==============================================================================
RELEASED ON 07/01/92
==============================================================================
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%
%%%%%%####%%####%%%######%%%######%%%###%%###%%%%%######%%%%%%%%%% // %%%%%%
%%%%%########## %### ### %### ### %### %### %%%%### %%%%%%%% // %%
%%%%### ## ### %### %### %###### %%### %### %%%%#####%%%%%%%%%%% /~~~~~~~/\ %
%%%### %% ### %### %### %### ### %### %### %%%%### %%%%%%%%% /:::::::/ / %%
%%### %%%### %%###### %%###### %### %######%%#######%%%%%%%%% /:::::::/ / %%%
%%% %%%%% %%%% %%%% %%% %% %% %%%%%%% /_______/ / %%%%
%%%%%%######%%#######%%%%######%%%###%%###%%#######%%%%%%%%% /1/2/3/A/ / %%%%%
%%%%%### ### ### %### ### %### ### ### ### %%%%%%% /4/5/6/B/ / %%%%%%
%%%%#####%%%####### ######## ### ### ### ### %%%%%% /7/8/9/C/ / %%%%%%%
%%%### %### ### #### ### ### ### ### ### %%%%%% /*/0/#/D/ / %%%%%%%%
%%### %%%### ### ### ### %###### %####### %%%%%%% /~~~~~~~/ / %%%%%%%%%
%%% %%%%% %% %% %% %%% %%% %%%%%%% /_______/ / %%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \_______\/ %%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%
%%%%%%%%UHF%MOBILE%PHONE%TECHNOLOGY%AND%YOU%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
==============================================================================
WRITTEN, CREATED, AND TESTED BY VIDEO VINDICATOR
==============================================================================
DEDICATION
~~~~~~~~~~
I would like to dedicate this to the memory of Scantronics, which as the
logon said, was definantly 'The last of a dying breed'. In early May /<ludge
got a visit from authorities who took all his gear, except his printer (oh,
how thoughtful). You see, our enemies have finally realized one of the weaker
links in the H/P society... The distribution of information. By hitting all of
the worthwhile boards, they can make it harder and harder to learn and swap
ideas. Well, there isn't too much we can do about it, except start talking
with people one-on-one, and get a 'verbal network' going. This is pretty much
all we can do. Our Enemy is taking steps towards eradication of our chosen
hobby, and we must take steps to prevent it's distruction. Well, enough with
the lecture, on with the file, and keep good thoughts for /<ludge...
INTRODUCTION
~~~~~~~~~~~~
Ah yes, here I am again, writing like there's no tommorow, but even if there
was, who the hell would want it? Anyways... I've been just doing my own thing
for the past couple months, let tax time go by, and decided I needed to give
some more of my helpful insight to the world. Ok, this file is about the
closest thing to a hacking file as you'll probably see me write (especially
since hacking isn't my forte and I know many people out there who are better
at it than me (See Digital Hitler, I admitted that you're better, and in public
no less!)). Ah well, this covers those wonderful UHF Mobile telephones that
are out and about... Not Cellular mind you, but UHF Mobile. I will go into
detail on the Zetron series of Repeater Computers, which seem to be the most
common.
ME, YOU, AND THE REPEATER
~~~~~~~~~~~~~~~~~~~~~~~~~
What you will be accessing is the repeaters in your local area. Most large
cities have at very least 5, and some have upwards of 15. Now each repeater
usually is accessable throughout the city, although they get better reception
in certain areas. Soo, once you estabish the region that works best for you,
that will be the target repeater. Now, when you dial the repeater, you will
get another tone, much like a PBX, where you are supposed to enter the extension
of the mobile phone you wish to reach. Remember that each repeater is
independant, so you will need to program yourself on all the ones you wish to
use. Also, choose one as your base channel, usually the one that is in the
region you will be around the most, and program this one for ringing capab-
ilities. One of the real benifits of this is you can set up multiple extentions
on each repeater, and have tons of phone numbers and extensions.
You can also access the voice paging feature, and capture a voice mail box.
This is accomplished by simply assigning yourself a 5-tone pager id, and then
finding the phone number of the VMB that corresponds to it. This is especially
nice when you don't necessarily want people to realize where you are, or when
you want to call screen losers.
HACKING THE ZETRON
~~~~~~~~~~~~~~~~~~
Here's the big joke of this... The 'hacking' process. The admin extension
is usually 7 digits, and usually starts with 000. Now that's still quite a
few possibilities, right? Nope, the shitty designers of this system made it
so when you enter a incorrect number it gives you that wrong tone. So say
the password is 0004311, when you call up, you enter 0, no tone? Enter 0 again.
Still no tone? Enter 0 a third time. No tone again. Now enter 0 a fourth
time. Ding-dong... Wrong tone. Now just repeat the first three, and try 1
for the fourth, and so on. Basic. And once you're in, there are no other
passwords... Boy these people sure are security concious.
THE SUPREME MENU
~~~~~~~~~~~~~~~~
Here's a 'flow-chart' of the menu structure for most Zetron-series repeaters.
I include the main and sub-menus, and also all the possible selections for each
command. Now remember, the system is hot-key, and you can type '!' anywhere
in it to get back to the main menu. It's formatted a little past 80 columns
since it is more useful printed and I wanted it even-looking. Here we go...
[S]YSTEM --+--- [C]OR -------+------- P. Polarity active high Yes/No
| +------- H. Hold time (*100ms) 0-50
| +------- Q. Quiet time (*100ms) 0-100
| +------- M. Mob Tx-to-Rx time (*100ms) 0-20
| +------- A. Mob act time (*sec) 15-255
| +------- V. COR validation active high Yes/No
| +------- B. Channel busy active high Yes/No
|
+--- [A]CCESS ------+----- S. Sign-on mode 0-2
| +----- D. DTMF timeout (*100ms) 30-250
| +----- R. Min. regenerated digits 1-15
| +----- U. Phone-to-mobile use ANI Yes/No
| +----- M. Mobile-to-mobile use ANI Yes/No
| +----- P. #+ANI disconnect Yes/No
| +----- C. Dial click decode mode 0-3
|
+--- [H] DISPATCH ---+---- H. Repeater Hold Time (*100ms) 0-250
| +---- S. CTCSS Hold Time (*100ms) 1-30
| +---- T. Timeout (*min) 1-10
| +---- I. Hog Idle Time (*sec) 1-25
| +---- L. Hog Limit Time (*min) 1-99
| +---- P. Hog Penalty Time (*10sec) 1-250
| +---- R. Dispatch ID Rate (*min) 1-99
| +---- D. CTCSS for dispatch Yes/No
| +---- O. Courtesy tone Yes/No
| +---- M. Stuck Mic ID Yes/No
|
+--- [P]AGING ----+------- D. Keyup delay (*25ms) 0-200
| +------- T. Talk time (*sec) 5-25
| +------- V. Vox hold time (*100ms) 0-50
|
+--- STATION [I]D ----+--- M. Mode 0-3
| +--- I. Interval (*min) 1-99
| +--- S. Call sign (chrs) CCCC###
|
+--- AUTO[D]IALS ---+----- 1. (chrs) 0-16 chars
| +----- 2. (chrs) 0-16 chars
| +----- 3. (chrs) 0-16 chars
| +----- 4. (chrs) 0-16 chars
| +----- 5. (chrs) 0-16 chars
| +----- 6. (chrs) 0-16 chars
| +----- 7. (chrs) 0-16 chars
| +----- 8. (chrs) 0-16 chars
| +----- 9. (chrs) 0-16 chars
|
+--- [V] TOLL RESTRICT -+- 1. Max toll digits 1 1-30
| +- 2. 1st digit restrict 1 (chrs) 0-4 chars
| +- 3. 2nd digit restrict 1 (chrs) 0-4 chars
| +- 4. Max toll digits 2 1-30
| +- 5. 1st digit restrict 2 (chrs) 0-4 chars
| +- 6. 2nd digit restrict 2 (chrs) 0-4 chars
|
+--- [T]ELCO CONTROL --+-- 1. Call limit timer-1 (*min) 1-60
| +-- 2. Call limit timer-2 (*min) 1-60
| +-- 3. Channel ringouts-1 1-25
| +-- 4. Channel ringouts-2 1-25
| +-- O. Delay before dialout (*100ms) 5-100
| +-- D. Disconnect on 2nd dialtone Yes/No
| +-- M. Dialout mode 0-3
| +-- V. Override dispatch Yes/No
|
+--- LINE [1] SETTING --+- A. Rings until answer 1-20
| +- D. Channel busy rings 1-25
| +- M. Answer mode 0-2
| +- U. Auto call user 0-99
|
+--- LINE [2] SETTING --+- A. Rings until answer 1-20
| +- D. Channel busy rings 1-25
| +- M. Answer mode 0-2
| +- U. Auto call user 0-99
| +- P. Priority override Yes/No
|
+--- [L]OCAL PHONE ---+--- D. Channel busy rings 1-25
| +--- M. Answer mode 0-1
| +--- U. Auto call user 0-99
|
+--- [M]ISCELLANEOUS --+-- D. Courtesy tone duration (*25ms) 1-10
+-- F. Courtesy tone frequency (*10Hz) 35-100
+-- A. Automatic gain (AGC) on Yes/No
+-- H. High pass filter on Yes/No
+-- S. CTCSS add-in Yes/No
+-- R. ANI for system relays (chrs) 1-8 chars
+-- 1. User relay 1 mode 0-4
+-- 2. User relay 2 mode 0-4
+-- B. Run modem at 300 baud Yes/No
[U]SERS ---+--- [A]CCESS -------+---- U. User range 1-325
| +---- E. User enabled Yes/No
| +---- M. Mobile-to-phone Yes/No
| +---- P. Phone-to-mobile Yes/No
| +---- B. Mobile-to-mobile Yes/No
| +---- H. Dispatch Yes/No
| +---- C. COR to answer Yes/No
| +---- S. * to answer Yes/No
| +---- D. # to disconnect Yes/No
| +---- F. Fast ANI required Yes/No
| +---- L. Line select Yes/No
| +---- 2. Line 2 default Yes/No
| +---- A. Autodial mode 0-15
|
+--- [O]PERATION -----+--- U. User range 1-325
| +--- E. User enabled Yes/No
| +--- Q. Equipment type 0-4
| +--- N. Number of ringouts mode 1-2
| +--- S. Ringout style 0-7
| +--- O. Courtesy tone Yes/No
| +--- X. Full-duplex mobile Yes/No
| +--- P. Privacy Yes/No
| +--- M. Call timer mode 0-2
| +--- T. Toll mode 0-2
| +--- D. DTMF thru Yes/No
| +--- F. Page format 0-5
| +--- C. Tone/code drop mode 0-2
| +--- 1. Enable relay 1 Yes/No
| +--- 2. Enable relay 2 Yes/No
|
+--- [S]PECIFIC ----+----- U. Current user 1-325
| +----- E. User enabled Yes/No
| +----- A. ANI code (chrs) 0-8 chars
| +----- F. Page format 0-5
| +----- P. Page code (chrs) (Above #)
| +----- X. Tx tone/code 0-38
| +----- R. Rx tone/code 0-38
|
+--- [T]ONE DISPATCH -+--- U. Current user 1-325
| +--- E. Enabled Yes/No
| +--- R. Reserved Yes/No
| +--- X. Tx tone/code 0-38
| +--- T. Tone in tail Yes/No
| +--- V. Privacy Yes/No
| +--- O. Courtesy tone Yes/No
| +--- H. Hog Mode Yes/No
| +--- M. Morse ID (chrs)
|
+--- [L]IST ------+------- U. User range 1-325
+------- A. List ANI users Yes/No
+------- T. List tone dispatch users Yes/No
SUPER[V]ISOR +- A. Program mode ANI (chrs) 1-7 chars
+- N. Supervisor user number 0-99
+- S. Reset system programming Yes/No
+- D. Reset dispatch programming Yes/No
+- U. Reset ANI user programming Yes/No
+- M. Logon message 0-34 chars
+- L. List system programming Yes/No
[A]CCOUNTING +- M. Minimum call time (*sec) 0-180
+- U. User range 1-325
+- 2. List ANI accumulated Yes/No
+- 1. Clear ANI accumulated Yes/No
+- 4. List tone dispatch accumulated Yes/No
+- 3. Clear tone dispatch accumulated Yes/No
[T]EST ----+--- A. Tone 1 frequency (*10Hz) 35-100
+--- B. Tone 2 frequency (*10Hz) 35-100
+--- 1. Single tone (=Telco:1,Tx:2) 0-2
+--- 2. Dual tone (=Telco:1,Tx:2) 0-2
+--- 3. CTCSS tone (=Tone) 0-38
+--- 4. Emphasis (=Off,On) Yes/No
+--- H. Hybrid adjust (=Off,On) Yes/No
+--- D. DTMF/Click detect (=Telco:1,Rx:2) 0-2
+--- C. COR detect Yes/No
+--- K. Click calibrate Yes/No
+--- S. Sense line states Yes/No
+--- T. CTCSS Decode Yes/No
+--- M. Memory Yes/No
[O]PTIONS --------- Lists the Tone and Normal Users
[E]XIT ------------ Hangs up the modem
PROGRAMMING THE SYSTEM
~~~~~~~~~~~~~~~~~~~~~~
Ok, Here's a default settings buffer for the system, and I will explain what
each thing means in the next section, so read and absorbe...
SYSTEM PROGRAMMING FOR phone # (repeater name) AS OF date
COR MENU
P. Polarity active high = Yes
H. Hold time (*100ms) = 1
Q. Quiet time (*100ms) = 50
M. Mob Tx-to-Rx time (*100ms) = 2
A. Mob act time (*sec) = 32
V. COR validation active high = Yes
B. Channel busy active high = No
ACCESS MENU
S. Sign-on mode = 0
D. DTMF timeout (*100ms) = 50
R. Min. regenerated digits = 7
U. Phone-to-mobile use ANI = Yes
M. Mobile-to-mobile use ANI = Yes
P. #+ANI disconnect = Yes
C. Dial click decode mode = 0
DISPATCH MENU
H. Repeater Hold Time (*100ms) = 30
S. CTCSS Hold Time (*100ms) = 8
T. Timeout (*min) = 3
I. Hog Idle Time (*sec) = 5
L. Hog Limit Time (*min) = 5
P. Hog Penalty Time (*10sec) = 30
R. Dispatch ID Rate (*min) = 15
D. CTCSS for dispatch = Yes
O. Courtesy tone = No
M. Stuck Mic ID = Yes
PAGING MENU
D. Keyup delay (*25ms) = 40
T. Talk time (*sec) = 10
V. Vox hold time (*100ms) = 1
STATION ID MENU
M. Mode = 2
I. Interval (*min) = 15
S. Call sign (chrs) = xxxxxxx
AUTODIALS MENU
1. (chrs) =
2. (chrs) =
3. (chrs) =
4. (chrs) =
5. (chrs) =
6. (chrs) =
7. (chrs) =
8. (chrs) =
9. (chrs) =
TOLL RESTRICT MENU
1. Max toll digits 1 = 15
2. 1st digit restrict 1 (chrs) = 1111
3. 2nd digit restrict 1 (chrs) = 0000
4. Max toll digits 2 = 7
5. 1st digit restrict 2 (chrs) = 00
6. 2nd digit restrict 2 (chrs) = 00
TELCO CONTROL MENU
1. Call limit timer-1 (*min) = 3
2. Call limit timer-2 (*min) = 3
3. Channel ringouts-1 = 4
4. Channel ringouts-2 = 4
O. Delay before dialout (*100ms) = 20
D. Disconnect on 2nd dialtone = Yes
M. Dialout mode = 1
V. Override dispatch = No
LINE 1 MENU
A. Rings until answer = 2
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 0
LINE 2 MENU
A. Rings until answer = 2
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 1
P. Priority override = No
LOCAL PHONE MENU
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 0
MISCELLANEOUS MENU
D. Courtesy tone duration (*25ms) = 3
F. Courtesy tone frequency (*10Hz) = 54
A. Automatic gain (AGC) on = No
H. High pass filter on = Yes
S. CTCSS add-in = No
R. ANI for system relays (chrs) = *1
1. User relay 1 mode = 0
2. User relay 2 mode = 0
B. Run modem at 300 baud = Yes
** End of list **
IMPORTANT COMMANDS TO KNOW
~~~~~~~~~~~~~~~~~~~~~~~~~~
Ok, Now I'll discuss some of the more necessary commands, and what they do.
Most of the others are pretty easy to figure out, or are not necessary. The
only really useful area is in the TOLL RESTRICT, TELCO CONTROL, and menus.
The system is usually split into two different systems, although on MOST they
only use one of them. So, what you want to do is configure the [2] settings
for you, and leave the [1] settings untouched (so they are not aware of the
usage.
You will want to change the following in the TOLL RESTRICT menu:
4. Max toll digits 2 = 20 (Amount of numbers)
5. 1st digit restrict 2 (chrs) = (Non-allowed first digit)
6. 2nd digit restrict 2 (chrs) = (Non-allowed second digit)
This will allow you to call oversears or special numbers with no hassle.
Next in the TELCO CONTROL menu:
2. Call limit timer-2 (*min) = 99 (The Maximum call time)
4. Channel ringouts-2 = 9 (Number of rings before
giving up)
This will configure your phone to allow 99 minutes per call, and let you
ring someone nine times.
Make sure not to edit anything within the STATION ID menu, since this will
bring the FCC down on the operators head, and we don't want the repeater to
get shut down.
Also, if you were wondering what they do if they find out that you're in the
system, well, that's easy. They disable the phone modem and enable the packet
one, so only people with HAM setups are able to call up and alter information.
This is a little extreme, but most of the time it will happen if you're billing
an enormous amount of calls to it, or taking up a massive amount of airtime
(and neglecting to cover it up).
VIEWING USER INFORMATION
~~~~~~~~~~~~~~~~~~~~~~~~
This is one of the nicer and more useful functions of the system, this way
you can get a complete listing of all the repeater users, and what services
they have available.
Here's a list of the most common (and most important abbreviations used in
the user list...
A = Privacy B = User enabled C = * to Answer
D = # to disconnect E = DTMF thru F = Number of ringouts mode
K = Call timer mode P = Mobile-to-phone Q = Phone-to-mobile
R = Mobile-to-Mobile U = Toll mode
PRIVACY means whenever you speak, the repeater will transmit a beeping sound,
so anyone listening will only be able to hear the person you call. USER ENABLED
is self explanitory, * TO ANSWER means you will only need to dial '*' to answer
calls, instead of '*' plus your ANI. # to disconnect is the same an answer, but
to cancel a call. DTMF thru means the repeater will allow DTMF tones to be
transmitted. NUMBER OF RINGOUTS MODE is which phone callout mode you have (set
this to [2], your custom callout setting). P,Q,and R all pretty much are the
same, allowing users to call from on to the other. TOLL MODE is another you
set to [2], altering from the default toll settings.
Ok, and now here's what the user printout looks like. USR is the actual user
number, the letters A-X correspond to the above list, ANI is the extension
number, RX is the recieve tone, TX is the transmit tone, TYPE is the type of
paging service, and PAGE is their 5 tone sub-audible...
Model xx (xxxxxxx)
Usr Programming ANI Rx Tx Type Page
--- ABCDEFGHIJKLMNOPQRSTUVWX -------- ---- ---- ------ --------
1 nYYnY100nn1nnnnYYYnn200n D 0 0 *None*
2 nYYnY100nn1nnnnYYYnn200n 1000 2 2 *None*
3 nYYnY100nn1nnnnYYYnn200n D 3 3 *None*
4 YYYnY100nn1nnnnYYYnn200n 1001 4 4 *None*
5 nYnnY100nn1nnnnYYYnn200n 1002 5 5 *None*
6 nYYYY100nn1nnnnYYYnn200n 1003 6 6 *None*
7 nnYnY100nn1nnnnYYYnn200n D 7 7 *None*
8 nYYnY200nn1nnnnYYYnn200n 1004 8 8 *None*
9 nYYYY100nn1nnnnYYYnn200n 1005 9 9 *None*
10 nYYYY100nn1nnnnYYYnn200n 1006 10 10 *None*
11 nnYYY100nn1nnnnYYYnn200n D 0 0 *None*
12 nYYYY100nn1nnnnYYYnn200n 1007 12 12 *None*
13 YYYnY100nn1nnnnYYYnn200n 1008 13 13 *None*
14 nnYYY100nn1nnnnYYYnn200n D 14 14 *None*
15 nnYYY100nn1nnnnYYYnn200n D 0 0 *None*
16 nYYYY100nn1nnnnYYYnn200n 1009 16 0 2 Tone 12345
17 nnYYY100nn1nnnnYYYnn200n D 17 17 *None*
18 nnYYY100nn1nnnnYYYnn200n D 18 0 *None*
19 nYYYY100nn1nnnnYYYnn200n 1010 19 19 *None*
20 nYYYY100nn1nnnnYYYnn200n D 20 20 *None*
21 nnYYY100nn1nnnnYYYnn200n D 0 0 *None*
** End of list **
The ANI is what people calling you need to dial (i.e. your extension), and
the number you need to dial in order to make calls out. The best way to use
this is to just piggy-back someones existing account. They definantly won't
complain when they get all the wonderful features, and then that also leaves
a very obvious (and innocent) scapegoat... My favorite kind.
The tone userlist is a little different than the mobile users... This is
mainly for pagers that happen to be using the same repeater, although that is
highly uncommon. Here it is...
TONE DISPATCH LIST FOR xxx-xxxx (xxxxxxxxx)
Model xx (xxxxxxx)
Usr Programming Out Tone ID
------ ABCDEFG -------------------------
1 nnnnnnn 1
2 nnnnnnn 2
3 nnnnnnn 3
4 nnnnnnn 4
5 nnnnnnn 5
6 nnnnnnn 6
7 nnnnnnn 7
8 nnnnnnn 8
9 nnnnnnn 9
10 nnnnnnn 10
11 nnnnnnn 11
12 nnnnnnn 12
13 nnnnnnn 13
14 nnnnnnn 14
15 nnnnnnn 15
16 nnnnnnn 16
17 nnnnnnn 17
18 nnnnnnn 18
19 nnnnnnn 19
20 nnnnnnn 20
21 nnnnnnn 21
** End of list **
There has never been any configured on any of the systems I've been on, so
I can't really tell you too much about the configuration information, although
that would lead me to believe that the feature isn't very exciting.
THE CALLER LOG... THE ENEMY
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Unfortunantly, as with everything in life, there's always a snag... The
caller log, although in this case it just takes a little extra effort to trick
the ever present enemy. Every space means there were some accounts inbetween
the used accounts that are deactivated. Here's what the log looks like...
CALLER LOG FOR xxx-xxxx (xxxxxxxxx)
User 6 01:22:30 87 Access(es)
User 12 00:37:02 48 Access(es)
User 13 00:27:01 40 Access(es)
User 16 00:23:56 49 Access(es)
User 19 00:28:26 33 Access(es)
User 21 00:11:18 14 Access(es)
** End of list **
On the surface this may appear to be fairly useless, but there is something
to be feared here. Many of the companies take it upon themselves to total the
time used, and then divide by the number of accesses. Now what this tells them
is the average call length... And if you're making 45 minute calls, this is
going to boost the call time just a LITTLE past 3 minutes, then all they do is
the same thing on a user by user basis and wala, they know whose account you're
on.
It only takes a little bit of extra effort to cancel this out though. Just
place a shitload of small calls, like 10 secs, and one of those for every 2 or
3 minutes you've used on your long call. This safely masks your using of the
system, as long as you aren't calling Alliance or making LD calls.
It is true that you can zero this list in the accounting menu, and that's
another way you can get around it, although this alerts them as to there is
either someone else on the system (and they're trying to hid something), or that
there is some sort of problem with the system, and they either try to fix what
is not wrong, or give up and write off the problem (and this is what you hope).
For those who wish to have all the reference, here's the Tone Dispatch Log...
TONE DISPATCH LOG FOR xxx-xxxx (xxxxxxxxxxxxx)
User 1 00:07:53
User 2 00:13:53
User 3 00:23:14
User 4 00:01:23
User 5 00:13:09
User 6 00:02:04
User 7 00:05:14
User 8 00:01:00
User 10 00:03:43
User 11 00:00:02
User 12 00:42:40
User 13 00:02:07
User 15 00:00:03
User 16 00:15:46
User 17 00:01:22
User 18 00:14:22
User 19 00:01:34
User 20 00:01:55
User 21 00:00:33
** End of list **
FREQUENCIES
~~~~~~~~~~~
Here's the technical description of the frequencies they use:
405-425, 440-460, 450-470 (in 12.5kHz steps)
Now since this even though this isn't dual-synchronis, is does use two
freqencies per channel. Now, is the first frequency was 405.000kHz, the sister
frequency would be 405.900kHz. Pretty basic, eh? The second frequency (your
transmit one) is always 0.900 kHz above the recieve. Usually you can call up
your local mobile phone company and find out their repeater frequencies... Hell,
several have faxed me complete listings and their effective range, I sure do
love companies with great customer service!
The tones which are used by the repeaters (both audible and subaudible) are
FCC regulated, so they are a standard... Meaning the repeaters tone 13 will
be the same as the Yaesu's tone 13. For more information on the tones, simply
go to your local library and see what the government has regulated for your
area.
CAN YOU SAY... YAESU?
~~~~~~~~~~~~~~~~~~~~~
Now there are many different manufactures of UHF phones out there, but the
one I would recommend over Motorola and Maxon would be Yaesu. They started
out as a pro equiptment dealer only, selling some of the best HAM radio gear
around, then about 2 years ago they entered into the commercial market. Now
they heave several handheld units available, but I would recommend above all
the others the FTH-7008. It sells for around $500 (but who's paying? (Refer to
Carding, My Way series)), and has a Priority Channel, Scan, Hi/Lo Power settings,
Auto-Squelch, and 15 channels (not crystals, but synthesis). Now, you will also
need the FTT-4DT (make SURE it's the 4DT not just the 4, because otherwise it
won't work). Now the FTT-4DT is a DTMF pad which goes on the unit between the
battery and the body, you can easily do the instilation yourself, and the unit
runs around $280.
Now what this gives you above and beyond the keypad is a squelch which will
only turn off when it recieves a certain 2-tone combination or a 5-tone sub-
audible. These are used to make the unit either ring for an incoming call, or
to respond when a page comes through.
Now here's the beauty of Yaesu. Your dealer can AND WILL sell you the
software and hardware necessary to program it yourself. It runs around $80
and is for the IBM XT or better. This drives the FCC CRAZY and gives you TOTAL
power... Now all you need to do is hack into the repeater and wala... Phone
service.
USES AND ABUSES
~~~~~~~~~~~~~~~
Now here's the payoff... Not only can you make calls out, long distance or
otherwise, and not have to worry about being billed or located, but you can
recieve calls in an almost totally secure way. Now you must keep in mind that
this is only half duplex, so the modem is out of the picture, but for voice
communication, from anywhere in you city and most likely ajacent cities, this
is the best thing since sliced bread! Now you can assign yourself as many
different extensions as you want, and I would recommmend changing them fairly
frequently. Also try to be away from home and/or on the move when calling,
since this will reduce the chances of being located if they should somehow
become suspicious. About the only way they will is if you do bill long distance
numbers to the Repeater, or if you dominate the airtime on it.
Once a month the owner of the repeater goes out on sight and gets a usage
log. Usually calls are limited to 3 minutes, so the average call is 2 minutes.
Now, if you're dominating the system, the average call is going to be quite
alot more than 3 mins, and he's going to know something strange is going on.
Of course, all he can do is change the password, and we all know how 'secure'
that is... hehe.
Now there are also companies (real bastard ones, who deserve to be fucked)
that run mobile like it was cellular, and charge minutely. Now these guys are
EASY to fuck with, since you can create yourself an account, take it off the
minutely billing cycle, and just don't make LD calls, only recieve calls... Wala
now you have a RADICAL phone, which will most likely never be discovered (mine
hasn't been for close to 4 months, and boy is it nice!).
Now one note on this... Usually it isn't the cops who deal with this, it's
the FCC, and believe it or not, they actually do get the job done fairly well.
But this by no means says it's dangerous... On the offical Vindicator Danger
scale this only rates a 3... And even lower if you're cautious.
CONCLUSION
~~~~~~~~~~
Ahh.. Another fine file comes to the conclusion... And, as usual, I really
don't have altogether too much to say that hasn't been already said! If you
feel compelled to leave me fan mail, with questions, comments, or threats,
then please do so at any of the boards listed below... I usually call at least
once a month or so. I have to say I always get a kick out of hearing from
people who have enjoyed my files, so write damn you!
I'd like to take a moment to welcome The Stash to my elustrious list of
file gathering sites... If you're in Europe, or the States for that matter,
this board is a definant must. And it's also the only overseas system I call.
Wow, my list of boards at the bottom is getting SMALL... So if anyone out
there knows of ANY good systems out there, that still hold true to the beliefs
that made the H/P scene what it is today, then leave me mail on the Roach.
And now, for the ever popular greetings...
/<ludge The White Rider Maximum Overdrive Digital Hitler
Strato Viper Erekose Mind Walker Grandmaster Ratte'
And anyone else worth mentioning that I didn't... And Always remember...
The future is Now, and we must take what we can.
=============================================================================
Demon Roach [PW: THRASH cDc Board - A Classic - GREAT ] 24 806-794-4362
Church/Theives [IBM H/P system running with MNP - 96 soon ] 24 619-789-2235
The Stash [My European Connection... Lots of files ] 96 46-498-222113
The Works [Tons of Files cDc Board Give it a call ] 24 617-861-8976
=============================================================================
This concludes another wonderful file by Video Vindicator (C)opyright 1992
=============================================================================
Downloaded From P-80 International Information Systems 304-744-2253