Copy Link
Add to Bookmark
Report
k-1ine_04
?%%%%;;;;;:;:;:;:;:;: ±±±±± {[ K - 1 i n e ^4^ ]} ±±±±± :;:;:;:;:;:;;;;;%%%%? _i love you_ --
Volume 2: The Heroin Edition
Fundamentalism (of any kind) troubles me. The world is too big and too
intricate to conform to our ideas of what it should be like. In my
experience I've found that most fundamentalists aren't so much attached to
their professed ideologies as they are to the way in which these ideologies
try to make sense of a confusing world.
But the world is confusing, and just because we invent myths and
theories to explain away the chaos we're still going to live in a world
that's older and more complicated than we'll ever understand. So many
religious and political and scientific and social systems fail in that
they try to impose a rigid structure onto what is an inherently ambiguous
world. I'm not suggesting that we stop trying to understand the world can
be fun and, at times, helpful. But if we base our belief on systems on the
humble assumption that the complexities of the world are ontologically
beyond our understanding, then maybe our belief systems will make more
sense and end up causing less suffering.
± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ±
"I hate it when people say 'I've got a tune that'll be right up your street',
and it'll be a big beat version of the Mastermind theme."
- Damian Harris, Skint Records
~-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-~
^: # Table of Contents # [] :^
~-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-~
____________________________________________________________________________
^; | Now a word from our sponsor! -- KICKZ0RS (r) | ;^
:-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`:
^; | Now a word from the Editor -- The Clone | ;^
:-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`:
^; | 'Jawa The Felcher' -- Anonymous | ;^
:-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`:
^; | iSEC Australia 2000 -- iSEC | ;^
:-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`:
^; | INWATS: 611-7XXX suffix skan -- The Clone | :
:-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`:
^; |The SS7 Signaling Connection Control Part Relay System -- The Clone |;^
:-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`:
^; | ADVERTISEMENT; SecurityNews.ORG | ;^
;^^.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,^^;
____________________________________________________________________________
t
r
a
n
s
m
i
s
s
i
o
n
l
o
o
p
e
d
.
.
.
=-=-
==
-= - . -= = =- -= -
= ., . , -=-=-=-=- =- -= -= =- = = -=
= , . =-
== - , , ;. --{[{{}}{[infinity refresh]}{{}}]}-- , , ;. - ==
- - = - -= = - .,. ,. -= =-
= = - .,. , - , ,. , =- -=
- -= , , . . . ., =- -= = .=,
, , ., , ., ,
a
t r i p o m a t i c sound f r o m f o r e i g n
a t h m o s p h e r e
a n d a g r i n n i n g c a t
w a s h e r e
'Now a word from our sponsor!'
;@n3b
_____________
_-_______-___ * WHAT'S THE NASTIEST, MOST EVIL, HORRIFYING,
KICKZ0RS (r) PSYCHOLOGICALLY DAMAGING TRICK YOU CAN IMAGINE?
WE /KICK ASS What's the most distressing stunt you could possibly pull?
_-_______-___ A joke that would make Lucifer, the Prince of Darkness
_____________ himself, wince?
* Why, it's to MAKE YOUR LOVED ONE BELIEVE THEY'VE WON
THE LOTTERY, when they haven't! Doesn't that sound like fun?
* TO BRING YOUR PARTNER TO THE VERGE OF A NERVOUS BREAK DOWN
JUST FOLLOW THIS SIMPLE GUIDE:
STICK IT UP YOUR JACKPOT!
Billed As One of The Cruelest Scams of ALL Time!
THE NATIONAL LOTTERY Wind-Up!
/KICK ASS - INSTRUCTIONS:
1. Secretly video the NATIONAL LOTTERY SHOW one Saturday.
2. The next day buy a ticket with the same winning numbers.
3. The following Saturday, settle in with your poor innocent partner to watch
the draw.
4. Create a diversion and PRESS PLAY on the video.
5. As the moment of the draw approaches, ask your partner to check the number
on your ticket while you go to the loo.
6. Hide behind the door and secretly watch your partner's face as, one by one,
ALL THE WINNING NUMBERS seem to come up.
7. Return to find your partner jumping up and down as they imagine wealth
beyond their wildest dreams.
8. P A U S E the video...
9. WITNESS THE VIOLENT, DERANGED BEHAVIOUR of someone who has had their dreams
built up only to be cruelly dashed on the rocks of reality.
LUCKY FOR THEM, THEY DIDN'T WIN!
NOW THEY WON'T...
[X] Be plagued with begging letters from distant relatives.
[X] Sink into booze and drugs hell, once they've blown the lot.
[X] Have to live in a disgustingly vulgar mansion in Esher.
[X] Appear in tabloid "How the Lottery Ruined My Life" stories.
[X] Engage in a fruitless mission to revive the fortunes of an
ailing third division football club, and purchase over-priced
Brazilian stars.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
BLOW THEIR MINDS - GUARANTEED
While we're on the subject of
L O N G S H O T S
THE CHANCES OF:
[] Swimming in a urine-free public pool - 950,322: 1
[] Meeting a Rugby player who doesn't fiddle with his goalies - 1,320,004,675: 1
[] Meeting perfume counter-girl with convincing fake tan 256,001,003: 1
[] Nude trampolining being accepted as an Olympic sport - 800,000,000,000,000: 1
[] Hiring a responsible builder who is punctual with his work and cleans up after
himself - No chance
#00.005/15/LOTTERY
LEGAL SCHMEGAL:
When we showed this ad to our crack legal department, they were aghast, one lawyer
even fainted. They imagined assaults, attacks, murders and divorces resulting from
people being exposed to this ad. They imagined themselves in court, permanently,
defending against endless "KICKZ0RS made me do it" -themed lawsuits and claims.
Weeping, quietly, from under a desk, we heard them whimper a plea to inform you
that the above material is for entertainment purposes only and is not intended
to be acted upon. KICKZ0RS accepts no responsibility for the consequences of any
actions taken based on the above. (No matter how funny it is)
__ KICKZ0RS (r) isn't really a registered Trademark of Nettwerked, 2000. __
____________________________________________________________________________
'Now a word from the Editor'
Ah yes... another FINE issue of K-1ine, indeed! And what better way to release
this issue, then RIGHT slap in the middle of May.
Are you excited? Was waiting a whole month for another issue of K-1ine too
much to handle? Off your rocker? Go crazy?!!?!?? I don't blame you.
If you don't remember, K-1ine has now been around for over one year... and is
already on the second volume. Pretty snazzy, eh? So please, sit back and relax,
and prepare yourself for 'K-1ine 4 - Volume 2: The Heroin Edition'.
Regards,
The Clone
http://nettwerk.hypermart.net - N e t t w e r k e d
webmaster@nettwerk.hypermart.net - I got this account for FREE!
__________________________________________________________________________________
'Jawa The Felcher'
by: Anonymous
There once was a felcher named Jawa...
who delighted in felchin his momma...
he was loathe to disclose...
how he injured his nose...
but it involved a straw and iguana!
--
_________________________________________________
iSEC Australia 2000 - July 4-6, 2000,
Melbourne Convention Centre, Melbourne, Australia.
The main IT security conference in Australia.
Visit: http://www.isec-worldwide.com
__________________________________________________
'INWATS: 611-7XXX suffix skan'
- -
By: The Clone
Date: Tuesday May 2, 2000
- -
Type: INWATS suffix scan (manual)
Numbers skanned: 500
NPA: 780
- -
1-800-611-7XXX
--------------
611-70XX
--------
611-7000 - Karrib Customer Service
611-7001 - "Debbie"
611-7002 - "Phillip"
611-7003 - Not In Service
611-7004 - "Angie"
611-7005 - "Joe"
611-7006 - "Hersh"
611-7007 - Not In Service
611-7008 - Some Office
611-7009 - "Issac"
611-7010 - Calling Area
611-7011 - Alergy Asthma Information Association
611-7012 - Disconnected
611-7013 - Not In Service
611-7014 - Beeping In a Loop
611-7015 - Busy
611-7016 - Not In Service
611-7017 - Call Cannot Be Completed
611-7018 - Calling Area
611-7019 - Not In Service
611-7020 - Not In Service
611-7021 - James Herten's Message Service
611-7022 - Not In Service
611-7023 - Jack Devon; Care Givers Database Report Line
611-7024 - Not In Service
611-7025 - Not In Service
611-7026 - Disconnected
611-7027 - Not In Service
611-7028 - Calling Area
611-7029 - Not In Service
611-7030 - Calling Area
611-7031 - Jerry Decoray's Message Service
611-7032 - Not In Service
611-7033 - Modem Carrier
611-7034 - Not In Service
611-7035 - Calling Area
611-7036 - Not In Service
611-7037 - Calling Area
611-7038 - Not In Service
611-7039 - Not In Service
611-7040 - Not In Service
611-7041 - Call Cannot Be Completed
611-7042 - Not In Service
611-7043 - Not In Service
611-7044 - Glaymen Placement Services
611-7045 - Not In Service
611-7046 - Not In Service
611-7047 - Calling Area
611-7048 - Calling Area
611-7049 - Not In Service
611-7050 - Fax
611-7051 - Safe-S Message Service
611-7052 - Not In Service
611-7053 - Total Travel and Tickets
611-7054 - Extremely Loud Tone
611-7055 - Numeric Message System
611-7056 - "Hello?"
611-7057 - No Answer
611-7058 - FAX
611-7059 - US Airways System - Not In Service
611-7060 - Call Cannot Be Completed
611-7061 - Call Cannot Be Completed
611-7062 - Equips' Communications
611-7063 - Calvin Phillip - Free Enterprises Incorporated
611-7064 - Not In Service
611-7065 - Fallicam
611-7066 - Not In Service
611-7067 - Call Cannot Be Completed
611-7068 - Not In Service
611-7069 - Calling Area
611-7070 - Not In Service
611-7071 - Not In Service
611-7072 - Not In Service
611-7073 - Not In Service
611-7074 - Some French Lady
611-7075 - Predential Security
611-7076 - Calling Area
611-7077 - Modem Carrier
611-7078 - "Hello?"
611-7079 - Adices
611-7080 - Adices
611-7081 - Adices
611-7082 - Adices
611-7083 - Adices
611-7084 - Adices
611-7085 - Adices
611-7086 - Adices
611-7087 - Adices
611-7088 - Adices
611-7089 - Adices
611-7090 - Adices (by this point they got really pissed off at me)
611-7091 - Call Cannot Be Completed
611-7092 - Hang Up
611-7093 - Not In Service
611-7094 - Not In Service
611-7095 - Call Cannot Be Completed
611-7096 - Cellular Number Not In Service - Message 1T22
611-7097 - 0403 - Invalid Location
611-7098 - Not In Service
611-7099 - Not In Service
611-71XX
--------
611-7100 - Not In Service
611-7101 - Not In Service
611-7102 - Calling Area
611-7103 - Calling Area
611-7104 - Calling Area
611-7105 - Calling Area
611-7106 - Not In Service
611-7107 - Bis-Cycle/Sports Order Dept.
611-7108 - Not In Service
611-7109 - Not In Service
611-7110 - Busy
611-7111 - Not In Service
611-7112 - Not In Service
611-7113 - Not In Service
611-7114 - Call Did Not Go Through
611-7115 - No Answer
611-7116 - Not In Service
611-7117 - Not In Service
611-7118 - Reddel's Voice-mail Box
611-7119 - Lisa's Voice-mail Box
611-7120 - Calling Area
611-7121 - Not In Service
611-7122 - Call Cannot Be Completed
611-7123 - Operator Services
611-7124 - Not In Service
611-7125 - Calling Area
611-7126 - Calling Area
611-7127 - Not In Service
611-7128 - Not In Service
611-7129 - Busy
611-7130 - Personal Identification Number (PIN)
611-7131 - Call Cannot Be Completed
611-7132 - Dental-plan Office
611-7133 - Calling Area
611-7134 - Call Cannot Be Completed
611-7135 - Calling Area
611-7136 - Calling Area
611-7137 - Not In Service
611-7138 - Not In Service
611-7139 - Not In Service
611-7140 - Mainstream Associates
611-7141 - Calling Area
611-7142 - Not In Service
611-7143 - Not In Service
611-7144 - Calling Area
611-7145 - Calling Area
611-7146 - Not In Service
611-7147 - Call Cannot Be Completed
611-7148 - Not In Service
611-7149 - Catherine Brooks (Music and Arts)
611-7150 - Busy
611-7151 - Not In Service
611-7152 - Not In Service
611-7153 - Bell Atlantic's Voice Messaging Service
611-7154 - Calling Area
611-7155 - Calling Area
611-7156 - Personal Assisant
611-7157 - Call Cannot Be Completed
611-7158 - Not In Service
611-7159 - Your Conference Call
611-7160 - Not In Service
611-7161 - Not In Service
611-7162 - Not In Service
611-7163 - Call Cannot Be Completed
611-7164 - Busy
611-7165 - Calling Area
611-7166 - Busy
611-7167 - Busy
611-7168 - Busy
611-7169 - Busy
611-7170 - Busy
611-7171 - Not In Service
611-7172 - Busy
611-7173 - Busy
611-7174 - Busy
611-7175 - Busy
611-7176 - Busy
611-7177 - "Hello?"
611-7178 - Not In Service
611-7179 - Not In Service
611-7180 - Elm Street Records Voice Mail System
611-7181 - Not In Service
611-7182 - Not In Service
611-7183 - Not In Service
611-7184 - Business by Promotion
611-7185 - Conference Call Centre
611-7186 - Calling Area
611-7187 - Call Cannot Be Completed
611-7188 - Not In Service
611-7189 - Not In Service
611-7190 - No Answer
611-7191 - Voice Messaging
611-7192 - Calling Area
611-7193 - Calling Area
611-7194 - Calling Area
611-7195 - Calling Area
611-7196 - Calling Area
611-7197 - Calling Area
611-7198 - Calling Area
611-7199 - No Answer
611-72XX
--------
611-7200 - Calling Area
611-7201 - Conference Call
611-7202 - Not Working Number at Shareholder Communications
611-7203 - Not In Service
611-7204 - No Answer
611-7205 - Calling Area
611-7206 - Leaseway Pension Administration
611-7207 - Calling Area
611-7208 - Calling Area
611-7209 - Synthetic Industries
611-7210 - Calling Area
611-7211 - Not In Service
611-7212 - Call Cannot Be Completed
611-7213 - Disconnected
611-7214 - Disconnected
611-7215 - Call Cannot Be Completed
611-7216 - American Institute of Chemists
611-7217 - American Express (Spanish)
611-7218 - Not In Service
611-7219 - Number is Not Correct
611-7220 - Not In Service
611-7221 - Calling Area
611-7222 - 'Yes' Capital Funding
611-7223 - Not In Service
611-7224 - No Answer
611-7225 - Calling Area
611-7226 - Not In Service
611-7227 - FAX
611-7228 - Not Working Number at Shareholder Communications
611-7229 - Pitchfloor Painting
611-7230 - Not In Service
611-7231 - Not In Service
611-7232 - Calling Area
611-7233 - Not In Service
611-7234 - Calling Area
611-7235 - Calling Area
611-7236 - Not In Service
611-7237 - Not In Service
611-7238 - "Four Digit Study Code", "Two Digit Centre Number"
611-7239 - Not In Service
611-7240 - Calling Area
611-7241 - Call Cannot Be Completed
611-7242 - Electronic Systems
611-7243 - Not In Service
611-7244 - Not In Service
611-7245 - Modem Carrier
611-7246 - Not In Service
611-7247 - Busy
611-7248 - Not In Service
611-7249 - Shela Hyne's Answering Machine
611-7250 - Conference Recall Recording Program
611-7251 - Call Cannot Be Completed
611-7252 - Not In Service
611-7253 - Calling Area
611-7254 - Not In Service
611-7255 - Not In Service
611-7256 - Not In Service
611-7257 - Not In Service
611-7258 - Call Cannot Be Completed
611-7259 - Call Cannot Be Completed
611-7260 - Modem Carrier
611-7261 - Wonwash Message Service
611-7262 - Calling Area
611-7263 - "Hello?"
611-7264 - Call Cannot Be Completed
611-7265 - Calling Area
611-7266 - Answering Machine
611-7267 - Not In Service
611-7268 - Not In Service
611-7269 - Not In Service
611-7270 - Calling Area
611-7271 - Ron Webber and Associates
611-7272 - Not In Service
611-7273 - Not In Service
611-7274 - Not In Service
611-7275 - Not In Service
611-7276 - Busy
611-7277 - Pasency Wall and Grant
611-7278 - Bluebunny - NASCAR Promotion
611-7279 - Country Wide Home Loans [www.countrywide.com]
611-7280 - "Please Hang Up and Try Your Call Again!" X 2
611-7281 - Call Cannot Be Completed
611-7282 - Not In Service
611-7283 - "Hello?"
611-7284 - Not In Service
611-7285 - No Answer
611-7286 - Not In Service
611-7287 - Sam Manny
611-7288 - Bank of America
611-7289 - Not In Service
611-7290 - Not In Service
611-7291 - Call Cannot Be Completed
611-7292 - Not In Service
611-7293 - Not In Service
611-7294 - Not In Service
611-7295 - No Answer
611-7296 - Bellingham Division of Social and Health Services
611-7297 - "Two Hundred Fifty"
611-7298 - Call Cannot Be Completed
611-7299 - Pottingham Home Office
611-73XX
--------
611-7300 - Not In Service
611-7301 - Call Cannot Be Completed
611-7302 - Not In Service
611-7303 - Not In Service
611-7304 - Not In Service
611-7305 - Not In Service
611-7306 - Not In Service
611-7307 - Trina (Help Desk)
611-7308 - Not In Service
611-7309 - Automedies Prompt Recorder
611-7310 - Busy
611-7311 - Call Cannot Be Completed
611-7312 - Not In Service
611-7313 - Busy
611-7314 - Busy
611-7315 - Not In Service
611-7316 - Olympic Autoglass (! Gateway Vulnerability !)
611-7317 - Queeneven Pump Company
611-7318 - Not In Service
611-7319 - Not In Service
611-7320 - Beep Beep Beep
611-7321 - Call Cannot Be Completed
611-7322 - Calling Area
611-7323 - Not In Service
611-7324 - Intercall
611-7325 - Not In Service
611-7326 - PLC Reconciliation Team
611-7327 - Brent @ Free Flight Cargo Services
611-7328 - Calling Area
611-7329 - Calling Area
611-7330 - Beep Beep Beep
611-7331 - Call Cannot Be Completed
611-7332 - Beep Beep Beep
611-7333 - Call Cannot Be Completed
611-7334 - Beep Beep Beep
611-7335 - No Answer
611-7336 - Call Cannot Be Completed
611-7337 - Not In Service
611-7338 - Busy
611-7339 - Beep Beep Beep
611-7340 - Beep Beep Beep
611-7341 - Call Cannot Be Completed
611-7342 - Not In Service
611-7343 - San Diego Gas and Electric
611-7344 - Call Cannot Be Completed
611-7345 - Law office of Mary Tyler Moore
611-7346 - IBM
611-7347 - "Hello?"
611-7348 - Disconnected / Not In Service
611-7349 - IBM
611-7350 - Unassigned Extension at IBM
611-7351 - Call Cannot Be Completed
611-7352 - Calling Area
611-7353 - IBM
611-7354 - Disconnected / Not In Service
611-7355 - Calling Area
611-7356 - Calling Area
611-7357 - Credit Collection Agency of Southern Virginia
611-7358 - Calling Area
611-7359 - Not In Service
611-7360 - Not In Service
611-7361 - Call Cannot Be Completed
611-7362 - Semcor 800 Support Line
611-7363 - Calling Area
611-7364 - Modem Carrier
611-7365 - Not In Service
611-7366 - Not In Service
611-7367 - Not In Service
611-7368 - Not In Service
611-7369 - Calling Area
611-7370 - Triple A Collections
611-7371 - Busy
611-7372 - Not In Service
611-7373 - Not In Service
611-7374 - JCR
611-7375 - Not In Service
611-7376 - "Hello!"
611-7377 - Honeywell Data Instruments
611-7378 - Busy
611-7379 - Jen Sherman at AT&T
611-7380 - News Century Morgage
611-7381 - Conference Recall
611-7382 - Call Cannot Be Completed
611-7383 - Not In Service
611-7384 - Busy
611-7385 - Glen Davis and Associates
611-7386 - Not In Service
611-7387 - American Health
611-7388 - Not In Service
611-7389 - Not In Service
611-7390 - Calling Area
611-7391 - Beep Beep Beep
611-7392 - Not In Service
611-7392 - Not In Service
611-7394 - Not In Service
611-7395 - Not In Service
611-7396 - Not In Service
611-7397 - Not In Service
611-7398 - Not In Service
611-7399 - Not In Service
611-74XX
--------
611-7400 - Stack Builders
611-7401 - Not In Service
611-7402 - Not In Service
611-7403 - Not In Service
611-7404 - * Line Seizing Problem = Exploitable! *
611-7405 - Dave's Courier Express Incorporated
611-7406 - Hick: "Hella?"
611-7407 - G and K Services
611-7408 - Ring... *hang up*
611-7409 - Not In Service
611-7410 - Ring... *hang up*
611-7411 - Not In Service
611-7412 - Calling Area
611-7413 - Calling Area
611-7414 - Not In Service
611-7415 - Calling Area
611-7416 - Not In Service
611-7417 - "Hello?"
611-7418 - Not In Service
611-7419 - Calling Area
611-7420 - Calling Area
611-7421 - Calling Area
611-7422 - Disconnected / Not In Service
611-7423 - Not In Service
611-7424 - Disconnected
611-7425 - Number Not Correct
611-7426 - Calling Area
611-7427 - Not In Service
611-7428 - Invalid / Blocked from Area Code
611-7429 - Invalid / Blocked from Area Code
611-7430 - "Hello?"
611-7431 - Not In Service
611-7432 - No Answer
611-7433 - Not In Service
611-7434 - Calling Area
611-7435 - No Answer
611-7436 - Not In Service
611-7437 - Not In Service
611-7438 - Authorization Code System
611-7439 - Authorization Code System
611-7440 - Chris Otomo @ Bell South
611-7441 - Massons
611-7442 - Authorization Code System
611-7443 - Not In Service
611-7444 - Not In Service
611-7445 - Disconnected / Not In Service
611-7446 - Not In Service
611-7447 - Veterinary Clinic (University of Minnisota)
611-7448 - Not In Service
611-7449 - Not In Service
611-7450 - Not In Service
611-7451 - Call Did Not Go Through
611-7452 - Cannot Be Completed
611-7453 - Not In Service
611-7454 - Not In Service
611-7455 - Not In Service
611-7456 - Not In Service
611-7457 - Authorization Code System
611-7458 - Calling Area
611-7459 - Not In Service
611-7460 - Not In Service
611-7461 - Not In Service
611-7462 - Message Centre
611-7463 - Not In Service
611-7464 - Calling Area
611-7465 - Shirly Mills
611-7466 - Not In Service
611-7467 - Carlton H Agency
611-7468 - Calling Area
611-7469 - Life Boat Publishing (Audex)
611-7470 - Life Boat Publishing (Audex)
611-7471 - Not In Service
611-7472 - Not In Service
611-7473 - Calling Area
611-7474 - Calling Area
611-7475 - Calling Area
611-7476 - Adnidas Mail Box
611-7477 - Not In Service
611-7478 - Not In Service
611-7479 - Not In Service
611-7480 - Not In Service
611-7481 - Not In Service
611-7482 - Not In Service
611-7483 - Not In Service
611-7484 - Not In Service
611-7485 - Calling Area
611-7486 - Not In Service
611-7487 - Invalid Number
611-7488 - AIM International
611-7489 - Not In Service
611-7490 - LOW TONE
611-7491 - "Hello?"
611-7492 - LOW TONE
611-7493 - Bob & Sheryn
611-7494 - Busy
611-7495 - Not In Service
611-7496 - Apartment and Home Hunters
611-7497 - Conference Recall Recording Program
611-7498 - Siren * beep beep beep *
611-7499 - LOW TONE
webmaster@nettwerk.hypermart.net
h t t p : / / n e t t w e r k . h y p e r m a r t . n e t
___ ___
The SS7 Signaling Connection Control Part Relay System
___ ___
Friday May 12, 2000
^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^
-- Research --
++ Introduction ++
++ Key Benefits of SCCP Relay ++
++ Platform & Application / Security Issue ++
++ SCCP Relay & GTT Functional Description ++
++ SCCP Relay Software Architecture ++
++ SCCP Relay Hardware Architecture ++
-- GSM Background Information --
+ Home Location Register (HLR) +
+ Visitor Location Register (VLR) +
+ International Mobile Subscriber Identity (IMSI) +
+ GSM's Mobile Station Equipment (MSE) +
-- GSM Call Routing --
+ Mobile Subscriber Roaming +
+ Mobile Subscriber ISDN Number (MSISDN) Call Routing +
+ Implementation of a second HLR to the GSM Network +
-- References --
++ Web-site Resources ++
++ Acronym Definitions ++
-- Wrap-up --
+* Conclusion *+
+* Contact *+
^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^
Introduction --
As the number of wireless subscribers throughout Canada and the United States
continues to increase dramatically each year, wireless carriers will be facing
the challenges that rapid growth creates. One such challenge in this market
is the migration from a single Home Location Register (HLR) to a multiple HLR
topology.
The HLR, which successfully stores critical identification and
subscription information about each customer, can become a network bottleneck
either because of the sheer number of subscribers contained in the database, or
because of the number of SS7 messages arriving at the HLR. A single HLR also
poses a risk to the overall survivability of the entire wireless service under
the new SS7 protocol.
Assembling additional HLR carriers to a wireless network presents significant
and problematical challenges, however. If the existing routing algorithms are
simply expanded, then every Mobile Switching Center (MSC) and Signal Transfer
Point (STP) on the network is affected, and the routing table management becomes
extremely complicated and highly error prone.
(STPs are the packet switches of the SS7 network. They receive and route incoming
signaling messages towards the proper destination and also perform specialized
routing functions.)
Many of the challenges in multiple HLR deployment are constantly an issue,
and are constantly being worked upon. Fortunately a company by the name
of MicroLegend has developed a centralized SS7 message routing system called
the 'SCCP Relay.' The SCCP Relay supports all of the necessary GSM SS7 message
routing tables to allow wireless carriers (specifically GSM/GPRS) to easily
expand to a multiple HLR topology.
Throughout this document, I will attempt to introduce a new technology within the
new world of the Out-of-band signaling SS7 architecture -- it is here to stay
and it has taken over the world telecommunications significantly from its older
counterpart switching system known as 5ESS.
Now please, sit back and relax, and prepare to enter the world of the SS7 Signaling
Connection Control Part Relay System...
Key Benefits of SCCP Relay --
A number of key benefits of the SCCP Relay (which deserve some mention) are:
'Reduced operations and maintenance overhead'
-------------------------------------------
The routing information for each subscriber is centralized in the SCCP Relays,
rather than being distributed among all of the STPs (Signal Transfer Point)
and MSCs (Mobile Switching Center). This useful and practical method simplifies
the process of entering and maintaining STP/MSC information, not to mention
the problems involving troubleshooting of SS7 routing.
'Providing a scaleable architecture for growth'
--------------------------------------------
The SCCP Relay simplifies the addition of multiple Home Location Registers (HLRs)
as the network itself develops. Much work has been done in this sector of
SCCP development, and will continue to innovate the telecommunications industry.
'Improved overall network reliability'
------------------------------------
The SCCP Relay supports the automatic routing of SS7 messages to a backup
Home Location Register (HLR) in the event of a Primary HLR failure. This
unique and useful feature enables the multiple HLRs to be configured in a
redundant and scaleable fashion, entering that the service itself remains
available to customers even in the rare case of an HLR failure. From my
knowledge of the SCCP Relay system, its up-time is approximately 99.99%. Impressive.
'Flexible connection options'
---------------------------
The SCCP Relay supports all types of Signaling System 7 (SS7) links, it can
operate as an STP (Signaling Transfer Point), connecting directly to mobile
switching centers (MSCs), Home Location Registers (HLRs) and other end nodes.
Typically, the flexible connection types of SS7's Signaling Transfer Points (STP)
can be configured to the proper destination in existing incoming routing functions.
'Mated pair deployment / Auto re-routing'
---------------------------------------
The SCCP Relay is deployed in a mated pair configuration, with each link being
fully and 100% redundant. Each mated pair system is capable of handling the full of
of network traffic (5,000,000 subscribers) with virtually no problems whatsoever.
Platform & Application / Security Issue --
Since its inception in 1994, Microlegend has focused exclusively on Signaling
System 7 network solutions. Microlegend's products support Intelligent Network
services, resolve interworking problems, switching signaling traffic, interface
SS7 and IP networks, and PROTECT network resources for telecommunications companies
worldwide.
Because of this, Microlegend has implemented ways which enable them to do
their job quickly and reliably. Unfortunately the problem they are faced with
is the issue concerning database security.
For example:
When Microlegend's team of engineers want to perform system diagnosis,
software updating, and subscriber databasing with "maximum efficiency", they
simply use a dial-up connection. This dial-up connection (located in Ottawa Ontario)
requires absolutely no login or password at all - just the telephone number,
and the optimal performing Unix Operating System known as 'VxWorks'.
What is at stake:
- Microlegend faces being compromised by hackers/phreakers and malicious
persons. These persons could take advantage of this security flaw and
steal potentially sensitive company information.
- The telecommunications infrastructure which supports well over 5,000,000
(five million) subscribers throughout Canada and the United States.
- Loss of revenue in the Billions due to time spent security auditing.
What can be done:
Instead of Microlegend compromising security for obscurity by using a dial-up
account to perform their system diagnosis, software updating, and subscriber
databasing, they should use their 10BaseT Ethernet LAN with an SSH connection
to perform the necessary tasks.
SCCP Relay & GTT Functional Description --
A detailed understand of the SCCP Relay product requires quite a bit of
grounding in the works of GSM networks. For convenience, I will explain
the brief key concepts of GSM network operation in relation to SCCP Relay
and GTT functioning.
The SCCP Relay provides a "central point" for GTT provisioning and execution on
behalf of the entire GSM carrier's SS7 network. The SCCP Relay performs GTT
capabilities for both the IMSI (123049210) and MSISDN (Mobile Subscriber Integrated
Services Digital Network) Adress types, eliminating the need to continually manage the
routing tables within STPs (Signaling Transfer Point) or MSCs (Mobile Switching Center).
ASCII Diagram _______
------------- / --- ( ( | ) ) - MSC
/ /-- -------
/ /
SCCP Relay STP/MSC / /
\ / / /
___ ___ / /
| | | |__/ /
| | ---- | |\ /
| | | | \ /
--- \ / --- \ \
\/ | /\ \ ___
/\ | / \ \ (___) - HLR
/ \ |/ \ --- | |
___ / \ ___ \ /--(___)
| | | | __/
| | ---- | | / \
| | | |-/ \
--- --- \ \--;__ __
\ ------- | || | - Gateway STP
/ \ -- --
SCCP Relay STP/MSC
[[ The SCCP Relay is deployed as a redundant pair of signaling nodes that can
be accessed via SS7 links connected to currently deployed STPs or can be utilized
as the STPs themselves. Where STPs previously have been deployed, the SCCP
messages are routed to the Relay (partial GTT) by the STP/MSC. The SCCP Relay
then performs system translation (either full or partial, depending on the provisioned
data), and routes the message back to the network to be automatically forwarded
to the destination HLR. The SCCP Relay can also perform the MTP routing, which is
the main function of the STPs. This incredible capability enables the SCCP Relay to
be deployed in networks without STPs. See the ASCII Diagram Above. ]]
SCCP Relay Software Architecture --
The SCCP Relay System is a solution based upon the 'Versatile Signaling Point' (VSP).
|| [look for a guide pertaining to VSP on
Nettwerked soon: http://nettwerk.hypermart.net] ||
At the "heart" of the SCCP Relay is the object oriented SS7 stack that provides
all the basic capabilities of a Signaling Transfer Point (STP) without compromising
speed or security (well, maybe not security... but I'll look into it).
The VSP SS7 Stack includes MTP and SCCP layer functionality with a configurable
GTT application, along with user interface, functioning log files (intruders beware!),
and several SCSI Disk Processes.
The GTT process supports both IMSI and MSISDN numbering formats, and as
a group, these processes are referred to as the SS7 Message Handler Unit (MHU).
Basically what the SS7 MHU does is simple: it terminates the SS7 links, performs
the GTT on incoming SS7 messages, and then re-routes the messages back onto the
SS7 network. To optimize its performance, the MHU runs on that real-time UNIX
operating system (you guessed it) 'VxWorks'.
The SCCP Relay system with its Versatile Signaling Point platform also includes
an independent Database Administration Unit (DAU), that supports the provisioning
and administration of the GTT data. The DAU, which happens to run on a UNIX-based
Operating system (gotta love UNIX!) called AIX, includes a command parser, database
manager, and an SCSI disk interface. The DAU and MHU communicate with each other in
parallel a highly redundant 10BaseT Ethernet LAN. An Ethernet WAN is used to
connect the SCCP Relays, to ensure that they remain synchronized with each other
properly.
In addition to the software running on the DAU and MHU, the SCCP Relay system
incorporates a Graphical User Interface (GUI) program that can be installed on
several of the operating stations. This user interface provides the ability to
provision and view the GTT data that resides on the DAU, as well as the option
to view the log information collected about GTT database transactions!
The operation stations connect to the SCCP Relay through a LAN or WAN, depending
on what option you choose. In addition, a custom interface to an existing provisioning
system can be developed to provision and view the entire GTT database.
For convenience check out the following terribly drawn ASCII diagram to get a better
idea about how the SCCP Relay's DB Admin works with AIX and how the Message Handler
works with VxWorks and how they all work together on the seamless 10BaseT LAN/WAN.
ASCII Diagram
-------------
|
- - - - - [#] ~ Console 10 BaseT ~
| |
- Serial Cable SCCP Relay
| ..____________________________________________ |
. / DB Admin Unit \
| | |---|
| |
| | (Command Parser)--------------------|---|- (@@)
| \ \ | Customer
| | \ \ | Defined Admin
| \ \ | Interface
| | (SCSI Control)--------(DB Manager) | | |
| / \ |
| | / \_ _ _ _ _ _ _|_ _($#)
| / | Ops Station
| | AIX / | |
|==============================================|
| | SS7 Msg Handler | |
| (GTT Application)________ |
| | | | \ | |
| (SCSI Control)----------(Log Server) |
| | | | | | |
------ | | | | (MTP UI) |
| __________|_________| | | | |
| (( SS7 [SCCP Layer] |)) | | |
| (( Stack _/ )) | | | |
| (( [MTP Layer]___))__| | | \____(#!)
| (( |||| |____))________| | |--Mate
| +__________||||_________+ | SR System
| |||| | |
| |||| |
| VxWorks |||| | |
\______________||||___________________________|
SS7 Links |
SCCP Relay Hardware Architecture --
The VSP platform, on which the SCCP Relay runs, is available in a verity
of configurations and sizes. The VSP scales smoothly from an economical system
with only four SS7 links to a fully loaded system with over 75 SS7 links.
The basic structure of the hardware components of the SCCP Relay, regardless
of the size and configuration, are exactly the same. The only real differences
between small systems and large systems are the number of cards, and the size of
the chassis itself.
The MHU is controlled by a System Controller card based on a 200 MHz PowerPC(tm)
processor. This processor controls the system level functions, including the TCP/IP
port, the serial ports, and the SCSI interface for the disk drive. It also provides
control for two Link Interface (LI) cards, with up to four SS7 links on each.
As these Link Interface cards are added, every third card is a Link controller card,
with its own 300 MHz PowerPC(tm) processor. This distributed processor architecture
ensures that the SCCP Relay has sufficient power to handle very large numbers of
subscribers (over 5,000,000 [Five Million]).
Each Link Interface card can support as many as four (4) SS7 Links. The V.35 cards
provide four SS7 ports, while the E1 and T1 versions provide two SS7 ports each.
The DAU runs in its own independent chassis, with its own independent fan, SCSI disk
and power supply. It uses the same System Controller card as the MHU, without the need
for the use of any Link Interface or Link Controller cards.
ASCII Diagram
-------------
Database Administration Unit
_________________________________________________________
| |
| |
10BaseT | |
_______| [Disk (AIX)] | DC Supply
| {{Fan}} [*Power Supply*] ____|__
| |
| |
Serial | {{{Processor - System Controller}}} |
(Console) | |
_______| |
|_________________________________________________________|
| |
| Processor - System Controller: 1, 1 |
10BaseT | Link Interface Card (4 SS7 links): 2, 2 |
| Link Interface Card (4 SS7 links): 3, 3 |
| _ _ _ _ _ _ |
______| |1| |2| |3| |1| |2| |3| |
| | | | | | | | | | | | | --
| | | | | | | | | | | | | -- E1/T1/V.35
Serial | | | | | | | | | | | | | --
(Console) | | | | | | | | | | | | | --
_______| | | | | | | | | | | | | --
| | | | | | | | | | | | | --
| [Disk] | | | | | | | | | | | | --
Serial | [VxWorks] | | | | | | | | | | | | |
(Logs) | | | | | | | | | | | | | |
_______| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| |_| |_| |_| |_| |_| |_| |
| |
| [-~-----------------FAN-----------------~-] |
| [*Power Supply*] [*Power Supply*] |
| (DC Supply) (DC Supply) |
|_________________________________________________________|
SS7 Message Handling Unit
GSM Background Information -- (Acronym Definitions in paragraph form)
'Home Location Register (HLR)'
A Home Location Register (HLR) is a database that contains semipermanent mobile
subscriber information for a wireless carriers' entire subscriber base.
HLR subscriber information includes the International Mobile Subscriber Identity
(IMSI), service subscription information, location information (the identity of
the currently serving Visitor Register (VLR) to enable the routing of mobile-terminated
calls), service restrictions and supplementary services information.
What the HLR basically does is it handles SS7 transactions with both Mobile Switching
Centers (MSCs) and of course VLR nodes, which either request information from the HLR
or update the information contained within the HLR. The HLR also initiates transactions
with VLRs to complete incoming calls and to update subscriber data.
Traditional wireless network design (anything before 1996) is based on the utilization
of a single Home Location Register (HLR) for each wireless network, but growth
considerations are prompting carrier administrators to consider multiple HLR databases.
So what does that mean? It means our Telecommunications Industry is under pressure to
develop larger and faster networks in order to satisfy the needs of residential and
business customers.
'Visitor Location Register (VLR)'
A Visitor Location Register (VLR) is a database which contains temporary information
concerning the mobile customers (subscribers) that are currently located in a
given MSC (Mobile Switching Centre) serving area, but whose Home Location Register (HLR)
is elsewhere (out of range).
When a mobile subscriber roams away from his/her home location and into a remote location
(ie. digital to analog), SS7 messages are used to obtain information about the subscriber
from the HLR, and essentially create a temporary record for the subscriber in the VLR which
usually only has one per Mobile Switching Centre.
'International Mobile Subscriber Identity (IMSI) Number'
"What the hell is IMSI?" - IMSI is a unique non-dialable number allocated to each mobile
subscriber in the GSM system that identifies the subscriber and his or her subscription
within the GSM network. Make sense yet?
The IMSI resides in the Subscriber Identity Module (SIM), which is transportable across
Mobile Station Equipment (MSE) (look for IMSI being supported by the GPRS standard soon!)
The IMSI is made up of three important parts:
#1: The Mobile Country Code (MCC)
#2. The Mobile Network Code (MNC) (they consist of 2 digits)
#3. The Mobile Subscriber Identity Number (MSIN) (they consist of 10 digits)
'Mobile Subscriber ISDN (MSISDN) Number'
The MSISDN is the dialable number that subscribers use to reach another mobile
subscriber. Some of the newer phones (ie. newer GSM supported Motorola, Nokia's)
in Canada and the U.S. support the up-to-date multiple MSISDNs which are now in
affect.
'Mobile Station Equipment (MSE) Subscription Services'
GSM carriers typically order Mobile Station Equipment (MSE) (or GSM phones)
from their suppliers (Nokia, Motorola, Sony, etc.) in large quantities (e.g. 1000 Units).
After receiving an order, the equipment supplier will program the ordered MSE SIMs with a range
of IMSI numbers.
GSM Call Routing --
'Mobile Subscriber Roaming'
When a mobile subscriber roams into a new location area, the VLR automatically
determines that it must update the HLR with the new location information, which it does
using an SS7 Location Update Request Message (LURM). The Location Update Message
is then routed to the HLR through the SS7 network, based on the global title translation
of the IMSI that is stored within the SCCP Called Party Address portion of the message.
The HLR responds with a message that information's the VLR whether the subscriber should
be provided services in the new location.
'Mobile Subscriber ISDN Number (MSISDN) Call Routing'
When a user dials a GSM mobile subscriber's MSISDN, the PSTN routes the call
to the Home MSC based on the dialed telephone number. The MSC must then query
the HLR based on the MSISDN identification, to acquire routing information required
to route the call to the subscribers' current location.
The MSC stores sensitive global title translation tables that are used to determine
the HLR associated with the MSISDN. When only one HLR exists, the translation tables
are trivial. When more than one HLR is used however, the translations become extremely
challenging, with one translation record per subscriber (see the useful example below).
Havin determined the appropriate HLR address, the MSC sends a Routing Information Request
(RIR) to it.
Example:
--------
When the HLR receives the Routing Information Request, it "maps" the MSISDN to the IMSI,
and ascertains the subscribers' personal profile including the current VLR at which the
subscriber is registered. The HLR then queries the VLR for a Mobile Station Roaming Number
(MSRN). The MSRN is essentially an ISDN telephone number which the mobile subscriber can
be reached at. The MSRN is a temporary number that is valid ONLY for the duration of a
single call. The HLR generates a response message, which includes the MSRN, and sends it
back across the SS7 network to the MSC. Finally, the MSC attempts to complete the call using
the MSRN provided.
'Implementation of a second HLR to the GSM Network'
As a GSM wireless carrier's subscriber base grows, it will eventually become
necessary to add a second HLR to their network (obviously). This requirement might be
prompted by a Service Subscription Record Storage Capacity Issue (SSRSCI) or
perhaps an SS7 Message Processing Performance Issue (MPPI). It might possibly be prompted
by a need to increase the overall network reliability.
The new HLR can be populated with service subscription records as new subscribers are
brought into service or existing service subscription records can be ported from the old
HLR to the new HLR to more evenly distribute the growing SS7 traffic load.
Usually, when new subscribers are brought into service, the second HLR will be populated
with blocks of IMSI numbers that are allocated when new MSE equipment is ordered.
Much more complicated SS7 message routing Global Title Translations are required
for Routing Information Request transactions between the MSCs distributed over the
entire wireless carrier serving area and the two or more HLRs. MSC Routing Information
Requests are routed to the appropriate HLR based on the dialed MSISDN and not the IMSI.
Unlike the IMSI numbers, the MSISDN numbers can not easily be arranged in groups to
reside within a single HLR and therefore, the MSC must contain an MSISDN to HLR
address association record for every mobile subscriber homed on each of the MSCs.
References --
'Web-site Resources'
Frame Relay
http://cctpwww.cityu.edu.hk/network/l2_framerelay.htm
Frame Relay Forum
http://www.frforum.com/
HN Networks
http://www.hn-networks.co.uk/index.html
MicroLegend SS7 Tutorial
http://www.microlegend.com/whatss7.shtml
Telecom Testing Support for GSM, SS7, GPRS, CDMA, Broadband
http://www.radcom-inc.com/tstsolut/telecom.htm
-- This is seriously the best information I could find.
What ever happened to the days where you'd punch in a phrase or
word, and actually find decent documents on personal and/or educational
web-sites? Now all I run into are these God damn commercial .com's
sites who just want to sell their shitty hardware/software... who
just want to make a BUCK. Well never worry about me selling out
to "the man", because all my information is going to stay completely FREE! =)
'Acronym Definitions'
I compiled most of these myself... the rest are stolen.
ACM Address Complete Message
ANM Answer Message
A Links Access Links
BIB Backward Indicator Bit
B Links Bridge Links
BSN Backward Sequence Number
CDT Conversation Data Table
CPA Called Party Address
CPN Called/Calling Party Number
DAU Database Administration Unit
D Links Diagonal Links
DPA Distributed Processor Architecture
DPC Destination Point Code
E Link Extended Link
F Link Fully Associated Link
FIB Forward Indicator Bit
FISU Fill in Signal Unit
FSN Forward Sequence Number
GTT Global Title Translation
HLR Home Location Register
IAM Initial Address Message
IRSC International Roaming Signaling Converter
ISDN Integrated Services Digital Network
ISUP ISDN User Part
KPBS Kilobits per Second
LSSU Link Status Signal Unit
LURM Location Update Request Message
Mf Multifrequency
MHU Message Handler Unit
MPPI Message Processing Performance Issue
MSC Mobile Switching Center
MSE Mobile Station Equipment
MSIN Mobile Subscriber Identity Number
MSISDN Mobile Subscriber Integrated Services Digital Network
MSRN Mobile Station Roaming Number
MSU Message Signal Unit
MTP Message Transfer Part
OMAP Operations, Maintenance and Administration Part
OPC Originating Point Code
PC Point Code
PSTN Public Switched Telephone Network
RBOC Regional Bell Operating Company
REL Release Message
RCL Release Complete Message
RIR Routing Information Request
RSP Route Set Prohibited Test Message
RSR Restricted Test Message
SS7 Signaling System 7
SCCP Signaling Connection Control Part
SCP Signal Control Point
SLS Signaling Link Selection
SOI Service Order Interface
SSRSCI Service Subscription Record Storage Capacity Issue
SRT Screening and Rerouting Table
SSP Signal Switching Point
STP Signal Transfer Point
SU Signal Unit
TCAP Transaction Capabilities Application Part
TFA Transfer Allowed Message
TFP Transfer Prohibited Message
TFR Transfer Restricted Message
TUB Traffic Usage or Billing
VPC Virtual Point Codes
VSP Versatile Signaling Point
Wrap-up --
'Conclusion'
This is the first of many SS7 related documents to be published for
Nettwerked / Hack Canada, which of course is a good thing because
there aren't enough people in the world writing about the SS7 protocol
let alone home grown Canadians!
Look for an introductory SS7 paper soon.
'Contact'
webmaster@nettwerk.hypermart.net
http://nettwerk.hypermart.net
A
N E T T W E R K E D
P R O D U C T
_______________________
Advertisement;
'Security News for Security Professionals'
w w w . S e c u r i t y N e w s . o r g
One of the newest computer security web-sites
to hit the Internet this month, has really made
an impact on the scene. Nettwerked is now an
official joint advertiser for SecurityNews.org,
and hopes to see more great information in the
future from these guys.
_______________________________________________
../ K-1ine 5.0 'Summer 2000' to be released by August.
What will K-1ine 5 have to offer?
-- More Telephony Related Documentation
-- Random Writings
-- DEF CON 8 Review(s)
-- & More!
K-1ine is Copyright 1999-2000 by Nettwerked. All rights reserved.
