330 lines
17 KiB
Plaintext
330 lines
17 KiB
Plaintext
Hacking Telephone Answering Machines
|
||
|
||
by Doctor Pizz and Cybersperm
|
||
|
||
******************************************************************************
|
||
DISCLAIMER: The following is for informational purposes only. All information
|
||
provided is simply to point out how easy it is to access such a system. The
|
||
author accepts no responsibility for irresponsible use of this knowledge, and
|
||
it is provided solely so people can be aware of the low security of such
|
||
systems. (Now that I'm off the hook in case you do something stupid...).
|
||
******************************************************************************
|
||
|
||
|
||
It seems that lately there is very little discussion of one of the most
|
||
simple but useful and rewarding forms of electronic information gathering,
|
||
hacking the telephone answering machine. Almost everyone has one of these
|
||
wonderful devices these days, to catch important messages while they are away
|
||
from their phones, or to screen important telephone calls. Nowadays, they
|
||
typically have the added advantage of being accessible from remote telephones,
|
||
so one needs to simply call his or her answering machine, enter their secret
|
||
code, and then either retrieve new messages, or listen to anything they had
|
||
previously recorded on the incoming messages tape, or perform any of a set of
|
||
additional functions determined by which key they press on their touch tone
|
||
phone. They also typically ignore the fact that virtually anyone else can
|
||
gain access to their messages by entering the appropriate code. Hence this is
|
||
a wonderful system to gather information from anyone without their knowledge,
|
||
especially if they are technologically illiterate.
|
||
|
||
For the most part, there are two main types of "electronic password"
|
||
used by these systems. They are amazingly simple to crack, as they are
|
||
typically only 2-digit or even 1-digit numbers!!!!!! On some machines, the
|
||
code must be entered before the outgoing message is over, on others, it must
|
||
be entered after the outgoing message, and on more sophisticated models, it
|
||
can be entered at any time.
|
||
|
||
|
||
MODERN 2-DIGIT PASSCODE SYSTEMS:
|
||
|
||
These are the most common systems in use today, typically made by
|
||
Panasonic, AT&T, etc. In these systems, the code can be entered before during
|
||
or after
|
||
the beep tone. For security reasons, we recommend BEFORE the beep tone, so
|
||
your intrusions are unnoticed... We will begin by discussing how to identify
|
||
the passcode.
|
||
|
||
|
||
Now, the question of how to hack their code. Well, this is so simple,
|
||
you don't even need a computer to do it. You can just enter all 2-digit
|
||
combinations until you get the right one (usually signalled by a series of
|
||
beeps on the other end). A relatively crude way was to enter each number in
|
||
sequence 01, 02, 03, 04,...,99. This works, but may take too long to enter
|
||
all numbers within the 20-30 second window we typically have before the beep
|
||
(The best time to play arounnd, as any tones entered after the beep will be
|
||
recorded on his incoming messages tape, and could let him know something is
|
||
up...). It is also important to stop as soon as you hit the right number, as
|
||
the additional entered numbers may be interpreted by the answering machine as
|
||
codes, and cause you to delete all their messages, or record a new greeting,
|
||
etc. That is really asking for trouble, and may cause them to try and change
|
||
their password (though it's usually only possible to choose from a range of
|
||
three consecutive numbers anyway...). Still, you need to be careful not to
|
||
let them catch on, eh?
|
||
|
||
A more sophisticated and fast way to do this is to take advantage of the
|
||
fact that such machines typically do not read two numbers at a time, and
|
||
discard them, but just look for the correct sequence, reading one at a time.
|
||
In other words, you can enter all 100 possible codes with roughly 1/2 the
|
||
number of keystrokes. Just enter as follows:
|
||
|
||
0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9,etc.
|
||
|
||
By reading in one phase we get:
|
||
|
||
0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1,1 2,1 3,1 4,1 5,1 6,1 7,1 8,1 9,etc.
|
||
|
||
In the other phase we get:
|
||
|
||
0 1,0 2,0 3,0 4,0 5,0 6,0 7,0 8,0 9,1 1,2 1,3 1,4 1,5 1,6 1,7 1,8 1,etc.
|
||
|
||
So by proceeding as follows we enter the following matrix sequentially,
|
||
encompassing all possible 2 digit numbers:
|
||
|
||
|
||
0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9
|
||
1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9
|
||
2 2 3 2 4 2 5 2 6 2 7 2 8 2 9
|
||
3 3 4 3 5 3 6 3 7 3 8 3 9
|
||
4 4 5 4 6 4 7 4 8 4 9
|
||
5 5 6 5 7 5 8 5 9
|
||
6 6 7 6 8 6 9
|
||
7 7 8 7 9
|
||
8 8 9
|
||
9 0
|
||
|
||
The last zero is important, as it completes the cycle, and allows for the code
|
||
9 0, which is the only one not as yet allowed for. I must emphasize the
|
||
importance of quitting as soon as you get the correct code, and also do not
|
||
keep going after the beep, if you are on a modern 2-digit access code system.
|
||
This way, you can record the passcode for your future reference, and prevent
|
||
detection.
|
||
|
||
Now, we shall get on to the question of how to use their system, once
|
||
you've broken in. In general, it is recommended to obtain a copy of the
|
||
owners' manual for various machines, but I have summarized some of the basics
|
||
below.
|
||
|
||
PANASONIC
|
||
|
||
Here are the codes for a Panasonic Easa-phone KX-T1450. The KX-T2420 is
|
||
identical without Room Monitor function In this case, strange things happen
|
||
when you enter 5:
|
||
|
||
1 = Back Space (Rewind the OGM tape)
|
||
2 = Skip Forward (Fast forward the OGM tape)
|
||
3 = Reset (Go back to the beginning of the OGM tape. MAY CAUSE ERASURE!!!)
|
||
4 = Memory Playback (Listen to new messages)
|
||
5 = Room Monitor (!!!! Listen to what is going on in the room NOW !!!!)
|
||
(This is only available on some models... But, try it...)
|
||
7 = OGM-REC (Record a new greeting!!!)
|
||
9 = OGM-STOP (Stop recording the new greeting)
|
||
* = OGM Skip (Don't Listen to the OGM)
|
||
0 = Turn off the machine !!!!!
|
||
|
||
To set to the answer mode remotely,
|
||
1. Dial the phone number
|
||
2. Wait 15 rings and hang up
|
||
|
||
To turn off the unit remotely (!!),
|
||
1. Dial the phone number
|
||
2. Push the code number, wait for the beep, enter 0, and hang up. Panasonic answering machines also respond to the user with a series of
|
||
codes which I will now outline. If you hear something different, you may not
|
||
be on a Panasonic system.
|
||
|
||
1 long beep : This is the "beep" after which people can leave their messages.
|
||
|
||
Also, this is sounded when the correct passcode is entered from
|
||
|
||
a remote telephone. (Same sound- Hint for software developpers)
|
||
It sounds when the tape has fully rewound, and after each
|
||
|
||
message is played back in entirety.
|
||
3 short bps : This sounds after the last message has been played back.
|
||
|
||
2 short bps : (10 seconds later) You are then being recorded - marker message
|
||
|
||
6 short bps : End of the incoming message tpe
|
||
|
||
6 short bps : (Quickly) Tape Broken (either incoming or outgoing)
|
||
|
||
Also, after entering the correct code, and after the one long beep, you will
|
||
hear n additional short beeps, where n is the number of new messages since the
|
||
last time the messages were retrieved. Remember, you can listen to earlier
|
||
ones on the same tape, by additionally backspacing from the first new message.
|
||
|
||
Anyway, that is a basic summary of the Panasonic answering machine system for
|
||
this machine. Many machines unfortunately do not have the Room monitor
|
||
function, so you can not see if you left your TV on, or anything like that...
|
||
Also, not all systems are identical, but on Panasonic machines, the numbers 1-
|
||
4 are the same, so this is the most important thing for you to remember
|
||
anyway...
|
||
|
||
|
||
|
||
AT&T
|
||
|
||
On AT&T machines, like the Answering System 1304, the passcode is again a 2-
|
||
digit number enterable before, during, or after the beep. Follow the same
|
||
guidelines as above.
|
||
|
||
After you enter the correct code on these machines, the system will
|
||
automatically begin to play back new messages. This is one key way to
|
||
distinguish these machines from the Panasonic ones discussed above.
|
||
|
||
To summarize the key functions for the AT&T system, look below:
|
||
|
||
2 Rewind tape (tape rewinds for as long as this key is depressed)
|
||
3 3 Clear messages (reset the tape to the beginning.)
|
||
5 Fast Forward (tape ffwds for as long as this key is depressed)
|
||
7 Replay messages from the beginning
|
||
8 8 Turn off the answering machine
|
||
* Record a memo (After listening to messages) OR
|
||
Skip the greeting (w/o entering code)
|
||
0 Turn on the machine (after hearing two beeps)
|
||
# Pause (for 5-7 seconds)
|
||
|
||
Basically this system is less sophisticated than the Panasonic. You cannot
|
||
change the OGM remotely (Damn!). As seen above, the codes are also quite
|
||
different, but fortunately they are easily distinguished by how they answer
|
||
after the security code is entered. The AT&T plays the messages, while the
|
||
Panasonic just beeps to tell you how many new messages are waiting. Here
|
||
also, the rewind and fast forward functions operate for the length of time you
|
||
depress the 2 and 5 keys respectively. On the Panasonic, they reewind or fast
|
||
forward for 15 seconds. Also, this system has a pause feature. By entering
|
||
the # sign, you can pause for a few seconds while listening to a message. One
|
||
extra safety (from your perspective...) feature is that on this system you
|
||
cannot erase messages until they have all played back, so you have less risk
|
||
of fucking up someone's system if it is an AT&T. You cannot change his
|
||
greeting, and it is difficult to accidentally erase his messages. If you wish
|
||
to do so, however, you must hit the 3 key twice after listening to the
|
||
messages in their entirety. To record a memo (why would you want to do
|
||
this???), you can press the * key after you hear 5 beeps (after listening to
|
||
the messages). Then begin to record. Also, the * key can be used before the
|
||
message is finished to skip listening to the OGM (useful for long distance
|
||
callers who are actually paying for the calls...) without the need for
|
||
entering a security code. To turn on the system from remote points, you need
|
||
to let it ring ten times, and after it answers with 2 "beeps", hit the 0 key.
|
||
It will subsequently be on. Similarly to turn it off, just enter 88. If the
|
||
machine answers the phone with no greeting, and just 2 beeps, it means the
|
||
tape is full. You can now enter the security code (without risk of them
|
||
recording the BEEPS!!!) and listen away for a long time!!! Basically, this
|
||
sums up the properties of the two most common systems I've encountered of the
|
||
2-digit passcode variety. SINGLE DIGIT PASSCODE MACHINES:
|
||
|
||
On some old model Panasonic and Phone Mate systems, the secret entry
|
||
passcode is only a one digit number(!!!). On these primitive systems, one
|
||
merely enters the correct number, during the message, and playback begins.
|
||
The other codes are simple to derive, and just for the sake of making this
|
||
hobby a sport, I will not give details for these systems. It is easy enough
|
||
to figure them out, and on these systems, it is hard to screw things up, as
|
||
there is little you can do anyway.
|
||
|
||
APPLICATIONS:
|
||
|
||
This can be a rewarding adventure if you decide to follow those
|
||
instructions (though far be it from me to suggest you to do this...). I will
|
||
point out some of the potentially entertaining, useful, and/or informative
|
||
applications of this technology.
|
||
|
||
As the true weirdos that we are, we shall begin with what we consider
|
||
the truly entertaining applications... If you have ever read the Village
|
||
Voice, Screw or other such newspaper, you will notice a large number of
|
||
advertisements for "unlicensed massage parlors", "Oriental relaxation spas",
|
||
"Escort services", etc. Call some of those numbers, preferrably at off-duty
|
||
hours (6-9 AM??) and try to hack their answering machine codes, listen to
|
||
their messages, and let the fun begin. You can hear lots of perverts, and
|
||
lowlifes making appointments for "services" about which they are sometimes
|
||
graphic. Also, they often leave telephone and credit card numbers (What
|
||
fun!!!). In case they are married, think of the blackmail potential...
|
||
|
||
Further, these "adult entertainment companies" also often run help
|
||
wanted ads in the Village Voice, and other such publications. Call these, and
|
||
you will get a plethora of phone numbers for nubile young women who might
|
||
believe you are the proprietor of the establishment in question. You might be
|
||
able to con some "free samples" as a sort of "job interview"... (hehehe)
|
||
Especially given the illegal activity they desire to become involved in, they
|
||
will be in no position to complain when they find out you are not for real...
|
||
Also, this way, the girls are often not so jaded as the old pros... They will
|
||
be trying to impress you if you get my drift, so you'll "hire" them.
|
||
|
||
Other similar companies can be hacked to get similar entertaining and
|
||
enjoyable results. In many cases, the outcomes can be QUITE LUCRATIVE in one
|
||
way or another... I do not advocate that you do these things, but I just want
|
||
to point out what COULD be done...
|
||
|
||
Let us move on to the informative espionnage type of application of this
|
||
technology. One could very easily use this technology to listen to the
|
||
messages of friends, and see what they are up to. If you are trying to call
|
||
your buddy Evan, and he isn't home, perhaps you can find out where he is by
|
||
going through some of his old answering messages. Say, Eric called him a
|
||
couple of hours ago and suggested that Evan come over to his place for some
|
||
beers. Well, you could then call Eric and voila, you may connect with Evan.
|
||
|
||
Now, let us assume you have a girlfriend, and you suspect she might be
|
||
cheating on you, yet you do not wish to confront her about it without any
|
||
evidence, or certainty of her cheating. Well, her new beau probably thinks
|
||
her answering machine is secure, and calls leaving messages about their
|
||
upcoming dates, or various discussions of their relationship. If you can hack
|
||
her machine {actually, you might even look at the bottom (where the passcode
|
||
is usually printed...) to save time and energy.} you will be afforded with a
|
||
plethora of potentially incriminating evidence. Hehehe.
|
||
|
||
A similar application can be when you have a new love interest. Suppose
|
||
there is some woman you are interested in, but you aren't sure if she is
|
||
available. A little phone answering machine surveillance can provide all of
|
||
the answers, and then some... In case she asks her friends about you, you'll
|
||
know everything she does. Also, you will learn details about her life, and
|
||
schedule, the better to run into her "accidentally", or strike up a
|
||
conversation about "common" interests...
|
||
|
||
Now, if you know someone in the same profession, say musicians, and you
|
||
call his answering machine, and hear someone offering him a gig. You could
|
||
call that person back, and accept the gig in your name, saying the originally
|
||
called musician was unavailable, but suggested that you call. Then be sure to
|
||
erase the original message on your buddy's machine. He'll never be the wiser,
|
||
and you'll get more work. Though he may wonder why he isn't getting much work
|
||
anymore...
|
||
|
||
Millions of applications exist, and if you have any additional
|
||
suggestions, please leave them with us. We can be reached on several BBS'es,
|
||
in 212, 718, and 914 area codes. Thanks. Also, if you have information on
|
||
other answering machine systems, please pass it along...
|
||
|
||
Again, in closing, we reiterate that the authors take no responsibility
|
||
for the misuse of this information. The ideas for applications were presented
|
||
for informational and entertainment purposes only, and we do not encourage you
|
||
to try any of the above suggestions. Remember, listening to the pass-code
|
||
protected messages of others constitutes an invasion of privacy, and may be in
|
||
violation of state and federal laws.
|
||
|
||
******************************************************************************
|
||
|
||
ANOTHER FINE PIZZ-SPERM T-FILE...
|
||
|
||
Please upload this file to other fine BBS'es, and give credit to the original
|
||
authors, Doctor Pizz and Cybersperm, of the TUBA crew.
|
||
|
||
******************************************************************************
|
||
|
||
|
||
***************************************************************
|
||
* *
|
||
* Another Fine File From the libraries of the TUBA crew. *
|
||
* *
|
||
***************************************************************
|
||
|
||
____ _______ *
|
||
/ \ ___ ___ ____ ___ ___ / / ___ ___
|
||
/ // // / / // / /______/ / / /
|
||
/ // // / / //-< / / / /
|
||
/_____//__//__ / /__// / / / /__ /__
|
||
|
||
-N-
|
||
|
||
CCCC Y Y BBB EEEE RRR SSSS PPP EEEE RRR M M
|
||
C Y Y B B E R R S P P E R R MM MM
|
||
C Y BBB EEE RRR SSSS PPP EEE RRR M M M
|
||
C Y B B E R R S P E R R M M M
|
||
CCCC Y BBB EEEE R R SSSS P EEEE R R M M M
|
||
|
||
|
||
|