💾 Archived View for spam.works › mirrors › textfiles › phreak › mfraud.phk captured on 2023-11-14 at 11:22:50.
⬅️ Previous capture (2023-06-16)
-=-=-=-=-=-=-
==============================================================================
RELEASED ON 07/01/92
==============================================================================
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%
%%%%%%####%%####%%%######%%%######%%%###%%###%%%%%######%%%%%%%%%% // %%%%%%
%%%%%########## %### ### %### ### %### %### %%%%### %%%%%%%% // %%
%%%%### ## ### %### %### %###### %%### %### %%%%#####%%%%%%%%%%% /~~~~~~~/\ %
%%%### %% ### %### %### %### ### %### %### %%%%### %%%%%%%%% /:::::::/ / %%
%%### %%%### %%###### %%###### %### %######%%#######%%%%%%%%% /:::::::/ / %%%
%%% %%%%% %%%% %%%% %%% %% %% %%%%%%% /_______/ / %%%%
%%%%%%######%%#######%%%%######%%%###%%###%%#######%%%%%%%%% /1/2/3/A/ / %%%%%
%%%%%### ### ### %### ### %### ### ### ### %%%%%%% /4/5/6/B/ / %%%%%%
%%%%#####%%%####### ######## ### ### ### ### %%%%%% /7/8/9/C/ / %%%%%%%
%%%### %### ### #### ### ### ### ### ### %%%%%% /*/0/#/D/ / %%%%%%%%
%%### %%%### ### ### ### %###### %####### %%%%%%% /~~~~~~~/ / %%%%%%%%%
%%% %%%%% %% %% %% %%% %%% %%%%%%% /_______/ / %%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \_______\/ %%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%
%%%%%%%%UHF%MOBILE%PHONE%TECHNOLOGY%AND%YOU%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
==============================================================================
WRITTEN, CREATED, AND TESTED BY VIDEO VINDICATOR
==============================================================================
DEDICATION
~~~~~~~~~~
I would like to dedicate this to the memory of Scantronics, which as the
logon said, was definantly 'The last of a dying breed'. In early May /<ludge
got a visit from authorities who took all his gear, except his printer (oh,
how thoughtful). You see, our enemies have finally realized one of the weaker
links in the H/P society... The distribution of information. By hitting all of
the worthwhile boards, they can make it harder and harder to learn and swap
ideas. Well, there isn't too much we can do about it, except start talking
with people one-on-one, and get a 'verbal network' going. This is pretty much
all we can do. Our Enemy is taking steps towards eradication of our chosen
hobby, and we must take steps to prevent it's distruction. Well, enough with
the lecture, on with the file, and keep good thoughts for /<ludge...
INTRODUCTION
~~~~~~~~~~~~
Ah yes, here I am again, writing like there's no tommorow, but even if there
was, who the hell would want it? Anyways... I've been just doing my own thing
for the past couple months, let tax time go by, and decided I needed to give
some more of my helpful insight to the world. Ok, this file is about the
closest thing to a hacking file as you'll probably see me write (especially
since hacking isn't my forte and I know many people out there who are better
at it than me (See Digital Hitler, I admitted that you're better, and in public
no less!)). Ah well, this covers those wonderful UHF Mobile telephones that
are out and about... Not Cellular mind you, but UHF Mobile. I will go into
detail on the Zetron series of Repeater Computers, which seem to be the most
common.
ME, YOU, AND THE REPEATER
~~~~~~~~~~~~~~~~~~~~~~~~~
What you will be accessing is the repeaters in your local area. Most large
cities have at very least 5, and some have upwards of 15. Now each repeater
usually is accessable throughout the city, although they get better reception
in certain areas. Soo, once you estabish the region that works best for you,
that will be the target repeater. Now, when you dial the repeater, you will
get another tone, much like a PBX, where you are supposed to enter the extension
of the mobile phone you wish to reach. Remember that each repeater is
independant, so you will need to program yourself on all the ones you wish to
use. Also, choose one as your base channel, usually the one that is in the
region you will be around the most, and program this one for ringing capab-
ilities. One of the real benifits of this is you can set up multiple extentions
on each repeater, and have tons of phone numbers and extensions.
You can also access the voice paging feature, and capture a voice mail box.
This is accomplished by simply assigning yourself a 5-tone pager id, and then
finding the phone number of the VMB that corresponds to it. This is especially
nice when you don't necessarily want people to realize where you are, or when
you want to call screen losers.
HACKING THE ZETRON
~~~~~~~~~~~~~~~~~~
Here's the big joke of this... The 'hacking' process. The admin extension
is usually 7 digits, and usually starts with 000. Now that's still quite a
few possibilities, right? Nope, the shitty designers of this system made it
so when you enter a incorrect number it gives you that wrong tone. So say
the password is 0004311, when you call up, you enter 0, no tone? Enter 0 again.
Still no tone? Enter 0 a third time. No tone again. Now enter 0 a fourth
time. Ding-dong... Wrong tone. Now just repeat the first three, and try 1
for the fourth, and so on. Basic. And once you're in, there are no other
passwords... Boy these people sure are security concious.
THE SUPREME MENU
~~~~~~~~~~~~~~~~
Here's a 'flow-chart' of the menu structure for most Zetron-series repeaters.
I include the main and sub-menus, and also all the possible selections for each
command. Now remember, the system is hot-key, and you can type '!' anywhere
in it to get back to the main menu. It's formatted a little past 80 columns
since it is more useful printed and I wanted it even-looking. Here we go...
[S]YSTEM --+--- [C]OR -------+------- P. Polarity active high Yes/No
| +------- H. Hold time (*100ms) 0-50
| +------- Q. Quiet time (*100ms) 0-100
| +------- M. Mob Tx-to-Rx time (*100ms) 0-20
| +------- A. Mob act time (*sec) 15-255
| +------- V. COR validation active high Yes/No
| +------- B. Channel busy active high Yes/No
|
+--- [A]CCESS ------+----- S. Sign-on mode 0-2
| +----- D. DTMF timeout (*100ms) 30-250
| +----- R. Min. regenerated digits 1-15
| +----- U. Phone-to-mobile use ANI Yes/No
| +----- M. Mobile-to-mobile use ANI Yes/No
| +----- P. #+ANI disconnect Yes/No
| +----- C. Dial click decode mode 0-3
|
+--- [H] DISPATCH ---+---- H. Repeater Hold Time (*100ms) 0-250
| +---- S. CTCSS Hold Time (*100ms) 1-30
| +---- T. Timeout (*min) 1-10
| +---- I. Hog Idle Time (*sec) 1-25
| +---- L. Hog Limit Time (*min) 1-99
| +---- P. Hog Penalty Time (*10sec) 1-250
| +---- R. Dispatch ID Rate (*min) 1-99
| +---- D. CTCSS for dispatch Yes/No
| +---- O. Courtesy tone Yes/No
| +---- M. Stuck Mic ID Yes/No
|
+--- [P]AGING ----+------- D. Keyup delay (*25ms) 0-200
| +------- T. Talk time (*sec) 5-25
| +------- V. Vox hold time (*100ms) 0-50
|
+--- STATION [I]D ----+--- M. Mode 0-3
| +--- I. Interval (*min) 1-99
| +--- S. Call sign (chrs) CCCC###
|
+--- AUTO[D]IALS ---+----- 1. (chrs) 0-16 chars
| +----- 2. (chrs) 0-16 chars
| +----- 3. (chrs) 0-16 chars
| +----- 4. (chrs) 0-16 chars
| +----- 5. (chrs) 0-16 chars
| +----- 6. (chrs) 0-16 chars
| +----- 7. (chrs) 0-16 chars
| +----- 8. (chrs) 0-16 chars
| +----- 9. (chrs) 0-16 chars
|
+--- [V] TOLL RESTRICT -+- 1. Max toll digits 1 1-30
| +- 2. 1st digit restrict 1 (chrs) 0-4 chars
| +- 3. 2nd digit restrict 1 (chrs) 0-4 chars
| +- 4. Max toll digits 2 1-30
| +- 5. 1st digit restrict 2 (chrs) 0-4 chars
| +- 6. 2nd digit restrict 2 (chrs) 0-4 chars
|
+--- [T]ELCO CONTROL --+-- 1. Call limit timer-1 (*min) 1-60
| +-- 2. Call limit timer-2 (*min) 1-60
| +-- 3. Channel ringouts-1 1-25
| +-- 4. Channel ringouts-2 1-25
| +-- O. Delay before dialout (*100ms) 5-100
| +-- D. Disconnect on 2nd dialtone Yes/No
| +-- M. Dialout mode 0-3
| +-- V. Override dispatch Yes/No
|
+--- LINE [1] SETTING --+- A. Rings until answer 1-20
| +- D. Channel busy rings 1-25
| +- M. Answer mode 0-2
| +- U. Auto call user 0-99
|
+--- LINE [2] SETTING --+- A. Rings until answer 1-20
| +- D. Channel busy rings 1-25
| +- M. Answer mode 0-2
| +- U. Auto call user 0-99
| +- P. Priority override Yes/No
|
+--- [L]OCAL PHONE ---+--- D. Channel busy rings 1-25
| +--- M. Answer mode 0-1
| +--- U. Auto call user 0-99
|
+--- [M]ISCELLANEOUS --+-- D. Courtesy tone duration (*25ms) 1-10
+-- F. Courtesy tone frequency (*10Hz) 35-100
+-- A. Automatic gain (AGC) on Yes/No
+-- H. High pass filter on Yes/No
+-- S. CTCSS add-in Yes/No
+-- R. ANI for system relays (chrs) 1-8 chars
+-- 1. User relay 1 mode 0-4
+-- 2. User relay 2 mode 0-4
+-- B. Run modem at 300 baud Yes/No
[U]SERS ---+--- [A]CCESS -------+---- U. User range 1-325
| +---- E. User enabled Yes/No
| +---- M. Mobile-to-phone Yes/No
| +---- P. Phone-to-mobile Yes/No
| +---- B. Mobile-to-mobile Yes/No
| +---- H. Dispatch Yes/No
| +---- C. COR to answer Yes/No
| +---- S. * to answer Yes/No
| +---- D. # to disconnect Yes/No
| +---- F. Fast ANI required Yes/No
| +---- L. Line select Yes/No
| +---- 2. Line 2 default Yes/No
| +---- A. Autodial mode 0-15
|
+--- [O]PERATION -----+--- U. User range 1-325
| +--- E. User enabled Yes/No
| +--- Q. Equipment type 0-4
| +--- N. Number of ringouts mode 1-2
| +--- S. Ringout style 0-7
| +--- O. Courtesy tone Yes/No
| +--- X. Full-duplex mobile Yes/No
| +--- P. Privacy Yes/No
| +--- M. Call timer mode 0-2
| +--- T. Toll mode 0-2
| +--- D. DTMF thru Yes/No
| +--- F. Page format 0-5
| +--- C. Tone/code drop mode 0-2
| +--- 1. Enable relay 1 Yes/No
| +--- 2. Enable relay 2 Yes/No
|
+--- [S]PECIFIC ----+----- U. Current user 1-325
| +----- E. User enabled Yes/No
| +----- A. ANI code (chrs) 0-8 chars
| +----- F. Page format 0-5
| +----- P. Page code (chrs) (Above #)
| +----- X. Tx tone/code 0-38
| +----- R. Rx tone/code 0-38
|
+--- [T]ONE DISPATCH -+--- U. Current user 1-325
| +--- E. Enabled Yes/No
| +--- R. Reserved Yes/No
| +--- X. Tx tone/code 0-38
| +--- T. Tone in tail Yes/No
| +--- V. Privacy Yes/No
| +--- O. Courtesy tone Yes/No
| +--- H. Hog Mode Yes/No
| +--- M. Morse ID (chrs)
|
+--- [L]IST ------+------- U. User range 1-325
+------- A. List ANI users Yes/No
+------- T. List tone dispatch users Yes/No
SUPER[V]ISOR +- A. Program mode ANI (chrs) 1-7 chars
+- N. Supervisor user number 0-99
+- S. Reset system programming Yes/No
+- D. Reset dispatch programming Yes/No
+- U. Reset ANI user programming Yes/No
+- M. Logon message 0-34 chars
+- L. List system programming Yes/No
[A]CCOUNTING +- M. Minimum call time (*sec) 0-180
+- U. User range 1-325
+- 2. List ANI accumulated Yes/No
+- 1. Clear ANI accumulated Yes/No
+- 4. List tone dispatch accumulated Yes/No
+- 3. Clear tone dispatch accumulated Yes/No
[T]EST ----+--- A. Tone 1 frequency (*10Hz) 35-100
+--- B. Tone 2 frequency (*10Hz) 35-100
+--- 1. Single tone (=Telco:1,Tx:2) 0-2
+--- 2. Dual tone (=Telco:1,Tx:2) 0-2
+--- 3. CTCSS tone (=Tone) 0-38
+--- 4. Emphasis (=Off,On) Yes/No
+--- H. Hybrid adjust (=Off,On) Yes/No
+--- D. DTMF/Click detect (=Telco:1,Rx:2) 0-2
+--- C. COR detect Yes/No
+--- K. Click calibrate Yes/No
+--- S. Sense line states Yes/No
+--- T. CTCSS Decode Yes/No
+--- M. Memory Yes/No
[O]PTIONS --------- Lists the Tone and Normal Users
[E]XIT ------------ Hangs up the modem
PROGRAMMING THE SYSTEM
~~~~~~~~~~~~~~~~~~~~~~
Ok, Here's a default settings buffer for the system, and I will explain what
each thing means in the next section, so read and absorbe...
SYSTEM PROGRAMMING FOR phone # (repeater name) AS OF date
COR MENU
P. Polarity active high = Yes
H. Hold time (*100ms) = 1
Q. Quiet time (*100ms) = 50
M. Mob Tx-to-Rx time (*100ms) = 2
A. Mob act time (*sec) = 32
V. COR validation active high = Yes
B. Channel busy active high = No
ACCESS MENU
S. Sign-on mode = 0
D. DTMF timeout (*100ms) = 50
R. Min. regenerated digits = 7
U. Phone-to-mobile use ANI = Yes
M. Mobile-to-mobile use ANI = Yes
P. #+ANI disconnect = Yes
C. Dial click decode mode = 0
DISPATCH MENU
H. Repeater Hold Time (*100ms) = 30
S. CTCSS Hold Time (*100ms) = 8
T. Timeout (*min) = 3
I. Hog Idle Time (*sec) = 5
L. Hog Limit Time (*min) = 5
P. Hog Penalty Time (*10sec) = 30
R. Dispatch ID Rate (*min) = 15
D. CTCSS for dispatch = Yes
O. Courtesy tone = No
M. Stuck Mic ID = Yes
PAGING MENU
D. Keyup delay (*25ms) = 40
T. Talk time (*sec) = 10
V. Vox hold time (*100ms) = 1
STATION ID MENU
M. Mode = 2
I. Interval (*min) = 15
S. Call sign (chrs) = xxxxxxx
AUTODIALS MENU
1. (chrs) =
2. (chrs) =
3. (chrs) =
4. (chrs) =
5. (chrs) =
6. (chrs) =
7. (chrs) =
8. (chrs) =
9. (chrs) =
TOLL RESTRICT MENU
1. Max toll digits 1 = 15
2. 1st digit restrict 1 (chrs) = 1111
3. 2nd digit restrict 1 (chrs) = 0000
4. Max toll digits 2 = 7
5. 1st digit restrict 2 (chrs) = 00
6. 2nd digit restrict 2 (chrs) = 00
TELCO CONTROL MENU
1. Call limit timer-1 (*min) = 3
2. Call limit timer-2 (*min) = 3
3. Channel ringouts-1 = 4
4. Channel ringouts-2 = 4
O. Delay before dialout (*100ms) = 20
D. Disconnect on 2nd dialtone = Yes
M. Dialout mode = 1
V. Override dispatch = No
LINE 1 MENU
A. Rings until answer = 2
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 0
LINE 2 MENU
A. Rings until answer = 2
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 1
P. Priority override = No
LOCAL PHONE MENU
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 0
MISCELLANEOUS MENU
D. Courtesy tone duration (*25ms) = 3
F. Courtesy tone frequency (*10Hz) = 54
A. Automatic gain (AGC) on = No
H. High pass filter on = Yes
S. CTCSS add-in = No
R. ANI for system relays (chrs) = *1
1. User relay 1 mode = 0
2. User relay 2 mode = 0
B. Run modem at 300 baud = Yes