His setup seems to be a telephone connected to a computer. When he dials another computer on the phone, he manages to gain access to it remotely.

The computer/phone setup

Is this a realistic situation or just something done for effect?

This video shows the technique but not the actual access being gained, as it is with the school's computer beforehand.

  • 75
    I'm assuming you're about 20? Anyone who used the Internet in the 90s (or earlier) had to use a modem. Before DSL and cable Internet, phone lines were the only way to connect to another computer from your home.
    – Plutor
    Commented Sep 1, 2014 at 11:07
  • 10
    John Draper en.wikipedia.org/wiki/John_Draper (A.K.A. Cap'n Crunch) figure out that Using a whistle from a cereal box he could drunk phones (also known as Phone Phreaking) and make free phone calls to anywhere in the world. Even the trick where David uses a soda-pop tab to make a free phone call used to work. As well as the Red Box, which imitated the sound of coins being dispensed worked up until around 1999, until Ma-bell/Bell Atlantic merged with GTE and became Verizon. So the answer is YES, it's possible to hack via "Dial-up" back then.
    – user31868
    Commented Sep 1, 2014 at 13:20
  • 12
    @AquaAlex (pedantry warning) There was an internet, and you connected to it. You didn't have the World Wide Web. Commented Sep 1, 2014 at 13:28
  • 6
    @JoshuaTaylor and before the amazing UseNet we were stuck with BBS (Bulletin board systems) and we had super fast speeds of 2400 bps. I can not explain how amazingly fast access became when we moved to 28.8k and later 56k modems OH MY WHAT SPEED! ;-)
    – AquaAlex
    Commented Sep 1, 2014 at 14:05
  • 21
    Oh my goodness. I can't believe using phonelines to connect to the internet has already been forgotten. I'm only 19 and I still remember it.
    – apnorton
    Commented Sep 2, 2014 at 2:16

4 Answers 4


The video clip shows what is referred to as "war-dialing" a term which was in fact coined from the name of this movie. The "hacking" implied here is that the phone number for the victim computer's modem is not publicly known, but by scanning a range of numbers, dialing one by one, a "secret" modem can still be located. Guessing username and password is the next step. In the movie, David Lightman has figured out where the school administration writes down the password, which was a quite realistic scenario back then.

But is the "telephone connected to a computer" setup a movie prop? Not at all! This was actually how modems for personal computers looked back then. A so-called "acoustically coupled modem" meant that you took your landline phone's handle and attached it to a mic and speaker as shown below, so your computer could do the talking. The same technology was also used in a less realistic fashion in the TV show VR5.

enter image description here

It's for real, we're not making this up!

  • 84
    "David Lightman has figured out where the school administration writes down the password, which was a quite realistic scenario back then." Back then? You're so optimistic. Commented Sep 1, 2014 at 9:21
  • 12
    The answer provides good technical insight, but misses some other aspects of the question: after connecting to the systems, David gets access by social engineering attack. In the case of the school, because someone (I think the principal's secretary) held a list of the passwords in an unsafe (although difficult to find) location. In the case of the DoD computer, it gave enough information about itself at login that David was able to guess which password the createor would have used. If you add those points, it would fully explain the OP.
    – SJuan76
    Commented Sep 1, 2014 at 13:34
  • 3
    And "War Driving" comes of course from this original "War Dialing" activity of major fun. It just went mobile. Juniors interested in learning how hacks were made back then should grab a copy of Clifford Stoll's "Stalking the Wiley Hacker" or maybe even his book-length version "The Cuckoo's Egg". Good times. Commented Sep 1, 2014 at 15:57
  • 4
    Back in college (late-70's, thanks - the Good Old Days when computers were water-cooled, IBM was the abode of the gods, and Led Zeppelin was still together. Ah, great days - GREAT days... :-) one of my profs explained to us how data exchanged over phone lines would NEVER exceed 300 baud. Couldn't be done! I've always wondered what happened to that guy... Commented Sep 2, 2014 at 16:52
  • 6
    It might be worth mentioning that the reason for having an acoustic coupler rather than a direct electrical connection at the time was due to AT&T being very picky on what devices they allowed to connect to "their" network...
    – thkala
    Commented Sep 3, 2014 at 0:17

I corrected one posting in a comment "You basically had to dial the number for your ISP." is of course wrong - direct dialin predated ISPs. A bit of lengthy personal history below about the credibility of this kind of attack for the times.

I was a VAX/VMS sysadmin for a mining company from about 1986 to 1989 and I had one direct dialin line which was a publicly accessible phone number - if anyone had guessed the number they would have been able to get a login prompt.

However, VMS was a very secure operating system, so the line was configured with a number of security features, from memory:

  1. Only a very small number of password attempts were allowed, with the line being locked out for a random period if they were exceeded.
  2. Any login failure resulted in immediate printed alert on the secure paper console in the computer room, my screen if I was logged in and an email to me (yes there was email back in those days).
  3. Terminal sessions through the dial-in line were logged so all incoming keystrokes were recorded.

"War-dialing" was a big deal and the trade magazines were full of tales of people finding that their company had exposed entire banks of phone lines with access to the computer. Whilst VMS could be secured very easily, there was also a time when it shipped with a "system" account with a default password and, even worse, the equally privileged "field"/"service" account which some technicians left enabled. So, finding a phone line that would answer was potentially a big deal in getting access to all kinds of systems.

We also had chains of bulletin-board connections where messages went via a store-and-forward system that could take days to forward messages, depending on volume and how often some people in the chain connected their computer to the next nodes.

If you're interested in hacking tales from that time, check out Clifford Stoll's "The Cuckoo's Egg" about how an astronomer turned sysadmin found an international hacker.


I forgot that I caught our commercial programmer allowing his girlfriend to login through the dialup port. He had sysadmin access and had created a program for her to run a home business generating labels. He didn't know enough to hide the activity by disabling logging on the port. That's my most exciting real hacking story in my entire career.

  • 10
    +1 for mentioning The Cuckoo's Egg - I read it like 20 years ago and never were able to find it again until you mentioned it here :-)
    – Martin
    Commented Sep 2, 2014 at 12:39
  • 1
    A certain irony in writing an answer about locking lines out after N password failures the day before I hear about the iCloud breakin to steal all those celebrity photos. It has been well-established now that the hack was via a flaw in Apple's "Find my Phone" service allowing unlimited password attempts.
    – Andy Dent
    Commented Sep 2, 2014 at 12:57
  • Ah yes, the field service account, password 'raster'.
    – user11521
    Commented Sep 3, 2014 at 0:25
  • For most of the years I was a sysadmin, the default account was "field", the password "service" and I once lodged an official complaint about an engineer I caught who deliberately re-enabled the account to "save him time on the next visit". It took a couple of versions for VMS to institute a one-time rule on these two accounts so the password was forcibly reset. In the meantime, Vaxes became desktop machines found as glorified PCs so even more users had terrifying defaults.
    – Andy Dent
    Commented Sep 3, 2014 at 5:03
  • 2
    @BenJackson - Same here. I started out on a Commodore Vic-20 and progressed up. I still work in the industry, and in the late 90's was working on a hospital system as an outside contractor. Their root password for the entire system was <enter>. Not the word, but just...hit...enter...
    – JohnP
    Commented Sep 4, 2014 at 17:51

He didn't - the hack was the password research.

Since all internet connectivity happened over phone lines at that time, he used his phone to establish a connection. You basically had to dial the number for your ISP.

Not quite true. Before the internet, a lot of people connected directly, computer to computer. You had a modem (or a bank of them) sat waiting for an incoming call from another modem.

To connect to a remote computer, you had to know the number, then a username and password. The first bulletin boards operated this way, and did not need a password, You just dialled in, downloaded all the new posts and disconnected. You could then read and write replies before connecting again to upload them.


The trick was not in the act of merely connecting to a remote system (a wardialer is not a hack - it's a brute-force tool) but rather in figuring out what the account passwords were. For NORAD, he researched who the system designer was and guessed that his password was his dead son's name. For the school passwords, he looked underneath a desk blotter in the school office when no one was looking, as I recall.


Not the answer you're looking for? Browse other questions tagged or ask your own question.