3 ms·

There's a lot of access tandem codes that use 0xx numbering. A lot of the really juicy stuff hides on toll networks though, and requires fairly specific trunks

There's a lot of access tandem codes that use 0xx numbering. A lot of the really juicy stuff hides on toll networks though, and requires fairly specific trunks to reach them. Overall though, I think most of the really sketchy stuff today hides in regular numbering ranges. EDIT: I should qualify all that by saying nobody I know has actually gone through the trouble of rifling through all 10,000 (1,000? In some, the last digit seems to be ignored) numbers in an ATC before. There's definitely stuff on there, but for whatever it's worth, Sprint's DMS-250 network will redirect the last four digits of an ATC destination to whatever number it thinks goes to the inward operator for that exchange. It's been like that for years, so maybe there's just nothing critical in there; else someone would've complained. Or on the other hand, maybe that's their way of locking it down.

peterwwillis 10y ago
Back in the day all the DATUs and SASS stuff were on regular exchanges, so I don't see why that would change. People like dec0der were indicted for rifling through all the carrier's "special" COs with wardialers to find them. And different providers would have different ranges for admin functions, maintenance, customer support, etc. It doesn't take long for a bored teenager with a modem to cycle through most of them (remember, only 540 COs per NPA, and while each CO had up to 10k subscribers, you could guess which ranges had something interesting on it)
- doctorshady 10y ago
  Considering his text files, I'd think he went through the exchanges by hand. Typically faster and more accurate if you're just looking for test numbers. http://oldskoolphreak.com/tfiles/phreak/ex_scan.txt http://oldskoolphreak.com/tfiles/phreak/ex_scan.txt http://oldskoolphreak.com/tfiles/phreak/espt2.txt http://oldskoolphreak.com/tfiles/phreak/espt2.txt
  - peterwwillis 10y ago
    Oh sure, a lot was done by hand, but if you're looking at an exchange without knowing anything about the carrier and can't find whatever specific range they're using for op stuff, a wardialer looking for a 400hz tone will save you time sitting at a dialpad. These files are from 5 years after I had started phreaking, which was 10-15 years after it had become popular. The only significant change I noticed was inbound dtmf tones being blocked, which really eliminated a lot of the fun you could have without finding your way into an admin line, an unsecured modem, or using social engineering. Bellsouth-specific exchange scanning by hand: https://web.archive.org/web/20010311195935fw_/http://fl2600.hypermart.net/780changex.htm https://web.archive.org/web/20010311195935fw_/http://fl2600.... If you'd like to listen to what idiotic phreakers' podcasts from the early 2000s sounded like, here you go: http://audio.textfiles.com/shows/binrev/ http://audio.textfiles.com/shows/binrev/ http://audio.textfiles.com/shows/defaultradio/ http://audio.textfiles.com/shows/defaultradio/ (you'll notice default radio has fewer episodes, because decoder went to jail....) There are some funny things though like Episode 84 of BinRev Radio, where Lucky225 finds out his voicemail number was found in Paris Hilton's phone's notes [after they were hacked], and social engineering their way through gated communities, which of course still works. Back when hacking was about fucking with systems, and not bug bounties and CTFs. (Get off my lawn!!!)
    - voltagex_ 10y ago
      Although they're silly, I learnt a lot from things like BinRev growing up. Lucky225 also owns the number of the former Mojave Phone Booth [0] which is now a party/conference line. [0]: https://en.wikipedia.org/wiki/Mojave_phone_booth https://en.wikipedia.org/wiki/Mojave_phone_booth [0.5]: http://99percentinvisible.org/episode/mojave-phone-booth/ http://99percentinvisible.org/episode/mojave-phone-booth/ [0.9]: +1 760-733-9969

peterwwillis 10y ago

Back in the day all the DATUs and SASS stuff were on regular exchanges, so I don't see why that would change. People like dec0der were indicted for rifling through all the carrier's "special" COs with wardialers to find them. And different providers would have different ranges for admin functions, maintenance, customer support, etc. It doesn't take long for a bored teenager with a modem to cycle through most of them (remember, only 540 COs per NPA, and while each CO had up to 10k subscribers, you could guess which ranges had something interesting on it)

doctorshady 10y ago
Considering his text files, I'd think he went through the exchanges by hand. Typically faster and more accurate if you're just looking for test numbers. http://oldskoolphreak.com/tfiles/phreak/ex_scan.txt http://oldskoolphreak.com/tfiles/phreak/ex_scan.txt http://oldskoolphreak.com/tfiles/phreak/espt2.txt http://oldskoolphreak.com/tfiles/phreak/espt2.txt
- peterwwillis 10y ago
  Oh sure, a lot was done by hand, but if you're looking at an exchange without knowing anything about the carrier and can't find whatever specific range they're using for op stuff, a wardialer looking for a 400hz tone will save you time sitting at a dialpad. These files are from 5 years after I had started phreaking, which was 10-15 years after it had become popular. The only significant change I noticed was inbound dtmf tones being blocked, which really eliminated a lot of the fun you could have without finding your way into an admin line, an unsecured modem, or using social engineering. Bellsouth-specific exchange scanning by hand: https://web.archive.org/web/20010311195935fw_/http://fl2600.hypermart.net/780changex.htm https://web.archive.org/web/20010311195935fw_/http://fl2600.... If you'd like to listen to what idiotic phreakers' podcasts from the early 2000s sounded like, here you go: http://audio.textfiles.com/shows/binrev/ http://audio.textfiles.com/shows/binrev/ http://audio.textfiles.com/shows/defaultradio/ http://audio.textfiles.com/shows/defaultradio/ (you'll notice default radio has fewer episodes, because decoder went to jail....) There are some funny things though like Episode 84 of BinRev Radio, where Lucky225 finds out his voicemail number was found in Paris Hilton's phone's notes [after they were hacked], and social engineering their way through gated communities, which of course still works. Back when hacking was about fucking with systems, and not bug bounties and CTFs. (Get off my lawn!!!)
  - voltagex_ 10y ago
    Although they're silly, I learnt a lot from things like BinRev growing up. Lucky225 also owns the number of the former Mojave Phone Booth [0] which is now a party/conference line. [0]: https://en.wikipedia.org/wiki/Mojave_phone_booth https://en.wikipedia.org/wiki/Mojave_phone_booth [0.5]: http://99percentinvisible.org/episode/mojave-phone-booth/ http://99percentinvisible.org/episode/mojave-phone-booth/ [0.9]: +1 760-733-9969