?%%%%;;;;;:;:;:;:;:;: ±±±±± {[ K - 1 i n e ^4^ ]} ±±±±± :;:;:;:;:;:;;;;;%%%%? _i love you_ -- Volume 2: The Heroin Edition Fundamentalism (of any kind) troubles me. The world is too big and too intricate to conform to our ideas of what it should be like. In my experience I've found that most fundamentalists aren't so much attached to their professed ideologies as they are to the way in which these ideologies try to make sense of a confusing world. But the world is confusing, and just because we invent myths and theories to explain away the chaos we're still going to live in a world that's older and more complicated than we'll ever understand. So many religious and political and scientific and social systems fail in that they try to impose a rigid structure onto what is an inherently ambiguous world. I'm not suggesting that we stop trying to understand the world can be fun and, at times, helpful. But if we base our belief on systems on the humble assumption that the complexities of the world are ontologically beyond our understanding, then maybe our belief systems will make more sense and end up causing less suffering. ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± ± "I hate it when people say 'I've got a tune that'll be right up your street', and it'll be a big beat version of the Mastermind theme." - Damian Harris, Skint Records ~-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'-~ ^: # Table of Contents # [] :^ ~-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{-{}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-}-~ ____________________________________________________________________________ ^; | Now a word from our sponsor! -- KICKZ0RS (r) | ;^ :-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`: ^; | Now a word from the Editor -- The Clone | ;^ :-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`: ^; | 'Jawa The Felcher' -- Anonymous | ;^ :-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`: ^; | iSEC Australia 2000 -- iSEC | ;^ :-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`: ^; | INWATS: 611-7XXX suffix skan -- The Clone | : :-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`: ^; |The SS7 Signaling Connection Control Part Relay System -- The Clone |;^ :-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`-`: ^; | ADVERTISEMENT; SecurityNews.ORG | ;^ ;^^.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,^^; ____________________________________________________________________________ t r a n s m i s s i o n l o o p e d . . . =-=- == -= - . -= = =- -= - = ., . , -=-=-=-=- =- -= -= =- = = -= = , . =- == - , , ;. --{[{{}}{[infinity refresh]}{{}}]}-- , , ;. - == - - = - -= = - .,. ,. -= =- = = - .,. , - , ,. , =- -= - -= , , . . . ., =- -= = .=, , , ., , ., , a t r i p o m a t i c sound f r o m f o r e i g n a t h m o s p h e r e a n d a g r i n n i n g c a t w a s h e r e 'Now a word from our sponsor!' ;@n3b _____________ _-_______-___ * WHAT'S THE NASTIEST, MOST EVIL, HORRIFYING, KICKZ0RS (r) PSYCHOLOGICALLY DAMAGING TRICK YOU CAN IMAGINE? WE /KICK ASS What's the most distressing stunt you could possibly pull? _-_______-___ A joke that would make Lucifer, the Prince of Darkness _____________ himself, wince? * Why, it's to MAKE YOUR LOVED ONE BELIEVE THEY'VE WON THE LOTTERY, when they haven't! Doesn't that sound like fun? * TO BRING YOUR PARTNER TO THE VERGE OF A NERVOUS BREAK DOWN JUST FOLLOW THIS SIMPLE GUIDE: STICK IT UP YOUR JACKPOT! Billed As One of The Cruelest Scams of ALL Time! THE NATIONAL LOTTERY Wind-Up! /KICK ASS - INSTRUCTIONS: 1. Secretly video the NATIONAL LOTTERY SHOW one Saturday. 2. The next day buy a ticket with the same winning numbers. 3. The following Saturday, settle in with your poor innocent partner to watch the draw. 4. Create a diversion and PRESS PLAY on the video. 5. As the moment of the draw approaches, ask your partner to check the number on your ticket while you go to the loo. 6. Hide behind the door and secretly watch your partner's face as, one by one, ALL THE WINNING NUMBERS seem to come up. 7. Return to find your partner jumping up and down as they imagine wealth beyond their wildest dreams. 8. P A U S E the video... 9. WITNESS THE VIOLENT, DERANGED BEHAVIOUR of someone who has had their dreams built up only to be cruelly dashed on the rocks of reality. LUCKY FOR THEM, THEY DIDN'T WIN! NOW THEY WON'T... [X] Be plagued with begging letters from distant relatives. [X] Sink into booze and drugs hell, once they've blown the lot. [X] Have to live in a disgustingly vulgar mansion in Esher. [X] Appear in tabloid "How the Lottery Ruined My Life" stories. [X] Engage in a fruitless mission to revive the fortunes of an ailing third division football club, and purchase over-priced Brazilian stars. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - BLOW THEIR MINDS - GUARANTEED While we're on the subject of L O N G S H O T S THE CHANCES OF: [] Swimming in a urine-free public pool - 950,322: 1 [] Meeting a Rugby player who doesn't fiddle with his goalies - 1,320,004,675: 1 [] Meeting perfume counter-girl with convincing fake tan 256,001,003: 1 [] Nude trampolining being accepted as an Olympic sport - 800,000,000,000,000: 1 [] Hiring a responsible builder who is punctual with his work and cleans up after himself - No chance #00.005/15/LOTTERY LEGAL SCHMEGAL: When we showed this ad to our crack legal department, they were aghast, one lawyer even fainted. They imagined assaults, attacks, murders and divorces resulting from people being exposed to this ad. They imagined themselves in court, permanently, defending against endless "KICKZ0RS made me do it" -themed lawsuits and claims. Weeping, quietly, from under a desk, we heard them whimper a plea to inform you that the above material is for entertainment purposes only and is not intended to be acted upon. KICKZ0RS accepts no responsibility for the consequences of any actions taken based on the above. (No matter how funny it is) __ KICKZ0RS (r) isn't really a registered Trademark of Nettwerked, 2000. __ ____________________________________________________________________________ 'Now a word from the Editor' Ah yes... another FINE issue of K-1ine, indeed! And what better way to release this issue, then RIGHT slap in the middle of May. Are you excited? Was waiting a whole month for another issue of K-1ine too much to handle? Off your rocker? Go crazy?!!?!?? I don't blame you. If you don't remember, K-1ine has now been around for over one year... and is already on the second volume. Pretty snazzy, eh? So please, sit back and relax, and prepare yourself for 'K-1ine 4 - Volume 2: The Heroin Edition'. Regards, The Clone http://nettwerk.hypermart.net - N e t t w e r k e d webmaster@nettwerk.hypermart.net - I got this account for FREE! __________________________________________________________________________________ 'Jawa The Felcher' by: Anonymous There once was a felcher named Jawa... who delighted in felchin his momma... he was loathe to disclose... how he injured his nose... but it involved a straw and iguana! -- _________________________________________________ iSEC Australia 2000 - July 4-6, 2000, Melbourne Convention Centre, Melbourne, Australia. The main IT security conference in Australia. Visit: http://www.isec-worldwide.com __________________________________________________ 'INWATS: 611-7XXX suffix skan' - - By: The Clone Date: Tuesday May 2, 2000 - - Type: INWATS suffix scan (manual) Numbers skanned: 500 NPA: 780 - - 1-800-611-7XXX -------------- 611-70XX -------- 611-7000 - Karrib Customer Service 611-7001 - "Debbie" 611-7002 - "Phillip" 611-7003 - Not In Service 611-7004 - "Angie" 611-7005 - "Joe" 611-7006 - "Hersh" 611-7007 - Not In Service 611-7008 - Some Office 611-7009 - "Issac" 611-7010 - Calling Area 611-7011 - Alergy Asthma Information Association 611-7012 - Disconnected 611-7013 - Not In Service 611-7014 - Beeping In a Loop 611-7015 - Busy 611-7016 - Not In Service 611-7017 - Call Cannot Be Completed 611-7018 - Calling Area 611-7019 - Not In Service 611-7020 - Not In Service 611-7021 - James Herten's Message Service 611-7022 - Not In Service 611-7023 - Jack Devon; Care Givers Database Report Line 611-7024 - Not In Service 611-7025 - Not In Service 611-7026 - Disconnected 611-7027 - Not In Service 611-7028 - Calling Area 611-7029 - Not In Service 611-7030 - Calling Area 611-7031 - Jerry Decoray's Message Service 611-7032 - Not In Service 611-7033 - Modem Carrier 611-7034 - Not In Service 611-7035 - Calling Area 611-7036 - Not In Service 611-7037 - Calling Area 611-7038 - Not In Service 611-7039 - Not In Service 611-7040 - Not In Service 611-7041 - Call Cannot Be Completed 611-7042 - Not In Service 611-7043 - Not In Service 611-7044 - Glaymen Placement Services 611-7045 - Not In Service 611-7046 - Not In Service 611-7047 - Calling Area 611-7048 - Calling Area 611-7049 - Not In Service 611-7050 - Fax 611-7051 - Safe-S Message Service 611-7052 - Not In Service 611-7053 - Total Travel and Tickets 611-7054 - Extremely Loud Tone 611-7055 - Numeric Message System 611-7056 - "Hello?" 611-7057 - No Answer 611-7058 - FAX 611-7059 - US Airways System - Not In Service 611-7060 - Call Cannot Be Completed 611-7061 - Call Cannot Be Completed 611-7062 - Equips' Communications 611-7063 - Calvin Phillip - Free Enterprises Incorporated 611-7064 - Not In Service 611-7065 - Fallicam 611-7066 - Not In Service 611-7067 - Call Cannot Be Completed 611-7068 - Not In Service 611-7069 - Calling Area 611-7070 - Not In Service 611-7071 - Not In Service 611-7072 - Not In Service 611-7073 - Not In Service 611-7074 - Some French Lady 611-7075 - Predential Security 611-7076 - Calling Area 611-7077 - Modem Carrier 611-7078 - "Hello?" 611-7079 - Adices 611-7080 - Adices 611-7081 - Adices 611-7082 - Adices 611-7083 - Adices 611-7084 - Adices 611-7085 - Adices 611-7086 - Adices 611-7087 - Adices 611-7088 - Adices 611-7089 - Adices 611-7090 - Adices (by this point they got really pissed off at me) 611-7091 - Call Cannot Be Completed 611-7092 - Hang Up 611-7093 - Not In Service 611-7094 - Not In Service 611-7095 - Call Cannot Be Completed 611-7096 - Cellular Number Not In Service - Message 1T22 611-7097 - 0403 - Invalid Location 611-7098 - Not In Service 611-7099 - Not In Service 611-71XX -------- 611-7100 - Not In Service 611-7101 - Not In Service 611-7102 - Calling Area 611-7103 - Calling Area 611-7104 - Calling Area 611-7105 - Calling Area 611-7106 - Not In Service 611-7107 - Bis-Cycle/Sports Order Dept. 611-7108 - Not In Service 611-7109 - Not In Service 611-7110 - Busy 611-7111 - Not In Service 611-7112 - Not In Service 611-7113 - Not In Service 611-7114 - Call Did Not Go Through 611-7115 - No Answer 611-7116 - Not In Service 611-7117 - Not In Service 611-7118 - Reddel's Voice-mail Box 611-7119 - Lisa's Voice-mail Box 611-7120 - Calling Area 611-7121 - Not In Service 611-7122 - Call Cannot Be Completed 611-7123 - Operator Services 611-7124 - Not In Service 611-7125 - Calling Area 611-7126 - Calling Area 611-7127 - Not In Service 611-7128 - Not In Service 611-7129 - Busy 611-7130 - Personal Identification Number (PIN) 611-7131 - Call Cannot Be Completed 611-7132 - Dental-plan Office 611-7133 - Calling Area 611-7134 - Call Cannot Be Completed 611-7135 - Calling Area 611-7136 - Calling Area 611-7137 - Not In Service 611-7138 - Not In Service 611-7139 - Not In Service 611-7140 - Mainstream Associates 611-7141 - Calling Area 611-7142 - Not In Service 611-7143 - Not In Service 611-7144 - Calling Area 611-7145 - Calling Area 611-7146 - Not In Service 611-7147 - Call Cannot Be Completed 611-7148 - Not In Service 611-7149 - Catherine Brooks (Music and Arts) 611-7150 - Busy 611-7151 - Not In Service 611-7152 - Not In Service 611-7153 - Bell Atlantic's Voice Messaging Service 611-7154 - Calling Area 611-7155 - Calling Area 611-7156 - Personal Assisant 611-7157 - Call Cannot Be Completed 611-7158 - Not In Service 611-7159 - Your Conference Call 611-7160 - Not In Service 611-7161 - Not In Service 611-7162 - Not In Service 611-7163 - Call Cannot Be Completed 611-7164 - Busy 611-7165 - Calling Area 611-7166 - Busy 611-7167 - Busy 611-7168 - Busy 611-7169 - Busy 611-7170 - Busy 611-7171 - Not In Service 611-7172 - Busy 611-7173 - Busy 611-7174 - Busy 611-7175 - Busy 611-7176 - Busy 611-7177 - "Hello?" 611-7178 - Not In Service 611-7179 - Not In Service 611-7180 - Elm Street Records Voice Mail System 611-7181 - Not In Service 611-7182 - Not In Service 611-7183 - Not In Service 611-7184 - Business by Promotion 611-7185 - Conference Call Centre 611-7186 - Calling Area 611-7187 - Call Cannot Be Completed 611-7188 - Not In Service 611-7189 - Not In Service 611-7190 - No Answer 611-7191 - Voice Messaging 611-7192 - Calling Area 611-7193 - Calling Area 611-7194 - Calling Area 611-7195 - Calling Area 611-7196 - Calling Area 611-7197 - Calling Area 611-7198 - Calling Area 611-7199 - No Answer 611-72XX -------- 611-7200 - Calling Area 611-7201 - Conference Call 611-7202 - Not Working Number at Shareholder Communications 611-7203 - Not In Service 611-7204 - No Answer 611-7205 - Calling Area 611-7206 - Leaseway Pension Administration 611-7207 - Calling Area 611-7208 - Calling Area 611-7209 - Synthetic Industries 611-7210 - Calling Area 611-7211 - Not In Service 611-7212 - Call Cannot Be Completed 611-7213 - Disconnected 611-7214 - Disconnected 611-7215 - Call Cannot Be Completed 611-7216 - American Institute of Chemists 611-7217 - American Express (Spanish) 611-7218 - Not In Service 611-7219 - Number is Not Correct 611-7220 - Not In Service 611-7221 - Calling Area 611-7222 - 'Yes' Capital Funding 611-7223 - Not In Service 611-7224 - No Answer 611-7225 - Calling Area 611-7226 - Not In Service 611-7227 - FAX 611-7228 - Not Working Number at Shareholder Communications 611-7229 - Pitchfloor Painting 611-7230 - Not In Service 611-7231 - Not In Service 611-7232 - Calling Area 611-7233 - Not In Service 611-7234 - Calling Area 611-7235 - Calling Area 611-7236 - Not In Service 611-7237 - Not In Service 611-7238 - "Four Digit Study Code", "Two Digit Centre Number" 611-7239 - Not In Service 611-7240 - Calling Area 611-7241 - Call Cannot Be Completed 611-7242 - Electronic Systems 611-7243 - Not In Service 611-7244 - Not In Service 611-7245 - Modem Carrier 611-7246 - Not In Service 611-7247 - Busy 611-7248 - Not In Service 611-7249 - Shela Hyne's Answering Machine 611-7250 - Conference Recall Recording Program 611-7251 - Call Cannot Be Completed 611-7252 - Not In Service 611-7253 - Calling Area 611-7254 - Not In Service 611-7255 - Not In Service 611-7256 - Not In Service 611-7257 - Not In Service 611-7258 - Call Cannot Be Completed 611-7259 - Call Cannot Be Completed 611-7260 - Modem Carrier 611-7261 - Wonwash Message Service 611-7262 - Calling Area 611-7263 - "Hello?" 611-7264 - Call Cannot Be Completed 611-7265 - Calling Area 611-7266 - Answering Machine 611-7267 - Not In Service 611-7268 - Not In Service 611-7269 - Not In Service 611-7270 - Calling Area 611-7271 - Ron Webber and Associates 611-7272 - Not In Service 611-7273 - Not In Service 611-7274 - Not In Service 611-7275 - Not In Service 611-7276 - Busy 611-7277 - Pasency Wall and Grant 611-7278 - Bluebunny - NASCAR Promotion 611-7279 - Country Wide Home Loans [www.countrywide.com] 611-7280 - "Please Hang Up and Try Your Call Again!" X 2 611-7281 - Call Cannot Be Completed 611-7282 - Not In Service 611-7283 - "Hello?" 611-7284 - Not In Service 611-7285 - No Answer 611-7286 - Not In Service 611-7287 - Sam Manny 611-7288 - Bank of America 611-7289 - Not In Service 611-7290 - Not In Service 611-7291 - Call Cannot Be Completed 611-7292 - Not In Service 611-7293 - Not In Service 611-7294 - Not In Service 611-7295 - No Answer 611-7296 - Bellingham Division of Social and Health Services 611-7297 - "Two Hundred Fifty" 611-7298 - Call Cannot Be Completed 611-7299 - Pottingham Home Office 611-73XX -------- 611-7300 - Not In Service 611-7301 - Call Cannot Be Completed 611-7302 - Not In Service 611-7303 - Not In Service 611-7304 - Not In Service 611-7305 - Not In Service 611-7306 - Not In Service 611-7307 - Trina (Help Desk) 611-7308 - Not In Service 611-7309 - Automedies Prompt Recorder 611-7310 - Busy 611-7311 - Call Cannot Be Completed 611-7312 - Not In Service 611-7313 - Busy 611-7314 - Busy 611-7315 - Not In Service 611-7316 - Olympic Autoglass (! Gateway Vulnerability !) 611-7317 - Queeneven Pump Company 611-7318 - Not In Service 611-7319 - Not In Service 611-7320 - Beep Beep Beep 611-7321 - Call Cannot Be Completed 611-7322 - Calling Area 611-7323 - Not In Service 611-7324 - Intercall 611-7325 - Not In Service 611-7326 - PLC Reconciliation Team 611-7327 - Brent @ Free Flight Cargo Services 611-7328 - Calling Area 611-7329 - Calling Area 611-7330 - Beep Beep Beep 611-7331 - Call Cannot Be Completed 611-7332 - Beep Beep Beep 611-7333 - Call Cannot Be Completed 611-7334 - Beep Beep Beep 611-7335 - No Answer 611-7336 - Call Cannot Be Completed 611-7337 - Not In Service 611-7338 - Busy 611-7339 - Beep Beep Beep 611-7340 - Beep Beep Beep 611-7341 - Call Cannot Be Completed 611-7342 - Not In Service 611-7343 - San Diego Gas and Electric 611-7344 - Call Cannot Be Completed 611-7345 - Law office of Mary Tyler Moore 611-7346 - IBM 611-7347 - "Hello?" 611-7348 - Disconnected / Not In Service 611-7349 - IBM 611-7350 - Unassigned Extension at IBM 611-7351 - Call Cannot Be Completed 611-7352 - Calling Area 611-7353 - IBM 611-7354 - Disconnected / Not In Service 611-7355 - Calling Area 611-7356 - Calling Area 611-7357 - Credit Collection Agency of Southern Virginia 611-7358 - Calling Area 611-7359 - Not In Service 611-7360 - Not In Service 611-7361 - Call Cannot Be Completed 611-7362 - Semcor 800 Support Line 611-7363 - Calling Area 611-7364 - Modem Carrier 611-7365 - Not In Service 611-7366 - Not In Service 611-7367 - Not In Service 611-7368 - Not In Service 611-7369 - Calling Area 611-7370 - Triple A Collections 611-7371 - Busy 611-7372 - Not In Service 611-7373 - Not In Service 611-7374 - JCR 611-7375 - Not In Service 611-7376 - "Hello!" 611-7377 - Honeywell Data Instruments 611-7378 - Busy 611-7379 - Jen Sherman at AT&T 611-7380 - News Century Morgage 611-7381 - Conference Recall 611-7382 - Call Cannot Be Completed 611-7383 - Not In Service 611-7384 - Busy 611-7385 - Glen Davis and Associates 611-7386 - Not In Service 611-7387 - American Health 611-7388 - Not In Service 611-7389 - Not In Service 611-7390 - Calling Area 611-7391 - Beep Beep Beep 611-7392 - Not In Service 611-7392 - Not In Service 611-7394 - Not In Service 611-7395 - Not In Service 611-7396 - Not In Service 611-7397 - Not In Service 611-7398 - Not In Service 611-7399 - Not In Service 611-74XX -------- 611-7400 - Stack Builders 611-7401 - Not In Service 611-7402 - Not In Service 611-7403 - Not In Service 611-7404 - * Line Seizing Problem = Exploitable! * 611-7405 - Dave's Courier Express Incorporated 611-7406 - Hick: "Hella?" 611-7407 - G and K Services 611-7408 - Ring... *hang up* 611-7409 - Not In Service 611-7410 - Ring... *hang up* 611-7411 - Not In Service 611-7412 - Calling Area 611-7413 - Calling Area 611-7414 - Not In Service 611-7415 - Calling Area 611-7416 - Not In Service 611-7417 - "Hello?" 611-7418 - Not In Service 611-7419 - Calling Area 611-7420 - Calling Area 611-7421 - Calling Area 611-7422 - Disconnected / Not In Service 611-7423 - Not In Service 611-7424 - Disconnected 611-7425 - Number Not Correct 611-7426 - Calling Area 611-7427 - Not In Service 611-7428 - Invalid / Blocked from Area Code 611-7429 - Invalid / Blocked from Area Code 611-7430 - "Hello?" 611-7431 - Not In Service 611-7432 - No Answer 611-7433 - Not In Service 611-7434 - Calling Area 611-7435 - No Answer 611-7436 - Not In Service 611-7437 - Not In Service 611-7438 - Authorization Code System 611-7439 - Authorization Code System 611-7440 - Chris Otomo @ Bell South 611-7441 - Massons 611-7442 - Authorization Code System 611-7443 - Not In Service 611-7444 - Not In Service 611-7445 - Disconnected / Not In Service 611-7446 - Not In Service 611-7447 - Veterinary Clinic (University of Minnisota) 611-7448 - Not In Service 611-7449 - Not In Service 611-7450 - Not In Service 611-7451 - Call Did Not Go Through 611-7452 - Cannot Be Completed 611-7453 - Not In Service 611-7454 - Not In Service 611-7455 - Not In Service 611-7456 - Not In Service 611-7457 - Authorization Code System 611-7458 - Calling Area 611-7459 - Not In Service 611-7460 - Not In Service 611-7461 - Not In Service 611-7462 - Message Centre 611-7463 - Not In Service 611-7464 - Calling Area 611-7465 - Shirly Mills 611-7466 - Not In Service 611-7467 - Carlton H Agency 611-7468 - Calling Area 611-7469 - Life Boat Publishing (Audex) 611-7470 - Life Boat Publishing (Audex) 611-7471 - Not In Service 611-7472 - Not In Service 611-7473 - Calling Area 611-7474 - Calling Area 611-7475 - Calling Area 611-7476 - Adnidas Mail Box 611-7477 - Not In Service 611-7478 - Not In Service 611-7479 - Not In Service 611-7480 - Not In Service 611-7481 - Not In Service 611-7482 - Not In Service 611-7483 - Not In Service 611-7484 - Not In Service 611-7485 - Calling Area 611-7486 - Not In Service 611-7487 - Invalid Number 611-7488 - AIM International 611-7489 - Not In Service 611-7490 - LOW TONE 611-7491 - "Hello?" 611-7492 - LOW TONE 611-7493 - Bob & Sheryn 611-7494 - Busy 611-7495 - Not In Service 611-7496 - Apartment and Home Hunters 611-7497 - Conference Recall Recording Program 611-7498 - Siren * beep beep beep * 611-7499 - LOW TONE webmaster@nettwerk.hypermart.net h t t p : / / n e t t w e r k . h y p e r m a r t . n e t ___ ___ The SS7 Signaling Connection Control Part Relay System ___ ___ Friday May 12, 2000 ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ -- Research -- ++ Introduction ++ ++ Key Benefits of SCCP Relay ++ ++ Platform & Application / Security Issue ++ ++ SCCP Relay & GTT Functional Description ++ ++ SCCP Relay Software Architecture ++ ++ SCCP Relay Hardware Architecture ++ -- GSM Background Information -- + Home Location Register (HLR) + + Visitor Location Register (VLR) + + International Mobile Subscriber Identity (IMSI) + + GSM's Mobile Station Equipment (MSE) + -- GSM Call Routing -- + Mobile Subscriber Roaming + + Mobile Subscriber ISDN Number (MSISDN) Call Routing + + Implementation of a second HLR to the GSM Network + -- References -- ++ Web-site Resources ++ ++ Acronym Definitions ++ -- Wrap-up -- +* Conclusion *+ +* Contact *+ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ ^^^ Introduction -- As the number of wireless subscribers throughout Canada and the United States continues to increase dramatically each year, wireless carriers will be facing the challenges that rapid growth creates. One such challenge in this market is the migration from a single Home Location Register (HLR) to a multiple HLR topology. The HLR, which successfully stores critical identification and subscription information about each customer, can become a network bottleneck either because of the sheer number of subscribers contained in the database, or because of the number of SS7 messages arriving at the HLR. A single HLR also poses a risk to the overall survivability of the entire wireless service under the new SS7 protocol. Assembling additional HLR carriers to a wireless network presents significant and problematical challenges, however. If the existing routing algorithms are simply expanded, then every Mobile Switching Center (MSC) and Signal Transfer Point (STP) on the network is affected, and the routing table management becomes extremely complicated and highly error prone. (STPs are the packet switches of the SS7 network. They receive and route incoming signaling messages towards the proper destination and also perform specialized routing functions.) Many of the challenges in multiple HLR deployment are constantly an issue, and are constantly being worked upon. Fortunately a company by the name of MicroLegend has developed a centralized SS7 message routing system called the 'SCCP Relay.' The SCCP Relay supports all of the necessary GSM SS7 message routing tables to allow wireless carriers (specifically GSM/GPRS) to easily expand to a multiple HLR topology. Throughout this document, I will attempt to introduce a new technology within the new world of the Out-of-band signaling SS7 architecture -- it is here to stay and it has taken over the world telecommunications significantly from its older counterpart switching system known as 5ESS. Now please, sit back and relax, and prepare to enter the world of the SS7 Signaling Connection Control Part Relay System... Key Benefits of SCCP Relay -- A number of key benefits of the SCCP Relay (which deserve some mention) are: 'Reduced operations and maintenance overhead' ------------------------------------------- The routing information for each subscriber is centralized in the SCCP Relays, rather than being distributed among all of the STPs (Signal Transfer Point) and MSCs (Mobile Switching Center). This useful and practical method simplifies the process of entering and maintaining STP/MSC information, not to mention the problems involving troubleshooting of SS7 routing. 'Providing a scaleable architecture for growth' -------------------------------------------- The SCCP Relay simplifies the addition of multiple Home Location Registers (HLRs) as the network itself develops. Much work has been done in this sector of SCCP development, and will continue to innovate the telecommunications industry. 'Improved overall network reliability' ------------------------------------ The SCCP Relay supports the automatic routing of SS7 messages to a backup Home Location Register (HLR) in the event of a Primary HLR failure. This unique and useful feature enables the multiple HLRs to be configured in a redundant and scaleable fashion, entering that the service itself remains available to customers even in the rare case of an HLR failure. From my knowledge of the SCCP Relay system, its up-time is approximately 99.99%. Impressive. 'Flexible connection options' --------------------------- The SCCP Relay supports all types of Signaling System 7 (SS7) links, it can operate as an STP (Signaling Transfer Point), connecting directly to mobile switching centers (MSCs), Home Location Registers (HLRs) and other end nodes. Typically, the flexible connection types of SS7's Signaling Transfer Points (STP) can be configured to the proper destination in existing incoming routing functions. 'Mated pair deployment / Auto re-routing' --------------------------------------- The SCCP Relay is deployed in a mated pair configuration, with each link being fully and 100% redundant. Each mated pair system is capable of handling the full of of network traffic (5,000,000 subscribers) with virtually no problems whatsoever. Platform & Application / Security Issue -- Since its inception in 1994, Microlegend has focused exclusively on Signaling System 7 network solutions. Microlegend's products support Intelligent Network services, resolve interworking problems, switching signaling traffic, interface SS7 and IP networks, and PROTECT network resources for telecommunications companies worldwide. Because of this, Microlegend has implemented ways which enable them to do their job quickly and reliably. Unfortunately the problem they are faced with is the issue concerning database security. For example: When Microlegend's team of engineers want to perform system diagnosis, software updating, and subscriber databasing with "maximum efficiency", they simply use a dial-up connection. This dial-up connection (located in Ottawa Ontario) requires absolutely no login or password at all - just the telephone number, and the optimal performing Unix Operating System known as 'VxWorks'. What is at stake: - Microlegend faces being compromised by hackers/phreakers and malicious persons. These persons could take advantage of this security flaw and steal potentially sensitive company information. - The telecommunications infrastructure which supports well over 5,000,000 (five million) subscribers throughout Canada and the United States. - Loss of revenue in the Billions due to time spent security auditing. What can be done: Instead of Microlegend compromising security for obscurity by using a dial-up account to perform their system diagnosis, software updating, and subscriber databasing, they should use their 10BaseT Ethernet LAN with an SSH connection to perform the necessary tasks. SCCP Relay & GTT Functional Description -- A detailed understand of the SCCP Relay product requires quite a bit of grounding in the works of GSM networks. For convenience, I will explain the brief key concepts of GSM network operation in relation to SCCP Relay and GTT functioning. The SCCP Relay provides a "central point" for GTT provisioning and execution on behalf of the entire GSM carrier's SS7 network. The SCCP Relay performs GTT capabilities for both the IMSI (123049210) and MSISDN (Mobile Subscriber Integrated Services Digital Network) Adress types, eliminating the need to continually manage the routing tables within STPs (Signaling Transfer Point) or MSCs (Mobile Switching Center). ASCII Diagram _______ ------------- / --- ( ( | ) ) - MSC / /-- ------- / / SCCP Relay STP/MSC / / \ / / / ___ ___ / / | | | |__/ / | | ---- | |\ / | | | | \ / --- \ / --- \ \ \/ | /\ \ ___ /\ | / \ \ (___) - HLR / \ |/ \ --- | | ___ / \ ___ \ /--(___) | | | | __/ | | ---- | | / \ | | | |-/ \ --- --- \ \--;__ __ \ ------- | || | - Gateway STP / \ -- -- SCCP Relay STP/MSC [[ The SCCP Relay is deployed as a redundant pair of signaling nodes that can be accessed via SS7 links connected to currently deployed STPs or can be utilized as the STPs themselves. Where STPs previously have been deployed, the SCCP messages are routed to the Relay (partial GTT) by the STP/MSC. The SCCP Relay then performs system translation (either full or partial, depending on the provisioned data), and routes the message back to the network to be automatically forwarded to the destination HLR. The SCCP Relay can also perform the MTP routing, which is the main function of the STPs. This incredible capability enables the SCCP Relay to be deployed in networks without STPs. See the ASCII Diagram Above. ]] SCCP Relay Software Architecture -- The SCCP Relay System is a solution based upon the 'Versatile Signaling Point' (VSP). || [look for a guide pertaining to VSP on Nettwerked soon: http://nettwerk.hypermart.net] || At the "heart" of the SCCP Relay is the object oriented SS7 stack that provides all the basic capabilities of a Signaling Transfer Point (STP) without compromising speed or security (well, maybe not security... but I'll look into it). The VSP SS7 Stack includes MTP and SCCP layer functionality with a configurable GTT application, along with user interface, functioning log files (intruders beware!), and several SCSI Disk Processes. The GTT process supports both IMSI and MSISDN numbering formats, and as a group, these processes are referred to as the SS7 Message Handler Unit (MHU). Basically what the SS7 MHU does is simple: it terminates the SS7 links, performs the GTT on incoming SS7 messages, and then re-routes the messages back onto the SS7 network. To optimize its performance, the MHU runs on that real-time UNIX operating system (you guessed it) 'VxWorks'. The SCCP Relay system with its Versatile Signaling Point platform also includes an independent Database Administration Unit (DAU), that supports the provisioning and administration of the GTT data. The DAU, which happens to run on a UNIX-based Operating system (gotta love UNIX!) called AIX, includes a command parser, database manager, and an SCSI disk interface. The DAU and MHU communicate with each other in parallel a highly redundant 10BaseT Ethernet LAN. An Ethernet WAN is used to connect the SCCP Relays, to ensure that they remain synchronized with each other properly. In addition to the software running on the DAU and MHU, the SCCP Relay system incorporates a Graphical User Interface (GUI) program that can be installed on several of the operating stations. This user interface provides the ability to provision and view the GTT data that resides on the DAU, as well as the option to view the log information collected about GTT database transactions! The operation stations connect to the SCCP Relay through a LAN or WAN, depending on what option you choose. In addition, a custom interface to an existing provisioning system can be developed to provision and view the entire GTT database. For convenience check out the following terribly drawn ASCII diagram to get a better idea about how the SCCP Relay's DB Admin works with AIX and how the Message Handler works with VxWorks and how they all work together on the seamless 10BaseT LAN/WAN. ASCII Diagram ------------- | - - - - - [#] ~ Console 10 BaseT ~ | | - Serial Cable SCCP Relay | ..____________________________________________ | . / DB Admin Unit \ | | |---| | | | | (Command Parser)--------------------|---|- (@@) | \ \ | Customer | | \ \ | Defined Admin | \ \ | Interface | | (SCSI Control)--------(DB Manager) | | | | / \ | | | / \_ _ _ _ _ _ _|_ _($#) | / | Ops Station | | AIX / | | |==============================================| | | SS7 Msg Handler | | | (GTT Application)________ | | | | | \ | | | (SCSI Control)----------(Log Server) | | | | | | | | ------ | | | | (MTP UI) | | __________|_________| | | | | | (( SS7 [SCCP Layer] |)) | | | | (( Stack _/ )) | | | | | (( [MTP Layer]___))__| | | \____(#!) | (( |||| |____))________| | |--Mate | +__________||||_________+ | SR System | |||| | | | |||| | | VxWorks |||| | | \______________||||___________________________| SS7 Links | SCCP Relay Hardware Architecture -- The VSP platform, on which the SCCP Relay runs, is available in a verity of configurations and sizes. The VSP scales smoothly from an economical system with only four SS7 links to a fully loaded system with over 75 SS7 links. The basic structure of the hardware components of the SCCP Relay, regardless of the size and configuration, are exactly the same. The only real differences between small systems and large systems are the number of cards, and the size of the chassis itself. The MHU is controlled by a System Controller card based on a 200 MHz PowerPC(tm) processor. This processor controls the system level functions, including the TCP/IP port, the serial ports, and the SCSI interface for the disk drive. It also provides control for two Link Interface (LI) cards, with up to four SS7 links on each. As these Link Interface cards are added, every third card is a Link controller card, with its own 300 MHz PowerPC(tm) processor. This distributed processor architecture ensures that the SCCP Relay has sufficient power to handle very large numbers of subscribers (over 5,000,000 [Five Million]). Each Link Interface card can support as many as four (4) SS7 Links. The V.35 cards provide four SS7 ports, while the E1 and T1 versions provide two SS7 ports each. The DAU runs in its own independent chassis, with its own independent fan, SCSI disk and power supply. It uses the same System Controller card as the MHU, without the need for the use of any Link Interface or Link Controller cards. ASCII Diagram ------------- Database Administration Unit _________________________________________________________ | | | | 10BaseT | | _______| [Disk (AIX)] | DC Supply | {{Fan}} [*Power Supply*] ____|__ | | | | Serial | {{{Processor - System Controller}}} | (Console) | | _______| | |_________________________________________________________| | | | Processor - System Controller: 1, 1 | 10BaseT | Link Interface Card (4 SS7 links): 2, 2 | | Link Interface Card (4 SS7 links): 3, 3 | | _ _ _ _ _ _ | ______| |1| |2| |3| |1| |2| |3| | | | | | | | | | | | | | | -- | | | | | | | | | | | | | -- E1/T1/V.35 Serial | | | | | | | | | | | | | -- (Console) | | | | | | | | | | | | | -- _______| | | | | | | | | | | | | -- | | | | | | | | | | | | | -- | [Disk] | | | | | | | | | | | | -- Serial | [VxWorks] | | | | | | | | | | | | | (Logs) | | | | | | | | | | | | | | _______| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |_| |_| |_| |_| |_| |_| | | | | [-~-----------------FAN-----------------~-] | | [*Power Supply*] [*Power Supply*] | | (DC Supply) (DC Supply) | |_________________________________________________________| SS7 Message Handling Unit GSM Background Information -- (Acronym Definitions in paragraph form) 'Home Location Register (HLR)' A Home Location Register (HLR) is a database that contains semipermanent mobile subscriber information for a wireless carriers' entire subscriber base. HLR subscriber information includes the International Mobile Subscriber Identity (IMSI), service subscription information, location information (the identity of the currently serving Visitor Register (VLR) to enable the routing of mobile-terminated calls), service restrictions and supplementary services information. What the HLR basically does is it handles SS7 transactions with both Mobile Switching Centers (MSCs) and of course VLR nodes, which either request information from the HLR or update the information contained within the HLR. The HLR also initiates transactions with VLRs to complete incoming calls and to update subscriber data. Traditional wireless network design (anything before 1996) is based on the utilization of a single Home Location Register (HLR) for each wireless network, but growth considerations are prompting carrier administrators to consider multiple HLR databases. So what does that mean? It means our Telecommunications Industry is under pressure to develop larger and faster networks in order to satisfy the needs of residential and business customers. 'Visitor Location Register (VLR)' A Visitor Location Register (VLR) is a database which contains temporary information concerning the mobile customers (subscribers) that are currently located in a given MSC (Mobile Switching Centre) serving area, but whose Home Location Register (HLR) is elsewhere (out of range). When a mobile subscriber roams away from his/her home location and into a remote location (ie. digital to analog), SS7 messages are used to obtain information about the subscriber from the HLR, and essentially create a temporary record for the subscriber in the VLR which usually only has one per Mobile Switching Centre. 'International Mobile Subscriber Identity (IMSI) Number' "What the hell is IMSI?" - IMSI is a unique non-dialable number allocated to each mobile subscriber in the GSM system that identifies the subscriber and his or her subscription within the GSM network. Make sense yet? The IMSI resides in the Subscriber Identity Module (SIM), which is transportable across Mobile Station Equipment (MSE) (look for IMSI being supported by the GPRS standard soon!) The IMSI is made up of three important parts: #1: The Mobile Country Code (MCC) #2. The Mobile Network Code (MNC) (they consist of 2 digits) #3. The Mobile Subscriber Identity Number (MSIN) (they consist of 10 digits) 'Mobile Subscriber ISDN (MSISDN) Number' The MSISDN is the dialable number that subscribers use to reach another mobile subscriber. Some of the newer phones (ie. newer GSM supported Motorola, Nokia's) in Canada and the U.S. support the up-to-date multiple MSISDNs which are now in affect. 'Mobile Station Equipment (MSE) Subscription Services' GSM carriers typically order Mobile Station Equipment (MSE) (or GSM phones) from their suppliers (Nokia, Motorola, Sony, etc.) in large quantities (e.g. 1000 Units). After receiving an order, the equipment supplier will program the ordered MSE SIMs with a range of IMSI numbers. GSM Call Routing -- 'Mobile Subscriber Roaming' When a mobile subscriber roams into a new location area, the VLR automatically determines that it must update the HLR with the new location information, which it does using an SS7 Location Update Request Message (LURM). The Location Update Message is then routed to the HLR through the SS7 network, based on the global title translation of the IMSI that is stored within the SCCP Called Party Address portion of the message. The HLR responds with a message that information's the VLR whether the subscriber should be provided services in the new location. 'Mobile Subscriber ISDN Number (MSISDN) Call Routing' When a user dials a GSM mobile subscriber's MSISDN, the PSTN routes the call to the Home MSC based on the dialed telephone number. The MSC must then query the HLR based on the MSISDN identification, to acquire routing information required to route the call to the subscribers' current location. The MSC stores sensitive global title translation tables that are used to determine the HLR associated with the MSISDN. When only one HLR exists, the translation tables are trivial. When more than one HLR is used however, the translations become extremely challenging, with one translation record per subscriber (see the useful example below). Havin determined the appropriate HLR address, the MSC sends a Routing Information Request (RIR) to it. Example: -------- When the HLR receives the Routing Information Request, it "maps" the MSISDN to the IMSI, and ascertains the subscribers' personal profile including the current VLR at which the subscriber is registered. The HLR then queries the VLR for a Mobile Station Roaming Number (MSRN). The MSRN is essentially an ISDN telephone number which the mobile subscriber can be reached at. The MSRN is a temporary number that is valid ONLY for the duration of a single call. The HLR generates a response message, which includes the MSRN, and sends it back across the SS7 network to the MSC. Finally, the MSC attempts to complete the call using the MSRN provided. 'Implementation of a second HLR to the GSM Network' As a GSM wireless carrier's subscriber base grows, it will eventually become necessary to add a second HLR to their network (obviously). This requirement might be prompted by a Service Subscription Record Storage Capacity Issue (SSRSCI) or perhaps an SS7 Message Processing Performance Issue (MPPI). It might possibly be prompted by a need to increase the overall network reliability. The new HLR can be populated with service subscription records as new subscribers are brought into service or existing service subscription records can be ported from the old HLR to the new HLR to more evenly distribute the growing SS7 traffic load. Usually, when new subscribers are brought into service, the second HLR will be populated with blocks of IMSI numbers that are allocated when new MSE equipment is ordered. Much more complicated SS7 message routing Global Title Translations are required for Routing Information Request transactions between the MSCs distributed over the entire wireless carrier serving area and the two or more HLRs. MSC Routing Information Requests are routed to the appropriate HLR based on the dialed MSISDN and not the IMSI. Unlike the IMSI numbers, the MSISDN numbers can not easily be arranged in groups to reside within a single HLR and therefore, the MSC must contain an MSISDN to HLR address association record for every mobile subscriber homed on each of the MSCs. References -- 'Web-site Resources' Frame Relay http://cctpwww.cityu.edu.hk/network/l2_framerelay.htm Frame Relay Forum http://www.frforum.com/ HN Networks http://www.hn-networks.co.uk/index.html MicroLegend SS7 Tutorial http://www.microlegend.com/whatss7.shtml Telecom Testing Support for GSM, SS7, GPRS, CDMA, Broadband http://www.radcom-inc.com/tstsolut/telecom.htm -- This is seriously the best information I could find. What ever happened to the days where you'd punch in a phrase or word, and actually find decent documents on personal and/or educational web-sites? Now all I run into are these God damn commercial .com's sites who just want to sell their shitty hardware/software... who just want to make a BUCK. Well never worry about me selling out to "the man", because all my information is going to stay completely FREE! =) 'Acronym Definitions' I compiled most of these myself... the rest are stolen. ACM Address Complete Message ANM Answer Message A Links Access Links BIB Backward Indicator Bit B Links Bridge Links BSN Backward Sequence Number CDT Conversation Data Table CPA Called Party Address CPN Called/Calling Party Number DAU Database Administration Unit D Links Diagonal Links DPA Distributed Processor Architecture DPC Destination Point Code E Link Extended Link F Link Fully Associated Link FIB Forward Indicator Bit FISU Fill in Signal Unit FSN Forward Sequence Number GTT Global Title Translation HLR Home Location Register IAM Initial Address Message IRSC International Roaming Signaling Converter ISDN Integrated Services Digital Network ISUP ISDN User Part KPBS Kilobits per Second LSSU Link Status Signal Unit LURM Location Update Request Message Mf Multifrequency MHU Message Handler Unit MPPI Message Processing Performance Issue MSC Mobile Switching Center MSE Mobile Station Equipment MSIN Mobile Subscriber Identity Number MSISDN Mobile Subscriber Integrated Services Digital Network MSRN Mobile Station Roaming Number MSU Message Signal Unit MTP Message Transfer Part OMAP Operations, Maintenance and Administration Part OPC Originating Point Code PC Point Code PSTN Public Switched Telephone Network RBOC Regional Bell Operating Company REL Release Message RCL Release Complete Message RIR Routing Information Request RSP Route Set Prohibited Test Message RSR Restricted Test Message SS7 Signaling System 7 SCCP Signaling Connection Control Part SCP Signal Control Point SLS Signaling Link Selection SOI Service Order Interface SSRSCI Service Subscription Record Storage Capacity Issue SRT Screening and Rerouting Table SSP Signal Switching Point STP Signal Transfer Point SU Signal Unit TCAP Transaction Capabilities Application Part TFA Transfer Allowed Message TFP Transfer Prohibited Message TFR Transfer Restricted Message TUB Traffic Usage or Billing VPC Virtual Point Codes VSP Versatile Signaling Point Wrap-up -- 'Conclusion' This is the first of many SS7 related documents to be published for Nettwerked / Hack Canada, which of course is a good thing because there aren't enough people in the world writing about the SS7 protocol let alone home grown Canadians! Look for an introductory SS7 paper soon. 'Contact' webmaster@nettwerk.hypermart.net http://nettwerk.hypermart.net A N E T T W E R K E D P R O D U C T _______________________ Advertisement; 'Security News for Security Professionals' w w w . S e c u r i t y N e w s . o r g One of the newest computer security web-sites to hit the Internet this month, has really made an impact on the scene. Nettwerked is now an official joint advertiser for SecurityNews.org, and hopes to see more great information in the future from these guys. _______________________________________________ ../ K-1ine 5.0 'Summer 2000' to be released by August. What will K-1ine 5 have to offer? -- More Telephony Related Documentation -- Random Writings -- DEF CON 8 Review(s) -- & More! K-1ine is Copyright 1999-2000 by Nettwerked. All rights reserved.