Hacking Voice Mail Systems

==Phrack Inc.==

Volume Two, Issue Eleven, Phile #4 of 12

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+=+ Hacking Voice Mail Systems +=+
+=+ Written for Phrack XI +=+
+=+ by:-> Black Knight from 713 +=+
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Voice Mail is a relatively new concept and not much has been said about it.
It is a very useful tool for the business person and the phreak. The way it
works is that somebody wishing to get in touch with you calls a number,
usually a 1-800, and punches in on his touch-pad your mailbox number and then
he is able to leave a message for you. Business experts report that this
almost totally eliminates telephone tag. When a person wishes to pick up his
message all he needs to do is call the number enter a certain code and he can
hear his messages, transfer them, and do other misc. mailbox utilities.

Most VMSs are similar in the way they work. There are a few different ways
the VMSs store the voice. One way is that the voice is recorded digitally and
compressed and when heard it is reproduced back into the voice that recorded
it. Another method that is slower and uses more space, but costs less, stores
the voice on magnetic tape, the same type that is used to store data on a
computer, and then runs the tape at a slow speed. Using this method the voice
does not need to be reproduced in any way and will sound normal as long as the
tape is running at a constant speed. On some of the newer VMSs the voice is
digitally recorded and is transformed from the magnetic tape at about 2400
bits per second.

There are many different types and versions of voice mail systems. Some of
the best and easiest to get on will be discussed.

Centagram
———
These are direct dial (you don’t have to enter a box number). To get on one
of these, first have a number to any box on the system. All of the other
boxes will be on the same prefix; just start scanning them until you find one
that has a message saying that person you are calling is not available. This
usually means that the box has not been assigned to anybody yet. Before the
nice lady’s voice tells you to leave the message, hit #. You will then be
prompted for your password. The password will usually be the same as the last
four digits of the box’s number or a simple number like 1000, 2000, etc. Once
you get on, they are very user friendly and will prompt you with a menu of
options. If you can’t find any empty boxes or want to do more, you can hack
but the system administrators box, which will usually be 9999 on the same
prefix as the other boxes, will allow you to hear anybody’s messages and
create and delete boxes.

Sperry Link
———–
These systems are very nice. They will usually be found on an 800 number.
These are one of the hardest to get a box on because you must hack out a user
ID (different from the person’s box number) and a password. When it answers,
if it says, “This is a Sperry Link voice station. Please enter your user ID,”
you will have to start trying to find a valid user ID. On most Sperrys it
will be a five digit number. If it answers and says, “This is an X answering
service,” you first have to hit *# to get the user number prompt. Once you
get a valid user number will have oKVWV..”!password on most systems, it
will be 4 digits. Once you get in, these are also very user friendly and have
many different options available.

RSVP
—-
This is probably one of the worst VMSs but it is by far the easiest to get
yourself a box. When it answers you can hit * for a directory of the boxes on
it (it will only hold 23). If you hit # you will be given a menu of options
and when you choose an option you will then be prompted for your ID number.
The ID number on an RSVP system will just about always be the same as the
mailbox number, which are always only 2 digits.

A.S.P.E.N.
———-
The Aspen voice message systems made by Octel Telecommunications is in my
opinion the BEST VMS made. To get a box on an Aspen, you need to find an
empty box. To find an empty box, scan the box numbers and if one says, “You
entered XXXX. Please leave a message at the tone,” then this is an empty box.
You next just press # and when prompted for your box number enter the number
of the empty box and friendly voice of the nice lady will guide you through
all of the steps of setting up your box. She first tells you what you can do
with the box and then will prompt you with, “Please enter the temporary
password assigned to you by your system manager.” This password will usually
be 4 digits long and the same as the box number like 1000, etc. Once you get
on their are many things you can do. You can make a distribution list where
if you want to leave a certain message to more than one person, you can enter
the list number and all of the boxes on the list will get the message. You can
also have the system call you and notify you that you have new messages. These
systems also have what they call “Information center mailboxes” that are
listen only and can also have a password on them so the person calling has to
enter the password before he hears the greeting message. Aspen VMSs have a
system managers mailbox that will just about give you total control of the
whole system and let you listen to people’s mail, create and delete boxes, and
many other things.

Thank you for reading this file and if you would like to get in touch with me
VIA VOICE MAIL call 1-800-222-0311 and hit *2155.

//–Black Knight from 713–
| for PHRACK XI (1987) |
–++–++–++–++–++–++-//

==========================================================================
Mailbox Systems
==========================================================================
Mailbox systems are the link between information and the underworld. If
you have ever called one, then you will know the advantages of having one,
especially the ones that are open to whole underworld, rather than just a
select few. There are two types of mailbox systems that are widely used.
The first type we will talk about is the multiple mailbox systems, or
commonly referred to as message systems. These systems have several
mailboxes set up on one number. Usually, you can access other mailboxes
from that number by pressing ‘*’ or ‘#’. Sometimes you just enter the
mailbox number and you are connected. These are the safest systems to use
to protect information from US Sprint and other long distance companies.
Since US Sprint and other companies call the destination numbers, it is
safer to have 800 mailbox systems, and most of the time, the multiple
mailbox systems are on 800 numbers. The passcode on these systems can
vary in length and can be accessed by several different methods, so it is
impossible to explain exactly how to hack these systems.
The other type is the single mailbox system. These are usually set up
in a reserved prefix in an area code. (Ex: 713-684-6xxx) These systems
are usually controlled by the same type of hardware/software. To access
the area where you enter the passcode, just hit ‘0’ for a second or so.
The passcodes are four (4) digits long. The only way to hack these is
manually. The best thing you could do is to find one that does not have
a recording from a person, but just the digitized voice. If you hack one
that someone already owns, they will report it and it will not last as
long.

Here is a list mailboxes or prefixes to help you get started
————————————————————————–
Single Multiple Digits
———— ———— ——–
213-281-8xxx 212-714-2770 3
213-285-8xxx 216-586-5000 4
213-515-2xxx 415-338-7000 Aspen Message System 3
214-733-5xxx 714-474-2033 Western Digital
214-855-6xxx 800-222-0651 Vincent and Elkins 4
214-978-2xxx 800-233-8488 3
215-949-2xxx 800-447-8477 Fairylink 7
312-450-8xxx 800-521-5344 3
313-768-1xxx 800-524-2133 RCA 4
405-557-8xxx 800-527-0027 TTE TeleMessager 6
602-230-4xxx 800-632-7777 Asynk 6
619-492-8xxx 800-645-7778 SoftCell Computers 4
713-684-6xxx 800-648-9675 Zoykon 4
800-847-0003 Communications World 3
==========================================================================

==Phrack Inc.==

Volume Three, Issue Thirty-four, File #6 of 11

HACKING VOICE MAIL SYSTEMS

by Night Ranger

DISCLAIMER

I, Night Ranger, or anyone else associated with Phrack, am not responsible
for anything the readers of this text may do. This file is for informational
and educational purposes only and should not be used on any system or network
without written permission of the authorized persons in charge.

INTRODUCTION

I decided to write this text file because I received numerous requests for
vmbs from people. Vmbs are quite easy to hack, but if one doesn’t know where
to start it can be hard. Since there aren’t any decent text files on this
subject, I couldn’t refer them to read anything, and decided to write one
myself. To the best of my knowledge, this is the most complete text on
hacking vmb systems. If you have any comments or suggestions, please let me
know.

Voice Mail Boxes (vmbs) have become a very popular way for hackers to get in
touch with each other and share information. Probably the main reason for
this is their simplicity and availability. Anyone can call a vmb regardless
of their location or computer type. Vmbs are easily accessible because most
are toll free numbers, unlike bulletin boards. Along with their advantages,
they do have their disadvantages. Since they are easily accessible this
means not only hackers and phreaks can get information from them, but feds
and narcs as well. Often they do not last longer than a week when taken
improperly. After reading this file and practicing the methods described,
you should be able to hack voice mail systems with ease. With these thoughts
in mind, let’s get started.

FINDING A VMB SYSTEM

The first thing you need to do is find a VIRGIN (unhacked) vmb system. If
you hack on a system that already has hackers on it, your chance of finding
a box is considerably less and it increases the chance that the system
administrator will find the hacked boxes. To find a virgin system, you need
to SCAN some 800 numbers until you find a vmb. A good idea is to take the
number of a voice mail system you know, and scan the same exchange but not
close to the number you have.

FINDING VALID BOXES ON THE SYSTEM

If you get a high quality recording (not an answering machine) then it is
probably a vmb system. Try entering the number 100, the recording should
stop. If it does not, you may have to enter a special key (such as ‘*’ ‘#’
‘8’ or ‘9’) to enter the voice mail system. After entering 100 it should
either connect you to something or do nothing. If it does nothing, keep
entering (0)’s until it does something. Count the number of digits you
entered and this will tell you how many digits the boxes on the system are.
You should note that many systems can have more than one box length depending
on the first number you enter, Eg. Boxes starting with a six can be five
digits while boxes starting with a seven can only be four. For this file we
will assume you have found a four digit system, which is pretty common. It
should do one of the following thin