7 ms·

I think the one of the most interesting and overlooked stories about the AOL era, is how the warez scene used bots and AOL's mail system to host every piece of

by bryans 4y ago

I think the one of the most interesting and overlooked stories about the AOL era, is how the warez scene used bots and AOL's mail system to host every piece of pirated content for years. Similar to IRC channels with bots that provided lists of available content and used DCC to transfer compressed files in small chunks -- these were still the days of 9600-56k, so transfers larger than floppies were often doomed to fail -- AOL private rooms would be filled with bots that would respond to requests and send files. The difference being that the AOL bots would email a list of available content, which could be a paginated list across multiple emails, or results for a specific search query. Then you would type another command into the chat to request a specific file or release, and the bot would forward you a series of emails with <1.4MB attachments (the maximum size at the time), already stored on AOL servers and ready to download at whatever speed your modem could handle. It took AOL a long time to catch on to this, and even then, they couldn't keep up with the sheer number of fake accounts being created -- or, as the article points out, accounts made with phished credit cards, of which there were hundreds of thousands floating around and a never-ending supply of new ones as AOL's userbase grew. They effectively hosted the warez scene throughout the 90s, until residential broadband became available and 10-100mbps was common in places like Sweden and Singapore, at which point the scene shifted to IRC and self-hosted top sites (i.e. private FTPs). It was a remarkably simple solution to a hosting problem, and the folks who organized it all will never get enough credit for their contribution toward creating a generation of graphics experts, for example, who couldn't afford the crazy prices of Photoshop or 3ds Max, but were able to use pirated copies to develop those skills and turn them into careers.

Scoundreller 4y ago
> 10-100mbps was common in places like Sweden and Singapore Oh yeah, I remember sometime in the 90s talking to a Dutch guy that had a 6/6 SDSL connection and ran a server in their own home. I thought he must have been a billionaire but was blown away to discover they worked on assembly line.
pram 4y ago
There were even hijacked AOL keywords with warez. The internal site builder had a simplistic BBS forum type thing, I remember one of those being used to link files. Very convenient!
steeve 4y ago
Thank you for the trip down memory lane. This by far the fastest way to get warez back in the day!
notadev 4y ago
To expand on this a bit, when you mailed an attachment on AOL, it would upload and be hosted on their servers. So when you forwarded that email to someone, the download was just a pointer to the original location on their servers. Warez groups would recruit people for positions likw uploaders with strong connections who would just send tons of mail with attachments (to themselves I think). Then the progz/bots, called Mass Mailers (MMers) would sit in a private chat and wait for commands. Sending the `/list` command in chat would result in one or more emails with lists of software, usually split up to reduce file size. If I were looking for PhotoShop, I might see something like: [400] PhotoShop 4.0 (cracked by Foo) 1/4 [401] PhotoShop 4.0 (cracked by Foo) 2/4 [402] PhotoShop 4.0 (cracked by Foo) 3/4 [403] PhotoShop 4.0 (cracked by Foo) 4/4 I'd then send `/send 400-403` in the chat and in a few minutes I'd have four forwarded emails containing a portion of an archive. You'd do this for a bunch of stuff and then when going to bed, let AOL's download manager download everything overnight. AOL did more for the WaReZ scene than anyone else in the mid-to-late 90s.
- jabroni_salad 4y ago
  This workflow is actually still in use in certain corners of the IRC world. It's kinda neat to see what other people are requesting in realtime.
- bdr 4y ago
  Instead of /list, I remember the bots advertising with ASCII decorations like this: _,-^-,_,-^-,_,-^ Enter 33 for /\/\ /\/\ ^-,_,-^-,_,-^-,_,-^-,_ (You'd type "33" in the chat to get a Mass Mail in your inbox.)
  - notadev 4y ago
    The MMers allowed you to specify chat commands, but the default was usually /list or /listme
  - bdr 4y ago
    Fixed formatting _,-*^*-,_,-*^*-,_,-*^ Enter 33 for /\/\ /\/\ ^*-,_,-*^*-,_,-*^*-,_,-*^*-,_
brentm 4y ago
The good ol' mass mail!
dls2016 4y ago
Phished credit cards? For a long time a silly credit card generator got past whatever simple check was performed when an account was created, allowing you access for a week or so until I guess an actual charge attempt was made. (This must have been around 1994 or 1995).
- nicoco 4y ago
  Oh I remember using fake CC generators in the nineties, as a teenager, and being amazed that it permitted to create accounts on some* websites. * yes, porn
- dvtrn 4y ago
  Heck, you didn’t even necessarily need a credit card in the earliest of days, when AOL (as well as EarthLink and CompuServe in fact) still let you pay using bank routing details. As long as the routing number was tied to a bank the service could lookup, it would take whatever account number you gave it and you were on the web! I won’t say how I learned this, but maybe the context clues will fill you in on how it ended when six months into discovering the internet for the first time, my family got a visit from the local PD and some gentlemen from “a government office down state”. I was 13 at the time. Not much came out it but some very strong words from a local magistrate, who ultimately showed clemency and dropped the affair with orders that I remain “off the web” for a year. My father on the other hand…was not so eager to let that one go, heh.
  - dls2016 4y ago
    > I was 13. Not much came out it but some very strong words from a local magistrate, who ultimately they showed clemency. Same thing happened to a friend. After that, I got into music and developed a more "healthy" approach to the internet... using it to learn about synthesizers and download the occasional cracked plugin.
  - soupfordummies 4y ago
    The rent payment portal my apartment uses still checks bank accounts this way. I know this because of the late charges I incurred due to a typo on the account number that the system accepted.
ilrwbwrkhv 4y ago
This naughtiness is what's missing now with the general public in the programming world. It has its pros and cons but man those days were so much fun.
- seanp2k2 4y ago
  Yeah; GitHub is orders of magnitude better than Planet Source Code ever was, but the high of posting your sick new vb5 BAS with “A+++++++++” in the title and getting all the gloves isn’t really the same today. Also, irc and newsgroups were amazing back then. I was just talking with some friends in discord about our days with mIRC scripts, in particular Invision 2 and Excursion. I feel like AOL scripting was this weird subculture of teenagers who did VB vs the slightly older generation with their perl / C and Linux tinkering. I didn’t personally get into FreeBSD until FreeBSD 4, and I felt kinda late to the party. This was around the time, for me, when Knoppix was cool and the world outside of Windows felt magical. Now, two decades later, instead of being some FSF dreamscape, sleep states and hybrid graphics on laptops cause problems across Win, Mac, and Linux, haha.
  - ilrwbwrkhv 4y ago
    My only fear is maybe our generation of hackers are old now and cryptocurrency is the place where the naughtiness is happening and we don't take it seriously because we are older.
  - anthk 4y ago
    Perl was still used on Knoppix/Debian Woody days. The Debian CD's came with a huge chunk of geeky/nerd stuff from that subculture, such as IRC bots, Anarchist FAQ, geekcode, the Linux Gazette...
konfusinomicon 4y ago
this was how I got into programming. got my first copy of Frontpage off one of those Warez rooms and put my site on aol hometown. it was animated gifs and NES roms. sponsored by cyberthrills(?) casino. surprisingly I never got a payment lol
- bradly 4y ago
  Wow, I did about the same thing. Took me about 23 years to go from using Frontpage to put rotating, flaming skulls any page I made to my job at Apple.
  - beaker52 4y ago
    Man, those gifs were the best. I feel like I went on a similar journey to you. I wouldn't be where I am today without that beginning.
    - metamet 4y ago
      I would love to hear the story of those who created those iconic gifs--the flaming skull and the twinkling Christmas tree stick out the most to me.
      - seanp2k2 4y ago
        JS snow was top-tier, as were flashing holiday lights with transparent backgrounds around the site for the holidays. Bonus points for midi choons. It was truly a lit time when you could control browser window size and position on the desktop from within JS, even eject the CD ROM! Free cup holder JS jokes freaked out the older folks. So good.
- seanp2k2 4y ago
  Fortune City for me, eventually convinced my dad to pay for a boxed copy of Macromedia Flash 4 and a real hosting account with front page extensions. I think it even did PHP, which led to lots of messing around with every PHP CMS under the sun, including a lot of time with PHP-Nuke. I never really figured that every hour spent messing with all that would translate into so much more value than any of my school work. The scope of our computer courses at school was basically touch typing and MS Office 97/98.
freefolks 4y ago
Actually the most overlooked things about AOL is about how their internal network (Merlin) got breeched through social engineering by a 14 yr old and did not have a clue about it for 5 years. Merlin is their tool that they use internally for their entire customer database and had a RAT installed that allowed people to create admin accounts, view peoples credit card, addresses, names and also allowed people to terminate accounts. AOL had 34 million paying users at this time.
- montag 4y ago
  Any source for this? Interested to read more. I feel the whole AOL saga would make a great Netflix documentary series. Lots of interesting wrinkles, like the acquisition of Winamp.
  - johnla 4y ago
    I don't have a source but in my Technology specialized HS a classmate came in with a THICK looseleaf ringbound book filled with Names, address, phone and credit card info. Each sheet was in tiny print and absolutely filled to the brim. I'd have to guess there were easily over 500 pages print front and back. He said it was from AOL hacking. I was just noob playing with the AOHell prog and didn't really utilize the app for anything more than "busting" into Lobbies that were full.
    - mtnGoat 4y ago
      Those were just text files showing form submissions from fake billing(phishing) pages. I’d guess. If it wasn’t a “non”(a cc never used at AOL before) it was low value, credit cards were a dime a dozen back then. Only Nons were really high value to ao-hackers. Or cards with the bank phone number, from the back of the card, so you could find out how much available credit they had.
- mtnGoat 4y ago
  I do not believe there was a RAT installed, I think that was just some not entirely true bragging you heard. rather it was ints(internals) that were in on the game and/or tunnels. Merlin lived inside a LAN, to get to it you’d need to break an SSID account which was always a clever trick. Same trick, 20 years later, can still be used to this day to bypass every MFA mechanism I know presently(aws, BofA, etc), if you are smart. The other option was to install a rat(sub7 was a good one) on an employees home machine and then tunnel through it to AOL when they were logged in with an ssid. Which then allowed you to invoke the forms you needed to do things that normally only employees could do. You ever wondered why so many l33ts were from Virginia? They were using mom and dads int accounts when they weren’t looking to lookup account info, then have a friend call in to reset the passwords. Installing a PWS on one of those home PCs was priceless, as you always have the employees password. Ah, the good old days.
deleted 4y ago
[deleted]
dylan604 4y ago
I never used AOL. It just seemed dumb to have that abstraction layer to the internet when other providers just went straight to the web. AOL keywords drove me crazy hearing radio ads "use AOL Keyword _____". Instead of this bot driven email, I made use of the alt.binary.mac.applications and similar newsgroups. But this email system you describe sounds exactly AOLish version of newsgroups. A way of holding someone's hand while the powerusers just went straight to the source.
- bsder 4y ago
  Lucky. You had another provider. In the US, one of the key things that Prodigy (remember them?), AOL and some other providers had was that they had a lot of "local" phone numbers instead of "long distance". This meant that your connection was a single charge and didn't rack up with time. That was a BIG deal. In addition, email addresses were still sufficiently uncommon and hard enough to get hold of that people were using "unmentionable" means to get them even up to about 1994 or so.
  - anthk 4y ago
    Outside the US there was Infovia from the Telefonica ISP which was pretty much the same as AOL. Local, isolated nets and no flat rates until 1999 or 2000.
- Falkon1313 4y ago
  AOL wasn't an abstraction layer to the internet, it was its own online service. To get on the actual internet, you had to wardial the telephone exchanges and happen to luck upon an unsecured university dialin server, from which, if you had a printout of IP addresses from a book or BBS, you could telenet to other servers to use gopher, ftp, irc, MUDs, etc. All plain text mode of course. AOL on the other hand was a lot more user friendly and lively, just dialin with a graphical interface and tons of groups, chat channels, games, etc. just right there. It wasn't until the internet was finally opened up to the public in the late 90s that AOL added an abstraction layer over the internet. Even then, it likely had all types of modem available, where, for instance, I tried IBM's ISP but it used modems that were incompatible with the modem that came installed in my IBM PC.
crate_barre 4y ago
Was this an AOL advent or a IRC one? There were irc channels specifically for warez where you did the same thing.
mtnGoat 4y ago
IRC was always the source of these files. The uploaders would go on irc and Usenet then use winrar to split them into mail attachments. AOL was just a distribution model to those that didn’t know how to use IRC. But it certainly didn’t come after, it was there long before and during this era. A lot of the fileserve bots on IRC were hosted on rooted international and .edu boxen. So essentially we should thank all the inexperienced Linux admins of the early 90s for having so many easy to compromise machines on unmonitored networks and then forgetting about them. ;) AOL OH accounts with no rate limits on chat sends, were the most fun. You could essentially dos whole rooms offline. calling AOL to get mail rate limits lifted was always fun too, explaining why you needed unlimited sending throughout. It was also interesting how many AOL employees were in on the game too, specially once people started paying for names. Does anyone know what happened to gosh(utoh) ?

by bryans 4y ago

Scoundreller 4y ago

> 10-100mbps was common in places like Sweden and Singapore Oh yeah, I remember sometime in the 90s talking to a Dutch guy that had a 6/6 SDSL connection and ran a server in their own home. I thought he must have been a billionaire but was blown away to discover they worked on assembly line.

pram 4y ago

There were even hijacked AOL keywords with warez. The internal site builder had a simplistic BBS forum type thing, I remember one of those being used to link files. Very convenient!

steeve 4y ago

Thank you for the trip down memory lane. This by far the fastest way to get warez back in the day!

notadev 4y ago

To expand on this a bit, when you mailed an attachment on AOL, it would upload and be hosted on their servers. So when you forwarded that email to someone, the download was just a pointer to the original location on their servers. Warez groups would recruit people for positions likw uploaders with strong connections who would just send tons of mail with attachments (to themselves I think). Then the progz/bots, called Mass Mailers (MMers) would sit in a private chat and wait for commands. Sending the `/list` command in chat would result in one or more emails with lists of software, usually split up to reduce file size. If I were looking for PhotoShop, I might see something like: [400] PhotoShop 4.0 (cracked by Foo) 1/4 [401] PhotoShop 4.0 (cracked by Foo) 2/4 [402] PhotoShop 4.0 (cracked by Foo) 3/4 [403] PhotoShop 4.0 (cracked by Foo) 4/4 I'd then send `/send 400-403` in the chat and in a few minutes I'd have four forwarded emails containing a portion of an archive. You'd do this for a bunch of stuff and then when going to bed, let AOL's download manager download everything overnight. AOL did more for the WaReZ scene than anyone else in the mid-to-late 90s.

jabroni_salad 4y ago
This workflow is actually still in use in certain corners of the IRC world. It's kinda neat to see what other people are requesting in realtime.
bdr 4y ago
Instead of /list, I remember the bots advertising with ASCII decorations like this: _,-^-,_,-^-,_,-^ Enter 33 for /\/\ /\/\ ^-,_,-^-,_,-^-,_,-^-,_ (You'd type "33" in the chat to get a Mass Mail in your inbox.)
- notadev 4y ago
  The MMers allowed you to specify chat commands, but the default was usually /list or /listme
- bdr 4y ago
  Fixed formatting _,-*^*-,_,-*^*-,_,-*^ Enter 33 for /\/\ /\/\ ^*-,_,-*^*-,_,-*^*-,_,-*^*-,_

brentm 4y ago

The good ol' mass mail!

dls2016 4y ago

Phished credit cards? For a long time a silly credit card generator got past whatever simple check was performed when an account was created, allowing you access for a week or so until I guess an actual charge attempt was made. (This must have been around 1994 or 1995).

nicoco 4y ago
Oh I remember using fake CC generators in the nineties, as a teenager, and being amazed that it permitted to create accounts on some* websites. * yes, porn
dvtrn 4y ago
Heck, you didn’t even necessarily need a credit card in the earliest of days, when AOL (as well as EarthLink and CompuServe in fact) still let you pay using bank routing details. As long as the routing number was tied to a bank the service could lookup, it would take whatever account number you gave it and you were on the web! I won’t say how I learned this, but maybe the context clues will fill you in on how it ended when six months into discovering the internet for the first time, my family got a visit from the local PD and some gentlemen from “a government office down state”. I was 13 at the time. Not much came out it but some very strong words from a local magistrate, who ultimately showed clemency and dropped the affair with orders that I remain “off the web” for a year. My father on the other hand…was not so eager to let that one go, heh.
- dls2016 4y ago
  > I was 13. Not much came out it but some very strong words from a local magistrate, who ultimately they showed clemency. Same thing happened to a friend. After that, I got into music and developed a more "healthy" approach to the internet... using it to learn about synthesizers and download the occasional cracked plugin.
- soupfordummies 4y ago
  The rent payment portal my apartment uses still checks bank accounts this way. I know this because of the late charges I incurred due to a typo on the account number that the system accepted.

ilrwbwrkhv 4y ago

This naughtiness is what's missing now with the general public in the programming world. It has its pros and cons but man those days were so much fun.

seanp2k2 4y ago
Yeah; GitHub is orders of magnitude better than Planet Source Code ever was, but the high of posting your sick new vb5 BAS with “A+++++++++” in the title and getting all the gloves isn’t really the same today. Also, irc and newsgroups were amazing back then. I was just talking with some friends in discord about our days with mIRC scripts, in particular Invision 2 and Excursion. I feel like AOL scripting was this weird subculture of teenagers who did VB vs the slightly older generation with their perl / C and Linux tinkering. I didn’t personally get into FreeBSD until FreeBSD 4, and I felt kinda late to the party. This was around the time, for me, when Knoppix was cool and the world outside of Windows felt magical. Now, two decades later, instead of being some FSF dreamscape, sleep states and hybrid graphics on laptops cause problems across Win, Mac, and Linux, haha.
- ilrwbwrkhv 4y ago
  My only fear is maybe our generation of hackers are old now and cryptocurrency is the place where the naughtiness is happening and we don't take it seriously because we are older.
- anthk 4y ago
  Perl was still used on Knoppix/Debian Woody days. The Debian CD's came with a huge chunk of geeky/nerd stuff from that subculture, such as IRC bots, Anarchist FAQ, geekcode, the Linux Gazette...

konfusinomicon 4y ago

this was how I got into programming. got my first copy of Frontpage off one of those Warez rooms and put my site on aol hometown. it was animated gifs and NES roms. sponsored by cyberthrills(?) casino. surprisingly I never got a payment lol

bradly 4y ago
Wow, I did about the same thing. Took me about 23 years to go from using Frontpage to put rotating, flaming skulls any page I made to my job at Apple.
- beaker52 4y ago
  Man, those gifs were the best. I feel like I went on a similar journey to you. I wouldn't be where I am today without that beginning.
  - metamet 4y ago
    I would love to hear the story of those who created those iconic gifs--the flaming skull and the twinkling Christmas tree stick out the most to me.
    - seanp2k2 4y ago
      JS snow was top-tier, as were flashing holiday lights with transparent backgrounds around the site for the holidays. Bonus points for midi choons. It was truly a lit time when you could control browser window size and position on the desktop from within JS, even eject the CD ROM! Free cup holder JS jokes freaked out the older folks. So good.
seanp2k2 4y ago
Fortune City for me, eventually convinced my dad to pay for a boxed copy of Macromedia Flash 4 and a real hosting account with front page extensions. I think it even did PHP, which led to lots of messing around with every PHP CMS under the sun, including a lot of time with PHP-Nuke. I never really figured that every hour spent messing with all that would translate into so much more value than any of my school work. The scope of our computer courses at school was basically touch typing and MS Office 97/98.

freefolks 4y ago

Actually the most overlooked things about AOL is about how their internal network (Merlin) got breeched through social engineering by a 14 yr old and did not have a clue about it for 5 years. Merlin is their tool that they use internally for their entire customer database and had a RAT installed that allowed people to create admin accounts, view peoples credit card, addresses, names and also allowed people to terminate accounts. AOL had 34 million paying users at this time.

montag 4y ago
Any source for this? Interested to read more. I feel the whole AOL saga would make a great Netflix documentary series. Lots of interesting wrinkles, like the acquisition of Winamp.
- johnla 4y ago
  I don't have a source but in my Technology specialized HS a classmate came in with a THICK looseleaf ringbound book filled with Names, address, phone and credit card info. Each sheet was in tiny print and absolutely filled to the brim. I'd have to guess there were easily over 500 pages print front and back. He said it was from AOL hacking. I was just noob playing with the AOHell prog and didn't really utilize the app for anything more than "busting" into Lobbies that were full.
  - mtnGoat 4y ago
    Those were just text files showing form submissions from fake billing(phishing) pages. I’d guess. If it wasn’t a “non”(a cc never used at AOL before) it was low value, credit cards were a dime a dozen back then. Only Nons were really high value to ao-hackers. Or cards with the bank phone number, from the back of the card, so you could find out how much available credit they had.
mtnGoat 4y ago
I do not believe there was a RAT installed, I think that was just some not entirely true bragging you heard. rather it was ints(internals) that were in on the game and/or tunnels. Merlin lived inside a LAN, to get to it you’d need to break an SSID account which was always a clever trick. Same trick, 20 years later, can still be used to this day to bypass every MFA mechanism I know presently(aws, BofA, etc), if you are smart. The other option was to install a rat(sub7 was a good one) on an employees home machine and then tunnel through it to AOL when they were logged in with an ssid. Which then allowed you to invoke the forms you needed to do things that normally only employees could do. You ever wondered why so many l33ts were from Virginia? They were using mom and dads int accounts when they weren’t looking to lookup account info, then have a friend call in to reset the passwords. Installing a PWS on one of those home PCs was priceless, as you always have the employees password. Ah, the good old days.

deleted 4y ago

[deleted]

dylan604 4y ago

I never used AOL. It just seemed dumb to have that abstraction layer to the internet when other providers just went straight to the web. AOL keywords drove me crazy hearing radio ads "use AOL Keyword _____". Instead of this bot driven email, I made use of the alt.binary.mac.applications and similar newsgroups. But this email system you describe sounds exactly AOLish version of newsgroups. A way of holding someone's hand while the powerusers just went straight to the source.

bsder 4y ago
Lucky. You had another provider. In the US, one of the key things that Prodigy (remember them?), AOL and some other providers had was that they had a lot of "local" phone numbers instead of "long distance". This meant that your connection was a single charge and didn't rack up with time. That was a BIG deal. In addition, email addresses were still sufficiently uncommon and hard enough to get hold of that people were using "unmentionable" means to get them even up to about 1994 or so.
- anthk 4y ago
  Outside the US there was Infovia from the Telefonica ISP which was pretty much the same as AOL. Local, isolated nets and no flat rates until 1999 or 2000.
Falkon1313 4y ago
AOL wasn't an abstraction layer to the internet, it was its own online service. To get on the actual internet, you had to wardial the telephone exchanges and happen to luck upon an unsecured university dialin server, from which, if you had a printout of IP addresses from a book or BBS, you could telenet to other servers to use gopher, ftp, irc, MUDs, etc. All plain text mode of course. AOL on the other hand was a lot more user friendly and lively, just dialin with a graphical interface and tons of groups, chat channels, games, etc. just right there. It wasn't until the internet was finally opened up to the public in the late 90s that AOL added an abstraction layer over the internet. Even then, it likely had all types of modem available, where, for instance, I tried IBM's ISP but it used modems that were incompatible with the modem that came installed in my IBM PC.

crate_barre 4y ago

Was this an AOL advent or a IRC one? There were irc channels specifically for warez where you did the same thing.

mtnGoat 4y ago

IRC was always the source of these files. The uploaders would go on irc and Usenet then use winrar to split them into mail attachments. AOL was just a distribution model to those that didn’t know how to use IRC. But it certainly didn’t come after, it was there long before and during this era. A lot of the fileserve bots on IRC were hosted on rooted international and .edu boxen. So essentially we should thank all the inexperienced Linux admins of the early 90s for having so many easy to compromise machines on unmonitored networks and then forgetting about them. ;) AOL OH accounts with no rate limits on chat sends, were the most fun. You could essentially dos whole rooms offline. calling AOL to get mail rate limits lifted was always fun too, explaining why you needed unlimited sending throughout. It was also interesting how many AOL employees were in on the game too, specially once people started paying for names. Does anyone know what happened to gosh(utoh) ?