ßß ßß ßßßßßß ßßßßßß ßß ßß ßß ßß ßß ßßßßßßß ßß ßßßßßß ßß ßß ackers ßß nformation ßß ßß eport ßß ßß ßßßßßß ßß ßß ÄÒÄ ÖÄ¿ ÖÄ¿ Ò Â ÒÄÄ¿ ÄÅÄÅÄ Ò Â º ÓÄ¿ ÓÄ¿ º ³ ÇÄ ÄÅÄÅÄ ÓÄÄ´ ÄÐÄ ÓÄÄÙ ÓÄÄÙ ÓÄÄÙ ÐÄÄÙ Á (March 1, 1998: Special Ascii Edition) Welcome, reader, to our Special Ascii Edition of Hackers Information Report. You guys using graphical browsers to look at this will simply NOT get it. Use a real browser (like lynx or Minuet), or download the files and look at them with a real text viewer (none of this NOTEPAD.EXE stuff...that'll make it look even worse). HiR is best viewed in vi under unix, or EDIT in dos. For those of you who have just joined us, our mag can be found at the following places: (Original Site) HTTP://www.jccc.net/~ndunker/hir.html (Note the new URL) (New Mexico Mirror) HTTP://azure.rcn.nmt.edu:2007/hir/ (TwistedinterneT) HTTP://www.twistedinternet.com/ (look at the newz file!) *** NEWS *** HiR is proud to announce yet another way to get ahold of the mag, as well as a bunch of other kick-ass information. We're working with TwistedinterneT services to bring you not only another place to find HiR, but grab TONS of other goodies, information, and toolz while yer there! See the newz file for more information!!! *** ---- *** HiR is an electronic magazine devoted to the freedom of information and technology. We do not condone ripping people off for the sake of passing boredom. We are here to share the wealth of information that exists out there, that we have either learned, or come up with on our own. HiR makes the best attempt to keep the content of the mag ethical. Typically, hack walk-throughs are not provided, but information pertentant to a systems inner workings are often discussed, allowing individuals to deduce for themselves any other options that can be pursued with the information. ONLY Hacking and Phreaking issues are discussed here. There is no death and destructuction, no warez sites, or even virii, and especially, NO CARDING. These are activities which are extremely questionable when it comes to the educational/informative side. (We're sorry to disappoint the people who like to blow things up...some of us like to do that too, we just don't cover it) Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄ ÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ HiR is written and assembled by the following people: Name E-Mail Function ------- ----------------------- ------------------------------------------- Axon Axon@compfind.com Writer, Webmaster, Compiles final product Asmodian X asmodianx@hotmail.com Writer, Insane insomniac psycho philosopher kminor pairsnarfer@gotmail.com Writer, kodiene phiend, Ascii g0d Dr.Freeze foodstamp.man@juno.com Writer Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄÄ¿ Ú¿ ÚÄÄ ÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ ÀÄÙÀÄÄÙ Articles You'll Find In This Issue of HiR Number Title Author ------ ------------------------------------------------------ -------------- 1 Introduction/Table of Contentz 2 Hacking Around With Meridian Voice Mail and PBX Axon 3 More HPC Hijinks Asmodian X 4 Mobile Hackers Guide to Phreaking (Article contains Axon instructions and skemz for the GoldBox) 5 The mysteries of the Dumb Terminal Axon 6 HiR Hacker Newz HaCKeRS iNFoRMaTioN RePoRT H a c k i n g A r o u n d W i t h ÖÄÄÒÄÄ¿ ÒÄÄ¿ ÒÄÄ¿ ÄÒÄ ÒÄÄ¿ ÄÒÄ ÖÄÄ¿ ÖÄÄ¿ º º ³ ÇÄ ÇÄÂÙ º º ³ º ÇÄÄ´ º ³ º º ³ ÐÄÄÙ Ð Á ÄÐÄ ÐÄÄÙ ÄÐÄ Ð Á Ð Á º º ³ Voice Mail and PBX Systems Ð Ð Á by Axon The Meridian Telephone system is becoming very popular for mid-size and large companies. Basically, all that the Meridian system is, is a PBX with Voice- mail and outdial capabilities. It's very flexible, and easily programmed. Almost all user-definable functions can be utilized via a standard DTMF phone keypad, from listening to your voice mail, to changing the mailbox greeting, and changing passwords, allowing off-site access to voice-mail and other functions. I've seen this phone system at two of my three places of employ- ment, as well as others. Chances are, you'll have no choice but to run across these systems once in your lifetime, simply because of their popularity. I am in no way saying that this is the BEST PBX or Voice-mail system, I'm just going to go over some basic information. Stations- Like any PBX, there are trunks (outdial lines) and stations (Phones hooked up to the PBX). The Meridian Mail System is a Digital PBX, and I don't think any phones other than the ones Meridian distributes, will work on it. I'll cover three types of meridian phones, which are the most popular, and the only ones I have seen. Meridian M2006 Telephone: The M2006 is a digital telephone that offers a standard DTMF keypad, Volume control, Release, and Hold buttons. It features Five programmable buttons along the right side of the phone, a one way speaker for on-hook dialing, plus a red light that indicates a voice-mail message. Alongside the programmable keys is an LCD status display bar. Below is a picture: ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ Note that the status Bar uses ³ ÚÄÄÄÄÄÄ¿ ÚÄÄÄÄ ÚÄÄÄ ÚÄÄ¿ ÚÄÄÄÄÄÄÄ ³ Little black arrows to indicate ³ ³ ³ ³HOLD ³RLS ³ >³ ³ P1 ³ if a programmable function is ³ ³ ³ ³ ³ ÚÄÄÄÄÄÄÄ ³ active, such as forwarding, ³ ÀÄ¿ ÚÄÙ ÚÄÄ ÚÄÄ ÚÄÄ ³ >³ ³ P2 ³ a conference call, etc. The ³ ³ ³ ³1 ³2 ³3 ³ ³ ÚÄÄÄÄÄÄÄ ³ xNNNN button, typicaly is labeled ³ ³ ³ ÚÄÄ ÚÄÄ ÚÄÄ ³ >³ ³ P3 ³ with the extension/mailbox number, ³ ³ ³ ³4 ³5 ³6 ³ ³ ÚÄÄÄÄÄÄÄ ³ such as "x1023". Pressing this ³ ³ ³ ÚÄÄ ÚÄÄ ÚÄÄ ³ >³ ³ P4 ³ button when the handset is on-hook ³ ³ ³ ³7 ³8 ³9 ³ ³ ÚÄÄÄÄÄÄÄ ³ will pick up the line and you'll ³ ÚÄÙ ÀÄ¿ ÚÄÄ ÚÄÄ ÚÄÄ ³ >³ ³ P5 ³ hear your dial tone and dialing ³ ³ ³ ³* ³0 ³# ³ ³ ÚÄÄÄÄÄÄÄ ³ on the one-way speaker. The Ascii ³ ³ ³ ³ >³ ³ xNNNN ³ drawing on the left is not exactly ³ ÀÄÄÂÄÄÄÙ ÚÄÄÄÂÄÄÄÄÂÄÄÄ ÀÄÄÙ ³ how the phone looks. It's just how ³ ³ ³<<<| |>>> ³ the keypad is layed out. There is ÀÄÄÄijÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ a Speaker above the keypad, and ³ ³ the keypad is about half as tall as ³ ³ It appears to be in the drawing. The <<< >>> bar, is the volume / ³ control. It's one solid button, but it rocks to the left or right, / ³ to decrease or increase volume, respectively. The programmable keys ³ ³ can be programmed various ways. I have seen the following functions ÀÄÙ assigned to programmable keys: Intercom, Conference, Transfer, Speed Call, Forward, Auto Dial, Program*, Call Pick-Up, and Message. Most of those functions are self-explanatory. I'll explain the ones that are not. Speed Call- Similar to speed-dialing on a normal telephone. Program numbers into 10 memory allocations, 0-9, and then just press [Speed Call] [x]. Auto Dial- Works in the same manner as Speed Call, but it calls one pre-programmed number, at the touch of this button. Program- This is only available on the other phone, and some of the larger phones that i will talk about, not the M2006. It is used for adjusting Volume of the speakerphone, Contrast of the status scren (which I'll talk about when i get to the next section), Call Timer enable, Idle Screen Format, and key clicks. Call Pick-UP- This is a function that allows a user to answer another phone in the same office. It's fairly useless, unless you feel like intercepting your boss's phone calls (I've tried it. fun.) The M2616 Telephone- Features include all of the ones found on the M2006 Telephone, plus a two-way speakerphone, 16 Programmable keys instead of five, and allows for modular options such as a status display (2 line Alphanumeric LCD display that shows number dialed, length of call, time, and other things). This phone also has a female DB25 port on the back of it. Materials i have acquired speak of the 2616's ability to support a programmable data adapter. I assume that's what the port is for, although I really don't know what the precise function of the programmable data adapter is. I won't bother showing a second picture. Just imagine the first picture with 2 rows of programmable buttons, 8 on each side of the status bar. Most of the programmale buttons i've sen on these phones are dedicated to AUTO-DIAL buttons, so typically these phones are found in supervisor offices, with pre- programmed numbers to all the stations of their underlings. The M2617 Telephone- The most luxurious and feature-rich phone I've seen is the M2617. While it has all of the funtions of the 2616, it has only 11 programmable buttons, and 5 "soft keys" across the top of the phone, under the display, which is, again, an alphanumeric LCD screen. The soft keys' functions can be programmed to change with the status of the phone. These keys can display the last number called, forwarding functions, speed dialing programmability, and a host of other options. The keys are used to navigate the whole menu Subsystem of the phone itself. The only place I've ever seen this phone was at the operator's desk, and it was hooked up to several modular adapters that were for transferring calls to different stations. I do not know all of the modular options that are available for these phones, but i do know that there are options for display screens, and additional programmable buttons. In addidtion, the 2617 (and I believe the 2616) are capable of handling multiple incoming phone lines. Remember the xNNNN button on the 2006? Well the 2617 is capable of handling many incoming lines, which take up one prog- rammable key per line, so you can press one of the incoming line buttons to connect to that line. The Voice mail System- The following information may be system specific to the location for which i found the informative literature. If this doesn't work with all meridian systems, so sue me. If you're actually at the place where the system is, this is a lot easier, if you have access to a station (a phone hooked up to the PBX). To enter the voice mail system, press the [MESSAGE] programmable button. If the phone does not have one of these, try dialing 4444. This may or may not work properly. If it does not, you're shot out of luck, or you can try to find a phone with a message button on it. Some way or another, though, there is an extension that can be dialed that will allow some of the phones to access messaging and setup options. Ceretain stations can be programmed from the console as to not allow mailbox setup on that station. Keep trying, I guess. Some phones may not have a mailbox set up. IF this is the case, you MAY be in extreme luck, as usually the system will begin prompting you for all the information it needs to CREATE a voice-mail box for that extension. You may hear a menu for how to play messages, or you may be told that there are no messages at all. There is also the possibility that you will be asked for a password. There is a VERY neat trick with meridian mail systems passwords... by default, ALL, that's right, EVERY SINGLE mailbox has a password, and ALL of the passwords, unless the default configuration was altered before set-up, is the same as the extension number, so if you see the number "x3125" on the programmable button on your phone, then try that as the password. It will probably work unless that mailbox is someone's personal mailbox and they have changed the password. Once you've entered the password, you're ready to do one of a few things. The most interesting of these, is obviousely TAKING OVER the mailbox, since that's probably one of the things you want to learn about. Rest assured, though, that your efforts in this stage could be taken the wrong way by the big corporate people, and also, it's nothing more than a few lousy keystrokes and maybe 5-10 minutes of work to completely wipe out the mailbox, or to change the password on it again and give control of the mailbox back to whom- ever it originally belonged. After the password has been entered, There are all sorts of things you may want to do. ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ³Enter Password ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÂÁÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÁÄÄÄÄÄÄÄ ÚÄÄÄÄÄÄÁÄÄÄÄÄ ÚÄÄÄÄÄÁÄÄÄÄÄ ÚÄÄÄÁÄÄÄÄ ÚÄÄÄÁÄÄÄÄÄÄ ÚÄÄÄÁÄÄÄÄÄÄ ³ ³[2] Reply to ³[3] Discard ³[4] Forward ³[5] Keep ³[6] Make ³[7] Play ³ ³Last message ³last message ³message to ³message. ³message to ³Messages ³ ³Listened to. ³Listened to. ³other phone ³send later ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ ÚÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄ ÚÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄ ³[8] User Options. ³[9] Exit (hang up ³(Passwords, Voice ³Greeting, etc.) ³This is FUN! I'm really only going to focus on the User Options menu in this article, because the rest is mundane, and can be easily explored by simply listening to voice prompts. The User Options menu is the most powerful menu that any normal person will have access to. ÚÄÄÄÄÄÄÄÄÄÄÄÄ ³User Options ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÁÄÄÄÄÄ ÚÄÄÄÄÄÄÁÄÄÄ ÚÄÄÄÄÄÁÄÄÄÄÄ ÚÄÄÄÁÄÄÄÄ ÚÄÄÄÁÄÄÄÄÄÄÄÄ ³[4] Record ³[6] Record ³[7] Change/ ³[8] Help ³[5] Make ³Personal ³your name. ³assign your ³Distribution ³greeting. ³passcode. ³List. (We ³won't cover ³this) Pressing 9 from this menu will take you back to the previous menu. Obviousely, taking overthe mailbox can be done simply by changing the passcode. If you want, you can leave the greeting and name the same, or you can scream something obscene. When you are recording, remember to hit the # key to stop the recording. For the love of god and hackers, please don't mess with the distribution list. It's not very user-friendly and I personally think it's the lamest thing since the 1960's phone phreaks designed 200 different colors of "boxes", all of which were different ways to put someone on hold or tie up their phone line. Have phun with all the meridians you can find! Hpc's Part Deux By. |\smodian >< It's me again, once again writing another fun filled with HPC's. To those of us who have one of those handy dandy portable devices. I have done a bit more studying about These wonderful devices, and have some more facts to bring to light. Tonights highlights will be Alternate power sources and hidden doodads and menus. -=- Alternate power supplys when using PCMCIA modem w/o AC power -=- One problem with HPC's is the inability to sustain a PCMCIA modem connection for more than 1 hour. When you go over one hour the batteries usually die. for those of you not familliar with HPc's they usually take 2 "AA" batteries. Rechargeable batteries work fine under normal load, however do not have the same staying power of regular alkaline batteries. A simple solution is to get High Capacity NiCad batteries. They will probably out last the Regular NiCads by a bit, but not by too much. A better solution is to use those expensive Energizer High Energy Lithium cells. It might be a good idea to have some as a spare for emergencies, but if you're on the road alot I would suggest an external power pack. Most manufacturers sell a NiMh Battery for roughly 30 to 50$. and would be a good idea if you got the cash. If you dont have the cash but you have an old 7.2 V NiCad "racing battery" along with the charger, and have a few bucks for parts and enclosures you can build your own rechargeable power supply. To knock the 7.2 v battery down to a useable voltage, simply make a Voltage regulator box via a LM309k 5V regulator. run a coaxial lead to a matching plug for yer power input and volia! Keep in mind that each HPc is different and yours may require a different voltage/current. Also Keep in mind what happens when a person screws up the power input no more HPC. Also keep in mind that I ain't responsible for what you fuch up... so don't come cryin to me about your deep fried investment. If it were up to me I'd use the mail order one!!! Another novel idea was utilized by Axon during the last 2600 meeting. Axon took an un interuptable power supply and plugged his HPC into it via a power cord. By the same token, if a person had an external modem and a Null modem adaptor, and hooked it up with the special propritary serial cables that come with the HPC. the person wouldn't have to worry about the drain on the batteries. OF course you could just bring a big spool of extention cord and a power strip but thats too obvious. Due to the low cost of purchasing the extended rechargeable battery usually about 50$ and the startup cost of building a box would be about the same. So unless your really straped for a battery I really suggest you use the manufacturers battery. Hince no schim, unless some one can get me a schem on the LM309k chip. Another Note, a company called Modem Express carries special battery powered modems. They supposedly can be reached at (612)-553-2075. -=- Secret Menu of Cassiopia/Pc Comp. death-=- Heres a neeto thing to destroy a Compaq/cassiopia's memory. Some time A HPC will lock up so bad it wont even boot. The solution to that is killing everything on the HPC. This fix is simply an alternative to pulling out the memory batteries and the work batteries. step 0: back up everything! step 1: Turn Off HPC step 2: press all at once Ctrl,Caps, Shift, On, and RESET from the menu you can blow the ram away to a factory state. to exit the menu press reset. .. well thats in in the way of neeto factoids... I'd like to point out some items from the previous article I did about palm tops. The RED box aspect was feild tested by an anonymous being, and they communicated to me that the method worked. In addition, I have found several telnet clients and ftp clients, as well s a FTP and WEB Sever. Both the Telnet Client and the Ftp Client are available from Ruksun software technologies. (http://www.corus.com) I picked up the Ftp from a Win CE web page. Some good pages to look at are ce.computra.net www.windowsce.com www.jimmy.com and some stuff like that... I found some of the kewlest stuff on a japanese page which is run by Eiichiroh Itoh. http://www.oohito.com/ -=- Kewl stuph in da werks for hpc's!!! -=- * Theres a 80186 Emulator in the works for the sh3 & the mips in the pre-alpha-nonexistant state -=- Projects under way by |\smo -=- * PPP'ing to a linux box via the Serial Port any way, Happy New year and safe driving! -=- |\smodian >< -=-  ÜÜÜÜÜÜÜ ÜÜÜ ÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜ ÜÜÜÜÜ ÜÜÜ ÜÜÜÜÜÜÜ ÛÜÜÿÜÜÛ ÛÿÛÜÛÿÛ ÛÿÜÜÜÜÛ ÛÿÜÿÜÿÛ ÛÿÜÜÜÿÛ ÛÿÜÜÿÛÜ ÛÜÿÜÛ ÛÿÛ ÛÿÜÜÜÜÛ ÛÿÛ ÛÿÜÜÜÿÛ ÛÿÜÜÜÛÜ ÛÿÛÿÛÿÛ ÛÿÛÜÛÿÛ ÛÿÜÜÜÿÛ ÜÛÿÛÜ ÛÿÛÜÜÜÜ ÛÿÜÜÜÛÜ ÛÜÛ ÛÜÛ ÛÜÛ ÛÜÜÜÜÜÛ ÛÜÛßÛÜÛ ÛÜÜÜÜÜÛ ÛÜÜÜÜÜÛ ÛÜÜÜÛ ÛÜÜÜÜÜÛ ÛÜÜÜÜÜÛ ÜÜÜ ÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÛÿÛÜÛÿÛ ÛÿÜÜÜÿÛ ÛÿÜÜÜÜÛ ÛÿÛßÿÜÛ ÛÿÜÜÜÜÛ ÛÿÜÜÜÿÛ ÛÿÜÜÜÜÛ ÛÿÜÜÜÿÛ ÛÿÜÜÜÿÛ ÛÿÛÜÜÜÜ ÛÿÜÿßÛÜ ÛÿÜÜÜÛÜ ÛÿÜÿÜÜÛ ÛÜÜÜÜÿÛ ÛÜÛ ÛÜÛ ÛÜÛ ÛÜÛ ÛÜÜÜÜÜÛ ÛÜÛÛÜÜÛ ÛÜÜÜÜÜÛ ÛÜÛÜÜÜÛ ÛÜÜÜÜÜÛ ÜÜÜÜÜÜÜ ÜÜÜ ÜÜÜ ÜÜÜÜÜ ÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÛÿÜÜÜÜÛ ÛÿÛ ÛÿÛ ÛÜÿÜÛ ÛÿÜÜÿßÛ ÛÿÜÜÜÜÛ ÛÜÜÿÜÜÛ ÛÿÜÜÜÿÛ ÛÿÛÜÜÿÛ ÛÿÛÜÛÿÛ ÜÛÿÛÜ ÛÿÛÜßÿÛ ÛÿÜÜÜÛÜ ÛÿÛ ÛÿÛÜÛÿÛ ÛÜÜÜÜÜÛ ÛÜÜÜÜÜÛ ÛÜÜÜÛ ÛÜÜÜÜÛß ÛÜÜÜÜÜÛ ÛÜÛ ÛÜÜÜÜÜÛ ÜÜÜÜÜÜÜ ÜÜÜ ÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜ ÜÜÜ ÜÜÜ ÜÜÜÜÜÜÜ ÛÿÜÜÜÿÛ ÛÿÛÜÛÿÛ ÛÿÜÜÜÿÛ ÛÿÜÜÜÜÛ ÛÿÜÜÜÿÛ ÛÿÛßÿÜÛ ÛÜÿÜÛ ÛÿßÛÛÿÛ ÛÿÜÜÜÜÛ ÛÿÜÜÜÜÛ ÛÿÜÜÜÿÛ ÛÿÜÿÜÜÛ ÛÿÜÜÜÛÜ ÛÿÜÜÜÿÛ ÛÿÜÿßÛÜ ÜÛÿÛÜ ÛÿÛÜßÿÛ ÛÿÛÜÜÿÛ ÛÜÛ ÛÜÛ ÛÜÛ ÛÜÛÜÜÜÛ ÛÜÜÜÜÜÛ ÛÜÛ ÛÜÛ ÛÜÛÛÜÜÛ ÛÜÜÜÛ ÛÜÛßÛÜÛ ÛÜÜÜÜÜÛ Sometimes it is necessary for a hacker to rely on techniques that have been developed by the close colleagues of ours, known as the phreakers. Hacking usually takes place, but is not limited to, electronic communications, such as the internet, bulletin boards, voice mail, packet radio, and other serv- ices. Almost always, where electronic communication is involved, so is the phone company. Enter the knowledge held by the phreaks. The original phone phreaks built elaborate devices such as the blue box, to explore billing proc edures, switches, and just "how does that voice on the other end get to where I'm standing?" Anymore, phreaking is more and more about exploiting holes in the telephone company, either physical or electronic, to gain "something for nothing", or, stealing service. Some of these techniques are extremely bord- erline legal issues, if not completely illegal. I don't necessarily condone these actions, but if there is a need, a hacking directive that cannot be achieved without using such measures, sometimes certain things have to be done. Maybe you need to make sure no one can pinpoint you as the hacker. Maybe you just feel like going outside to hack, who knows. Everyone has their reasons. I, myself am not a phreaker, but I learn from them, and can put their knowledge and power to use for my own purposes as a hacker. So, here's my guide to using phreaking to aid in hacking. There will be quite a bit covered here, I have broken it up into sections: 1) Your Mobile Platform 2) General Equipment 3) Preparing for the event 4) Keeping On your Guard 5) Hacking it Up! 6) UH-OH! We've got company! 7) Making a BeigeCord 8) Complete plans on making and using a GoldBox (Schems included!) 9) Tips for use with the Acoustic Coupler ------------------------------------------------------------------------------ Your Mobile Platform =-=-=-=-=-=-=-=-=-=- Surely you'll want a laptop with a good sum of battery life, or a palmtop, anything with a terminal program, and a modem. Without these, mobile hacking (at least via electronic means) is not very likely. If choosing a laptop or other portable hacking platform, look for something that's light, yet durable. I personally have two platforms for field hacking: An NEC laptop with a 540Meg hard drive, 8 megs of ram, and a wonderful terminal emulator called Telemate. I also have a Hewlett Packard 300LX palmtop with 2 megs of overall storage, and a built in VT-100 and TTY terminal emulator. Both of them have their good and bad sides. Both of the devices support PCMCIA modems. I have 2 modems, an Eiger Labs 28.8 faxmodem, which is powered by the telephone line to reduce battery drain, and a Megahertz 14.4 faxmodem which is Battery powered, so it will work with an acoustic coupler for payphone (or other) use, but will reduce my laptop's run time by 15 minutes or so, and kills my palmtop in a half-hour flat. Whereas the palmtop is small, weighs under 3/4 of a pound, and is rugged like you wouldn't believe (I dropped it in the mud when i was using it at a payfone once and it didn't so much as complain!), it has no backlight, and the letters are very small and hard to read in low-light conditions. Battery life is limited to about 45 minutes when using a modem, and that's if i use VERY expensive alkaline batteries. Cheap batteries won't even last half an hour with a modem, and NiCd batteries last 5-10 minutes. Not a great choice, but for hit-and-runs, it's a winner, at least if u got a good flashlight. Oh yah, no logging or file transfer capability with the built-in software, either. I've seen some software for Windows CE that has A few transfer protocols, but that's about it, still no logging. They even expect you to PAY for it. Yuck. The laptop is a different story though. It is full-featured when it comes to communications. Compared to the palmtop, it's a battle control center. With my current setup, I can emulate anything i would ever want to, 3270, VT-xxx (a lot of the VT's), and I can even program my own emulation rules in, if i get very bored. Logging, no problem. File transfer, no problem. Scripting is beautiful. The only problem is that the device weighs in at almost 6 lbs and on top of that, takes up a lot of space. Having close to 3 hours of battery life while online is a bonus though, even longer if you remove the power-leaching modem from the slot. I *ALWAYS* carry a spare set of batteries, for both my palmtop and the laptop, even when I'm not hacking. If you're using some electronic device (like the REALLY old laptops) that takes normal sized batteries such as AA, C, D, or 9v, you'd really be wise to get the expensive kind to use while you hack, especially if you don't know how long you'll be running your equipment. The last thing you want is a low battery warning before you have time to cover your tracks. ------------------------------------------------------------------------------ General Phreaking Equipment and Misc Stuff =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (Ones marked with * are optional, maybe overkill, yet still fun) ---------------------------------------------------------------- Backpack to cram the equipment into Ratchet or Bolt-Driver set (you can get cheap 14 pc sets at computer stores, be sure to get 7/16 and 3/8 inch sockets. They'll be the most useful) A decent pocket knife (to strip/cut wires, wire ties, etc) Screwdrivers, various sizes, flat and philips head (for taking out screws, and prying) Pliers, slip notch, and needle-nose (for pulling out stuff, limitless uses) Small penlight (for reading stuff up-close, etc) Flashlight (when you need some major light for working) Notepad and paper (to write stuff down with. Don't always rely on electronic storage when field hacking. Sometimes jotting is more convenient than typing) BeigeCord (Will tell how to make this later) Suitable phone to go along with the BeigeCord (Later, as well) Pair of cheap-ass light cotton or thin leather gloves (Fingerprints. Period.) No-DoZ (Available in small packages at convenience stores, just in case you're out later than you thought you'd be) * Battery operated camera flash (See more details later) * Acoustic coupler (for payphones or anywhere you can find phones but no jack) * Walkie-Talkies (if you've got more than one person) * Goldboxes (depending on directives to be achieved, and application * Fake Telco ID tags (These are often capable of fooling normal people, especially at 2am if they've just woken up) ------------------------------------------------------------------------------ Preparing for the event =-=-=-=-=-=-=-=-=-=-=-= Before you decide to go out hacking with your mobile platform, you need to decide where you're going to hack from. This may be a telco can out in the middle of farmer bob's field, or it might be the Fortress fone hanging off the wall of a 7-Eleven! HEH! Anyhow, once you've found out where you're going to be doing this from, you need to scope it out in both broad daylight, and in darkness as well. Get familiar with this place, as you will need to be comfortable with your surroundings. At night, let some cars drive by if at all possible. (If no cars drive by, have a friend cruise up and down the adjacant roadway or paths). You need to be able to stay out of their sight, but still be able to see them coming. ------------------------------------------------------------------------------ Keeping on your guard =-=-=-=-=-=-=-=-=-=-= You should have a backpack or other carryable bag that will allow you to store all the stuff in it, in a well-organized and easily accessible manner. I usually advise you venture out in small groups. NEVER have more than 5 people and NEVER use more than one vehicle when traveling via car/van/truck etc. At least one person should be watching out for cops, telco people, bystanders or others. Use walkie-talkies when there will be more than 20 feet between the watchmen and the people doing the phreaking/hacking. ------------------------------------------------------------------------------ Hacking it up! =-=-=-=-=-=-=-= As far as hacking, standard procedures need to take place. You hack just like you normally would, except maybe you'll get a little chilly. The only thing you really want to do is find a phone line to use, and use it for hacking. The main purpose I've found for this is sheer anonymity. If they can't trace a call back to you, you won't be found guilty. Make sure when ripping telco cans/boxes apart, you don't leave any fingerprints. It's sometimes advisable to wear light leather or thin cloth gloves when partaking in such activities. As far as opening cans/boxes, that's why you need the sockets. Most of them are secured by 3/8 and 7/16 inch bolts. sometimes you need the screwdrivers too. You can kind of figure out what to do once inside. (More tips in the beigecord section) ------------------------------------------------------------------------------ UH-OH! We've got company! =-=-=-=-=-=-=-=-=-=-=-=-=-= When and if you encounter a person who seems to be unfriendly, you need to have a plan. In the case of stupid laymen, I'd say it's wise to try to convince them that you belong there, either you're analyzing their phone lines because service was knocked out randomly and you're trying to find which areas are affected and fix it, or something. This is where the fake telco ID tag comes in handy. Just make sure you're not showing it to an actual telco guy or someone who would know any better. Bullshitting is good. If it's a cop or telco guy, or if you just can't tell if u can fool the person or not, you need to whip out your already charged camera flash, close your eyes tight, flash it (blinding them for about 10-45 seconds), and get the hell out! One alternative that's a lot cheaper, is buying those cheap-ass flashbars (or cubes You know, for those cheesy 10-millimeter point-and-shoot cameras) at the general store or Wal-Mart, and tearing them apart CAREFULLY. remove all the bulbs and store them in something soft and non-flammable. When broken (such as thrown on the ground), they will go off like they normally would, also blinding anyone who didn't have their eyes closed). Some flash bars' bulbs don't work like this. So slam one of the bulbs onto the pavement as a test, before relying on them to be used for this purpose. ------------------------------------------------------------------------------ Making a BeigeCord =-=-=-=-=-=-=-=-=-= Around here, phreaks use beigeboxes all the time. Typicaly they use them to tap into residential phone lines and call 900 numbers to purchase online time on BBS's and sometimes for personal amusement. A beigebox is just a telephone with alligator clips instead of a modular plug. I think you know that. Well, a BeigeCord, is just what i call a telephone wire with a modular jack on one end to plug your modem or phone into, and alligators on the other, to tap into lines with. This is simple: Buy a telephone cord (between 3 and 6 feet long) and cut off one of the plugs, and wire up 2 alligator clips to the middle 2 wires. Hook your mobile platform or phone up to the modular jack, and the other end up to the line. Look for red and green pairs of wires, and hook the alligators onto the screws, or strip the insulation off of a wire and spread it far apart enough to leave unprotected wire to hook your alligator onto. Example: ================---------=================== Insulation^^^ ^^^ ^^^Insulation BARE WIRE If you still have some problems, (heck, even if you don't), I would advise you to read some other phreaking articles. Once you've done this, your computer will act just it does at home as far as communications. It's also nice to have a phone for voice communication. a cheap, one-piece phone that accepts a modular plug is all you need (some one piece fones have a hard-wired cord. bletch.) ------------------------------------------------------------------------------ Gold Boxes =-=-=-=-=-= Gold box...fun! The gold box is an electronic device that links two phone lines together. When the first line is called, it picks up the line, and gives you the dial tone for the second line, which you dial another number from. when the call is traced, it's traced to the second line your goldbox was on. You really need to find a telco box that has many lines in it, in order to use this. Try to make sure that the "first" line, is not a main line that is used for any incoming calls. What you're looking for is a telephone line that only carries outgoing phone calls, like the line used for credit card verification. Chances are, you will want to make sure your goldbox fits inside the telco box nicely. With a goldbox, you can call from home, and not have to be worried about a trace. The only drawback is that most gold-boxes I've seen will stay off-hook for a set amount of time, like 45 minutes. So if your call lasts 45 minutes it will hang up on you, but if your call lasts less than that, it will stay off-hook till the 45 minutes are up, and you can't use it till it hangs up again. Hooking up a goldbox is a lot like hooking up a beigebox, except that you have to wire two lines up, instead of one. This works best for business phone lines, because most small residential boxes only have 1 line, and even if they have 2 lines, calling one of them might wake someone up, because even though the goldbox picks up the line very quickly, the phone still rings for a short amount of time. Businesses, there will be less likely that the ringing is heard, and if it is, it will probably be by a janitor, who will dismiss it easily. (I did mention that you only gold-box at NIGHT when people are home and asleep didn't I???) This is a better model I found on the internet though. This one's cool because it hangs up shortly after you hang up (Actually when the line voltage drops on line 1...Have you ever gotten hung up on, then waited for 30 seconds, and heard that static noise drop out, hear some clicks, and then hear the fast busy signal? The dead part is what resets the goldbox) Here's the ASCII SCHEM for this beast! Photo1^^ ÚÄÄ(/\/\)ÄÄÄÄ¿ ÄÄÄÄÄÄÄÄÄÄÄ´ Ú(|<)Ä¿ bÚÁ¿Transistor1 Red Line 1 ÃÄÄÙLED1 ÃÄÄÙ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄ ³ ³ e c ³ Green Line 2 ³ LED2 Ã/\/\ÄÄÄ/\/\ÄÄÄ/\/\ÄÄÄ/\/\Ù ÀÄÄ(|<)ÄÄÙ10k 10k 1.4k 1.4k Photo2-> Ú(/\/\)¿ Trans2--> ÚÁ¿b ³ ÄÄÄÄÄÄÄÄÄÂÄÙ ÀÄÂÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Green ³ c e ³ Red Line 2 Line 2 ³ ³ À/\/\/Ù 1.4K ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ Legend (All parts can be found at radioShack Easily!) ³ ³ ³ ³ ÚÁ¿ 2N3904 Transistors Labels: b=Base c=collector e=emitter³ ³ Ù À ³ ³ /\/\ Resistor. Labels: Value in ohms noted under each symbol³ ³ ³ ³ (|<) LED. Note: Try to use high output LED's. ³ ³ ³ À (/\/\) Photocell ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ I usually put this whole chunk of equipment into one of the small or medium radio shack project cases. You'll want to make sure that your LED's are REALLY bright, and you may want to use some tape to make them touch the photo- cell. Drill 2 holes in the case, one in either side, and when assembling your goldbox, run both of the Line1 wires out one hole, and label that hole "Line1" and the line2 wires through the other hole, labeling it "Line2". You can not get the greens or reds confused here. I usually use green and red wire when creating my goldbox, so that i won't get confused, I'd advise that you did the same! Once you have the wires poking out of the holes (make sure there's at least 5 inches of wire on each so you have something to work with), put some electrical tape over the inside of the holes. If any light gets into this box, the victim's fone lines will go batty. The only light in this box that we are wanting is the light being produced by the LEDs! An optional design i heard mention of one time by a colleague of mine was using an optocoupler... you may look into that, but i've yet to see plans for such a device...feel like making 'em? If you successfully do it and do a nice write-up on it, make good skems to go along with it, go ahead and send it to us and we'll probably publish it! This design will not hang up after a given amount of time. Instead it hangs up when YOU hang up. That's good news for you. You may want to build 3 or 4 of these little guys if ya got the cash to do so. Chances are once ma bell is onto ya (that is traces it to the boxed number), you may never see this thing again. Also, if they DO see this box, they might see what phone numbers have called the other line it was hooked up to at or around the time the traced calls were made. that would point to you. that's not good. Goldboxes can be used in conjunction with payphones and an acoustic coupler. This is a safer method, because ma bell probably won't physically search the site where the gold box is for maybe 2 weeks, then they'll see what phones were calling that number at that time and date, and it's a payphone. could be ANYONE! Seriousely, and sadly enough, I must say that you should count each gold box you install as money spent to achieve a hacking directive. It's not wise to go back to the site and retrieve it, unless you have a lot of balls. I know of at least one person who went back to get the box, only to find out that pacific bell employees had found it when activating another line for the victim establishment, and called in the authorities, who were roughing it in van across the street. Luckily, only the trespassing charges held up in court but not everyone may be that lucky. Retrieving a goldbox should take as much (if not more) planning and effort as it took to plant it. Keep an eye on the area for a few days, in broad daylight, and at night. Take note of vehicle positions, people, everything, especially everything you can see from near the boxes location. How do you know what number to call to activate your gold box? Well, that's where the phone and beigecord come in. Hook up the biegecord to the phone line you are using for line1. This is the line you will be calling from your modem or phone. When you get a dialtone through your handset, dial an ANI. (All the ANI's I have are now deactivated...growl! Keep an eye on 2600 magazine, in the letters section, there's almost always some ANI numbers in there). The ANI will spout off a 10 digit number (area code and 7 digit phone number. Use your pencil and note pad now...WRITE DOWN THAT NUMBER! Go call it from another phone somewhere. You should get a dial tone VERY quickly, usually it doesn't even get through a full ring for me. Dial a local number just to see if it works, a BBS, see if you get a carrier tone, or if your best friend would be awake at this hour, call and brag...erk... no. don't brag. Bragging is the bane of hacking, to a degree. When using a payphone to hack, Redboxing is not the way to go. Most payphones i've ran into let you stay on a local call indefinitely with the initial change (25, 35 cents). You might as well pay, then dial the gold box, which is local, then dial the long distance number from there. That way you won't get an operator asking for more money halfway through your hacking. (computerized voices cause pretty good amounts of line noise!) If this method is used, you have unlimited length long distance phone call for 25 or 35 cents depending on your phone company. Your victim may not see things the same way! ------------------------------------------------------------------------------ Acoustic Couplers =-=-=-=-=-=-=-=-= An acoustic coupler is just a device that is strapped to a phone, and then plugged into your modem. It basically just makes an audio connection to the phone line that the phone is on. This is good for payphones, phones that are on digital PBX's, or any phone where the wall jack is not accessible, but an outside line is! You may be able to find an acoustic coupler in computer stores in your area (I bought mine at a CompUSA in June, 1997) and sometimes you can find old ones at garage sales, used computer stores, and other places. I have seen them in 1-800-batteries catalogs (GREAT Catalog for people with laptops and cell phones...Call 1-800-batteries (I don't know how they did it, but just dialing the first 7 numbers of "betteries" doesn't work...gotta dial tha whole thing), and ask them to be put on the catalog list. it's free! The instructions (if any) that come with the coupler are always screwed up. Here is what i always do when dialing acoustic... 1) Power up my laptop. 2) While it's booting up, I unpack the coupler from my backpack 3) I insert my PCMCIA modem into my laptop 4) I pick up the handset, and strap the acoustic coupler to it. (make sure that both the coupler's on the right direction, speaker to microphone!) And plug the RJ-11 Plug into the jack on my modem. 5) I enter my terminal program, and manually use the command ATX0. (All this does is makes sure it won't hang up if there is a faint or absent dial tone. When you dial with the phone's keypad, it won't get a dial tone and most modems would hang up unless this was done first.) 6) I Manually enter the command to lock my modem to a specific baud rate For high quality phones, I keep it at 14.4 (on a coupler compatible 33.6 modem I managed to get 26.4kbps out of it, but my modem's just 14.4) For cheap phones i use 4800 For payphones i stoop down to 1200 (To see how to do this, read your modem manual. IT's ATF for my 14.4 My 28.8 is hard to force the baud rate on) 7) I Type "ATD" into the terminal program, but DON'T hit enter 8) I press down on the hook for 5 seconds to get a new dial tone 9) I Use the keypad of the phone I'm using to do all my dialing. If you're gonna dial through a Goldbox, dial the redbox number first, wait 10 seconds or so, Dial the other number. 10)Before the carrier starts, hit enter on the computer so that it picks up, waiting for a carrier. The connection will be like any other connection. Once you've disconnected, take it apart any way you want. I pretty much take it apart differently each time. ------------------------------------------------------------------------------ This concludes the phreaking techniques to manifest hacking. Codes could have been covered but that is an area that i know very little about, and haven't personally tried to use. Remember, if nothing else, you guys in Jr. and Sr. high school could use some of this as a science project! . Happy haqn! Dumb Terminals Dumb terminals have been used with computers since the advent of mainframe computers. All that a dumb terminal is, is an input/output device that is attached to a larger, more powerful computer via a serial connection, modem, or other network connection. There have been many different kinds of terminals created since the idea first came into play. Some of the more popular ones were the Televideo Terminal, and Digital (DEC)'s VT 100, 102, and 400 terminals. You can still find these terminals in libraries, stores, colleges, and some offices. Essentially, all that these terminals contain is a CRT (Screen), a keyboard, and inside the body of the monitor, is a circuitboard, which contains some ROM chips with some hard-coded programs (This included information for some specific emulation functions, the setup program, and the standard boot-up, connection, and self-test functions), as well as a small amount of RAM (used for Input, Communication, and print buffers), but there is also an area of EEPROM. This, in conjunction with the setup program, is going to be a major part of this article. Why would you want to mess with these terminals? Well, there are many reasons why one would want to mess with them, or at least get familiar with them. At stores, you might see one of these just out in the open, and unattended. Some stores i know of (such as Comp-USA), they have the terminals on the sales floor so that sales people can look up prices, quantity in-stock, and other information about the merchandise, in case a customer has a question, or if they can't find what the customer wants (which happens so often that you stand a better chance of finding it yourself). Now, if only you knew how to use it... Well, every place has their own software, and i can not spend my time telling you the ins and outs of each individual software. I've also seen these terminals in libraries, used for electronic card catalogs. Dumb terminals are easily distinguished by either a nasty Green, amber, or white/grey screen, attached directly to a keyboard. You can find out about each terminal and what kind of software is being run once you find one of them logged in. You need to find the set-up hotkey sequence. Some of the DEC terminals just use F3. (if there's an F-key or other non-alpha-numeric key that seems to have been torn off, there's a good chance that's the one you're looking for. This was the case in a blockbuster video i was at a few weeks ago, where they had a terminal up and running for Blockbuster patrons to look up rental availability, new releases, up-and coming rental release dates, etc). On Televideo Terminals, There's always (or at least I've always seen) a key close to the upper right hand corner of the keyboard, kind of where the F-keys are, and it's labeled: Set Up ----------- I can't remember what the option on the bottom of the key is, but you just have to hit the Shift Key, and that key at the same time. The Set-Up Menus ---------------- These vary drastically from one terminal to the next. You're almost always guaranteed to find out more about the software that the establishment you're messing with is using, just by looking at the programmed macros. If you're feeling evil, write the settings down, and change them on that terminal. You can usually change some normal system settings, such as Reverse Video mode, Connection Speed, printing (if there's a printer), and in some cases, you can access a log of keystrokes (hee hee!). A very few terminals allow the user to define their own custom emulation settings, allowing an advanced, and properly informed user to set a Televideo terminal to handle VT, 3270, Prism, and many others. Dumb terminals are great if you just want to hit some dial-up unix shell accounts or get on bulletin boards. You can usually hook a modem up directly to it and go to town. This works best with VT series terminals, because the VT-100 + emulation settings are very similar to the ANSI codes that many BBSes use. If you don't have a VT terminal, most unix systems allow the user to define the terminal type, and it will slip into that emulation mode. This article doesn't really cover many specifics, other than to point out that these pieces of equipment which have been labeled completely obsolete, still have value and function, and not only to the hacker. I wish it was possible for me to show exactly how to get into setup (and what you can do once you're in there) on as many different models as possible, but I can't, simply because it's different for each brand, and between models. Sometimes it's just fun to hack around trying to find the cool little "secret" menus. HiR NeWZ! Mirror Sites: As you may have read in the first file (intro/ToC) to this issue of HiR, We're now working in conjunction with the people at TwistedinterneT services (www.twistedinternet.com), a site that impressed the hell out of Axon while he net surfed one day. HiR can be found in the library, under the magazines, on their web site. Make sure to check out their files too (especially some of the unix and phreaking stuph!) As far as the spread of information is concerned, I haven't seen this much stuff in one place at the same time since the death of silicon toad's page (if it's still around, mail us the URL!!! We miss that place too!). Proof that there is still a glimmer of hope for the freedom of information! The Man in Black/Rosencrantz has also provided a mirror for the southwestern region of the united states (Physical server location is socorro, New mexico). This is a full mirror site of the official HiR page, and contains nearly the exact same content. What's with the ASCII!!?? This issue has been deemed the "Special ASCII Edition" of HiR. All of the article titles are ascii-ized, and some of the other parts have been created in that wonderful high-bit character set. If you're trying to view this in netscape, MSIE, wordpad, notepad, or anything else graphical, it probably will look like crap, and that's because your veiwer sucks! Use a real text viewer like vi or something...hell, use EDIT in dos, or pico (shudder) under unix. If you really knew what you were doing, you'd be using lynx as your browser, and you could read ALL this stuff online, isn't that nice?! As usual, we need writers. While we won't nessecarily take everything that comes our way, I'm sure that there are plenty of hackers out there willing to share their knowledge with others. If you're into (or used to be into) the H/P scene, and consider yourself a decent writer, then by all means send some of your work to H_i_R@Hotmail.com, with your article submission attached. The more info, the better! Recently, while digging around in dumpsters, Axon and his friend Frogman ran across this book that blows the motorola bible out of the water. It was a training book used for an employee education seminar. Held within its 300+ pages is such a wealth of information, from programming instructions for each motorola phone, to troubleshooting tips, a frequency / channel table for both AMPS and N-AMPS, and ever so much more than that. Over the next few issues, you can expect to find quite a few articles dealing with cellular. We will attempt to unravel the mysteries that are clarified within it's pages. The original owner of the manual was even kind enough to jot down some notes in the margins that provide even more detail. We'll keep you posted. This pretty much concludes HiR 4. Keep your eyes peeled on our sites for new and exciting things happening, as well as an update on how the newest HiR is coming along. Tentative release date for HiR 5 is May 1, 1998.