💾 Archived View for spam.works › mirrors › textfiles › phreak › beatcid.txt captured on 2023-06-16 at 19:39:37.
-=-=-=-=-=-=-
Beating Caller ID
by The Fixer
v.1.03 98/08/30
(C) 1998 The Fixer's Tech Room
For free distribution - you may freely repost & distribute this but not
for profit without permission of the author. See further restrictions
at the end of this file.
To start off with - 12 Ways to beat Caller ID
(0) This doesn't count as a way to beat CID, but there's a general
principle to consider when contemplating ways to beat CID.
Generally, the CID signal your target sees corresponds to the owner
of the dial tone you call him from. If you call direct, you dial
from your own dial tone and your line is identified. If you call a
third party, and by whatever means manage to acquire his dial tone,
and from there dial out, it is the number associated with that
second dial tone that your target sees. Some of the ideas following
this were developed with this basic idea in mind.
(0.5) This also doesn't count, but remember that beating Caller ID as
such is only the first layer of your protection. If your calling is
sufficiently annoying or criminal, there is *always* a paper trail
(ANI data, billing data, trouble reports, *57 traces, etc) leading
back to the phone you first called from. That trail is not always
easy or worthwhile to track you down with. Whether or not the trail
is followed depends entirely upon how pissed off your target is and
how much co-operation he can get from the phone company, law
enforcement, etc.
(1) Use *67. It will cause the called party's Caller ID unit to
display "Private" or "Blocked" or "Unavailable" depending on the
manufacturer. It is probably already available on your line, and if
it isn't, your local phone company will (most likely - please ask
them) set it up for free. This is the simplest method, it's 100
percent legal, and it works.
(2) Use a pay phone. Not very convenient, costs 25 or 35 cents
depending, but it cannot be traced back to your house in any way,
not even by *57. Not even if the person who you call has Mulder and
Scully hanging over your shoulder trying to get an FBI trace (sic).
Janet Reno himself couldn't subpoena your identity. It's not your
phone, not your problem, AND it will get past "block the blocker"
services. So it's not a totally useless suggestion, even if you
have already thought of it.
(3) Go through an operator. This is a more expensive way of doing it
($1.25-$2.00 per call), you can still be traced, and the person
you're calling WILL be suspicious when the operator first asks for
them, if you have already tried other Caller ID suppression methods
on them.
(4) Use a prepaid calling card. This costs whatever the per-minute
charge on the card is, as they don't recognize local calls. A lot
of private investigators use these. A *57 trace will fail but you
could still be tracked down with an intensive investigation (read:
subpoena the card company). The Caller ID will show the outdial
number of the Card issuer.
(5) Go through a PBX or WATS extender. Getting a dial tone on a PBX is
fairly easy to social engineer, but beyond the scope of this file.
This is a well-known and well-loved way of charging phone calls to
someone else but it can also be used to hide your identity from a
Caller ID box, since the PBX's number is what appears. You can even
appear to be in a different city if the PBX you are using is! This
isn't very legal at all. But, if you have the talent, use it!
(6) I don't have proof of this, but I *think* that a teleconference
(Alliance teleconferencing, etc.) that lets you call out to the
participants will not send your number in Caller ID. In other
words, I am pretty sure the dial tone is not your own.
(7) Speaking of dial tones which aren't yours, if you are lucky enough
to live in an area with the GTD5 diverter bug, you can use that to
get someone else's dial tone and from thence their identity.
(8) Still on the subject of dial tones which aren't your own, you can
get the same protection as with a payphone, but at greater risk,
if you use someone else's line - either by just asking to use the
phone (if they'll co-operate after they hear what you're calling
about) or by the use of a Beige Box, a hardware diverter or bridge
such as a Gold Box, or some other technical marvel.
(9) This won't work with an intelligent human on the other end, it
leaves you exposed if the called party has a regular Caller ID box
with memory, and has many other technical problems which make it
tricky at best and unworkable for all but experts. A second Caller
ID data stream, transmitted from your line after the audio circuit
is complete, will overwrite the true data stream sent by the telco
during the ringing. If the line you are calling is a BBS, a VMB, or
some other automated system using a serial port Caller ID and
software, then you can place your call using *67 first, and then
immediately after the other end picks up, send the fake stream. The
second stream is what the Caller ID software processes, and you are
allowed in. See the technical FAQs below for an idea of the
problems behind this method; many can be solved.
(10) Someone in alt.2600 (using a stolen AOL account, so I can't credit
him or her properly) suggested going through 10321 (now 10-10-321)
or 10288. Apparently using a 10xxx even for a local call causes
"Out of Area" to show up on the Caller ID display. I live in Canada
where we don't have 10xxx dialing so I can't verify nor disprove
this.
(11) There are 1-900 lines you can call that are designed to circumvent
Caller ID, ANI, traces, everything. These services are *very*
expensive, some as high as $5.00 a minute, but they include long
distance charges. This was first published in 1990 in 2600
magazine, and in 1993 the IIRG reported that 1-900-STOPPER still
works. Beware - even if you get a busy signal or no answer, you
will get charged at 1-900 rates! Another one published in 2600 in
1990: 1-900-RUN-WELL. That one supposedly allows international
calls. I'm not about to call either one to find out. Note that you
could still be caught if the operators of these services were to be
subpoenaed.
(12) Use an analog cellular phone. Most providers of plain old analog
service show up on Caller ID as "Private" or "Out of Area" or a main
switchboard number for the cell network. This is becoming less and
less true as cellular providers move to digital cellular and PCS,
which pass the phone's number on Caller ID. Corollary: Rent a
cellphone by the day. This might even be cheaper than using a
prepaid phone card.
How Caller ID Works
Caller ID is a data stream sent by the phone company to your line
between the first and second ring. The data stream conforms to Bell
202, which is a 1200 baud half-duplex FSK modulation. That is why
serial Caller ID boxes run at 1200 baud.
The data stream itself is pretty straightforward. Here's an example:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU?'^D032415122503806467x
The first thing of note is the 30 U's. Those are actually sync pulses.
A "U" is 55 hex, or 01010101 binary. This is called the "Channel
Siezure Signal."
After that comes 130 milliseconds of 1200 Hz (the Bell 202 "mark"
frequency) which usually shows up in the datastream as a character or
two of garbage.
That is followed by the "message type word", which is 04 hex for
standard Caller ID, 07 hex for Name & Number. A word, by the way, is 8
bits for our purposes.
That is followed by the "message length word" which tells us how many
bytes follow.
The next four bytes are the date, in ASCII. In the example above, the
date is 0324, or March 24th.
The next four bytes after the date are the time, also in ASCII. In the
example, the time is 1512, or 3:12pm.
The next 10 digits are the phone number that is calling. In the
example, the phone number is 250-380-6467. The number is also in ASCII
and doesn't contain the hyphens. Some phone companies will leave out
the area code and only transmit 7 digits for a local call, others will
always send the area code as well.
If this were a name-and-number Caller ID data stream, the number would
be followed by a delimiter (01h) and another message length byte to
indicate the number of bytes in the name. This would be followed by the
name itself, in ASCII.
If this call originated from an area that doesn't support Caller ID,
then instead of the phone number, a capital "O" is transmitted (4F hex).
If the call was marked "private" as a result of the caller using *67 or
having a permanent call blocking service, then instead of the phone
number, a capital "P" (50 hex) would be sent.
The very last byte of the data stream is a checksum. This is calculated
by adding the value of all the other bytes in the data message (the
message type, length, number and name data, and any delimiters) and
taking the two's complement of the low byte of the result (in other
words, the two's complement of the modulo-256 simple checksum of the CID
data).
Some Technical FAQ's
Q: When I block Caller ID with *67, does it send my number anyway and
just set a "private bit" so that the other person's Caller ID Display
unit won't display it?
A: No. The person you're calling doesn't get your phone number anywhere
in his data stream if you block your call that way. All he/she gets
is "P" and the date/time of the call.
I would like to refer to an experiment I performed in March, 1998
with a Serial Port Caller ID, which delivers the raw data stream to a
PC for software interpretation. The following Usenet message (edited
for this file) is the report I published on that experiment:
Newsgroups: alt.2600
From: The Fixer <fixer@bc1.com>
Date: Tue, 24 Mar 98 16:12:58 -0800
Subject: Caller ID and *67 - The Facts
OK, it's time to shovel the bullshit which is piling up in this
newsgroup about Caller ID.
A few people are saying that when you block your Caller ID with
*67, the switch sends your number anyway along with a so-called
"private bit" that tells the Caller ID display unit to suppress
display of the number.
In order to squelch those who'd rather flame back with "show me
proof" than just read a FAQ, here is the proof. These are
actual raw data captures from a Bell 202 demodulator (better
known as a serial port Caller ID) which I captured myself today.
They prove conclusively that the "Private Bit" is a myth.
Here is what I got in my raw data stream when I called my voice
line from one of my BBS lines (which is unlisted, hence the
PRIVATE string in the name field):
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU?'^A^H03241512^A2503806467^G^OPRIVATE x
This is what I got when I did the same thing with *67:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU?^P^A^H03241512^D^AO^H^AP(?
The number I was calling from was 250-380-6467. That string is
clearly displayed in the first (non *67) call. In the number
field of the second call, only the letter "O" is transmitted.
In the name field, only the letter "P" is transmitted.
In both calls, the date and time (03/24, 15:12) is transmitted,
but transmission of the calling telephone number is suppressed
in the second call. There is no "private flag" suppressing
display of the number by the display unit; the calling number is
not transmitted at all!
For those of you unfamiliar with the CID raw data stream, the
U's are actually sync pulses (an ASCII "U" is 01010101 binary).
The control characters are field delimiters. The first 8-digit
number is the date and time in MMDDHHSS format. The second
number in the first call is the phone number, in NPANXXXXXX
format. That is followed by the name (for those of us with name
& number CID). The ^O (0Fh) just before the name indicates how
many characters are in the name - in this case "PRIVATE" is
padded out with 8 spaces (20h) to make 15 characters. At the
very end is an 8-bit checksum.
Believe me, if I were wrong about this, there would be a huge
marketing frenzy to sell "*67 proof Caller ID boxes" and I would be
making a fortune selling my Serial Caller ID software, which works
directly with the data streams illustrated above!
Q: Can't I just send noise down the line to scramble the Caller ID
signal between the rings?
A: No. Your phone line doesn't generate the Caller ID signal. It is
made by the switch on your calling party's line, and the audio
circuit between your line and his is not completed until after he
picks up the phone.
Q: Do 1-800 numbers have Caller ID? Can I hide my identity from them?
A: Some do have Caller ID, and the *67 block will work, but many more
have realtime ANI - Automatic Number Identification. This is an
older technology which uses a separate line to deliver your number,
and cannot be blocked. And all 800 subscribers get a list of
everyone who called them on their monthly bill, blocked or not.
Q: Can I hide my identity by sending a fake Caller ID signal down the
line before they answer?
A: *Generally*, no. The audio circuit between your phone line and their
line is not completed until the other party picks up. Once they do,
they would hear your fake signal and know what you were doing...
unless the person you're calling is very poorly informed or
untrained. Even so, most Caller ID devices have memory and so the
person you're calling could just as easily scroll back through the
box's memory and find your true number.
Once upon a time, the phone system worked differently, and the audio
circuit WAS connected even before the called party picked up. A
device called a "mute" or a "black box" was used to take advantage of
this fact and allow anyone calling a line with a black box to do so
toll-free. If the system still worked that way (and there's no
technical reason why it couldn't in these days of digital switching)
then yes, it would be very feasible to send a fake Bell 202 data
stream down the line; in fact you'd hear the real one every time you
called someone with Caller ID and you'd get a really good feel for
the timing involved. But if it worked that way, then black boxes
would also still work, and they don't.
Q: How about *69? If I protect my call using *67, can they still call
me back?
A: Not in 604/250 anyway, and probably not most places.
Some interesting notes about this: When *69 was first introduced
here in 250, if you tried to *69 a blocked call, you would get a
recording telling you that the number could not be announced. And it
would then offer to connect you anyway! I guess it was business who
asked for the change because that meant a telemarketer using *67
would have people call back and their switchboard answer "Sleazebag
Marketing, how can I help you?". At that point the number was a
white pages lookup away. So BC Tel, and I would venture to guess its
parent company GTE and many others, changed it so that *69 won't even
call back.
If you find in your area that you CAN call back with *69 to a *67
protected number, you're a lucky sonofabitch! Why is that? Well,
with the "old" working of *69, you may still be able to get the
number of a blocked caller if you are (a) lucky and (b) patient. Take
your phone off the hook until midnight (if it's a business) or early
afternoon (if it's a person). THEN activate *69. No incoming calls
will have come into your line since it was off-hook, so your line's
*69 last-call register will still have their phone number in it, and
at those times you are far more likely to get an answering machine
which may spill the beans as to who called you... clever huh?
Final Word
Caller ID can be worked around in so many ways that it really offers no
value to its subscribers. I am not against the existence of Caller ID,
as I have been on the receiving end of harassing phone calls and slimy
telemarketers, all of whom I've been able to put in their place thanks
to this technology. There's no doubt that Caller ID can help bring
those who deserve it to justice. But at the same time, we all have the
right to privacy, and the option to not share your identity with someone
you're calling is, and always should be, available.
For this reason, I think that Caller ID should be available free on
every line as part of the basic service. It's worth nothing anyway!
---------------------------------------------------------------------------
That's it. This file may be updated as I receive more information.
Look for updates on my web site at
http://ranchonevada.home.ml.org
or
http://ranchonevada.ml.org
or if that doesn't work,
http://A3A18294.sympatico.bconnected.net
---------------------------------------------------------------------------
This file is a freely-distributable copyrighted work. You may repost
this file free of charge without modifications, but no for-profit
distribution is allowed without prior arrangement with the author.
Two individuals who have stolen my work in the past are hereby
prohibited and enjoined from possessing or distributing this file:
Pinhead the Cenobite and Jolly Roger. If you are either of these
individuals, you must delete this file from your system now. If you are
not, you may not knowingly allow either of these individuals to receive
this file if it is in your power to prevent such reception. Retention
of this file on your system or on any backup constitutes acceptance of
this term.
(C) Copyright 1998 The Fixer's Tech Room, a division of Whirlwind
Software (British Columbia). All rights reserved.