Useless [hacker|cracker|computer-criminal|*] Movie Trivia: The Net

Webspace Sponsored by:

This page (like others in the Useless Trivia space) exist to provide analysis and review of computer security in films. Reviews of usernames and passwords used in these films will be mentioned as they can be found and identified.

The Net: Suspense

Opens with Sandra Bullock's character playing a game like Wolfenstein 3d on a Mac. She finds "a virus" and appears to use ResEdit to locate it in code, extract it, and fix the game.

Humorous online chat comments from movie: (I formatted to ircII style. It was originally left pane of frame contained names of speakers and the right side had their written words.)

<IceMan>   No one leaves the house anymore. No one has
           sex. The net is ultimate condom
<Angel>    That talk Iceman could lead to eventual
           extinction of r species.
<Cyberbob> My sympathies exactly Angel - Let's have a
           date and procreate
<Angel>    Not me Ice. In two days I'm off on vacation -
           just me, a beach and a book.
<Cyberbob> I'm there {{{{{babe}}}}}, look no further. ;-)
<Angel>    Sorry, you're the best Bob, but not my type.
<Cyberbob> I'm crushed :-( so what do you want in a man?
<Angel>    Butch. Beautiful. Brilliant. Captain America
           meets Albert Schweitzer. Spends all day dashing into fray
           while making world safe for democracy; at night playing
           Bach Cantatas while curing cancer
<Cyberbob> Settle for a guy who puts the seat down?
<IceMan>   Listen Angel, you're dreaming. You're one of us.
<Cyberbob> We accept you. We accept her. You are one of us.
<IceMan>   One of us.

Mozart's Ghost: (Back in the "Day" when a whole web site fit on a 1.44MB floppy disk. (Not likely with what they showed with graphics, sound and movement)
Sandra's character is instructed to visit a link "Concert Information" at which point the link takes her to "Houston Electric Utilities Internet Access Point"

(Image of   ) W e l c o m e  t o
(Texas with )
(Center of  ) H o u s t o n    E l e c t r i c   U t i l i e s 
(atom with  )
(4 electrons) I n t e r n e t   A c c e s s   P o i n t
Houston_elec.com                                Served by Dual T1s
IP 421.643.21.2                        Mainframe access at port 23


               Please Enter Your Password:
            ---------------------------------
            |>                              |
            ---------------------------------

           Protected by G a t e k e e p e r^TM Software 

                                                                     __
                                                                     ||

WOW!!!! Served by two 1.544Mbps connections (heh). The amusing security item here is that this is a web page, but the notice on the middle right side says "Mainframe access at port 23" and if they are using standard port services, then that would be telnet. Woot! Telnet access to the mainframe! Plain-text passwords across the wire!
That IP address above is rather amazing. It seems that even the 8 bit bytes in Texas can have more bits than 8 per byte. To contain digits from 0 through to include "421" would require 9 bits per 8 bit bytes. The next value of 621 would need 10 bits per 8-bit byte. (Joke:) Perhaps they are compressing their bytes, or using IPV4.1 to get an extra 10% more. (heh.)
At this point, the uber-elite securely-coded web-form technique with security by obscurity is noticed with that little "pi" character. When she clicks on it, (while holding down control-shift) some images flash on the screen:

What appears to be part of a README for an old copy of Compact Pro:

export laws change, I will re-enable encryption capabilities as quickly as possible.
* New Features *
Double-clicking archives in Finder with Option key extracts all contents
Double-clicking filenames in catalog window extracts files
Segment command divides archives into fixed-size segments
BinHex4 encoding/decoding
Report command generates text file summary of archive contents
Maximum number of items in a folder increase to 1500
Maximum length of passwords increased to 99 characters
Self-extracting archives prompt for destination folder when extracted
Option to automatically validate after saving
Reduced system requirements - requires System 4.2 and Mac 512 SE(with 1MByte memory) or higher

* Incompatibilities With Earlier Releases *
Two new features of Compact Pro may cause compatibility problems with older versions of Compactor.
If you create an archive which has a folder with more than 300 items, Older versions of Compactor will not be able to Open the archive.

A page with a diagram of a gear.
nicely formatted memory hex dumps with address in hex, values in hex, and printed character representation of 8-bit hex codes in memory..

A picture of a bus-style network with what looks like an Apple Computers LocalTalk Network (CSMA/CA) showing names of machines and function:
Data placed in table form (In this table items are listed top to bottom, but in the image were displayed right to left across the top from "Georges' Mac" through to "Bert's Mac", then down to "LaserWriterPro 630" then left to right for the rest, connected in a bus topology.
Note: "Georges Mac" has the name and first service item swapped.

Address	Name	Model	Services
65398.118	LaserWriter Pro 630	LaserWriter 0/0-1	Services
65516.127	Bert's Macintosh	Macintosh II	AFPServer FM Pro 2.0 Workstation 0/0-4
65291	Dan's Centris 650	Macintosh Centris 650	Workstation 0/0-2
2.240	DPC LaserWriter 5g	LaserWriter	0/0-1
65333.127	DPC Mac Server	Macintosh IIfx	AFPServer FM Pro 2.0 PPC ToolBox Workstation 0/0-5
65302.118	Front Desk Mac II	Macintosh II	Workstation 0/0-2
65408.22	Georges' Mac	AFPServer	Macintosh Quadra 610 Workstation 0/0-3
65366.57	Lina's Mac II	Macintosh II	AFP Server Workstation 0/0-3
65422.27	Macintosh 610	Macintosh Centris 610	PPC ToolBox Workstation
65330.1	Quadra 900	Macintosh Quadra 900	AFP Server Workstation 0/0-3
601.76	SelectPress 600	LaserWriter	0/0-1
65420.112	Tech Server	Macintosh SE/30	2.0Mail Server AFPServer MeetingMaker XP PPCToolBox Workstation 0/0-6

A text editor screen which could be a WordStar-clone with 4 columns.
Note how it appears first and last names are switched?
Note how "Antonioli Melissa" and "Bentley Allison" are sharing the same seat?
The column data was green, but the header and footer were white and used a font size inconsistent with the font in the column.

                         |||1I||1UUIllUU UI||U||Ul11U|||   (<----bar code)
                          B I L L I N G   R E C O R D S
---------------------------------------------------------------

------FIRST           LAST            SEAT         CODE--------
      Aal             Scott            32A         AALZSCO
      Andres          Susan            21B         ANDRESA
      Antonioli       Laurie            8F         ANTONIO
      Asunction       Melissa          25C         ASUNCIO
      Ayriss          Dave             18A         AYRISSZ
      Baliscao        Jesse            17C         BALISCA
      Barrabee        Suzee            14A         BARRABE
      Bentley         Allyson           8F         BENTLEY
      Berenson        Annie            13B         BERENSO
      Billy           Serena           12A         BILLYZS
      Blevins         Jill              5C         BLEVINS
      Borrmann        Carl             26A         BORRMAN
      Brown           Kevin            29C         BROWNAK
      Buechert        Courtney         10B         BUECHER
      Casey           Linda             8B         CASEYZL
      Cung            Irving           21F         CHUNGZI
      Cocciolo        Harry            24C         COCCIOL
      Cocke           Bess             27D         COCKEAB
      Colantuono      Bill              6G         COLANTU
      Cordell         Alan             18G         CORDELL
      Courneyer       Rene             15A         COURNOY
      Coyner          Bo               13D         COYNERZ
      Crayton         Ed               34A         CRAYTON
      Curtin          Paul             31B         CURTINZ
      Curtin          Taya              4B         CURTINA
      Daley           Blake            16C         DALEYAB
      Delgleish       Laurie            9E         DALGLEI
      Darby           Kieran           29F         DARBYAK
      DeGance         Tonya            17D         DEGANCE
      Desk            Reception        36A         DARBYAK
      Donald          Michelle         21A         DESKIRE
      Duree           Damon            20B         DONALDZ
      Ellis           Timothy           4A         DUREEZD
1--------10-------20-------30-------40-------50-------60-------70-------80-

Some sort of tax reporting program that could be used to file taxes:

F10=CLEAR                FAST TAX FROM THE TAX INSTITUTE
18-Jan-95                       FOR 1994 TAX YEAR                     FAST TAX
              -------------------------
              |    Wages    | Fed W/H |   ------------------------------    <
 -------------+-------------+---------+-  |Filing Status    F2     MFJ |    >
 |W-2 #1      |          $0 |      $0 |T| |Exemptions       F3       5 |    ^
 |W-2 #2      |          $0 |      $0 |T| |Children for EIC F4       1 |    v
 |W-2 #3      |          $0 |      $0 |T| |2441 Dependents  F5       1 |    ?
 |W-2 #4      |          $0 |      $0 |T| |Blind & 65+      F6       0 |
 |Other Income|          $0 |      $0 |T| |                            |
 |Sch C Income|          $0 |      $0 |T| |Using Standard   F7         |
 |Total       |          $0 |      $0 |-  |Deduction
 --------------------------------------   |-----------------------------

 --------------------------------------   |=============================
 |Child Care paid           |      $0 |   |Taxable Income           $0 |
 |Adjustments to Income     |      $0 |   |Federal Tax Owed         $0 |
 |Estimated Tax Paid        |      $0 |   |Self Empl. Tax           $0 |
 |Nontaxable earned Income  |      $0 |   |EIC                      $0 |
 |Total Schedule A          |      $0 |   |                            |
 |Other (-)Credits/(+)taxes |      $0 |   |Refund                   $0 |
 --------------------------------------   |=============================



 F1=HELP F2=STATUS F3=EXEMP F4=EIC F5=2441F6=BLIND765+ F7=SCH A/MAIN F8=QUIT

Up-close view of text "ost. He's" "his screaming" "thrash" "style that"
"UNAUTHORIZED ACCESS"

A graph showing market activity for a possible stock market from 1981 through to 1992 (Later we find it is for thw following):

=============================================================================
|SYMBOL TMO                  Max $  47.50             Fortune 500 Rank 385  |
|THERMO ELECTRON CORP.  - NY ^DTC                                           |
|Technology - Diversified                                                   |
|Vertical lines below show month of Stock Splits or Other Distribution      |
|                                                                           |
|$50 |                                                                      |
|    |                                                                      |
|$25 |    ( a   g r a p h   i s   p l a c e d   h e r e )                   |
|    |                                                                      |
|    |                                                                      |
|    ----,-----,-----,-----,-----,-----,-----,-----,-----,-----,-----,-----,|
|                                                                           |
|    1981  1982  1983  1984  1985  1986  1987  1988  1989  1990  1991  1992 |
|                                                                           |
============ H/Help   N/New    V/Value    B/Browse   E/End ==================

And the above images are cycled through in semi-random order.

Demonstration of passing forged/bogus "beacon" location information to planes in order to cause pilots to believe they are in one place preparing for a landing, when in reality, they are in another, and end up crashing into something as they fly too close to the ground.
Funny side note about status of planes (ONTIME/DELAYED) at the airport, they offer new codes for status like:
- DELAYED
- CANCELED
- MISSING
- HIJACKED
- CRASHED
- NO FUEL
Arranging for an accomplice to steal a purse so you can chase after them to gain access to credit cards, identity information, or specific items you think they are carrying. Allows creation of dependency from the person who has lost their resources.
New identity shifting:
Name: Ruth Marx
Address: 407 Finley Avenue, Venice, CA, 90291
Place of birth: Santa Monica, CA (Earlier she said she was from La Huenta Colorado and moved to San Jose)
DOB: 03/05/68 P
Form shown movie's "today" as March 29,1995
Later they again change Ruth Marx information:
SSN: 915-30-1717
DOB: 06/11/68
Address: 39 Admirals Way, Venice, CA 90291
File ID: XKF16-774
Then Antagonist edits:
POLICE ARRESTS:
12/93 LAPD Prostitution
9/93 LAPD Petty larceny
1/91 SFPD Narcotics possession
8/89 LAPD Parole violation
4/88 SFPD Prostitution
WARRANTS ISSUED
LAPD Prostitution
SFPD Narcotics possession
"Ruth Marx" steals a cell phone with number: 555-7605
Description of triangulation and location of a cell phone with triangulation based on cell base stations in range to "hear" beacon from phone - even when not in use, but left "on".
She attempts to "telnet" to an e-mail address using what appears to be a web page based session from a Swiss ISP "@ip.ch". (Of course, many shell based ssh client allow for use of a username@hostname to login as a specified user on a specified host.)
/@ip.ch/> TELNET rcds.bnh@navDC.mil
/@ip.ch/> CONNECTING
From the card "BER5348833" is the password after she connects to the "web page" via "telneting" to an "email address" (heh heh)
As she is connecting, it is described later she was spidering through:
"Dozen hops so far":
A "POP" in Switzerland
A little UNIX box at the University of Montana
5 routers at Berkeley

WOW! They Have "UN*X Shell v1.63.2" I did not know there was just one! (heh heh)
(See below) Port 42? That is "nameserver" but not the DNS that we are familiar with that runs on port 53. Weird.

UN*X Shell v1.63.2     Port 42 Session 5

/> WHOIS ICEMAN
        --------------
           ICEMAN
        --------------
    Name: Kelly Mann
     Age: 12
      IP: dude.satex
          83.74.342.73

/> WHOIS GANDALF361
        --------------
          GANDALF361
        --------------
    Name: Malik Dillon
     Age: 37
      IP: lordrings.ndu.wrld
          43.624.234.53
Location: New Delhi, India

/> WHOIS CYBERBOB
        --------------
          CYBERBOB
        --------------
    Name: Robert Fox
     Age: 39
      IP: cyber.wh.ca
          75.258.34.164
Location: West Hollywood, CA

Starting a chat session with Cyberbob:
Movie tries to convey she is able to be anonymous, and set up a peer-to-peer encrypted session with just a single passphrase that is

<Gandalf361> What's the latest version of that software?
<Dogma22>    LOL - That app will never ship
<Gandalf361> Version 6.0 sucks - I'm writing a hack to
             fix it
->*Cyberbob* Cyberbob - HELP -- need your expertise
             Meet me in private room

"Private Chat Room" has a name that is 7 characters long? Passphrase for encryption that is 7 characters long? I get the sense that this is supposed to be an AOL-like "chat room" thingy.

<anonymous>  You ever seen a Pi symbol attached to a
           program?!?

<Cyberbob>   Pi = Praetorians
<Anonymous>  The Praetorians?? -- Who are they?
<Cyberbob>   The Big Bad Wolf - Cyberterrorists, techno(...)
             They want to blow the house down
<Anonymous>  Cyberbob, help me. I need more information about
             them
<Cyberbob>   LAX Airport, Wall Street, Atlanta - EXTREMELY
             DANGEROUS -- Don't mess with them --
<Anonymous>  Can't help it -- they're messing with me.
<Cyberbob>   Must not continue. Must meet IRL
             In private.
<Anonymous>  The Santa Monica Pier -- by the Ferris Wheel
<Cyberbob>   Agreed. Seven PM tonight. I'll wear

Chat screen is then covered in "gibberish"
Message from System:

Communications Error
TCP/IP link dropped -

Supposedly they trace Cyberbob to "8833 Rosewood, West Hollywood" from his conversation with her.
Good idea presented: If you have a nicer car, park it in a new/used car lot to sleep overnight - it will bend in with other cars.

California DMV and police systems altered to make her car appear reported stolen:

Retrieving 3P0W893 license data

Code 341               Reported: B
Log file 31344122      APBs issued
 R E P O R T E D     S T O L E N

Ruth arrested:

ADDRESS  39 ADMIRALS WAY
   CITY  VENICE
  STATE  CA
    ZIP  90291
  PHONE  (301) 853-3472

    CDL  I61611899
EXPIRES  7/97

Example of tailgating to gain access to a locked-door restricted area (San Francisco: "Cathedral" software company office space to try to get copy of disk.

From a desktop machine at Cathedral, she has access to a list of applications:

PROGRAMS      ---------------------------------------------
SYSTEMS       |    C a t h e d r a l   S o f t w a r e    |
APPLICATIONS  |   I n t e r n a l  S y s t e m  M e n u   |
COMMAND       ---------------------------------------------
------------  | P r i n t e r  S p o o l e r              |
|          |  | F i l e   S e r v e r / 1 s t  f l o o r  |
------------  | F i l e   S e r v e r / 5 t h  f l o o r  |
              ---------------------------------------------
              | H .  S t o r a g e                        |
              | M a n a g e m e n t                       |
              | O p t i c a l   A r c h i v e             |
              ---------------------------------------------
              | T e r m i n a l   E c h o                 |
              ---------------------------------------------
              | F a c i l i t i e s  M a n a g e m e n t  |
              | A c c o u n t i n g  &  R e c o r d s     |
              | E l e c t r o n i c  M a i l              |
              | I n t e r n e t w o r k   R o u t i n g   |
              ---------------------------------------------

"Terminal Echo" (ttysnoop?) Portrayed as a GUI remote viewing application to see a desktop machine
Once Angela (Sandra Bullock's character) has physical access to the office, but no way to identify the person pretending to be Angela, she calls Angel's extension to discover which office person she is and which session to snoop.

Fake Angela sends talk message:

PRAETORIAN:

Suspect ANGEL is near -
Advise immediately.

Angela trips fire alarm to get office evacuated and for fake Angela to leave with rest of office and give real Angela Access to fake Angela's desktop.
Angela is able to access another "pi" redirection and many of the same pages flashed in quick succession from before are flashed again.
One difference is a photo ID for a "Gregg, Jeff", "JG@gms.wrld", "23.75.345.200","Port 34, Login 10:05p", "Gregg Microsystems"
Another difference is A kind of flowchart for GUI programming and windows displays to show based on options select.

Prompted for a password - Angela does a "Terminal Echo" again, but the listing looks a little bit more like a "w" or process listing:


  LOGO     C A T H E D R A L   E C H O   P R O G R A M
CATHEDRAL  TRANSCRIPTS FOR STATION SE12
  LOGO    

 MIN:SEC  |  TYPE  |  ACTION

 0 1:2 4  |  SYS   | SYSTEM IDLE
 0 2:1 3  |  Ae    | Exit System
 0 1:5 0  |  Key   | ^W (close)
 0 1:2 4  |  Ae    | Confirmation: message sent
 0 1:0 4  |  Key   | Praetorian <TAB> Suspect ANGEL
          |        | is near - advise immediately <CR>
          |        | Archangel
 0 0:4 6  |  Ae    | /TALK/
 0 0:3 9  |  Key   | /Password:/ natoar23ae
 0 0:1 9  |  Ae    | /LOGIN/
 0 0:0 6  |  Ae    | /TELNET/
 ? ?:? ?  |  ????T | Echo Enabled: Station 5E12

From the above, we see a demonstration of the risks of having a password included as part of a command line argument. Angela uses the printed password to gain access to


Remote Access                                    Authorization D
                                                 Guest Level Security


  * Central Television Network                              ^ Page Up
  * Air Quality Maintenance Board
  * Air Traffic Network (Canada)
  * Air Traffic Network (US)
  * Washington Water & Light
  * NATO Defense Network
  * Navy Department
  * Nevada Highway Police
  * Alabama Colleges
  * New York Police Department
  * New York Stock Exchange
  * FBI Central Computer
  * Northern California 911
  * Oregon University, Dept. of Biology
  * Alaskan Pipeline
  * American Stock Exchange                                 v Page Down

From the above list, she scrolls down to choose "Bennett, Angela"

  * Institute of Russian ????
  * Bergstrom, T. Michael
  * Bethesda Naval Hospital
  * Internet Airline Service
  * Bennett, Angela
  * U.S. Passport Registration
  * Cathedral Software Inc.
  * Phillips, Ben
  * Internet Mail & Routing
  * Krystal Cancun Resort
  * Pharmacy Ordering Net
  * Champion, Alan

Bio for this person:


Remote Access                                    Authorization D
                                                 Guest Level Security

[         ] NAME:
[         ] M A R X   R U T H          Soc Sec #
[         ]                            915-30-1717
[PICTURE  ]     P E R S O N A L   H I S T O R Y
[OF  HER  ]   EDUCATION:
[         ]    Lincoln High School
[         ]      Dropped out, age 14

[  NEXT  ]    FAMILY HISTORY:
              Family on welfare since 1975
[PREVIOUS]    Father killed in robbery attempt 05/73
              Mother in drug rehabilitation 1971
[ DELETE ]        1977, 1981, 1983, 1991
              Mother killed in drug overdose 12/92
[  FILE  ]    No brothers or sisters

[** SEE  ]    MEDICAL HISTORY:
[  BELOW ]    Treatment for venereal disease
[        ]    Repeated drug overdoses, 1985-1992  v
[        ]
              C R I M I N A L   R E C O R D
              OUTSTANDING WARRANTS:
              LAPD Prostitution
              LAPD Grand Theft

              PRIOR ARRESTS:
	      12/91 LAPD Prostitution
               9/93 LAPD Petty Larceny
               1/91 SFPD Narcotics Possession
               9/90 LAPD Narcotics Possession
               8/89 Parole Violation              v

              PRISON TIME SERVED:
              1990 Soledad Corr Facility
              1987 LA County Jail
---
       
** Contents of that window:
[RECORD LOCATOR    ]
[2 M?65-5234  5    ]
[??????? 123 / IP  ]
[????? RESI 5133-41]

She tries to delete record of Ruth Marx:

--------------------
| INVALID COMMAND  |
|  You Must Have   |
| Mainframe Access |
|  To Delete Files |
--------------------

Message to Archangel: "INCOMMING MESSAGE:"

---------------------------------------------
| Talk Function                         v ^ |
---------------------------------------------
|ARCHANGEL:                    |   [REPLY ] |
|----------------------------- |   [ SEND ] |
|Terminate all Mozart Ghost    |   [LOCATE] |
|files NOW.                    |   [ INFO ] |
|Terminate Angel NOW.          |            |
|----------------------------- |            |
|PRAETORIAN                    |            |
---------------------------------------------

While talk session is "connected", she does "WHOIS":

UN*X Shell v1.63.2     Port 42 Session 5
/> WHOIS PRAETORIAN
        --------------
         PRAETORIAN
        --------------
    Name: 
     Age: 
      IP: 75.748.86.91

Location:

But on close-up of that screen, we see a different IP address:

      IP: 23.75.345.200

Now she does a "search"

SEARCH IP 23.75.345.200
DOMAIN PREF = gms.wrld
SET STRING FILLTER = "GREGG"
SET SUBNET M???
SET PACKET ?

and:

SET DNS
BEGIN
TRUNK RO????

and:

ROUTER TABLE 5A
  TLA - SUBNET: 67
  PSC - SUBNET: 234
  MCB - SUBNET: 83
  PLL - SUBNET: 345

and:

   B-NET TABLE EMPTY
   ERROR -34: ACCESS NOT PERMITTED

QUERYING DNS RECORDS
COM/GOV/MIL/EDU/NET/ORG/FOR
A57820
A8583265
B4, A3 RO
PORT 1
PORT 2
PORT 3

PORT 11
PORT 12
MATCH DETERMINED

and:

------------------------------------------------------------------
|SEARCHING IP#                  | SEARCH RESULTS                 |
|                               |                                |
|23.75.345.200                  | 23.75.345.200                  |
|23.75.345.200                  | 23.75.345.200                  |
|                               |  jg@gms.wrld                   |
|                               |                                |
|TRUNK ROUTER TABLE 5A          | [PHOTO] Gregg, Jeff            |
|NET FEED TO B_NET SERVICES     | [  OF ] JG@gms.wrld            |
|DOMAIN REGISTRATION UNKNOWN    | [JEFF ] 23.75.345.200          |
|SEARCHING POSSIBLE SUBNETS     | [GREGG] Port 34, Login 10:05p  |
|UNREGISTERED SUBNET FOUND      | [HERE ] Gregg Microsystems     |
|SUBNET LINKED TO gms.wrld      |                                |
|RESOLVING USER ID              |                                |
|                               |                                |
|L O O K U P   C O M P L E T E  | L O O K U P   C O M P L E T E  |
------------------------------------------------------------------

NOTE: THESE ARE THE ONLY VALID IP ADDRESSES SHOWN IN THE MOVIE!
and sub section of that looks like a normal traceroute:

1 ip4.tiac.net (199.0.65.15) 124 ms  131 ms  140 ms
2 cisco.tiac.net (199.0.65.1) 140 ms  *  141 ms
3 sl-dc-5-84/7-384k.sprintlink.net (144.228.25.93) 162 ms  141 ms
4 icm-dc-1-F0/0.icp.net (144.228.20.101) 260 ms  313 ms  230 ms
5 icm-fix-e-H2/0-T3.icp.net (192.157.65.122) 169 ms  *  141 ms
6 192.203.229.246 (192.203.229.246) 168ms  163 ms  140 ms
7 t3-1.cnss58.Washinton-DC.t3.ans.net (140.222.58.2)  139 ms  161 ms  140 ms
8 mf-0.cnss58.Washinton-DC.t3.ans.net (140.222.56.222)  139 ms  162 ms  140 ms
9 t3-1.cnss72.Greensboro.t3.ans.net (140.222.72.2) 168 ms  162 ms  168 ms
10 * t3-0.cnss104.Atlanta.t3.ans.net (140.222.104.1) 160 ms  157 ms
11 t3-2.cnss64.Houston.t3.ans.net (140.222.64.3) 197 ms  218 ms  198 ms
12 t3-0.cnss80.St-Louis.t3.ans.net (140.222.80.1) 198 ms  221 ms  228 ms
13 t3-1.cnss25.Chicago.t3.ans.net (140.222.25.2) 227 ms  231 ms  226 ms
14 t3-0.cnss40.Cleveland.t3.ans.net (140.222.40.1) 258 ms  220 ms  227 ms

Above lines are crossed out with red lines in sequence except for: "10 * t3-0.cnss104.Atlanta.t3.ans.net (140.222.104.1) 160 ms 157 ms"

Reverse DNS lookup for each as of 3/1/2003:
199.0.65.15              vpn01.penton.com.
199.0.65.1               (none, but part of penton.com)
144.228.25.93            (none, but part of sprintlink.net)
144.228.20.101           (none, but part of sprintlink.net)
192.157.65.122           (none, but part of icp.net)
192.203.229.246          mf-0.enss145.t3.ans.net
140.222.58.2             (none, but part of ans.net/uunet (whois lookup))
140.222.56.222           (none, but part of ans.net)
140.222.72.2             (none, but part of ans.net)
140.222.104.1            (none, but part of ans.net/uunet (whois lookup))
140.222.64.3             (none, but part of ans.net)
140.222.80.1             (none, but part of ans.net)
140.222.25.2             (none, but part of ans.net/uunet (whois lookup))
140.222.40.1             (none, but part of ans.net)

And this one:
140.222.104.1            (none, but part of ans.net/uunet (whois lookup))
Was the one left unmarked when lines were crossed through others in the list.

An a "w"-like listing:

tills ----- ttyp0 18:24
fxzodiac -- ttyp4 00:15
almann      ttyp9 00:55 
new         ttypa 23:58
root ------ ttypd 15:13
pshepard    ttype 00:43

A different view of different information:

root     ttyq0 ---- 13:40 support
vyper    ttyq3 ---- 00:15 benj      ttyqb
friskykd ttyq7 ---- 00:52 root      ttyqc
root     ttyqb      10:22 cynthial  ttyqd
root     ttyqc ---- 16:27 flavor    ttyqe
james    ttyqe      11:52 wgregory
cabrown  ttyrb ----

The username "james" matching "wgregory"
Another screen that is a bit different:

TELOS.EU
23.75.341

SECOR.OMS
23.755.342

EMU.JA
23.75.343

HRM.BRO.COM
23.75.344

GMS.WRLD
23.75.345

She also seems to have interest in "friskykd"

She saves the photo image and ID of "Jeff Gregg" as "gmsFile.DOC"
Archangel described Angel as "brunette" but she looks more like a redhead. Possible use of hair dye to alter appearance from description.
To hide, an example of blending into a crowd is offered (she joins the march/parade.)

At Moscone Convention Center ("4th Annual Pan-Pacific Computer Convention" and the "Cathedral Booth") she gets to the Cathedral Software Inc. booth and uses one of their computers to access e-mail.

PROGRAMS      ---------------------------------------------
SYSTEMS       |    C a t h e d r a l   S o f t w a r e    |
APPLICATIONS  |   I n t e r n a l  S y s t e m  M e n u   |
COMMAND       ---------------------------------------------
------------  | P r i n t e r  S p o o l e r              |
|          |  | F i l e   S e r v e r / 1 s t  f l o o r  |
------------  | F i l e   S e r v e r / 5 t h  f l o o r  |
              ---------------------------------------------
              | H .  S t o r a g e                        |
              | M a n a g e m e n t                       |
              | O p t i c a l   A r c h i v e             |
              ---------------------------------------------
              | T e r m i n a l   E c h o                 |
              ---------------------------------------------
              | F a c i l i t i e s  M a n a g e m e n t  |
              | A c c o u n t i n g  &  R e c o r d s     |
              | E l e c t r o n i c  M a i l              |
              | I n t e r n e t w o r k   R o u t i n g   |
              ---------------------------------------------

From above, chooses e-mail:

-------------------
| Forward Mail    |
| Copy Mail       |
| Print Mail      |
-------------------
| Change Server   |
| Mail Utilities  |
-------------------
| Main Menu       |
-------------------

She chooses "Change Server"

Enters information on where to send a message:
(Lot's wrong here... generally, you pick up mail from POP, and send with SMTP, and like most of the movie, an invalid IP address - not enough octets filled and a value over 255, and then the server name contains a "_" which is not allowed in DNS which are permitted to have letters, numbers and "-" so long as the "-" is not next to a "." and "." so long as they are preceded/proceeded by a letter/number.)
```
              SWITCH MAIL CENTER
IP Address: 52.136.434
POP Name: POP.FBI.DOJ
Server Name: FBI/DEPT_OF_JUSTICE
Password
Call Time:
Private Net #:
Port Number:
your Name: Bennett, Angela
```

New screen with web-like mail program

                U.S. Department of Justice
 F e d e r a l   B u r e a u   o f   I n v e s t a g a t i o n
     -----------------------------------------------------
       E l e c t r o n i c   M a i l   S e r v e r

    ----------------------        ---------------------- 
TO: |bcg@fbi.justice     |  FROM: |User ID 345489-2    |
    ----------------------        ---------------------- 
    ----------------------        ---------------------- 
RE: |Praetorian Evidence |  ENCL: |GS_FILE.DOC         |
    ----------------------        ---------------------- 
MESSAGE:
----------------------------------------
|I have been witness to serious crimes |
|committed by, and on behalf of, Jeff  |
|Gregg, the founder and president of   |
|Gregg Systems. Attached to this       |
|message is evidence of these facts.   |
----------------------------------------

Angela switches disk for the one with the "virus" seen at the beginning of the movie, such that when the antagonist presses "ESC" virus code infects the gatekeeper system.
(Hmmm. Nifty virus - one that infect a machine just by having an infected floppy inserted into the machine and nothing on the disk run.)
(Also nifty that this virus can infect a remote server through a network API that it knows nothing about

(C) 2006, 2005, 2004, 2003, 2002, 2001 Passwall.com. Copyright Information: Any of the above content that was created by me may be copied so long as each copy includes this copyright and links back to this site with reference to source and the content not be used for financial gain.

(C) 2006, 2005, 2004, 2003, 2002, 2001 of information included above with explicit credit to people other than me who have submitted documentation, additions, corrections. You will need to get their permission to use their included content.

I do not provide screenshots from movies, or downloadable movies for any films to avoid issues with Copyright infringement. It is my intention to legally provide news, information, trivia, and discussion about films and ensure content is not illegally reproduced. If you control Copyright to any of these movies and will extend to me permission is writing to capture screenshot images to be used on the web, please let me know!

If you have suggestions on additions, feel free to e-mail them to me. Please use valid e-mail addresses so I can reply to you. I like to offer credit to people for their submissions. When you provide your submission, please specify what name should be credited with the information provided and if you would like to have an e-mail link to your address or a URL to your home page.

Useless Trivia: Movie reviews with respect to computer security.