textfiles/phreak/beatcid.txt

                           Beating Caller ID
                              by The Fixer
                            v.1.03 98/08/30

(C) 1998 The Fixer's Tech Room

For free distribution - you may freely repost & distribute this but not
for profit without permission of the author.  See further restrictions
at the end of this file.


             To start off with - 12 Ways to beat Caller ID

(0) This doesn't count as a way to beat CID, but there's a general
    principle to consider when contemplating ways to beat CID.
    Generally, the CID signal your target sees corresponds to the owner
    of the dial tone you call him from.  If you call direct, you dial
    from your own dial tone and your line is identified.  If you call a
    third party, and by whatever means manage to acquire his dial tone,
    and from there dial out, it is the number associated with that
    second dial tone that your target sees.  Some of the ideas following
    this were developed with this basic idea in mind.

(0.5) This also doesn't count, but remember that beating Caller ID as
    such is only the first layer of your protection.  If your calling is
    sufficiently annoying or criminal, there is *always* a paper trail
    (ANI data, billing data, trouble reports, *57 traces, etc) leading
    back to the phone you first called from.  That trail is not always
    easy or worthwhile to track you down with.  Whether or not the trail
    is followed depends entirely upon how pissed off your target is and
    how much co-operation he can get from the phone company, law
    enforcement, etc.

(1) Use *67.   It will cause the called party's Caller ID unit to
    display "Private" or "Blocked" or "Unavailable" depending on the
    manufacturer. It is probably already available on your line, and if
    it isn't, your local phone company will (most likely - please ask
    them) set it up for free.  This is the simplest method, it's 100
    percent legal, and it works.

(2) Use a pay phone.  Not very convenient, costs 25 or 35 cents
    depending, but it cannot be traced back to your house in any way,
    not even by *57.  Not even if the person who you call has Mulder and
    Scully hanging over your shoulder trying to get an FBI trace (sic).
    Janet Reno himself couldn't subpoena your identity.  It's not your
    phone, not your problem, AND it will get past "block the blocker"
    services.  So it's not a totally useless suggestion, even if you
    have already thought of it.

(3) Go through an operator.  This is a more expensive way of doing it
    ($1.25-$2.00 per call), you can still be traced, and the person
    you're calling WILL be suspicious when the operator first asks for
    them, if you have already tried other Caller ID suppression methods
    on them.

(4) Use a prepaid calling card.  This costs whatever the per-minute
    charge on the card is, as they don't recognize local calls.  A lot
    of private investigators use these.  A *57 trace will fail but you
    could still be tracked down with an intensive investigation (read:
    subpoena the card company).  The Caller ID will show the outdial
    number of the Card issuer.

(5) Go through a PBX or WATS extender.  Getting a dial tone on a PBX is
    fairly easy to social engineer, but beyond the scope of this file.
    This is a well-known and well-loved way of charging phone calls to
    someone else but it can also be used to hide your identity from a
    Caller ID box, since the PBX's number is what appears.  You can even
    appear to be in a different city if the PBX you are using is!  This
    isn't very legal at all.  But, if you have the talent, use it!

(6) I don't have proof of this, but I *think* that a teleconference
    (Alliance teleconferencing, etc.) that lets you call out to the
    participants will not send your number in Caller ID.  In other
    words, I am pretty sure the dial tone is not your own.

(7) Speaking of dial tones which aren't yours, if you are lucky enough
    to live in an area with the GTD5 diverter bug, you can use that to
    get someone else's dial tone and from thence their identity.

(8) Still on the subject of dial tones which aren't your own, you can 
    get the same protection as with a payphone, but at greater risk,
    if you use someone else's line - either by just asking to use the
    phone (if they'll co-operate after they hear what you're calling 
    about) or by the use of a Beige Box, a hardware diverter or bridge 
    such as a Gold Box, or some other technical marvel.

(9) This won't work with an intelligent human on the other end, it
    leaves you exposed if the called party has a regular Caller ID box
    with memory, and has many other technical problems which make it
    tricky at best and unworkable for all but experts.  A second Caller
    ID data stream, transmitted from your line after the audio circuit
    is complete, will overwrite the true data stream sent by the telco
    during the ringing.  If the line you are calling is a BBS, a VMB, or
    some other automated system using a serial port Caller ID and
    software, then you can place your call using *67 first, and then
    immediately after the other end picks up, send the fake stream.  The
    second stream is what the Caller ID software processes, and you are
    allowed in.  See the technical FAQs below for an idea of the
    problems behind this method; many can be solved.

(10) Someone in alt.2600 (using a stolen AOL account, so I can't credit
    him or her properly) suggested going through 10321 (now 10-10-321)
    or 10288.  Apparently using a 10xxx even for a local call causes
    "Out of Area" to show up on the Caller ID display.  I live in Canada
    where we don't have 10xxx dialing so I can't verify nor disprove
    this.

(11) There are 1-900 lines you can call that are designed to circumvent
    Caller ID, ANI, traces, everything.  These services are *very*
    expensive, some as high as $5.00 a minute, but they include long
    distance charges.  This was first published in 1990 in 2600
    magazine, and in 1993 the IIRG reported that 1-900-STOPPER still
    works.  Beware - even if you get a busy signal or no answer, you
    will get charged at 1-900 rates!  Another one published in 2600 in
    1990: 1-900-RUN-WELL.  That one supposedly allows international
    calls.  I'm not about to call either one to find out.  Note that you
    could still be caught if the operators of these services were to be
    subpoenaed.

(12) Use an analog cellular phone.  Most providers of plain old analog
    service show up on Caller ID as "Private" or "Out of Area" or a main
    switchboard number for the cell network.  This is becoming less and
    less true as cellular providers move to digital cellular and PCS,
    which pass the phone's number on Caller ID.  Corollary: Rent a
    cellphone by the day.  This might even be cheaper than using a
    prepaid phone card.




                          How Caller ID Works

Caller ID is a data stream sent by the phone company to your line
between the first and second ring.  The data stream conforms to Bell
202, which is a 1200 baud half-duplex FSK modulation.  That is why
serial Caller ID boxes run at 1200 baud.

The data stream itself is pretty straightforward.  Here's an example:

UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU<EFBFBD>'^D032415122503806467x

The first thing of note is the 30 U's.  Those are actually sync pulses.
A "U" is 55 hex, or 01010101 binary.  This is called the "Channel
Siezure Signal."

After that comes 130 milliseconds of 1200 Hz (the Bell 202 "mark"
frequency) which usually shows up in the datastream as a character or
two of garbage.

That is followed by the "message type word", which is 04 hex for
standard Caller ID, 07 hex for Name & Number.  A word, by the way, is 8
bits for our purposes.

That is followed by the "message length word" which tells us how many
bytes follow.

The next four bytes are the date, in ASCII.  In the example above, the
date is 0324, or March 24th.

The next four bytes after the date are the time, also in ASCII.  In the
example, the time is 1512, or 3:12pm.

The next 10 digits are the phone number that is calling.  In the
example, the phone number is 250-380-6467.  The number is also in ASCII
and doesn't contain the hyphens.  Some phone companies will leave out
the area code and only transmit 7 digits for a local call, others will
always send the area code as well.

If this were a name-and-number Caller ID data stream, the number would
be followed by a delimiter (01h) and another message length byte to
indicate the number of bytes in the name.  This would be followed by the
name itself, in ASCII.

If this call originated from an area that doesn't support Caller ID,
then instead of the phone number, a capital "O" is transmitted (4F hex).

If the call was marked "private" as a result of the caller using *67 or
having a permanent call blocking service, then instead of the phone
number, a capital "P" (50 hex) would be sent.

The very last byte of the data stream is a checksum.  This is calculated
by adding the value of all the other bytes in the data message (the
message type, length, number and name data, and any delimiters) and
taking the two's complement of the low byte of the result (in other
words, the two's complement of the modulo-256 simple checksum of the CID
data).



                          Some Technical FAQ's


Q: When I block Caller ID with *67, does it send my number anyway and
   just set a "private bit" so that the other person's Caller ID Display
   unit won't display it?

A: No.  The person you're calling doesn't get your phone number anywhere
   in his data stream if you block your call that way.  All he/she gets
   is "P" and the date/time of the call.

   I would like to refer to an experiment I performed in March, 1998
   with a Serial Port Caller ID, which delivers the raw data stream to a
   PC for software interpretation.  The following Usenet message (edited
   for this file) is the report I published on that experiment:

        Newsgroups: alt.2600
        From: The Fixer <fixer@bc1.com>
        Date: Tue, 24 Mar 98 16:12:58 -0800
        Subject: Caller ID and *67 - The Facts

        OK, it's time to shovel the bullshit which is piling up in this
        newsgroup about Caller ID.

        A few people are saying that when you block your Caller ID with
        *67, the switch sends your number anyway along with a so-called
        "private bit" that tells the Caller ID display unit to suppress
        display of the number.

        In order to squelch those who'd rather flame back with "show me
        proof" than just read a FAQ, here is the proof.  These are
        actual raw data captures from a Bell 202 demodulator (better
        known as a serial port Caller ID) which I captured myself today.
        They prove conclusively that the "Private Bit" is a myth.

        Here is what I got in my raw data stream when I called my voice
        line from one of my BBS lines (which is unlisted, hence the
        PRIVATE string in the name field):

        UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU<55>'^A^H03241512^A2503806467^G^OPRIVATE        x

        This is what I got when I did the same thing with *67:

        UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU<55>^P^A^H03241512^D^AO^H^AP(<28>

        The number I was calling from was 250-380-6467.  That string is
        clearly displayed in the first (non *67) call.  In the number
        field of the second call, only the letter "O" is transmitted.
        In the name field, only the letter "P" is transmitted.

        In both calls, the date and time (03/24, 15:12) is transmitted,
        but transmission of the calling telephone number is suppressed
        in the second call.  There is no "private flag" suppressing
        display of the number by the display unit; the calling number is
        not transmitted at all!

        For those of you unfamiliar with the CID raw data stream, the
        U's are actually sync pulses (an ASCII "U" is 01010101 binary).
        The control characters are field delimiters.  The first 8-digit
        number is the date and time in MMDDHHSS format.  The second
        number in the first call is the phone number, in NPANXXXXXX
        format.  That is followed by the name (for those of us with name
        & number CID).  The ^O (0Fh) just before the name indicates how
        many characters are in the name - in this case "PRIVATE" is
        padded out with 8 spaces (20h) to make 15 characters.  At the
        very end is an 8-bit checksum.

   Believe me, if I were wrong about this, there would be a huge
   marketing frenzy to sell "*67 proof Caller ID boxes" and I would be
   making a fortune selling my Serial Caller ID software, which works
   directly with the data streams illustrated above!


Q: Can't I just send noise down the line to scramble the Caller ID
   signal between the rings?

A: No.  Your phone line doesn't generate the Caller ID signal.  It is
   made by the switch on your calling party's line, and the audio
   circuit between your line and his is not completed until after he
   picks up the phone.


Q: Do 1-800 numbers have Caller ID?  Can I hide my identity from them?

A: Some do have Caller ID, and the *67 block will work, but many more
   have realtime ANI - Automatic Number Identification.  This is an
   older technology which uses a separate line to deliver your number,
   and cannot be blocked.  And all 800 subscribers get a list of
   everyone who called them on their monthly bill, blocked or not.


Q: Can I hide my identity by sending a fake Caller ID signal down the
   line before they answer?

A: *Generally*, no.  The audio circuit between your phone line and their
   line is not completed until the other party picks up.  Once they do,
   they would hear your fake signal and know what you were doing...
   unless the person you're calling is very poorly informed or
   untrained.  Even so, most Caller ID devices have memory and so the
   person you're calling could just as easily scroll back through the
   box's memory and find your true number.

   Once upon a time, the phone system worked differently, and the audio
   circuit WAS connected even before the called party picked up.  A
   device called a "mute" or a "black box" was used to take advantage of
   this fact and allow anyone calling a line with a black box to do so
   toll-free.  If the system still worked that way (and there's no
   technical reason why it couldn't in these days of digital switching)
   then yes, it would be very feasible to send a fake Bell 202 data
   stream down the line; in fact you'd hear the real one every time you
   called someone with Caller ID and you'd get a really good feel for
   the timing involved.  But if it worked that way, then black boxes
   would also still work, and they don't.


Q: How about *69?  If I protect my call using *67, can they still call
   me back?

A: Not in 604/250 anyway, and probably not most places.

   Some interesting notes about this:  When *69 was first introduced
   here in 250, if you tried to *69 a blocked call, you would get a
   recording telling you that the number could not be announced.  And it
   would then offer to connect you anyway!  I guess it was business who
   asked for the change because that meant a telemarketer using *67
   would have people call back and their switchboard answer "Sleazebag
   Marketing, how can I help you?".  At that point the number was a
   white pages lookup away.  So BC Tel, and I would venture to guess its
   parent company GTE and many others, changed it so that *69 won't even
   call back.

   If you find in your area that you CAN call back with *69 to a *67
   protected number, you're a lucky sonofabitch!  Why is that?  Well,
   with the "old" working of *69, you may still be able to get the
   number of a blocked caller if you are (a) lucky and (b) patient. Take
   your phone off the hook until midnight (if it's a business) or early
   afternoon (if it's a person). THEN activate *69.  No incoming calls
   will have come into your line since it was off-hook, so your line's
   *69 last-call register will still have their phone number in it, and
   at those times you are far more likely to get an answering machine
   which may spill the beans as to who called you... clever huh?




                               Final Word


Caller ID can be worked around in so many ways that it really offers no
value to its subscribers.  I am not against the existence of Caller ID,
as I have been on the receiving end of harassing phone calls and slimy
telemarketers, all of whom I've been able to put in their place thanks
to this technology.  There's no doubt that Caller ID can help bring
those who deserve it to justice.  But at the same time, we all have the
right to privacy, and the option to not share your identity with someone
you're calling is, and always should be, available.

For this reason, I think that Caller ID should be available free on
every line as part of the basic service.  It's worth nothing anyway!

---------------------------------------------------------------------------

That's it.  This file may be updated as I receive more information.
Look for updates on my web site at

        http://ranchonevada.home.ml.org

or
        http://ranchonevada.ml.org

or if that doesn't work,

        http://A3A18294.sympatico.bconnected.net

---------------------------------------------------------------------------

This file is a freely-distributable copyrighted work.  You may repost
this file free of charge without modifications, but no for-profit
distribution is allowed without prior arrangement with the author.

Two individuals who have stolen my work in the past are hereby
prohibited and enjoined from possessing or distributing this file:
Pinhead the Cenobite and Jolly Roger.  If you are either of these
individuals, you must delete this file from your system now.  If you are
not, you may not knowingly allow either of these individuals to receive
this file if it is in your power to prevent such reception.  Retention
of this file on your system or on any backup constitutes acceptance of
this term.

(C) Copyright 1998 The Fixer's Tech Room, a division of Whirlwind
    Software (British Columbia).  All rights reserved.