Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [165]
Only a week after my arrival, I found a lovely apartment in northwestern Raleigh, in an elaborate complex called “The Lakes,” a suitable name since its eighty-plus acres included shorelines on two separate lakes. The place featured not just an Olympic-sized pool, tennis courts, and racquetball courts but two volleyball courts: the management had trucked in loads of sand to create a beachlike setting. The Lakes also featured parties every weekend for all the residents, described to me as lively, noisy affairs crowded with lots of smiling Southern beauties. My apartment was small, but who cared? I felt as if I were living a dream.
I stopped by U-Save Auto Rental, a one-man operation, the kind of place where the owner takes a hard look at the people who come in, as if he were thinking that they might not be planning on bringing his car back. He cast a doubtful expression at me, too, but I responded with friendly, unhurried chat, and he warmed up.
“I’ve just been through a hideous divorce,” I told him. “I came to Raleigh because it’s a long way from Vegas, you know what I mean?” This was my attempt to explain why I would be paying in cash. As part of the act, I handed him my business card for the company I had supposedly worked for in Vegas—the same phony company I’d created to get the law firm job in Denver.
By the time I was ready to climb into my temporary rattletrap, he let me drive away without even checking my references.
I kept thinking about the last remaining step of the Motorola hack: getting hold of a compiler that would translate the source code into a form the cell-phone chip could understand. Having the compiler would allow me to make changes to the source code and compile a new version of the firmware that would shrink my visibility—for example, letting me toggle on and off how my cell phone communicated with the mobile provider to disable tracking, and adding functions that would make it easy to change the ESN from the cell phone’s keypad, so I could easily clone my phone to any other subscriber’s number.
Once I was back in the saddle for this effort, a little research showed me that Motorola used a compiler from a company called Intermetrics, which quickly made it to the top of my list of hacking targets. I identified a computer called “blackhole.inmet.com” that was on Intermetrics’ internal network, directly accessible from the Internet.
When I realized that the company’s systems were patched against all the latest security vulnerabilities, I quickly changed tactics. Conveniently, “blackhole” turned out to be vulnerable to the same IP spoofing attack that JSZ and I had used against Shimmy.
When I got into the system, I saw that two system administrators were logged in and apparently busy at work. Rather than risk being discovered in case one of them checked the currently established network connections, I looked for alternate ways to access the company remotely that would not be easily detected. Maybe I could find a dial-up number and connect over my modem.
In the files of one of the system administrators, Annie Oryell, I found a file with a promising name: “modem.” Yes! The file held the text of an email she had sent to other employees, informing them of the dial-up numbers. It read, in part:
We currently have two dial-in hunt groups. The 661-1940 group consists of 8 9600bps Telebit modems which connect directly into the Annex terminal server. The 661-4611 hunt group has 8 2400bps Zoom modems which currently connect to the terminal server.
Bingo: “661-1940” and “661-4611”were the dial-in numbers I was looking for. I changed the password on what appeared to be a few dormant accounts on the Annex terminal server and dialed in to avoid the risk of being detected on any of the Internet-facing systems.
System administrator Oryell appeared to use the host blackhole as her personal workstation. I figured