746 lines
34 KiB
Plaintext
746 lines
34 KiB
Plaintext
|
|
|||
|
|
|
|||
|
|
***************************************************************
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* Phreaks *
|
|||
|
|
* *
|
|||
|
|
* Long Distance Phone Thieves *
|
|||
|
|
* *
|
|||
|
|
* OR *
|
|||
|
|
* *
|
|||
|
|
* The Phreaker's Handbook *
|
|||
|
|
* *
|
|||
|
|
***************************************************************
|
|||
|
|
MCI
|
|||
|
|
|
|||
|
|
MCI is the Queen Mother of the long distance companys. There are
|
|||
|
|
only a handful of companys that are "networked". This means
|
|||
|
|
they've built their system to a point where travelers (or phreaks
|
|||
|
|
can call into a local phone number and be in the "network" even
|
|||
|
|
if they're three thousand miles from home. The exception is when
|
|||
|
|
you're in an area that isn't serviced. Most LD services utilize
|
|||
|
|
800 numbers so that you can connect even if you're out in the
|
|||
|
|
boonies.
|
|||
|
|
|
|||
|
|
Here we have two different code formats, one for the so called
|
|||
|
|
"executive" user, primarily business , the other for the average
|
|||
|
|
person. Executive class entails using the 950-1022 dialup. To
|
|||
|
|
make a call you need to enter no less than thirty two digits. You
|
|||
|
|
dial zero plus the area code and phone number that you want, then
|
|||
|
|
the area code and phone number with a four digit "security code"
|
|||
|
|
at the end. It'll look like this, 9501022 (the dialup)
|
|||
|
|
02125551212 (zero plus the area code and phone number ) then
|
|||
|
|
7045551212xxxx (your area code,phone number and security code).
|
|||
|
|
|
|||
|
|
Many years ago I saw a piece of graffiti on the bathroom wall of
|
|||
|
|
the Cotton Bowl. It went like this, "I've shit in England - I've
|
|||
|
|
shit in France - But before I shit here again - I'll shit in my
|
|||
|
|
pants." I feel the same way about this format. As a businessman,
|
|||
|
|
I wouldn't waste my time trying to dial all this garbage. A real
|
|||
|
|
pain in the ass. Hackers, don't find the format that tough. With
|
|||
|
|
the exception of the user's telephone number and code the rest
|
|||
|
|
are known quantities. You're left with fourteen numbers to hack
|
|||
|
|
out. This can be reduced even further. MCI's 950 codes are good
|
|||
|
|
anywhere in the country. Experienced phreaks pick an area that is
|
|||
|
|
known to have an extremely high population density. New York City
|
|||
|
|
is a case in points, area code 212. The number of digits has just
|
|||
|
|
been reduced to eleven. The phreak will choose a prefix that is
|
|||
|
|
occupied predominantly by business and cut the number down to
|
|||
|
|
eight digits, which is one less than Sprint's code. I've seen
|
|||
|
|
425,943,344,964,269,422,820,227,635,747,486,668,686,233,248,532,
|
|||
|
|
732,306,938,255,925,678,and 564 posted on hacker boards. It seems
|
|||
|
|
that Wall Street is a juicy target. The interesting thing about
|
|||
|
|
hacking MCI's 950 numbers is that the phreak also gets the number
|
|||
|
|
<EFBFBD>j܌of the person who's going to be getting the bill. It's not
|
|||
|
|
unusual for the hacker to call the victim on some pretense just
|
|||
|
|
to find out who it is. If it's a large company who might not
|
|||
|
|
notice a few additional phone calls, he'll use the code sparingly
|
|||
|
|
so as not to attract attention. The end result will be years of
|
|||
|
|
free long distance.
|
|||
|
|
|
|||
|
|
MCI's second format is pretty standard. A local dialup and a five
|
|||
|
|
digit code followed by the area code and number you wish to speak
|
|||
|
|
with. They've recently instituted a new "security measure". One
|
|||
|
|
phreak hacked out eight codes in about an hour. He let them sit a
|
|||
|
|
day before he got around to using one of them, some phreaks let
|
|||
|
|
them sit as long as a month. In that twenty four hour period all
|
|||
|
|
but one of them went bad. It isn't unusual to see codes go bad. A
|
|||
|
|
few of them fall by the wayside due to natural attrition, people
|
|||
|
|
not paying their bills or cancelling service. To see seven fall
|
|||
|
|
with one blow is mathematically improbable. It means they've
|
|||
|
|
been reprogramming the computers to scan the dialups and check
|
|||
|
|
for activity. If a node has an activity average of fifty calls
|
|||
|
|
an hour and the hacker pumps the actual amount over that
|
|||
|
|
average, it'll trigger a feature in the programming that'll
|
|||
|
|
generate an activity report for a system operator to read.
|
|||
|
|
Furthermore, the computer will list all the phone numbers called
|
|||
|
|
and the codes that connected them to the system. If the phone
|
|||
|
|
numbers are identical it can safely be assumed they're being
|
|||
|
|
telephucked. The report will also show a time lag of about
|
|||
|
|
fifteen seconds between calls. Isn't technology wonderful?
|
|||
|
|
|
|||
|
|
The hacker's solution to their solution is obvious. Don't keep
|
|||
|
|
dialing the same phone number over and over. The first generation
|
|||
|
|
of hacker programs did (and still do) use a one number
|
|||
|
|
destination. Consequently, they've set a pattern that, after
|
|||
|
|
four or five years, the phone companies have finally noticed. It
|
|||
|
|
takes about twenty minutes of reprogramming to beat it. Hacks
|
|||
|
|
have now started using large files dialups similar to the one in
|
|||
|
|
the appendix. It's not too difficult to blitz the call counter
|
|||
|
|
feature either. MCI doesn't publish their dialup numbers except
|
|||
|
|
to their customers and then they only give them one at a time.
|
|||
|
|
Their ratio seems to be figured at around one dialup for two
|
|||
|
|
hundred thousand of population. To find other dialups all one
|
|||
|
|
needs to do is scan the prefix surrounding a known node. Hacks
|
|||
|
|
are now rewriting their software to spread their hacks out over a
|
|||
|
|
wider area. Fifty to one hundred hacks on one node and then they
|
|||
|
|
move to another. The five digit code hacked on a local dialup is
|
|||
|
|
good only on that node. A New York code won't be good in
|
|||
|
|
Cleveland. It took MCI several years and a ton of money in losses
|
|||
|
|
and programming time to come up with this little security wonder.
|
|||
|
|
It'll take a fifteen year old phreak twenty minutes of
|
|||
|
|
reprogramming at a cost of zero bucks to bust it. Kinda makes you
|
|||
|
|
wonder doesn't it?
|
|||
|
|
|
|||
|
|
What of the one code that was still good? The hacker didn't touch
|
|||
|
|
it. He realized the system had detected him. It wouldn't be hard
|
|||
|
|
recognize his pattern of calling. He knew the good code might be <20>j܌"trapped". Any activity on it would have been traced (illegally).
|
|||
|
|
If he stayed on the code long enough for the security department
|
|||
|
|
to process the necessary paperwork he would undoubtedly be
|
|||
|
|
busted. He decided that it was wiser to protect himself and those
|
|||
|
|
that he called by not using it. He noted the number just in case
|
|||
|
|
he should hack it out again at a later date.
|
|||
|
|
|
|||
|
|
Some psychologists say that names can affect the development of a
|
|||
|
|
child. I knew two kids when I was in school who's names are
|
|||
|
|
etched in my memory forever, Jock Strap and Harry Balls. Their
|
|||
|
|
parents should have been shot. The president of MCI is Orville
|
|||
|
|
Wright. Orville has his work cut out for him.
|
|||
|
|
GTE SPRINT
|
|||
|
|
|
|||
|
|
|
|||
|
|
Sprint is owned by General Telephone. If you've ever lived in a
|
|||
|
|
GTE area you can attest to the absolute crapola you've received
|
|||
|
|
as service. Sprint has advertised good connections and rightly
|
|||
|
|
so. Their international access is equal to AT&T. Like MCI and all
|
|||
|
|
the other LD services, they don't go everywhere. They've
|
|||
|
|
concentrated building their network in the metropolitan areas
|
|||
|
|
where the money is so you country bumpkins are going to have to
|
|||
|
|
wait a little longer.
|
|||
|
|
|
|||
|
|
I recently spoke with Sprint's security department. They have a
|
|||
|
|
service oriented philosophy. They don't want any restrictions on
|
|||
|
|
data line users. A study indicated a respectable percentage of
|
|||
|
|
Sprint customers were computer operators. Sprint maintains a
|
|||
|
|
considerable number of dialup ports. I estimate the ratio is one
|
|||
|
|
port for each forty thousand of population. As of this writing,
|
|||
|
|
Sprint has not completed it's national 950-0777 setup.
|
|||
|
|
Consequently, she still has a large number of local dialups in
|
|||
|
|
the system. Scanning to either side of a local non 950 dialup
|
|||
|
|
will yield a wealth of unpublished nodes.
|
|||
|
|
|
|||
|
|
Sprint's code format runs 9 digits in length and also uses
|
|||
|
|
prefix qualifiers . In this case a three digit coding identifies
|
|||
|
|
the physical area of the country the code has been assigned to.
|
|||
|
|
The next 4 digits are presumably it's record place within their
|
|||
|
|
computer system. Therefore, xxxXXXXxx would translate to a three
|
|||
|
|
digit prefix, followed by a four digit record number, with the
|
|||
|
|
remaining two digits being what used to be a travel code.
|
|||
|
|
Hackers report success rates of one per 300 hacks using the
|
|||
|
|
random number approach, a bit on the shabby side. Success ratios
|
|||
|
|
on MCI are around seven percent, or seven per hundred
|
|||
|
|
hacks,actually pretty good. On Metro three to four percent is
|
|||
|
|
about right. Essentially, Sprint is spreading their valid
|
|||
|
|
accounts out over a wider area, keeping the density low, thus
|
|||
|
|
making them harder to find. The hacker can increase his return
|
|||
|
|
ratios by using the prefix and suffix technique. His first time
|
|||
|
|
on the system he'll use a random hack, searching for a nine digit
|
|||
|
|
code. Then use the first three digits of the code as a prefix,
|
|||
|
|
and the last to digits as a suffix. All he needs then to hack is
|
|||
|
|
the four digits in between. The return rate is currently one per <20>j܌two hundred hacks using this approach, a 33% increase in
|
|||
|
|
efficiency.
|
|||
|
|
|
|||
|
|
Sprint has achieved a reputation for vigorously prosecuting
|
|||
|
|
phreaks. Yet, they are as limited as all the other companies.
|
|||
|
|
They rely mainly on fear. Occasionally, they'll snare some kid
|
|||
|
|
who overstayed his welcome. They make a big deal giving the
|
|||
|
|
impression they're busting thousands a day. This just isn't so.
|
|||
|
|
Phreaks only get caught when they get stupid or lazy. You can't
|
|||
|
|
blame Sprint for capitalizing on some phreak's lack of brains.
|
|||
|
|
Conversely, you can't blame the phreak for cashing in on Sprint's
|
|||
|
|
lack of smarts.
|
|||
|
|
|
|||
|
|
As an update, Sprints 950 dialups require 9 digits. Local nodes
|
|||
|
|
used to come in at 7 and 8 digits. As the local dialups disappear
|
|||
|
|
the 9 will become the norm. Sprint still has no specialized
|
|||
|
|
security systems. The rumors of profound phreak snaring abilities
|
|||
|
|
are basically untrue.
|
|||
|
|
|
|||
|
|
They win a few and lose a few, although it appears they lose more
|
|||
|
|
than they win.
|
|||
|
|
|
|||
|
|
Allnet Communications
|
|||
|
|
|
|||
|
|
Allnet is a run of the mill telecom company. They utilize the
|
|||
|
|
standard 6 digit format and can be found at 950-1044. They appear
|
|||
|
|
to have developed or purchased software for analyzing their data
|
|||
|
|
much the same way Mci has. Furthermore, they seem to have
|
|||
|
|
established a customer profile with which to compare current
|
|||
|
|
hacking activities against the record of past calling habits.
|
|||
|
|
A hacked code will remain valid for three days. It seems to take
|
|||
|
|
that long to run the programming.
|
|||
|
|
|
|||
|
|
Additionally, a code that connects for only a few seconds will be
|
|||
|
|
invalidated within 24 hours. The obvious solution is stay
|
|||
|
|
connected for several minutes. It works. On the user profile
|
|||
|
|
strategy, there is no means of defeating it except to rape the
|
|||
|
|
hell out of the code from the minute one lays hands on it. Those
|
|||
|
|
that adhere to the I C's Rules of Phreaking wouldn't care since
|
|||
|
|
they don't stay on a code more than three days any way.
|
|||
|
|
Itt is Internation Telephone and Telegraph and operates out of
|
|||
|
|
Seacacus New Jersy. They've been the the telcomunications
|
|||
|
|
business for many years and have specialized in telix type
|
|||
|
|
services.
|
|||
|
|
|
|||
|
|
Itt's connections aren't particularly terrific for data
|
|||
|
|
transmissions. Phreaks have complained of excessive line loss
|
|||
|
|
over relatively short distances. The company's strong point is
|
|||
|
|
and will continue to be their telix activities.
|
|||
|
|
|
|||
|
|
The code format for this service is different. In an obvious
|
|||
|
|
attempt to deter phreaking, they've departed from the usual node,
|
|||
|
|
<EFBFBD>j܌code, number arrangement. Instead they utilize a reverse
|
|||
|
|
arrangement, node, area code and number, then the code. From a
|
|||
|
|
practical point of view there is little difference. From an
|
|||
|
|
operational viewpoint the phreak must chain together his dialing
|
|||
|
|
sting instead of using just one. I others words, instead of
|
|||
|
|
punching one macro to output his call, two are required.
|
|||
|
|
The coding uses a prefix and suffix as area qualifiers. The first
|
|||
|
|
two digits of the code refer to the area of the country the code
|
|||
|
|
has been assigned. Consequently, most phreaks prefer to use the
|
|||
|
|
prefix in their hack attempts. The object is, of course, to
|
|||
|
|
improve effieciency.
|
|||
|
|
|
|||
|
|
Itt has no special security considerations as far as traces and
|
|||
|
|
traps go. They have instead emphasized getting the phreak
|
|||
|
|
disconnected as quickly as possible. Most Itt's will go bad in
|
|||
|
|
three days (See Chapter on Updates). Hense it is impossible for a
|
|||
|
|
phreak to be on the system long enough to require concern about
|
|||
|
|
traps and traces.
|
|||
|
|
|
|||
|
|
Itt is expanding it's overseas network and is offering services
|
|||
|
|
to Singapore as well as the regular European countries.
|
|||
|
|
|
|||
|
|
|
|||
|
|
ITT LOCAL DIALUPS
|
|||
|
|
|
|||
|
|
|
|||
|
|
201-463-0900 305-545-8895 513-228-6506 717-234-0718
|
|||
|
|
201-589-6343 305-764-4522 513-651-1823 717-299-4796
|
|||
|
|
202-565-4110 312-364-6020 515-284-5040 717-347-9135
|
|||
|
|
203-324-1172 312-922-1013 518-462-2068 717-825-2761
|
|||
|
|
203-333-2722 313-662-2041 602-257-8200 803-233-1351
|
|||
|
|
203-527-7389 313-964-2843 608-258-8900 803-256-3060
|
|||
|
|
203-787-0170 314-656-0800 609-338-0340 803-573-7639
|
|||
|
|
203-794-1085 315-471-2900 609-989-1631 803-577-6728
|
|||
|
|
203-866-8411 316-267-1088 612-375-0690 804-355-1433
|
|||
|
|
209-445-9300 317-637-5223 614-224-0024 804-380-9038
|
|||
|
|
212-248-0151 401-273-8263 615-327-2511 804-627-3596
|
|||
|
|
214-651-0609 404-525-0714 615-521-7600 805-395-0123
|
|||
|
|
215-376-4864 405-525-7731 615-697-7000 813-223-5380
|
|||
|
|
215-433-2166 408-280-1301 616-458-2472 817-338-4749
|
|||
|
|
215-563-3256 412-261-4930 617-357-5562 904-358-8522
|
|||
|
|
216-375-9040 414-933-5680 702-323-7191 913-371-1300
|
|||
|
|
216-621-0490 415-495-2816 704-375-4311 916-448-6606
|
|||
|
|
219-237-1700 415-858-2750 713-862-5067 918-585-5001
|
|||
|
|
302-654-2809 502-589-9360 714-973-8032 919-378-9489
|
|||
|
|
303-861-4411 504-566-8300 716-325-1180 919-725-3532
|
|||
|
|
305-425-7791 512-474-4397 716-845-5150 919-832-9438
|
|||
|
|
|
|||
|
|
<EFBFBD>`<60>
|
|||
|
|
Listing of Cities Serviced by ITT
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Allentown Anaheim Annapolis
|
|||
|
|
Athens Atlanta Baltimore
|
|||
|
|
Boston Brooklyn Cambridge
|
|||
|
|
Camden Charlotte Chicago
|
|||
|
|
Compton Dallas El Monte
|
|||
|
|
Elk Grove Fort Worth Fort Lauderdale
|
|||
|
|
Gainesville Galveston Garden City
|
|||
|
|
Gardena Gary Glendale
|
|||
|
|
Greensboro Greensville Hackensack
|
|||
|
|
Houston Inglewood Jacksonville
|
|||
|
|
Joliet Kankakee La Plata
|
|||
|
|
Long Beach Los Angeles Lynchburg
|
|||
|
|
Miami Morristown New Brunswick
|
|||
|
|
New York Newark Newport News
|
|||
|
|
Norfolk Norristown Northbrook
|
|||
|
|
Oak Brook Oakland Orlando
|
|||
|
|
Palo Alto Philadelphia Reading
|
|||
|
|
Richmond Rochester Rome
|
|||
|
|
Rosenberg Sacramento San Jose
|
|||
|
|
Santa Monica Santa Ana Scranton
|
|||
|
|
Sherman Oaks Spartanburg St. Petersburg
|
|||
|
|
Tampa Thousand Oaks Trenton
|
|||
|
|
Van Nuys Washington West Palm Beach
|
|||
|
|
White Plains Wilkes-Barre Wilmington
|
|||
|
|
Winston-Salem
|
|||
|
|
|
|||
|
|
Western Union Metrophone
|
|||
|
|
|
|||
|
|
Metro was everyone's whore. Metro never said no. Any too bit
|
|||
|
|
phreak could bang a metro code. The system was of interest to
|
|||
|
|
business primarily due to there method of billing breakdowns.
|
|||
|
|
Metro has been raped to the tune of tens of millions in phreak
|
|||
|
|
related losses.
|
|||
|
|
|
|||
|
|
Metro is currently, for phreaking purposes, offline. It's unknown
|
|||
|
|
whether she has changed her code format or has simply closed
|
|||
|
|
shop. Her previous code format was a standard 6 digit affair. The
|
|||
|
|
equipment used was old and had very poor line quality. This was
|
|||
|
|
apparent in 1200 baud data communications but would not
|
|||
|
|
necessarily have been noticed on voice transmissions. The listing
|
|||
|
|
for her networked dialups is included below.
|
|||
|
|
|
|||
|
|
201-427-1100
|
|||
|
|
201-487-3155
|
|||
|
|
201-531-7900
|
|||
|
|
201-643-2227
|
|||
|
|
201-825-8852
|
|||
|
|
201-828-8660
|
|||
|
|
202-737-2051 <20>j܌
|
|||
|
|
203-222-1148
|
|||
|
|
203-323-1468
|
|||
|
|
203-522-0003
|
|||
|
|
203-748-0770
|
|||
|
|
206-382-0910
|
|||
|
|
212-732-7430
|
|||
|
|
212-950-0220
|
|||
|
|
213-202-6117
|
|||
|
|
213-404-4100
|
|||
|
|
213-618-0231
|
|||
|
|
213-624-8884
|
|||
|
|
213-629-1026
|
|||
|
|
214-595-4282
|
|||
|
|
214-742-4500
|
|||
|
|
215-351-0100
|
|||
|
|
215-770-8940
|
|||
|
|
216-374-1001
|
|||
|
|
216-861-5163
|
|||
|
|
219-237-4805
|
|||
|
|
219-420-0011
|
|||
|
|
219-882-8901
|
|||
|
|
301-659-7700
|
|||
|
|
302-429-9439
|
|||
|
|
303-623-5356
|
|||
|
|
305-326-3300
|
|||
|
|
305-462-3530
|
|||
|
|
312-356-4480
|
|||
|
|
312-396-2550
|
|||
|
|
312-450-5875
|
|||
|
|
312-480-8901
|
|||
|
|
312-496-2431
|
|||
|
|
312-578-3900
|
|||
|
|
312-679-8120
|
|||
|
|
312-844-6981
|
|||
|
|
312-853-4700
|
|||
|
|
312-888-5580
|
|||
|
|
312-891-8083
|
|||
|
|
312-981-8870
|
|||
|
|
312-986-0566
|
|||
|
|
313-963-4847
|
|||
|
|
313-996-8900
|
|||
|
|
314-342-1130
|
|||
|
|
315-474-3911
|
|||
|
|
317-635-6284
|
|||
|
|
401-272-0356
|
|||
|
|
402-422-1120
|
|||
|
|
404-223-1000
|
|||
|
|
405-232-9011
|
|||
|
|
408-947-7606
|
|||
|
|
409-833-9331
|
|||
|
|
412-261-5720
|
|||
|
|
414-277-1805
|
|||
|
|
414-633-3636 <20>j܌415-499-8086
|
|||
|
|
|
|||
|
|
415-579-6001
|
|||
|
|
415-676-1062
|
|||
|
|
415-724-3170
|
|||
|
|
415-794-4800
|
|||
|
|
415-833-9200
|
|||
|
|
415-836-6900
|
|||
|
|
415-852-0900
|
|||
|
|
415-956-0162
|
|||
|
|
419-243-1046
|
|||
|
|
502-561-0900
|
|||
|
|
504-566-8500
|
|||
|
|
512-224-9600
|
|||
|
|
512-474-6057
|
|||
|
|
513-228-1576
|
|||
|
|
513-241-1747
|
|||
|
|
516-933-9700
|
|||
|
|
516-950-0220
|
|||
|
|
518-436-6200
|
|||
|
|
602-254-2930
|
|||
|
|
602-323-0502
|
|||
|
|
606-231-8961
|
|||
|
|
608-251-9596
|
|||
|
|
609-338-0100
|
|||
|
|
609-641-0004
|
|||
|
|
609-989-1900
|
|||
|
|
612-370-9000
|
|||
|
|
614-224-0577
|
|||
|
|
616-242-9580
|
|||
|
|
617-950-1020
|
|||
|
|
618-235-8870
|
|||
|
|
619-233-0327
|
|||
|
|
702-329-1025
|
|||
|
|
707-584-4931
|
|||
|
|
713-224-9417
|
|||
|
|
714-527-7055
|
|||
|
|
714-591-9351
|
|||
|
|
714-594-9311
|
|||
|
|
714-877-6641
|
|||
|
|
714-972-9515
|
|||
|
|
716-852-9200
|
|||
|
|
716-950-1020
|
|||
|
|
717-238-4731
|
|||
|
|
717-348-4300
|
|||
|
|
717-846-6304
|
|||
|
|
718-950-0220
|
|||
|
|
804-225-1920
|
|||
|
|
804-623-9004
|
|||
|
|
805-968-0700
|
|||
|
|
806-379-8271
|
|||
|
|
806-762-0004
|
|||
|
|
815-966-2401
|
|||
|
|
816-471-1999 <20>j܌817-322-1422
|
|||
|
|
|
|||
|
|
817-338-1639
|
|||
|
|
817-565-9202
|
|||
|
|
817-757-2002
|
|||
|
|
818-350-1028
|
|||
|
|
818-954-8699
|
|||
|
|
818-992-8282
|
|||
|
|
913-621-3186
|
|||
|
|
914-684-0268
|
|||
|
|
915-532-0025
|
|||
|
|
915-561-5481
|
|||
|
|
915-658-2943
|
|||
|
|
915-676-0078
|
|||
|
|
916-443-6921
|
|||
|
|
918-587-6770
|
|||
|
|
Thrifty Telephone Exchange
|
|||
|
|
|
|||
|
|
|
|||
|
|
TTE is an example of a mom and pop telephone company. It services
|
|||
|
|
a very small area and utilizes 800 as its sole source of out of
|
|||
|
|
the area access for its customers. The 800's are also more
|
|||
|
|
expensive for the customer.
|
|||
|
|
|
|||
|
|
TTE offers two dialups in the 818 area, 902-0950 and 908-0951.
|
|||
|
|
These are located in Van Nuys, California, a part of the City of
|
|||
|
|
Los Angeles. She utilizes the standard 6 digit format.
|
|||
|
|
|
|||
|
|
TTE is a good example of a company hackers just won't mess with.
|
|||
|
|
Not because of any great security measure or because of some
|
|||
|
|
ultra sophisticated phreak catching ability, but simply for the
|
|||
|
|
reason they don't have enough customers (valid codes) to make the
|
|||
|
|
effort worthwhile. TTE has a rough road to hoe. It seems too
|
|||
|
|
small to be of interest for a larger company to gobble up and is
|
|||
|
|
unable to compete on the grander scales of Mci or Sprint. She's
|
|||
|
|
bound to belly up sooner or later. This situation is not unique
|
|||
|
|
in the industry.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Access Communications
|
|||
|
|
|
|||
|
|
|
|||
|
|
Access is a company in the genre of TTE with the major exception
|
|||
|
|
it appears to have the benefit of more capitalization. There
|
|||
|
|
operate out of the 801 area and offer a local dialup at 801-359-
|
|||
|
|
3900 as well as national access at 800-548-0003. The code length
|
|||
|
|
is identical to ITT, 7 digits. The prefix may safely assume the
|
|||
|
|
use of prefix qualifiers.
|
|||
|
|
|
|||
|
|
Access' format is standard with one minor exception. Node + code
|
|||
|
|
+ 1 + area code and destination number. Like ITT's reverse
|
|||
|
|
format, the minor deviation from the norm is bound to save the
|
|||
|
|
telco money. The problem all these companies have is they must
|
|||
|
|
make the format easy enough for an idiot to operate and the MUST <20>j܌make the dialups and formats public knowledge. In doing both they
|
|||
|
|
make their systems vulnerable.
|
|||
|
|
|
|||
|
|
|
|||
|
|
U.S. Telecom
|
|||
|
|
|
|||
|
|
U.S. Telecom was known as the "Metro" of the 950's. Codes were
|
|||
|
|
easily hacked and density varyed in direct proportion to the
|
|||
|
|
population of the area serviced. The Director of "Code Abuse" is
|
|||
|
|
a fellow named "Frank Porko". It seems one of the prerequisites
|
|||
|
|
of being in telecommunications is you have an odd name. Frank
|
|||
|
|
was recently promoted to this exaulted position. U.S. Tel isn't
|
|||
|
|
making money, so the company has been swallowed up by a bigger
|
|||
|
|
fish, Sprint. Frank didn't strike me as overly bright on the
|
|||
|
|
subject of phreaking. The company has tried the "Carrier Blast"
|
|||
|
|
only to find it worked for a couple of days and the phreaks by
|
|||
|
|
passed it. It can still be found at the end of the dialing
|
|||
|
|
sequence for their 950. Their latest security gizzy is to limit a
|
|||
|
|
caller to four tries before it routes him to a dummy line. Sound
|
|||
|
|
familiar? Sprint does it with two tries and it doesn't work for
|
|||
|
|
them either. Ironically, phreaks in the military are hurting
|
|||
|
|
USTel much worse than the civilian poplulation. It appears
|
|||
|
|
government computers are being put to uses other than those
|
|||
|
|
intended. U.S. Tel's 950-1033 dialup is already famous among
|
|||
|
|
phreaks. They've placed qualifiers on the codes, even so the
|
|||
|
|
return rate runs around five per hundred hacks. Five percent -
|
|||
|
|
not bad. The node uses the standard six digit format. I spoke
|
|||
|
|
with one of their chief programmers who was trying to hack out
|
|||
|
|
codes. He complained the only code he could find was his own.
|
|||
|
|
This explains why the company's response time is so pathetic.
|
|||
|
|
Phreaks and computer engineers thinking at different levels. This
|
|||
|
|
supports the old saying of "Set a Theif to Catch a Thief".
|
|||
|
|
|
|||
|
|
U.S. Tel sports two 800 numbers, 800-345-0008 and 800-245-0033.
|
|||
|
|
These babies are infamous. The 345 number used to have codes
|
|||
|
|
packed like sardines, every tenth (fifteenth at the most) number
|
|||
|
|
was a good code. How could you lose? After several years of
|
|||
|
|
getting their asses kicked they finally changed the format and
|
|||
|
|
wised up a bit and went to a 14 digit code, ie. AT&T format. The
|
|||
|
|
format is constructed of two sets of three digits followed by two
|
|||
|
|
sets of four digits, XXX-XXX-XXXX-XXXX. We can assume the first
|
|||
|
|
sets of three are area qualifiers, actually area codes. USTel
|
|||
|
|
doesn't use the actual area code as do AT&T and MCI. Area codes
|
|||
|
|
818 and 714 return as 527 and 662 respectively. Additionally, the
|
|||
|
|
three digit prefix and suffix are also bastardized. Hackers have
|
|||
|
|
deduced this is the product of a mathematical formula indexed
|
|||
|
|
from the users area code and phone number. The four digit
|
|||
|
|
"security code" is obtained by the same formula. A group of
|
|||
|
|
hackers who call themselves the IC (Inner Core) are working on
|
|||
|
|
cracking this coding. There are fifty of them. This translates to
|
|||
|
|
fifty intellegent people, fifty computers all dedicated to
|
|||
|
|
breaking the MCI/Ustel code. It would seem it is only a matter
|
|||
|
|
of time before they succeed. It's their belief they will also
|
|||
|
|
reap the AT&T formula in the bargain. This stems primarily from <20>j܌the fact MCI "borrowed" AT&T's format.
|
|||
|
|
<EFBFBD><02>
|
|||
|
|
Hackers love a challenge and will rise to one almost at the
|
|||
|
|
dropping of a pin. Code cracking is what they love best. I have
|
|||
|
|
no doubt that the IC will succeed.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Update
|
|||
|
|
|
|||
|
|
The 14 digit format is being used for new accounts. Older
|
|||
|
|
customers still have their 6 digit codes. US Tel has never had
|
|||
|
|
terrific connections and under Sprint this has not improved.
|
|||
|
|
Two digit prefix qualifers are used. The calling areas are very
|
|||
|
|
small. Sprint is still the best bet for away from home phreaking.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
SBS SKYLINE
|
|||
|
|
|
|||
|
|
|
|||
|
|
Each long distance company tries to promote itself in different
|
|||
|
|
ways. Skyline's approach is two fold, first price (so what's
|
|||
|
|
new), and secondly the fact they use satellites to get their
|
|||
|
|
calls to their destinations. This isn't terribly impressive.
|
|||
|
|
Never the less, they obviously feel enough people will be
|
|||
|
|
impressed it's worth mentioning. Point in fact, most of the LD's
|
|||
|
|
use satellites. It would be impractical, not to mention
|
|||
|
|
expensive, to use AT&T's network for 100% of their traffic.
|
|||
|
|
Skyline has a well established dialup at 950-1088. Her format is
|
|||
|
|
the standard 6 digits. Hacks report it is a fairly easy system.
|
|||
|
|
|
|||
|
|
It appears she has divided the country in areas which are rather
|
|||
|
|
large geographically. A code that originates in one area will be
|
|||
|
|
workable two to three hundred miles from its point of origin. The
|
|||
|
|
six digit code will also work on her 800-446-4462 dialup. There
|
|||
|
|
are reports she also uses a seven digit format collateral to the
|
|||
|
|
six.
|
|||
|
|
|
|||
|
|
Skyline has a reputation for vigorously calling the destination
|
|||
|
|
numbers after more than ten calls have been placed. This is the
|
|||
|
|
most they can realistically do. One must assume they will score
|
|||
|
|
a certain percentage of people who are willing to give them
|
|||
|
|
information about the origin of the calls. Yet, as far as
|
|||
|
|
experienced hacks and phreaks go, you can be equally sure the
|
|||
|
|
trail will stop there and the possibility of back tracking is
|
|||
|
|
nil, if not impossible. This problem is not unique to Skyline.
|
|||
|
|
|
|||
|
|
She appears to be your run of the mill long distance carrier
|
|||
|
|
without much to make it especially noteworthy. Like all other
|
|||
|
|
services, she isn't making money and is playing the merger game.
|
|||
|
|
I predict by 1988 you will have three majors in the business,
|
|||
|
|
AT&T, MCI, and Sprint. The rest are fish bait waiting to be
|
|||
|
|
gobbled up by the larger fish. See Updates for further
|
|||
|
|
information. <20>j܌
|
|||
|
|
|
|||
|
|
|
|||
|
|
Alliance Teleconferencing
|
|||
|
|
|
|||
|
|
Alliance is a service of At&t. It provides people, usually
|
|||
|
|
business with what is essentially a party line; several people
|
|||
|
|
can join in the same conversation at the same time. It's an
|
|||
|
|
outstanding tool for business. The phreak approaches Alliance
|
|||
|
|
essentially from the same perspective, except that phreakery is
|
|||
|
|
the business.
|
|||
|
|
|
|||
|
|
As a service of At&t, Alliance is approached indirectly through a
|
|||
|
|
PBX or a diverter. The origination phone number of all calls
|
|||
|
|
place to Alliance is supplied by the ANI - Automatic Number
|
|||
|
|
Identifier. Placing the call through a PBX insures the ANI, and
|
|||
|
|
the people receiving the bill, will be someone other than the
|
|||
|
|
phreak.
|
|||
|
|
|
|||
|
|
AT&T offers two basic conference services, Alliance 1000 and
|
|||
|
|
Alliance 2000. The former is your basic voice communication and
|
|||
|
|
the later has special graphic abilities. The service operates in
|
|||
|
|
all fifty states, Mexico, Canada, Puerto Rico, Bermuda and the
|
|||
|
|
Virgin Islands.
|
|||
|
|
|
|||
|
|
To make a conference call the phreak will need to have the phone
|
|||
|
|
numbers of all the parties. Since this is not always desireable,
|
|||
|
|
the controller can route the call through a number of loops, thus
|
|||
|
|
insuring the location of the phreak remains unknown (See Loops).
|
|||
|
|
The controller will then call 0+700+456-1000 for an audio
|
|||
|
|
conference. He'll then dial in the phone numbers as you would any
|
|||
|
|
At&t call. When the party answers, he'll tell him to hold on
|
|||
|
|
while he connects the rest of the group. He'll hit the # button
|
|||
|
|
to continue adding people or the * to cancel his input. He can
|
|||
|
|
resume adding callers at any time by hitting the # button. Ending
|
|||
|
|
a conference is easy, everyone hangs up.
|
|||
|
|
|
|||
|
|
A national conference was held after the 415 bust to discuss
|
|||
|
|
added security measures to counteract the sting techniques used
|
|||
|
|
by the Fremont Police Department. Elite phreaks from coast to
|
|||
|
|
coast were dialed in. The phreaks saw the need for immediate
|
|||
|
|
discussion to plan their future actions and to discuss the
|
|||
|
|
details of the bust. One of the parties to the conference had
|
|||
|
|
actually seen the hacker known as Trask as he was being arrested.
|
|||
|
|
Trask's down fall held vital concern to many on that conference
|
|||
|
|
as he held many personal phone numbers and names in his data
|
|||
|
|
base. The police did not obtain that information nor did Trask
|
|||
|
|
make a deal with them. Needless to say he was prosecuted. Other
|
|||
|
|
hackers involved in the 415 bust did make bargains with law
|
|||
|
|
enforcement which resulted in wide spread arrests. The Fremont
|
|||
|
|
Sting has successfully been used in Texas and there is every
|
|||
|
|
indication it will be used elsewhere.
|
|||
|
|
<20>j܌
|
|||
|
|
Alliance provided the means for these hacks to meet and discuss
|
|||
|
|
their vital concerns. Some company with a PBX was billed for the
|
|||
|
|
calls. It would be accurate to say that while the 415 conference
|
|||
|
|
was called under "emergency" conditions, most conferences are
|
|||
|
|
little more than bullshit sessions. Some pranksters like to play
|
|||
|
|
games like dialing six or seven operators and listening to the
|
|||
|
|
say, "Operator", "Operator", "No I'm the operator can I help
|
|||
|
|
you?". This can go on for five or six minutes before they realize
|
|||
|
|
they've been cross connected. Others like to call their favorite
|
|||
|
|
software company and taunt them as to how they've cracked their
|
|||
|
|
latest security measures. These applications are rather juvenile.
|
|||
|
|
|
|||
|
|
|
|||
|
|
At&t Security is a feared aspect of the phreak's existence. With
|
|||
|
|
the exception of the PBX and the Diverter, Ma Bell holds all the
|
|||
|
|
cards. Tracing is a snap. Even so, At&t doesn't appear to be a
|
|||
|
|
mean mother in the tracking down of her Alliance phreaks. The
|
|||
|
|
company with the PBX is going to be stuck with the bill and it
|
|||
|
|
appears the phone company has little incentive to follow the
|
|||
|
|
scent.
|
|||
|
|
|
|||
|
|
Phreaks of fifteen to twenty years pass used to place calls and
|
|||
|
|
have them billed to phone booths. ESS has made that game
|
|||
|
|
obsolete. However, Ma Bell didn't sit still for the theft. They
|
|||
|
|
dropped the billing on the party who received the call. If then
|
|||
|
|
didn't pay, they lost their phone service. The obvious option was
|
|||
|
|
to give them the name and location of the person that really was
|
|||
|
|
responsible for the call. There are no reports that this
|
|||
|
|
collection device is still being used. From the phreak's vantage
|
|||
|
|
point, Alliance is pretty safe.
|
|||
|
|
|
|||
|
|
Another old method of phreaking from payphones, and purported to
|
|||
|
|
have dome from Abby Hoffman, was to place a call from a payphone
|
|||
|
|
and to reverse the handset of an adjacent payphone to signal the
|
|||
|
|
operator that money was being dropped. As the phreak dropped the
|
|||
|
|
coins into the phone he wasn't placing the call from, the clinks
|
|||
|
|
and cur-chunks would signal her the correct amount had been
|
|||
|
|
deposited. This was corrected by simply making the telephone
|
|||
|
|
cords shorter.
|
|||
|
|
|
|||
|
|
Cur-chunks are out and tones are in. So the technique now has a
|
|||
|
|
new twist called the Red Box. the box is a simple, handheld,
|
|||
|
|
battery operated tone generator that duplicates the tones used to
|
|||
|
|
signal the operator the money has actually been placed into the
|
|||
|
|
payphone. Utilizing 1700 hz and 2200 hz (Duel Multi Frequency
|
|||
|
|
Tones), the box signals that a nickel has been dropped by pulsing
|
|||
|
|
the frequencies at 66ms one time. A dime is recognized by 66ms on
|
|||
|
|
once, off once, and on again. This produces two "beeps". The
|
|||
|
|
quarter is shown at 33 ms off and on five times.
|
|||
|
|
|
|||
|
|
The newest phone technology also brinks greater phreaking
|
|||
|
|
opportunities. The Cordless telephone is one example. These units<74>j<EFBFBD>
|
|||
|
|
|
|||
|
|
use two frequencies, one to send and the other to receive. the
|
|||
|
|
FCC restricts the number of frequencies available so that a trial
|
|||
|
|
and error approach in hacking is feasible. Most people don't
|
|||
|
|
realize a cordless signal can carry for miles enabling others to
|
|||
|
|
hear every word of their conversations. A properly equipped
|
|||
|
|
techno-phreak can zero in on the signal, locate the source, and
|
|||
|
|
screw around until he find the correct "in" level. The result is
|
|||
|
|
a Godzilla of a phone bill for the unsuspecting owner of the
|
|||
|
|
cordless phone. Most phreaks wouldn't go to this kind of trouble.
|
|||
|
|
Your technoelectrical wiz kids will.
|
|||
|
|
|
|||
|
|
Ess, while being the scourge of phreakdom, has also enabled him
|
|||
|
|
some benefits. The payphone games and 950 phreaking are just two
|
|||
|
|
examples. ESS has, however, completely obliterated the use of the
|
|||
|
|
infamous Blue Box. Phone company computers are programmed to be
|
|||
|
|
sensitive to the 2600 hz tone needed to seize a trunk line. And
|
|||
|
|
818 system operator (an adult) boxed one call on ESS. He was
|
|||
|
|
detected and traced but not arrested. The second time he box, he
|
|||
|
|
had a knock on the door and was arrested by the local police who
|
|||
|
|
had been accompanied by telco security. It's estimated by the mid
|
|||
|
|
1990's the entire country will be on ESS. Today, only the major
|
|||
|
|
metropolitan areas utilize the service. Crossbar is still the
|
|||
|
|
norm for the boonies.
|
|||
|
|
|
|||
|
|
Ess is a technological marvel, a logical step in the ever
|
|||
|
|
evolving future of the phone industry. Yet, it has some very
|
|||
|
|
scary aspects. The ability for abuse is tremendous. In the movies
|
|||
|
|
you see the cop saying "We didn't have enough time for the
|
|||
|
|
trace." Not any longer. Traces, wire taps and much more can be
|
|||
|
|
programmed to be automatic. An operator at a console can push a
|
|||
|
|
few buttons and Zap, no civil rights. I knew a woman who's
|
|||
|
|
brother was a highly placed official in Pac Tel. Her boyfriend
|
|||
|
|
had broken up with her and she was livid. The boyfriend's
|
|||
|
|
communications were traced and tapped as a "courtesy" by the
|
|||
|
|
brother. There is a history of past abuse which spawned the few
|
|||
|
|
laws designed to protect the consumer. However, just as there are
|
|||
|
|
laws against wire fraud, there are plenty of phreaks breaking
|
|||
|
|
those laws. The phreak can hide behind the technology of the
|
|||
|
|
computer and use it to break the law. So can your phone company.
|
|||
|
|
Murphy's law is applicable here, if it can happen it will.
|
|||
|
|
|
|||
|
|
Government has a philosophy of regulating and controlling the
|
|||
|
|
hell out of small and medium sized business. Large politically
|
|||
|
|
powerful corporations are afforded the convenience of policing
|
|||
|
|
themselves. A classic case of the fox watching the hen house. If
|
|||
|
|
the public were even remotely aware of the capabilities of ESS
|
|||
|
|
the uproar would shatter Washington. Phone services have been
|
|||
|
|
taken for granted. The combination of ESS and the Data Services
|
|||
|
|
who sell their information over the network makes it impossible
|
|||
|
|
for anyone to have true privacy. TRW is a prime target of the
|
|||
|
|
hacking community. Hacks abuse that data service and others for
|
|||
|
|
their own informational needs. It logically follows that any <20>j܌
|
|||
|
|
agency with the inclination could use those services to create
|
|||
|
|
non existent people or to kill the electronic lives of real ones.
|
|||
|
|
The computer gives spying an entirely new dimension. Believe it,
|
|||
|
|
Big Brother really is Watching!
|
|||
|
|
with the bill and it
|
|||
|
|
appears the phone company has little incentive to follow the
|
|||
|
|
scent.
|
|||
|
|
|
|||
|
|
|