Useless [hacker|cracker|computer-criminal|*] Movie Trivia: Swordfish

Webspace Sponsored by:

This page (like others in the Useless Trivia space) exist to provide analysis and review of computer security in films. Reviews of usernames and passwords used in these films will be mentioned as they can be found and identified.

Swordfish: Action

Passport shows a Finnish hacker with the name Axl Torvald: Possible reference to Linus Torvalds. Passport shows movie Torvald is from Helsinki Finland the place Linus was born, but is socially Swedish. Birth date on passport appears to be Dec 31, 1964, a slight transmutation of Linus' birthday, Dec 28, 1969 - where a 4 and 9 look alike and a 3 day difference exists.
There is a second passport where the last name is Torvalds, but this one states he is from Germany stating he was born November 1, 1971.
Axl is an opportunist: when detained at airport, he tailgates with another person through a usually locked door, and gains access to a key access elevator that had just arrived.
Police officer/FBI Agent claims Axl is "World's Number One Hacker". (Is he really referring to Linus?)
Method shown for getting a person to leave their post: Phone call to person from their boss to a phone at a different location that forces the person to move to the new location, and when they pickup they are asked to hold. Meanwhile, caller has opportunity to take action.
"Breaking 128 bit key DES DoD laptop" scene: First laptop screen includes fake "code" on the left with many assignments, and tests, and the right contains invalid IP addresses where at least one of the "octet" exceed 255 in each.
Next laptop screen seems to show same display as previous.
Next screen offers message about encryption key and then flashes "ENCRYPTED ACCESS KEY" and then in all red "ACCESS DENIED" (flashing)
Next screen has two halves, a left and right pane. The left side has what appear to be some common and not-so-common *NIX user groups:
```
CHECKFSYS          SUPPORT      SAVE       RSM
DAEMON             CUSTSUP      TAR        RSMADM
ADM                DATABASE     DEVICE     RUSR
UUCP               CATALOG      DEVADMIN   SALES
BIN                USER         ANON       SAS
SYS                GUEST        ANONYMOUS  SAVE
123                TOUR         UUCP       BACKUP
ADDUSER            SYSDIAG      NUUCP      SAVEP
ADMIN              SYSDIAGS     ADM        SERVIC
ANON               DIAGS        NET        FIELD
ANONUUCP           TEST         MAN        SETUP
ANONYMOUS          DIAG         MGR        SHUTDOWN
ASG                FLD          NETMGR     SMTP
AUDIT              SERVICE      NETWORK    MAL
BACHAPPL           SUPPORT      INSTALL    SOFTWORK
BACKUP             VISITOR      JOURNAL    SPACE
BATCH              ADMIN        JOURNALS   STARTUP
BBH                SYSADM       KCML       SU
BLAST              SYSADMIN     LEARN      SUNDIAG
BUPSCHED           OPERATOR     LIB        SUOPER
CBM                MANAGER      LIBRARY    SUPER
CBMTEST
ROOT
```
Next Screen "ACCESS DENIED" large red letters again... they must have something more advanced than vt320.... ;-)
Next screen shot: Back to redisplay above fake dir listing but it starts from the 3rd row with "DATABASE" and the left pane is chopped.
Next screen shot, more of the above screen is painted, but vertical and horizontal chopping permit less viewing than the above.
Another, closer, more restricted display of the items above in a quick refresh.
"ACCESS KEY" then "ACCESS DENIED"
Number appear in a "Matrix-like" display (think opening to Matrix with "call trace"):
```
22 4567524
24 4596878
```
With the obvious double meaning, the protagonist's ex is hooked up with a guy who does finances/backs/distros porn films. This in itself is not remarkable, but the name of the film company is: "Backdoor Films"
vernam cipher mentioned along with 128-bit key, and 512-bit key sizes.
"Going to Caltech to get old code" scene: Protagonist claims he has his original code for "the worm he has been using for year" at Caltech, stored on a PDP-10 that they keep around for historical purposes.

"Downloaded the Worm" scene with screen shot:
(There were graphics on the screen and a rotating 3d object in the center, separating the text to two sides.

CHOOSE CONN> O
DUMP [S]RC/[OST/[B]OTH [O]>         $LINE = $_[0]:
CAT /ETC/PASSWD                      IF ($LINE!=/#/)
ROOT:JOSH:0:1:SUPERUSER
    /:SBIN/SH                       @TMP = SPLIT/~/. $TMP
NOACCESS:X:5:6:977:USER:/:          @DIP = SPLIT/\./. $TMP(0):
SYSADM:ADMIN                        @EIP = SPLIT/\~/. $TMP(1):
    234.930.6.17.98 JDK               } ELSE {
[CR] OR ENTER SM:A401               @DIP = SPLIT/\./. $LINE
[R]ESET CONNECTION/(0)> N           @EIP = SPLIT/\./. $TMP(0):
AT \\172.299.4.9.95 %               }
/DELETE                             $A1 = $DIP(0)
                                    $B1 = $DIP(1)
RCP/1.13                            $C1 = $DIP(2)
ACCEPT RANGES: BYTES                $D1 = $DIP(3)
CONTENT-LENGTH 10908                $E1 = $DIP(4)
    IF ($#PSWD < 6)                 $F1 = $DIP(5)
#:/USR/BIN/SCRIPT } ELSE {             $NUM = @EIP:
SUB DOIT $LINE 10.1.2.3255          } ELSE {$PSWD}

"Launch the worm" scene:
"LOADING WORM PROGRAM"
"INITIALIZING WORM PROGRAM"
Node have labels on them "ROUTING ADDRESS", "TARGET IP SOURCE", "PORT 22", "ICMP QUERY", "TRACEROUTE", "SYS LINK", "PORT 120", "PORT 80", "PATCH FINDER", "TCP IP STACK", "SECURITY SECTOR", "NETWORK ACCESS", "FLAG PROBE", "PASSWORD DATABASE QUERY" and there are a few graphic buttons on the bottom right which include "WEB", "BBS", "TELNET", "SATELLITE" , and "LOCAL".
Lines are drawn to connect the above nodes.
Screen for transactions

    ADMINISTRATOR
                                   FUND TRANSFER
  FILE      NAME    1 2 3 + . %    DESTINATION
  EDIT    HISTORY   4 5 6 X   $    BANK OF MONTE CARLO
  ACCT    TRANSACT  7 8 9 / < >
 FILTERS  FEATURES  . 0 #          TRANSFER IN PROCESS
TRANSFER  SPECIAL                  DESTINATION ACCOUNTS
  APR     ACCESS                                     45645678956:1567892
 SEARCH     CODE                                     26578984595:3545789
                                                     35489546578:3789512
                                                     37595451235:345

"How do you want it distributed in the accounts" with next screen

             W     O     R     L     D     B     A     N     C
                 I  N  V  E  S  T  O  R  S    G  R  O  U  P


HINTS                    A C C O U N T   I N F O R M A T I O N
                     ACCOUNT NUMBER       ACCT.CODE   BALANCE
REGISTRATION         SFJKLJH0190J5890-67  SRDFSH4     1,288,987,908.09
                     SDFP0DIT0R950J0956   SRDFSH4     1,234,989,990.76
COVER                JSF09J43245DRRJ104   SRDFSH4     1,454,344,003.45
                     D2934J609J9DJER645   SRDFSH4     1,521,467,068.36
MARK                 WIR-061-02-405JDK456 SRDFSH4     2,563,009,493.12
                     DSTS45ER654ER456ER   SRDFSH4     1,438,238,348.16

ADMINISTRATOR

(Some of the above was found in next screen)
(Some of these numbers were fuzzy. Doing the best I can with what I have.)
(If you add the totals for each account and compare to the bottom, you see a rounding difference between 9,501,036,814.35 and 9,501,036,814.36

 ACCT#:48648678956:1867892
 ACODE:AZ126 BCODE:48657AD
CREATED:D124444 LOCATION:WA8
ROUTING:D11E2R45ER BALANCE: 1,900,207,362.87

 ACCT#:265789245:35457892
 ACODE:AZ126 BCODE:48657AD
CREATED:D124444 LOCATION:WA8
ROUTING:D11E2R45ER BALANCE: 1,900,207,362.87

 ACCT#:35489546578:3789512
 ACODE:AZ126 BCODE:48657AD
CREATED:D124444 LOCATION:WA8
ROUTING:D11E2R45ER BALANCE: 1,900,207,362.87

 ACCT#:37595451235:3459856
 ACODE:AZ126 BCODE:48657AD
CREATED:D124444 LOCATION:WA8
ROUTING:D11E2R45ER BALANCE: 1,900,207,362.87

 ACCT#:1568789445:154112
 ACODE:AZ126 BCODE:48657AD
CREATED:D124444 LOCATION:WA8
ROUTING:D11E2R45ER BALANCE: 1,900,207,362.87


    $  9 , 5 0 1 , 0 3 6 , 8 1 4 . 3 6

          UNITED STATES DOLLARS

"Rubber hose crypto analysis" is applied to Halle Berry's character to try to aid in recovery of access to the passphrase to unlock program that is hiding money. (Threats to another person that the owner of the code care about enough to give up the code.)

They have another screen with what amounts to fake trace/ping information, but over that screen pops up some "code":

trace routing to (11.32.12.01), 40 hops max, 10 hops min 40 byte packets
   hub 06, single dest with 1 sec. as dest flood
maxcount = 2; # Maximum allowable number of ACK/RST
maxtime = 5; # Maximum allowable time for maxcount to occur
      source = 0;
      port = 0;
      target = 0;
filter portscan ip (), timer clock = 360 minutes > clock zero than 1 minute
               timer = 0, cancel clock timer
               route ID_23349987987 Monte Carlo
               stop HOP

At the end of the film, Halle Berry's character is withdrawing money from the account in Monte Carlo.
Account number spoken: 356127G
Password: "swordfish" (However, we don't see case, or munging of password like before with "SRDFSH4" as we don't see the screen.)

In the closing credits, we see this in the scrolling text:

                         final password: vernam

Very likely, one of the passwords used on their website hype the movie thingy. If you skip to the end of the credits, you can find it just before the end title of the movie "S W O R D F I S H" is displayed in the center.)

Swordfish the webspace promo (These don't really even count - web hype contest)

Passwords:
1)  nsa
2)  counter
3)  cipher     (yep, seems to be spelled that way)
4)  elliptic
5)  prime
6)  enigma
7)  tempest
8)  symmetric
9)  venona
10) vernam

??) yukondenali   (Mentioned by others as valid, but not part of site)
??) swordfish     (Mentioned by others as valid, but not part of site)

* http://promo.warnerbros.com/operationswordfish/cmp/rules.html

Keycodes:
3492
6405
9d0e
011a
ba1f
5ed6
9e2a
a32e
4d2b
0011

(C) 2006, 2005, 2004, 2003, 2002, 2001 Passwall.com. Copyright Information: Any of the above content that was created by me may be copied so long as each copy includes this copyright and links back to this site with reference to source and the content not be used for financial gain.

(C) 2006, 2005, 2004, 2003, 2002, 2001 of information included above with explicit credit to people other than me who have submitted documentation, additions, corrections. You will need to get their permission to use their included content.

I do not provide screenshots from movies, or downloadable movies for any films to avoid issues with Copyright infringement. It is my intention to legally provide news, information, trivia, and discussion about films and ensure content is not illegally reproduced. If you control Copyright to any of these movies and will extend to me permission is writing to capture screenshot images to be used on the web, please let me know!

If you have suggestions on additions, feel free to e-mail them to me. Please use valid e-mail addresses so I can reply to you. I like to offer credit to people for their submissions. When you provide your submission, please specify what name should be credited with the information provided and if you would like to have an e-mail link to your address or a URL to your home page.

Useless Trivia: Movie reviews with respect to computer security.