The Discordant Opposition Journal Issue 10 - File 11
An Old(ish) Australian Phone Phreak
- fwaggle
<doj note>
this text is somewhat outdated, but it never actually made it into the DoJ, so i figured i'd include it. however, i can assure you budding australian phreaks, that this phreak does not work anywhere any more. possibly largely due to NetNerd's "telstra is lame" website (which actually ranked higher in many search engines than the actually telstra site) publicizing this any several other phone phreaks for "SmartPhones", telstra replaced every single smartphone in australia with a new, updated version.
that's not to say there isn't phreaks out there for them. if i can get in touch with NetNerd and pheonix, i plan on tracking down some more texts for the DoJ. :)
</doj note>
Note:
The author in no way claims responsibility for the discovery of this information, or the use/misuse of it. It is intended purely for interests sake as a theoretical guide. Ya mum.
Hey peoples. I'm kinda giving away my location a little bit here.. Yeah pity me, I'm australian. This phreak is pretty old, and it wont work on many of the payphones. Ima write this text as more of a techo theory thing rather than just explain the phreak. I asked around, and this is what the few people who could bother with talking to me all seem to aggree on as the theory behind it (Major Greetz to NetNerd).
Also greetz to Pheonix fer helpin me get it working to begin with. :P
Okay. Some background, on the part of the phone that you could conceivably exploit and the apparent reasons (so i'm told, but the theory behind it seems sound) why it works.
It seems that for billing purposes, the exchange sends to the phone a polar reversal every time the phone is supposed to charge you a unit. If the phone doesn't have enough coins in it, or enough credit left on the phone card, then this is it's cue to hang up on you.
Now to the part of the phone itself that is exploitable. It seems that there's apparently two readers in the card slot instead of just one. I'm told there is also a magnetic card reader over slightly over from the smart-card reader, and this is the part that you use.
Simply go to your local Electronics store and stock up on a few 1.3KOhm resistors. They're like 3c each or something silly so get a few..
Next you must find a version of the payphones that will work. The most common way to find out if it's gonna work (next to trying it) is to press the Language Support button (from memory that's what it's called, with a lil flag on it) and if it has no effect then it's probably going to work.
But I've come accross one phone where the Language button has no effect and the phreak just would NOT work. (Of course I've never practically tested this so I wouldn't know :P). Any rate, find a payphone that it'll work on. :)
Now you have to poke one end of your resistor in the card reader just under the point of the red arrow. The idea is to get it so one end is making good contact with the card reader head (I'm told the magnetic reader is the one you are "reaching out and touching" and the other end grounded to the chassis of the phone.
I've heard of people using tape, or actually fashioning "cards" with the resistor permanently in place to make this easier. I found it easier to bend the resistor so it held itself there. NetNerd told me it seems to work better if you put the resistor in from the side, in the little thumbhole piece.
It can be done in a matter of seconds. If you haven't done so already, pick up the handset of the phone. You should hear a buzzing in the background that wasn't audible before. Sorry, you can't do anything about this. :)
I've found if you pick up the handset while placing the resistor, you have a tendency to get a zap off it. With practice you can avoid this though.
If you hear said buzzing, you would simply dial your number. When the person the other end picks up, you'll hear a weird electrical buzzing sort of sound that's much louder than the background buzz and lasts for like 1 or 2 seconds.
That's the polar reversal. The phone will reset itself, thinking it's hung up. But if all's gone well, the resistor earthing the card reader will prevent the phone from hanging up the line. (Note it also prevents you from hanging up if you put the handset up without removing the resistor. Remember this if pranking, kay? :P)
Now, the phone will still be connected, but it will have reset and disabled the microphone (my guess is this would be to stop any kind of Red Box or Tone Dialler related attacks). The final trick is to enable the microphone.
By law all australian payphones must provide access to the 000 emergency number for free. Obviously this is for emergencies. So you dial 000. Because you're not at the dial-tone, you wont get 000 but the so-called "Smart-Phone" doesn't know that. It activates the microphone, and even prints "Free Call" on the screen for you.
Next billing unit, you will again hear the polar reversal and in most cases you'll find it's reset the phone and disabled the microphone on you. Simply dial 000 again to reactivate it, or as NetNerd pointed out, while connected the * key acts as a kind of Re-Dial function, making the task even easier.
So what have we learnt today? Well Netnerd tells me the whole problem is because Telstra contracted foreign companies to build our payphones instead of using the Australian ones. I haven't figured out the link yet.. Maybe foreign countries underestimated the resourcefulness of Australian Phreaks...
Hehehe..
Whatever, Like I said to begin with, this text in no way condones fraudulent use of payphones. Chances are some day everyone that's making use of this or some other phreak technique will go down in some huge sting or something, so before you try out the Theory in the text, think if you really want to be a part of it or not.
Well.. I'm out... If you're in Aus and really must email me, I'm including my contact info... But I'm broke, so I don't do conferences at the mo :)
fwaggle '99
