TAP YIPL

home *** CD-ROM | disk | FTP | other *** search

/ TAP YIPL / TAP_and_YIPL_Collection_CD.iso / PHREAK / CELLULAR / MFRAUD.TXT < prev next >

Wrap

Text File | 1994-07-17 | 36.5 KB | 690 lines

============================================================================== RELEASED ON 07/01/92 ============================================================================== %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%% %%%%%%####%%####%%%######%%%######%%%###%%###%%%%%######%%%%%%%%%% // %%%%%% %%%%%########## %### ### %### ### %### %### %%%%### %%%%%%%% // %% %%%%### ## ### %### %### %###### %%### %### %%%%#####%%%%%%%%%%% /~~~~~~~/\ % %%%### %% ### %### %### %### ### %### %### %%%%### %%%%%%%%% /:::::::/ / %% %%### %%%### %%###### %%###### %### %######%%#######%%%%%%%%% /:::::::/ / %%% %%% %%%%% %%%% %%%% %%% %% %% %%%%%%% /_______/ / %%%% %%%%%%######%%#######%%%%######%%%###%%###%%#######%%%%%%%%% /1/2/3/A/ / %%%%% %%%%%### ### ### %### ### %### ### ### ### %%%%%%% /4/5/6/B/ / %%%%%% %%%%#####%%%####### ######## ### ### ### ### %%%%%% /7/8/9/C/ / %%%%%%% %%%### %### ### #### ### ### ### ### ### %%%%%% /*/0/#/D/ / %%%%%%%% %%### %%%### ### ### ### %###### %####### %%%%%%% /~~~~~~~/ / %%%%%%%%% %%% %%%%% %% %% %% %%% %%% %%%%%%% /_______/ / %%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \_______\/ %%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%% %%%%%%%%UHF%MOBILE%PHONE%TECHNOLOGY%AND%YOU%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ============================================================================== WRITTEN, CREATED, AND TESTED BY VIDEO VINDICATOR ============================================================================== DEDICATION ~~~~~~~~~~ I would like to dedicate this to the memory of Scantronics, which as the logon said, was definantly 'The last of a dying breed'. In early May /<ludge got a visit from authorities who took all his gear, except his printer (oh, how thoughtful). You see, our enemies have finally realized one of the weaker links in the H/P society... The distribution of information. By hitting all of the worthwhile boards, they can make it harder and harder to learn and swap ideas. Well, there isn't too much we can do about it, except start talking with people one-on-one, and get a 'verbal network' going. This is pretty much all we can do. Our Enemy is taking steps towards eradication of our chosen hobby, and we must take steps to prevent it's distruction. Well, enough with the lecture, on with the file, and keep good thoughts for /<ludge... INTRODUCTION ~~~~~~~~~~~~ Ah yes, here I am again, writing like there's no tommorow, but even if there was, who the hell would want it? Anyways... I've been just doing my own thing for the past couple months, let tax time go by, and decided I needed to give some more of my helpful insight to the world. Ok, this file is about the closest thing to a hacking file as you'll probably see me write (especially since hacking isn't my forte and I know many people out there who are better at it than me (See Digital Hitler, I admitted that you're better, and in public no less!)). Ah well, this covers those wonderful UHF Mobile telephones that are out and about... Not Cellular mind you, but UHF Mobile. I will go into detail on the Zetron series of Repeater Computers, which seem to be the most common. ME, YOU, AND THE REPEATER ~~~~~~~~~~~~~~~~~~~~~~~~~ What you will be accessing is the repeaters in your local area. Most large cities have at very least 5, and some have upwards of 15. Now each repeater usually is accessable throughout the city, although they get better reception in certain areas. Soo, once you estabish the region that works best for you, that will be the target repeater. Now, when you dial the repeater, you will get another tone, much like a PBX, where you are supposed to enter the extension of the mobile phone you wish to reach. Remember that each repeater is independant, so you will need to program yourself on all the ones you wish to use. Also, choose one as your base channel, usually the one that is in the region you will be around the most, and program this one for ringing capab- ilities. One of the real benifits of this is you can set up multiple extentions on each repeater, and have tons of phone numbers and extensions. You can also access the voice paging feature, and capture a voice mail box. This is accomplished by simply assigning yourself a 5-tone pager id, and then finding the phone number of the VMB that corresponds to it. This is especially nice when you don't necessarily want people to realize where you are, or when you want to call screen losers. HACKING THE ZETRON ~~~~~~~~~~~~~~~~~~ Here's the big joke of this... The 'hacking' process. The admin extension is usually 7 digits, and usually starts with 000. Now that's still quite a few possibilities, right? Nope, the shitty designers of this system made it so when you enter a incorrect number it gives you that wrong tone. So say the password is 0004311, when you call up, you enter 0, no tone? Enter 0 again. Still no tone? Enter 0 a third time. No tone again. Now enter 0 a fourth time. Ding-dong... Wrong tone. Now just repeat the first three, and try 1 for the fourth, and so on. Basic. And once you're in, there are no other passwords... Boy these people sure are security concious. THE SUPREME MENU ~~~~~~~~~~~~~~~~ Here's a 'flow-chart' of the menu structure for most Zetron-series repeaters. I include the main and sub-menus, and also all the possible selections for each command. Now remember, the system is hot-key, and you can type '!' anywhere in it to get back to the main menu. It's formatted a little past 80 columns since it is more useful printed and I wanted it even-looking. Here we go... [S]YSTEM --+--- [C]OR -------+-------P. Polarity active high Yes/No | +-------H. Hold time (*100ms) 0-50 | +-------Q. Quiet time (*100ms) 0-100 | +-------M. Mob Tx-to-Rx time (*100ms) 0-20 | +-------A. Mob act time (*sec) 15-255 | +-------V. COR validation active high Yes/No | +-------B. Channel busy active high Yes/No | +--- [A]CCESS ------+----- S. Sign-on mode 0-2 | +----- D. DTMF timeout (*100ms) 30-250 | +----- R. Min. regenerated digits 1-15 | +----- U. Phone-to-mobile use ANI Yes/No | +----- M. Mobile-to-mobile use ANI Yes/No | +----- P. #+ANI disconnect Yes/No | +----- C. Dial click decode mode 0-3 | +--- [H] DISPATCH ---+---- H. Repeater Hold Time (*100ms) 0-250 | +----S. CTCSS Hold Time (*100ms) 1-30 | +----T. Timeout (*min) 1-10 | +----I. Hog Idle Time (*sec) 1-25 | +----L. Hog Limit Time (*min) 1-99 | +----P. Hog Penalty Time (*10sec) 1-250 | +----R. Dispatch ID Rate (*min) 1-99 | +----D. CTCSS for dispatch Yes/No | +----O. Courtesy tone Yes/No | +----M. Stuck Mic ID Yes/No | +--- [P]AGING ----+-------D. Keyup delay (*25ms) 0-200 | +-------T. Talk time (*sec) 5-25 | +-------V. Vox hold time (*100ms) 0-50 | +--- STATION [I]D ----+---M. Mode 0-3 | +---I. Interval (*min) 1-99 | +---S. Call sign (chrs) CCCC### | +--- AUTO[D]IALS ---+-----1. (chrs) 0-16 chars | +-----2. (chrs) 0-16 chars | +-----3. (chrs) 0-16 chars | +-----4. (chrs) 0-16 chars | +-----5. (chrs) 0-16 chars | +-----6. (chrs) 0-16 chars | +-----7. (chrs) 0-16 chars | +-----8. (chrs) 0-16 chars | +-----9. (chrs) 0-16 chars | +--- [V] TOLL RESTRICT -+-1. Max toll digits 1 1-30 | +-2. 1st digit restrict 1 (chrs) 0-4 chars | +-3. 2nd digit restrict 1 (chrs) 0-4 chars | +-4. Max toll digits 2 1-30 | +-5. 1st digit restrict 2 (chrs) 0-4 chars | +-6. 2nd digit restrict 2 (chrs) 0-4 chars | +--- [T]ELCO CONTROL --+--1. Call limit timer-1 (*min) 1-60 | +--2. Call limit timer-2 (*min) 1-60 | +--3. Channel ringouts-1 1-25 | +--4. Channel ringouts-2 1-25 | +--O. Delay before dialout (*100ms) 5-100 | +--D. Disconnect on 2nd dialtone Yes/No | +--M. Dialout mode 0-3 | +--V. Override dispatch Yes/No | +--- LINE [1] SETTING --+-A. Rings until answer 1-20 | +-D. Channel busy rings 1-25 | +-M. Answer mode 0-2 | +-U. Auto call user 0-99 | +--- LINE [2] SETTING --+-A. Rings until answer 1-20 | +-D. Channel busy rings 1-25 | +-M. Answer mode 0-2 | +-U. Auto call user 0-99 | +-P. Priority override Yes/No | +--- [L]OCAL PHONE ---+---D. Channel busy rings 1-25 | +---M. Answer mode 0-1 | +---U. Auto call user 0-99 | +--- [M]ISCELLANEOUS --+--D. Courtesy tone duration (*25ms) 1-10 +--F. Courtesy tone frequency (*10Hz) 35-100 +--A. Automatic gain (AGC) on Yes/No +--H. High pass filter on Yes/No +--S. CTCSS add-in Yes/No +--R. ANI for system relays (chrs) 1-8 chars +--1. User relay 1 mode 0-4 +--2. User relay 2 mode 0-4 +--B. Run modem at 300 baud Yes/No [U]SERS ---+---[A]CCESS -------+----U. User range 1-325 | +----E. User enabled Yes/No | +----M. Mobile-to-phone Yes/No | +----P. Phone-to-mobile Yes/No | +----B. Mobile-to-mobile Yes/No | +----H. Dispatch Yes/No | +----C. COR to answer Yes/No | +----S. * to answer Yes/No | +----D. # to disconnect Yes/No | +----F. Fast ANI required Yes/No | +----L. Line select Yes/No | +----2. Line 2 default Yes/No | +----A. Autodial mode 0-15 | +--- [O]PERATION -----+---U. User range 1-325 | +---E. User enabled Yes/No | +---Q. Equipment type 0-4 | +---N. Number of ringouts mode 1-2 | +---S. Ringout style 0-7 | +---O. Courtesy tone Yes/No | +---X. Full-duplex mobile Yes/No | +---P. Privacy Yes/No | +---M. Call timer mode 0-2 | +---T. Toll mode 0-2 | +---D. DTMF thru Yes/No | +---F. Page format 0-5 | +---C. Tone/code drop mode 0-2 | +---1. Enable relay 1 Yes/No | +---2. Enable relay 2 Yes/No | +--- [S]PECIFIC ----+-----U. Current user 1-325 | +-----E. User enabled Yes/No | +-----A. ANI code (chrs) 0-8 chars | +-----F. Page format 0-5 | +-----P. Page code (chrs) (Above #) | +-----X. Tx tone/code 0-38 | +-----R. Rx tone/code 0-38 | +--- [T]ONE DISPATCH -+--- U. Current user 1-325 | +---E. Enabled Yes/No | +---R. Reserved Yes/No | +---X. Tx tone/code 0-38 | +---T. Tone in tail Yes/No | +---V. Privacy Yes/No | +---O. Courtesy tone Yes/No | +---H. Hog Mode Yes/No | +---M. Morse ID (chrs) | +--- [L]IST ------+-------U. User range 1-325 +-------A. List ANI users Yes/No +-------T. List tone dispatch users Yes/No SUPER[V]ISOR +- A. Program mode ANI (chrs) 1-7 chars +- N. Supervisor user number 0-99 +- S. Reset system programming Yes/No +- D. Reset dispatch programming Yes/No +- U. Reset ANI user programming Yes/No +- M. Logon message 0-34 chars +- L. List system programming Yes/No [A]CCOUNTING +-M. Minimum call time (*sec) 0-180 +- U. User range 1-325 +- 2. List ANI accumulated Yes/No +- 1. Clear ANI accumulated Yes/No +- 4. List tone dispatch accumulated Yes/No +- 3. Clear tone dispatch accumulated Yes/No [T]EST ----+---A. Tone 1 frequency (*10Hz) 35-100 +--- B. Tone 2 frequency (*10Hz) 35-100 +--- 1. Single tone (=Telco:1,Tx:2) 0-2 +--- 2. Dual tone (=Telco:1,Tx:2) 0-2 +--- 3. CTCSS tone (=Tone) 0-38 +--- 4. Emphasis (=Off,On) Yes/No +--- H. Hybrid adjust (=Off,On) Yes/No +--- D. DTMF/Click detect (=Telco:1,Rx:2) 0-2 +--- C. COR detect Yes/No +--- K. Click calibrate Yes/No +--- S. Sense line states Yes/No +--- T. CTCSS Decode Yes/No +--- M. Memory Yes/No [O]PTIONS --------- Lists the Tone and Normal Users [E]XIT ------------ Hangs up the modem PROGRAMMING THE SYSTEM ~~~~~~~~~~~~~~~~~~~~~~ Ok, Here's a default settings buffer for the system, and I will explain what each thing means in the next section, so read and absorbe... SYSTEM PROGRAMMING FOR phone # (repeater name) AS OF date COR MENU P. Polarity active high = Yes H. Hold time (*100ms) = 1 Q. Quiet time (*100ms) = 50 M. Mob Tx-to-Rx time (*100ms) = 2 A. Mob act time (*sec) = 32 V. COR validation active high = Yes B. Channel busy active high = No ACCESS MENU S. Sign-on mode = 0 D. DTMF timeout (*100ms) = 50 R. Min. regenerated digits = 7 U. Phone-to-mobile use ANI = Yes M. Mobile-to-mobile use ANI = Yes P. #+ANI disconnect = Yes C. Dial click decode mode = 0 DISPATCH MENU H. Repeater Hold Time (*100ms) = 30 S. CTCSS Hold Time (*100ms) = 8 T. Timeout (*min) = 3 I. Hog Idle Time (*sec) = 5 L. Hog Limit Time (*min) = 5 P. Hog Penalty Time (*10sec) = 30 R. Dispatch ID Rate (*min) = 15 D. CTCSS for dispatch = Yes O. Courtesy tone = No M. Stuck Mic ID = Yes PAGING MENU D. Keyup delay (*25ms) = 40 T. Talk time (*sec) = 10 V. Vox hold time (*100ms) = 1 STATION ID MENU M. Mode = 2 I. Interval (*min) = 15 S. Call sign (chrs) = xxxxxxx AUTODIALS MENU 1. (chrs) = 2. (chrs) = 3. (chrs) = 4. (chrs) = 5. (chrs) = 6. (chrs) = 7. (chrs) = 8. (chrs) = 9. (chrs) = TOLL RESTRICT MENU 1. Max toll digits 1 = 15 2. 1st digit restrict 1 (chrs) = 1111 3. 2nd digit restrict 1 (chrs) = 0000 4. Max toll digits 2 = 7 5. 1st digit restrict 2 (chrs) = 00 6. 2nd digit restrict 2 (chrs) = 00 TELCO CONTROL MENU 1. Call limit timer-1 (*min) = 3 2. Call limit timer-2 (*min) = 3 3. Channel ringouts-1 = 4 4. Channel ringouts-2 = 4 O. Delay before dialout (*100ms) = 20 D. Disconnect on 2nd dialtone = Yes M. Dialout mode = 1 V. Override dispatch = No LINE 1 MENU A. Rings until answer = 2 D. Channel busy rings = 6 M. Answer mode = 1 U. Auto call user = 0 LINE 2 MENU A. Rings until answer = 2 D. Channel busy rings = 6 M. Answer mode = 1 U. Auto call user = 1 P. Priority override = No LOCAL PHONE MENU D. Channel busy rings = 6 M. Answer mode = 1 U. Auto call user = 0 MISCELLANEOUS MENU D. Courtesy tone duration (*25ms) = 3 F. Courtesy tone frequency (*10Hz) = 54 A. Automatic gain (AGC) on = No H. High pass filter on = Yes S. CTCSS add-in = No R. ANI for system relays (chrs) = *1 1. User relay 1 mode = 0 2. User relay 2 mode = 0 B. Run modem at 300 baud = Yes ** End of list ** IMPORTANT COMMANDS TO KNOW ~~~~~~~~~~~~~~~~~~~~~~~~~~ Ok, Now I'll discuss some of the more necessary commands, and what they do. Most of the others are pretty easy to figure out, or are not necessary. The only really useful area is in the TOLL RESTRICT, TELCO CONTROL, and menus. The system is usually split into two different systems, although on MOST they only use one of them. So, what you want to do is configure the [2] settings for you, and leave the [1] settings untouched (so they are not aware of the usage. You will want to change the following in the TOLL RESTRICT menu: 4. Max toll digits 2 = 20 (Amount of numbers) 5. 1st digit restrict 2 (chrs) = (Non-allowed first digit) 6. 2nd digit restrict 2 (chrs) = (Non-allowed second digit) This will allow you to call oversears or special numbers with no hassle. Next in the TELCO CONTROL menu: 2. Call limit timer-2 (*min) = 99 (The Maximum call time) 4. Channel ringouts-2 = 9 (Number of rings before giving up) This will configure your phone to allow 99 minutes per call, and let you ring someone nine times. Make sure not to edit anything within the STATION ID menu, since this will bring the FCC down on the operators head, and we don't want the repeater to get shut down. Also, if you were wondering what they do if they find out that you're in the system, well, that's easy. They disable the phone modem and enable the packet one, so only people with HAM setups are able to call up and alter information. This is a little extreme, but most of the time it will happen if you're billing an enormous amount of calls to it, or taking up a massive amount of airtime (and neglecting to cover it up). VIEWING USER INFORMATION ~~~~~~~~~~~~~~~~~~~~~~~~ This is one of the nicer and more useful functions of the system, this way you can get a complete listing of all the repeater users, and what services they have available. Here's a list of the most common (and most important abbreviations used in the user list... A = Privacy B = User enabled C = * to Answer D = # to disconnect E = DTMF thru F = Number of ringouts mode K = Call timer mode P = Mobile-to-phone Q = Phone-to-mobile R = Mobile-to-Mobile U = Toll mode PRIVACY means whenever you speak, the repeater will transmit a beeping sound, so anyone listening will only be able to hear the person you call. USER ENABLED is self explanitory, * TO ANSWER means you will only need to dial '*' to answer calls, instead of '*' plus your ANI. # to disconnect is the same an answer, but to cancel a call. DTMF thru means the repeater will allow DTMF tones to be transmitted. NUMBER OF RINGOUTS MODE is which phone callout mode you have (set this to [2], your custom callout setting). P,Q,and R all pretty much are the same, allowing users to call from on to the other. TOLL MODE is another you set to [2], altering from the default toll settings. Ok, and now here's what the user printout looks like. USR is the actual user number, the letters A-X correspond to the above list, ANI is the extension number, RX is the recieve tone, TX is the transmit tone, TYPE is the type of paging service, and PAGE is their 5 tone sub-audible... Model xx (xxxxxxx) Usr Programming ANI Rx Tx Type Page --- ABCDEFGHIJKLMNOPQRSTUVWX -------- ---- ---- ------ -------- 1 nYYnY100nn1nnnnYYYnn200n D 0 0 *None* 2 nYYnY100nn1nnnnYYYnn200n 1000 2 2 *None* 3 nYYnY100nn1nnnnYYYnn200n D 3 3 *None* 4 YYYnY100nn1nnnnYYYnn200n 1001 4 4 *None* 5 nYnnY100nn1nnnnYYYnn200n 1002 5 5 *None* 6 nYYYY100nn1nnnnYYYnn200n 1003 6 6 *None* 7 nnYnY100nn1nnnnYYYnn200n D 7 7 *None* 8 nYYnY200nn1nnnnYYYnn200n 1004 8 8 *None* 9 nYYYY100nn1nnnnYYYnn200n 1005 9 9 *None* 10 nYYYY100nn1nnnnYYYnn200n 1006 10 10 *None* 11 nnYYY100nn1nnnnYYYnn200n D 0 0 *None* 12 nYYYY100nn1nnnnYYYnn200n 1007 12 12 *None* 13 YYYnY100nn1nnnnYYYnn200n 1008 13 13 *None* 14 nnYYY100nn1nnnnYYYnn200n D 14 14 *None* 15 nnYYY100nn1nnnnYYYnn200n D 0 0 *None* 16 nYYYY100nn1nnnnYYYnn200n 1009 16 0 2 Tone 12345 17 nnYYY100nn1nnnnYYYnn200n D 17 17 *None* 18 nnYYY100nn1nnnnYYYnn200n D 18 0 *None* 19 nYYYY100nn1nnnnYYYnn200n 1010 19 19 *None* 20 nYYYY100nn1nnnnYYYnn200n D 20 20 *None* 21 nnYYY100nn1nnnnYYYnn200n D 0 0 *None* ** End of list ** The ANI is what people calling you need to dial (i.e. your extension), and the number you need to dial in order to make calls out. The best way to use this is to just piggy-back someones existing account. They definantly won't complain when they get all the wonderful features, and then that also leaves a very obvious (and innocent) scapegoat... My favorite kind. The tone userlist is a little different than the mobile users... This is mainly for pagers that happen to be using the same repeater, although that is highly uncommon. Here it is... TONE DISPATCH LIST FOR xxx-xxxx (xxxxxxxxx) Model xx (xxxxxxx) Usr Programming Out Tone ID ------ ABCDEFG ------------------------- 1 nnnnnnn 1 2 nnnnnnn 2 3 nnnnnnn 3 4 nnnnnnn 4 5 nnnnnnn 5 6 nnnnnnn 6 7 nnnnnnn 7 8 nnnnnnn 8 9 nnnnnnn 9 10 nnnnnnn 10 11 nnnnnnn 11 12 nnnnnnn 12 13 nnnnnnn 13 14 nnnnnnn 14 15 nnnnnnn 15 16 nnnnnnn 16 17 nnnnnnn 17 18 nnnnnnn 18 19 nnnnnnn 19 20 nnnnnnn 20 21 nnnnnnn 21 ** End of list ** There has never been any configured on any of the systems I've been on, so I can't really tell you too much about the configuration information, although that would lead me to believe that the feature isn't very exciting. THE CALLER LOG... THE ENEMY ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Unfortunantly, as with everything in life, there's always a snag... The caller log, although in this case it just takes a little extra effort to trick the ever present enemy. Every space means there were some accounts inbetween the used accounts that are deactivated. Here's what the log looks like... CALLER LOG FOR xxx-xxxx (xxxxxxxxx) User 6 01:22:30 87 Access(es) User 12 00:37:02 48 Access(es) User 13 00:27:01 40 Access(es) User 16 00:23:56 49 Access(es) User 19 00:28:26 33 Access(es) User 21 00:11:18 14 Access(es) ** End of list ** On the surface this may appear to be fairly useless, but there is something to be feared here. Many of the companies take it upon themselves to total the time used, and then divide by the number of accesses. Now what this tells them is the average call length... And if you're making 45 minute calls, this is going to boost the call time just a LITTLE past 3 minutes, then all they do is the same thing on a user by user basis and wala, they know whose account you're on. It only takes a little bit of extra effort to cancel this out though. Just place a shitload of small calls, like 10 secs, and one of those for every 2 or 3 minutes you've used on your long call. This safely masks your using of the system, as long as you aren't calling Alliance or making LD calls. It is true that you can zero this list in the accounting menu, and that's another way you can get around it, although this alerts them as to there is either someone else on the system (and they're trying to hid something), or that there is some sort of problem with the system, and they either try to fix what is not wrong, or give up and write off the problem (and this is what you hope). For those who wish to have all the reference, here's the Tone Dispatch Log... TONE DISPATCH LOG FOR xxx-xxxx (xxxxxxxxxxxxx) User 1 00:07:53 User 2 00:13:53 User 3 00:23:14 User 4 00:01:23 User 5 00:13:09 User 6 00:02:04 User 7 00:05:14 User 8 00:01:00 User 10 00:03:43 User 11 00:00:02 User 12 00:42:40 User 13 00:02:07 User 15 00:00:03 User 16 00:15:46 User 17 00:01:22 User 18 00:14:22 User 19 00:01:34 User 20 00:01:55 User 21 00:00:33 ** End of list ** FREQUENCIES ~~~~~~~~~~~ Here's the technical description of the frequencies they use: 405-425, 440-460, 450-470 (in 12.5kHz steps) Now since this even though this isn't dual-synchronis, is does use two freqencies per channel. Now, is the first frequency was 405.000kHz, the sister frequency would be 405.900kHz. Pretty basic, eh? The second frequency (your transmit one) is always 0.900 kHz above the recieve. Usually you can call up your local mobile phone company and find out their repeater frequencies... Hell, several have faxed me complete listings and their effective range, I sure do love companies with great customer service! The tones which are used by the repeaters (both audible and subaudible) are FCC regulated, so they are a standard... Meaning the repeaters tone 13 will be the same as the Yaesu's tone 13. For more information on the tones, simply go to your local library and see what the government has regulated for your area. CAN YOU SAY... YAESU? ~~~~~~~~~~~~~~~~~~~~~ Now there are many different manufactures of UHF phones out there, but the one I would recommend over Motorola and Maxon would be Yaesu. They started out as a pro equiptment dealer only, selling some of the best HAM radio gear around, then about 2 years ago they entered into the commercial market. Now they heave several handheld units available, but I would recommend above all the others the FTH-7008. It sells for around $500 (but who's paying? (Refer to Carding, My Way series)), and has a Priority Channel, Scan, Hi/Lo Power settings, Auto-Squelch, and 15 channels (not crystals, but synthesis). Now, you will also need the FTT-4DT (make SURE it's the 4DT not just the 4, because otherwise it won't work). Now the FTT-4DT is a DTMF pad which goes on the unit between the battery and the body, you can easily do the instilation yourself, and the unit runs around $280. Now what this gives you above and beyond the keypad is a squelch which will only turn off when it recieves a certain 2-tone combination or a 5-tone sub- audible. These are used to make the unit either ring for an incoming call, or to respond when a page comes through. Now here's the beauty of Yaesu. Your dealer can AND WILL sell you the software and hardware necessary to program it yourself. It runs around $80 and is for the IBM XT or better. This drives the FCC CRAZY and gives you TOTAL power... Now all you need to do is hack into the repeater and wala... Phone service. USES AND ABUSES ~~~~~~~~~~~~~~~ Now here's the payoff... Not only can you make calls out, long distance or otherwise, and not have to worry about being billed or located, but you can recieve calls in an almost totally secure way. Now you must keep in mind that this is only half duplex, so the modem is out of the picture, but for voice communication, from anywhere in you city and most likely ajacent cities, this is the best thing since sliced bread! Now you can assign yourself as many different extensions as you want, and I would recommmend changing them fairly frequently. Also try to be away from home and/or on the move when calling, since this will reduce the chances of being located if they should somehow become suspicious. About the only way they will is if you do bill long distance numbers to the Repeater, or if you dominate the airtime on it. Once a month the owner of the repeater goes out on sight and gets a usage log. Usually calls are limited to 3 minutes, so the average call is 2 minutes. Now, if you're dominating the system, the average call is going to be quite alot more than 3 mins, and he's going to know something strange is going on. Of course, all he can do is change the password, and we all know how 'secure' that is... hehe. Now there are also companies (real bastard ones, who deserve to be fucked) that run mobile like it was cellular, and charge minutely. Now these guys are EASY to fuck with, since you can create yourself an account, take it off the minutely billing cycle, and just don't make LD calls, only recieve calls... Wala now you have a RADICAL phone, which will most likely never be discovered (mine hasn't been for close to 4 months, and boy is it nice!). Now one note on this... Usually it isn't the cops who deal with this, it's the FCC, and believe it or not, they actually do get the job done fairly well. But this by no means says it's dangerous... On the offical Vindicator Danger scale this only rates a 3... And even lower if you're cautious. CONCLUSION ~~~~~~~~~~ Ahh.. Another fine file comes to the conclusion... And, as usual, I really don't have altogether too much to say that hasn't been already said! If you feel compelled to leave me fan mail, with questions, comments, or threats, then please do so at any of the boards listed below... I usually call at least once a month or so. I have to say I always get a kick out of hearing from people who have enjoyed my files, so write damn you! I'd like to take a moment to welcome The Stash to my elustrious list of file gathering sites... If you're in Europe, or the States for that matter, this board is a definant must. And it's also the only overseas system I call. Wow, my list of boards at the bottom is getting SMALL... So if anyone out there knows of ANY good systems out there, that still hold true to the beliefs that made the H/P scene what it is today, then leave me mail on the Roach. And now, for the ever popular greetings... /<ludge The White Rider Maximum Overdrive Digital Hitler Strato Viper Erekose Mind Walker Grandmaster Ratte' And anyone else worth mentioning that I didn't... And Always remember... The future is Now, and we must take what we can. ============================================================================= Demon Roach [PW: THRASH cDc Board - A Classic - GREAT ] 24 806-794-4362 Church/Theives [IBM H/P system running with MNP - 96 soon ] 24 619-789-2235 The Stash [My European Connection... Lots of files ] 96 46-498-222113 The Works [Tons of Files cDc Board Give it a call ] 24 617-861-8976 ============================================================================= This concludes another wonderful file by Video Vindicator (C)opyright 1992 =============================================================================