AOL: The Rise and Fall of the First Internet Empire (2017)

TL;DR:

  • Did dumb teenager/nerd rage things.
  • Released one of the first "1 IM Punters" on AOL.
  • Sent out some old school (non 1IM) email punters to a "hacker's" phished accounts I had beef with letting them also know they were compromised. *Before that, emailed the source code I stole for their "super protected code" and the 1 IM Punter code to that "hacker" I had beef with.
  • AOL blamed me for the account theft and blacklisted my address forever.

I had gotten really into the "hacker" scene on AOL. Mostly because apart from the really terrible Planet Source Code snippets, there were many ways to learn coding online at that time.

Anyway, I did it in my early teens and in my mid teens I had sort of branched out into more advanced stuff (not hacking/%hat stuff) but I guess my last hoorah is that I created and released one of the first "1 IM Punters" which would crash their AOL before the IM would even render. I didn't have any active phished accounts anymore and didn't really care because I had been "over it" for some time but it caused my address to be blacklisted from AOL forever. According to my dad, he tried to get on AOL in 2004or 2005 or something and was still banned.

Anyway, whoever is still interested, you can read on for why I did what I did as I think it is somewhat interesting about the AOL/Internet (non-IRC/Usenet/BB/etc. of course) culture at that time.

First, there were "punters" and other sort of tools, such as automated phishers and chat log forging (I mean it was just plain text, so no big deal) with auto ban submission (TOSsers - to try to get a Community Action person to ban the target account. Worked well with multiple submissions from multiple accounts, so there were a couple of "Net"TOSser that would all submit the same forged logs at the same time to the AOL CAT (Community Action Team)).

By far though, the common "Punters" that simply freezes AOL for eternity, until the user force close's the application, the dial-up connection timed out which happened for people with bad connections (not really slow ones but ones that were consistently slow on latency relative to that time) or until the AOL client runs out of memory and crashes, which would take a lot of time. These could be sent over IM or emailed out to targets. How did these work? Simply use HTML font and bgcolor tags with different colors over and over. You could send at least 255 characters per IM and much more over email and yes, you could tag them right after the other with no linebreak and the AOL rendering engine would parse and execute them in order.

Remember I said one of the first 1 IM Punters? Well, it was specifically the second one released. Why? "Celtix" was the handle of the author that released the first thing. Now understand that Visual Basic (VB) 4.x - 6.x was very popular. Most of us were teenage kids and OOP was just starting to catch on widely.

Celtix didn't release the 1 IM Punter publically until they (there was a rumor that it was a "she" so I don't know the gender) made a "Disassembly Shield" because Dodi's "VB Disassembler" was really popular in the color because you could basically steal source code and libraries from other people using VB.

So Celtrix releases this new Punter and it included the "Disassembler Shield" which did defeat the available ones out at the time. They'd crash. Few people knew the 'secret' of this magical crash that would crash the client before the target would even see it, before the client could log it and before any third party "IM Blockers" could work.

At that time I wasn't really into that culture but I was really curious about how it was done. So I went to my old grounds, used my old contacts and finally was able to track down Celtix! And so I asked if they could let me have some sort of hint but also I was really curious about the "Shield" too.

Celtix was a major asshole. I mean I didn't go in just bugging them or anything. I tried to establish some rapport and so on and this meeting was set-up, so Celtix knew what I was after and accepted it. But Celtix took this time to make fun of me, gloat, and lord over me. But I took it and tried to gain some hint, even if not the answer to my curiosities.

Celtix' insults kept coming...so finally I was pissed. Celtix even ended it right when I was going to defend myself...over a lame private chatroom. They crashed me.

I'm fuming. Please understand I was also a teen still. Not even almost a young adult yet. I think I only had a Learner's Permit for driving at the time, maybe even before that.

So I opened up my Hex Editor (Hex Workshop 2.5 I think it was) and went over Celtix' program. And I had looked through a lot of Hex by then and knew what I was looking for. But I didn't get too far. I found something odd. Something was wrong with the very beginning of the program. Something was odd but I didn't know what....then it hit me. Celtix indeed used VB, which was obvious but the VB runtime DLL was always in capital letters. It was all lowercase, including the runtime title. What? I've never seen that...so I put the proper case back.

Boom. Disassembler didn't crash. Wow. So I emailed Celtix their own Disassembler Shield code and 1 IM Punter code. Hell yeah! I didn't release Celtix' code. Nope. I copied the technics.

So what was the 1 IM Punter's 'secret'? It used the HTML tag to set the font size to '9999999999'.

Wat.

That was it. So I released my own version of the Disassembler Shield that did some different things to exploit the popular disassemblers and did (what I thought) was a slightly better job. Turns out it would generally crash my programs as well, so I scrapped that. I released the second 1 IM Punter to the "public" and for good measure?

Released the 'secret' to the community. Just like that. In all the hide away private chatrooms and to my contacts.

I sent those old style freezing punter emails to all of Celtix' phished accounts that I knew of saying that they were stolen. Yeah because that's smart right? One of those accounts reported me to AOL and I was blacklisted from service because I was hacking (they assumed I stole those accounts and also the whole freezing up and such in the emails was also considered a hacking violation to AOL).

And that's my story of releasing one of the first 1 IM Punters and getting blacklisted from AOL.

/r/Documentaries Thread Parent Link - youtube.com