Science Fiction & Fantasy Stack Exchange is a question and answer site for science fiction and fantasy enthusiasts. It only takes a minute to sign up.
Sign up to join this community
His setup seems to be a telephone connected to a computer. When he dials another computer on the phone, he manages to gain access to it remotely.
Is this a realistic situation or just something done for effect?
This video shows the technique but not the actual access being gained, as it is with the school's computer beforehand.
The video clip shows what is referred to as "war-dialing" a term which was in fact coined from the name of this movie. The "hacking" implied here is that the phone number for the victim computer's modem is not publicly known, but by scanning a range of numbers, dialing one by one, a "secret" modem can still be located. Guessing username and password is the next step. In the movie, David Lightman has figured out where the school administration writes down the password, which was a quite realistic scenario back then.
But is the "telephone connected to a computer" setup a movie prop? Not at all! This was actually how modems for personal computers looked back then. A so-called "acoustically coupled modem" meant that you took your landline phone's handle and attached it to a mic and speaker as shown below, so your computer could do the talking. The same technology was also used in a less realistic fashion in the TV show VR5.
It's for real, we're not making this up!
I corrected one posting in a comment "You basically had to dial the number for your ISP." is of course wrong - direct dialin predated ISPs. A bit of lengthy personal history below about the credibility of this kind of attack for the times.
I was a VAX/VMS sysadmin for a mining company from about 1986 to 1989 and I had one direct dialin line which was a publicly accessible phone number - if anyone had guessed the number they would have been able to get a login prompt.
However, VMS was a very secure operating system, so the line was configured with a number of security features, from memory:
"War-dialing" was a big deal and the trade magazines were full of tales of people finding that their company had exposed entire banks of phone lines with access to the computer. Whilst VMS could be secured very easily, there was also a time when it shipped with a "system" account with a default password and, even worse, the equally privileged "field"/"service" account which some technicians left enabled. So, finding a phone line that would answer was potentially a big deal in getting access to all kinds of systems.
We also had chains of bulletin-board connections where messages went via a store-and-forward system that could take days to forward messages, depending on volume and how often some people in the chain connected their computer to the next nodes.
If you're interested in hacking tales from that time, check out Clifford Stoll's "The Cuckoo's Egg" about how an astronomer turned sysadmin found an international hacker.
update
I forgot that I caught our commercial programmer allowing his girlfriend to login through the dialup port. He had sysadmin access and had created a program for her to run a home business generating labels. He didn't know enough to hide the activity by disabling logging on the port. That's my most exciting real hacking story in my entire career.
He didn't - the hack was the password research.
Since all internet connectivity happened over phone lines at that time, he used his phone to establish a connection. You basically had to dial the number for your ISP.
Not quite true. Before the internet, a lot of people connected directly, computer to computer. You had a modem (or a bank of them) sat waiting for an incoming call from another modem.
To connect to a remote computer, you had to know the number, then a username and password. The first bulletin boards operated this way, and did not need a password, You just dialled in, downloaded all the new posts and disconnected. You could then read and write replies before connecting again to upload them.
The trick was not in the act of merely connecting to a remote system (a wardialer is not a hack - it's a brute-force tool) but rather in figuring out what the account passwords were. For NORAD, he researched who the system designer was and guessed that his password was his dead son's name. For the school passwords, he looked underneath a desk blotter in the school office when no one was looking, as I recall.
