***BEGINNERS FREEFONE PHREAKING IN THE UK (1998)*** *************************************************** - by uV & Senor Cardini - DISCLAIMER (All the information in this file is for educational purposes only. No-one involved in the compilation of this file would suggest using it for any purposes leagal/illegal whatsoever. In fact it might all be complete bollocks for all we know etc) !! Loadsa phun to be had on freephone numbers !! Freefone phreaking is calling freephone (0500/0800) numbers and using the interesting systems that are often on the other end. This often means accessing company's phone system to obtain free calls or services. I will cover the three main areas:- VMB Hacking, Dial-Outs and Conference System abuse. There are countless other systems on 0800's that are not covered here. **Scanning** You need to scan a lot of 0800/0500 numbers to find useful numbers. You can't use a scanning program like Toneloc here as you are not looking for a modem carrier signal. This means dialling hundreds of numbers by hand. Apparently BT are able to detect mass 0800 scanning done from your home phone but I know lots of people who have called 1000's and never heard a peep. Still a phone box is better if you're paranoid. You may reach foreign systems on UK 0800 numbers. The 0800 89XXXX range is full of these as is the 0800 9XXXX range. These are also referred to as Country Direct numbers (check out the back of you BT Book). These are cool as you may get access to systems in that country. USA numbers a great because the US has loads more conferences, loops and PBX's than we do and lots of these are on the WWW. Companies are getting wise to abuse of their systems. Certain numbers are always getting hacked and are now completely blocked. It might be worth avoiding the 0800 89xxxx range for this reason 0500 numbers don't get anywhere near as much attention...:-) So choose the range of numbers you are going to scan and get going. Make a note of what you find and what time you dialled. It is best to dial out of hours for whatever country the line terminates in. Otherwise a lot of numbers will be picked up by a human. You are looking for dial-tones, other tones and automated attendants, mail-boxes etc. Getting in: Let's say you have the number of an American company on a 0800 89XXXX. This might answer as "Welcome to ABC company voice-mail system, if you know the number of the person you want to reach dial it now. If you have a mail-box on the system press 9. If you want to reach assistance dial 0 or stay on the line`. Listen to the whole message - there may be other options. If you get no options try the * or # keys or combinations of these with numbers like 1,8 or 9. This may throw you into the voice mail. You may have to leave a message and then try to break out. Get a range: Try dialling some extensions and get an idea of the range of numbers accepted. You are starting to map the system. Some extensions (often at the end of the allowable range or a one off number like 2000, 4444 etc.) will have an out-dial on it. **The Systems** *VMB's This is accessing voice-mail systems and using the features to your own ends. You can set up your own free voice-mail box or listen to confidential messages etc. This is obviously boring after the first few times. The real interest comes when there is an out-dial, conference box or whatever on the system that is only accessible by valid mailbox owners. This centres around the fact that most VMB passwords are either the same as the box number (Box=3300, PW=3300), a crappy default (1234), easy to remember/guess (1111, 1234 etc.) or similar (box number+0). When you enter the voice-mail system it will often tell you what make it is Meridian, Octel, Norstar or whatever. This obviously helps a lot, although particularly sad individuals will come to recognise them by the prompts anyway. You really need to try all these numbers and map out systems for yourself to get a good idea of what's out there. There are loads of texts specific VMB brands. I reckon Meridian are the easiest to hack (pass-code is the box number as default and they have an excellent help facility - press the * key). I will only touch on Meridian systems to give you an idea of how they work. A lot of the points are relevant to other systems. Meridian Voice-mail:- I suggest you read Coldfire's text on Meridians. I won't go into details as he does it well and I don't want to quote it word for word. I will therefore cover the practical hacking aspects I will assume you will go get that text! Ok here are a few of the more essential ones *8 is mailbox commands *7 is message commands *81 is login 011 is name-directory 011# is dial any number/extension - depends on whether you're logged in/masks etc(see below) *80 is mailbox features - options here to allow to to change the number that is dialled when 0 is pressed (normally the opertator) - has some potential... Lets say you called a company, pressed * and got "Hello, you have reached the voice-mail system. If you have a mailbox on the system press pound(#), or if you wish to reach someone and know the 4 digit extension please dial it now" If you press # you get "Meridian Mail. Mailbox?" - this is expecting a 4 digit code+# and a 4 digit-pass-code+#. Unfortunately you have no idea of the allowable codes. They could be random or more likely within a certain range. 3000 is normally a good shot BUT seeing as the login sequence will only let you know whether you have got BOTH codes correct you'll have a hard time hacking it. Go back to the original prompt and try some extension numbers until you get one or two that work. Seeing as the box numbers are always the same as the extension numbers so now you know some valid box numbers or better still the range of valid box numbers. Ideally you want unused boxes in their default state. These unused extension/boxes don't have a "Hi leave a message for John Smith here" on them. Depending where you are in the system. Dialling 011 will put you through to a directory system where you can dial in a name using the number/letter combinations on you telephone keypad. Try SMITH or JONES, you should get a few numbers this way. Once you have valid boxes you need the pass-codes, so go to the login (*81) and try the default pass-code, i.e. the box number itself. Empty boxes are more likely to work in this way, failing that try some 1234, 1111 sequences (good for thick giggly admin department boxes :)). You should be able to get at least one box this way. You will have noticed that 3 unsuccessful pass-code tries will throw you out. With one valid box you can get around this. Try 2 boxes then log into your valid box, now try two more and so on until you get more boxes. As long as you enter one valid code combination in 3 you are fine. This is the sort of feature that most systems have and makes hacking them much easier. To see if you have an out-dial here enter 09+number to dial+# if it dials you have got one (remember to work out what country your system is in first though). Which brings us on to.... *Out-dials This is basically dialling into a company's phone system (PBX), gaining access and dialling out. The net result is that you only pay for the call to the company. If this is an 0800 number then you don't pay anything. There are two ways you might come across out-dials. 1. Straight-forward PBX extenders Background:- A company wants it's sales staff to be able to call internationally from home for free so they set up an 0800 PBX extender. This allows the person to dial free to the company number and then out to the desired destination (on the company bill). They work mostly like this: you dial a certain number and get another dialling-tone, another sort of tone or even a voice-prompt ("enter your 4 digit ID" etc.). An incorrect tone will often give a two-tone alarm signal (don't worry it is just an audible prompt). Once you enter the correct code (normally plus a #) you may get another dial-tone which you can use as if dialling from you own phone. You may have to enter 9 or 0 or similar to get a line. You may need to add a # to the end of the number. Hacking them:- These are only easy to hack if the code is something stupid like 1111, 2222, 1234 etc., +# which it often is. The first thing you need to know is the length of the code. You may be able to get this by entering in the numbers very slowly and listening. After the correct number of digits there may be the alarm tone or a soft click. If not you have to assume it is 4 or less. If it is not you are going to have a hell of a job cracking it anyway! Try the common defaults as described and any other easy-to-remember numbers. You may notice that it bleeps you out after only 2 numbers when say entering 12 but after 4 numbers when trying 4567. This may be a clue to the start of the sequence. If you have a group of bored, nerdy friends (you may be a student for example.;-)) you can split up the 9999 possible combinations between you. This should only take 10 of you a couple of hours. The speed of these things is often dependant on how many tries a system lets you have before throwing you out. Another way is to use a PBX Hacker program which I won't go into except to say that they come with their own documentation, they don't often work unless you know the exact format of the switch (PBX) and can't be used from phone boxes (can you explain 9999 calls to the same number?!) 2. "Hidden" PBX's. Background:- Most larger companies have their own PBX systems with 0800 access numbers. Some of them will intentionally want people to be able to dial though them, others just don't know it can be done or have configured them incorrectly. Their out-dial may be on a certain extension or hidden behind a VMB (See the VMB section on Meridians) Hacking them:- This can be as easy as ringing the sales line 0800 of some company, asking for another dept, say accounts, asking to be put though to the operator and saying "Hi I'm Dave from accounts, I can't seem to get an outside line. Could you dial this number for me?" - this may or may not work!. There are a number of ways depending on the make of the system and the way it is configured. I can't give you a sure-fire way on all systems. You may just be able to dial 9+the- number-you-want+# or 09+.... Etc. You may have to try every extension until you get a tone. You may have to hack the systems admin. box first to change some options. You may have to hack a certain box. Meridian systems often allow 09+number+# but only after you have logged in successfully to a mail-box. There may be calling masks set up by the administrator which restrict outgoing calls to nil or a limited range (e.g. local calls or free-fone calls only). So (on most Meridians for example) having a valid box/code is not always enough. However, you may be able to fool the mask on a UK system by entering 141 in front of the number you want as the system is often checking for zeros. Keep trying different 0800 numbers until you find systems that you can hack. ANY fool can hack a Meridian. You will find some with out-dials once you have, you have got your phree calls without any fancy kit. *What is the real number?** Although you may be dialling an 0800 number you can be sure that there is a normal number like 01454 654312 or whatever linked to it. If you dial 17070 (in BT areas) from your out-dial it will tell you what number you are really at. If this doesn't work dial your own number and do a 1471 job on it. This means that if you want to pretend to be someone else or specifically to pretend to be from that company you can! All but a really determined trace will do is show up the wrong number. *Linking them up* Linking up your out-dials will extend their usefulness. If you have an 0800 out-dial that terminates in the USA thus allowing dialling to US numbers you can use it to dial 1-800 numbers which are the yank equivalent of our 0800 numbers. Americans are way ahead in the use of mail/switching systems and there are out-dials, conferences etc. abound. *Keeping hold of them* Using out-dials is obviously illegal. Not only are you gaining unauthorised access to a system (i.e. hacking) but you are stealing call credit from the company. BT and the company have a vested interest in stopping you or catching you. Here are some guidelines: I. The first rule is do not give the numbers/codes out to anyone else. As soon as you do you can be sure that they will too and so on, and so on. At least one of these people will be a twat, use it to call Mexican sex-lines for 4 hours at 2am on a Sunday. It will either get closed down or they will set up a trace. II. Use them wisely. As with all crime, you should be fine unless you get noticed. So if you call numbers that are likely to be called from that company, are of a normal length, during normal times etc. you are unlikely to raise any eyebrows. III. Linking out-dials up makes tracing your call much harder, especially if you cross international boundaries. This will often throw the phone companies systems and can make prosecution harder. The most likely way of tracing calls is going to be from the point which you 1st call in at. Seeing as you are only making freefone calls from that point it will not be showing up in any bills. They are not losing and are not monitoring. Should the second company notice they will trace it back to the first company. Do this through 3 or 4 and things start looking good for you! IV. Try not to use them from home V. Don't stay on for long. Using one out-dial to acess the Intenet for hours at a time is one way of getting noticed. VI. Be paranoid. No matter how careful you are being, there may be others using the same out-dial recklessly. You could get caught in the same net. It is a good idea to tell you call recipient to have a cover story ready in case they are called to see who called them at a certain time. "Oh yeah, I have been getting odd calls, some time they just don't speak to I just leave the receiver off the hook and come back to it in an hour" or "Fuck off you running-dog capitalist pig I don't have to tell you anything". **Conferences** For spending hours talking to your geeky phrekin' mates you really need to start accessing conference systems. These are basically systems which join multiple lines together so all parties can speak to each other real-time. Those shite Partyline things are basically fucking expensive conferences (although now they are not allowed to even be real-time!). There are two general ways of accessing conferences. 1. Social Engineering/Carding This is a piece of piss. Ring up your directory enquiries or look on the Internet for teleconferencing numbers. A good way of accessing these things is to call the USA through one of your US-terminating out-dials. This allows you access to the many US based conferencing companies as well as hiding your phone number. You need some information before you call. Get some US names and addresses - check out the Internet. People often put such info. at the bottom of their newsgroup postings. The name, address, zip code and telephone number must match. Basically just ing them up and ask to set up a conference. The conversation will go something like this:- TC "Hello thank you for choosing XYX Teleconferencing Ltd, how may I help you?" You "Hi I would like to set up a conference please" TC "Sure when would you like it for?" You "in about 15 minutes" TC "How long for and for how many people sir?" You "4 hours and for twenty people please" TC "What is your company name, your name and address please" You "3M corporation, John Mackenzie, 1020 Slow St, Happy Valley. Minesota Zip code 12232" TC "Was that Mackintosh" - (how!?) You "No that MACKENZIE" TC "Sorry about that" You "No problem, it's a bad line" - probably because you're calling through 16 extenders! TC "And what's the billing number" You "that's 1-513-2344-3434" TC "Fine that has been set up - please dial 1-800-854-8554 to access your conference. The conference number will be 54334. What would you like for your pass-code?" You "Err 8232 please. Oh by the way, I have some people accessing the conference from the UK. What number do they need to dial?" TC "That will be 0800-756-3333" You "Thanks" Now you and your mates can call the relevant access numbers and enter the codes and get chatting. This works virtually every time with most of these companies - think about it, how the fuck are they supposed to find out who is vaild or not from that info. You can even get cheeky and use someone's account. Try calling AT&T teleconferencing and saying you are John Doe from some big company" Try anything you like. Remember they really don't know who you are. Some companies allow billing to a credit card. You can generate these pretty easily using CreditMaster and use them. This however does tend to carry a heavy penalty and also fucks over some poor unsuspecting member of the public (if that bothers you) Anyway there's no need. 2. Company Conferencing Systems Companies having realised how handy but expensive teleconferencing is have set up their own conference boxes. The most common one in the USA is Meeting Place. You will find these on the end of 0800 numbers or on extensions of Octel VM systems systems (try spelling MEETING into the directory to find the extension or just get scanning). They welcome you with "Welcome to Meeting Place. To attend a meeting press 1. To access your profile press 2 etc" What you need is a valid profile number. These a 3-17 digits but generally are between 4 and 6. You just have to keep trying until you find one. (There are default profiles on 0001, 0002 and 0003) The pass-code may be something like 123456. Once you are on these you can set up conferences when ever you like for loads of people. You can lock the session, form splinter sessions and boot people out like IRC. You don't need to know too much more as they are voice-prompt city. However there are some important features which stop you from getting noticed - the exact layout of Meeting place is in another text file, cryptically entitled "Phreaking Conferences with Meeting Place". See ya uV and Senor Cardini ************************************************** Shouts to Darkcyde Communications + Hybrid + Public Nuisance + Nitrous Oxide