Copy Link
Add to Bookmark
Report
Phruwt Issue 03 009
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Misclanious h/p info |
| Article by Phoney Phreak |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
CALL WAITING TAP
================
If you live in an ESS area, you probably have call waiting. This allows you
to receive a call when you are already on the phone talking to someone. The
good thing about it is that you don't have to worry about missing an important
call when you're on the phone. The bad thing is that you may be listened in
on.
To eavesdrop on the unsuspecting person, that person must already be on the
line. When you call, you will sometimes hear a unique click during the first
ring. This indicates that the caller is on the other line. When you hear
this sign, wait until he answers. When he does answer, click your phone twice.
When you click the first time, your phone will jump to your other line while
his phone thinks you are still on his line. When you click it again, you
will drop your other line and jump back on the person's line. The call is now
a conferenced so if you say something, they can hear you! May not work in
major metropolitan areas since they may have fixed this problem.
ELEVATOR/CONDO PHONES
=====================
Phones located in elevators or Condomiums (used to call guests) are phones with
a set of predials in their memory. When you press the button to call for help
as found in some elevators or dial '34' to reach your friends in a condo, the
phone looks up the "real" phone number and dials it. Think of it as a regular
phone with speed dialing capabilities. One way around it is to seize the line
before the it dials out first. You must get a very loud DTMF dialer and dial
the number quickly before it call do the lookup and dial first. On other
phones, there is no dial, you can only receive calls usually from security or
the elevator company. A way around this is to flash hook the number you want
to dial. As you know, pulse dialing is actually flash hooking very quickly so
you would need to do the same. If you aren't good at it, you can flash hook
10 times fast and an operator should come on. You can ask her that your
keypad can't dial an '8' needed to complete your call so if she can dial the
number for you. Some condo phones have a "backdoor" number that allows the
resident manager access to the condo without a key. If you find out the
number, the door will buzz and you'll be able to get in.
NUMBER IDENTIFICATION
=====================
Dialing 1-200-XXX-XXXX (don't dial a 1 in the X position) in some areas is a
line identification number called ANIC or the "Iron Lady". It will tell you
what number you are calling from. This works in Florida and Georgia. This
is a great way to find out the number you all calling from when you're using
a butt-set on a block.
Various Numbers:
1-800-933-3258
1-998-222-2222
1-800-282-0911
10732-1-404-988-9664
1-800-MY ANI IS
211-2111/211-2001 (San Diego area)
760 (San Francisco area)
1-415-811-1212/1515 (San Francisco area)
114 (San Bernardino area)
1223 (Los Angeles area - 213)
144, 511, 510, 311 (Los Angeles area - 805)
970-222-22222 [with the extra 2] (Dallas area)
RINGBACK NUMBER
===============
Most phreakers know about ringback numbers. In my area, if you dial your own
phone number, you will hear a recording about someone trying to call you.
Then when you hang up, the phone will ring.
CELLULAR PHREAKING
==================
To get a free call on a cellular phone, try this: When you make your call,
stay on the line until the other party hangs up then pull out your battery.
Don't press CLR, END, or Power Off! The cellular phone company will get an
invalid transmission error and will not bill the call. If you do it too
often, they WILL catch on.
CELLULAR PHONE PROGRAMMING
==========================
Reprogramming cellular phones is possible without changing chips or using
eprom burners. Knowing the procedures for changing the programming is usually
known only to the cellular company's technicians. There are many phones and
cellular phone companies out there so this may not work for you.
1) Motorola phones have a serial number...look at it.
For Example:
F09XXXXXXX if the 1st 'X' is 'D', 'F', or 'G' it's an older phone
if the 1st 'X' is 'H', 'K', 'L', etc, it's a newer one
*** If the phone is new, you can only reprogram your phone a total of 3
times...the first time was the original programming before the purchase.
Only a programming computer can program phones after the 3rd time.
2) Hit 'RCL' (recall)
3) Hit '#'
4) Enter the security code TWICE (the code is usually 6 digits)
The cellular phone companies usually use the same code
such as '000123' or '000000' or '123456' or the phone's NXX.
For example: 123456123456
5) Hit 'RCL' (recall)
<<<programming mode>>>
6) Scroll through the programming using the '*' key
Phone number, area code, lock code, security code, and
other transmission functions are found here
7) Press 'send' to complete programming or turn off the power
to exit without saving any of the changes
PBX OUTDIALS
============
On some PBX systems (banks, department stores, colleges, etc) dialing 9
(or 8) to get an outside line then 1 + A/C + number will be blocked. Try
replacing the 1 with a 7. In order words, dialing this number 9 + 7 + 415 +
936 + 0000 just might work! Also dialing a two-digit number, such as 51, can
also get you an outside line if 8 or 9 doesn't work (i.e. RCA's Interconnect
equipment uses a '31' to seize an outside line). By the way, 415-936-XXXX
is San Francisco's Weather number which does not give back answer supervision
while 312-936-XXXX is Chicago's Weather that does give answer supervision.
PARKING METERS
==============
Tired of paying $2.00 for 1 hour of parking? Well, in most parking meters,
you can drop the tops of soda cans in and the meter recognizes these slugs as
quarters or more! The best soda tops can be found on the road. Look for the
ones that have been flattened really well...these will have no problems
getting in the meter. Put the top in the quarter slot at an angle so that it
can go in. Turn the knob very slowly. If you're lucky, the meter will see
it as a quarter...if you're really lucky, the meter gets confused and gives
you the maximum time allowed.
Another way is to file down a penny. Don't file all the way around, just file
it (or cut it) in one area so it looks like 1/4 of the penny got chopped off.
File the top and bottom too (the heads and the tails). Now drop it into the
dime slot. Turn the knob very slowly and the meter will give you the maximum
time.
By the way, the soda top method also works for the newspaper dispensers
but not soda machines. For older soda machines, video games, vending
machines, and washing machines, you may want to shrinkwrap a quarter (or use a
thin panty hose) and insert the quarter. Use the end of the shrinkwrap or
panty hose to pull it out and put it back in so that it flicks the coin entry
mechanism. When you have enough credit, drop the whole thing in (unless you
can get it out). Again, this used to work for older models several years ago
but I haven't tried it on the newer machines.
PHONES, PHONES, PHONES
======================
Hotels have been trying to come up with ways to increase their revenues and
among them has been CPE (Customer Premise Equipment) like Answer Detect
Equipment (ADE). This device detects the guest's call's answer supervision.
In most hotels, you could place a free call anywhere as long as it didn't go
over a minute. This loss of revenue is enormous and most hotels feel that
this AD device will help them generate thousands of dollars a year.
If the call is directly billed to the hotel (direct dialed), the ADE, PBX,
and Call Accounting equipment identifies and charges the guest for that call
and with the PMS (Property Management System), puts the call together with
other charges like food and bar tabs. However, if the call is going to a long
distance operator who is offsite, the operator center needs to somehow
identify that the ANI coming in belongs to a hotel and not a residential
customer. If it can't identify the caller correctly, the guest can 1) Bill
to the ANI (which in turn bills the hotel), 2) Use a bogus room number, or 3)
Bill back to the hotel (which is an option in some cases) then check out in
the next 15 minutes because by then it may take the operator center several
minutes to communicate the charges back to the hotel.
In some hotels the house phones are located next to payphones. A guest could
call a long distance operator from the house phone, request to bill to a third
number (the payphone) and when the payphone rings, answers it and accepts the
charges. Don't do it the other way unless you know the hotel's DID (Direct
Inward Dial) of that phone. If the operator cannot identify that the third
party number is a payphone, you'll be able to get a free call.
By the way, the 1-800-COLLECT from MCI has been losing a lot of money to fraud
because of collect calls made to payphones. The only way for them to stop
this is to get a complete listing of payphones in the U.S. from all the LECs
(Local Exchange Companies) and keep them in a database for reference. There
is one way they can sort of tell and that is by the number. If the phone
number has a 9 in the 7th position, it may be a payphone (NPA NXX 9XXX). Most
payphones (and company DID's or incoming calls to extensions) have a 9 in this
position. If the payphone you're trying to bill to doesn't have a 9 in the
7th position, they might not be able to tell. AT&T does have a complete
listing since they probably created it from scratch being that they were the
BOC (Bell Operating Company) so use another carrier or IXC (Inter-Exchange
Company) like MCI or Sprint. And don't use your LEC's long distance operator
(for example, if you're in California and GTE CA is who you get your local
telephone bills from, don't use them since they'll know every payphone in town).
There are usually payphones in a row that this technique could be used. If
the phone number is scratched off, use the ANIC as mentioned above to get the
phone's ANI. This won't work for COCOTs though since most of these phones
disable incoming calls even though their number might not be considered
payphones. Payphones are given a different COS (Class of Service) and are
identified by most switches as payphones coming up with a 14 as the
originating ID.
Another place you could try is to make your long distance call from the
hospital and go through a long distance operator. In most cases, they would
know that you're calling from a hospital and if you bill the call to a third
number, they won't verify the number.
By the way, Bellcore is a company that designates and classifies new NPAs and
NXXs. They send out updates to keep all the IXCs and LECs informed of changes.
Each NXX is identified as residential, cellular, mobile, informational, etc.
while the LECs maintain information down to the station level.
Blast from the Past
==============
Remember when cracking was the biggest thing in the mid 80s. If you could
crack a game and put your name on it, you were king. Crackerjack, Disk
Jockey, and the Krak-Man were infamous and could tackle just about every
copy protection method around. Computist magazine specialized in cracking
software and readers could send in their cracks. Companies were scrambling
around to come up with ingenious protection methods. I remember Airheart
from Broderbund had the extremely difficult spiral copy protection method
while Wizardry games from SirTech could only be copied reliably by
manipulating your disk drive.
Around this time, hacking and phreaking flourished as word about boxing
spread. Many BBSs started up to fill the need and help spread the latest on
hacking and phreaking. Boards like Skeleton Crue, Queen Mary, Black Ice
Private, Sherwood Forest, Demon Roach Underground, CASFA, Ripco, The
Screaming Electron, Scantronics, Digital Warfare, Private Conspiracy,
Inphinity Edge, Metal Shop, etc. were busy with activity. Codes were traded,
phone numbers distributed, and stories told. Don't you miss those days when
systems were so easily bypassed and manipulated?!
I remember when Tymnet had a security hole the size of the 'Pacific'. You
could easily hop into this network and outdial or just roam around finding
holes. There was even a good bbs you could reach called the 'Face-2-Face
BBS'. This board had a lot of information and knowledgeable users but I could
never figure out what 'Kill Tom' meant. There was also another board called
'Altos' that was located in Munich, Germany that had a lot of US visitors...
it had great files but a lot of unhelpful locals.
After awhile, viruses were on everyone's mind and new boards cropped up
specializing in this new area. Ice 9, Powerdome, Midian, Baron's Bistro,
Downgrade Evolution, Virus Connection, Crow Tech, and a few others help
distribute newly created viruses. Remember the Virus Exchange in Bulgaria,
it had every rare and hard to find virus ever created (I remember getting
huge phone bills since I had to resort to calling legitimately since I got
caught phreaking to this board). And I still think Todor from Virus Exchange
was the Dark Avenger.
- Phoney Phreak
