Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [60]
Lewis and I were both eager to find out more from Eric about what he and Poulsen had been doing together. In one phone conversation, Eric again rattled off the names of Pacific Bell systems he and Poulsen had gained control over. The list was familiar, all except one that I had never heard of: “SAS.”
“What’s SAS?” I asked.
“It’s an internal testing system that can be used to monitor a line.”
In phone company lingo, “monitor” is a tactful word for wiretap.
I told Eric, “With switch access, you can monitor a line anytime.” I figured he’d understand: the phone company’s 1A ESS switches had a “talk & monitor” feature that let you pop in on a line and listen to the conversation.
Eric said, “SAS is better.”
He claimed that he and Poulsen had made a nighttime visit to the Sunset central office in West Hollywood. But their visit had turned up some things they hadn’t seen before. They found the place strange: unlike other COs, it was equipped with unusual computer terminals and tape drives, “looking like something from an alien planet.” One refrigerator-sized box had various types of equipment humming inside it. They came across a manual identifying the device as a Switched Access Services unit—SAS for short. When Poulsen started leafing through the manual, he realized that SAS was meant for line testing, which sounded like it meant you could connect onto any phone line.
But was it just for checking that the line was working? Or could you pick up conversations?
Poulsen started fiddling with the SAS control terminal. Punching in the number of a pay phone he sometimes used, he confirmed that, yes, you could drop in on a line and hear the conversation.
He went back into the CO on another night with a tape recorder so he could capture the data being sent out from the SAS equipment. He wanted to try to reverse-engineer the protocol at home and give himself the same capabilities.
I had to have access to this system. But when I asked for details, Eric clammed up and quickly changed the subject.
I started researching it the very next day.
The mysterious SAS was just what I had been lacking in my life: a puzzle to be solved, an adventure with hazards. It was unbelievable that in my years of phone phreaking, I had never heard about it. Intriguing. I felt, Wow, I gotta figure this out.
From my earlier nocturnal visits to phone company offices, as well as reading every telephone company manual I could get my hands on and social-engineering phone company employees since I was in high school, I had a well-developed knowledge of the different departments, processes, procedures, and phone numbers within Pacific Bell. There probably weren’t a lot of people inside the company who knew the structure of the working organization better than I did.
I began calling various internal departments. My line was, “I’m with Engineering. Does your group use SAS?” After half a dozen calls, I found a guy in an office in Pasadena who knew what I was talking about.
For most people, I guess, the toughest part of a ruse like this would be figuring out a way to get hold of the desired knowledge. I wanted to know how to gain access to SAS, as well as the commands that would let me take control of it. But I wanted to go about it in a safer way than Eric and Kevin Poulsen had done; I wanted to do it without having to physically enter a Pacific Bell facility.
I asked the guy in Pasadena who knew about SAS to pull a copy of the manual off the shelf for me. When he came back on the line with it, I asked him to open it up and read me the copyright notice.
The copyright notice?
Sure—that gave me the name of the company that had developed the product. But from there, I hit a snag. The company had gone out of business.
The LexisNexis database maintains massive online files of old newspaper