textfiles/magazines/WORDOFGOD/wordgod4.txt

                      #####################################     +
                     /##   T h e  W o r d  O f  G o d    ##     +
                    |/##    A -=MINISTRY=- Production    ##   +++++
                    |/## Hotel Chelsea  -  Sam Hain      ##     +
                    |/## Fungus Land    -  Malignant     ##     +
                    |/##                      Growth     ##     +
                    |/## Ulterior Motives - GenesyS      ##     +
                    |/##+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+##     +
                    |/##                                 ##
          /#########|/#####################################
         |/## Issue |/////////////////////////////////////
         |/## Number ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         |/## ------ FOUR  (4)    ##
         |/##      January 1990   ##
         |/#########################
         |//////////////////////////
         ~~~~~~~~~~~~~~~~~~~~~~~~~~
         This is it!!!  Our FOURTH issue.  I never thought it would last
         this long.  HAPPY NEW YEAR!!  As a 1990 special issue, we are
         including HACKING Voice Mail Box systems, a BIG list of GOOD
         numbers to call, and some other ideas we have...  A bit of the
         information in this issue has been printed elsewhere, but ALL will
         have new ideas and techniques, making them a seperate article.
         Well, Enough TALK - More INFORMATION!!!


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Hotel Chelsea - (206)/pri-vate
      -Now an uncensored information bulletin board.  Any legal (remember
       the first amendment) information can be posted.  Call!
   Fungus Land - (206)/pri-vate
      -a TRIAD distribution Site.  Running at 9600+ (I believe.)  One of
      the best pirate boards in Washington State.
   Ulterior Motives - (206)/pri-vate
      -Former home of NSoC, but now (after the merge) they are in with FFA
      in a new group called THE GUiLD.  They have put a few items out, and
      more are coming.  Very promising.
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   LOCKPICKLOCKPICKLOCKPICKLOCKPICKLOCKPICKLOCKPICKLOCKPICKLOCKPICKLOCKPIC

    You know those round keyholes that look like a bitch to pick?  (you see
    them on pop machines and IBM-AT console locks.)  Well, fret not
    anymore, since all you need to open them up is some art supplies.

    INGREDIENTS:
    ------------
    1 small ball of air hardening clay (steal this from Art 101)
    1 pair of shoes

    Now...  take this lump of soft clay and, after making sure no one is
    looking, push it into the keyhole.  After packing it in good, pull it
    out.  It should be in the shape of the keyhole.  If not, roll it up
    and try again.  Now, leave for a while and let the clay harden fully
    (usually an hour or three.)  Then, go back, check for unwanted viewers,
    open up the machine, and grab the dough and whatever inside turns you
    on.

    Now, you may be asking yourself, 'What does my pair of shoes have to do
    with this?'  WELL, they are very important in case you ARE seen.  If
    Principal Bob comes-a-runnin', just drop key, and give with a step.  NO
    evidence.  "But the machine was open already sir..."
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    HACKING VOICE MAIL SYSTEMS

    Most VMS's are similar in the way that they work.  They store the voice
    in different ways: digitally compressed, magnetic tape, etc.  There are
    many different VMB companies, but I will just examine a few of the more
    popular systems...

    CENTAGRAM
    ~~~~~~~~~
    These are direct-dial (you do not have to enter a box number.)  To get
    on one of these, first have a number to ANY box on the system (scan
    randomly.)  All of the other boxes will be on the same prefix.  Just
    start scanning them until you get a message saying that the person you
    are calling is not yet available.  This means that the box has been
    created, but is not owned by anyone yet.  Before the lady tells you to
    leave a message, press the # button  You will then be asked for your
    password.The password will usually be the same as the last 4 digits of
    the box number, or easy-to-remember #'s like 1000, 2000, etc....
    Once you get on, they are very user-friendly, and you will get a list
    of options.  If you can't find any empty boxes, or you want to create
    some for yourself, the system administrators box # is 9999 on the same
    prefix as the other boxes.

    SPERRY LINK
    ~~~~~~~~~~~
    These are very nice systems, but very hard to hack because you must get
    a user ID (different from a box number) and a password.  When it
    answers, if it says "This is a Sperry Link voice station.  Please enter
    your user ID," you will have to start trying to find a valid user ID.
    On most Sperry's, it will be a five digit numebr.  If it answers and
    says, "This is an XXX answering Service."  You first have to dial *# to
    get the user number prompt.  Once you get a valid user number, you will
    have to get the password.  It will be 4 digits long.

    RSVP
    ~~~~
    This is the WORST VMB, but VERY easy to get an account.  When it
    answers, hit * for a directory of the boxes on it (it only holds 23.)
    If yo hit # you will be given a menu of choices, and when you choose an
    option, you will be asked for your ID number.  This is usually the same
    as your User number, which are always only 2 digits long.

    A.S.P.E.N.
    ~~~~~~~~~~
    OCTEL TELECOMMUNICATIONS makes the Aspen system, and it is one of the
    best VMS's around.  To get a box on Aspen, you need to find an empty
    box.  To find an empty box, just scan box numbers.  If one says "You
    entered XXX.  Please leave a message at the tone." then this is an
    empty box.  Just press # and when prompted for your box number, enter
    the number of the empty box.  The lady will guide you through setting
    up your box.  She will then ask for "Your temporary password."  This is
    usually the same as the box number, 4 digits long, or a number like
    1000,2000, etc...  You can make a Distribution list for where you want
    a message to go, set it up so that a password must be entered before a
    caller hears your greeting, etc..  The System Managers account gives
    you complete control over the system.

    LIST OF VMB SYSTEMS ACROSS THE US-
    1-800-222-0311                      1-800-321-6366
    1-800-759-5000
    ______________________________________________________________________

    Hacking CABLE -
     (This is written from MANY different Text files.  Not all techniques
     have been tested yet.  If you have a different way to hack CABLE, then
     call one of the -=Ministry=- Nodes and tell us!)

    There are four methods of pay-channel security that are used most
    commonly.  Each type has different methods of using the cable-ready
    receivers.

    JAMMING:
    ~~~~~~~~
      A Jamming signal is placed between the picture carrier and the aural
      carrier of the secured channel.  The Cable operator supplies a filter
      for each customer for each pay-channel they subscribe to.  This type
      of security can be defeated by using homemade NOTCH filters
      (discussed later.)

    TRAPPING:
    ~~~~~~~~~
      In this system, frequency filters are installed in-line with the
      cable drops on telephone poles.  The traps are removed for customers
      paying for the premium channels.  Cable Ready Tc's work fine in these
      systems.

    SCRAMBLING:
    ~~~~~~~~~~~
        THE GATED SYNC METHOD
          Scrambling in Cable TV still means pulled sync suppression.  In
          it's simplist form, amplitude of the picture carrier is reduced
          by 6 db during the horizontal blanking intervals and sometimes
          during the vertical blaking intervals.  The resulting video
          signal has sync tips between the black and white levels.  Sync
          seperators in the set cannot operate properly with this signal,
          nor can AGC and colour circuits, so the picture is scrambled.

          A decoder compensates by antennuating the signal during the time
          in which the transmitted signal was not antennuated.  In order to
          accomplish this, the logic controlled gain switch must get timing
          information.  In-Band systems transmit pulses as amplitude
          modulation of aural carrier or a seperate carreir in out-of-band
          systems.

       OUT-OF-BAND-SCRAMBLING
          The usualt set-up is that the decoder is connected directly into
          the cable ahead of the channel converter.  Decoding is done at
          the pay channel frequency.  The decoder is likely to be in a
          seperate box, added to an old system to provide pay channels.
          The box consists of a simple (90-1290 Mhz) receiver for the
          our-of-band data carrier and a broad band 6Db gain switch.  There
          is provision for several scrambled channels, each with a
          different data carrier.

          This system is directly compatible with cable-ready receivers.
          Without the cable converter, the decoder is connected to the TV.
          Tuning and remote features of the TV are preserved with the only
          inconvenience being the need to operate the switch on the decoder
          when changing to and from any scrambled channel.  Out-of-band
          systems tend to last untilt he operators using them rebuild to
          provide for a large increase in the number of channels.


        IN-BAND-SCRAMBLING:
          In this system, any number of the available channels can be
          scrambled.  Because the data carrier for each scrambled channel
          is in it's own aural carrier, only one data reciever (at the
          aural carrier - i.e. Channel 3) is required.  The decoder detects
          the presence or absence of data automatically switching itself in
          or out.  The convertor-decoder box can be hardwired to decode
          just the channels ordered, using a prom-like device.
          Alternatively, the transmitted channels can be tagged by time
          division multiplexing binary tag (program identification) data
          with the sync data on the aural carrier.  The decoder boxes can
          be wired for tiers (groups of programs the cable operator sells
          together) rather than fixed channels, giving the operator more
          flexibility.

          The decoder boxes can be addressable.  These boxes have a
          seperate out-of-band data channel for data from the head end.
          Each box has a serial number burned into it's logic or otherwise
          available to its logic circuitry (EPROM), and it's channel or
          tier authorization stored in volatile RAM.  A computer at the
          head end periodically addresses all decoders in the system
          individually and loads each with the channel or tier capacity
          ordered by the customer.  The need for house calls is reduced,
          Pay-per-view is possible, and missing boxes can be turned off,
          rendering them useless for premium channel viewing.  Some, but
          not all, of these features can be programmed into out-of-band
          systems

          Aside from their ability to generate sync pulses, thus foiling
          the scrambling system, cable ready TV's have presented another
          difficult problem for in-band systems.  Because the decoder
          operates at the converted channel, a channel converter is
          required ahead of it.  Whether the TV reciever is cable-ready or
          not, it operates only at the converted channel,w asting the
          tuning and remote control features.

    *YAWN*  So, now you're wondering how to bypass all those security
    methods, right?  Well, there are MANY ways, and each depends ont he
    type of system you have.

    How to figure out if you have GATED SYNC SCRAMBLING.
          This is characterized by correct sound (you hear everyone talking
          just fine), and a picutre that is ALMOST normal, but looks like
          the vertical hold needs to be adjusted.  If you want to be 100%
          sure, call up your cable companies customer help line and ask.
          They will answer you, so you won't sound stupid.

    Where to pick up GATED SYNC decoder-units.
          Look in the back of elctronic magazines.  Not the yuppie ones
          like Popular Electronics, but the dedicated ones like
          Radio-Electronics or The Amateur Radio Tech Journal.

          You can get them for $35-60 from :
                J & W Electronics Inc.
                P.O. Box 800
                Mansfield, Ma.  02048
                (800)/227-8529  (orders)
                (617)/339-5372  (Tech info)

    How to figure out if you have SSAVI Scrambling.
          (Suppressed Sync Audio Video Inversion)
          The picture will look like a photograph negative, with  the first
          14 lines scrambling all around and very bad sound.  All the
          information is sent in the first 14 lines, so you DEFINITELY need
          a hardware device to sort through all this.

          THEORY - The suppressed sync signal is transfered from the first
          few lines of video transmitted (which are transmitted normally.)
          The box "sees" these 14 normal sync pulses and calibrates itself
          to reproduce these sync pulses for the rest of the frame of
          video.  It then inserts these pulses where needed in the signal
          to produce a normal picture.  This re-calibration for every frame
          is necessary, though.  Sync pulses over 500 times a second, and
          if the clock were not constantly re-vamped, it could get
          out-of-sync with itself.  The Audio is transmitted on a
          subcarrier at about 15 Khz.  All the box does is re-transmit the
          audio on the proper frequency.  The video signal is randomly
          inverted, but the mode can only be switched between frames, not
          between fields, making the job of detection, and re-inversion,
          easier.

          The ZENITH SSAVI Decoder (the inventor of the SSAVI system) is
          11" x 7" and about 2 1/2" tall (including rubber feet.)  IT has a
          round, vertical travel pushbutton switch in the rear left top
          corner, and in a samll metal label on the top center of the box
          is engraved ZENITH SSAVI-1.  There are 3 female F connectors on
          the left rear and a 3-pin power connector on the bottom right
          rear.  The case is brown, with a wood-grain strip running around
          the side.

          You can get a Anti-SSAVI box by writing to:
                Video Electronics
                3083 Forest Glade Dr.
                Windsor, Ontario N8R 1W6
                (519)/944-6443

       You can also obtain SSAVI boxes from them.  This is the REAL thing.
       That's why they are selling from Canada.  They guarantee that the
       SSAVI will work on these channels:
       Ann Arbor 31
       Baltimore 54
       Wash. DC  50
       Chicago   66
       Dallas    27
       Minneapolis/St Paul 23
       San Jose  48
       St. Louis 30
       Tulsa     41
       Boston    27

    They want $130 for the box, and a $21/month fee.  But htere are ways
    around that.

    Another trick is to call up your local Cable company and tell them what
    services you currently subscribe to.  Ask them if you would have to get
    a new box in order to get more channels.  They will say "no", because
    most of the boxes haev a small coputer in them which can be told over
    the cable which channels you are authorized to recieve.  This is the
    same computer that decides wheteher the channel you want to watch needs
    the descrambler.  If they say yes however, you are in good luck.  If
    they say no, then you will have to change the authorization codes
    inside the box itself.  There are 2 ways to do this...

    Inside some of the boxes, there are 4 little dials (potentiometres.)
    Change to the station you would like to watch that is scrambled and
    adjust these until you gewt a good picture..  Howver, you may have to
    change them back when you want to watch a different station.

    Second way - Get a new box (whether stealing it, buying it hot, or
    whatever.)  open it up without destroying it (harder than it sounds)
    and look for a set of sockets without chips in them.  It will have
    wires in it instead.  Try to correspond the wires with the channels you
    pay for.  Then, try moving excess wires around in.. out.. other holes..
    etc.. until you get some of the channels you want.

    If it is programmed by the cable company, you have 2 more ways to avoid
    payment.  open up the box and find where the computer, descrambler, and
    receiver are.  unplug the computer and just hook the output of the
    receiver to the input of the descrambler.  This does not permit the
    computer to say which channels to block.

    The second way is to call your cable company and ask for ALL the
    services that you don't pay for.  They will program your box from the
    Hq's and bill you for it.  A week or so later, call back and ask for
    the poor-man's packagae again.  Tellt hem you didn't like the stations
    that you paid for.  Then, IMMEDIATELY, unplug your box from the CABLE
    in the wall.  Keep it unplugged for 2 or 3 days, then plug it back in.
    You will have to pay for one month service, but after that, it's just
    the normal price.  Now, if the box doesn't get power, it might run down
    and erase the authorization codes.  One way around this is to find out
    what voltage it is running with and plug it in with a voltage converter
    until the few days are up.  This would make the box think it was still
    running, but not actually receiveing any information.


    ---------------------------------------------------------------------

    Well, shit.  I didn't think I was going to get this one out this year.
    This may be the last issue until summer next year since I will be in
    Norway until June.  If you have any good hacking tips for Scandinavia,
    please tell me at either SAMHAIN @ UWACDC (Bitnet) or
                             RAVER @ MAX.ACS.WASHINGTON.EDU (internet)

    BTW - Good job on the internet hackers directory PHRACK.  That's a
    really good idea.  Anyone know how to use the chat relays on any of the
    UoW systems?
                Sam Hain