I followed a routine and never deviated from it. Ever. It worked too well to improve upon, and I never saw any reason to expand my business by working with other hackers. I never trusted other hackers and I still don't, because the majority of them were exactly the same: ambitious, talk-don't-walk, backstabbers who listened to the Wu-Tang Clan before the Wu-Tang Clan was mainstream. I avoided these people like the plague, but I never forgot to Serve. No matter what anyone says about me now, they can't say I never gave back to the cause because I always Served.
If my mom made breakfast in the morning, I took my time at the table with the kitchen TV tuned in to the Today show so I could watch Katie Couric—before she turned into a bitch—smile and bat those pretty eyelashes to the camera. On the day my mom got Phished, she was making scrambled eggs and I had managed to wake up a full twenty minutes before my alarm was set to go off: ten o'clock. After a quick check in the kitchen, I went back into my room and signed online—back then we just had a 56k modem—and searched AOL for a Server chat room.
Back then, AOL was still young, but they had managed to catch on quick to some of the more careless hacker tricks. Any private chat rooms named “Warez” or “Hacker” were automatically shut down, and eventually “Porn” followed shortly thereafter. So someone started a private chat called “Server.” People followed. When the chat room started filling to capacity too often, someone else opened a private chat called “Server2.” And so on, and so on.
On that particular day, I found myself in “Server8.” No one else was serving, everyone was just shooting the shit like typical wannabe hackers with too much time on their hands, the type who'll take but never give, typical guys I suppose. I waited awhile to see if anyone else was up to it, then I opened up my Server program and turned it on. Immediately, people started requesting, just like hyenas waiting around for the Lions to do all the work and then picking away the scraps.
You're sitting there now asking yourself what the fuck I'm talking about. You've probably got some kind of file sharing program on your computer right now, or your kid does—Limewire, Bearshare, Gnutella, any of those programs where you download files and music from other people's computers without paying. Those programs have been around a long time, only back in the old school days everything was by email. Hackers uploaded songs and games and porn and forwarded the emails with the files attached. Then they made a program that automatically sent those emails to other AOL members who requested them just to make the process easier and faster.
It's called Serving, and you do it because the world works better as a community. It's a matter of honor. When you go into a chat room full of hackers, there are expectations. You share, because it's the first thing you learned in Kindergarten and it's a good rule to abide by, dammit. And when you share, you do it for a respectable amount of time, and you wait for everyone to get a chance to pick out all the best porn and programs and Wu-Tang shit.
On the day my mom got Phished, I Served for a good two hours and made sure everyone got something to download. Everyone requested a list of emails in my mail box, and everyone requested one of those emails with some sort of attached file. Most everybody requested at least one Wu-Tang song, and then a couple of newer videogames that had recently been uploaded. I knew a few hackers back then from a group called the Bio-Warez (pronounced “wears”) who stole a few copies of computer games that weren't due out for months, and helped them distribute the hacked files in exchange for some good porn.
I let the Server program automatically run while I ate my scrambled eggs, listened politely to my mom's spiel about why I should apply for college this year, and even indulged her in more than a little small talk about our neighbors.
“The Wilson's are moving to Oregon …”
“Harry's finally getting rid of the pink trim on his house …”
“Yadda, yadda, yadda …”
It was more than I could do in exchange for the amenities: the rent was free, I was unemployed—technically—and the food was amazing … my mom could cook a chicken forty different ways with forty different flavors.
“Are you looking for a job today?” she asked me.
I picked up my pace, shoveling larger forkfuls of eggs into my mouth. I didn't want to lose my temper and act like an asshole. “Of course,” I said. “I actually have an interview at 3M.”
My mom threw her head over her shoulder, neglecting the dishes so she could get a good look at me. “Full-time?”
I nodded.
“Good for you.” She turned back to her dishes and started humming to herself, probably to keep from asking the question she desperately wanted to ask. Maybe she was afraid of the answer.
“I'm not lying,” I said.
“I never asked.”
I left the last two mouthfuls of eggs on the plate, scraping them into the trash and setting them next to the sink. I went back into my room and turned off the Server program. A couple of wanna-be's had IM'd me during breakfast, asking me if I had any stashed porn I could email them. I ignored those messages, closing them out one by one and was almost ready to sign off when another person IM'd me.
\/_\/arez1: Thanks for serving. Check your email.
I opened my email, scrolling through my collection of music and programs until I found a recent message from \/_\/arez1. I opened it and scanned through the Bait and Tackle. It was good material, the kind of stuff I could throw into my regular rotation, so I forwarded it to my anonymous Hotmail address before grabbing my heavy jacket and heading out the door.
It worked the same way then just like it does now. Phishing, I mean. Tricking people into giving up their credit card numbers. And it was just as easy back then as it is now.
I took the 51 bus south, downtown to the Have A Nice Day Café, which was the closest thing to an internet café Milwaukee had in those days. It was always crowded, and of course there were a few other cafes in the area with computers, but Have A Nice Day offered a level of privacy that was unmatched, with good coffee and a clientele that minded its own fucking business. The café looked a lot like a restaurant, with a dozen tables in the center of the room and the registers all the way in the back. The computers are along the walls, with small wooden walls in between to keep anyone who wasn't directly behind me from seeing anything.
On the day my mom got Phished, I had to wait fifteen or so minutes before a computer opened up, leaning against the pastry case and ignoring the nagging, empty space in my pudgy stomach, occasionally glancing at the only attractive girl my age who was sitting with a guy who looked like Rivers Cuomo from Weezer. After four years in high school as a non-jock, I had managed to perfect the art of staring: just enough to retain in my memory for later fantasies, not enough to get caught; just enough to consider stepping up and starting a conversation, not enough to get too down on myself about the inevitable rejection that would follow.
At the computer, I signed into my Hotmail account and checked the newest orders: three requests, two for computer parts and one for a new Playstation video game. There were three emails, all from Paypal—which was new at the time—confirming three new deposits into my account. I sent a confirmation email to all three of the customers, along with a listing of new products that they could purchase in the future.
I always kept my prices low, usually half off whatever the suggested retail was, and I always explained how I did it so none of the customers would get too jittery. It was a system built on trust back then, because the FBI still had their heads up their asses when it came to the Internet and no regular joe could find a Phisher who screwed them over after they wired the funds to him (there were some girls, but I never met them). I told them that, yes, I used stolen credit card information and, yes, it was perfectly safe for them—for me, that was another story.
Sound confusing? Good. That's a good way to keep it.
After finishing up the emails, I went into four different chat rooms on Yahoo! and gathered the screen names from each, pasting them to a blank Word document. I opened a new window and opened my dummy AOL email address and grabbed the new Phishing lures from earlier in the morning. Nowadays, hackers use fake emails from sites like eBay and Paypal in order to get credit card information, but back in the day everyone was a little more trusting, especially of AOL. I IM'd everyone from all four chatrooms, masking my screen name and copying my Phishing bait into every IM:
AOLsystemhost: Your account is currently signed on at another location, according to AOL security. In order to verify your account we ask that you please follow this link and confirm you identity.
The entire text was highlighted with a link to a page entirely separate from AOL's main server, a dummy site from a free Web page that I changed every week. The person clicking on the link would think they were being sent to AOL's main Web page, when in reality they were being redirected to a dummy site. I used to change it every day when I first started out because I was so afraid of getting busted, but after awhile I realized no one ever investigated these things too thoroughly and besides, none of the Feds really understood what was going on anyway. And I never felt bad, because in every IM window, in the lower right hand corner, was a statement from AOL that no hacker could bypass: “AOL will never ask for your account information.”
So how stupid were they, really? To fill out a form on a Web site that doesn't even look like AOL's main homepage? To be fair, we got pretty good at making the fake sites look realistic, complete with credit card info and an assortment of random information and AOL graphic lookalikes.
It was like hunting pan fish with corn. Not everyone took the bait, but if you had enough patience, someone would eventually fall for it. The lure I used that day was good, and it got me ten different responses. Normally, I hooked them in with a link to a free online contest (everyone loves winning in contests!), and all they had to do was update their account to have their names cast in the drawing, but it never worked as good as this one. This one was a keeper, that new bait right out of a hacker's “Angler” magazine that was guaranteed every time.
In a few minutes, all ten forms were sent to my dummy Hotmail account, filled out with the relevant credit care info. I took three random ones and went to Amazon to purchase the three items my customers had requested. Overnight delivery. Three different addresses, all in the warehouse district, memorized by heart. After confirming the payments, I deleted all ten emails and temporary internet files so there was no trace left. I did this every day, just to be sure, even though I probably could have re-used a lot of the credit card numbers for a few days before their owners figured out what was happening. But like I said before, I tried to avoid as much stress as possible.
Before leaving the café, I printed out two old order forms from the day before with the addresses of where the shipments would be made. This was my daily routine, making purchases online and then picking up purchases from the day before. I used Milwaukee's industrial district in the Third Ward because there were abandoned buildings everywhere, and it was easy to get packages delivered there without a confirmation signature. There were hundreds of abandoned buildings in the area along the lake, enough to keep the deliveries relatively safe from suspecting eyes and completely random just in case someone started investigating.
No one did, though. No one caught on very fast to phishing, and even now it's pretty easy to pick up a few credit card numbers online and use them online. Use a fake shipping address, some abandoned place. Use it once. We re-sold the shipments at a discount, you see. We used the stolen credit card numbers to buy things online, shipped them to a safehouse, then turned around and sold the merchandise for cheap to someone else and pocketed all the money. There were a lot of us, even back when AOL first became popular, and we had an unspoken code to keep investigators from snooping around.
No one ever did, and to be honest it was a little disappointing. It never came as much of a surprise when the World Trade Center collapsed—how could it? I was breaking the law on a daily basis and no one even tried to stop me. It wouldn't have been hard, probably as difficult as it was for John Walker Lindh to infiltrate the Taliban—all they would have needed to do was sit around online and wait. I'm not the literary type, but I suppose there's some irony in all of it.
I found out about the Server rooms on AOL from some Web site I happened by when I was looking for porn (it all came back to porn back in those days), and I jumped into the mix on my second day, requesting emails with music attached, then getting more bold and requesting computer games and eventually more porn after I got my first computer in my room. And through it all no one tried to stop any of it.
On the day my mom got Phished, I went from building to building, finding broken windows to get inside so I could reach the mail drop box. All of the packages on this particular day were small, mostly video games and music CD's, enough to fit into my backpack. With the larger shipments I borrowed a car and followed a great pre-determined escape plan through downtown, and I had the entire industrial section memorized inside and out.
These buildings, they had huge slots for packages because so many came in every day back when a business still occupied the massive space of red bricks and steel. The deliveryman would open the large slot and roll the package along the metal conveyor belt that would take it all the way down into the mail room. It was extremely inefficient, which was probably why this area was so abandoned. If Pabst couldn't consolidate its mail system, I can't even imagine how much money it was wasting in the whole “beer-brewing” process.
I made a complete circle around the block, deluding myself into believing I was honestly worth the trouble of a sting operation. Like always, the area was abandoned. No businesses, the grain factory next door long since shut down, the building itself a skeleton of crack paint and broken windows with the letter “B” missing from the name “PABST BREWERY” scrawled in faded white along the wall overlooking the I-94 freeway.
I opened the front door—it was unlocked—and made my way through the large empty bottling plant to the basement. I sifted through the pitch-blackness, cursing myself for still not bothering to bring a flashlight no matter how many times I found myself in this situation, breathing through my mouth because the stench of fermented beer from sixty years passed was causing me to gag uncontrollably. I found the mail room through one of the open doorways on the opposite end, thankful for the few windows near the ceiling to partially illuminate the way for me, and retrieved the small box filled with a rewritable CD drive—the newest technology of the time—and stuffed it in my backpack.
I went to the next two buildings without bothering to scan the area. I dared someone to catch me, to care that I was doing what I was doing, hoping even as I reached the downtown post office that someone was tracking me, somehow, and planning on busting me before I could slap the new addresses on each box and send them out to my customers. I even walked the mile back to my house, to make sure any undercover officers wouldn't lose me and could take their time with the necessary protocol necessary for taking down a small time thief.
I walked into my house disappointed, willing to relieve the stress of it all—or lack thereof—with a solid ten minutes of porn, but my mom stopped me before I could reach my room. She had a look on her face like she knew what I was about to do behind my locked door or, worse, like she had spent the entire day following me around the warehouse district. She motioned for me to step into the kitchen, which smelled like her famous chicken and rice.
She sat down across the table from me. “Honey, we all need to start being more careful when we're online.”
My heart slowed down just a little bit. What was she talking about? “I'm always careful.”
“Do you have a good password?” she asked.
“Yeah.”
She nodded, eyes glancing in the direction of the stove for a moment. “Well, someone got a hold of one of our passwords, and they were using our account this afternoon.”
“What?” I asked. “What do you mean they used our account?”
“I received a message from AOL,” she said. “They explained to me that someone got into one of our screen names.” Spoken like a true web-ignorant parent—using big words without an understanding of what power they truly held. “I had to re-enter all of our account information this morning just to verify everything.”
“Oh, Mom,” I said. My brain felt like it was trying to claw its way through my eyes. “Mom.”
“What?” she asked.
But what to say without attracting any suspicion? How to explain to her that she had been Phished without giving away exactly how much I knew about everything?
“Nothing,” I said. “Just … be careful when you're online.”
To her, I was little more than an occasional Web surfer, an unemployed high school graduate with low aspirations who spent his afternoons out of the house and surely couldn't have a secret bank account worth close to three thousand dollars. Even a crack in that image meant changing everything, making up new excuses every time I went out, avoiding the same coffee shops, everything. And, in all fairness, the odds were pretty good that I was the one who Phished her in the first place. But that information was already destroyed, the evidence cleared away, and so I could only wait and see if the words “credit card theft” ever popped up in conversations between her and my old man. They never did, and I never once thought about going clean and getting a real job.
Because on the day my mom got Phished, I made six hundred bucks.
