Grade "A" Hacking (Autumn 1989) 
-------------------------------
By The Plague

What is UAPC?

UAPC stands for University Applications Processing Center. This is a computing
and data processing facility that deals with academic record keeping and
processing. One of their jobs is to process student applications for CUNY (City
University of New York) schools. Another job, and this is the part that
interests us most, is to process student records for the New York City public
high schools.

Nearly all New York City public high schools are connected to UAPC. There are
116 public high schools in New York City (with several hundred thousand
students). The reasons for interconnection are obvious. If every school had its
own student data storage computer, its own proprietary software, and its own
staff trained on that particular system, the cost would be too great. Not only
that, but data transfer and statistical analysis would be impossible for the
school system as a whole. As an example, there would be much paperwork, chaos,
and confusion just to transfer a student from one school to another. Computing
the drop-out rate and other valuable statistics like standardized test scores
would involve every school sending in reports generated by its own computer
system, and hence more paperwork, more bureaucrats, and more confusion.

So now you understand why all NYC high schools are linked by modem to this one
computer. All grades, attendance, course records, and schedules for every New
York City high school student are stored and processed at UAPC.

Where is UAPC?

UAPC is located in Brooklyn at Kingsborough Community College (across from
Sheepshead Bay at the far end of Manhattan Beach). The actual computers and
personnel are in Building T-1 (or simply building ONE). If you happen to go
trashing there sometime, building T-1 is a one-story tan colored aluminum shed.
It looks sort of like a gigantic tool shed. Above the entry door is written
"ONE" in large black plastic lettering. By the way, you re allowed to go in.
Nobody is going to check ID or anything like that. If you look like a student,
no problem. The reason for this is that T-1 connects to T-2, another shed (blue
in color), which has many classrooms. The actual UAPC office is directly to
your right as you enter T-1.

In each New York City high school, there is something called a "program office."
This room usually contains terminals and big printers and it's where each
school creates class schedules for teachers and students, among other things.
The staff that work in these offices are trained at UAPC.

Technical Information about UAPC

Enough background; here's the scoop. UAPC computers run on IBM mainframes (IBM
370 and 3090). The virtual operating system that is used is MVS (which is much
like the familiar VM/CMS). On top of MVS runs Wylbur (pronounced will-burr, not
while-birr), which is sort of like a command shell plus a batch language plus an
editor all rolled into one. On top of Wylbur, run the actual applications
(jobs) for processing of grade files.

There are several applications for various tasks (entering grades, entering
attendance, class scheduling, generating transcripts, and various other
reports). These applications are written in a batch-like language and are
stored on disk in source code format. The reason for this is that each school
has its own way of doing things (i.e., naming conventions for classes and
sections), and the batch programs can be modified by either UAPC or qualified
people who work in each high school's program office. These applications are
submitted to run on the IBM machines with the JCL code appended at the top of
each application.

Each school connects to UAPC via a terminal and modem and each school is
allocated its own directory (or library as the batch-heads call them) on the
system. This directory contains the applications (jobs) that the school uses
each day for various activities. Data files are also contained in these
directories. The data files are in a pretty much IBM standard format (although
stored in EBCDIC instead of ASCII). Input records for each application are
usually fed in using punch cards or scan-tron type readers at the local school.
If you've ever gone to a New York City high school you'll know what I mean: The
attendance punch cards are brought down each day from each homeroom to the
program office. Also, each teacher would fill in attendance forms (used to
detect class-cutting) using a number-2 pencil. These forms look like the test
forms for the SATs.

Sometimes, however, input is entered manually at the terminal in the program
office, usually for query type jobs. For instance, if one student lost his
class schedule and wanted a replacement, he would have to go to the program
office and ask for one. They would run that application on the terminal, print
up a schedule for that student, and give it to him.

How Do You Know if Your School is on UAPC?

If you go to a New York City public high school, then the chances are 95
percent that your school is on UAPC. If you are not sure, look for the telltale
signs at your school. Does your homeroom teacher use punch cards? Is your
transcript laser-printed on white paper and divided into nice columns grouped
by academic subject? Does your school's program office contain terminals and
printers? Is your class schedule (aka program card) printed on 5.5"x7" paper
(either heavy-bond white or thin-bond blue)? Is your grade report (aka report
card) printed on computer paper, about 5.5" high (regular width) with a blue
Board of Ed logo in the middle, with explanation of grades (in blue) on the
back? Do you get little yellow or white laser-printed cards in the mail when
you play hooky or cut classes? Any of these sound familiar, boys and girls?
They should, because almost every New York City public high school fits all
these categories. If your school fits any of these (especially the punched
cards and terminals in the program office), then you can be sure that your
grades are lurking somewhere in the bowels of UAPC.

Logging on to UAPC

To get on, you're going to need a dialup. It's not too much work getting the
dialup, if you do a little snooping and trashing around the program office at
your school, you should find it written down somewhere. However, I will save
you some time and tell you that there are at least 12 dialups for UAPC in the
718-332-51XX number range and several in the 718-332-55XX range. There are many
more elsewhere (usually exchanges local to Kingsborough Community College).

You should only connect to UAPC on school days during valid school hours. You
can connect to UAPC at either 300 or 1200 baud. However, in an effort to thwart
people for finding their dialups, UAPC will not print anything to the screen
unless you connect at the right format and hit a few of the right keys.
Therefore, you should use the following procedure in order to connect: Call at
300 or 1200 baud, using 7 data bits, even parity and 1 stop bit (7E1), and
local echo (or half duplex). Once connected, hit the RUBOUT/DELETE key (ASCII
code 127 or 255 [hex $7F or $FF]) three times, and then hit return twice. You
will be greeted with the following:

  UAPC MVS390A LINE   10-TEN 11:59:02 03/22/89
  11:59 Wednesday 89-03-22
  You are signed on to U.A.P.C. Have a good day.
  TERMINAL?

When you are prompted for the terminal, just enter a letter-two-digit
combination (A99 works just fine).

You will then be prompted for "USER?" which is your school's login ID. The
format for the username is $HSxxn, where xx is a two-letter abbreviation for
your school's name, and n is a digit from 1 through 9, indicating the
particular account used by the school. N is usually 1, 2, or 3. An example of a
user ID is $HSST1 or $HSST2, which are the user ID's for Stuyvesant High School
in Manhattan.

You can guess at your school's user ID (it's easy enough, for instance
Sheepshead Bay High School would be $HSSB1 or South Shore High School would be
$HSSS1, etc.), but a better way is to pick up the trash from the program
office. You should find stacks of green and white printer paper that is 132
columns in width. The user ID will be almost everywhere throughout most
printouts generated. Remember to look for the $HSxxn format.

After entering a valid user ID, what you will see next depends on several
things. Normally you should see the "PASSWORD?" prompt, but on some accounts
you may also see a "JOB?" or "KEYWORD?" prompt. This simply depends on the
school, however 90 percent of the accounts only ask for the PASSWORD. The JOB
and KEYWORD are simply additional passwords. However, every user ID has a
PASSWORD on it. Usually only $HSxx1 accounts have JOB or KEYWORD passwords.
However most schools have several accounts (usually two or three), and the
$HSxx2 and $HSxx3 will usually have only the "PASSWORD?" prompt. There is no
difference in access privilege between the various accounts at each school.
They are simply there so that more than one terminal at each school can be
logged in at the same time.

Getting the Password

Naturally, you're going to need the password if you are serious about doing
anything with UAPC. There are several options here. However, one option that I
would not recommend is that you attempt to hack the password by brute force.
UAPC has a nasty habit of allowing you four attempts at the password before it
disables that account and notifies the security dudes at UAPC. If you disable
your school's account, your school's program office must call UAPC by voice in
order to reactivate it. There is a way around this, if you really want to
brute-hack the account. After three password attempts, you should hang up and
redial, and then do another three attempts, and so on. This will keep the
counter from ever reaching 4 and disabling the account. Although it's a pain in
the neck, there isn't much we can do about it. However, if you have no plans of
ever getting into UAPC and just want to annoy your school, simply log on as
them early each morning and disable their password. This will give them a
headache to say the least, having to call up UAPC each day to reactivate their
password.

Other ways of getting the password include our old favorite, social
engineering. Here there are two options. You can attempt to engineer UAPC by
voice, thus saying that you are the school and that you need the password.
Conversely, you can attempt to engineer the school by calling the program
office by voice and saying that you are from UAPC and that you need them to
change their password to a diagnostic password, which you will so kindly
provide. If you're going to do social engineering, make sure you get some valid
people's  names at either UAPC or at your school.

Yet another way to get the password is to do what was done in War Games,
snooping around the program office. They usually do not have the password
written down. But, and this is important, you can get the password if you can
somehow manage to look over the shoulder of the terminal operator when he/she
is logging in. Remember, they connect to UAPC at half duplex, and thus keys are
echoed locally, meaning that you will see the password on the screen as it is
typed. I know this for a fact.

If you're hardware inclined, you can tap the line that connects to the modem
and terminal. These lines are usually not connected to the schools switchboard,
and can even be exposed outside the building itself. Use a tape recorder and a
Radio Shack auto-pickup device to tape the transmission (which is usually 300
baud anyway). Play the tape into your own modem (set it on answer) and you'll
be able to see the originate data (including the password) on your screen. If
you haven't tapped modem lines before, I do not suggest using this method.

Note that UAPC requires each school to change their password once a month, so
make sure you get the password right after they change it. This will give you
plenty of time to learn how to use UAPC before you attempt any stunts with
modifying data.

All About Wylbur

Okay, you're in UAPC; what now? Well, once in you will be dealing with Wylbur.
Like I said before, Wylbur is sort of like a command shell plus batch language
and editor all built into one. You will know you're in Wylbur when you are
given a "COMMAND?" prompt.

There are some misconceptions about Wylbur that I would like to clear up right
now. When most New York City hackers talk about the "grades computer" they
simply refer to it as Wylbur. This is misleading because they are referring to
UAPC. Wylbur is not synonymous with UAPC; the Wylbur shell is used at many
different computing sites, which use MVS and IBM mainframes. It's sort of like
equating VAX/VMS to the computers at DEC. VMS is an operating system and has
very little to do with the machines at DEC headquarters. The same holds true
for Wylbur and UAPC.

Wylbur also runs on the other IBM machines at Kingsborough (which have
different dialups, separate from UAPC). These machines have no affiliation with
the UAPC machines. Therefore students using these other machines at
Kingsborough must know Wylbur as well. Lucky for us, you or any student can
purchase (no ID required) a Wylbur manual at the Kingsborough bookstore
(Building U) for $4. Just ask the nice lady for the "Wylbur User's Guide,"
written by Ganesh Nankoo, and tell 'em I sent ya. If you do get into UAPC, I
strongly suggest that you buy this manual. It is very informative and can keep
your ass out of hot water.

Some useful commands under Wylbur:

RUN PRINT: run the exec program in your active area and print the output. 

RUN FETCH: same as above, but place output in fetch queue.

FETCH*: fetch the last output and place into your active area.

LIST: list current active area to screen.

LIST OFF: list current active area to printer.

LOCATE: locate all jobs submitted.

LOCATE*: locate last job submitted.

LOCATE 056: locate job 056.

PURGE 056: purge job 056 which is on the output queue.

COLLECT: input/enter data into your active area.

CLEAR ACTIVE: clear your active file in memory.

USE #name: load the file "name" from disk into your active area.

SAVE #name: save your active area.

SET PSW: change your password.

SET KEY: change your keyword.

SHOW DIR: show current files in your directory.

SHOW USERS: show current users on UAPC.

(Note: Your active file is a buffer used by the editor. You can list it, save
it, clear it, load into it, run exec jobs from it, etc.)

You can also get help on UAPC by typing HELP HELP (yes, twice. One HELP will
not do the trick).

Applications That Run on UAPC

Once inside UAPC, you may have very little contact with Wylbur itself, and you
will see a "WHICH JOB?" prompt instead of the "COMMAND?" prompt. The reason for
this is because most of the time the applications are all automated and
accessed from menus that are run by batch files, which execute when you log in.

Thus, the system is very friendly. You may see a menu that asks you if you want
to view a transcript, view a schedule, admit a student, dismiss a student,
transfer a student, add classes, delete classes, etc. You simply choose what
you want to do. Via these menus you will be able to do anything that the school
administrators can do, including changing grades. Sometimes, however, there are
no menus, and you will have to execute commands yourself. A list of these
commands can be gotten using one of the HELP menus. Here are some of the jobs
you can execute: ABSCOR, ABSINFO, ABSREP, ACADROP, ACAINFO, ACAMSTR, ADDSECT,
ADDROP, ADRPLST, BATINFO, ABSINQ, CLASSLST, CODELIST, CUTINFO, CUTDEL,
FIXCODES, FIXOFCL, HITRAN, GRDUPDT, LATCOR, LATINQ, MAIL, NGRUPDT, OFCLLIST,
PUNRQST, REGISTER, REQADRP, REQINFO, REQUPDTE, SCAN, SCHEDULE, SKED, TRAN,
TRANUPDT.

You can drop straight into Wylbur by sending a <BREAK>. This will cause your
menu shell program to stop executing. If you happen to leave the menu system
and do drop into Wylbur (with its "COMMAND?" prompt) you can get back to the
menu system by typing RUN. This will execute the menu shell program that is
currently in your active area.

Remember that each time you or your menu program submits a job (i.e., to change
a grade), the job will be executed and the output will be placed on the fetch
queue. If you don't want to leave a trail, then you must use one of the above
Wylbur commands to find and PURGE the output of your completed jobs. If you do
not PURGE the output, it has a good chance of being printed out at the program
office when they print the output of all the jobs that they submitted.

Changing Grades

Clearly, this thought has crossed your mind in the past few minutes, so let me
begin by saying that I do not recommend changing any records on UAPC. You can
use UAPC to get all kinds of useful information on people and never get in
trouble.

If you do hope to change grades and get away with it, there are several things
to consider. You must remember that your guidance counselor has physical
backups of all your grades in his/her little notebook. If you've gone to your
counselor for advice on which classes to take, you'll recognize the book of
which I speak. The grades in this book are not generated by UAPC but instead
entered into the books at the end of each grading period by the counselors
using a pen or pencil. This physical record is only used as backup in case UAPC
gets wiped out or something like that. Comparisons between UAPC transcripts and
the physical record are almost never done, unless there is some kind of
disagreement between the student and the school regarding the transcript
itself. If you do plan to make a clean run, you had better cover all the
angles. This means bribing some stupid kid to borrow the book for a little
while so that you can make some modifications, give the dude $20, and make sure
he doesn't know who you are.

Guinea Pigs

Before modifying either your physical record or your UAPC grades, I would
strongly suggest using a guinea pig test subject. What this means is that you
should pick some kid, any kid, who goes to your school and that you have never
met and never plan to meet, change their grades, purge the output on the fetch
queue, sit tight for a few days, and watch what happens. Keep a close eye on
your test subject. If you notice the kid getting suspended or federal agents
running around your school or something like that, you know that you better not
mess with UAPC, at least not in your school anyway. If nothing happens, then
you should decide whether to take the risk of changing your own grades.

If you consider the use of innocent human guinea pigs to be distasteful, then
you had better be prepared to risk your ass by using yourself instead. I do not
consider it to be distasteful, but then again I am devoid of all ethics and
morals anyway.

You can still bail out at this point and your life will proceed normally.
However, if you do change your grades (both physically and on UAPC) and nothing
happens to you for several weeks, you can be almost 100 percent sure that you
got away with it. Since both records (physical and UAPC) have been changed,
there can be no discrepancies. Only your previous teachers will know what
grades they gave you, and by now they will have forgotten who you are. Only
your transcript speaks for them now. If you do get away with it, you can start
mailing out those applications for Stanford and MIT.