📸

the sales and invoicing systems for a number of large computer companies and equipment wholesalers. The system they had worked out was surprisingly simple. First they would create dummy corporations by hacking into a credit agency, listing their company on the register and giving it a ‘triple-A’ credit rating – the highest.³ Then they would hack into a supplier and create a real paper trail: they would tie into the sales department and cut an order, jump to the accounts department and ‘pay’ the invoice, then skip over to shipping and write out a delivery manifest. The delivery address would be a mail drop – the address of an answering service, say – which would also receive all documentation from the target company. From the supplier’s point of view the paper trail was complete: they had an order, a paid invoice and a delivery manifest. The paperwork made sense. If they checked they would find the buyers had a triple-A credit rating. The company didn’t, of course, have the money to cover the equipment it had just delivered, but that wouldn’t be discovered until the company tried to balance its books.

The supplies that Captain Zap and his friends ordered included portable terminals, a Hewlett Packard computer, peripherals, cameras, walkie-talkies and other supplies. Pat can’t remember all the stuff now. According to the authorities, who kept better track of the scam, the total amount of goods taken amounted to $500,000.

Pat insists that hacking into the supplier’s computers was simple: ‘There was no security,’ he says. Using guesswork and defaults they could prise their way past the log-in and password prompts. For more recalcitrant computers they rigged up an adapted ‘war dialling’ system that would keep pounding at the door with one ID and password combination after the other until they got in. Even if a computer operator has assiduously removed default codes, there are still common combinations that people use over and over. There are said to be just a few of these combinations – like name and surname, or company name and department – that, in a large system, someone will use. Knowing the names of employees and where they work greatly speeds up the process of hacking. People pick simple combinations for an obvious reason: they need to remember them. Choosing something completely off-the-wall increases the chance of forgetting.

📸