💾 Archived View for aphrack.org › issues › phrack10 › 3.gmi captured on 2021-12-03 at 14:04:38. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
==Phrack Inc.==
Volume Two, Issue Ten, Phile #3 of 9
**********************************
* The TMC Primer *
*--------------------------------*
* Written by: Cap'n Crax *
*--------------------------------*
* December 17, 1986 *
**********************************
This file was originally intended to be a "data file" of info on TMC ports,
formulas, etc, but I decided that it would serve a better use as a "tutorial"
of sorts. But first a bit of background info...
Who is TMC?
TMC (TeleMarketing Communications) is a long distance service serving all 50
states. While not as well known as MCI or Sprint, they are a fairly large
company. They are capable of setting up business communications systems,
PBX's, and residential service. Unlike most LDC's, however, they operate on a
"franchise" basis, which means that each franchise of the company has little
information about any other franchise, although they do use the same lines and
the same type of equipment.
So, what can they do for me?
Well, for most of us, TMC offers many new potentials for abuse. One of the
primary weak points of the company is the code formats that they decided to
use. Codes on all TMC ports are seven digits. If they were generated
randomly, this would be a reasonably secure system from sequential code
hacking. But TMC doesn't use random codes. Instead, they use a checksum based
formula system, with different formulas on each port. I assume that this is
because they wanted a wide displacement of the codes over the seven-digit
series, so that a sequential code hacker wouldn't be able to get 2 or 3 good
codes in a row. Or perhaps they are just very stupid. In any case, it's
interesting that they seem to have never thought of what could happen if
anyone ever managed to figure out any of these formulas. Anyway, that's what
this file is about.
Great! What else can you tell me?
Well, TMC seems to use some form of the Dimension PBX system for their billing
system (Their ads say that the switching equipment is digital). This makes
TMC ports easily identifiable by the "Hi-Lo" bad code siren. For those who
worry about such things, TMC is one of the "safer" companies to use. This is
largely because, unlike "unified" companies like MCI, TMC franchises don't
really care if another franchise is losing money. Since each franchise is
independent of all others, there are many 800 ports, one for each franchise.
If you use an out-of-state 800 port, you are free from such worries as ANI,
which I have never perceived as a major threat to the code-user anyway. Also,
TMC offers lots of opportunities for the aspiring security consultant
(hehehe).
Ok, so where's some real info?
Right here. I am going to explain as much about TMC hacking as I can manage,
without actually handing out codes. First, an example port. The example I am
using is the 800 port for Louisville, KY.
1-800-626-9600
This is the port. If you are not familiar with TMC, you may want to call it
to see what it sounds like. So let's say you call it and recognize it as a
TMC. What next? Well, a good bet would be to run a standard "code-hack"
program on it... Set it for seven digits, 1+ the number, and note that TMC
codes start with 0 on more than 50% of the ports I have seen. So let's say
that you then get this list of (fictional) codes...
0347589
0347889
0348179
0350358
0355408
At first glance, this may look like a series of "random" numbers. But, look
closer. These numbers are based on a checksum. It is as follows...
Code Format: 03xabcy
x+y=13
(In the first code, x=4 and y=9, and, of course, 4+9=13)
a+c=15
(Here, a=7 and c=8, and 7+8=15)
b=1 to 9
(Digit "b" is unrelated to the rest of the numbers. It could, for example, be
varied from 1-9 to possibly find more working codes)
Also note that 0+5 would equal 15, since the 0 is really a 10. Really!
Please note that the above formula is only fictional. I wouldn't want to
possibly cause loss to TMC by giving away codes on their system!
Is that all?
No, of course not. TMC, in their love of telecom enthusiasts, has also put an
additional prize in the Krackerjack box. The vast majority of TMC ports have
"Outside Line" codes, which is a 2 or 3 digit number, that, when entered after
certain codes, will give an AT&T dialtone. This is apparently a holdover from
the fact that they are using PBX equipment. Anyway, if anyone is asking why
you'd want an AT&T dialtone, (does anyone need to ask?) it will allow
unrestricted calling. This, of course, means 976's, 900's, Alliance
Teleconf., international calling, etc... Naturally, I can't list any of these,
but I can say that if it is 2 digits, it would start with any number from 2-9
and end in 8 or 9. If it is three digits, it will almost always start with 6,
and be followed by any two digits. Some possible outside line codes would be
59, 69, 89, 99, 626, 636, 628, etc... These, of course, are only examples of
possible codes. As I mentioned, these O/S line codes are entered after the
seven digit code. The O/S line codes only work after certain 7-digit codes,
and from my experience, the 7-digit codes that they work with normally can't
be used for the usual 7 digits+1+number dialing. I can find no apparent
pattern to the codes that they do work with, so you will have to find them by
trial-and-error.
What, you want more?
Ok, well, here's a few 800 ports...
1-800-433-1440 1-800-227-0073 1-800-331-9922 1-800-451-2300
1-800-354-9379 1-800-248-4200 1-800-531-5084 1-800-351-9800
Closing.
Please note that this article is only intended as an overview of TMC and why
they would/wouldn't be a good choice for your long distance needs. And
goodness me, don't use any of this information in an illegal way!