==Phrack Inc.== Volume Two, Issue Ten, Phile #3 of 9 ********************************** * The TMC Primer * *--------------------------------* * Written by: Cap'n Crax * *--------------------------------* * December 17, 1986 * ********************************** This file was originally intended to be a "data file" of info on TMC ports, formulas, etc, but I decided that it would serve a better use as a "tutorial" of sorts. But first a bit of background info... Who is TMC? TMC (TeleMarketing Communications) is a long distance service serving all 50 states. While not as well known as MCI or Sprint, they are a fairly large company. They are capable of setting up business communications systems, PBX's, and residential service. Unlike most LDC's, however, they operate on a "franchise" basis, which means that each franchise of the company has little information about any other franchise, although they do use the same lines and the same type of equipment. So, what can they do for me? Well, for most of us, TMC offers many new potentials for abuse. One of the primary weak points of the company is the code formats that they decided to use. Codes on all TMC ports are seven digits. If they were generated randomly, this would be a reasonably secure system from sequential code hacking. But TMC doesn't use random codes. Instead, they use a checksum based formula system, with different formulas on each port. I assume that this is because they wanted a wide displacement of the codes over the seven-digit series, so that a sequential code hacker wouldn't be able to get 2 or 3 good codes in a row. Or perhaps they are just very stupid. In any case, it's interesting that they seem to have never thought of what could happen if anyone ever managed to figure out any of these formulas. Anyway, that's what this file is about. Great! What else can you tell me? Well, TMC seems to use some form of the Dimension PBX system for their billing system (Their ads say that the switching equipment is digital). This makes TMC ports easily identifiable by the "Hi-Lo" bad code siren. For those who worry about such things, TMC is one of the "safer" companies to use. This is largely because, unlike "unified" companies like MCI, TMC franchises don't really care if another franchise is losing money. Since each franchise is independent of all others, there are many 800 ports, one for each franchise. If you use an out-of-state 800 port, you are free from such worries as ANI, which I have never perceived as a major threat to the code-user anyway. Also, TMC offers lots of opportunities for the aspiring security consultant (hehehe). Ok, so where's some real info? Right here. I am going to explain as much about TMC hacking as I can manage, without actually handing out codes. First, an example port. The example I am using is the 800 port for Louisville, KY. 1-800-626-9600 This is the port. If you are not familiar with TMC, you may want to call it to see what it sounds like. So let's say you call it and recognize it as a TMC. What next? Well, a good bet would be to run a standard "code-hack" program on it... Set it for seven digits, 1+ the number, and note that TMC codes start with 0 on more than 50% of the ports I have seen. So let's say that you then get this list of (fictional) codes... 0347589 0347889 0348179 0350358 0355408 At first glance, this may look like a series of "random" numbers. But, look closer. These numbers are based on a checksum. It is as follows... Code Format: 03xabcy x+y=13 (In the first code, x=4 and y=9, and, of course, 4+9=13) a+c=15 (Here, a=7 and c=8, and 7+8=15) b=1 to 9 (Digit "b" is unrelated to the rest of the numbers. It could, for example, be varied from 1-9 to possibly find more working codes) Also note that 0+5 would equal 15, since the 0 is really a 10. Really! Please note that the above formula is only fictional. I wouldn't want to possibly cause loss to TMC by giving away codes on their system! Is that all? No, of course not. TMC, in their love of telecom enthusiasts, has also put an additional prize in the Krackerjack box. The vast majority of TMC ports have "Outside Line" codes, which is a 2 or 3 digit number, that, when entered after certain codes, will give an AT&T dialtone. This is apparently a holdover from the fact that they are using PBX equipment. Anyway, if anyone is asking why you'd want an AT&T dialtone, (does anyone need to ask?) it will allow unrestricted calling. This, of course, means 976's, 900's, Alliance Teleconf., international calling, etc... Naturally, I can't list any of these, but I can say that if it is 2 digits, it would start with any number from 2-9 and end in 8 or 9. If it is three digits, it will almost always start with 6, and be followed by any two digits. Some possible outside line codes would be 59, 69, 89, 99, 626, 636, 628, etc... These, of course, are only examples of possible codes. As I mentioned, these O/S line codes are entered after the seven digit code. The O/S line codes only work after certain 7-digit codes, and from my experience, the 7-digit codes that they work with normally can't be used for the usual 7 digits+1+number dialing. I can find no apparent pattern to the codes that they do work with, so you will have to find them by trial-and-error. What, you want more? Ok, well, here's a few 800 ports... 1-800-433-1440 1-800-227-0073 1-800-331-9922 1-800-451-2300 1-800-354-9379 1-800-248-4200 1-800-531-5084 1-800-351-9800 Closing. Please note that this article is only intended as an overview of TMC and why they would/wouldn't be a good choice for your long distance needs. And goodness me, don't use any of this information in an illegal way!