| 1209Hz | 1336Hz | 1477Hz | 1633Hz | |
| 697Hz | 1 | 2 | 3 | A |
| 770Hz | 4 | 5 | 6 | B |
| 852Hz | 6 | 8 | 9 | C |
| 941Hz | * | 0 | # | D |
VMB (Voice Mail Boxes) are used by company to help manage internal phone systems. They offer a range of services from personal answer phones to internal routing of calls. One facility often abused is the ability to get an outside line. Companies often overlook the security of their telephone systems when conducting installations and audits. ALL telecommunications should be considered when securing systems.
You may like to read ColdFire's Meridian VMB hacking document and the official Meridian website.
PBX stands for Private Branch eXchange and is the term used to describe in-office telephone systems (eg. Meridian). You mustn't get PBX confused with VMB (although one can involve the other). Abuse of a PBX often involves re-routing calls to other numbers. You pay for the call to the PBX which reroutes the call to a long distance number which the owner of the PBX must pay for. Obviously this is illegal if you do not have the permission of whomever is paying the bill. It is not a difficult matter for the telephone company to trace you even if you manage to route your call through several different systems.
A complete and up to date guide to boxes is Fixer's Box Review. Also see Fone Ranger's UK Box pages.
Can I blue box in the UK? No, yes, kind of. IFf you can find a country direct number that terminates in a country with a CCITT5 mechanism AND the tones aren't filtered along the way, then yes you can blue box through that number. The UK has used SS7 for some time now making blue boxing inside the UK impossible. China, Belize, Venezuela and Nicaragua may still use C5 at the time of writing.
Can I red box in the UK? Yes and no. Pay phones in the UK have filters in place to stop that kind of thing from happening. If you call up a suitably gullible operator you might be able to perform some social engineering wizardry and they'll remove the filters to allow you to put money in.
War-Dialing (aka scanning) is the practice of repeatedly dialing phone numbers, to find out what is on the other end. These are mainly voices, although sometimes you may find trunks, carriers (modems), VMBs, Faxes, and other strange stuff. 'Tone-Loc' is a highly acclaimed package to aid scanning. Normally you scan a block of numbers (the most common scans are of 0800 / 0500 because they're free) and keep a log of anything interesting you find for later attention. Scanning may be illegal under the Computer Misuse Act [see Section 4.2].
Often identification is the challenge. It is not so much the actual cracking of a system, in many cases it is trivial, it is more knowing that it is VERSION x REVISION y and that VERSION x REVISION y has potentially unpatched security issues. It is pointless to build a profile in any telephone logs in a futile attempt to hack blind. Availability. In the UK many organizations rely on copper wire modems for communications. This is largely due to the lack of cheap broad-band access even in 2001.
ISDN. ISDN can be war dialed. It is less easy with CAPI based ISDN adapters but trivial with those which accept AT commands.
Linux. Linux has very few war dialing packages pre-fabricated. However DOSEMU is trivial to set up and even the VGA version of TLO can be ran with little or no problems. With some UNIX/BSD/Linux and shell scripting knowledge chat scripts can be generated on the fly. With the richness of UNIX/Linux/BSD C/Perl and countless other languages you can do some amazing things. Regex IDing and adaptive tree based searching come to mind. This does require intermediate UNIX/Linux/BSD skills. So rather than ask "How do I war-dial under *nix" jump a few newsgroups and start asking "How do I do x for the purpose of y in z *nix?"!
Logging. BT do log. Most companies PBXs log. Often, still, companies don't check PBX logs. This is not to say that you will not be caught. There are many exceptions, particularly post hack where a company will check their phone logs. Often post hack this will be done to build a case against a cracker and with most modern SMAS OS's it is trivial. In fact as easy as any other UNIX system administrator checking their logs.
How do I avoid getting logged? This is a difficult question and requires thought on your behalf. Firstly war-dialing from home provides a direct link between yourself and any system attacked. So you shouldn't be asking that question, should you? If you have, go away for a while and come back when you have thought about it. Think Calling Cards. Think Cash Payment. Think Pay-As-You-Go. Think remote locations. Think multiple locations. Think about taking your time. If you haven't built up some kind of idea of how you are logged, go away and come back when you do. This applies as much to IP networks as telephone networks.
The risks involved with war dialing are dependent on the prefix you're operating within.
You may want to grab a copy of the OFTEL listings to determine who provides the services for your particular target as well; Soon you too will discover the beauty of subscriber leased DMS tekneeq. :-) Interesting ranges are marked as Allocated, and classed with a provider name. Other particularly interesting ranges turn up as protected. Don't be fooled. These are the older 3 digit DDSN ranges, aka 0800-XXX-XXX. Scan them and be damned, you'll find lots of interesting stuff to play with. Strangely enough, the OFTEL docs are in an archive called codelist.zip. How Ironic.
If you're serious about doing some damage with Toneloc or the like, get a second line. Your parents/spouse/SO/flat-mates will appreciate the line being free, and you don't have to have a schizoid embolism every time they pick up midway through a nMap sweep.
You pick up the phone, dial the number, and wait for them to answer :-). Other than that they're used in blue boxing, using calling cards, finding modems and voice-mail/PBX abuse. The reason the get a lot of attention from phreaks is they are FREE!
What are the 0800 89xxxx numbers for? They are direct overseas lines (known as country direct numbers), most will ask you for pin numbers. BTs originally lumped all it direct overseas lines in this area, but it has now realized this wasn't such a good idea and is distributing them more evenly. Mercury's country direct numbers are evenly distributed through out the 0500 xxxxxx range.
Country direct numbers are numbers which forwards calls to a regular number in the remote country. I believe these numbers are arranged with your local Telco, who rent a number of 0800/0500 lines from BT/Mercury and pay BT/Mercury for incoming calls over them. The remote Telco then resells these numbers to company's requiring a toll-free number from the UK. You are not charged for the call, the company you reach is paying for the call, as with all 0800/0500 numbers.
On modern exchanges BT sends the phone number of the number which called you (when possible), just before the first ring - sometimes you can hear the data packet if you have call-waiting enabled and CLID as well; the packet is broadcast at 1200 baud (if you have call-waiting enabled you can sometimes hear the CLID packet being sent). BT will sell you a device to read these (approx £50 at time of writing). Home-brew (obviously non BT Approved) are around, or take a look at http://www.solwise.co.uk/ who have various units for sale. You also have to pay BT for the receiving the data - this is about a £10 a quarter. Caller-ID modems are now also available which will transmit the data packet to a serial port of a computer, as are devices to plug into your serial port.
For a more detailed discussion see 'Caller Display and Call Return' by William Dangerfield, Simon Garrett and Melv Bond in British Telecommunications Engineering; Volume 12 part 3 (October 1993). Also See Supplies Information Note (SIN) 227, available on 0800 318601. BABT have issued a specification, BABT/SITS/94/53 to replace the draft specifications BABT/TC/128 and BABT/TC/131. This specification is identical to the 131 draft and is shorter and easier to meet than the 128 draft. A copy can be obtained from BABT on (01932) 222289.
You can block the sending of your phone number you are dialing by prefixing it with 141. Your also have the number of the last person who called (from a phone which supplies caller ID) by dialing 1471. 141 though is by no means secure and just stops the data from being supplied to the caller, not the exchange itself!
There is also an excellent UK Caller ID FAQ at
http://www.ainslie.org.uk/callerid/cli_faq.htm
The UK Info Disk is a CD containing a database of UK telephone numbers and addresses as produced by 192.com. Many people come to the newsgroup and ask for cracks or copies of the professional version which allows you to do reverse look-ups, that is, find an address from a phone number. However this is not a warez group and you will be frowned upon. Piracy is illegal, if you can't afford software, there is plenty of free software available for you. 192.com spent a lot of time creating that disk and breaking BT's monopoly on directory inquiries. That deserves respect, especially from the phreaking community. I
If you are looking for a crack, don't ask us where to find one. Don't claim to own the software and have lost the registration key, that's your own fault and you should have made a note of it. Phone 192.com and they will probably help you out if you can prove that you own the software. Come to think of it, there is really no need why any individual would need the professional edition. If want to trace someone from a phone number e.g. you are being harassed, then go through the proper channels to get it dealt with, it's a lot easier and also more effective.
Green BT wiring cabinets (also known as PCPs) - usually seen in the street -
tend to be a "reasonably ordered mess" inside, and are where you really need to
beige box from. A good guide by ColdFire is available at
http://www.phreak.co.uk/fone.ranger/phreaking/btwiring.txt
An updated version can also be
found.
There are a number of attacks and ways of making free calls simply using a fax back system. Attacks usually consist of making large numbers of calls to a small selection of numbers. Free calls can be gained because the system dials out itself.