===== Phrack Magazine presents Phrack 16 ===== ===== File 6 of 12 ===== ****************************************************************************** * * * Tapping Telephone Lines * * * * Voice or Data * * * * For Phun, Money, and Passwords * * * * Or How to Go to Jail for a Long Time. * * * ****************************************************************************** Written by Agent Steal 08/87 Included in this file is... * Equipment needed * Where to buy it * How to connect it * How to read recorded data But wait!! There's more!! * How I found a Tymnet node * How I got in ************* THE EQUIPMENT ************* First thing you need is an audio tape recorder. What you will be recording, whether it be voice or data, will be in an analog audio format. >From now on, most references will be towards data recording. Most standard cassette recorders will work just fine. However, you are limited to 1 hour recording time per side. This can present a problem in some situations. A reel to reel can also be used. The limitations here are size and availability of A.C. Also, some reel to reels lack a remote jack that will be used to start and stop the recorder while the line is being used. This may not present a problem. More later. The two types of recorders I would advise staying away from (for data) are the micro cassette recorders and the standard cassette recorders that have been modified for 8 to 10 hour record time. The speed of these units is too unstable. The next item you need, oddly enough, is sold by Radio Shack under the name "Telephone recording control" part # 43-236 $24.95. See page 153 of the 1987 Radio Shack catalog. ***************** HOW TO CONNECT IT ***************** The Telephone recording control (TRC) has 3 wires coming out of it. #1 Telco wire with modular jack. Cut this and replace with alligator clips. #2 Audio wire with miniature phone jack (not telephone). This plugs into the microphone level input jack of the tape recorder. #3 Audio wire with sub miniature phone jack. This plugs into the "REM" or remote control jack of the tape recorder. Now all you need to do is find the telephone line, connect the alligator clips, turn the recorder on, and come back later. Whenever the line goes off hook, the recorder starts. It's that simple. **************** READING THE DATA **************** This is the tricky part. Different modems and different software respond differently but there are basics. The modem should be connected as usual to the telco line and computer. Now connect the speaker output of the tape player directly to the telephone line. Pick up the phone and dial the high side of a loop so your line doesn't make a lot of noise and garble up your data. Now, command your modem into the answer mode and press play. The tape should be lined up at the beginning of the recorded phone call, naturally, so you can see the login. Only one side of the transmission between the host and terminal can be monitored at a time. Going to the originate mode you will see what the host transmitted. This will include the echoes of the terminal. Of course the password will be echoed as ####### for example, but going to the answer mode will display exactly what the terminal typed. You'll understand when you see it. A couple of problems you might run into will be hum and garbage characters on the screen. Try connecting the speaker output to the microphone of the hand set in your phone. Use a 1 to 1 coupling transformer between the tape player input and the TRC audio output. These problems are usually caused when using A.C. powered equipment. The common ground of this equipment interferes with the telco ground which is D.C. based. I was a little reluctant to write this file because I have been unsuccessful in reading any of the 1200 baud data I have recorded. I have spoke with engineers and techs. Even one of the engineers who designs modems. All of them agree that it IS possible, but can't tell me why I am unable to do this. I believe that the problems is in my cheap ass modem. One tech told me I needed a modem with phase equalization circuitry which is found in most expensive 2400 baud modems. Well one of these days I'll find $500 lying on the street and I'll have nothing better to spend it on! Ha! Actually, I have a plan and that's another file..... I should point out one way of reading 1200 baud data. This should work in theory, however, I have not attempted it. Any fully Hayes compatible modem has a command that shuts off the carrier and allows you to monitor the phone line. The command is ATS10. You would then type either answer or originate depending on who you wanted to monitor. It would be possible to write a program that records the first 300 or so characters then writes it to disk, thus allowing unattended operation. ************** HOW CRAZY I AM ************** PASSWORDS GALORE!!!! After numerous calls to several Bell offices, I found the one that handled Tymnet's account. Here's a rough transcript: Op: Pacific Bell priority customer order dept. How may I help you? Me: Good Morning, this is Mr. Miller with Tymnet Inc. We're interested in adding some service to our x town location. Op: I'll be happy to help you Mr. Miller. Me: I need to know how many lines we have coming in on our rotary and if we have extra pairs on our trunk. We are considering adding ten additional lines on that rotary and maybe some FX service. Op: Ok....What's the number this is referenced to? Me: xxx-xxx-xxxx (local node #) Op: Hold on a min....Ok bla, bla, bla. Well you get the idea. Anyway, after asking her a few more unimportant questions I asked her for the address. No problem, she didn't even hesitate. Of course this could have been avoided if the CN/A in my area would give out addresses, but they don't, just listings. Dressed in my best telco outfit, Pac*Bell baseball cap, tool belt and test set, I was out the door. There it was, just an office building, even had a computer store in it. After exploring the building for awhile, I found it. A large steel door with a push button lock. Back to the phone. After finding the number where the service techs were I called it and talked to the tech manager. Mgr: Hello this is Joe Moron. Me: Hi this is Mr. Miller (I like that name) with Pacific Bell. I'm down here at your x town node and we're having problems locating a gas leak in one of our Trunks. I believe our trunk terminates pressurization in your room. Mgr: I'm not sure... Me: Well could you have someone meet me down here or give me the entry code? Mgr: Sure the code is 1234. Me: Thanks, I'll let you know if there's any trouble. So, I ran home, got my VCR (stereo), and picked up another TRC from Trash Shack. I connected the VCR to the first two incoming lines on the rotary. One went to each channel (left,right). Since the volume of calls is almost consistent, it wasn't necessary to stop the recorder between calls. I just let it run. I would come back the next day to change the tape. The VCR was placed under the floor in case a tech happened to come by for maintenance. These nodes are little computer rooms with air conditioners and raised floors. The modems and packet switching equipment are all rack mounted behind glass. Also, most of the nodes are unmanned. What did I get? Well a lot of the logins were 1200, so I never found out what they were. Still have 'em on tape though! Also a large portion of traffic on both Tymnet and Telenet is those little credit card verification machines calling up Visa or Amex. The transaction takes about 30 secs and there are 100's on my tapes. The rest is as follows: Easylink CompuServe Quantumlink 3Mmail PeopleLink Homebanking USPS Chrysler parts order Yamaha Ford Dow Jones And a few other misc. systems of little interest. I'm sure if I was persistent, I'd get something a little more interesting. I spent several months trying to figure out my 1200 baud problem. When I went back down there the code had been changed. Why? Well I didn't want to find out. I was out of there! I had told a couple of people who I later found could not be trusted. Oh well. Better safe than sorry. ************************************** Well, if you need to reach me,try my VMS at 415-338-7000 box 8130. But no telling how long that will last. And of course there's always P-80 systems at 304-744-2253. Probably be there forever. Thanks Scan Man, whoever you are. Also read my file on telco local loop wiring. It will help you understand how to find the line you are looking for. It should be called Telcowiring.Txt <<< AGENT STEAL >>>