AOHell
 | This article needs additional citations for verification. (November 2008) |
 | |
| Developer(s) | Da Chronic, Rizzer, The Squirrel |
|---|---|
| Initial release | 1994 |
| Final release | 3.0 beta 5
|
| Operating system | Windows |
| Available in | English |
| Type | hacking, script kiddy |
AOHell was a Windows application that was used to simplify 'cracking' (computer hacking) using AOL. The program contained a very early use of the term phishing. It was created by a teenager under the pseudonym Da Chronic, whose expressed motivation was anger that child abuse took place on AOL without being curtailed by AOL administrators.
History
[edit]AOHell was the first of what would become thousands of programs designed for hackers created for use with AOL. In 1994, seventeen year old hacker Koceilah Rekouche, from Pittsburgh, PA, known online as "Da Chronic",[1][2] used Visual Basic to create a toolkit that provided: a new DLL for the AOL client, a credit card number generator, email bomber, IM bomber, Punter, and a basic set of instructions.[3] It was billed as, "An all-in-one nice convenient way to break federal fraud law, violate interstate trade regulations, and rack up a couple of good ol' telecommunications infractions in one fell swoop". When the program was loaded, it would play a short clip from Dr. Dre's 1993 song "Nuthin but a G Thang".
Most notably, the program included a function for stealing the passwords of America Online users and, according to its creator, contains the first recorded mention of the term "phishing".[4] AOHell provided a number of other utilities which ran on top of the America Online client software. Though most of these utilities simply manipulated the AOL interface, some were powerful enough to let almost any curious party anonymously cause havoc on AOL. The first version of the program was released in 1994 by hackers known as Da Chronic, The Rizzer, and The Squirrel.
Features
[edit]- A fake account generator which would generate a new, fully functional AOL account for the user that lasted for about a month. This generator worked by exploiting the algorithm used by credit card companies known as the Luhn algorithm to dynamically generate apparently legitimate credit card numbers. The account would not be disabled until AOL first billed it (and discovered that the credit card was invalid). The generator could also generate fake addresses and phone numbers, resembling on their surface legitimate personal information. One example of a fake account generator was a Macintosh One-click based piece of software called Fake Maker written by a user known as McDawgg within the AOL Macwarez community. This software ran in parallel with the AOL program to create fake accounts based upon generated legitimate credit card account numbers. This software ultimately released three versions and helped to create thousands of fake accounts before AOL weakened its ability through more expedient account verification.
- Phishing tools. The program included a "fisher" tool in 1995[5] that enabled hackers to steal passwords and credit card information through automated social engineering. The program would barrage random AOL users with instant messages like:
Hi, this is AOL Customer Service. We're running a security check and need to verify your account. Please enter your username and password to continue.
- A punter (IM-bomber), which would send malicious Instant Message(s) to another user that would sign them off.
- A mail bomb script which would rapidly send e-mails to a user's inbox until it was full.
- A flooding script that would flood a chat room with ASCII art of an offensive nature, such as the finger or a toilet.
- An 'artificial intelligence bot', which did not really contain artificial intelligence, but had the ability to automatically respond to a message in a chatroom upon identification of keywords. (For example, a 'profane language' autoresponse was built into the program.)
- An IM manager, which provided facilities to automatically respond to or block IMs from certain users.
- A Steve Case cloak, which allowed users to pose as AOL founder Steve Case in chat rooms.
Motives and legacy
[edit]The existence of AOHell and similar software even allowed AOL to develop its own warez community. Lurking in secret chat rooms with names such as 'AirZeraw', mm, cerver, 'wArEzXXX', g00dz, 'punter', 'gif', 'coldice', 'GRiP', and 'trade', AOHell created bots, often referred to as 'servers', which would send out a list of warez (illegally copied software) contained in their mailbox.[6] Simply messaging the bot with the titles of the desired software packaging would result in those packages being forwarded to one's mailbox. Since the data merely had to be copied into another user's mailbox (while still residing on an AOL server), the piracy was only limited by how fast messages could be forwarded, with AOL paying for all the cost of the bandwidth. One additional limitation included an allotted number of email messages which could be sent per day by a particular user account. Botters were able to circumvent this limitation by signing up for a white-list account which was subjected to an unknown probationary period where AOL administrators monitored the account.
The existence of software like AOHell provided a parallel 'lite' version of the hacker underground that had existed for years before, based around bulletin board systems. Programs like AOHell played an important part in defining the 'script kiddie', a user who performs basic cracking using simple tools written by others, with little understanding of what they are doing. These types of programs had a tendency to have AOL accounts banned; and so most users were logged on to accounts they had acquired illicitly, either by phishing or a fake account generator.
In the manual, the creator of AOHell claims that he created the program because the AOL administrators would frequently shut down hacker and warez chatrooms for violation of AOL's terms of service while refusing to shut down the pedophilia chat rooms which regularly traded child pornography.[7] "Da Chronic" claimed that when he confronted AOL's TOSAdvisor about it, he was met with an account deletion:
AOL constantly closed the "Hackers" Member room, but refuses to do anything about all the pedophilia rooms. I once IMed TOSAdvisor and asked him why he closes the Hacker room, but does not close the kiddie porn rooms. He did not reply, instead he cancelled my account. I guess we see where AOL's priorities lie.
He also stated that his goal was:
[To have] 20,000+ idiots using AOHell to knock people offline, steal passwords and credit card information, and to basically annoy the hell out of everyone.
The program was last compatible with AOL version 2.5.
References
[edit]- ^ Garfinkel, Simson L. (1995-07-01). "AOHell". Wired. ISSN 1059-1028. Retrieved 2019-11-01.
- ^ Stonebraker, Steve (January 2022). "AOL Underground". aolunderground.com (Podcast). Anchor.fm.
- ^ Garfinkel, Simson (1995-04-21). "Illegal program troubles America Online" (PDF). The Boston Globe. Retrieved 2022-05-31.
- ^ Rekouche, Koceilah (2011). "Early Phishing". arXiv:1106.4692 [cs.CR].
- ^ Langberg, Mike (September 8, 1995). "AOL Acts to Thwart Hackers". San Jose Mercury News.
- ^ Armnet, Marco (2014-04-19). "Flashback to 1995: AOL Proggies". Retrieved 2016-01-31.
- ^ "AOHell Documentation". Da Chronic. Retrieved 2016-01-31.
Further reading
[edit]- Simson L. Garfinkel (1995-04-21). "AOHell". The Boston Globe. (scan)
- Wallace Wang (2003-01-01). "AOHell". Steal This Computer Book 3. No Starch Press. p. 297. ISBN 1-59327-000-3.