Power Scanning II: Power Carrier Scanning (C) 1999 El Oscuro/250 Intro - What is Carrier Scanning? If you're interested in what this file has to say, you've probably seen the 1983 movie "WarGames" starring the nerdy but clueless Matthew Broderick and the lovely but clueless Ally Sheedy. So you already know what carrier scanning is, because Broderick had his 1970's-vintage Imsai 8080 doing a carrier scan in the movie. For those of you who just arrived from Mars and therefore haven't seen WarGames, a carrier scan is what happens when you program your computer to call every phone number in every telephone prefix in the city, and make a note of which numbers are answered by computers. The process is sometimes called an exchange scan, a modem scan, or even a WarGames scan. Today, there are many freeware carrier scanning programs for all platforms, and they are easy to find on the internet and on BBSes. Carrier Scanning Pitfalls As you can imagine, carrier scanning has some unpleasant side effects. For starters, you end up pranking nearly everyone in the city, including emergency services, etc. The phone companies have largely dealt with carrier scanning by putting software into their switches that detects sequential dialing from one number, e.g. 253-0001, 253-0002, 253-0003, 253-0004 etc. Some telcos will cut off your line temporarily when they detect this, others will send a security goon out to "persuade" you to stop, still others will dispense with the pleasantries, cut off your line permanently, and sick the police on your sorry ass. That's no fun. Your mileage may vary, but I can tell you for a fact that my local telco makes some pretty heavy threats on you if you sequential-scan just a few dozen numbers. Another problem with carrier scanning is that it takes a *long* time. When your scanner calls a number that has a modem on it, it has to wait up to 20 seconds to get a connection, so *every* number takes 20 seconds. That means you can only dial 3 numbers a minute, 180 numbers an hour. It would take 56 hours straight to do a whole exhange from 0000 to 9999! Do you really want to tie up your phone line for two and a half days? I wouldn't. So how does a would-be carrier scanner today deal with these seemingly huge problems? Slow Bauds Mean Fast Connects! Well, for starters, you can reduce the needed connect time to 10 or 15 seconds by simply doing your scanning with a modem set to 300 or 1200 baud. Most modemers don't realize this, because they do all their calling at 33.6k or 56k, but the slowest baud rates on the modem have the fastest handshake and connect time! Scanning at 300 baud won't even add a noticeable overhead to the dialing process - you know, the time it takes the modem to receive the "ATDT 253-7000" command or send back the "NO CARRIER" message. If you could reduce connect wait time from 20 seconds to 10 seconds, with maybe 2 seconds of overhead (modem reset, etc) between calls, suddenly you can dial 5 numbers a minute instead of 3, a 66 percent improvement in efficiency! Many Hands Make Light Work! Secondly, and I know I covered this a bit in Power Scanning I, it always helps a lot to have a few friends in on the action to help out. Get a friend scanning with you - or a second computer on a second line in your house - or multiple computers scanning through beige boxes on the telephone snake cable running through your apartment building - and that 56 hour scan gets demolished in 28 hours, or 14, or 7, or 3 and a half. I don't know why more people don't co-ordinate their efforts in scanning; I guess there are too many egos these days. Don't Dial Listed Numbers! I am about to explain a technique that simply wasn't available to Matthew Broderick's WarGames character back in 1983. This is made possible by the widespread avilability of phone directories on CD-ROM. In a traditional carrier scan, your program dials every possible number, without regard to what may be on the other end. But what if your program already knew for certain that some numbers would NOT have modems? What if it didn't call those numbers? The fact is, most modem numbers are unlisted! The ones that *are* listed, are in the phone book - you don't need a scanner to find them. But the really good ones, the ones you want to find, are all unlisted. They don't appear in your phone book, and more importantly they don't appear on your phone listings CD-ROM! Now, there are quite a few WarGames dialers that allow you to enter a list of numbers not to call. This feature is there so that you don't end up calling your family and friends during scans of their prefixes. But what if you could put every *listed* number in the prefix in that do-not-dial list? Well, what would happen is that you would eliminate 50 to 90 percent of the numbers from your scan - you would be left only with not-in-service numbers and unlisted numbers! So, run your listings CD's browser program, export the whole prefix you want to scan to a text file, delete the names and addresses so you have just a list of phone numbers. Cut and paste this into your scanner program (if you're running a Windows or Mac scanner) or import it into your scanner's config file or do-not-dial list - read your scanner's docs for how to do this, I'm not going to hold your hand THAT much. This technique has a really great bonus - by eliminating known voice numbers from your scan and by reducing overall the number of times you dial, you greatly reduce your risk of drawing unwanted attention to your project! Skip Unassigned and Cellular/Pager Blocks There's one variant on the previous technique that should also be applied to any carrier scan. Sometimes, in sparsely populated areas or in brand-new prefixes, all the phone numbers fall into a block. For example, way out in Spidercrotch, Manitoba, you might find that there are only lines assigned in the range 204-642-2000 to 204-642-4000, a 2000 number range. Or the brand-new 410 prefix in Springfield may, at this time, only have 1200 numbers assigned, from 410-1000 to 410-2200. A quick look in a reverse directory will reveal these. Consider the probabilities before you add what appears to be an unassigned block to a do-not-dial list. Is the prefix new? Is it in a heavily populated area or a rural one? If the prefix is old, and in a metropolitan area, then any big gaps you find in the listings are probably dedicated assigned blocks, full of unlisted numbers - prime scanning territory. Or else they're pagers or cellphones. Give a few random numbers in those ranges a call and see if you get a recording that tells you the range is for pagers or cellphones. If it is, or if the prefix is in a rural area, then scanning them is an utter waste of time because you won't get any carriers. So consider nuking such blocks from your scan, and consider thoughtfully. Other Tricks of the Trade o Set your modem's dial speed (the S11 register) to the lowest value possible. Most modems have a minimum of 50ms, the phone system can keep up woth dialing as fast as 45ms. You can save a little time each call this way, which really adds up over thousands of calls. Just put ATS11=50 in your initialization string. o If your phone company offers a "Do Not Disturb" line feature, activate it before you scan, and have your scanner program renew it periodically if it has a time limit. That way any incoming calls will not disrupt your scan. This is especially helpful if you're not using *67 to block your Caller ID, because a certain number of people will try to call you back. o Be paranoid and use *67, but remember that you do NOT need to wait for the stutter dial tone. ATDT*672537000 works as well as ATDT*67w2537000 and is one or two seconds faster. Again, this adds up massively over thousands of calls. If *67 costs per-call then your phone company is in a minority of shitheads, and you should investigate the cost and possibility of a per-line Caller ID block before you scan - unless you want your phone bill to come in a crate instead of an envelope. o If you've recently performed a hand scan of a partial prefix (as in Power Scanning I), you need not bother re-scanning that range with your carrier scanner, as any carriers would have been noted in your hand scan. Add all the numbers in that block to your do-not-dial list to save time. o This is the only thing for which I'm going to grab you by the collar and shake you until it sinks in: DO NOT SCAN WATS (800, 888, 877) exchanges with your computer, or at least not from a phone line which can be traced back to you or to someone you need to stay alive/free/sane. If you knew how few consecutive 800 calls it takes to set off an audible alarm at your local RNCC, you'd never call an 800 number again! The Impact of Power Scanning Remember I said that a traditional scan using no special techniques would take 56 hours to do a whole prefix? By setting a 10 second connect time, a 12 second total dial cycle, that 56 hours falls to 33 hours and 30 minutes. By getting a second computer on a second line helping out, that 33:30 drops to 16:45. By getting a friend to help out on two lines, or two friends to help out on one each, 16:45 becomes 8:23. By eliminating an average 50 to 90 percent of numbers from the scan by ignoring listed numbers and unassigned blocks, that 8:23 falls to 4:12 at worst, and as little as only 0:50 if the prefix is saturated with mostly residential listed numbers! At 50 minutes a prefix, you could cover a small city completely in one evening (7 prefixes in 6 hours)! How about scanning an entire area code? It's not out of the question with Power Scanning! Get a couple of dozen accomplices and totally blanket an area code in weeks. 2600 wouldn't have room to print the results! That's a 93 to 99 percent reduction in scanning time overall, and yet it's 100 percent as effective and thorough as the grueling 56 hour nightmare that hackers used to deal with in days gone by! Carrier Scanning Pitfalls II You'd never add 911 to your scan list, would you? Well, most people don't know this, but the 911 call center also has an unlisted 7-digit number - an alias - that is the same as dialing 911! It may be the "old" police emergency number from before your area got 911 service, it may be in a special exchange, or (and this is the case where I live) it may be a normal phone number whose last 3 digits are 911 (e.g. 250-361-9911). 911 Service was introduced to my area the same year (1988 for anyone who cares) that the 361 prefix was created, so its location makes sense. There are two things you MUST do to prevent your scanner calling 911, before you start on any automated scan of unlisted numbers. First, you MUST exclude the 911 alias from your scan. If you have Caller ID then this is easy, just dial 911 and hang up. They will call back to find out why you hung up. Tell them you're sorry, your phone has a panic button and you accidentally pressed it, and then when you're off the phone take note of what appeared on your Caller ID box. Or dial *69 if you don't have Caller ID. The number you get back must be added to your exclude list. The other thing you have to do is go to your local library and look in an old phone book (every public library that has phone books keeps obsolete ones). Get one from before 911 was instroduced to your area, and add all the emergency numbers - police, fire, ambulance - to your exclude list. Chances are even if you have had 911 service for 15 years or more those numbers still work and are forwarded to... guess where. If your computer dials a 911 alias during a scan, they will first try to phone you back and failing that, a police cruiser will visit. Not a desirable occurrence. So make sure it doesn't happen! Conclusion There's no doubt that the Internet has killed BBSes and rearranged the faces of online services like Compuserve and Prodigy. But hosting modems of various descriptions are still on the rise and will be for a long time. Look in the October 1998 issue of Scientific American for Carolyn Meinel's article on hacking. It has a great example of why we scan. A company whose entire presence was on the internet, could not keep a hacker out because someone in the company had installed a "backdoor" modem without permission, the hacker found it and used it to remain online even when the whole company network had been severed from the internet! So the choice is clear - hack with the internet alone and be l33t or use *all* the tools at your disposal and get something done instead. Face it, the need for carrier scanning will remain as long as there are dialup modems!