4 ms·

One thing missing in this article, and in a lot of understanding of the Hayes protocol, is that the escape sequence wasn't just "+++". It was specifically: Pa

One thing missing in this article, and in a lot of understanding of the Hayes protocol, is that the escape sequence wasn't just "+++". It was specifically: Pause, +++, Pause. So a series of "+" characters in the transmitted data stream would not make it listen for an AT command. When the modem wasn't online, it was in AT command mode by default anyway. But if in a call, the way to hang up was "Pause +++ Pause ATH0 <CR>" (the zero was implied, "ATH" would work just as well).

myself248 5y ago
My first proper "hack", at the age of 14, involved exactly this. The Excelsior! BBS software for Amiga included a pretty cool little scripting layer called the Intuitive Programming Language, or IPL, and all IPL commands began with an escape character of some sort. I don't even remember what that was, but let's use # for the sake of illustration. Normal users couldn't enter the # character and thus couldn't invoke IPL, but the sysop could embed it into pages and do cool stuff. I wanted to do cool stuff. One of the things IPL could do was change text colors. Of course, most boards would use ANSI escape sequences for the same, but IPL did it in a lot fewer characters, and in a terminal-independent way, which was then translated to ANSI at render time, if the user viewing the page was logged in with an ANSI terminal. (So you could write the same screen and have it work for both ANSI-capable and text-only terminals, for instance. Pretty neat, but I digress.) Excelsior! was inherently multi-line, and had a great little chat system. Since most BBSs were single-line, this was a big deal and got a lot of use. And naturally, anything that added fancy features to chat was well-received. Enter the Colorific! extension, which had one purpose: To shove a bunch of IPL color commands _into the user's display name_, so that when you entered chat, you'd have a yellow name, a black name, a rainbow name... There was another user on the board named Kristine, who hinted ever so gently that Colorific! might have more features than initially met the eye. That was all my curious mind needed, I scoured its menus, played with its functions, and finally it clicked: Through the regular BBS menus, I could edit my display name too! I couldn't enter the IPL escape character, but I could arrow back and forth and edit the rest of the string around it, so if I let the extension give me a rainbow name first, suddenly my name was something like #C14.M#C13.y#C12.s#C11.e#C10.l#C9.f or whatever. I had a bunch of escape characters to play with. Then I could just stuff in whatever IPL commands fit in the display-name field. One of the other things IPL could do was insert delays. I mostly saw this used for graphical effect, like making a fireworks display appear at proper timing independent of modem speed. Unique and cool, but I very quickly recognized the Hayes Escape power of the delay command. Giddy seconds later, I changed my username to #D600.+++#D600.ATH0#CR. and entered chat, whereupon the board promptly hung up on me. Whoops. Good thing the display name reset itself after a logout. So I called back, and this time I changed my username to #D600.+++#D600.ATS2=42#CR.ATO#CR. and entered chat. This time nothing appeared to happen, but I knew I had just changed the settings on the modem serving MY line such that it now expected ** as its escape character, not +++. Then back to the earlier string, entered chat again, and as they say, boom went the dynamite! I was alone, and any time anyone else called back and entered chat, all I had to do was say anything at all, and the board would hang up on them. I will never forget that feeling. It was discovery, it was power, it was secrecy. It was mayhem of the most incredibly harmless kind. It was time to have some fun...
jcrawfordor 5y ago
Hayes modems required the pause around +++ as a measure to avoid race conditions around data that might be in the inbound or outbound buffers during the switch to command mode. However, there are a number of modems (including in my experience basically all modern modems) that do not enforce the pause requirement and are happy to receive a command immediately following, e.g. +++<CR>ATDT can be sent with no problems on a modern Telit module I'm using. So in practice this was not really an effective mitigation to problems around the +++ switch to command mode and it remained an exploitable security issue for some time in the '90s.

myself248 5y ago

My first proper "hack", at the age of 14, involved exactly this. The Excelsior! BBS software for Amiga included a pretty cool little scripting layer called the Intuitive Programming Language, or IPL, and all IPL commands began with an escape character of some sort. I don't even remember what that was, but let's use # for the sake of illustration. Normal users couldn't enter the # character and thus couldn't invoke IPL, but the sysop could embed it into pages and do cool stuff. I wanted to do cool stuff. One of the things IPL could do was change text colors. Of course, most boards would use ANSI escape sequences for the same, but IPL did it in a lot fewer characters, and in a terminal-independent way, which was then translated to ANSI at render time, if the user viewing the page was logged in with an ANSI terminal. (So you could write the same screen and have it work for both ANSI-capable and text-only terminals, for instance. Pretty neat, but I digress.) Excelsior! was inherently multi-line, and had a great little chat system. Since most BBSs were single-line, this was a big deal and got a lot of use. And naturally, anything that added fancy features to chat was well-received. Enter the Colorific! extension, which had one purpose: To shove a bunch of IPL color commands _into the user's display name_, so that when you entered chat, you'd have a yellow name, a black name, a rainbow name... There was another user on the board named Kristine, who hinted ever so gently that Colorific! might have more features than initially met the eye. That was all my curious mind needed, I scoured its menus, played with its functions, and finally it clicked: Through the regular BBS menus, I could edit my display name too! I couldn't enter the IPL escape character, but I could arrow back and forth and edit the rest of the string around it, so if I let the extension give me a rainbow name first, suddenly my name was something like #C14.M#C13.y#C12.s#C11.e#C10.l#C9.f or whatever. I had a bunch of escape characters to play with. Then I could just stuff in whatever IPL commands fit in the display-name field. One of the other things IPL could do was insert delays. I mostly saw this used for graphical effect, like making a fireworks display appear at proper timing independent of modem speed. Unique and cool, but I very quickly recognized the Hayes Escape power of the delay command. Giddy seconds later, I changed my username to #D600.+++#D600.ATH0#CR. and entered chat, whereupon the board promptly hung up on me. Whoops. Good thing the display name reset itself after a logout. So I called back, and this time I changed my username to #D600.+++#D600.ATS2=42#CR.ATO#CR. and entered chat. This time nothing appeared to happen, but I knew I had just changed the settings on the modem serving MY line such that it now expected ** as its escape character, not +++. Then back to the earlier string, entered chat again, and as they say, boom went the dynamite! I was alone, and any time anyone else called back and entered chat, all I had to do was say anything at all, and the board would hang up on them. I will never forget that feeling. It was discovery, it was power, it was secrecy. It was mayhem of the most incredibly harmless kind. It was time to have some fun...

jcrawfordor 5y ago

Hayes modems required the pause around +++ as a measure to avoid race conditions around data that might be in the inbound or outbound buffers during the switch to command mode. However, there are a number of modems (including in my experience basically all modern modems) that do not enforce the pause requirement and are happy to receive a command immediately following, e.g. +++<CR>ATDT can be sent with no problems on a modern Telit module I'm using. So in practice this was not really an effective mitigation to problems around the +++ switch to command mode and it remained an exploitable security issue for some time in the '90s.