+ORC revealed the best of Zen stalking	+ORC's stuff
20 January 1999	by aZh nAZg
	Courtesy of Fravia's page of reverse engineering
Well: helluya of a work! Even if aZh nAZg'style seems to me a little too convoluted (I hope he'll 'polish' a little this and detail better, for instance, his stalking on the archies), there's quite a lot to learn in here. This said I actually don't believe (personally) that aZh nAZg's assumptions are correct. Yes: "the trail (is) already long cold and well trampled", as aZh nAZg writes, yet I remember months of passionate stalking (with the Basilisk, +gthorne and Hackmore+Readrite) where we definitely came to the conclusion that +ORC is dutch. Not German, not Swede: dutch. And the fact that a very well known Amiga cracker of the eighties had as a Nickname 'ORC' gave us much to think (but we found few 'beef' on the Web, unfortunately). Since +ORC is no more in contact with anyone of us, unfortunately, there's no way we can finish our stalking (I remember that when he wrote +gthorne that he was in Cairo (Egypt) for his hyerogliphical cracking, more than one year ago, I mobilized two egyptian crackers, who went in the CairoMuseum's bar asking if some funny european fellow had ordered considerable amounts of wodka-martini's... only to find out that no alcohol is served there :-( Yes, +ORC does not publish any more his 'how to crack' masterpieces... yet he can still be useful for all reversers as stalking quarry :-) I hope, in publishing this essay to open the way for some other good stalkers that want to improve their skills joining aZh nAZg in this fascinating stalking endeavour (a very difficult one now that the trial is cold). Good luck. aZh nAZg's Nosferatu stalking is an impressive work of art and some of the evidences are quite heavy. Still I don't believe that +ORC is aZh nAZg's Swede: but this good swiss stalker may be right with the Idea that the tutorial has been translated from Cezch: my personal alternative theory is that +ORC is the Petr Horαk that wrote in Prag (in 1982!) the beautiful utility KGB that you can download on my tools page... Horαk sounds a little like +ORC, see, and wasn't +ORC himself that wrote that nomen est omen? :-)
	There is a crack, a crack in everything That's how the light gets in
Rating	(*)Beginner ( )Intermediate ( )Advanced ( )Expert

Who is/was +ORC? A fine problem; perfect for a weeks contemplation. The Basilisk and others have already done fine work on bringing the issue to resolution. I soon realized that I was approaching a chase where the trail was already long cold and well trampled. Many brilliant stalkers had already tried all of the obvious approaches; there was however, some comfort to be had in that, as that very fact suggested that +ORC was either being *very* clever, or *very* candid.

While in regular stalking the trick is to have a good dictionary of synonyms to feed into the search engines, the trick with Zen stalking is to have an open mind ('zen mind'), untiring doggedness, and above all, to 'psych' oneself into the mindset of one's quarry.

OK, so, mindset of quarry, now let's see...what do we know about him? The Lessons (read and re-read them all several times, getting a feel for the language used), the Riddle itself, the URL and what it points to, +ORC's mention of it leading to a 'dead' page...

Ok, Riddle: the language used is heraldic, duh. The quote is from, well you know already, duh. Some lines are different than the original; there's numeric symbology used, could be something about shifting bits, adding, replacing numbers in the URL, after all, he was an assembly coder...

...nope, he'd be *zen!* too lazy to do that for real. He'd want us to *think* we should do that -- mount an exhaustive search of the Web -- and sit there revelling that he got all dem lamers up off their butts and doing something useful. But he's got a great sense of humor, so mebbe the heraldic stuff is still a clue, jest a diff sort of clue. Save it for lata...

The URL, of course leads into .mil territory, as trcroute will reveal (actually it winds up bouncing between two DNSs in .mil until it dies out). But as we already know, someone has visited fravia using that URL as their (spoofed) IP address, so we know that it's someone's calling card. How hard is it to do that? Not very, I could write the code from scratch in an hour or so.

So, how about the reference to the 'dead' page? Well, the obvious thought is that what that means is a page that's no longer being maintained. I would imagine that many folks have already searched all available engines for a +ORC directory, with mixed results (did you find the Electric Company, in Minsk?). But, I hand you +ORC's *own words*: (Lesson 2: '...for those of you that do not know anything, here is the ARCHIE way you get all the program that do EXIST on the planet:...'). My favorite one is the one in Oldenburg, Germany (-oldenburg.de/Docs/net-serv/archie-gate.html). Let's see...orc.htm...there it is: www.sics.se/sicskatalog/orc/orc.htm, and hey! orc.gif as well. Let's see who this is...

Ok, its Lars-Hakan Loenn ... and what's this, his nickname? 'Orc' ... well, well ... what does he do...search, search...a hah! He was a student at SU (university of Sweden) in 93, and in 94, and...hmm, not in 95...where was he in 95...search, search...a Hah! He's at CalTech, in the Swedish Club. And he didn't graduate...so he was an exchange student ... search, search ... he's into RPG (role playing games), specifically Gothic ... search, search ... while at CalTech lists his home server as nosferatu.sics.se ... search, search ... lot's of references to Gothic RPG. Save that for later...

Ok, orc.htm -- view source -- nothing interesting here. Spider sics.se ... search, search ... ok: Swedish Institute of Computer Science ... phone number, building name, a Hah! group name ... search, search ... here it is: his name on several of SICS's web pages as 'Grafik: Loenn'. He's a webmaster. He likes graphics. He might think heraldry is kewl, gothic and all that. Hmm.

Search, search ... a hah! He's does marathon runs: 3000m and 5000m, aka OL, which pardon my german means Orientierungs Lauf or some such, just as though he were in the militia at the time ... c.f. 'possibly once in the military' reference (forget where, duh). Ok, so he knows about encryption, and that .mil servers are off limits. Hmm.

Ok, dejanews da sucka ... advanced search, 1 Dec 95 thru 1 Jun 96 author +ORC ... whaz dis? 16 Feb 96 : 'see if it works' by +ORC posted to alt.test ... see if *what* works? ... where else doth he post? Ok, alt.hacker.malicious, makes sense, but, what's this: de.org.ccc? whazzat? Ok, hmm, they're talking about Germany's PTT trying to regulate Inet access. Why Germany? He's Swedish ... hmm, mebbe he wants to go work in Germany when he's done with school. Means he must speak fluent German, at the very least ... his English ain't lousy either ... could have a Dutch parent or spend time there on vacation or mebbe grew up there ... when's the first Lesson? 20 Feb 96 thru 25 Jun 96 ... and what's this? he keeps on re-posting stuff - wierd! (tell ye why in a moment, hehe)

Now, dear reader, for some major Zen. Forgive me while I quote verbatim a rather lengthy chunk of news thread. You will benefit from reading it in its entirety b4 getting to my commentary (and of course you can check it out for yourself on dejanews): Posted 18 Feb 96 in response to a post 15 Feb 96 in alt.hacker.malicious et al:

Now, I speak fluent English, German and French, and can read pages written in Dutch, Swedish, Italian, Spanish and pig latin ( comes from having been in prep in Switzerland; veni vidi vici et al). Those Lessons read like a translation to English from (possibly) German, or even maybe Czech. My guess is, +ORC found the Lessons on fido, or in eastern europe, and translated them, or mebbe got them via CalTech while he was studying there. I did a quick scan of all threads in alt.hacker.malicious during the end of 95 and early 96, to see who if any stopped posting once +ORC started. There are several; take your pick. It t'ain't Destrukto cuz Destrukto still operates a site today as Destrukto. Noone on aol.com's a good bet, c.f. 'The Analyst' s comments above :). Btw, nfo.org is 'National Farmers Organisation", hehe.

Assuming this zen reasoning is correct (and i have no good reason to doubt my own intuition, hehe), we will probably *never* find out who authored the Lessons, unless we can find them somewhere with file dates prior to Feb 96. But I have great hopes of finding +ORC himself. For I know, he's into Gothic, and Graphics. Search, search ... here it is:

Nosferatu himself: http://www.geocities.com/TimesSquare/Stadium/9490. In his email he speaks of further riddles, so let's see. We know they won't be 'leet, or on par with the Lessons (was he too lazy to answer, or just didn't know?), so they shouldn't be too hard to crack ... :)

Ok, on index.htm:
- '...and sword-shaped toothpicks from a dry martini...'
- 'Last, and most importantly for the purposes of this site: The nosferatu are potent information- gatherers, managing to gain access to just about everything.'
- 'all is not as it appears'
Sounds like the +ORC we know and love, no? Hmm. Here, the page owner is soliciting help from ne1 who knows some javascript. Guess +ORC decided to 'help' out a bit, no? And put some Orc-isms in while he was at it.

Did you find the 'secret' door yet? I knew you would :). Here is the passage: 'So, you think your a good nosferatu just because you found the secret 'door'... Anyone with half a brain could have figured that out. OK, so you're bright enough to know that not everything is as it appears. Good for you.'
That 'good for you' is straight out of the Lessons, is it not? Which it would be if +ORC had translated them, for they would then be in his idiom of choice. Things are still making sense. Ooooh! Heres a Login script! Oh no! It's booby trapped! Re:

"Also for reference, this is impossible for mortals to hack. If they do successfully hack it, the site shuts down for a week and changes are made to prevent it from happening again. Also, it will mess with their computer so much that they couldn't hack it again if they wanted to. It uploads a virus to any computer that attempts to access it. The virus allows complete access to all files on that persons computer. It downloads all of their files to the creator of the site, right before it deletes al of them and even destroys their hardware. Only registered nosferatu have the anti-virus program. It is highly unlikely that anyone could program an adequate anti-virus program becaus hidden with the first virus (if it is disabled) then a second virus will activate and just erase all of their files (starting with their anti-virus). The masquerade is perfectly protected."

I'm sooo scared. Let's look at that script...

now, i don't feel *too* bad, cuz fravia dunno howto quote script either :)...

>!--
thispage="verify2.htm"
if (getcookie("lastvisit")!=null)
	{  user=username+"#"+accesslevel+"$"+numsub
	setcookie(user)
	document.clear()
	document.writeln("\>H1\<User verification\>/H1\<")
	document.writeln("You must log in with a registered username and password")
	document.writeln(">FORM NAME='myform'<")
	document.writeln("Username: >INPUT TYPE=TEXT SIZE=20 
                          NAME='username'<>BR<")
	document.writeln("Password: >INPUT TYPE=PASSWORD SIZE=20
			  NAME='password'<>BR<>input type=hidden 
			  name='access' size=3 value='"+accesslevel+"'<>input 
                          type=hidden name=num size=3 value='"+numsub+"'<")
	document.writeln(">br<>br<>INPUT TYPE='BUTTON'
			  VALUE='Submit' onClick=authorize()<>INPUT TYPE='reset'
			  VALUE='Clear'<>input type=button value='Delete Access Account'
			  onclick=deletecookie('lastvisit')<>/form<>p<")
	document.writeln(">a href='apply.htm'<Click here if you want to apply
			  for usage of the NOSNET>/a<")
	}
	else
	{
	document.clear()
	document.writeln(">H1<User verification>/H1<")
	document.writeln("You must log in with a registered username and password")
	document.writeln(">FORM NAME='myform'<")
	document.writeln("Username: >INPUT TYPE=TEXT SIZE=20 
			NAME='username'<>BR<")
	document.writeln("Password: >INPUT TYPE=PASSWORD SIZE=20
			NAME='password'<>BR<>input type=hidden name='access'
			size=3 value='#E3'<>input type=hidden name=num size=3
			value='$0'<")
	document.writeln(">br<>br<>INPUT TYPE='BUTTON' VALUE='Submit'
onClick=authorize(),setcookie(this.form.username.value+this.form.access.value+this.form.num.value)<
>INPUT TYPE='reset' VALUE='Clear'<>P<")
	document.writeln(">a href='apply.htm'<Click here if you want to apply
			for usage of the NOSNET>/a<")
	}
// -->

<!--
function setcookie(name)
{
	today=new Date()
	document.cookie="lastvisit="+escape(today)+"_"+name+";expires=01-Jan-2000"
}

function getcookie(name)
{
	var namestr = name+"="
	var namelen = namestr.length
	var cooklen = document.cookie.length
	var i=0
	while (i>cooklen)
		{var j=i+namelen
			if (document.cookie.substring(i,j)==namestr)
			{ endstr = document.cookie.indexOf (";",j)
		if (endstr==-1) {endstr=document.cookie.length}
			tempstr = unescape(document.cookie.substring(j,endstr))
			username = tempstr.substring(tempstr.indexOf("_")+1,
					   tempstr.indexOf("#")) 
			accesslevel=tempstr.substring(tempstr.indexOf("#")+1,
					    tempstr.indexOf("$")) 
			numsub = tempstr.substring(tempstr.indexOf("$")+1,tempstr.length)
			numsub = eval(numsub)
	
			return tempstr
			}
		i=document.cookie.indexOf(" ",i)+1
		if (i==0) break
		}
	return null
}

function deletecookie(name)
{
	var expdate=new Date()
	expdate.setTime (expdate.getTime()-1000000000)
	document.cookie=name+"="+getcookie(name)+";expires="+expdate.toGMTString()
	location="verify2.htm"
}

function steller(form) {
     location="steller.htm"
}

function surfto(form) {
     ident=document.forms[0].username.value
     location="agent.htm?user="+ident+"";
 }

function sysadmin(form) {

        location="admin.htm";
        
}

function authorize() {

if (document.myform.username.value == 'Thomas Hastings' &&
document.myform.password.value == "0000000000") {
        
        sysadmin(this.form)
        return true
        }
        
if (document.myform.username.value == 'Malthus' &&
document.myform.password.value == '8478691725') {
        
        surfto(this.form)
        return true
        }
        
if (document.myform.username.value == '`Spider' && 
document.myform.password.value == '209.42.128.3') {
        surfto(this.form)
        return true
        }

if (document.myform.username.value == 'ACE' && 
document.myform.password.value == '****'){

	sysadmin(this.form)
	return true
	}

if (document.myform.username.value == 'Luto' &&
document.myform.password.value == '7733271036') {
        
        surfto(this.form)
        return true
        }

if (document.myform.username.value == 'Miette' &&
document.myform.password.value == '7734041868') {
        
        surfto(this.form)
        return true
        }
        

        alert('Your username or password is incorrect. Access denied.')

        return true
        }
--<

Paranoia sets in. What if +ORC really *is* an elite cracker? What if that page is merely a smokescreen, and there are other pages hidden on that site? What if i'm wrong? Go figure :-)

homepage links search_forms +ORC how to protect academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_fravia+
Is reverse engineering legal?