Copy Link
Add to Bookmark
Report
k-1ine_21
k-21-(10)-01
OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
OoO=o=oOO=o=O=>
: -`- -`- OoO=o=oOO=o=O=>
; _|_--oOO--(_)--OOo--_|_ OoO=oOO==OoO=o=oOO=o=O=>
| ¡ K-1ine Zine ! | OoO=o=oOO=o=O=>
! issue 21, volume 10¡ OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
---------O^O---- OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
;. |__|__| oODestructionO=oOr=oOO=WorldooODomination?=o=o=O=>
|| || OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
ooO Ooo OoO=o=oOO=o=O=OoO=o=oOO=o=O=OoO=o=oOO=o=O=>
OoO=o=oOO=o=O=OoO=o=oOO=o=O=O=o=ooO=o=>
;`-.> November 2001 <=o=O=o=O=o=O
'Come With Us'
"As part of the conversion, computer specialists rewrote 1,500
programs; a process that traditionally requires some debugging."
-- USA Today, referring to the IRS switchover
_____________________________________________________________________________
» .- Words from the Editor -. « |
*: [-] Introduction .......................................... The Clone :*
*: (-) Contact Information ................................... The Clone :*
*: (-) Advertisment .......................................... HackerSalvage:*
*: (-) Link of the Month ..................................... The Clone :*
*: (-) K-1ine Mirrors ........................................ The Clone :*
*: (+) News: Chemical Brothers | 'Come With Us' .............. The Clone :*
____________________________________________________________________________
» .- Documents -. « |
*: (x) 'The TRS(Telus Relay Service) Loophole' ............... Phlux :*
*: (x) 'The Invisible Box' ................................... Lucky225 :*
*: (x) 'Nortel Screen Phones Explored/ADSI Carrier Scan' ..... p1asm1c :*
*: (x) 'An Introduction to Telus' Terminating Test Lines' .... The Clone :*
*: (x) 'A Mobile Phone ANI-Diversion Technique' .............. The Clone :*
_____________________________________________________________________________
» .- Conclusion -. « |
*: [-] Credits ............................................... The Clone :*
*: [-] Shouts ................................................ The Clone :*
_____________________________________________________________________________
Introduction -
Welcome to the newest issue of K-1ine... issue #21. We have a bunch of great
article compilations for your liking. Take the time to read through them,
and don't forget to submit something - you might just be in the next issue.
I hope you enjoy this issue... see you next month!
-->
Contact Information;
=-=-=-=-=-=-==-=-=-=
Comments/Questions/Submissions: theclone@hackcanada.com
On IRC: irc.2600.net - #hackcanada, #cpu (key)
Check out my site: (Nettwerked) http://www.nettwerked.net
-->
--
-- Advertisment --
+++ WWW.HACKERSALVAGE.COM +++
HackerSalvage.com is a non-profit website dedicated to
keeping old hardware in circulation. Many of us have
piles of it sitting around but can't just toss it out.
Here you can post computer items for sale or post a
want ad for items you are looking for. A perfect place
to get rid of perfectly good junk.... and get some new
stuff to rebuild the pile.
+++ +++
--
--=[ LINK OF THE MONTH ]=--
Every month I post one really great "link of the month" on every issue
of K-1ine magazine. The link can be anything in the technology industry,
music scene, rave scene, punk scene, or even a good article you read on a
news site. I'll be taking submissions via e-mail or IRC right away;
so get your links in and maybe you'll see it in the next issue of K-1ine!
For the month of November, the link of the month is:
http://www.peopleiworkwith.com
Pure Craziness...
[submitted by: The Clone]
--
K-1ine Mirrors:
http://the.wiretapped.net/security/info/textfiles/k1ine/
"Wiretapped.net is an Australian site offering an archive of open
source software, informational and advisory textfiles and radio/conference
broadcasts covering the areas of network security, network operations,
host integrity, cryptography and privacy. We aim to become the largest
archive of this nature in the Asia/Pacific region through steady growth
of our archives and regular updates to them (most updated nightly).
We are proudly telehoused on a 10Mbit/sec connection by Connect.com.au using
OneGuard hardware donated by eSec Limited. The archive, along with its
sister site on the same machine, The AusMac Archive, generates between 10
and 60 gigabytes of outbound traffic daily. Wiretapped.net is hosted in
Sydney, Australia."
--
News: Chemical Brothers | 'Come With Us'
To celebrate the Chemical Brothers new album, I thought I'd title this issue of
K-1ine with the same name as their newest album. Can't wait to check this album
out since I've been a huge Chems fan since they were (temporarly) Dust Brothers
in late 1994. Support these great artists by buying their newest album.
The Chemical Brothers have announced details of their fourth studio album,
the follow up to the hugely successful SURRENDER. Come With Us will be released
on January 29, 2002. The tracklisting is as follows:
* Come With Us
* It Began In Afrika
* Galaxy Bounce
* Star Guitar
* Hoops
* My Elastic Eye
* The State Were In
* Denmark
* Pioneer Skies
* The Test
The album features two guest vocalists; Beth Orton on 'The State Were In'
and Richard Ashcroft on 'The Test'. Check out www.astralwerks.com/chemical
for more details on the forthcoming single, "Star Guitar," released on January 15.
--
<h410gen> Carnivore = TCPDUMP
--
_______________________________________
: :
: The TRS(Telus Relay Service) Loophole :
:_______________________________________:
_____________________
: 8/15/2001 :
: by phlux :
: phlux@fucktelus.com :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
=================================================================================================
$!@#$!@#$!@#$
$@ WARNING #@
&@#$*%@#&#@$&
NONE OF THIS TEXT FILE MAY BE REPRODUCED IN PART OR ENTIRETY OR ELSE AND STUFF UNLESS YOU DON'T
TELL ME THAT YOU DID IN WHICH CASE I MIGHT NOT FIND OUT BUT IF I DO THE STREETS WILL RUN RED WITH
YOUR BLOOD AND ANYONE WHO COPPERATED AND HELPED AND THEY'RE DOGS MAYBE EVEN YODA SO BE FUCKING
CAREFUL WHO YOU GIVE THIS TO SO THAT THIS KIND OF TECHNOLOGY DOESN'T GET INTO THE WRONG HANDS
=================================================================================================
NOTE: This is not a really major finding, however I think its kind of funny, and it is usable
so i felt it was txt worthy. I dont recomend you actually use this loophole, but rather just
retain the knowledge, as knowledge is power.(ROUND 1 FIGHT!)
=================================================================================================
Introduction:
I needed to call a good friend of mine.. having no calling cards and not being able
to call direct, I thought of the possibilities. I have PBXs, out dials, social engineering, but I
didn't feel a need to make an illegal call as it was a serious matter. Rooting around some old
back up CDs i found this one text, TTY.TXT, a text documenting the telus relay service.(by me!)
I think it was just information i ripped from telus' site or something sometime ago, as it was all
very basic. However I re-taught myself the terms used in TTY, then I read on, and got to the part
about HCOs and VCOs.
This loophole will alow you to make a phone call from alberta to anywhere in canada with 50% off
the long distance charges. Also my phone book says gimps using TTY get free local calling (bring
yer computer to the payphone). I am not sure if this is still true as the phone book is not the
newest available...
No biggie, but keep in mind its legit! (but you tie up gimpers relay service, kind of like
parking in a handi-capped spot. Or maybe even that time you took a shit in the fat ass stall
that has more square feet then your bedroom. This txt should be labeled as a DoS really)
=================================================================================================
The Loophole:
VCO stands for Voice Carry Over, while HCO means Hearing Carry Over.
If you do not have basic knowledge on TTY, go read my TTY text. I will rip the important stuff;
In a TTY call, VCO enables you to speak directly to the person you are calling, for hearing impaired
people who can speak clearly. When you connect to a CA, just say 'requesting VCO, GA' or equivelant
to use this feature. VCO can only be turned on when the call is answered, to which she will announce
'VCO on GA' or something.
HCO, Hearing Carry Over(you can hear but can't talk, same as above but reverse.)
If you don't already know where this is going.....
TTY your ass to 711:
-
Heres an example transcript;
TRS CA: "Telus Relay Service this is Anne, may I help you q, GA"
You: "Yes please, im trying to call my friend Steven Thrasher at 403-265-2307 GA"
TRS CA: "One moment please GA"
You: "No problem, GA"
...CA rings Steven, confirms he knows how to use TTY, the call is connected...
TRS CA: "Hey Jon, whats up q GA"
You: "Sup stevie... oh yo yo yo I found my hearing aids<CR> CA can i request an HCO q GA"
TRS CA: "Heh you always lose them things... HCO on GA"
You: "GA on HCO"
HCO is now enabled. You still type your messages to the TRC CA to Stevie, but you save the op having to
type what Steve says, so you request a VCO;
You: "CA: That dirty dog steve wants me to tell him this joke myself! requesting VCO"
When the CA does a VCO press your thumb onto your neck, putting pressure on your voice box, and emulate
an electronic voice box(practise finding the right spot before requesting the VCO), and tell the operator
that you can take things from here.
Thats all there is too it.
To do this you will need a TTY that supports HCO and VCO(can be expensive)
However, i have fathomed the idea of building&coding a baudot emulator to be used with an acoustic coupler
from the handset to the soundcard speaker/mic and a parallel port for toggling HCO and VCO to your headset.
Firstly i would need a job, or an accomplise to help me rob radio shack.
props: pooly, Lucky225, theclone, Mark Hubber, PSYKO, and the Zig-Zag man.
plops: TRON(fag teeth)
--
The Invisible Box
By Lucky225
Email: Lucky225@verizonfears.com
Introduction:
The invisible box will make it so that when you pick up a phone on your phone line any
of those in-use lights that tell if an extension phone is picked up, wont light.
Theory:
The theory is based off the same principles as the infamous blackbox that used a 1.8k
resistor to keep the phone line at 50v when you pick up, which actually still works, but
because of SS7 the voice path is cut off from the party calling you, and the phone company
doesn't allow a voice connection any more until your phone goes off hook and there's
supervision. The invisible box works by using high resistance to keep the voltage at
about 20 volts. This is accomplished by placing a resistor of about 470ohms in
series with your phone. The phone is approximately 215ohms and draws 28ma of current, which
means when your phone is off-hook there is approximately 6 volts on the phone line. When
you place the resistor in series with the phone line there is a total resistance of 685ohms.
Using ohm's law, 685 ohms times 28ma gets you 19.2 Volts! So the resistor keeps the phone
line at about 20 volts, and most in use lights only go off when there is about 15 volts or
less on the phone line.
Construction:
You will need a phone cord and a 470ohm resistor(Yellow, Purple, Brown). You can get the
resistor in a 5 pack at radioshack for $0.49. It wouldn't hurt to have some wire stripers,
and possibly electrical tape or solder. Strip the phone cord in the middle, dont cut the
modular jacks off. You'll see 4 or 2 wires, usually black, red, green, and yellow. Dont
worry about the black and yellow wires, in fact cut them off they'll get in the way. Leave
the green wire alone, thats the positive wire, and sense current flows from negative to
positive and we're trying to opose current so the voltage wont drop we leave it alone!
Finally, cut the red wire (that's the negative!) in half and strip both ends, you're going
to insert the resistor here.
Diagram:
(-) Red wire 470ohm
-------------/\/\/\----------
-----------------------------
(+) Green wire
Conclusion:
That's it, pretty simple huh? You might be thinking that maybe there is no real use for
this because all it does it make it so that an in-use light doesn't light when you pick up
the phone. But think of the possibilities, you could go beigeboxing with this box and it
might save you if the person your beigeing off of has an in-use light and they always look
at it to see if their kid is on the phone, but because of your trusty invisible box hooked
up to the phone line that light never comes on and they never pick up to yell at what they
would think is their kid. Personally, I use it when I'm talking on my phone line but want
to use my main line to go on the internet, my mom is always checking that damn in-use light
and yelling at me, "You're on the internet with my phone line! GET OFF NOW!" HA-HA! Now
she'll never know! The sad thing is I bet this even bypasses those lame $200 phone tap
detectors you always see on TV.
Okay time for greets:
Yari my beloved!, Spoonm!, Pooly, BigB9000, Xhype, Gizmo, Morbid Angel, Lancomandr,
phlux, cry0, syncron, Omega2, phreak2000.com! and anyone else I left out!
-------
UPDATE
-------
After recently purchasing the 43-443 in-use light from radioshack, I noticed
that they detected current, not voltage, unlike the in-use light on my mom's phone that only
detects voltage drop. However you can defeat these by placing a 220ohm resistor in parallel
with the phone line and when your using your phone there won't be enough current to light
the light. I have made an improved "invisible box" that defeats both the voltage and current
detector in-use lights. Below is the diagram:
Red
Ring(-) 470ohm
---------/\/\/\------->
< 220ohm
>
-----------------------
Tip(+)
Green
If your in-use light still lights trying changing the resistor values as the resistance
of your phone may vary.
--
----------------------------------------------------------------------------------
Nortel Screen Phones Explored/ADSI Carrier Scan 06/07/01 :: by p1asm1c
----------------------------------------------------------------------------------
Note: most of this information applies to the new vista screenphones
(Vista 390, Cybiolink 8000; See below on more info on these phones)
A few years ago, due to my impeccable bill paying and courteous mannerisms with
bell operators I was given the opportunity to receive a free Vista 350 phone,
that's right, FREE!. Ecstatic, I sent back the necessary paperwork to our friends
at bell, and in a few weeks my coveted vista 350 had arrived. The couriers kept on
coming at the wrong times, so I decided to go pick it up myself. My companion and
I grabbed our bikes and ventured to Puralator headquarters, located in the
urban-industrial lakeshore wasteland east of downtown Toronto. But sulfur fumes
wouldn't stop us from obtaining the grail, I mean phone...
While we were on our way back home, we decided to check out the fabulous
collection of dumpsters nearby the warehouses. I spotted an old rackmount server
under a garbage bag. Unfortunately, it wasn't meant to be, as we had a load to
carry already. The mysterious box would have to wait for another day.
We stopped by a local Pizza place and ordered some food, while I hastily ripped
open the box.
Inside the parts were many:
1. Manual for Vista 350 Phone
2. LCD Screen Module
3. Vista 350 Phone
4. Setup Guide
5. Feature 'HotSheet'
6. Standard RJ-14 Headset w/ Cord
7. 9 foot RJ-11 cord
8. Nortel AC Adapter
9. 2 Position desk stand
As I paged through the manual, it explains that the vista phone is structured in
2 basic parts.
Firstly, the main part of the phone, containing the dialer, speakerphone, and
4 buttons: Hold, Link, Goodbye (Terminates an open line when using data services),
and Options. Lastly a blood red indication light which has become standard on most
Nortel phones. On the underside there were 3 jacks, 2 RJ-11, and 1 RJ-14 for the
receiver. The second RJ11 jack can be used for your fax/data device. Along side was
a standard 16Vac 50-60Hz Power adapter. Also a pass through for an optional printer
for the data module.
Receiver (+)
||
||
\/
______{_______
/@|LED| _____ \
|+|...| |LCD | | {
|+|123| |SCR | | { = Removable Module
|+|456| |____| | {
|@|789| ... | ...= Interface Buttons
\_______{__..._ /
Module 1 - Module 2
The data module has 17 buttons on it's face. 4 are used as directional buttons, 6
for Interface, and 6 for service selection. On the underside there is a single RJ11
Connector which can be used for an optional printer. And on the side is the male
connector for the aforementioned 20pin AMP connector.
As I read through more of the documentation I was advised to call a phone number
to initialize my vista phone, this isn't required for normal operation but is
necessary to use the online services.
So when we arrived at the house I plugged in the phone and dialed up the number.
A small load indicator flashes while the speaker gives of a discrete bleep while
the phone is downloading information, your prompted to download the services the
phone has to offer. Dialing this number again later on is also a good idea as new
services are often added (read: the new automated directory services, email, etc...)
After removing the 6 star shaped screws on the main module, I lifted of the back
side of the phone. Inside there were a few things that caught my eye. One, that
Nortel have a very innovative form of directing led light. A large arc of plastic
directed from one small standard 2.5v led is projected it into a 2 inch light as
mentioned above. Similar engineering was used for the speakerphone led indicator.
Looking onto the main circuit board, most of everything was on par compared to a
standard nortel phone. With exception to the new data module chipsets and connectors.
The connector seems to connect to a 20 pin AMP (SN: QMV6368T5) connector labeled
P1 on the board. Accompanied by what looks like a new chipset developed by Nortel.
And finally a vanilla 5 volt speaker used for the speakerphone.
Pictures and Hi-Res shots of the boards will be availible soon at:
http://www.cpj.f2s.com
The way the phone works software-wise is the phone connects using the ADSI protocol
to connect to an NT box running the appropriate software, this connection is
established at 1200bps, the phone then downloads prefabricated scripts which reside
on the server.The modification of these scripts could be done for many purposes,
Since the ADSI is being used more and more for interactive services over telephones,
(most notably a recent project involving a diabetic database entry client
developed in Ontario)
Generic Sample Scripts in C availible for download at http://www.cpj.f2s.com.
This scripts could have endless uses.
Possibilities include a script when dialed could tie up the phone line
unless it is physically disconnected.
This could come in handy if one came into contact with the box that almost every vista
phone calls ever so often (3-4 times a week) and downloads automatic updates. Or you
could create a script that would send all information from electronic banking carriers
to your machine, this would not stand for long but as the volume of users is large,
a few minutes would prove useful, and would embarrass and scandalize a financial
institution of your choice.
Recently, as I was activating one of these phones, it asked me to input my vitals......
low and behold, when i pressed next, the name, address, and postal code of the person
I was setting it up for was displayed on the screen for editing. It would not be
suprising if the vista phone went about keeping you name, address and postal code on
the phone before it's shipped to you. Perhaps bell we're even ahead of the rest,
because like digital convergence's recent manufacturing of the cuecat, it looks like
the vista uses the same tactics or consumer intrusion. This would explain the sudden
generousity and enthusiastic ad campaign for 'free' vista phones.
416 ADSI/ACMS Carrier Scan:
-
Note: Numbers in this exchange which were not ADSI carriers are not listed.
Most of these numbers were out of service with the exception of a fax machine
at 416.421.1096.
-
416.462.5231 -Not in Service
416.462.5232 -Not in Service
416.462.5233 -Not in Service
416.462.5234 -Screen Phone (Recording/Non ADSI)
416.462.5235 -Screen Phone (Recording/Non ADSI)
416.462.5236 -Screen Phone (Recording/Non ADSI)
416.462.5237 -Screen Phone (Recording/Non ADSI)
416.462.5238 -Presently the number you have reached is busy
416.462.5239 -Ads
416.462.5240 -Presently the number you have reached is busy
416.462.5241 -Ads
416.462.5242 -Sorry, we are presently experiancing difficulties
416.462.5243 -Ads
416.462.5244 -Ads
416.462.5245 -Ads
416.462.5246 -Ads
416.462.5247 -Ads
416.462.5248 -One moment please... (Bell PBX)
416.462.5249 -Ads
416.462.5250 -Sorry, we are presently experiencing difficulties
416.462.5251 -Sorry, we are presently experiencing difficulties
416.462.5252 -Sorry, we are presently experiencing difficulties
416.462.5253 -Sorry, we are presently experiencing difficulties
416.462.5254 -Sorry, we are presently experiencing difficulties
416.462.5255 -Sorry, we are presently experiencing difficulties
416.462.5256 -Sorry, we are presently experiencing difficulties
416.462.5257 -Sorry, we are presently experiencing difficulties
416.462.5258 -Sorry, we are presently experiencing difficulties
416.462.5259 -Sorry, we are presently experiencing difficulties
416.462.5260 -Sorry, we are presently experiencing difficulties
416.462.5261 -Sorry, we are presently experiencing difficulties
416.462.5262 -Sorry, we are presently experiencing difficulties
416.462.5263 -Sorry, we are presently experiencing difficulties
416.462.5264 -Sorry, we are presently experiencing difficulties
416.462.5265 -Sorry, we are presently experiencing difficulties
416.462.5266 -Sorry, we are presently experiencing difficulties
416.462.5267 -Sorry, we are presently experiencing difficulties
416.462.5268 -Canada Trust Bank Profile Updating system
416.462.5269 -Busy
416.462.5270 -Not In Service
-----
416.406.4140 -Electronic Phonebook
416.421.1097 -Email
416.421.1696 -Stocks
416.462.5244 -Bell Direct
888.419.1717 -Financial Services Download
* Vista 390, an identical clone of the Vista 350 with the only difference being
less ROM and a few cosmetic changes.
* Cybiolink 8000 a new screen phone introduced last Christmas which has a larger
screen and more Flash memory.
In any case both of these modifications use the same method and hardware to
communicate to ADSI/ACMS boxes, so most of the information in this document
can be applied to these models.
--
'An Introduction to Telus' Terminating Test Lines'
< Written by: The Clone
< Date: Tuesday, November 6, 2001
(Updated: Thursday, November 8, 2001)
--
InDEX;
* Disclaimer
* Definition
* Introduction
* Default Prefixes
* Additional Terminating Test Lines
* Other Test Numbers
* Conclusion
* Credit
* Contact Information
* Shout-Outs
--
Disclaimer: The content within this file is for informational and
entertainment purposes only. Unauthorized access of the
test systems spoken about in this file may get you in
trouble with local and/or national law enforcement.
By reading this, you agree not to try any of this.
Definition: "Test numbers are dialups to testing equipment or test
features set up by the phone company or private entities."
Introduction:
Back in early 1999 when the 403/780 area code split went on, Telus decided to
set up a series of test numbers called "Alberta Terminating Test Lines" in the
403 and 780 area codes. Since the split affected millions of landline/cellular
customers, Telus thought that permissive phone numbers would be the best way to
keep the information flowing between employees. Alberta Terminating Test Lines
gave Telus tech's the ability to call up a private number and leave detailed
messages regarding any technical issues (problems) that may have arised with
780 to 403 (and 403 to 780) long distance call routing.
To this day, Telus still uses Terminating Test Lines as a way for local and long-
distance carriers to communicate. By dialing up the specific number, you will be
greeted by an automated female voice; "You have reached an Alberta 780 Terminating
Test Line", followed by an Octel system voice telling you that you either have
messages waiting (which it then plays it for you), or it'll tell you: "No messages
are waiting. Please try again later. Thank you. Good-bye."
Default Prefixes:
These prefixes are in the 780 area code only. If you have a list of Alberta Terminating
Test Line prefixes the in 403 area code, please pass them on and I'll add them to this
particular listing. More prefixes are being added as more Terminating Test Line numbers
are discovered.
Prefixes;
` 423-XXXX
` 425-XXXX
` 428-XXXX
` 429-XXXX
` 455-XXXX
` 459-XXXX
--
Additional Terminating Test Lines:
British Columbia;
(604/778), Overlay: NPA 778 introduced for service on 11/03/01.
` 778-510-XXXX (Call-Net Communications, Southwestern B.C.)
` 778-610-XXXX (Telus, Southwestern B.C.)
` 778-810-XXXX (AT&T Canada, Southwestern B.C.)
`
Ontario:
(905/289), Overlay: NPA 289 introduced for service on 06/09/01.
` 289-210-8378 (Bell Canada, Southern Ont.)
` 289-510-8378 (Call-Net, Southern Ont.)
` 289-810-8378 (AT&T Canada, Southern Ont.)
Other Test Numbers:
[Taken from "ALT.PHREAKING FAQ 1.41", http://members.tripod.com/~SeusslyOne]
1004 hz test tone - This is a vanilla 1004 hz tone. Nothing too useful here,
without a loop analyser anyway.
ANAC - This test dial up will read off the number of the line youre calling from.
On rare occasions you will find ANACs with a DTMF response for use with remote
test terminals.
DATUs - DATUs (Digital Audio Test Units) are a godsend to technicians and phone phreaks
everywhere. DATUs allow a caller to monitor lines (don't get too excited), open
and short pairs, and put trace tones on the pair. While it might not sound too
exciting, it has more applications than most people think.
Loops - These numbers exist in linked pairs. Call one number and youll get a tone.
Call the other number and you get dead silence. If both are called at the same
time they make a connection. It used to be that you could then talk over this
connection, but now there are filters that block speech placed on most loops.
Ringback - Calls back the originating number in an annoying fashion. Dialing all the
touch-tone digits in order (starting with 1 and ending in # going across
the keypad rows) will generate 2 tones saying the keypad is ok.
Milliwatt test - These are 1004 hz tones sent out at 0 db. Milliwatt tests are used to
check for line loss and other complex tests.
Sweep Tones - Tone sweeps are a test tone ranging from 304hz to 3204hz. A common use
for sweep tones is to check for infinity-transmitter style taps. Dial up
a sweep tone. If an audible clicking is heard during the sweep then a
transmitter could be installed on your line. Telco maintenance uses sweep
tones to check for the presence of loading coils, and other such nasties
that eat high frequency tones in order to qualify a line for high speed
services.
Quiet termination - This feature connects the caller to a port with fixed resistance,
600 ohms or 900 ohms being the most common. There should be nothing
but dead silence on connection. Clicks, static or crosstalk will be
clearly evident if a noisy line is used to dial this test.
-
Conclusion;
I hope this paper was of interest and of benefit to you. Test numbers are quite interesting
little toys to play around with, while travelling through the land of the telephone system.
One never knows what they can find until they start actually taking the time to hand-scan...
(see: http://www.nettwerked.net/files.html | "Scanning (Manual)"). Peace out!
-
Credit:
Thanks to Phlux for the additional input.
Support Phlux's HASH project (http://www.hackcanada.com/hash.txt).
-
Contact Information:
E-MAIL: theclone@hackcanada.com
IRC: irc.2600.net (#hackcanada, #cpu)
URL: www.nettwerked.net
-
Shout-Outs:
Hack Canada (#hackcanada / www.hackcanada.com),
Canadian Phreakers Union (#cpu / www.nettwerked.net/cpu),
CYB0RG/ASM, H410g3n, Phlux, Alan, Seuss, Lucky225.
.END.
--
. A Mobile Phone ANI-Diversion Technique .
Date: Monday, October 29, 2001
Author: The Clone
[ inDEX ]
. - Disclaimer
. - Introduction
. - Explanation
. - Conclusion
. - Credit
. - Contact Information
-_-
Disclaimer: The content within this file is for informational and
entertainment purposes only. Unauthorized access of the
systems spoken about in this file using this ANI-spoofing
technique may get you in trouble with local and/or national
law enforcement. Don't do naughty things... thanks.
-
Introduction:
Several months ago while sitting at home having nothing better to do but
mess around with various phone numbers on my cell phone, I discovered
something rather interesting. By calling up specific toll-free ANAC systems
in the United States belonging to AT&T and other carriers, the Automatic
Number Identification (ANI) information that I was read was completely
different than the information that actually belongs to me. This got me a
bit curious as to why this might be occurring. The rest of this file will
delve a little bit into the steps I took in order to conclude the theory of
my misread ANI account data.
Explanation:
With my Pre-Paid FIDO GSM phone calling from the 780 area code in Edmonton,
I called up several ANAC systems and on every one of these systems the ANI
information read back was: 780-707-0000, which didn't appear to be my phone
number. After calling that phone number back, I was suprised that FIDO's
"this number is not in service" recording came on.
When calling from a Rogers AT&T Pay-As-You-Go TDMA cellphone, the ANI
information read back was: 780-965-0000, which didn't appear to be my phone
number either. After calling that phone number back, I got a similar
message from ROGERS AT&T telling me the number I called was not in service.
When calling from a Telus / Clearnet CDMA cellphone, the ANI information
read back was: 780-427-5700, which didn't appear to be my phone number
either. After calling that number back, I got a message from Telus telling
me the number I called wasn't in service.
The Potential? By simply using a cell phone without any physical/mode
modification whatsoever, one may spoof their ANI information from American
Toll-free Carriers such as; AT&T, MCI WORLDCOM, TRACFONE, VERIZON, etc.
With your actual phone number information not being registered with the
end-carrier, you have the ability to bruteforce a large number of the
blocked carriers without fear of being tracked - perfect diversion
techniques. If one wanted to call in a bomb threat, they could get away
with it. If someone wanted to prank call, harrass, or otherwise piss
someone off over the phone without fear of being tracked (through basic means),
they could.
Want an ANAC # to test your cell phone on?
http://groups.google.com/groups?q=ANAC+%23%27s
Conclusion:
Instead of your phone's MIN (MSISDN in GSM terms) passing through to the end-
carrier, the information passing through is that of the mobile switches'
aliased phone number - often called "pseudo ANI". Please keep in mind that the
MSSC (Mobile Services Switching Center, Home Location Register in GSM terms)
do keep records of what customers ESN/MIN called what phone number at any given
time. Please be aware of the consequences, and DO USE other diversion techniques
in addition to this if you wish to be 100% anonymous in all of your future
phreaking escapades!
Credit:
Thanks to 'TRON' for the additional information.
Contact Information:
E-MAIL: theclone@hackcanada.com
URL: www.nettwerked.net
--
-- Credits
Without the following contributions this zine issue would be fairly
delayed or not released, so thank you to the following people:
Lucky225, Phlux, plasm1c, and The Clone (dats me!)
-- Shouts:
Hack Canada (#HackCanada), Canadian Phreakers Union (#cpu), The Grasshopper Unit,
Flippersmack, Pyrofreak, soap, Kybo_ren, Flopik, Pinguino, and lastly to
everyone and anyone who contributes to the Canadian H/P scene.
;. .;.. ; ;. ;..
;.. .;..; .;.; .;; ;..
.;..;. .;..; .;.;...; ;..;..
.;. A .;. .;.
;.. N E T T W E R K E D ;..
;..;.. P R O D U C T ;..;..
.;..; ;..;..
; .;..;.;.. .; . .;. ..;..
.;.. . .; ..;..;..;.. .;
;..;. .;.. . .;.. .;.;.
..;. ..;.. .;. ;.;..;;..;.;
;.;;..;.. ;.;.; .; .
;.;..;. .;. ;.;:.;.
,;....;.
.;.;. .;.;
.;.;.;
.;.;
;..;.
.;.;;.; .;. ..; ;. > > > > > > STOP THAT! I SAID STOP-IT!
