Remembering hacking tools from past generations

If you’re an old-school hacker like me, then at some point, you’ve asked yourself, what happened to all the cool hacking tools?

As the hacking landscape and cybersecurity landscape has evolved, so have security protocols and new tools programmed by masterminds to defeat them. What I present to you isn’t conclusive. However, I hope to trigger your nostalgia.

For some of you, this will be a trip down memory lane. If that’s the case, then you’re as old as I am.

The glory days of the 90s

This is where all the fun began for me. I was 14 years old, and trying to learn as much as I could, from sites like hackers.com. These were days when hacking was more straightforward than it is today, and it was easier in the years before the late 90s.

That’s because there were fewer hackers than today, and personal computers were pretty expensive, so fewer people owned a PC than today, which translates to less network noise.

We were still in the process of exploring the boundaries of technology, our curious minds urging us to see what was out there. Every computer system and network device was like a microcosm to a much larger universe within the World Wide Web, and we were figuring out how to maneuver through them all.

Winnuke

This malicious yet brilliant little program turned out to be the primary (but not exclusive) reason why I started on this hacking journey in the first place. This decision came after one day I was on the receiving end of relentless attacks while chatting on IRC.

An unknown actor nuked my PC 15 times in a row. Exasperated, and screaming my rage at the world, I threw up my hands and quit being ignorant of what was happening and decided to learn how and why this attack kept persisting.

Winnuke targeted computers running Windows 95 and NT. Basically, it was a remote denial-of-service (DoS) program that targeted the way Windows handled certain types of network traffic by exploiting a vulnerability in the NetBIOS protocol stack.

It sent a nasty little payload in the form of specially crafted out-of-band (OOB) data packets over TCP on port 139, triggering a specific sequence of actions within the NetBIOS stack, resulting in a denial-of-service (DoS) condition that forced the system to crash or freeze up with the infamous Blue Screen of Death. As a teenager in the 90s, rocking Windows 98 from a Pentium S with a 128 kbps 8000 baud dial-up modem was totally not cool.

Claymore

One of the first tools I got my hands on was a nifty Windows executable, known as Claymore, written by The Grenadier. Its purpose was simple – to brute force Windows programs, including CD keys, and product serial keys. This presented a unique opportunity for players of the popular PC game titles Starcraft and Half-Life because their weak CD keys utilized a rudimentary 13-digit algorithm anyone could bypass with a little trial and error.

Many thanks to @_Gr4yb0x aka infosecguy for finding this program surviving on the web.

The 13th digit in the algorithm validated the 12 digits entered before it, thus, giving you the flexibility to enter in any combination for the initial 12 digits, then guess the final digit, which reduced it to 10 potential options. Word got out that the sequence 123456789=1234 would let any user satisfy the key. However, if you were not aware that you could guess the CD keys, Claymore could crack it.

This was useful because software piracy (commonly called Warez) was prominent in the hacker scene in those days. Peer-to-peer sharing in mIRC coatrooms was how most of us accessed copyrighted material.

Brute forcing weakly protected software meant we could provide CD or Licensing Keys with pirated software meant anyone could download and use them, free of charge. After all, the age-old hacker adage has always been, “Information should be free.”

As long as protected software exists, so will piracy, which exists to rebel against corporate greed. However, I have always advocated, that if you pirate something that you love, support the author or developer.

Catcall

Catcall was a fun DOS-based telephony harassment program, originally coded in 1989 by a member of the famous Legion of Doom named The Marauder. What’s cool about this nifty tool is that it still worked nearly 20 years after its first release.

In 2006, I was still using dial-up, so I built a telephone cable extension, connecting the 4 colored wires in a common telephone cable and wrapping it around the house to reach the garage. This way I could have internet inside my hacker space. No, we didn’t have a basement. But I was using Catcall for all kinds of telephony mayhem.

I found a copy of the release documentation online. The system requirements suggested using IBM PC/XT/AT or any 100% compatible. It required a minimum of 64k RAM and any Hayes-compatible modem. Let’s just say the last time I used Catcall I was rocking an IBM ThinkPad with an aging Pentium processor, with Windows XP as my operating system.

Don’t be too surprised. The original release of Nmap came out in September back in 1997. We still use it to this very day.

I once drove around the city on my bicycle in the mid-2000s looking for old fortress phones (payphones) which provided a call-back number. I had over a dozen numbers, so I went home and rang all these phones off the hook consecutively for hours.

If someone picked up the phone receiver, you could hear their voice over the modem speaker. However, Catcall rang the numbers in the list of phone numbers inputted by the user, hung up, and after a specified delay, then called back.

ToneGen – free phone calls

I can only say a few words about this DOS-based Color Box tone generator, as I don’t remember too much about it, other than its simple functions. I have had this screenshot for a very long time. Color Box tone generator was coded by Chronos Master of Time, and it was very useful because it was developed during a time when phone hacking, also known as phreaking, was still relevant.

It simulated a variety of hertz tones from your modem’s speaker. If you wanted to explore the magical backdoors of telecommunication systems from a fortress phone, you armed yourself with a handheld voice recorder and recorded the tones produced by ToneGen.

For example, you could simulate a 1700 hertz tone by building a Redbox. But if soldering wasn’t your strong point, you could use programs like this which simulates the sounds made by the fortress phone when it receives coins, thus allowing you to make free phone calls.

There are so many others I could mention, but for lack of space, I cannot catalog them all, along with my memories with these tools.

Hacking tools from the new Millennium

When Windows XP arrived on the scene, hackers and techno wizards entered a new era of hacking “progz” (programs) and security auditing tools designed to explore a landscape full of new vulnerabilities, operating system tricks, and so on. Since Windows XP quickly became the industry standard, it meant that the entire world suddenly became a playground for the curious.

Cain & Abel

I’m going to assume almost everyone in-the-know, has used this at one time or another. I regularly used this famous security auditing tool from oxid.it, although I claim no mastery of it.

Developed back in 2005 by Massimiliano Montoro and Sean Babcock. It was the Swiss Army knife of password recovery for Windows systems. I could say it recovered passwords, conducted network analysis, and other security-related audits, but if you didn’t use it, then you don’t fully comprehend the scope of this powerful tool.

Cain & Abel was in my top 3 hacking tools during my remote desktop hacking campaigns in the mid-2000s. After gaining access and installing backdoor access, I ran this tool to scrub the system for cached passwords, perform network traffic sniffing, WEP cracking, and crack a large variety of hashes which included Ophcrack’s RainbowTables support for Windows NTLM hashes. This could be extracted from the SAM registry for pivoting across accounts or cryptanalysis.

Auto Submitter

I do not truly know the name of this useful underground hash-cracking IRC client, as it was disclosed to me privately around 16 years ago. I oftentimes used this to control my botnet army.

It was written by a programmer named Exidous (no relation to myself) and featured a variety of autonomous hash-cracking functions.

Once you joined the associated IRC server and channel #rainbowcrack, you could submit MD5, SHA1, and MySQL hashes to be checked and cracked by the bot, identified as c3p0 in the above screenshot.

Additionally, if my memory is correct, the IRC client was connected to Rainbowcrack, which worked in the backend simply by building and running rainbow tables for the most painstaking brute-force attack method imaginable. That’s for those who can wait 500 years to crack a hash after every possible combination has been attempted. That’s why if cracking that password hash was really important, hackers would try to break into one of those Cray supercomputers.

We could talk about Brutus. Back Orifice 2000. SubSeven. C.I.A. Mind Control. Network Stumbler. With the myriads of hacking tools out there from past to present, the important thing to take away from this is that most are here one minute and gone the next. Finding even a mention of old hacking remnants from a forgotten generation is becoming increasingly difficult.

Today, we remember how far we’ve come.