taken care of.  Thanks, have a nice day.

T:  Good, so I'm not gonna have any problems?

H:  No, but if you do just give the computer center a call, and we'll take care
    of it.

T:   Oh, thank you honey.  Have a nice day now.

     "It doesn't work all the time, but we get away with it a good part of the
time.  I guess they just don't expect a call from someone who isn't really part
of their company,"  says the hacker.  "I once social engineered the COSMOS
control center.  They gave me dial-ups for several systems, and even gave me
one password.  I told them I was calling from the RCMAC and I was having
trouble logging into COSMOS," says another.

     This last problem illustrates a perfect example of what I mean when I say
these problems can be prevented if more care and common sense went into
computer security.  "Sometimes, if we want to get in to COSMOS, but we don't
have the password, we call a COSMOS dial-up at about 5 o'clock.  To logoff of
COSMOS you have to hit a CONTROL-Y.  If you don't, the next person who calls
will resume where you left off.  A lot of the time, people forget to logoff.
They just turn their terminals off, in the rush of going home."

     The past examples do not comprise the only way hackers get into systems,
but most of the problems shown here can exist regardless of what types of
systems your company has.  The second article deals with solutions to these
problems.
_______________________________________________________________________________