Home

Untitled - beardyjay

1. A year of 2600 for every article we print this can be used toward back issues as well A 2600 t shirt for every article we print A voice mail account for regular writers two or more articles An account on 2600 com for regular writers 2600 com uses encryption for login sessions and for files so that your privacy is greatly increased PLEASE NOTE THAT LETTERS TO THE EDITOR ARE NOT ARTICLES Send your articles to 2600 Editorial Dept P O Box 99 Middle Island NY 11953 0099 Spring 1996 2600 Magazine THE ALASKAN PHONE SYSTEM by Ice You re probably looking at the title of this article The Alaskan phone system Who cares But the Alaskan phone system is actually very interesting and dif ferent from most others Alaska was admit ted into the union second to Hawaii d has 5 the la munications is the only one owned by the local government in the nation we aren t in an RBOC no USWest etc but it s at least as lame as other telcos A residential line is about 16 a month and a business one is 30 a month We have CID Last Call Return and Continuous Redial as of a few months ago but no other other CLASS fea tures to speak of We don t yet have ISDN available in town T1 s cost from 160 to 200 a month plus 137 a mile Fiber ethernet links are a minimum of 600 Page 24 2600 Magazine month The payphones were 15 cents until about two years ago when they went to 25 I
2. 61 o 74470 83158 H E HACKER QUARTERLY a THIRTEEN NUMBER ONE SPRING 996 crus 5 5 3 IN CANADA STAFF Editor In Chief Emmanuel Goldstein Layout Scott Skinner Cover Design Phriend2 Shawn West GTE Office Manager Tampruf It s not a computer crime to break into someone s system and just look around Susan Lloyd a spokesperson for the FBI s Washington DC field office as quoted in the March 10 1996 Boston Herald Writers Billsf Blue Whale Commander Crash Eric Corley Count Zero Kevin Crow Dr Delam John Drake Paul Estev Mr French Bob Hardy Kingpin Knight Lightning NC 23 Peter Rabbit David Ruderman Silent Switchman Thee Joker Mr Upsetter Voyager Dr Williams Network Operations Max q Phiber Optik Voice Mail Neon Samurai Webmasters Bloot Corp Inspirational Music Raekwon and the Wu Tang Clan Trancemode Express 1 01 Negativland Sex Dirt Shout Outs Veggie Freqout Sciri Mark0 Zeed Refugium CENENE SEE HERE caught in the web 4 tap alert 6 a page of revenge 9 unshredding the evidence 10 confessions of a beige boxer 12 macs at ease 17 sharp cash trix 18 hacking doors 20 hacking caller id boxes 22 the alaskan phone system 24 avoiding suspicion 26 letters 28 motorola cellular guide 38 2600 marketplace 48 hackers 95 review 53 gt w gt lt 2600 ISSN 0749 3851 is published quarterly by 2600 Enterprises Inc 7 St
3. Seven digit dialing only Full keypad and memory dialing but memory locations 1 through 10 can not be changed The phone will dial only from as many as 50 programmable memory locations step 10 above suggested entry is Digit 6 Digit 7 Digit 8 Auxiliary horn alert 1 to enable Hands free VSP auto mute to enable mutes outgoing hands free audio until the MUTE key is pressed Not used in TDMA Min mark 1 NOT CHANGE ABLE 2 Station Class Mark SCM 666 or VOX Max Power 832 Ch 0 666 N 3 0 W 1 666 N 1 2 W 2 666 N 0 6 W 3 4 666 Y 3 0 W 5 666 Y 1 2 W 6 666 Y 0 6 W 7 8 832 N 3 0W 9 832 N 12W 10 832 N 0 6W 11 12 832 Y 3 0W 13 832 Y 1 2 W 14 832 Y 0 6 W 15 00000100 Digit Not used in USA enter 0 Digit 2 Notusedin USA enter 0 Digit3 Notused in USA enter 0 Digit 4 Digit 5 Digit 6 Digit 7 Digit 8 Extended Field When enabled the telephone will scan more than 32 paging channels Not used in USA 0 to disable Single system scan 1 to enable scan A or B system only determined by bit 2 of step 02 Set to 0 to allow user the option Super speed dial 1 to enable pressing N or NN SND will dial the number stored in mem ory location NN User selectable service level 0 to enable allows user to set long distance memory access dialing restrictions Lock function 0 to enable allows user to lock un lock the phone if this is set to 1 the phone
4. 15 EACH 2 FOR 26 AVAILABLE IN LARGE AND XTRA LARGE WHITE LETTERING ON BLACK BACKGROUND I M A TRADITIONALIST SEND ME AN OLD FASHIONED BLUE BOX SHIRT MY SIZE IS I WANT TO TRY SOMETHING NEW SEND ME AN ELITE MICHELANGELO VIRUS SHIRT MY SIZE IS O 1 shirt 15 OQ 2shirts 26 AND WHILE HAVE YOUR ATTENTION SEND ME INDIVIDUAL SUBSCRIPTION Q 1year 21 UO 2years 38 OU 3 years 54 CORPORATE SUBSCRIPTION O 1year 50 UO 2years 90 O 3 years 125 OVERSEAS SUBSCRIPTION Q 1 year individual 30 3 1 year corporate 65 LIFETIME SUBSCRIPTION 3 260 you will get 2600 for as long as you can stand it also includes back issues from 1984 1985 and 1986 BACK ISSUES invaluable reference material 3 1984 25 1985 25 XQ 1986 25 OU 1987 25 m 1988 25 OQ 1989 25 XQ 1990 25 1991 25 O 1992 25 XQ 1993 25 QO 1994 25 QU 1995 25 OVERSEAS ADD 5 PER YEAR OF BACK ISSUES individual back issues for 1988 to present are 6 25 each 7 50 overseas Send orders to 2600 PO Box 752 Middle Island NY 11953 Make sure you enclose your address TOTAL AMOUNT ENCLOSED UKRAINE cheerful sight in Kiev Ed Fisher TRANS DNEISTRE A little known breakaway republic between the Ukraine and Moldova Tom Mele MOLDOVA An old phone that runs on Getones 16 per US dollar Tom Mele ROMANIA The town of Suceava where judging by the chains there is a vandalism problem
5. DTMF and Audio Tones Off Audio Path Set Some that say no function do have a function but it is to Speaker unknown until it is figured out 054 TX Carrier On Key Transmitter Three test commands are significant for program 064 TX Carrier Off Spring 1996 2600 Magazine Page 41 1 074 085 094 105 114 12x 13 14 15 16 17 18 18 Page 42 RX Audio Off Mute Receiver Audio RX Audio On Unmute Receiver Audio TX Audio Off TX Audio On Set Transceiver to Channel xxxx receive and transmit in decimal accepts 1 2 3 or 4 dig its Set Power Step to x 0 1 7 0 Maximum Power 3 Watts 7 Minimum Power Out Power Off shuts off the radio 10 kHz Signalling Tone On 10 kHz Signalling Tone Off Setup Transmits a five word RECC mes sage each of the five words will be FF00AASSCC33 Transmitter de keys at the end of the message Voice Transmits a two word REVC mes sage each of the two words will be FF00AASSCC33 Transmitter de keys at the end of the message C Scan Allows for entry of as many as 5 negative SID s for each NAM Newer Motorola phones are equipped with a feature called C Scan This is an option along with the standard A B system selections C Scan allows the phone to be programmed with up to five inhibited system ID s per NAM This is designed to prevent the phone from roaming onto specified non home systems and therefore reduce accidental r
6. If you do anything to get yourself arrested you are wide open for search of person and personal pos sessions like book bags If you are arrested some place like home they can visually search the imme diate premises any point from where they can enter to where they find you Then the same parameters apply as an automobile search Never ever ever carry a concealed firearm Spring 1996 unless you have a permit for it This really upsets LEO s and can cause all kinds of problems even fed eral charges if you crossed state lines while carry ing It is fairly easy to get a permit in many states Pennsylvania will provide one after a background Check Basically you must have a clean record be of age 18 or 21 I forget and be of good character that means you cannot be a habitual drunkard or spouse beater You have to provide a reason some thing like a work schedule requiring you to work odd hours and travel through dangerous areas An inter esting tidbit concealed carry permit holders are not subject to the Brady Bill background check The supposition is that they already passed it to get the permit Also avoid the fancy knives You are much bet ter off carrying an X acto blade or a good electri cian s knife scrape some wires with it so you can easily claim that it is a tool not a weapon In this day of cyber phobia and get tough on criminals the courts are much less likely to disallow evidence gath
7. No way Bronco Man was cruising the highway just looking for this kind of stuff When he spotted me he stuck with me radioed into The Man and was pulled over To make a long story not so long they let me go but not before they issued me a Warning ticket for speeding of course They said they weren t going to search my car because they didn t think I was running drugs They also told me to expect to be pulled over again before the end of my joumey because I was considered high profile They were right 1 was pulled over two more times before I reached my final destination One officer said 1 crossed the center line 1 had to 1 was changing lanes and didn t give the third officer a chance to tell me why he pulled me over blurted out This the third time I ve been pulled over I m not running drugs I m just trying to get home to my mother who is ill I m on probation I ve already been checked out and I m fucking tired He said Go lady just go All three times there was a D E A white car agent parked behind the squad car So my advice to any female trav eling alone is Don t latch onto the car who is traveling a little fast so that he gets the ticket not you Get a radar detector I had one take airline tags off your suitcases and cover them with blankets or put them in the trunk Get a dummy or the next best thing to sit in the pas senger seat preferably one that looks like grandma Spr
8. Unfortunately no so called civil liberties group thinks this is an important enough case to become involved in This means there could be many more Bernie S cases before something is done Weigh all of this before making your decision and then do what s right for you Dear 2600 This thing going on with Bernie S has really gotten me pissed off What right does the government have to prosecute a man who just had the software It s not like he was using it at the time Tell me what i can do to help Mike W Page 30 2600 Magazine The best way to help is to spread the word Check out the website www 2600 com finger bernies 2600 com for the latest info and distribute what you see in 2600 to as many people as vou can We ve made a great deal of progress in the last couple of months in spite of media indifference There are an awful lot of us and we know how to getthe word out People like vou are vital to this Dear 2600 I was reading your article on Ed Cummings in the Autumn 1995 issue and I stumbled on a fact that I per sonally was not aware of and frankly find appalling This is Title 18 USC Section 1029 possession of a technology which can be used in a fraudulent manner What s next In a year will carrying a pencil in your pocket be considered concealing a deadly weapon It s amazing that the people supposedly representing us in Congress could pass such an anti citizen law How in the world can they ma
9. Works on rare 20 lei coins which are worth about a penny Tom Mele COME AND VISIT OUR WEB SITE AND SEE OUR VASTARRAY OF PAYPHONE PHOTOS THAT WE VE COMPILED http www 2600 com
10. commands to enter another test command the key must be depressed all otherkey depres sions are ignored Receive control channel messages counting correctable and uncorrectable errors When the command starts the number of the com mand will be displayed in the upper right cor ner of the display Entering a key will ter minate the command and display two three digit numbers in the display The first number is the number of correctable errors and the second is the uncorrectable errors Received voice channel messages counting correctable and uncorrectable errors When the command starts the number of the com mand will be displayed in the upper right hand corner of the display Entering a key terminates the command and will display two three digit numbers in display The first is the number of correctable errors and the second is the uncorrectable errors Receive control channel messages counting word sync sequence When the command starts the number of the command will be displayed in the upper right hand corner of the display Entering a key will terminate the command and display the number of word sync sequences in the display Receive voice channel messages counting word sync sequences When the command starts the number of the command will be displayed in the upper right hand corner of the display Entering a key will terminate the command and display the number of word sync sequences in the display Receive co
11. feeding the data in is now easy with a flatbed scanner and can be eas ler if you have thin sheets of clear stiff plastic to sandwich mash the shreds down A programmer would then want to compare the edges of the images in the computer s memory The basic idea is to turn the edge of a shred image into a word according to its pixel pattern This word would then be sorted with the other words and the results would indicate which images are matches Only a small portion of each edge would be compared since a close match in one area is a good indicator for the whole A sample size might be three inches in length starting one inch down from the top of each shred Reconstruction would be accomplished by drawing in the images in their relative positions and printing the result or passing the image to an OCR rou tine for translation into completed ASCII text pages Have fun but publish your results the 2600 web page _ http www 2600 com come explore Spring 1996 2600 Magazine Page 11 contessions ot a beige boxer by RedBoxChiliPepper Here s what happened when I took beige boxing just a little too far while living in Celina Ohio population 8000 I started out like most people just finding a telco box or a neighbor s box on the side of their house plugging in my phone and dialing away at the 900 numbers and harassing operators But that got really old after awhile So I set up sort of a permanent be
12. neighbor s house one night to check out the possibilities on their line and ended up doing the same thing to their line only run ning the line in my basement window and upstairs to the spare bedroom where the other two lines were hooked up Since I only had one conference phone that didn t work very well to begin with I decided to build a simple switchboard on top of my desk It ended up being a piece of sheet metal with five two position switches on it Switch 1 was my own phone line switch 2 was the first neighbor s line and switch 3 was the other neighbor s line Also each switch had a light above it to indicate In Use Normally the switches would be in the off position If I wanted to use a line I flipped it on and hit the speakerphone button on my desk phone or used my official Bell operator headset Actually one of those cheap headsets that you buy from Radio Shack but hey I drew a Bell symbol on it okay So now with their two lines and my own three way calling line I had a total of four phone lines to play with The new neigh bor s calls proved to be much more interest ing that the others They had a son and teen aged daughter who liked to talk on the phone a lot And when their conversations did get a little boring I helped them out by patching my Sound Blaster card directly into my switchboard so I could add sound effects movie clips and rude noises to their conversation Lemme tell you their reac tion
13. then CDEFGHI are as follows to select to store C SAT frequency 0 5970 1 6000 2 6030 3 no channel lock Options are D Carrier 0 off 1 on CSCAn Preferred Non preferred with system lockout E Signalling tone 0 off 1 on Std A b or Std b A Preferred Non preferred F Power attenuation level 0 through 7 SCAn Ab or SCAn bA Non preferred Preferred G Channel mode 0 voice channel SCAn A A ONLY 1 control channel SCAn b B ONLY H Receive audio mute 0 unmuted HOME Home only 1 muted Transmit audio mute 0 unmuted These are typical options some phone s vary C Scan is 1 muted only available on newer models and does not appear Press to hold display and to end unless programed see below 03 Reset Autonomous Timer This command results in the reset of the autonomous timer Test Mode but does not provide any test function on Not all commands work on all telephones If a com these models mand is not valid the display will show ErrOr Not all 04 Initializes Telephone to Standard Default numbers have been assigned Not all numbers have been Conditions Carrier Off Power Level 0 listed here Some commands were intended only for Receiver Audio Muted Transmit Audio Motorola factory applications This is the disclaimer in Muted Signalling Tone Off SAT Off the technical training manual I have included all of the Resetting of Watch Dog Timer Enabled other commands I have discovered one way or another
14. to you don t be alarmed Watch ing Hackers 9S one gets the impression that these are inside stories going on to whigh you may or may not b privy depending 1 suppose op sho you know and how much fime you spend on IRC s hack Hackers 95 has a definite home video feel to 3t and one of the dangers inherent in commercializing such a vided is that the subject matter may only be of interest to those who attended the various conventions or ook part Channel 6 Chamel 7 Channel 5 Channel 9 10 Channel 12 Chamel 13 Chammel 14 Chamel 15 recording and the public access televisi n show Kaleidoscope it s not bad it s just not good The fairest word I can think Of to describe it is ama teurish only with endearing qualities don t want to be mean its just that the production Bloodaxe the Mild F TRE quality can be rustrating attimes as when Chris other with 2600 Editor In Chief 5 phone with his manic hand Emmanuel Goldstein Part two shows some inter gesticulations causing the esting highlights from SummerCon95 in Atlanta automatic sound levels to Part three continues with highlights from DefCon fade out for critical seconds IH in Las Vegas Part four puts us inthe driver s during his spiels It is my seat with a bona fide Motorola cellular phreaker sincere hope that the pro Part five is a discussion of Area 51 a military ducers of this 35 video base in Ne
15. 53rd St between Lexington amp 3rd Orlando FL Fashion Square Mall in the food court between Hovan Gourmet amp Panda Express Payphones 407 895 5238 7373 4648 896 9708 895 6044 6055 Ottawa ONT Canada Cafe Wim on Sussex a block down from Rideau Street 7 pm Philadelphia 30th Street Amtrak Station at 30th amp Market under the Stairwell 7 sign Payphones 215 222 9880 9881 9779 9799 9632 387 9751 Pittsburgh Parkway Center Mall south of downtown on Route 279 In the food court Payphones 412 928 9926 9927 9934 Portland OR Lloyd Center Mall second level at the food court Raleigh NC Crabtree Valley Mall food court Rochester NY Marketplace Mall food court St Louis Galleria Highway 40 and Brentwood lower level food court area by the theaters Sacramento Downtown Plaza food court upstairs by the theatre Payphones 916 442 9543 9644 bypass the carrier San Francisco 4 Embarcadero Plaza inside Payphones 415 398 9803 9804 9805 9806 Seattle Washington State Convention Center first floor Toronto ONT Canada Sheppard Centre Food Court area around Second Cup 7 pm Vancouver BC Canada Pacific Centre Food Fair one level down from street level by payphones 4 pm to 7 pm Washington DC Pentagon City Mall in the food court tiens AUSTRALIA EUROPE SOUTH AMERICA Aberdeen Scotland Outside Marks amp Spencers next to the Grampian Transport kiosk Belo Horizonte Braz
16. LED as short as you can handle solder ing to Next cut the cathode the side with the black band on the zener diode approxi mately the same length as the lead you just cut on the LED Now solder the LED to the zener diode by soldering the cut lead on the zener to the cut lead on the LED Next locate the plus and minus side of the bridge rectifier this is the side that your zener LED unit will be soldered to Solder the Page 6 2600 Magazine ALERT zener lead to the minus pin on the bridge rectifier and the remaining lead of the LED to the plus pin On the opposite side of the bridge rectifier that you just soldered to are the two pins that you must solder the push button switch to Pick one switch lead and solder it to one of the two remaining rectifi er pins then solder the other switch lead to the other remaining rectifier pin You have now completed assembly of the tap block ing device we recommend that you now go drink some Hacker Pschorr Oktoberfest or if you re real manly a bottle of Cisco Installing the Device into a Phone If you don t already have a phone to work with it is strongly suggested that you purchase the Model 2 9220 GE telephone from K Mart It goes for 18 99 and comes in many colors we prefer black Unlike many phones on the market the 2 9220 contains all of its electronics in the handset with two alligator clips it makes a very nice beige box Internally a lithium battery keeps
17. This patch is disabled and you can crash tEase Nifty huh amp This last thing is my personal favorite for AtEase Thiet is not for school but rather office sup ftment stores like Sears Most Macs dubbed Performas are OE software including AtEase ing on the demo Macs If they presentation program it can easily be quit by using the command option esc method mentioned above Then you will be at AtEase The software comes with a default pass word familymacintosh no caps no spaces which most places don t bother to change Every place I ve visited it worked If you use this then you can even change the password Hahahaha Also many department stores just let the screensaver run It is most often AfterDark 3 0 If they are using the password function then all you have to do is use the same command option esc as used above This is because with AfterDark 3 0 they made the screensaver a separate program that loads itself when it goes on and quits itself when it goes off You can force quit it like any other pro gram There are many other ways to hack AtEase as well as hundreds of other programs Page 17 Editor s Note Although readers should always exer cise caution in the application of knowledge the sub ject matter of this article deserves a special advisory Do not attempt to take advantage of this security weakness unless you have the approval of those in charge Doing otherwise could risk your fut
18. a composite of photos and it also involved a fair amount of touching up The van that crashed into the phone booths ves it reallv happened wasn t a phone van at all and had nothing to do with 2600 And Walter the dog has never been in New York City You can check out our web site for a more graphi cal look at how it was done Fun On Planes Dear 2600 For a few years I ve used a rather enjoyable bug in Airphones Because I often fly it has actually turned out to be a very convenient method of entertaining one self on a flight without causing any major disturbances where something unfortunate may occur e g death When you use an AT amp T Call Me card a card designed so that one uses it to call a predetermined number like a parent but nobody else with GTE s In Flight phone service you can use the card to call numbers which have not been specifically configured forthe card What this means is that using your AT amp T Call Me card you may call any number in the world without the hassle of putting up with their rates which rival 900 numbers in expense This little trick has made otherwise boring flights let s face it besides being able to start interesting con versations with people around you there isn t a whole lot that you haven tread in a 2600 overa three hour time period become even enjoyable Oh yeah thinking that their banning of portable computers on some flights was just another way of con trolling us
19. accurate since we d been getting complaints about this individual back in 1994 Tainted though this case may be its quite likely these questions won t change a thing But we can learn something important Odds are that if someone approaches you and tries to get vou to turn your knowledge and interests towards the world of crime they are either trying to trap you or they are trying to con you If you feel nice and secure because the person you want to commit crimes with is a trusted friend be aware that nothing tears apart a friendship more quickly than a federal indictment There is absolutely no way of knowing how someone will react to that kind of pressure until the time comes when they are confronted by it Take heart in the fact that these days you can still wind up in prison and be considered a major threat to society without committing crimes When people recognize this we have a chance of win ning some important battles Highway Weirdness Dear 2600 My fiance and have been avid readers of your informative zine for the past two years and I must say we have learned a lot I had the opportunity recently to drive myself from Phoenix Arizona to Springfield Illinois and thought you and your readers may be inter ested in what I encountered with our fine highway patrol I left Phoenix at 4 00 pm Monday evening the 4th of December My brother in law was kind enough to rent me a car to get to Illinois so that I could be with my
20. and I would call back later Well 1 called back for two more days at different times and got the same message The third day just out of curiosity I pressed 1 on Spring 1996 2600 Magazine their voice mail to access the operator who takes orders fortheir free software Bingo wasn t even put on hold my call was put right through When I explained to the operator what was happening she responded by saying that s just the way it is The point is that AOL makes it incredibly easy to sign on by including their free software in just about everything computer related you buy And they make it incredibly difficult to cancel once you realize how use less and costly their service is YUKYUK We were able to get through without much delay late at night and over the weekend the number is 800 827 6364 If you re told to wait for a ridiculous amount of time on the phone you re better off contacting vour credit card company and telling them to refuse any fur ther charges We happen to know Netcom has the same problem read some of the local netcom newsgroups to see the hell their former customers are going through In fairness this kind of thing seems to happen to an awful lot of providers Credentials on Credentials Dear 2600 It seems to me that you don t do a lot of research on your zine In the last issue of 2600 I read an article about Credentials Services In this article you start flam ing TRW for their Privacy Watch s
21. as much fun as cellular along with the fact there isn t much to them this infor mation is very limited and somewhat brief 1 would still like all information pertaing to all of Motorola s pagers sent to me so this article can be updated General Disclaimer This article is not intended to be an aid in cellular fraud That is both illegal and immoral Would you like someone to make charges on your phone If you want free calls you want to check elsewhere for information pertaining to boxes which is not mentioned here This article is not intended for use by people with little electronics experience This is not a tutorial and not intended to be used except by people with previous cellular experience who are familiar with programming cellular phones There are tons of introductory files all over the net For more info get into alt cellular or alt 2600 If you have specific questions those are the places to start I hope to make make future articles more interna tional However the U S cellular system greatly differs from other countries and we are all ignorant here as to what others are doing but isn t that always the way Any info on hacking the GSM system at least being able to use different SIM cards in different phones The term is SIM locked and a friend needs to unlock his phone Please Email any info about this Send all related info about the new phones with caller ID manuals instructions bugs etc If anyone
22. be Service get away with such a horrid event ThePawn We had no problem finding another provider who hel ped us with 56k connectivity Not all NYNEX lines can handle this but we knew that when we started the project We suggest you ask local providers in your area if they support 56K ISDN data over voice and make sure they know exactly what you re talking about And keep pushing for a flat rate ISDN service so we can just use 64K and not have to pay their ridiculous per minute surcharge Good luck Netware Nonsense Dear 2600 I have for the most part been very impressed with the level of technical knowledge and creativity that have found in 2600 always wait impatiently for the next issue to arrive at my local Borders Book Store Today is the first time I can honestly say that what I was reading was gibberish I refer to the article titled Hacking Netware from the Winter 95 96 issue With all due respect to Trap 1 would agree with his opening line Reading through the book It would appear that Trap has done little else than that with regard to Netware We will not bother with the fact that Netware 3 11 is horribly outdated The first half of the article is purely speculative What if I could dial in and If I can get access to the backup account by going to work after hours types of fantasy There are two Netware backup solutions that are the most prevalent Both are based on the server console which
23. cannot be locked step I above suggested entry is 00000000 Digit 1 Handset programing 0 to enable allows access to pro gramming mode without hav ing to enter test mode 3 Service Level Codes The telephone will only dial numbers in memory locations 01 02 and 03 No keypad entries or memory storage is possible Restrict all outgoing calls Page 46 2600 Magazine Digit 2 Second phone number not all phones 1 to enable Digit 3 Call timer access 0 to enable Not used in TDMA Digit4 Auto system busy redial 0 to Spring 1996 568 57xit Spring 1996 enable Internal Speaker disable I to enable use with select VSP units only do not use with 2000 series mobiles Digit 5 Digit 6 IMTS Cellular 1 to enable rarely used Digit 7 User selectable system regis tration 0 to enable Digit 8 Dual antenna diversity I to enable 6 step 16 and 19 above suggested entry is 0011010 for portable and 0011011 for mobile units Digit 1 Enhanced Scan when enabled four strongest signalling chan nels are scanned insted of two 1 enabled 0 disabled Cellular Connection used only in series II phones if a series I cellular connection is used with a series Il O series II 1 56 165 1 0 for ALL TDMA PHONES Continuous DTMF 1 to enable software version 8735 and later Transportable Internal Ringer Speaker When set to 0 audio is routed to the external speak er of
24. case discussed at long last We hope this new publicity will cause some heads to roll at the Secret Service and pre vent this kind of thing from happening again to more of us Regardless Bernie S has gained Page 5 TAP by No comment and Crash Test Idiot Who s the operator an anonymous conference voice says I am booms Joe Hacker with confidence Suddenly Joe notices his phone goes dead and the tap alert light has gone off Joe startled only momentarily pushes the red override but ton on his phone announces Gotta go pulls the phone cord swiftly from the ter minal box and is off safely to his next clan destine operation of the night Fiction scenario Yes Probable Yes again with the help of a tap alert device described in this article The tap alert device is useful in many ways How about those times when a parent or roommate dropped onto the line and lis tened while you were having some salatious conversation not meant for their ears Wouldn t it have been nice to have known the moment they dropped in Or perhaps you are wary that your phone line is tapped but how can you tell for sure The tap alert device will detect lower grade taps not the non par asitic or the electronic taps at the switch Assembly No project board is required for the fol lowing assembly and the final product will be small enough to fit on the average thumb nail First cut the cathode the short lead on the
25. code you have dialed is invalid Do you know when or why such security would be applied to this number Overuse perhaps The Mad Tapper Ringwood IL What you have is the Spanish AT amp T customer ser vice line Like the English version 800 222 0300 all you have to do is hit 1 to hear vour phone number read back As for the demise of the 1 800 MY ANI IS overuse is probablv an understatement Even after a code was put onto that line so many people had it it was onlv three digits that we would be amazed if the number still exists by the time you see this Cellular Prisoner Dear 2600 My handle is Alphabits and I ve been in the H P scene for over nine years I m currently in federal cus tody in New Jersey waiting to go to trial for cellular phone fraud mainly trafficking in counterfeit access devices in violation of title 18 section 1029 a 2 of the US code In September of 1995 I was indicted by the U S government and then shortly thereafter 1 was arrested by Secret Service agents on a freeway in south ern California I was one of the key figures busted in the Celco 51 incident The U S Secret Service Cellular One and an informant operated an H P BBS in New Jersey for about two years To my knowledge there were a total of 15 other people arrested across the country during September Since Cellular One was a key partner in the operation they were mainly targeting cellular fraud On September 3rd 1 w
26. cut chipped documents or ashes but with paper spaghetti A three page group only takes an hour or two to completely recon struct The key to paste up in turn is proper and systematic comparison of each and every shred against as many others as seem to fit This has to be done sys tematically in order to avoid re comparisons and to identify patterns in the reconstructed portions The Procedure Place the sorted shreds into a raw area to one side and place the first shred on the paste up board anywhere Tape it down with masking tape top and bot tom Masking tape pulls back off the board easier than clear tape Next pick up the second shred and place it alongside the first in the same orientation Compare it against one side then the other If it matches tape it down and if it does not tape it down a little farther away perhaps an inch or so away parallel to the first Repeat repeat repeat Uncrook your back every little while When you compare the shreds in this manner you are limiting the number of compar isons to a fixed predictable number If you run out of room to paste down new strips grab a fresh paste up board and keep it handy or prepare to recycle the no match pile which will develop opposite the raw pile But that adds steps and time to your task Inspect the reconstructed document strips as they grow Read what develops to guess which shreds match the open edges The widening strips are compa
27. every set of terminals in there and taking notes of what was what I was going to go for choice and pick my least favorite neighbors but decid ed that that would take forever so I hooked up to the first 50 terminals on the back side so telco wouldn t notice and put the box back together I hoped I hadn t hooked up one of my neighbor s that I already had hooked to my house causeit dsuck to waste a whole line like that Now the hard part I dug a trench a few inches deep from the telco box down the alley into my own back yard then through the yard and into that little hole underneath my basement window It took me over three hours to complete all of this but when I was finished there wasn t a trace that anything strange was going on I had to cut a hole in the floor to get the cable upstairs to my switchboard and found myself hoping that my landlord wouldn t drop by anytime soon He got testy when I drilled holes in his property So I got that far and went to bed I couldn t really do much more cause I need ed to go to Radio Shack and buy some more switches and a larger piece of sheet metal Another month passed I discovered that I had access to the phones in random hous es as far away astwoblocks and another pay phone I d hooked about every sound device Spring 1996 2600 Magazine I owned into the switchboard including my computer s Sound Blaster tape deck CD player voice changer and echo machine I had the ability
28. is bullshit We should all come together to protest and screw the gov ernment for these unimaginable and cruel punishments they are subjecting him to But on the other hand Bernie S did commit more Spring 1996 crimes than possess and have custody and control of hardware and software such as an IBM Think Pad lap top computer and computer disks Imean he wrote four articles for 2600 which would imply he is a Real Hacker Just look at the shit he knows How to Defeat 69 AT amp T Sub Maps FAX A New Hobby Paging For Free Cellular Phone Fraud and Where It s Headed Iknow that knowledge is not a crime but using that knowledge to commit a crime is But 1 strongly think that he deserves to be released from prison because he has already suffered enough Adam Schoenfeld We don t know whether to slam you for being dense or congratulate you for being witty Its probably best just not to say anything Military Miscellany Dear 2600 As part of my job 1 had to go to a high security mil itary base recently There were loads of fences and dogs etc My escort lead me through four doors with elec tronic combination locks on them The combination on each door was 12345 Is this what is known as military intelligence Also 1 have been trying to hack my local USAF base 1 have found a phone number that rings answers and sends a carrier My old 2400 baud modem seems to lock on but nothing comes on the screen Is th
29. means that day to day operations do not require you to login to a workstation Only when you desire to modify or add additional sessions is there a need to login and that login account does not need any exceptional privileges to execute the management soft ware There is no knowledge or experience showing here on the part of Trap Further statements such as All information about where and when a specific login ID has logged in is recorded in the Bindery is just simply wrong Login out info is recorded in a file called NET ACCT DAT and only if the accounting feature is enabled on the server Do not mistake all NET files as Bindery files Also make note that the correct spelling is BINDERY not BINDARIES The second half of the article is partially right the correct part is that Novell will ask for the name of the licensee The wrong part is that they would ever give out a back door password Anyone even remotely familiar with Netware should know that you can always re enable the supervisor password at the console or in the worst case by power cycling the server Not the preferred Page 51 method but Novell would rather have you do this than admit to having a back door into every Netware server Another important thing to note is that not only will Netware report failed login attempts to a file but also to the System Console by default with the Network ID wire number and ethernet card address So be pre pared to
30. more than eight times its capacity if you have the right revi sion Here s how you do it Most Caller ID boxes you see in stores are sold according to the capacity of num bers they can store The more you pay for the box the greater storage capacity of numbers between 60 and 99 for example you obtain over the cheaper boxes which only hold between 10 and 30 numbers CIDCO or Caller ID Company is one of the most popular manufacturers of Caller ID hardware and is publicly traded on the stock market CIDCO s boxes are sold in stores under names such as AT amp T GTE Radio Shack and others Because CIDCO concentrates on mass production and OEM sales it is less expen sive to manufacture one CID circuit board that is jumper solder points instead of jumper pins selectable for the capacity of numbers that it can store The good news is you can buy the cheapest CIDCO Caller ID that you can find 10 number memory is perfect and upgrade it to handle 85 num bers How to buy it Before you buy it s important to know first that you have a CIDCO unit remem ber lots of companies show their names on the outside of the case and which ROM revision you have Fortunately for us the CIDCO engineers tell us this when the unit is booting up When you insert the nine volt battery watch the display You will see Page 22 2600 Magazine C NAM ver 1 2A or C NAM ver 1 4 After this you will see the capacity of
31. or not its supposed to save time Disney Critique Dear 2600 I can t believe how many inaccuracies there were in this article As a former cast member at WDW I can tell you that the majority of facts listed in the article were gross errors You really should check your articles before they are printed Not doing so hurts the reputa tion of your publication Michele Warner Itsure would be helpful if you shared with us some of the inaccuracies Fortunately someone else did Dear 2600 I usually find that your mag has well researched quality information and articles until I read your Winter 95 96 issue Don t get me wrong It was all great except for one article Infiltrating Disney by Dr Delam I would urge the good doctor to quit taking the Lysergic Acid Diethylamide as he mentions at the end of the article and begin checking his facts Here are just a few minor corrections WDW in general is not guarded by a moat The Magic Kingdom is on one side for a small area The stupidest place to try and sneak in would be by Space Mountain because that is where there are not only the most guard stations patrolling security cars and cameras but also the so called moat In addition the tunnels are not underground they are actually at ground level WDW is built above ground level and it does not go to each land only four out of the seven and would hardly call it a ring at all It does not even remotely resem
32. stored numbers active in memory and there is plenty of space to add switch es boxes devices etc Open your phone and locate the red ring and green tip wires If you are opening the 2 9220 the trick is to pull out the Hi Low Off and Pulse Tone slide switches first they ll pull straight out Then remove the small plastic plate which was underneath the two buttons by prying it up Underneath this plate is the well hidden Japanese screw which if you haven t read this yet you are extremely pissed off at The ring and tip wires will be going into the jack on the mouthpiece end Cut the ring wire in two Solder one ring wire to one of the pins on the push button side of the tap alert and the other ring wire to the other pin on the push button side If you have a Spring 1996 special location in mind inside the phone jumper wires may be necessary Plug the phone in and see if the LED lights If it doesn t light one of two things has hap pened 1 Your phone line is already tapped 2 You fucked up Case 2 GOTO liquor store get more beer start over Case 1 Disconnect all of your phones and connect your phone line to an electric power cord from an old blender or some thing and plug it into the 120v outlet this should do the trick If NO DIALTONE laugh EXTREMELY HARD To test the circuit pick up your new phone make sure the LED is lit then pick up a second phone on the same line If the LED goes out
33. switchboard and not only was it easier for me to get calling cards I could see exactly who my neigh bors were calling I started keeping files on the neighbors and who they called Oh did I mention that I have no life You may have figured that out already Two months later not much had changed 1 still had the same setup and was working on expanding it 1 added ten more switches to it for extra lines and started wandering around my neighbors yards late at night looking for new possibilities also hooked an old bulky cellular phone into my setup so I could connect neighbors to the cellular roaming network and I added another phone so I could listen in n more than one line at a time without them hear ing each other Spring 1996 The little green telco box on our block was very well secluded It sat near some bushes in the alley behind my house about three houses over The only problem with it was that it was sitting right underneath a bright street light I eventually took care of the street light with my pump pellet rifle It took an hour s worth of patience to finally hit it just right but I finally turned it off That being accomplished I went to the hardware store and bought a cable This nifty little cable had 50 separate wires inside of it enough to hook 25 phones to When dark finally came I grabbed my back pack and hiked over to the telco box I opened it and started hooking my phone dialing 1 800 MY ANI IS on
34. the desired number and passcode Interesting things from Bellcore and GTE notes 710 routed calls have priority if other circuits are busy etc On a non priority call like yours or mine the var ious telco carrier networks will try alternate circuit rout ings but only so many A 710 GETS call will allow more than the usual alternate routings NCS stands for National Communications System located in Northern Virginia probably the Pentagon Be as careful when messing with this as you would be messing with any federal installation feds don t have much of a sense of humor anonymous Dear 2600 This is in response to a letter written in the Autumn 1995 issue by FxPigMan The computer you refer to Page 34 2600 Magazine is a Dynatel 655 which is a loop analyzer terminal and it does what you said runs a test on the line but oh my friend this little mini computer can do so much more By just punching in a number such as oh 2600 it will produce a 2600 tone for you 1 like to refer to it as a waterproof laptop sitting on a 12 volt battery it also has a lithium battery This laptop is sold to phone com panies for 5000 Not your average laptop eh Well the place the Dynatel connected to is the Dynatel host computer Here s another number on the Dynatel net work 1 800 801 0139 This is the number for US West There is one for every Baby Bell across the country And about the ANI number the linem
35. the pay phone line and dialed a phone company number that just sat there blank When a guy picked up the phone I played a recording of a dial tone into the phone When he began dialing I stopped the recording and when he finished dialing I played the recording AT amp T Please enter your calling card number now He began to enter his calling card and I came on and talked to him in a really annoying nasal voice Page 14 2600 Magazine Me AT amp T what seems to be the prob lem Him Y m just using my calling card Me Okay what s your calling card number Him gives me his number Me That card s not going through here Do you have another card Him Uh yeah I have my AT amp T call ing card Me Okay let s try that one Him gives me his number Me Okay yep that one s okay Here s your call and fuck you for using AT amp T I had no idea what number he had dialed in the first place so I got an old recording of Tina the phone sex operator and put it on the line Hi this is Tina Are you ready for a hot time The poor guy tried to talk to her and finally realized that it was a recording and hung up I watched him walk down the street and use the phone booth a few blocks away A few days later I bought one of those touch tone decoders It had an LCD display that showed me exactly what digits were being dialed on any line I hooked it up to I hooked this into my
36. the transportable 1 routes it to the handset 8 hour time out 0 to enable software version 8735 and later Not used 0 only Failed page indicator 0 to enable phone beeps when an incoming call is detected but signal conditions prevent com pletion of the call Portable scan 0 for portable 1 for mobile units Digit 2 Digit 3 Digit 4 Digit 5 Digit 6 Digit 7 Digit 8 Illumination Diagnostic Lights up all lights except the green in use light and displays all 8 s The phone is also muted until repowered Call Processing Mode x 0 AMPS x NAMPS x 2 RESERVED x 3 RESERVED x 4 RESERVED x 5 TDMA signalling x 6 TDMA signalling with before decoding TDMA signalling with loopback voice loopback x 7 584 598 604 614 624 638 64 658 66 67 68 69 708 718 728 TBH 74 99 after decoding x 8 TDMA signalling with loopback FACCH after decoding x 9 TDMA forced synchronization Compander On Audio compressor and expander See 39 Compander Off Audio compressor and expander See 38 no function ESN Transfer for Series 1 D M T Mini TAC only Turn On Ringer Audio Path Turn Off Ringer Audio Path Does something doesn t display anything Does something doesn t display anything Identity Transfer Series I Transceivers and some Current Shipping Portables Displays two 3 digit numbers If you keep entering this command repeatedly th
37. to hook 28 lines up to a sin gle phone creating a monster party line of confused people and my calling card list had reached almost 100 numbers That s the most I d ever had all at once Then on Friday the power bill arrived It was an outrageous amount probably because I had a habit of turning on heaters while opening windows leaving lights and my computer on all day etc It didn t seem fair that I should have to pay so much to them especially since I stopped going to work as often so I could sit at home and play operator My neighbors had a recepta cle on their deck that they used to plug in the bug lamp and sometimes a radio I fig ured if they weren t using it all that much I d take advantage of that That night I dug down about a foot where the plug was and cut open a section of the plastic pipe to expose their wires Carefully using rubber gloves and pliers I managed to splice my orange 100 foot extension cord into their line I ran that underground to my basement window and start plugging my large appliances in The refrigerator space heater microwave and electric oven So I walked over to their power meter and peered in to the glass bub ble and noticed the disk was spinning quite rapidly Oh well They owned a pool and deck Obviously they could afford a little more electricity I figured that if they were rich they could probably afford cable TV and I noticed that their cable line was conve niently located next
38. to this was fantasic Each kid would blame it on the other and when I did it to either of the parents they would yell at their kids to quit playing around on the phone Now I was happy and had plenty of things to do with my sparetime which I had a lot of l dbeen using various calling cards Spring 1996 from both of their lines late at night to call bulletin boards for about a month and a half and still Telco Security hadn t called them up questioning them about anything I thought maybe they were just trying to build a case against them and were holding out for more fraud In any case I decided to keep close tabs on their phone calls in case AT amp T called them questioning anything so I d have advance warning to sneak back over and disconnect their lines To help with this I bought a few ofthose cool Radio Shack deals that automatically record all incoming and outgoing calls on your lines so I could keep up with their phone calls while I was at work Then something horrible happened Most of my favorite phone companies around the United States figured out that they were being ripped off big time by peo ple who order calling cards with personal ized pin numbers for other people This security flaw was my major source of calling cards and now they had set it up so if you wanted to do this you needed the victim s social security number Getting their social security number wasn t a super hard task but it sure was a pain in the ass t
39. vocal electronically or verbally Learn the local laws and conditions wherever you are They may be petty and they may be uncon stitutional but if they give an LEO some reason to pay special attention to you watch out Remember what happened to our friend at the convenience store in Haverford Township who did federal time because he attracted the attention of a Haverford Township cop Was he doing something that was illegal when viewed by an LEO driving by I don t know but from accounts I ve read there was some hanging out or maybe a van full of racially disadvantaged males sit ting in the parking lot LEO s look for that kind of thing They also watch gangs of youths hanging around in malls Especially if they in the perception of the LEO are speaking in a weird language or carrying weird devices If you are under 18 or look it pay attention to local curfew laws Pay special attention to vehicle safety parking and driving laws Many people casually violate the speed limit Page 26 2600 Magazine ease through intersections with stop signs without really stopping park on the wrong side of the street drive after drinking too much drive after drinking at all if under age or drive a fast looking car with minor defects cracked windshield broken tail light plastic cover over the license plate LEO s usually ignore these actions unless they become too obvious or they are in the mood to pick on someone T
40. 1 decided to check it outfor myself found my hard drive emits a birdie at 145 150 MHz which actually could be on a comm frequency that they use Particle Man 203 Repression and Hackers Dear 2600 Repressive governments fear open communication Television and radio stations are often the first targets in Spring 1996 military coups Those who have exceptional skills in dealing with communication technology have a special role to play in supporting or opposing repressive rule For example after the coup in Poland in 1981 telecom munications out of the country were cut off for several days The Indonesian government has prevented radio communication between East Timor and the rest of the world since invading and occupying it in 1975 Suppose there is a severe clampdown on dissent in your country Emergency laws are passed limiting free speech Leading dissidents are arrested Surveillance of potential opposition groups is intensified There is a resistance movement using nonviolent methods such as petitions rallies sit ins strikes etc To be effective the resistance needs information on impending arrests information on targets of surveillance information on opposition activities in other parts of the country and reliable information to counter government lies Hackers have skills that could be immensely valuable to the resistance What could hackers do that would be most helpful to a nonviolent opposition to government r
41. 1801 Pennsylvania Ave NW Donald F Evans Washington DC 20006 Vice President Federal Regulatory Affairs July 12 1995 Dear Telecommunications Customer Based on a review of publicly available records at the Federal Communications Commission I understand that you recently experienced a problem trying to place an operator assisted call from a pay phone or hotel phone MCI requested information from the FCC about such complaints solely for the purpose of esnding this letter and sharing our thoughts about a pro consurner solution to the problem you experienced When a customer uses a calling card or requires operator assistance from a pay phone it s reasonable to expect the call to go through your own long distance company But the fact is that such calls can be routed through a company that you ve never even heard of and at a different rate than you expected to pay The reason is that when you dial 0 to make an operator aasisted call you get an operator services company chosen not by you but by the owner of the place from which you are calling for example a hotel or airport There is a remedy for this problem and the FCC has the authority to require the nation s telephone companies to use it The remedy is called billed party preference This simply means that if you re the one paying for the call then you select the company that carries it No extra digits are required The system recognizes your billing information and rou
42. 26 47 Set RX Audio level to X 76 5 49 198 0 68 319 5 127 For FI9CTA Series Tranceivers 81 0 50 202 5 69 324 0 104 X 0 Lowest Volume 85 5 51 207 0 70 328 5 105 X 6 Highest Volume 90 0 52 211 5 71 333 0 106 X 7 mute 94 5 53 216 0 80 337 5 107 Normal setting is 4 99 0 54 220 5 81 342 0 108 For D M T Mini TAC Tranceivers 103 5 55 225 0 82 346 5 109 X 0 Lowest Volume 108 0 56 229 5 83 351 0 110 X 7 Highest Volume 112 5 57 234 0 84 355 5 111 Normal setting is 4 117 0 58 238 5 85 360 0 70 For TDMA Tranceivers and FO9F Series and Higher Portables 53 Enable scrambler option when equipped X 0 Lowest Volume 54 Disable scrambler option when equipped X 15 Highest Volume 55 Display Program N A M Test Mode Normal setting is 2 to 4 On TDMA trans Programming ceivers and Micro TAC portables settings 8 through 15 are for DTMF applications only Test Mode Programming 484 Side Tone On Use this command in conjunc The following steps are for software version tion with 350 to test the entire audio path in 9308 and older If you have a newer phone hands free applications they will most likely be different The newer 49 Side Tone Off phones with Caller ID are for sure Send me 508 Maintenance data is transmitted and test the new programming steps so I can update results displayed these 1 don t want to hear that they were PASS received data is correct wrong unles
43. 3 0099 Spring 1996 PAPARAZZI HACKERS HACKERS 95 hy Phon E and R Burns 34 95 29 through web site http www rockpile com security hackervid him Custom Video Produc tion 15 Lakeshore Drive Middletown NJ 07701 55 shipping outside L S Pal Secam 10 extra Review by Bine Whale A BOranh HACKERS VE pem wld be Pee Hackers 95 is not the first independently pro duced video depicting meal hackers but t may be one of thes m s accessible Typically hacker videos are rarities that debut at hacker conventions oa Select audi ence of peers following which the videos promptly disappear for the five or so years needed fomthe statute of limitations to absolve everyone involved ofany thing they may be guilty of Thus one is not like ty to find a video of hackers performing their rafi at the local video store But Phon E amp R F Burns Offer their video dir ctto you tor 8 price Hackers 95 is divided into roughly six parts Part one depicts two casual interviews actually more like mono 1 loguesy one with former Legion of Doom member Chris Gopgans aka Erik in depicted events Fortunately Hackers 95 includes a wide range of top ics that Should offer some thing for everyone The production quality of Hackers 95 falls some where between your aver age high school orchestra Cybersnare If some or all of this sounds tinfamiliar
44. 495 Florida 495 503 325 0861 Bootleg Software 392 Alameda Astoria OR 97103 6 5536 MHZ CRYSTALS available in these quan tities ONLY 5 for 20 10 for only 35 25 for 75 50 for 125 100 for 220 200 for only 400 2 each Crystals are POSTPAID All orders from out side U S add 12 per order in U S funds For other quantities include phone number and needs E Newman 6040 Blvd East Suite 19N West New York NJ 07093 FREE MONEY Yes this method works You can actually get money from money changing machines Page 48 2600 Magazine without actually breaking into them Other products such as HOW TO GET FREE ELECTRICITY and How to Beat the Bill Collectors All of the methods we send out work AND you can actually change your fingerprints This method has helped others make their move on society You can too Send SASE and 10 to cover expenses Refunded on any order Write to Alan PO Box 800066 Houston TX 77280 0066 SELLING MICROSOFT OFFICE 95 PROFES SIONAL for 175 brand new Microsoft Windows 95 training videos all levels starting from 39 95 and up Call InterSoft Development Group Inc at 847 679 7252 CAP N CRUNCH WHISTLES Brand new only a fewleft THE ORIGINAL WHISTLE in mint condi tion never used Join the elite few who own this trea sure Once they are gone that is it there are no more Keychain hole for keyring Identify yourselfat meetings etc as a 2600 member by dangling you
45. Dr No pitifully embarrassed myself and the magazine 2600 with this plagirized arti cle Why you might ask hmm that is tough Who knows what goes on in a young persons head when such an easy thing can be done I guess i wished i were in the spotlight Although i did plagirize i also did do research on this topic I regret what i have done i was not trying to take anything away from Emery W Lapinski but just try to spread knowledge in a quite interesting way So i must apologize officially to Emery W Lapinski 2600 Magizine and the entire hacker information seeker community for this fraudu lent act all i can say is that i was nieve and disrespect ful and i have no excuse That is that Regretfully Dr No It s hard for us to imagine how someone could send in an article written by another person and claim it as theirs With tens of thousands of readers around the world the odds of getting away with it are pretty slim In our 12 vears of publishing this is the first case of this that has come to our attention Since its not possible for us to know if an article has been lifted from somebody or someplace outside of the hacker world we rely on the honesty of our writers and the vigilance of our readers We re sorry this had to happen and we will do every thing in our power to keep this kind of thing out of our pages Immortalize Yourself Send your letters to 2600 Editorial Dept PO Box 99 Middle Island NY 1195
46. Hz x 770Hz x 12 852Hz x 13 941 Hz x 14 1150 HZ not used in cellular x 15 1209 Hz x 16 1336 Hz x 17 1477 Hz x 18 1633 Hz not used in cellular x 19 Turn DTMF off x 20 2087 Hz x 21 2308 Hz x 22 2553 Hz not used in cellular x 23 Turn DTMF off x 24 3428 Hz not used in cellular x 25 3636 Hz not used in cellular x 26 4000 Hz not used in cellular x 27 3555 Hz not used in cellular x 28 4571 Hz not used in cellular x 29 Turn DTMF off Someone please check out 24 thru 28 for accuracy had weak equipment Turn DTMF Off Display RSSI D Series Portable Only or 35x 36nnn 37 38 39 39 2600 Magazine Set Audio Path to x x 0 VS P Microphone applies to mobiles only x Speaker x 2 Alert x 3 Handset x 4 Mute x 5 External Telephone applies to porta bles only x 6 External Handset applies to newer portables Scan TDMA telephones only Scans the pri mary control channels and attempts to deci pher the forward data stream The display will show PASSI if the strongest control channel was accessed PASS2 if the second strongest was accessed and FAIL if no control channel could be accessed nnn Scan speed in milliseconds Tunes from channel 1 to 666 in order Entering a pauses the scan and displays current Channel Number and RSSI reading AAA Channel Number and BBB RSSI Reading When scan speed is 300 milliseconds or greater the current s
47. ID 10 IN USA SECURITY CODE LOCK CODE SERVICE LEVEL SEE NOTE 3 BELOW OPTION PROGRAMMING SEE NOTE 4 BELOW OPTION PROGRAMMING SEE NOTE 5 BELOW INITIAL PAGING CHANNEL A SYSTEM IPCH B SYSTEM IPCH DEDICATED PAGING CHANNELS 021 IN USA SECONDARY INITIAL PAGING CHANNEL 708 for system A 737 for system B Allows the TDMA telephone to be assigned to a TDMA channel in a call SECONDARY INITIAL PAGING CHANNEL FOR SYSTEM A SECONDARY INITIAL PAGING CHANNEL FOR SYSTEM B OPTION PROGRAMMING SEE NOTE 6 BELOW Page 45 NOTES Take care with Motorola s use of 0 and 1 Some options use 0 to enable some use 1 These are eight digit binary fields used to select the following options I step 02 above suggested entry is 11101001 for A system 10101001 for B sys Digit Local use mark 0 or 1 Digit2 Preferred system 1 system A 0 system B Digit 3 End to end DTMF dialing 1 to enable Digit 4 Not used enter 0 Formerly used for test mobile Digit 5 Repertory speed dialing 1 to enable Not used in TDMA by clearing locations 01 02 and 03 and place the phone in servicing level 001 In some phones this applies to memory locations 01 10 The telephone will dial only numbers from memory locations The keypad is disabled and super speed dialing is not enabled Keypad dial only no memory recall allowed Unlimited keypad and memory dial ing DEFAULT
48. If you have enabled the second phone number bit in step 10 below then pressing SND will switch to NAM 2 Steps 01 thru 06 09 and 10 will repeat for NAM 2 the step number will be followed by a 2 to indicate NAM twoT 6 The CLR key will revert the display to the previ ously stored data 7 The key will abort programing at any time Programming Data Step digits range Description 1 00000 32767 SYSTEM ID 2 3 DIGITS AREA CODE 3 7 DIGITS TEL NUMBER 4 2 DIGITS STATION CLASS MARK 5 2 DIGITS ACCESS OVERLOAD CLASS 6 2 DIGITS GROUP ID 10 IN USA 7 6 DIGITS SECURITY CODE 8 3 DIGITS LOCK CODE 9 0333 OR 0334 INITIAL PAGING CHANNEL 10 6 DIGIT OPTION PROGRAM BINARY MING SEE NOTE 1 11 3 DIGIT OPTION PROGRAM BINARY MING SEE NOTE 2 Take care with Motorola s use of 0 and 1 Some options use 0 to enable some use 1 NOTE I This is a 6 digit binary field used to select the following options Digit 1 Internal handset speaker 0 to enable Digit 2 Local Use Mark 0 or 1 Digit 3 MIN Mark 0 or 1 Digit 4 Auto Recall always set to I enabled Digit 5 Second phone number not all phones I to enable Digit 6 Diversity two antennas not all phones 1 to enable On newer models they have added and changed some numbers As of the 3 27 92 manual the 6 digit binary field is still the same NOTE 2 This is a 3 digit binary field used to select the following options Digit 1 Continuo
49. We recently received this letter from a justifiably upset reader Dear 2600 The most recent Issue of 2600 contains an article entitled Understanding Verifone Machines attributed to Dr No on the Verifone credit card authorization machine Volume 12 Number 4 Winter 1995 96 pps 22 24 Except for the first and last paragraph this arti cle is a verbatim duplication of an article I wrote and published including ASCII diagrams under my own name to althackers in 1992 entitled Credit Card Authorization Machines My article was later pub lished in Issue 03 of the e zine Informatik available at Page 52 2600 Magazine http www eff org pub Publications E journals CuD and hacker zines Inform inform 3 gz and at other archives I do not now go by nor have I ever gone by nor do I intend to go by the pseudonym Dr No Furthermore to the best of my knowledge have never conversed with anyone calling themselves Dr No My permission was neither sought nor obtained for the publication of this article in 2600 I hereby demand public apologies retractions cor rections from those parties who perpetrated this fraud I also request that these apologies appear as prominently as the plagiarized article in the next issue of 2600 mag azine Emery W Lapinski ewl panix com We contacted the author of this article and got the following response emmanuel and the entire staff of 2600 i must admit that i
50. afe 1260 North Dearborn Cincinnati Kenwood Town Center food court Cleveland Coventry Arabica Cleveland Heights back room smoking section Columbia SC Richland Fashion Mall 2nd level food court by the payphones in the smoking section 6 pm Columbus OH City Center lower level near the payphones Dallas Mama s Pizza northeast comer of Campbell Rd and Preston Rd in North Dallas first floor of the two story strip section 7 pm Payphone 214 931 3850 Houston Food court under the stairs in Galleria 2 next to McDonalds lowa City IA Fourth floor of Pappajohn Business Administration Building by the pay phones near the Eleanor Birch conference room Kansas City Food court at the Oak Park Mall in Overland Park Kansas Los Angeles Union Station corner of Macy amp Alameda Inside main entrance by bank of phones Payphones 213 972 9519 9520 625 9923 9924 Louisville KY The Mall St Matthew s food court Madison WI Union South 227 S Randall St on the main level by the payphones Payphone numbers 608 251 9746 9914 9916 9923 Meriden CT Meriden Square Mall Food Court 6 pm Nashville Bean Central Cafe intersection of West End Ave and 29th Ave S three blocks west of Vanderbilt campus New Orleans Food Court of Lakeside Shopping Center by Cafe du Monde Payphones 504 835 8769 8778 and 8833 good luck getting around the carrier NewYork City Citicorp Center in the lobby near the payphones 153 E
51. ail cell where there are no secret levers to get you outta there Whenever I see one of these registers in a store or restaurant 1 always ask the clerk if they know about the secret way to open the register They never do 1 have never met anyone working at a store or restau rant who knew about the hidden lever Usually they express disbelief until 1 demonstrate how easy it is for me to slide my fingers underneath and give the lever a push The instruction manual for the register explains the lever as a way to open the cash drawer when Spring 1996 2600 Magazine power failure is encountered or the machine becomes out of order The brief and grammatically incorrect paragraph describing the lever is pushed all the way to the back of the manual almost on the last page and is given under the unassuming title Opening the Drawer By Hand If you ever open one of these reg isters you can find the instruction manual hidden underneath the till After opening the cash drawer you will see the compartmentalized till which has sections for different money denominations and Coins Lift out the till slightly to reveal the manual and possibly other goodies underneath Protecting the Lever Sometimes a store will install its cash register in such a way that you cannot slide your fingers under neath to access the lever For instance the register may be protected by a raised portion of the counter In one library I saw pieces of metal bolt
52. al document these give a clue to what information is missing and what shred patterns to look for to complete it Obviously there are many uses for such a simple technique even in this informa tion age of the brave new world order But it isn t foolproof You may see coffee grounds mixed in with the bag used cat lit ter and even lunch waste mixed with the shreds The targets who do that are proba bly well aware of this reconstruction tech nique and will expect your forays into their dumpster Their other main defense sub terfuge and decoy is even more effective They simply increase the shred volume to include everything available and overflow the sorting capacity of the reconstruction ist Or they salt the real shredded informa tion with errors and omissions even fake derogatory documents to elicit a revealing admission from the snoop Burning is best but is not legal in many urban areas Even when it s legal it s expensive it requires safety equipment and personnel supervising every moment of the burn The military however prefers fire and flushing to any alternative When it absolutely positively has to disappear overnight fire and water should be your choice too Extra Assignment for the Artful Programmer Who needs this headache and tedium Anyone who needs the data would have to give up their job or their social life to have time for reconstruction Why not let a com puter do it Of course
53. an gave you 1 would be willing to bet it s not good anymore They change them every month One other note about the Dynatel since every unit is networked and you need a password for them it s useless to acquire one of them As soon as they come up missing even if you do know the password they get taken off the network They can still perform some functions but the point in having one would be so you could explore the vast possibilities This would be hard to do with a crippled 655 PhreakHolio Colorado Springs Dear 2600 used a trick I found in an old issue A laundromat near my place has an old bill coin changer so 1 photo copied a 10 bill and fed it in the slot 1 made myself about 200 The guy who owns the place must be on glue cause he hasn t caught on yet Whenever I m broke just photocopy 10 bills and take em down and get the quarters then take the change to the arcade and get bills Also for anyone travelling in Vancouver Canada the phony bills also work in the Skytrain termi nals a great way to travel for almost free Also if you buy a zone fare with a 10 you get 8 50 change Thanks guys I love my 2600 The Mighty Pantharen N Vancouver Canada Let s get this straight You re photocopying money telling everyone in the world about it announcing your location and going back to the same places wondering why nobody 5 catching on And on top of all that vou re saying that we were the inspi
54. as extradited from Los Angeles to New Jersey in order to stand trial During my two week journey was incarcerated with a few hack ers including Agent Steal and Kevin Mitnick Although I cannot talk specifically about my case now I can say it is amazing how small the government s knowledge is regarding computers and hacking One example is that on one of the computers they found a text file of FTP sites They are trying to figure a loss value of 500 per site 73 000 for the file Excuse me loss value of what Did ftp cso uiuc edu exec pc lose money some how In any case hopefully I will be free sometime around January of 1997 I m currently being held in a 100 year old jail similar to Alcatraz which is a total intellectual waste land 1 would appreciate it if you could post my address or forward it to someone who could Any letters print outs etc would be greatly appreciated Jeremy G Cushing 63366 Union County Jail 15 Elizabethtown Plaza Elizabeth NJ 07207 TS We wish you luck and encourage people to send mail since prison can be a very lonely and mentally Page 32 2600 Magazine crippling environment While we don t know particulars about your specific case we do know that many ques tions are being raised about the Celco 51 sting opera tion of 1995 In particular we have heard numerous reports of the informant you mentioned appearing at 2600 meetings trying to get people to commit crimes We know this is
55. at they could provide It makes a great playground for phreakers at least in places other than Anchorage and who knows maybe we could have some con up here sometime It would be scary but funny watching all of you driving the Alaskan Canadian Highway Page 25 AUR QESe du by Me Have you noticed that there are certain members of our segment of society who seem to attract trou ble They seem to get caught need to mount legal defense funds and ask for help from different pro fessional societies Please understand that this is not a flame or personal attack on any individual group or collection of individuals who have gotten into trouble this is a how not to analysis I define trouble as having special attention paid to one s self by members of law enforcement at any level For purposes of this article I don t care whether certain laws are just proper constitutional or right I also don t care if the actions suspicions or tactics of law enforcement are proper 1 want to help the reader that s you avoid their attention The bottom line is that if you are going to be doing something illegal you must avoid at all costs the attention of Law Enforcement Officers LEO cops or feds I also use the term for departments or agencies The other thing to avoid is publicity that can come from formal news media attaching ones name to viruses or malicious attacks to systems writing for paper or e zines or being very
56. ble any standard shape The second main point I would like to correct is about sneaking down into the tunnels the correct name is utilidoors It would be very stupid to go into the doors that Dr Delam mentioned because this is one of the ones with the most traffic It would be a lot smarter although quite stupid to try and sneak down at all to go Page 50 2600 Magazine down in the doors by Liberty Square behind the silver smith s shop in the Pocahontas Cove area Very little traffic back there Even if you did get down without anyone asking you questions you very likely would not go more than 50 feet without being apprehended The castmembers not actors as the author said do wear nametags and you would be questioned very quickly take this from someone who was escorted down numer ous times by castmembers The computer control room is nowhere near where Dr Delam said it was and there is no security device like the one described on the door A numerical keypad yes but a hand print reader No Another fact that he got wrong was the job inter view These do not take place in any of the parks These take place in the casting center a rather large building by Pleasure Island The only time you would get taken into the park would be after you are hired and that would be for training Finally there are a lot less sur veillance cameras than people think and a lot more undercover security people If anyone is interest
57. d and not making eye contact Guilty Or are you sit ting forward hands down looking at them when they speak Innocent But most importantly is they way in which you profess your innocence Almost all guilty people start out denying that they did it A guilty person will start out vigorously denying the allegations Then slowly that vigor begins to decline until they are just sitting there quietly looking at the floor listening to the interrogator outline the charges and maybe bogus evidence until finally they confess while looking down at their lap An innocent person however begins much the same way denying their involvement maybe even laughing at the suggestion Then as the interview con tinues while a guilty person gets quieter an innocent person continues to deny the 2600 Magazine Page 29 allegations or they become even more adamant in pro fessing their innocence They start by saying no then after an hour they pound the table and after two or three hours throw a chair against the wall Never anywhere near a police officer this will get you in trouble guar anteed If you follow this pattern the investigators will come out of the interview room scratching their heads saying Gee maybe he really is innocent But remem ber never never let on that you know this information If they know that you know about these patterns of denial then all bets are off as far as convincing them of your innocence Rob
58. d locate the 12 contacts at the top near the antenna connector These contacts are numbered 1 through 12 from top left through bottom right Pin 6 topright is the Manual Test Mode Pin You must ground this pin while powering up the phone Pin 7 lower left or the antenna connector should be used for ground Follow one of these proce dures to gain access to pin 6 1 The top section of the battery that covers the con tacts contains nothing but air By careful measuring you can drill a small hole in the battery to gain access to pin 6 Alternately simply cut the top off the battery with a hack saw Having gained access use a paper clip to Short pin six to the antenna connector ground while powering up the phone 2 If you do not want to destroy a battery you can apply an external 7 5 volts to the and connectors at the bottom of the phone ground pin 6 while powering up the phone as above 3 You can also try soldering or jamming a small jumper between pins 6 and 7 top right to lower left or between pin 6 and the antenna connector housing ground Carefully replace the battery and power up the phone Use caution with this method not to short out any other pin 4 A cigarette lighter adapter if you have one also makes a great test mode adapter as it can be disassem bled to give you easier access to pin 6 Many are pre marked or even have holes in the right location This is because they are often stamped from the same mold t
59. e weapons science survival cellular hacking cyberspace The price is 29 95 shipping Write to X Philes Tranbaersvaegen 25 14 37238 Ronneby Sweden Email dt93tn pt hk r se http www algonet se synchron for more information THE WHACKED MAC ARCHIVES CD This CD includes almost 200 different files and utilities including war dialers virri phreaking utilities text files cracking utilities and much much more Everything you need to get your Mac completely Whacked This collection will be especially useful to all Macintosh users network administrators hackers computer security professionals phreakers computer teachers crackers lab monitors virus writers communication specialists and anyone who deals with Macintosh systems on a day to day basis If you have been searching f or that hard to find util ity or program you can probably find it on the Whacked Mac Archives To learn more about the CD and who we are check out http www l0pht com spacerog index html To order your own Limited Edition copy of the Whacked Mac Archives please send name address postal code and country to The Whacked Mac Archives c o LOphT Heavy Industries PO Box 990857 Boston MA USA 02199 0857 Please include 19 95 plus 4 50 for shipping and handling in United States dollars for each CD ordered We will ship anywhere Spring 1996 2600 Magazine in the world via First Class U S Mail Cash checks or money orders accepted sor
60. e first number will constantly change the second won t as far as I have seen Display FLEX and Model Information Used with Identity Transfer Abbreviated field transmitter audio deviation command for transceivers with FCC ID ABZ89FT5668 Abbreviated field power adjustment com mand for transceivers with FCC ID ABZ89FT5668 Field audio phasing commands The left side of the display should read 00 followed by a two digit number The 00 indicates the first programming step If you press the the 00 changes to 01 and so on until 08 The 06 and 0A are used to change the audio level to change press the volume up or down keys Other registers don t know Field power adjustment command no function Commands 74 75 76 77 78 80 and 99 actu ally have unknown functions As new phones come out more commands are added deleted as needed The majority of these commands were figured using very old software versions Some commands won t work on some phones If you find a command that does some thing please inform me as well as the software version number of the phone it was discovered on The author can be emailed at Mike Larsen bbs uti com 2600 Magazine Page 47 Happenings ACCESS ALL AREAS II Computer Security amp Hacking Conference July 6th and 7th 1996 London UK Aimed at computer hackers phone phreaks computer security professionals cyberpunks law enforcement o
61. e full descriptions under TEST MODE COMMANDS 3248 Clears the telephone Older Motorola allowed either three or fifteen changes in the MIN After that the phone had to be sent to Motorola to reset the counter This is the com mand they use Displays the ESN This is the TEST MODE PROGRAMMING as described below 388 55s Test Mode Commands 4 Enter Test Command Mode 004 no function 014 Restart Re enter DC power start up routine On TDMA telephones this command has the same effect as pressing the PWR button Lock Unlock Procedures 024 Display Current Telephone Status This is a Phones with LOCK buttons Press LOCK for at non altering version of the STATUS DIS least half a second PLAY On a 14 character display all the infor Phones with an FCN button Press FCN 5 note that mation is shown On a 7 character display 5 has the letters J K and L for lock only the information on the second line of a Phones with no FCN or LOCK button Press 14 character display is shown On a 10 char Control 5 control is the black volume button on the side acter display all the information on the sec of the handset ond line ofa 14 character display plus the last three characters of the first line are shown System Select Procedures STATUS DISPLAY alternates between Phones with a RCL button press RCL then to AAA Channel Number decimal select STO to store BBB RSSI reading for channel Phones with no RCL button press Control
62. eally did live in Celina Ohio alone and bored for a few months and ran up quite a hefty phone bill It was my own bill though I really hope this article is an inspiration to all and hope that the Celina Police will stop looking for those kids in the boatyard after they read this ANNOUNCING THE 1996 2600 INTERNET SEARCH The goal is simple Find the oldest computer system hooked into the Internet It could be a UNIVAC Or a DEC 10 Maybe a Timex Sinclair Who knows The only way to find out is to start searching If you re the first one to find an ancient system and it stays on the net throughout 1996 you ll win a lifetime sub scription to 2600 You can even set up your own archaic system but you have to keep it on the net it has to be the oldest system report ed to us and in the event of a tie you have to be the first one reporting it If you come under federal indictment for attacking the machine you find it could affect your chances of winning Send entries to 2600 Ancient Computers PO Box 99 Middle Island NY 11953 or email contest 2600 com Spring 1996 Kites by Loogie Mostschools use Macintosh computers because they are easy to use and schools can get them at great discounts Well most of the teachers are old farts and the ENIAC wasn t even around when they were young so they have no clue how to use com puters Our generation has grown up in the comput er age a
63. ecent area code reat hapless telephone users ANAC number is now 107 discovered this by now b does anyone know the p phone number The seq m tone 0000000001 year subscription from Eastern Europe fe fo us and ask for one No email no faxes in You d be amazed how few people put in he Winter 1995 1 996 ess others have ick note anyways By the way fted by the ANAC after my Thanks for the update Unless Oni come in with that number on it so this could be a toll pen call though not Rom payphones The numbers following the readout remain a mystery Points on Interrogation Dear 2600 read your mag regularly and find the information timely useful and fun 1 do however take major exception to the Autumn 1995 article Hacking a Police Interrogation by Darlo Okasi While there are some good points much of the information presented is flat out wrong and dangerous Darlo makes a point that the reader should try to be in control of the interrogation You are not in control That is what an interrogation is all about If you challenge the control of a natural con trol freak the cops you put yourself in jeopardy If your readers were to put these Page 28 2600 Magazine principles into practice they risk being locked up for extended periods of time on no charges Against the law you say The cops will say Sue us and even if you do it will take years and thousands to settle Darlo is fond of e
64. ed in a real hacking Disney article 1 was considering writing one detailing the workings of their huge VMB system in place at their resort Anyone interested The Imagineer No article that we have ever printed has resulted in such empassioned and emotional responses We never cease to be amazed by the power of Disney An Edward A Smith Theory Dear 2600 In the Autumn 1995 issue letters column pbixby writes of the AT amp T cable ship Edward A Smith with an editorial comment about its reserved exchange in the 500 area code I d like to speculate about the purpose of assigning the exchange to the ship It seems logical to have a permanently assigned exchange that will follow the ship no matter where it goes After all won t the cable the ship lays need to be tested If so having a reserved exchange would be extremely convenient for this purpose No matter where in the world the ship was operating there would be a phone number that could be routed through the cable being laid thus providing a ready made test circuit If this is true it would be inter esting to see what could be done by dialing numbers in the Edward A Smith s exchange some guy Cincinnati Bell Nightmare Dear 2600 Recently 1 had two new phone lines added to my house bringing me up to a total of four But the phone company Cincinnati Bell had a few surprises for me when they added them They told me that in order to add the new phone lines they w
65. ed to the countertop as a protective measure against finger insertions There is another way in which the lever can be foiled if the supervisor locks the cash drawer with the key then it will not open It is rare however to find a locked cash drawer especially during the day when people are coming into the store to buy stuff The vast majority of the registers I ve seen were freely accessible to anyone who knew about the lever Conclusion One time 1 was in a music store that used one of these registers and the cashier was talking to his friend who was leaning against the counter The friend happened to bang his elbow on the cash regis ter and the drawer flung open of its own accord The two were surprised as was 1 but 1 also knew what had happened the shock of his arm had conducted to thelever which got rattled back and caused the draw er to fling open The ER 3100 is a good cash register easy to use highly programmable and expandable But it does have this one problem If you use this model in your store you should make sure the back is closed off so customers cannot slide fingers underneath Either put up a piece of wood or metal in front of the register or lower the register into a niche or put it up against a wall Another alternative is to put a big piece of duct tape over the hole in the bottom of the register Page 19 HACKING DODR by Clark W Griswold thought it would be fun to share some interesting
66. embly C and Visual BASIC but would like to know some hacking and phreaking basics Will the people there be willing to teach me or just let me listen to their conversations Skywarp There s usuallv somebody around with a 2600 shirt on Ages vary from 10 to mid 705 Avoid people outside that range We re very informal so you don t have to worry about protocol If vou don t act like an idiot and aren t committing crimes you should have no problem being acce pted for who you are Good luck Dear 2600 In the summer 1994 issue of 2600 volume eleven number two at the bottom of page 17 is an announce ment indicating 2600 is on line through IRC channel 2600 the 26th of each month Is this still in effect My service offers IRC access In order for me to successful ly connect with 2600 do I need to specify a port number or will 1 connect through the system s default port con nection 6667 Thank you for an excellent publication Frank M Any public IRC server should get vou into the IRC world we all inhabit The 2600 channel has sort of developed a life of its own and 8 no longer controlled by us Such is the nature of IRC You will on occasion find 2600 people wandering in and out of the channel Info Dear 2600 Item of possible interest 710 NPA belongs to feds Previously 1 have never been able to reach a number in 710 from the POTS network 710 NCS GETS 710 627 4387 results in a new dialtone with a request to enter
67. enced Bernie S to 6 24 months double the sentence of someone convicted of attempted murder in the same district Under the law he should be released on May 30 but the Secret Service may attempt to impose even more suffer ing on him by seeking to have that extended Throughout this entire escapade the Secret Service has said in every court appearance that some of the most disturbing evidence they found in Bernie s possession was information on the Secret Service themselves frequencies address es codenames and pictures that had been on a television show Special Agent Thomas Varney has said under oath that any reasonable person would view this evidence as proof that Bernie S was a threat to society And this assumption was accepted by law enforcement the legal system the media and ultimately the public We decided to check into this We found that all of this information was completely legal and available to the public And to emphasize the point we made all of it and more available on our web page The reaction was phenomenal an average of around 1 000 visitors a day And the irony was delightful because the Secret Service overreacted at one person s possession of this material millions of people around the world now had easy access to it It may not have been Spring 1996 2600 Magazine enough to get Bernie S freed but it was enough to get his story into newspapers around the world and have the real issues of the
68. epression What could and should be done beforehand to make it more difficult for a government to repress dissent What is likely to encourage hackers to supportthe resis tance rather than perhaps due to bribes or threats sup port the repressive government For some years I ve been studying nonviolent resis tance to repression but have only just scratched the sur face Suggestions would be most welcome Brian Martin Australia AOL Hell Dear 2600 I have been subscribed to Netcom now for a pretty long time and have been pretty satisfied with their ser vice Recently I have been absolutely deluged with free disks from AOL in virtually everything I buy So I thought I would give them a try to find out why so many people have such hate for AOL and its users Well signed on and quickly realized that the AOL interface was a lot more glitter than actual functionality This is when the real trouble started I tried to cancel my account online and was presented with the message to cancel your account please call or write to AOL O K No problem right Wrong 1 called the 800 number and was sent into their voice mail system When you first call you are presented with two choices 1 To order free software press one 2 to can cel your account press two So I pressed two and was told by a recorded voice that the current wait to talk to a customer service representative was a half hour I hung up and assumed that they must be busy
69. ered illegally pulling you over without reason or searching your trunk illegally Even if the courts throw out everything from that LEO acting improperly they can still use the information gath ered to look into your life further If you were carry ing alaptopin yourtrunk and it was confiscated they would search the disks even if they could not use the evidence on the disk they could use the information to investigate further Do you have a copy of Phrack laying around Do you have any codes or an Elite BBS in your terminal emulator dialer directory Any cracked or pirated software How about TBBOM Yes Then they have more reason to watch you and gather evidence You have given the LEO what they need most probable cause Probable cause is a legal term defined as Reasonable grounds for belief that an accused person is guilty as charged by the American Heritage Dictionary It means that you have given them reason to believe that an illegal activity has or is occurring It is the requirement for the issuance of search warrants arrest warrants sub poenas of financial and telephone records and for wiretaps When they catch you saying e mailing or down loading something that violates some law then you are one of those dangerous hackers and should be Spring 1996 2600 Magazine thrown away to protect society before you decide to launch nuclear warheads at Washington DC or steal credit card numbers and charge 1 000 000 t
70. ervice Now let s get down to basics about this article One Credentials Services is not part of TRW Granted it is a business TRW started but it was sold to an independent company back in October 1994 Two You fail to explain the rest of the pitch and that is that Credentials will remove your name from mailing lists from all major bureaus and keep your name address and phone number from being added to any mailing lists that the major three bureaus sell Three The letters you can send to telemarketers is one to deter them from continuing to contact you It does work because you have pre warned them not to contact them Four It kind of bothers me that your zine claims to be informative about things others need to be informed of But you have an even larger problem when you a don t research your periodicals and b purpose fully edit the information to suit your needs Just for your knowledge I work for Credentials and used to work for TRW If you have any questions about any of our services please contact us Gebby It seems hard to believe that a credit agency can successfully launch a consumer group whose job it is to keep credit agencies in check You ll forgive us if we remain skeptical about Credentials objectivity continued on page 50 S Page 37 Motorola Cellular Guide by Mike Larsen After much deliberation I decided to include infor mation about Motorola s pagers and their test mode commands Since pagers aren t
71. fficials net surfers programmers and the computer underground It will be a chance for all sides of the computer world to get together discuss major issues learn new tricks educate others and meet The Enemy For further information contact one of the following web http www access org uk email aaa info access org uk fax 44 0 1428 727 100 phone 44 0 973 500 202 DEF CON IV July 26 28 1996 at the Monte Carlo Hotel in Las Vegas Among the fun activities planned Hacker Jeopardy Capture The Flag hack ing contest Email dtangent defcon org website http www defcon org phone 206 626 2526 write 2709 E Madison Seattle WA 98112 30 in advance 40 at the door For Sale CONTRIBUTE TO THE WALTER FUND Since being hit by a car in October the 2600 mascot has been featured on the Winter cover has had over 10 000 visits to his web page and most important ly has gotten back onto his feet You can help lessen the weight of his medical bills by getting an official Walter t shirt for 20 We ll even throw in a free HOPE shirt from the 1994 hacker conference Send cash or make checks payable to cash 2600 Walter Fund PO Box 848 Middle Island NY 11953 Check Walter s progress on the 2600 web site www 2600 com or finger walter 2600 com for the latest update If you already contributed and you want a HOPE shirt just contact us DMV 96 Department of Motor Vehicles databases on CD Rom Oregon 219 Texas
72. has any type of cellular monitoring software that is PC based using a scanner and or Motorola Bag phone email me immediately General User Info Before getting into the programming of the cellular phone it is important for the user to know the normal things necessary for day to day operation While the majority of the stuff in the user s manual is intended for people who have problems programming their VCR there are a few things that are very important and are only mentioned in the users manual I would like to add that while I have extensively worked on finding additional test mode commands 1 nor anyone else have never worked with the normal operation commands as listed in the sidebar For exam ple you will notice sequences with 1 or Fen 0 7 This is totally unexplored teritory Happy hack ing See entering test mode on the new 95xx phones Page 38 2600 Magazine Programming Info Some units have dual NAM s The ESN prefix is 130 decimal 82 hex Motorola can be reached at 1 800 331 6456 There are many different models of Motorola phones sold under various brand names if you think it s a Motorola it probably is Determine which access sequence to use Hand Held Portable Models If the phone has an FCN button and no MENU but ton use sequence 1 Ifthe phone has no FCN button use sequence 2 If the phone has a MENU button and an FCN but ton use sequence 4 Installed Mobile Phones and Tran
73. hat the manufacturer uses for making hands free adapter kits and these kits require access to the phone s connectors Ultra Classic II Series Ground Pin 2 to pin 4 Micro Tac Flip Series This phone follows similar methods as outlined for the 8000 series above Remove the battery and locate the three contacts at the bottom of the phone The two outer contacts are raised and connect with the battery The center contact is recessed This is the Manual Test Mode connector Spring 1996 Now look at the battery contacts The two outer ones supply power to the phone The center contact is an extra ground This ground needs to be shorted to the test mode connector on the phone The easiest way to do this is to put a small piece of solder wick wire alu minum foil or any other conductive material into the recess on the phone Having done this carefully replace the battery and turn on the power If you have been suc cessful the phone will wake up in test mode Handsets Most Motorola handsets are interchangeable when a handset is used with a transceiver other than the one it was designed for the display will show LOANER Some features and buttons may not work for instance if the original handset did not have an RCL or STO but ton and the replacement does you will have to use the control or control sequence to access memory and AJB system select procedures ming and registering the telephone for service se
74. hat if you cooperate you will get a lesser sentence The truth of the mat ter is that the police do not have the power to grant you immunity from prosecution or lessen your sentence in any way only the district attorney can do this One can 4 houtany charges ever being brought it is a privilege in most img arrested since you defi at brings me to another dawyer Keep your mouth icracking the case Plus inst you at a later date record or videotape the ipermission ou is don t do anything you caught System Default Dear 2600 I would like to comment on Darl Interrogation in the Autumn 1995 issue C what police do during an interrogation grea sing innocent In the article Okasi cori hey want in an attempt to get yi e Hacking a Police ight that understanding our ability to come out that the police can say Your confession is of note that in the area of committed the act the ne let alone prove that iyou say can and will be o you There may be a ey can say they have o fingerprints bloody the evidence they say re the guy Lying about son will not confess no have the evidence then in court The best piece 5 have the right to remain few idealists out any manner of silent use it Further if you understand that the police aren t just interested in what you say but also how you act you can gain a real advantage Are you sitting back in your chair with your arms folde
75. hat will take a list of pager exchanges 345 XX XX and randomize the last four digits dial the resulting number wait for X seconds enter the victim s 123 4567 and the sign and hang up Second it is very important to ran domize the last four digits of the pager so as to not develop a pattern It doesn t hurt to sprinkle in a few other numbers at random like your local Radio Shack or Skin Head Society A typical menu for the paging program should look like this Spring 1996 2600 Magazine Enter Victim s Number 234 6565 Enter Number of Pages 250 Enter Start Time 22 30 EndTime 23 50 Use Lookup Table Y N Y Enter Exchange XXX Enter Randomize Seed 6 Leave blank if using lookup table otherwise enter an exchange A progress screen should show the pager dialed total dials victim s number elapsed time and remaining pages You may also want to use some of your modem s more sophisticated fea tures like tone detection to speed up the process Pager numbers are easy to come by Almost anyone we know carries them Determining what numbers to call is equally easy For instance pager number345 1234 can be used as a starting point to search for the exchange s range Typically a pager company will buy blocks of numbers like 345 1000 thru 345 3000 Determining the range is as simple as dialing a starting number until you hear the classical Please enter your numeric message or you hear a beep Chances a
76. he phone In this case only the last part of the data can be seen 5 Test Mode Programming Data for AMPS 6 and NAMPS Cellular Telephones 7 Step of digits range Description 8 9 1 00000 32767 SYSTEM ID 2 8 DIGIT OPTION 10 BINARY PROGRAMMING SEE NOTE 1 BELOW 3 10 DIGITS MIN AREA CODE amp 11 TEL 4 2 DIGITS STATION CLASS MARK SEE NOTE 2 12 BELOW 5 2 DIGITS ACCESS 13 OVERLOAD CLASS 14 6 2 DIGITS GROUP ID 15 10 IN USA 7 6 DIGITS SECURITY CODE 8 3 DIGITS LOCK CODE 16 9 3 DIGITS SERVICE LEVEL SEE NOTE 3 BELOW 10 8 DIGIT OPTION BINARY PROGRAMMING SEE NOTE 4 BELOW 11 8 DIGIT OPTION BINARY PROGRAMMING SEE NOTE 5 BELOW 17 12 0333 OR 0334 INITIAL PAGING CHANNEL 13 0333 A SYSTEM IPCH 14 0334 B SYSTEM IPCH 18 15 3 DIGIT NUMBER PAGING CHANNEL 021 IN USA 16 8 DIGIT OPTION 19 BINARY PROGRAMMING SEE NOTE 6 BELOW Spring 1996 2600 Magazine Steps 01 through 06 and 12 will repeat for NAM 2 if the second phone number bit has been enabled in step 11 Test Mode Programming Data For TDMA Cellular Telephones of digits range 00000 32767 8 DIGIT BINARY 10 DIGITS 2 DIGITS 2 DIGITS 2 DIGITS 6 DIGITS 3 DIGITS 3 DIGITS 8 DIGIT BINARY 8 DIGIT BINARY 0333 OR 0334 0333 0334 3 DIGITS 3 DIGITS 708 737 8 DIGITS Description SYSTEM ID OPTION PROGRAMMING SEE NOTE 1 BELOW MIN AREA CODE amp TEL STATION CLASS MARK SEE NOTE 2 BELOW ACCESS OVERLOAD CLASS GROUP
77. he receiv er push the button for your friend s apartment and no one answers Now what Well the next time you are in his apartment and he lets someone in notice what button s he pushes on his phone to open the door The next time you try to get in and he is not there whip out your trusty pocket dialer hold it up to the mouth piece and push the same tones for the same length of time and 1 bet the lock will open on the door If you don t believe me try it for yourself The look on my friend s face when he s late to meet me at his apartment and I m sitting at his apartment door inside the build ing waiting or just all of a sudden knock on his door without calling first to be let in is worth a million bucks He still can t figure it out Since 1 figured this out 1 can either get free phone calls and or get into about 30 percent of the buildings that I mess around with Spring 1996 NOKIA 100 SERIES CELLULAR HANDPORTABLE TELEPHONE NAM PROGRAMMING INSTRUCTIONS The Nokia 100 105 Series handportable CMT uses en EEPROM NAM that can be programmed directly from the standard user keypad In order to access the NAM Yad ener 6 access code curren programmed ein the phone Once the programming mode is accessed NAM parameters are loaded by entering them into the display and storing them to lected memory locations Be sure to obtain all parameters before proceeding ACCESS NAM PROGRAMMING MODE 1 Tum the phone
78. hey usually do not bother the WASP male businessman in a clean suit who may know the local politician or be able to afford a lawyer if he has a broken tail light but they are more likely to pull over a younger person someone with long hair or a member of racial minority Once they pull you over anything in plain sight is fair game if they can see it back seat floor in the glovebox when you reach for insurance card they can legally look at it If you give them problems make furtive movements move like you are reach ing for a weapon or are verbally abusive they can search your person for the LEO s safety all very legally They can also look in your trunk if you give permission of free will or under pressure if they get a search warrant properly or improperly if they have reason to believe there is imminent danger to public safety or if they just feel like it illegally If they see anything illegal in plain sight they can search your person and trunk if they find anything illegal on your person they can search your trunk If they find anything in plain sight on your person or in your trunk then the real problems begin Although it can be tough at times treat all LEO s with respect especially during a traffic stop Turn your inside light on and place your hands on the dash or wheel where they can be seen Think of the LEO as someone to social engineer you want them to like you not think you are slime
79. hods is that one can get rough with suspects the suspect a critical question the person might rub their nose shift their body from one side to another cross their arms give off a fake cough etc Part 2 Verbal behaviors include speech disturbances sounds that are not words such as ah er uh um The suspect will often omit article words in sen tences a the and for clip words in half drop suffixes off words ing drop word endings es ed and will often self correct themselves in the middle of sentences Part 3 Statement analysis is done after the suspect writes down exactly what happened or what they were doing at a certain time alibi Experts will then exam ine the document very closely and look for signs such as handwriting pressure curved lines frequently misspelled words etc What makes the Kinesic Interview Technique so successful is that it uses the above three mentioned parts together to come to a conclusion The Kinesic Interview Technique is very complex and too elaborate for me to explain in detail Spring 1996 Spring 1996 to you without having to write a book on the matter The police manual had to train with goes over several hundred pages and 1 highly suggest taking a class on this subject in order to get all of the necessary information about this technique How about infiltrating a police training seminar Did you know that the police can even lie to you during an interrogation and tell you t
80. ically of a pseudo government with resources that rival that of the United States To this government with the vast monies machines and manpower at its disposal public data security is non existent The use of the PGP program RIPEM and oth ers like them is a noble idea they would probably keep your neighbor out of your email but realistically to this government they are like the Cap n Crunch decoder rings of old Toys Public digital privacy does not exist where this government is concerned Publicly the government puts up a huge fight We don t want the program avail able it could be used by our enemies they say Anything over 40 bit encryption is a weapon It s not to be export ed etc what a better way to play to our enemies Publicly they proclaim that it is unbreakable it is to be heavily regulated and such while privately they sit back and easily decode anything they have a desire to Either way they win they convince the sheep that it s a bad thing used only by hackers communists and other ene mies of the state It is outlawed which makes it that much easier for them to operate or by all the bad press they generate with their claims of its invincibility They lull everyone into a false sense of security where they think all of their data is safe from prying eyes when in reality it is easily read whenever it s their turn to be indicted At the same time they try an end run with the Clipper Chip and the Capsto
81. ige box on my next door neighbor s line I hooked a line into their box ran it under the siding to make it invisible down next to a basement window and into the ground From there I dug a trench in the ground about 3 inches deep from their box to my box and hooked the wire into my box to the yellow and black wires Now I could use their line to call BBSes around the world for free I decided not to make any direct long distance calls so they wouldn t start investigating and find the extra line going into the ground So I only third number billed and used calling cards from their line and tried as best as I could not to annoy the operators too badly So you see it started out sort of inno cently but then I began to eavesdrop on a lot of my neighbors conversations After awhile the conversations got sort of boring so I hooked up my two line phone to both of the lines and started conferencing total strangers onto their line while they were in the middle of a conversation which caused quite a bit of confusion especially when I hooked them up to overseas people Then to make things worse l d pop in and say in a deep voice Please deposit 25 cents Pretty soon my neighbors got to be too boring for me I mean they reacted to my pranks on their line the exact same way every time and their conversations without me were totally boring hardly worth listen Page 12 2600 Magazine ing to So I went to my other next door
82. il Pelego s Bar at Assufeng near the payphone 6 pm Buenos Aires Argentina In the bar at San Jose 05 Bristol England By the phones outside the Almshouse Galleries Merchant Street Broadmead Payphones 44 117 9299011 9294437 6 45pm London England Trocadero Shopping Center near Picadilly Circus next to VR machines 7 pm to 8pm Manchester England The Flea and Firkin Oxford Road Melbourne Australia Melbourne Central Shopping Centre at the Swanston Street entrance near the public phones Munich Germany Hauptbahnhof Central Station first floor by Burger King and the payphones One stop on the S Bahn from Hackerbruecke Hackerbridge Birthplace of Hacker Pschorr beer Payphones 49 89 591 835 49 89 558 541 542 543 544 545 Granada Spain At Pilar Del Toro Pub in Plaza Nueva near the Darro Bridget Puente del Darro Halmstad Sweden At the end of the town square Stora Torget to the right of the bakery Tre Hjartan At the payphones All meetings take place on the first Friday of the month from approximately 5 pm to 8 pm local time unless oth erwise noted To start a meeting in your city leave a message and phone number at 516 751 2600 or send email to meetings 2600 com WE GIVE UP OK ENOUGH WE VE BROUGHT BACK THE BLUE BOX SHIRTS SO YOU CAN STOP COMPLAINING AND BITCHING SO NOW THERE ARE TWO VERSIONS OF 2600 SHIRTS THE BLUE BOX SCHEMATIC SHIRTS AND THE MICHELANGELO VIRUS SHIRTS SAME OLD PRICE
83. in Scurr White Lake MI Bernie S Fallout Dear 2600 I have been a proud reader off and on for a long time I buy at the stands But I am totally confused and scared about placing an ad in your Marketplace after reading the article No More Secrets Bernie S Being in business selling info of this matter 1 see that the Marketplace is still full of this type of info What does this mean Is this kind of info now illegal to sell buy or even for you to allow such ads From Popular Mechanics to Soldier of Fortune there are many people and companies with ads selling this type of info How about companies like Loompanix Delta Press and many others are their books now illegal Is some ofthe info 2600 prints now illegal under the current law title 18 US C section 1029 It sure soundsthat way to me Did this law go into effect in October 94 or 95 I don t know if am breaking the law or not What should we underground info sellers do Should 1 quit my business I have about 170 publica tions that took me a few years to work up to How can you keep your magazine going with a law like this Does For Informational Purposes Only mean any thing anymore 1 am one worried man Name Withheld The way the law passed in October 1994 now reads we could indeed be guilty of the same crimes Bernie S was imprisoned for But we believe the law is wrong and is blatantly unconstitutional It must be chal lenged on all fronts
84. ing 1996 2600 Magazine Make yourself look older I m 34 maybe stick a pillow up your shirt be pregnant They are out there and they are on our highways Jus Jizzen We suspect explaining what a dummy is doing sit ting next to you in a car might prove to be more trouble than its worth Your other ideas are sound though Dear 2600 Lately I ve been experimenting with different num bers trying to find an ANI number for the 214 area code Anyway dialed one number 291 9901 and something strange happened It rang once normally then I got some digital sounding ring about three times and then some high pitched tone that lasted about 5 10 seconds After that a computer voice said Hello K L T Y Transmitter System Enter security number now It just repeated that until I entered a number Do you know what this is King Otar This is probably a system to monitor and possibly control the transmitter for that particular broadcast sta tion If they re really stupid the station may allow remote control of room temperature as well as the abil ity to turn the station on and off The high pitched tone sounds like a low speed computer carrier that is proba blv another way into the system Meeting Questions Dear 2600 1 am an Orthodox Jew and therefore cannot attend any meetings on Friday nights funny thing how all the 2600 meetings happen on Friday nights was wonder ing if you knew of any meeting in the New York Ci
85. ing calls How stupid can Bell get Do you have any ideas for why Bell might do this I cer tainly can t understand why Michael H Whenever something stupid like this happens vou can bet the bottom line is money The local phone com panies dont like it either when payphones are used for incoming calls because the person calling is probably paying much less for the call than an outgoing call from the payphone would cost Coin calls are grossly over priced and each calling card call carries a whopping surcharge Most phone companies are jumping at the chance to turn off incoming service in the name of the fight against drugs or some other nonsense If enough people fight this something just might get done Questions Dear 2600 For the past several months have tried and tried to figure out the free call code to SouthWestern Bell telephones About eight months ago if you typed in 10362 andthen dialed the number you wanted to call you could avoid the annoying 25 cent deposit And then it changed to 10649 but since then i have yet to fig ure out the next code 1 am fairly new to phreaking and have since made eight different boxes 1 can still easily get a free phone call don t get me wrong But 1 want to figure out how to access the codes and what other codes might lead to If you try to type in 10362 and the number you wish to connect to it says the access Page 35 code you have dialed is invalid S
86. irates and hacks M The NSA is a spy organization That means they re not likely to send out messages announcing their pres ence We also doubt thev care much about software pirates The Winter Cover Dear 2600 I just received the Winter 95 96 issue of 2600 and I d like to congratulate you on the cover photograph I was ROTFL No doubt critics of the arts could go into detailed analysis and praise of the composition of this work the stark contrast between the left and right parts of the pic ture movement vs stillness etc and the Freudians would be delighted to equate the depicted scene with sex ual penetration etc but I ll simply say it was hilarious I ve been a subscriber for a few years and this is by farthe best 2600 cover I ve seen yet Again congratula tions Christian Germany Dear 2600 The cover of this month s mag is the best yet Is it Page 36 2600 Magazine possible to get it as a BMP or GIF once the www site is back up Dereks The GIF is available on the web site under the covers section Dear 2600 I absolutely love the cover of the Winter 95 96 issue The look that the dog is giving the camera is the best part of the photo Anyway I was wondering if you could tell your loyal readers the story behind the inci dent depicted on the cover I noticed that the old Bell van had a 2600 logo on it Had you guys finally had enough of NYNEX and PSI fuLcrum Miami FL The cover was
87. is a Defender modem If so do 1 have a cat in hell s chance of getting round this Cockroach Its impossible to say what you re connected to since you re not getting anything back It could just be a modem connected to nothing Some of those hacker challenge idiots do that to try to drive us crazy some times Our advice is to try all kinds of variations to get any kind of a response at all from it Once you ve gotten that far you re starting to make progress Dear 2600 Over the past 10 years I have been employed as a US Navy nuclear submarine radioman and for a short while thereafter for the arch enemy of your organiza tion the National Security Agency so am no stranger to the world of codes cyphers and cryptology But now due to a difference in political beliefs 1 have chosen to wash my hands of the whole mess deciding to start again in another less taxing field During my tenure with NSA your magazine along with several others of the same theme were made read ily available by the powers that be as a sort of reference material both as what to watch for and to generate new ideas But 1 did not write this to stroke your egos my concern is for the security of the common man I am referring to the PGP or Pretty Good Privacy program While 1 am under contract with the govern ment to not speak on issues of national security for the Spring 1996 2600 Magazine remainder of my lifetime can speak hypothet
88. it is working properly and you will hear nothing on your special phone Override the tap alert by pressing the push button your phone will now work as a normal phone allowing you to once again hear and speak on the line If everything is working OK at this point you should find a way to mount the tap alert device inside the phone Our peo ple have found that drilling two small holes in the bottom of the 2 9220 allows the switch and LED to be pushed through and then screwed down in place with the lock ing nut from the switch This method is not only simple but looks good and the place ment of the LED works out great for an illumination source in those dark alleys writing is often important in weird places Final Notes If tap alert devices are in parallel they will not work on each other In other words they will not detect when another phone with the device is present on the line If two or more devices are in series you will not be able to use your phone at all You may find that you can sell these special phones to your friends at school for a nice price Your friends will appreciate it and so will you because any calls to your friends will be safe from prying ears Many thanks to the little purple guys with yellow spots for their help with the tuning forks We wouldn t have hit 2600 hertz without them D5 Spring 1996 2600 Magazine Page 7 MCI Telecommunications Corporation ape
89. it works or not so this date can be isolated Mine is a 9562 that worked Installed Mobile Phones and Transportable Models To enter test mode on units with software version 85 and higher you must short pins 20 and 21 of the transceiver data connector An RS232 break out box is useful for this or construct a test mode adaptor from standard Radio Shack parts For MINI TR or Silver Mini Tac transceivers smaller data connector you can either short pins 9 and 14 or simply use a paper clip to short the hands free microphone connector Hand Held Portable Models There are two basic types of Motorola portable phones the Micro Tac series Flip phones and the larger 8000 and Ultra Classic phones Certain newer Motorola and Pioneer badged Micro Tac phones do not Page 40 2600 Magazine have a flip but follow the same procedure as the Micro Tac 8000 amp Ultra Classic Series If you have an 8000 series phone determine the type before trying to enter test mode On the back of the phone or on the bottom in certain older models locate the F09 number This is the series number If the fourth digit of this number 15 a D you cannot pro gram the unit through test mode a Motorola RTL4154 RTL4153 programer is required to make any changes to this unit Having determined that you do not have a D series phone the following procedure is used to access test mode Remove the battery from the phone an
90. iver to control channel word is received or when the achieve a total of 0 degrees phase shift key is entered to abort the command Do not enter any values except those shown 408 RCVVC Receive one voice channel word below When the word is received it is displayed in hex This command will be complete when a 0 0 121 5 59 243 0 86 voice channel word is received or when the 45 1 126 0 60 247 5 87 key is entered to abort the command 9 0 2 130 5 61 252 0 112 41 Enables Diversity on FI9CTA series only 13 523 135 0 62 256 5 113 42 Disables Diversity on F19CTA series only 18 0 4 139 5 63 261 0 114 43 Disables Diversity 22 5 5 144 0 40 265 5 115 Use T R antenna on F19CTA series only 270 6 148 5 41 270 07 116 Use R antenna on D M T mini TAC 31 527 153 0 42 274 5 117 444 Disables Diversity 36 0 16 157 5 43 279 0 118 Use R Antenna on F19CTA series only 40 5 17 162 0 44 283 5 119 Use T R antenna on D M T mini TAC 45 0 18 166 5 45 288 0 120 45 Display Current Receive Signal Strength 49 5 19 171 0 46 292 5 121 Indicator Displayed as a 3 digit decimal 54 0 20 175 5 47 297 0 122 number The strongest signal I have ever 58 5 21 180 0 64 301 5 123 received was 179 and I was sitting directly 63 0 22 184 5 65 306 0 124 below the tower without an external antenna 67 5 23 189 0 66 310 5 125 46 Display Cumulative Call Timer 72 0 48 193 5 67 315 0 1
91. k back there again you ll see that they cost 15 each We hope vou don t think that all letter writers get free subscriptions and t shirts That deal only applies to article writers As for your questions about the reality of raids we ve seen it play out like that all too often And like vou we also ask why Radio Shack Fun Dear 2600 I have a friend who s homeless Last year 1 got him one of those 20 phone cards He was in a jam and had to use it He said Man that was a life saver so this year thought I would give him the gift that keeps on giving I went to Rat Shack The computer showed they had three tone dialers in the store After looking around for about 20 minutes the guy told me These things always disappear the drug dealers use them for some thing They didn t even have the floor model 1 didn t confuse him by telling him drug dealers could afford to buy anautodialer if they wanted one 1 asked if they had any 6 5mhz crystals They didn t stock them but he could order it So he called someone and they had him ask me what it was for I said I don t know I m just picking it up They had him tell me they don t show anything 1 went to another Rat Shack same story Three in the computer none in the store I m starting to lose my smile if you know what I mean asked about the crystals same story He got someone on the line and asked about the crystal and listened for a minute Then he loo
92. ke it illegal to distribute informa tion of any type How can they make it illegal to own a device that maybe if someone feels like it could possi bly if they wanted to break the law be used in a fraud ulent manner Is it actually true now that having a copy of BlueBeep zipped up on my hard drive makes me a felon This is unbelievable However it seems like a law that will disgustingly stay on the books Is there any thing we can do about this 1 don t think so I have already written to my congressman Is the constitution ality ofthis law being challenged by anyone yet Please give me a minute 1 have to recover from shock and then go and clean off my hard drive and hide my red box that has been lying in a desk drawer for a year I never thought I d see the day where I d have to fear arrest for talking or writing about something I m nau seated TcP Denver Colorado We re getting letters like yours every day People are realizing the implications of this law and it s well worth getting upset about So far one person is chal lenging the constitutionalitv of this law Bernie S The problem is that its very difficult to do this when the Secret Service keeps throwing him into prison Its a fair bet they re aware of this fact Dear 2600 Phil Zimmerman Ed Cummings the Pentagon mall incident and countless others Are you sure you live in a free country Mario Canada Dear 2600 I think that this whole Bernie S saga
93. ked at me I m 6 4 and weigh 285 and said Uhhh you better talk to him I told him forget it He said thanks and looked relieved Looks to me like Rat Shack has a new policy Then I went to a large stationery Spring 1996 2600 Magazine Store near my house and asked for one of those record ing greeting cards The clerk said we usually carry them but Hallmark recalled them all Nobody knew what the story was Anybody know anything about the recall One last thing my friend owns a few Chevron sta tions so 1 asked about the satellite dishes on the roofs of the booths He said it was for credit card verification so they don t use the phone lines No music no alarm just credit cards The only way to make anonymous remailers 100 percent secure is to use someone else s account Biohazard Unfriendly Payphones Dear 2600 I went to a restaurant this morning and saw for the first time a Bell Atlantic payphone that didn t accept incoming calls 1 understand that cocots wouldn t accept incoming calls for the reason that the owners make no money But with Bell phones they make out either way Well 1 was curious so I went to the phone and looked where the number is displayed and the number was there A wonder since it s not too useful 1 checked the number with my ANI just in case and went home At home I called the number and I got a recorded message that said The number you have reached is not in ser vice for incom
94. lable is an MCI styleblack hat with white letteringthatsays PHONE Spring 1996 PATROL only 18 2447 Fifth Avenue East Meadow NY 11554 3226 FREE PHONE CALLS FOR LIFE New video How To Build a Red Box VHS 60 min Complete step by step instruction on how to convert a Radio Shack tone dialer model 43 146 into a red box to obtain FREE calls from payphones This video makes it easy Magnification of circuit board gives a great detailed view of process Other red boxing devices discussed as well Hallmark cards digital recording watch and more This video will save you thousands of dollars every year Best investment you ll ever make Only 29 US and 5 for shipping amp handling We sell 6 50 MHz crystals too CABLE TV BOXES Enables you to receive every pay channel for FREE as well as pay per view Stop paying outrageous fees for pay channels You must call or e mail us first and tell us the brand and model number of the cable box you have Only 210 U S amp 10 shipping amp handling 30 day money back guarantee Send check or money order to East America Company Suite 300H 156 Sherwood Place Englewood NJ 07631 3611 Tel 201 343 7017 E mail 76501 3071 com puserve com Free technical support X PHILES HPA CD ROM The most complete HPA CD Rom available today containing over 21 000 files about hacking phreaking anarchy occult drugs conspiracy UFO s programming in all languages HP48 security hardwar
95. le costs in the ballpark of 15 000 bucks a month Alascom is the long distance company that built most of the statewide phone sys tem and it got all kinds of concessions from the FCC during deregulation by argu ing that we never had AT amp T and Alaska was 8 special case As is we didn t even have the 1 907 or even the 1 dialing until fairly recently Times change so quick ly I still remember the You do not need to dial a 1 recording when you did use it To my probably inaccurate knowledge I was the last person in the state to dial long distance without a 1 The cellphone setup isn t that different from other places We have Cellular One and MacTel wireline within the Anchorage and vincinity area There are other carriers that handle farther out com munications which can be tricky with the 2 carrier FCC limit and other cell sites so nearby A really cool thing is that the cellu lar systems extend through in state long dis tance boundaries so you can place calls to some areas for just the normal airtime fees They actually route the calls through the towers to evade the long distance company With the exception of Anchorage Alaska s phone system is a mixture of old equipment rigged up to new equipment and somehow interfaced with the rest of the net work Anchorage has relatively new switch es but the marketing department is too stu pid to realize that they could sell some of the features th
96. mised us the ability to use 56k data over voice over an ISDN line When it was finally realized that they didn t offer this service the contracts had already been signed Since it was a verbal agreement there was little recourse and more than a few people including PSI believed that we would be held to the contract Several years ago that s probably what would have happened However by posting our account of the story on our web site as well as Usenet newsgroups and other Internet forums we were able to make contact with scores of other people who had had similar run ins We used these con tacts to pool our resources When we went one step further and posted sound files of telephone conversations where PSI reps were clearly heard saying they supported the service we wanted there was no way the issue could be avoided PSI reacted at first by threatening to sue us That proved to be an even bigger mistake since indi viduals on the net are particularly averse to legal threats by large corporations Now newspapers were actually starting to take an interest in the case PSI really had no choice Shortly after wards and without fanfare they sent us a full refund We believe they learned a valuable lesson and we have no hard feelings towards them What happened was an honest mistake It was their reaction that made them look bad and pres sure from so many people that ultimately made them give in We didn t have to sue them or waste an i
97. mother who is ill First of all let me start out by telling you that I am on two years probation for computer fraud and or credit card fraud but that s a whole different story Anyway 1 must carry travel papers from my pro bation officer which I had Thank God was travel ing north on 1 17 to Flagstaff and yes 1 was speeding a tad They had just changed the speed limit according to each state but it was still posted at 65 1 was keeping up with the flow of traffic and passed a Bronco No it wasn t O J The Bronco stayed close behind me and it wasn t long before he passed me He got right in front of me and slowed down to 55 1 stayed in back of him for a few miles until I noticed I was only going 50 m p h 1 sped up and went around him He sped up and stayed close behind me About ten miles down the road I looked in my rear view mirror and saw that the Bronco was no longer there in its place was the Highway Patrol 1 let my foot off the gas pedal and noticed that he sped up and was right behind me A couple more miles down the road he hit his lights and pulled me over He asked for my ID and registration At thistime I told him Spring 1996 it was a rented vehicle and gave him my travel papers He asked me to get out of the car As I did I noticed that the Bronco 1 was playing tag with was parked behind the squad car The officer showed my probation papers to this other gentleman and they both kind of chuck led 1 was la
98. nal N AM Enter STO 04 STO ENTER SYSTEM PARAMETERS Memory Location 03 or 05 12 Press and hold the CLR key until the display clears 13 In one long string enter the system parameter eccording to the format of Example 2 below Be sure to separate each parameter with an asterisk Do not place an asterisk before or after the string Si ID Gaour ID Maar EXAMPLE 2 lt 4 34 1 1 334 15 15 Access Minioo N Aom Orrian Cats PAEA Mu oea 14 For Primary NAM Enter STO 03 STO Fer Optional N AM Enter STO 05 STO VERIFY NAM INFORMATION 15 Press and hold the CLR key until the display clears 16 Use up v to scroll thru locations 01 through 05 17 Verify that the information for each memory location is 18 To exit the programming mode C pica sti 466 ted di If NAM ERROR appears on the display programming was done incorrectly and must be repeated MOBILE KIA PROGRAMMING THIS KIND OF INFO can really get you in hot water if the Secret Service finds it in your possession It s probably not a good idea to looking at it No kidding Really hacking caller id boxes by Dave Mathews Because the Caller ID system uses out of band signaling that is set up in the SESS switch there is no way to fake your out calling number unless you make an opera tor assisted call or dial through a company PBX You can however hack the box that sits in your house up to
99. nd many of us know much more about com puters than the teachers faculty Some of the teach ers don t mind admitting their computer illiteracy and lovehelp with their machines from people like me but then there are the teachers who think that they know what the hell they are doing and hate it when a kid tells them how to do something when they are in a jam or how to do something easier etc They also just hate it when you hack their crappy little security systems that they thought were so impenetrable However I find it rather fun E The first and most common security system 1 called AtEase It is a shell program that 1 realls despise Not because it is hard to hack but be it has such a retarded interface This is the ea to overcome Here are some ways to overcome it The first requires a computer with a program mer s switch This is a switch on the front of the with the triangle restarts the com one with the circle loads the debugger When you T are in the regular AtEase selection screen hit the right one and you will see an empty dialogue box with a gt at this prompt Type G FINDER After you hit return the screen will disappear and AtEase will quit and load the regular operating system the Finder Then you have full access to everything and can trash or change anything you want If the computer you are on does not have a debugger then try this Hit command option esc The command button is the
100. nder the watchful eyes of their boss Also every time No Sale is rung up that fact is recorded Later when the boss prints out an activi ty log he or she will see that cashier B pressed No Sale four times that night while cashier D did not press it at all Ifsomemoney is missing the four No Sales would lead the boss to suspect cashier B is the culprit Many bosses forbid their employees to use the No Sale button because they don t want the cash drawer opened unnecessarily for just this reason How to Get Around T his Security Now we get to the security laxity in the register There is a way to open the ER 3100 in such a way that the bell does not ring Completely silent More importantly by opening the drawer in this way you also bypass the computerized activity log The boss will have no records that the register was ever opened The cash register rests on four black rubber pads which raise the register off the countertop a little less than half an inch This is just enough space to slide Spring 1996 one s fingertips underneath the register Indeed this is the method to opening the register There is a secret lever under the register It s towards the front of the machine on the side facing the customer Because it is on the far side away from the cashier if the cashier wants to access this secret lever he must lift the reg ister and slide his hand and arm underneath the reg ister to reach the lever on the
101. ne Project The public thinks it has wonone yea It doesn t matter it was only a diversion The Clipper Chip was the equivalent of leaving your car door unlocked Without it and given the government s capabilities it s like locking your car door but leaving the window down And the PGP pro gram adds all the security of rolling the window halfway up It is a mere annoyance for them an added day to the reading of your data Theonly secure way to store infor mation is in your head And given the government s methodology of going about interrogations in issues concerning national security that s not really safe anymore just want everyone to know Big Brother is still watching and they are getting better everyday On an unrelated note 1 would like to mention D Ruduolph Goettel will be missed Skinny Puppy won t be the same Disappointed in our Government Spanish ANI Dear 2600 Bored one day at home decided to start dialing a bunch of 800 numbers when came across a computer ized number that spoke in Spanish was hitting random numbers when heard the lady say my phone number The number is 1 800 235 0900 If you dial the right numbers you get your ANI in Spanish I have been accustomed to using the ever famous 1 800 MY ANI IS Lately when 1 dialed it up it sent a steady tone over the line and then stopped when a key is pressed After Page 31 pressing a couple of keys I get the message The autho rization or ID
102. nordinate amount of time All we had to do was speak up The same kind of power in a different kind of way was felt with the Bernie S case which we have been involved in for over a year now In January of this year the United States Secret Service managed to have Bernie S locked up yet again for last year s charge of possessing tech nology which could be used to commit fraud By being arrested last year Bernie technical ly violated probation for an offense committed several years ago in a small Pennsylvania town Spring 1996 Because it was such a minor incident equal in seriousness to insulting the flag nobody could ever have been expected to go to prison for it However the Secret Service made it their busi ness to portray Bernie S as a major threat to soci ety The judge along with the probation officer and prosecutor who had previously said the case was of little significance were heavily influenced by having the Secret Service come to their small town Based on this image he was put back in prison with murderers rapists and death row inmates He was considered especially dangerous because the judge had set such a high bail 250 000 This despite the fact that he was obvi ously not a flight risk having shown up for numerous hearings where he could have been imprisoned on the spot After several weeks the judge conceded that the bail was too high and had it lowered to 100 000 In early March the judge sent
103. ntrol channel data and display the majority voted busy idle bit 0 idle 1 busy SAT On When x 0 SAT 5970HZ x 1 SAT 6000HZ x 2 SAT 6030HZ SAT Off Transmit Data Transmits continuous control channel data All words will be FF00AASSCC33 When the command Spring 1996 288 294 30 31 32 33x 34 35 Spring 1996 starts 27 will be displayed in the right side of the display Entering a key will terminate the command The transmitter de keys when finished Activate the high tone 1150 Hz 55 Hz De activate the high tone Activate the low tone 770 Hz 40 Hz De activate the low tone Clear Sets non volatile memory to zeroes or factory default This command will affect all counters all repertory memory including the last number called stack and all user pro grammable features including the setting of System Registration It does not affect the ESN NAM phasing data or lock code This takes a minute or so Do not turn off the tele Phone while this is showing 32 on the dis play Wait until the normal service level dis play resumes Turn on DTMF for x 1 9 0 plus the sin gle tones x 1 697 Hz 1209 Hz x 2 697Hz 1336 Hz x 3 697 Hz 1477 Hz x 4 770 Hz 1209 Hz x 5 770 Hz 1336 Hz x 6 770Hz 1477 Hz x 7 852 Hz 1209 Hz x 8 852 Hz 1336 Hz x 9 852 Hz 1477 Hz x 941 Hz 1209 Hz x 0 941 Hz 1336 Hz x 941 Hz 1477 Hz x 10 697
104. o since you guys are the people to ask how would 1 get access to these codes I have tried the core of SouthWestern Bell if you know what i mean and have had no such luck in find ing a damn thing Any suggestions NeVeR FluX First off these codes are never intended for free phone service If you manage to use one of them for that pur pose it s because some dimwit has misprogrammed your central office It usually doesn t take them too long to realize this The codes are used to route long distance calls over different long distance companies But the 10XXX format is becoming obsolete so any list of such numbers won be telling the whole story The new for mat is 101XXXX Thats ten times more codes to find Good luck Dear 2600 A friend of mine got the Internet finally One day while he was swapping files with a guy he was sudden ly kicked off He went to log back on and found that in his mailbox was a message It said something to the point of We found you swapping files Do it again and we ll arrest you The cool thing is my friend got this guys e mail address Now because my friend swears that he was only trading shareware and music I will give you his address It reads as follows Hoover crc nsa gov When my friend got this e mail he was freaked out of his mind Most of the guys friends of ours convinced him that it was a joke But in the back of my mind I wonder Is the NSA taking a part in the crackdown of p
105. o have to do that every time I wanted a new calling card They were making things hard for me I only had about twenty cards left and my cards went dead pretty quick lately because of my extensive international calling I could third number bill everything but if you ve ever tried to do that for a BBS call you know that it s a pain in the ass to get it right That s when I went over to the window and looked across the street I saw a little shop with a pay phone next to it and a guy in a suit talking on the pay phone Since car phones weren t a big thing yet in this little town the few yuppies that there were usu ally stopped by this phone to make their important phone calls And of course they preferred credit cards to pocket change A plan started to form in my head Of course I couldn t run a phone wire underneath the Spring 1996 2600 Magazine street because the police probably wouldn t be too happy if 1 used a jack hammer So That night at 3 00 a m I got on my cel lular phone and dialed the direct line to the Celina police I explained to them that I had just seen a few kids jump the fence to the boatyard by my house and break into the office I listened in on my scanner as the dispatcher sent all available units to the boatyard All two of them eh 1 was ready when I heard that and ran across the street to the pay phone I had done this a million times before but usually it was in a seclud edarea and there wa
106. o some grandmother s Visa card Do you do things that gain the attention of tele phone company security officials They monitor pat terns look into people who receive fraudulent tele phone calls do you get many calls from people using codes or cracked PBX s into people who make fraudulent telephone calls you never card from home dorm work or friend s and into people who call telephone numbers that make or receive fraudu lent calls do you call phones that have that kind of activity people or Elite boards The security forces can gather information and then give the LEO their probable cause Anyone who brags about illegal activities is bringing attention to themselves This is publicity Who hasn t bragged about cracking some software or a system or figuring out codes but remember the only way to keep a secret is not to tell anyone If you want to spread information you must ensure anonymity or safe pseudonymity Anonymity occurs when a creation document note message poem book flyer picture etc is not signed Pseudonymity Occurs when a creation is signed with a false or made up name one that cannot be traced back to you It is not illegal for an LEO or a telco security official as a private citizen to read messages on a BBS or netnews This is the same as that person read ing the business cards or for sale notes on boards in some stores it is publicly available information without the expectation of privac
107. o want a Metallica box CD set and I want to know what a vac uum cleaner is I left them alone completely until Mildred got back from the hospital While they were gone I bought some heavy duty wire and tapped into their circuit breaker box giving me complete control I also ran their water line through my house so I could leech and control that When they got home Mildred got in the shower and Herb sat down to watch Tammy Faye Bakker on TV I walked over to my Department of Water switchboard and turned a valve This valve released the five gallon tank of washing machine Blue dye into their water lines Then I popped in the porno video Edward Penishands and sent that into their living room TV set Herb was so engrossed in his show that he didn t even Page 16 2600 Magazine hear Mildred screaming something about alien invasions A few months passed I spent the day mowing my neighbor s lawn while they were gone I mowed the words WE COME IN PEACE It was 2 30 in the morning and I grabbed my backpack and sprinted over to the Celina Power and Light building I began to dig a trench from their building to my basement window Ahem wait a second I think I ve been using a few too many illegal substances or something Actually I made this whole thing up I was bored okay Anyone who believed any of it even for a second needs to have their head checked out The story is proba bly full of holes although I r
108. oaming fees 1 C Scan can only be programmed from test mode power phone up with the rel evant test mode contact grounded see above 2 Press to access test mode 3 Press 187 the phone will display 0 40000 4 Enter the first inhibited system ID and press Continue to enter additional system ID s if required After the 5th entry the phone will display N2 Press to continue and add sys tem ID s for NAM 2 as required 5 Ifan incorrect entry is made outside the range of 00000 32767 the display will not advance press CLR and re enter Use a setting of 40000 for any un needed locations 6 When the last entry has been made press to store and press to exit turn off power or Phones without the C Scan option used this command to SEND NAM SEND NAM Display shows AA BB where AA Address and BB Data Displays the contents of the NAM one address at a time 198 204 215 228 234 24 25x 26 27 2600 Magazine advanced by pressing the key The following data is contained in NAM The test is exited by depressing the key SIDH Sec Code OPT 1 2 amp 3 MIN MINI MIN2 FCHNA SCM FCHNB IPCH NDED ACCOLC CHKSUM GIM Display Software Version Number 4 digits displayed as year and week Note Entering commands 20 through 23 or 27 causes the transceiver to begin a counting sequence or continous transmission as described below In order to exit from the
109. on 2 Enter the NAM access code Factory default is 3001812345 3 Enter STO 00 4 Verify that STORE NOT DONE appears in the display If NOT ALLOWED appears check to sec if you have entered the accom code correctly Note If NOT ALLOWED appears after a few programming attempts the access code has been changed or an error has occurred and the phone will have to be retumed to Nokia for repair ENTER SPECIAL NAM PARAMETERS Memory Location 01 5 Press and hold the CLR key until the display clears 6 n one long string enter the special NAM pasameters eccording to the format of Example 1 below Enter each emergency number such as 911 or 911 folowed by the pound key the Languages Code followed by the asterisk key and the desired four digit lock code Language codes 0 English 1 French 2 Spanish NOTE Emergency numbers entered in memory location 01 can be used while call restrictions arc active and when the phone is locked NOTE 2 The first number entered in the list of emergency numbers is used for the speed dial 9 key EXAMPLE 1 TN Aman Ker 91145 911540 1234 Lar Coos 7 Enter STO 01 STO Lee Cont ENTER MOBILE PHONE NUMBER Memory Location 02 or 04 8 Press and hold the CLR key until the display clears 9 Enter the correct 10 digit phone number 10 For Primary NAM Enter STO 02 STO For Optio
110. on Co Durham DH7 6PD England Bulletin Boards ANARCHY ONLINE A computer bulletin board resource for anarchists survivalists adventurers investigators researchers computer hackers and phone phreaks Scheduled hacker chat meetings Encrypted e mail file exchange WWW http anar chy online com telnet anarchy online com modem 214 289 8328 ACCESS DENIED BBS 613 226 5386 Info exchange for H P V C subjects Willing to exchange info with anyone Need info on CID ANI and other phreaking utils Send email to visible daemon a eidetic takeone com Marketplace ads are free to subscribers Send your ad to 2600 Marketplace PO Box 99 Middle Island NY 11953 Include your address label or photocopy Ads may be edited or not printed at our discretion Deadline for Summer issue 5 31 96 Page 49 continued from page 37 Crippled 911 Dear 2600 I was at a Mosholu Woodlawn South Community Coalition meeting in the Bronx recently The captain of the 52nd precinct told us that the precinct has a highly increased workload over the last monthbecausethey got new Caller ID Now they have to send a car to respond to every aborted call that comes in even every hang up call Their caller ID identifies not only the caller phone number but the phone subscriber s name address and apartment number Ben Stock Its actually not Caller ID that s causing this prob lem but rather the new Enhanced 911 system Believe it
111. one with the Apple icon on it and the little close ended pound sign You will then get a dialogue box asking if you want to force quit AtEase Obviously you do so click the button Force Quit Sometimes this will work quitting AtEase and loading the Finder sometimes it will quit AtEase and then load it again Again this must be done at the regular AtEase selection screen Spring 1996 2600 Magazine The third way is as follows Restart the com puter and hold down the shift disabling all exten sions When you are about to get to AtEase it will ask you for a password Just hit cancel Then keep opening up program after program until you run the thing out of memory Sometimes AtEase will then quit leaving all the applications open with no operating system open Then go to all the different programs and quit them After the last one the computer will realize that it has no operating sys tem and it will start up the Finder However some times this works and sometimes not It will not work on version 2 0 or higher of AtEase in my experiments and it won t work on certain comput ers but you may get lucky The reason this happens is because AtEase installs a patch in the system itself so that it will launch AtEase at startup even if the extensions are disabled by hitting shift at startup but there is also extension The extension contains a patch for tEase to make it able to handle running out of mory
112. other side That s where the customer has an advantage it s actually easier for the customer to open the drawer than the cashier The customer has the lever literally inches away from his or her body In many pizza parlors and other places that use this register you can stand by the counter and casually slide your fingers under the register palm up Insert your fingers under the center of the regis ter until you find a rectangular hole in the metal bot tom of the register close to the nearest edge Inside this hole you will feel a vertical strip of metal per pendicular to the floor Push this metal strip away from you towards the cashier and the cash drawer will roll open The lever is hard to find at first The hole in the bottom of the register is pretty big and the lever is pretty small Also the lever does not feel like a lever It doesn t feel like a user interface object that you are supposed to manipulate and if you were to lift the register and peek underneath you would see that the lever doesn t look like anything special either In short the Sharp people are trying to disguise this lever from casual observation and discovery But we know it s there Feel around until you find it in the hole and push on it I strongly strongly advise you to first make sure the store does not have security cameras and no security guards and prefer ably that you re good friends with the cashier Otherwise you could find yourself in a j
113. ould have to come out and upgrade the wiring on my private lane because current ly you could have no more than two lines per house So Spring 1996 I agreed and all was coming home one day and found that my street looked like a level on Pac Man Different multi colored symbols and arrows every where orange yellow and green Sure you see these things all the time on sidewalks like maybe one T T or a yellow arrow or something but this was crazy And not just on the street 1 mean on everybody s lawns and porches too No lawn on the street was left untouched So I walk up to the guy doing this who was armed with 3 or 4 cans of spray paint and asked him what the hell he thought he was doing He said that he was from the phone company and that he was just doing what they told him to do 1 noticed that his van was not a telco truck but rather an unmarked Chevrolet van 1 figured that since it was the weekend he just drove over in his own van no problem so 1 didn t bother to ask So a few days later Cincinnati Bell shows up to begin work in their marked vans Four of them They worked for a few weeks once about every two or three days and finally finished up and got the lines installed But I asked him what the other guy was there for and they gave me the basic equivalent of Duh 1 dunno and wouldn t listen to my complaints nor those of the several neighbors who had their houses vandalized So now my street is pain
114. r keychain and saying nothing Cover one hole and get exactly 2600 hz cover the other hole and get anoth er frequency Use both holes to call your dog or dol phin Also ideal for telephone remote control devices Price includes mailing 99 95 Not only a collector s item but a VERY USEFUL device to carry at all times Cash or money order only Mail to WHISTLE PO Box 11562 ST Clt Missouri 63105 6 55 MHZ CRYSTALS FOR SALE CHEAP for 1 50 10 1 25 each 100 1 each Contact root kaht ponyx com for info or send orders to B Buckman PO Box 225 Middleboro MA 02346 THE BLACK BAG TRIVIA QUIZ On MS DOS disk Interactive Q amp A on bugging wiretapping locks alarms weapons and other wonderful stuff Test your knowledge of the covert sciences Entertaining and VERY educational Includes selected shareware catalog and restricted book cata log Send 1 1 50 for 3 5 and 2 stamps to Mentor Publications Box 1549 Y Asbury Park NJ 07712 TAP BACK ISSUES complete set Vol 1 91 of QUALITY copies from originals Includes schemat ics and indexes 100 postpaid Via UPS or first class mail Copy of 1971 Esquire article The Secrets of the Little Blue Box 5 amp large SASE w 52 cents of stamps Pete G PO Box 463 Mt Laurel NJ 08054 We are the original HACK THE PLANET A new and exciting board game in which 2 4 players race to complete a hack ing mission Please send 3 00 check or money order payable to CASH Also avai
115. ration for all this It S all very interesting but most people probably want to know when exactly you landed on our planet Corrections Dear 2600 I found an error in last quarter s issue The author of Stealth Trojans states that the processor will send signals out on the bus telling all the cards that data is being written to port 8I FOh Most cards however only look at the lower 16 bits of the address Anyone can clearly see that 81F0h fits entirely within a 16 bit Spring 1996 address I believe the intent was that the high bit would be stripped ignored by the hard disk controller resulting in a write to port IFOh b00da Philadelphia Reality Dear 2600 Well first I want to say that your magazine is cool just got my first issue But 1 have to say something about your movie review of Hackers You said that the raids were like those in real life and 1 doubt that I ve never been raided so 1 don t really know but it seems wrong to me He s a hacker Why would like 20 guys with machine guns jump through the windows and run upstairs He s a hacker What s he going to do Throw his computer at them C mon now They could ve sent two guys through the door with maybe a nightstick each and gotten the exact same results Also it says in the back of the magazine that blue box schematic shirts are still only available by request so here I go Pd like a blue box schematic shirt Meth If you loo
116. re that if you cannot figure out how to do this you are probably not smart enough to figure out the program lt is best to use several paging companies in a lookup list for the program to avoid repeated ly abusing the same one If you use five compa nies and paged the victim 100 times with each the paging company would not become suspi cious considering the thousands of pages cycled on a daily basis and your victim will have been annoyed 500 times The best method is to use small doses say 50 or so pages every three or so hours This could be built into the program since Quick Basic is very flexible As a safety feature compile your program and password in case the victim points the finger at you Happy Revenge Page 9 UNSHREDDINGMMTHE EVIDENCE Page 10 by Datum Fluvius The key to reconstructing shredded documents is to sort the shreds prior to paste up There are so many differences in the angle of each shred what text each document contained which color its paper was and which weight that the identification of individual documents by their shreds is fairly simple It is of course tedious It also takes practice But once the shreds have been properly classified only a few pages exist in each little group of sorted shreds These will submit easily to careful paste up and reconstruction since only one or two hun dred shreds exist in a three page group of average size This article assumes you are not dealing with cross
117. red as if they were shreds and joined whenever possible If two matching strips coexist on a paste up board but remain unjoined they retard your further com parisons since two of the available edges will not match any free shreds That also wastes time When a few documents have been completed transparent packing tape can be used to fuse them or care can be taken to tape only the tops and bottoms of each document with masking tape That way when the shreds are cut free of their tape they are just a bunch of loose shreds again ready for disposal Clear contact paper has been used but it can ruin documents whose shreds will not lay flat anymore due to dampness or lengthy storage Tape is easier to control than contact paper but both media will pull shreds up with their static electric charges unless you ground them Fully taped documents are much easier to store 2600 Magazine Spring 1996 and preserve if you need the original If you want the data invest in photocopies Press completed documents between plas tic overhead projector sheets to keep the copier s glass clean and to align the shreds One thing to remember is that business es and governments use forms whenever possible to save cost These can be road maps to incomplete reconstructed docu ments and are invaluable to have prior to beginning a project If need be clear plas tic can be traced over a completed form to outline just the form boxes When laid over the parti
118. rldwide communication in the history of humanity When word of something needs to be gotten out all that is required is access and the world can know within seconds Now with the growing popularity of the World Wide Web any one with the necessary access has the ability to become their own information disseminator where people from around the world actually come to you for information of any sort And with the growing number and abilities of search engines people anywhere can find you based on the information you provide This kind of power is unprecedented in the hands of solitary citizens It s precisely because of the hacker mentality responsible for creating this medium that the authorities are in such a panic This explains the rush to control every thing from content to accessibility But the pow ermongers are far too late this time The box is open and the rules forever changed It no longer matters what those who don t realize this choose to do They are doomed to failure What is important though is for the rest of us to maxi mize the potential of this technology while it is still in relative infancy As consumers we no longer have to wait for someone to speak on our behalf With the net we can speak for ourselves and be guaranteed an audience and ultimately a reaction of some sort In our last issue we mentioned a problem we were having with an Internet Service Provider Page 4 2600 Magazine PSI who had pro
119. rong s Lane Setauket NY 11733 Second class postage permit paid at Setauket New York POSTMASTER Send address changes to 2600 P O Box 752 Middle Island NY 11953 0752 Copyright c 1996 2600 Enterprises Inc Yearly subscription U S and Canada 21 individual 50 corporate U S funds Overseas 30 individual 65 corporate Back issues available for 1984 1995 at 25 per year 30 per year overseas Individual issues available from 1988 on at 6 25 each 7 50 each overseas ADDRESS ALL SUBSCRIPTION CORRESPONDENCE TO 2600 Subscription Dept P O Box 752 Middle Island NY 11953 0752 subs 2600 com FOR LETTERS AND ARTICLE SUBMISSIONS WRITE TO 2600 Editorial Dept P O Box 99 Middle Island NY 11953 0099 letters 2600 com articles 2600 com 2600 Office Line 516 751 2600 2600 FAX Line 516 474 2677 Spring 1996 2600 Magazine Page 3 Caught 1n the Web How do mere individuals stand up to modern day injustices What can we do to get the word out when the system has failed us and the most important thing is to find others in a similar sit uation who may be able to help out Throughout history this kind of a challenge has been insurmountable to most But the times are changing very rapidly And the one thing indi viduals have over bloated bureaucracies and huge corporations is the ability to adapt quickly We ve learned over the past few years that the Internet is probably the most effective means of wo
120. ry no credit card orders Please make checks payable to LOphT Heavy Industries Massachusetts residents please add 5 sales tax Please allow four to six weeks for delivery ABSOLUTE POWER CORRUPTS ABSO LUTELY Arm yourself with knowledge and information for the Information Age Get informa tion on hacking phreaking cracking electronics viruses anarchy techniques and the internet here We can supply you with files programs manuals and memberships from our elite organization Legit and recognized world wide Our QUALITY infor mation sources and resources will elevate you to a higher plane of consciousness Coming soon Hack videos Fora full catalog send 1 to SotMESC Box 573 Long Beach MS 39560 USA Over 3 000 cat alogs distributed Help Wanted NEED HELP to clear my credit reports Please respond to M D Hall PO Box 162 5025 N Central Phoenix AZ 85012 PLEASE HELP CLEAN MY CREDIT REPORT Reward G Pierre 33 S Broadway 312 Yonkers NY 10701 HELP WANTED 1 live in England our telephone system is British Telecom I keep receiving malicious calls I use the British version of caller identification device They type in 141 to block their number from showing up on my caller display I need either infor mation or a gadget to trace the phone caller or to reveal or unblock their number I will pay for any equipment gadgets and postage in U S funds Please help Send to Lee J Round 25 Plawsworth Road Sacrist
121. s there are corrected steps follow FAIL 1 2second timeout no data rec ing FAIL 2 received data is incorrect Assuming you have completed one of the 51 Test of mobile where maintenance data is above steps correctly the phone will wake up transmitted and looped back in test mode when you turn the power on Display is as follows When you first access test mode the phone s PASS looped back data is correct display will alternate between various status FAIL 1 2 second timeout no looped back information that includes the received signal data strength and channel number The phone will FAIL 2 looped back data is incorrect operate normally in this mode You can now 52x SAT Phase Adjustment A decimal value that access Service Mode by pressing the key corresponds to phase shift compensation in the display will clear and a will appear Use Page 44 2600 Magazine Spring 1996 the following procedure to program the phone l Enter 55 to access programing mode 2 The key advances to the next step Note that test mode programming does not have step numbers Each time you press the key the phone will display the Step next data entry 3 The CLR key will revert the display to 1 the previously stored data 2 4 Thef key aborts programing at any time 5 To complete programing you must scroll through all entries until a appears in the 3 display 6 Note that some entries contain more dig 4 itsthancan be displayed by t
122. s when you push the buttons except for the two or three digit code you put in to speed dial the individ ual apartments When you pick up the receiver to either put in the speed dial number or push a single button next to the particular person s name try using your pocket tone dialer Radio Shack or equivalent type that you put up to the mouthpiece and send DTMF with and see if Page 20 2600 Magazine you can make a local or even long distance call Wow A free phone to call anyone you want Of course you would want to be careful on making a number of long distance calls that would be billed direct to that number but using calling cards PBX s extenders or just local calls should not arouse any suspicion or raise the phone bill of the party who gets the bill for that number Keep in mind that you are at the front door of people s residences so just being there for an extended period of time might be a little obvious so use discretion Also try dialing an ANI number and see what happens If you get a valid number have someone try to call you at that security phone and see what happens Sometimes it will ring on its own and sometimes it may be an actual zextension of one of the phone numbers in the manager s apartments If you really want to get back at the manager cuz he kicked you out or something suppose you could run his bill sky high with 900 numbers but that would be illegal Just one more thing You pick up t
123. sn t such time pressure I pulled out my specially cut alan wrench and opened the bottom panel of the pay phone I set the base unit of my cord less phone there in the bottom and clipped the wires into the pay phone line Then I plugged the AC cord into the receptacle Most phones have these in the bottom panel to power the light on top of the phone I wrapped a garbage bag around the phone to protect it from water damage and the evil GTE linemen and put the panel back on The whole thing took less than four minutes Meanwhile the brutal Celina police force was crawling around the boat yard with flashlights looking underneath all the boats for these hardened criminal kids They never found them though I went back home and picked up my cordless handset I turned it on and dialed the local Wal Mart A recording came on telling me to deposit twenty five cents So 1 called a number a little further away called Mann s Chinese Theater in Holly wood California and was asked to deposit 2 25 tried red boxing the coins in but I think the reception was screwing it up 1 ended up going through a live operator who put the call through for me I decided I d better get this fixed I didn t need GTE dropping a trouble card on my pay phone and discovering my cordless base unit in there So I took the handset apart and hard wired it into my switch Page 13 board I replaced the rechargable batteries with an AC line and built a red bo
124. spoof IPX packets with Packet Signatures something I would personally like to see Trap s article does make one point very clear to Novell CNA CNE types though people do think about how to break into Netware systems however misin formed they may be I would hope that before Novell Hack II comes out that Trap gets some experience and does his research Gandolf Words of Praise Dear 2600 I just bought my first copy of your mag Wow Nice to know there are people out there who are actively defending the liberty that this country was founded upon liberty that has since become corrupted by power hungry feds Ofcourse that s not the real reason I picked out your mag among the hundreds of glossy commercialized computer selections It s nice to finally have a publica tion that isn t totally controlled by industry and political correctness What a thrill it was to open it up and find actual paper white pages filled with nothing but clear cut information I also appreciate your boldness concerning controversial issues such as phreaking and other so called illegal activities These laws against us crimi nals are nothing but the feds way of protecting indus try giants profit margins it is a travesty of free com munication and liberty that there must be a group of people who are forced to break laws and be a secretive society all in the pursuit of knowledge The Cyber Hitchhiker Words of Shame
125. sportable Models If the phone has no FCN button and no RCL button use sequence 3 If the phone has an FCN button use sequence 4 If the phone has a MEM button use sequence 5 If the phone has an RCL button and no FCN button use sequence 6 Access Codes for Sequences 1 through 6 1 FCN SECURITY CODE TWICE RCL 2 STO SECURITY CODE TWICE RCL 3 CTL 0 SECURITY CODE TWICE 4 FCN 0 SECURITY CODE TWICE RCL 5 FCN 0 SECURITY CODE TWICE MEM 6 CTL0 SECURITY CODE TWICE RCL The default security code is 000000 The CTL con trol button is the single black button on the side of the handset NAM Programming 1 Turn the power on 2 Within ten seconds enter the access sequence as determined above 3 The phone should now show 01 in the left of the display This is the first programming entry step number If it does not work the security code is incorrect or the programing lock out counter has been exceeded In either case you can still program the unit by following the steps under Test Mode Programming below 4 The key is used to increment each step Each time you press the display will increment from the step number displayed on the left to the data stored in that step displayed on the right When the data is dis played make any necessary changes and press to increment to the next step number Spring 1996 5 The SND key is used to complete and exit pro graming when any STEP NUMBER is displayed
126. tatus is displayed during the scan when less than 300 milliseconds the status is displayed only during pause Entering dur ing a pause causes the scan to resume Entering aborts the scan and leaves the mobile tuned to the current channel During this command only the and keys are rec ognized Sets Low Battery Threshold Usage 37 x where x is any number from 1 to 255 If set to l the Low Battery indicator will come up when the phone is powered on If set to 255 it may never come up Display ESN Displays ESN in four steps two hexadecimal digits at a time in a four digit display The decimal shows the address 00 through 03 as the first two digits and two digits of the ESN as the last two digits Use the G 0 step through the entire hexadecimal ESN Compander OFF D Series Portables or SND SNM Display shows AA BB Where AA Address BB Data Send the SNM to the display All 32 bytes of the SNM will be dis played one byte at a time The byte address will be displayed in the upper right hand cor ner and the contents of that address will be displayed in the hex The key is used to step through the address similar to the SEND NAM 1842 command Compander ON D Series Portables or RCVSU Receive one control channel word Page 43 When the word is received it is displayed in 4 5 degree increments Compensation added hex This command will be complete when a to inherent phase shift in transce
127. ted multi colored which hasn t faded at all in the many rains and several feet of snow we have had thanks to our good friends at the phone company Mr iNSaNiTY Sounds like vour local TV news might have fun with this one Understanding the Hacker Dear 2600 I m a new reader to this cool magazine picked up a copy of 2600 at a store Volume 12 number 4 Winter 95 96 and had to buy it As I was reading it I came across the article Understanding the Hacker by Bootleg 1 would like to say that I totally agree with everything it said The greatest part was the idea of no more wars with guns but with knowledge that hackers crave for and can t get enough of Thank you Bootleg Sevangles Seven Angles 56K ISDN Link Dear 2600 In your last issue and on your web page 1 was reading about the ordeal with PSInet Well I m glad you got your money back and such but I have a question did you everfind a 56k data over voice ISDN provider I have been desperately seeking one myself I live in northern NJ Please let me know if you found any I also just read more about Bernie S the more and more read about it the more and more I can t believe that is actually happening The things going on are so ludicrous the story just feels fictitious They were pros ecuting him for possession of the Anarchist Cookbook Spring 1996 2600 Magazine Christ you can go buy that at Walden Books or B Dalton How can the not so Secret wanna
128. ter introduced to the Bronco man He was D E A Imagine my surprise When I was asked why I thought I was pulled over I said Well I guess it s obvi ous 1 was speeding The officer asked Bronco D E A man How fast was she doing He replied Oh only about 80 not bad I had no idea what was going on here Bronco Man not Mr Officer had clocked me and by his own speedometer not by a radar gun I must have had this dumb look on my face because Bronco D E A man spoke up Where are you headed I told him I was on my way to Springfield Illinois to be with my mother who has cancer He asked What s with the suitcases 1 told him I expected to be in Illinois quite a while and those were my clothes When asked what else 1 had in the car told him my dog and a few of my worldly belongings you know computer scanner M1200 slippers housecoat He then asked me a string of how bouts such as how much cash I had meth pot alcohol blah blah blah I said Look I can t afford any trouble As you can see I m on probation what s going on here He Bronco D E A man told me that I fit the profile of get this a drug runner 1 was a white female traveling alone in a rented car with suitcases that had airline tags on them I never take em off reminds me of where I ve been and an out of state driver s license 1 still had an Illinois driver s license yet another story Oh my God My mouth dropped
129. ter con troller There s a 14 foot dish or so aimed at the satellite These trailers are capable of handling 100 200 numbers in a single exchange and they actually have pay phones on some of them I got a trunk tone once without using any illicit means to get it I received an incoming call the operator wanted to bill me something for it so I chucked in a coin what the hell I m just lame heard a few clicks and bam I just about killed myself because my BB was 500 miles away in Anchorage All of the major towns with more than 2 500 peo ple usually have a microwave tower or a larger satellite setup and switch The satel lite is also nice because you can make calls from just about anywhere if you re leet enough to have the suitcase transciever kit The rest of the state is littered with Earth Stations and toll complexes etc There s also fiber optics from Fairbanks to Anchorage to Juneau the three major cities which covers quite a few hundred miles on the way We also have a fiber line in between Japan and Portland don t ask me why they didn t use Washington named the Trans Pacific Cable that s used for 99 percent of long distance calls but it has been cut Spring 1996 2600 Magazine before by boats and other unknown caus es four times in the just the last year so the satellite is still used for backup The long distance companies must make their money through leased lines as a T1 to Seatt
130. tes the call automatioally to the carrier you normally use You may have seen the attached article in a recent edition of USA TODAY Consumer reporters at your local newspaper TV or radio station might be interested to learn that you too have had such an experience That s one step you can take to hasten the end of this widespread consumer problem Another is to write to The Honorable Reed Hundt Chairman FCC 1919 M Street NW Washington DC 20554 Tell him you have heard about billed party preference and that it could eliminate the kind of problem that you experienced Your support for billed party preference puts you in good company For example one of the best regarded consumer protection organisations The National Association of State Utility Consumer Advocates as well as eeveral state publio utilities commiaxione have filed comments with the FCC expreming support for billed party preference Whether or not you are an MCI customer you can be sure that my company supports your power to choose a long distance company in all dirrumstanams We intend to continue fighting for American consumers on this issue and we invite you to join us ly uf MCI GETS US AGAIN You would think filing a complaint with the FCC would protect you from those pesky MCI telemarketers Guess again Every time you complain about a phone company you wind up on a list that phone companies have access to And they get so angry when we find their lis
131. the unit If it is a 10 81 or 30 call unit buy it as it should be very inexpensive If it is a 60 number unit you can now make it hold 25 additional numbers If it says 85 call it is maxed out and you cannot increase the storage How to hack it So your unit says 1 2A or 1 4 when you power it up and you saved tons of money by purchasing the 10 number version Get out your Phillips screwdriver and take out the two visible screws on the bottom of the unit Peel off the rubber feet on the opposite side of the two screws you just removed and you will find two additional screws total of four that will let you open the box just peel the feet off and save them Now we can see the circuit board In the off set in the middle side of the board you will see a GoldStar chip with the number GSNI5 GM76C28AFW 10 or somthing similiar Beside it you will see one of two jumper pads depending on the ROM version you have The two versions are as follows Version 1 2A One pad unlabeled with four solder points Blue trace wire from GS Chip to A 10 number Eng Spanish B 85 number Eng Spanish C 10 number Eng Spanish D 10 number Eng Spanish Make sure you solder the wire to the correct side of the pad Version 1 4 Two sections labeled Spring 1996 X2 C oo 10 B oo 30 A oo 60 None 85 Call Call Call Call Remove solder b t pads R17 D oo French English E oo Spanish English F oo English Only With
132. things I ve learned about something we ve all seen dealt with and sometimes cursed at I m talking about those telephone security systems in the front of apartment buildings You know what I m talking about those damn phones you have to pick up the receiver and push a button and wait for your friend relative to pick up the phone and then decide whether to let you in the building or not Thenthey push a magic button andthe electric lock on the front door opens for a few seconds and you have to hurry and put the phone back and run to the door and open it before the buzzing stops I m not talking about the simple intercom types but the ones where you hear a dial tone and the button you push speed dials their apartment phone number dial tones can you see where I m going already I started to get curious when I saw how my friend lets people in when he gets a call from the lobby on his phone When whoever it is says I m downstairs let me in the resident then pushes a button on his phone and holds it for two or three seconds and lets go The secu rity phone downstairs senses this signal and energizes the electronic lock from my friend holding down the 6 key on his phone for a few seconds and letting go All fine and well you say but what does this do for my curious mind Well to begin with most of the security phones in the front of the building have a standard telephone keypad built in but you cannot get any tone
133. to their phone box So the day after that I got free cable A few weeks later free cable alone just wasn t enough for me 1 wanted to be able to con trol what my neighbors watched So I hooked up sort of a loop so that their cable line was coming to my house before it got to them Then I built this little switchboard Page 15 next to my phone switchboard that consist ed of a few TV monitors a VCR a video camera and some video mixing devices By the time I was through hooking it all up I had the power to change their chan nels make them watch my home video col lection or wipe their TV show off the air with a variety of 37 different wiping tech niques I also had a monitor set up showing me exactly what they were seeing in their house By now you re probably wondering what these neighbors did to me to make me want to be so mean spirited to them Well nothing They just lived at the wrong house at the wrong time I tuned in to their phone and TV The old lady was talking to Gertrude while watch ing The Price Is Right and her husband was out in back trying to figure out the prob lems they ve been having with their bug zapper light I left her TV picture on but muted the sound so I could talk over Bob Barker Using my voice changer I announce Greetings Earthling Mildred I am alien visitor Q359 Kriegsmitzelpap shmeer I come in peace Take me to your leader Bob Barker or I will disintegrate your house Oh and I als
134. ts PAGE OF REVENGE by Big Lou Youve seen the titles and heard of the results However nothing mean nothing can compare to the chill down your victim s spine as he she is blasted for hours or even days by the ever annoying sound of ving ring Hello yes this is Dr Smith did you page me only to have it happen 45 seconds later ring ring Hello yes this is ACE Gravel and Dirt did you page me So Walmart pissed you off Wanna lock up their phones for three or four days Ex wife still on your back The local cops don t like you because you molested your laptop Imagine a metropolitan area like New York and how many people there are in it with digital pagers Imagine only 10 percent of that pager population being paged with your favorite enemy s home or business number Well folks imagine no more The concept is real and it works very well Now first a word of caution Just like a handgun has potentially deadly rami fications a program to page at will and en masse can also prove equally devastating This retribution method should be reserved for only the most serious of paybacks and should be used wisely The method for this high tech but very sim ple method of payback requires a working knowledge of Basic Quick Basic or even Assembly if you re that good a computer with a modem laptop preferred and a small list of pager numbers First the program is just a sim ple dialer t
135. ty area that happens on other nights or if such a meeting could be arranged I am generally new to the H P scene and although 1 do not intend to do any major H P activ ity 1 am interested in the stuff So any help in arranging a meeting of 2600 on a night other than Friday would be of great help to me Joshua Friday night has always been the night for 2600 meetings sincetheir inception back in 1987 Before that TAP meetings were held on Friday nights as well It s the whole tradition thing which seems to be clashing with vour tradition thing It possible we may need to make some sort of a change to accommodate more peo ple since the meetings have grown so much over the vears But this is something that needs to be worked out carefully right now everyone knows that the first Friday of the month is 2600 meeting day By branching out to other days we could lose that recognition factor and also make things a whole lot more confusing for everyone We re open to suggestion In the interim remember that 2600 is onl yone forum you re free to do whatever you want under the name of other groups if you disagree with or can t meet our guidelines Page 33 Dear 2600 Please give me some more information about the meeting in London I know that it is at the Trocadero Centre by the VR machines and know the time But how should I know who to look for What age of peo ple And how should I introduce myself At the moment i write code in ass
136. ure and possibly vour life Opening a cash register without permission is ver v different from logging onto a com puter without permission despite what some author ities want us to believe by Dennis Fiery There is an interesting security problem with the Sharp ER 3100 cash register The ER 3100 is an inexpensive model that can be fully programmed by the user but the security problem is about as low tech as you can get I ve seen this model being used in bagel stores pizza places including the Sbarros chain libraries video stores and elsewhere so this is a pretty popular choice as far as registers go You can recognize the register because it is beige and it sits on top of a silver grey cash box The register and the box appear to be two separate pieces but actual ly they are bolted together as one On the back of the register the side that faces the customer there is a moveable lighted display that shows the cash total in green and it has the word Sharp printed on it in white lettering Weare all familiar with the great precautions that store owners take to prevent employee theft If you have someone working the register in your store you have to trust them to a certain degree But as you know if you ve ever had a job behind a counter the boss usually has a bunch of rules that must be fol lowed so he can keep track of who is using the cash registers and how they are being used In some stores receipts are imprinted
137. us DTMF to enable Digit 2 Transportable Ringer Speaker 0 Transducer 1 Handset Spring 1996 2600 Magazine Page 39 Digit 3 8 hour time out in transportable mode 0 to enable On newer models they have added and changed some numbers As of the 3 27 92 manual the 3 digit binary field has become a 5 digit binary field Digit 1 Failed Page Indicator 1 Disabled 0 Enabled Digit 2 Motorola Enhanced Scan 1 Enabled 0 Disabled Digit 3 Long Tone DTMF 1 Enabled 0 Disabled Digit 4 Transportable Internal Ringer Speaker 1 Handset 0 Transdcr Digit 5 Eight Hour Timeout 1 Disabled O Enabled Test Mode Access Newer 95xx Phones Thank you Motorola Many newer phones don t require grounding If your software version number is 9526 I think or newer enter this FCN 0 0 83786633 STO In case you have trouble remembering the number sequence it spells out TESTMODE Leave it to Motorola to make this easier and easier all the time I have used this and it does work This command just backs up my claim even further that ESN changing via handset is a reality It s a matter of finding the correct combination of keys Normal test mode commands work like usual from then on For some odd reason this hasn t been included in all the 95xx phones I believe they started it in Software 9526 This is only an estimate so if you have a 95xx flip let me know what software version you have and whether
138. vada where outer space aliens are will take some of their loot known to frequent Finally and invest it into say a real part six is a press confer ence on Operation 2600 Magazine Gopgas repeatedly knocks his tie clip micro microphone or at least disable the automatic vol inne conirols on their camera equipment Page 57 5i BRERBSSRER NORTH AMERICA Anchorage AK Diamond Center Food Court smoking section near payphones Ann Arbor MI Galleria on South University Atlanta Lennox Food Court near the payphones by Cinnabon Baltimore Baltimore Inner Harbor Harborplace Food Court Second Floor across from the Newscenter Payphone 410 547 9361 Baton Rouge LA In The LSU Union Building between the Tiger Pause and Swensen s Ice Cream next to the payphones Payphone numbers 504 387 9520 9538 9618 9722 9733 9735 Bloomington MN Mall of America north side food court across from Burger King and the bank of payphones that don t take incoming calls Bolse ID Student Union building at Boise State University near payphones Payphone numbers 208 342 9432 9559 9700 9798 Boston Prudential Center Plaza Terrace Food Court Payphones 617 236 6582 6583 6584 6585 try to bypass the carrier Buffalo Eastern Hills Mall Clarence by lockers near food court Charlotte NC South Park Mall in the food court near the payphones Chicago 3rd Coast C
139. ve not had much success blue boxing off of our lines but that s just within Anchorage There are two long distance carriers in General Communications Inc 077 880 Alascom 10866 No sway lliszu doni hed eie a feature named Malicious Call Hold which they forgot to omit if someone calls you from within your wire center you press the button on your Meridian phone and they can t hang up It s fun Customer Data Change you get an account on the switch and get to play with your lines is only 4 month but there s a 7 500 startup SMDI Simplified Message Desk Interface read your philes costs 600 month These are only available under Centrex yes we do have Centrex Spring 1996 but the even funnier part is that a normal Centrex line is two dollars a month cheap er than a normal business line I don t know what they were smoking when they came up with their pricing including their inflated leased line prices above but it s the government what can you say The rural telcos are a lot more fun to play with Alaska has two of our own communications satellite Aurora and Aurora II stationed in geostationary orbit above us They re owned by Alascom but GCI gets access to it as with all of Alascom s equipment Alascom makes these crappy CO in a trailer things that they ship off to all the Eskimo villages and such which from what I can tell are some old Crossbar stuff with a transmit
140. version 1 2A you must solder the trace wire from the GoldStar chip to the separated gold pad on the circuit board that is labeled B to obtain full capacity of 85 numbers With version 1 4 you will need to remove the solder that is bridged between the circuit board pads labeled as o above to increase the capacity You will most likely have solder bridged between the A B or C pads Your language will most likely be jumpered between the pads labled E which lets you select English or Spanish after bootup If you want to force English or allow French and English just remove the bridge from pad E and span the pads between D or F with solder That s all there is to it As new Caller ID Call Waiting displays who is calling you while you re on call waiting boxes come out I ll have a fix for those as well most store 99 numbers initially I ve hacked around with half a dozen different boxes and CIDCO s are the best Others like TT Systems will only change button features when you cut traces instead of increasing capacity so it s no use explain ing those If you have a different CIDCO ROM revision or another CID box look for a jumper pad or solder points Chances are you might be able to hack it in the same manner that we can with these WRITE FOR 2600 Apart from helping to get the hacker perspective out to the populace and educating your fellow hackers you stand to benefit in the following ways
141. with the clerk s name In other places a code letter or number is used the ER 3100 offers four different letters that can be printed on a receipt A B D and E The store owner can insert a key into the register turn it and press a button or series of buttons to print out an activity log giving a complete breakdown of what money is in the register Page 18 2600 Magazine what was purchased and what money was refunded Big Brother is definitely smiling about all these pre cautions bosses take to spy All of the above is a good way to keep track of individual transactions but whenever the cash draw er is open the clerk can swipe out a handful of money Cash registers generally have a No Sale button on them which allows the drawer to be opened without a transaction being issued No Sale is mostly used when someone comes into the store and asks for four quarters for a dollar or other change The No Sale button is dangerous because it opens the drawer and while it s open anything at all could go on and the boss doesn t have much control over that except to trust the cashier s honesty There are some precautions taken to try to pre vent employee theft when a No Sale is rung First of all when No Sale is pressed the cash register rings its bell If the supervisor or manager is on the other side of the room they will know that the regis ter is open and the employee will realize that he or she is somewhat u
142. x on the switchboard that was hooked directly into the cordless phone s microphone Then I boosted the antenna by hooking it to the old TV antenna on top of my house This was getting to be pretty fun The next morning I had the alarm set for 10 00 a m so I could sit at my window and wait for yuppies to use my pay phone My first customer came at 10 18 a little kid who used a copper slug Damn him I should call his parents for this Anyway I came on and impersonated the operator telling him he was in big trouble and if he didn t put in a real fifty cents immediately I would come over there and rip that St Louis Cardinals hat right off his head and hit him with it He hung up looked nervously around and quickly disappeared into the alley At 10 57 while I was in the middle of my Frosted Flakes breakfast the neighbor hood mailman stopped by to use the phone I looked through my binoculars and saw him punch a zero first I was so happy milk came out of my nose When he tried to enter his calling card number I interfered by hitting some extra numbers He tried it again and 1 messed him up again Then I heard the AT amp T recording Please hold for operator assistance An operator came on and asked for his card number He read it off as I wrote it down I was so grateful to him 811 didn t even harass him during his call I got three calling card numbers that day The next day I got a little more cre ative I got on
143. xpressing false bravado or attitude telling the cops they are dirty and cursing This is dead wrong If your readers put on such a belligerent attitude with the cops they risk being hit and beaten or depending on social status even killed Again the cops will say Don t like it Sue us This happens all the time What should someone do in case of interrogation Keep cool Be friendly help P Li ut vou just 2 cuo nae Do make a story with your friend s if aes some gray activity Do tell the same story over and over and over and over Do wait them out It is a game but a game of the most serious nature with your physical body on the line The Prophet Dear 2600 i would like to make a few comments about the article Hacking a Police tion Autumn 1995 The advice the author gave don t tell them BiVing out this 4 The Kinesic Interview Tec phase behavioral analysis system that is used to improve the commun ocess in order to conduct more effec tive and efficient interviews and interrogations The foundation of the technique rests on the common everyday behavior of human beings and their diverse com munication skills The preceding text was quoted directly from the handy police training manual I got to keep after completing the course Please notice that victims and eyewitnesses are interviewed by the police while suspects are interrogated The only difference between the two met
144. y Many boards have LEO s of telco as members usually without the SYSOP s knowledge Posted messages have time stamps telco records have timestamps traces or ille gal calls the two can be matched up Speaking to the media baiting LEO s writing articles and publicly displaying illegal activities is publicity LEO s go after those that are most visible especially when that person has had media exposure because it makes the LEO look more effective Think about it I am not an LEO nor related to one and I don t play one on TV I ve been pulled over a number of times for minor traffic violations I avoided arrest for some fairly serious activities a few years ago by insulating my public and private persona Page 27 Opening More Doors Dear 2600 Concerning garage door openers ours has an 8 bit DIP switch inside giving a whopping 256 different codes We replaced the switch in ours with a CMOS 8 bit counter and 555 timer to drive it Now it counts through all the codes in under a minute We drive around to see who has the same brand of opener The local fire department does You Eastern Euro Dear 2600 1 received two issu am the first Croatian 6j Letters I read that yo As I would be very mu amp with applying for this believe that All you have to do former Soviet Union a just a letter from the that little effort ANAC Chang Dear 2600 A quick update o regarding AT amp T s univ the r

Untitled - beardyjay

Contents

Download Pdf Manuals

Related Search

Related Contents