_+ +_ TELUS Mobility; Panasonic EN-POWR numeric pager exploit __ __ Telus Mobility offers to its customers, few types of paging services. One type is called 'EN-POWR numeric pager'. With the EN-POWR numeric pager, you get total FLEX coverage. In other words, you get coverage all across Alberta. The Panasonic EN-POWR pre-paid numeric pager is only $99.95, and it comes with 6 months of enhanced service with a limited but nifty selection of assorted colors to choose from. "But Clone, I have three kids to feed. I can't afford this type of service!" It's completely understandable. That is why I wrote this file. To show you how to get service that *should* be dirt cheap for absolutely free. Lets say that one day you were walking down the street minding your own business, picking flowers, waving to Telus employees as they drive past in their goodie-vans, when you trip over a pager that has the word 'Panasonic' labelled on the top. This semi-transparent device, with its groovy design is the only thing stopping you from suing Telus for leaving its property laying around. Then you remember that it's an EN-POWR pre-pad numeric pager and it has to be property of someone. "Hmm..." you think. At this point you can do one of two things; you can call Telus reporting a missing pager, or you can try to use your wits to find a way to exploit this. First lets take a look at the pager features: Pager features -------------- · saves 23 messages · message time stamp · built in alarm clock · silent vibration or audible alert · low battery alert · shows date and time of day · selective erase/erase all · locks important messages · uses only one AAA battery · FLEX technology gives you up to four months battery life · duplicate message indicator · reminder alert · backlit display · automatic on/off 'Saves 23 messages', thought of anything yet? ;) Sure you have my analytical friend. Along with numeric paging option, you also get a voice-mail paging option which requires you to dial the number the pager is subscribed to. So you think "How am I going to get this pager number?" ------------------------------------------ One easy way is to wait for someone to page you. Usually friends of the pager customer, don't know the pager is in the wrong hands so they unknowingly send them a voice-message. Bad idea. The minute they send that message, the data is sent to the Telus Mobility switch, and straight to the pager itself. What is displayed? The pager number, silly! (note: if a numeric page is sent, the numbers displayed on the screen are whatever the person who sent it typed.) The next step is easy, you call the number. The next thing you'll hear is one of two things; 1. the customers message, 2. Telus' default message. By simply pressing '0' on the keypad, you'll next be prompted by an automated voice saying: "Please enter your access code". "How do I acquire the access code?" -------------------------------- If the customer was stupid enough to set the default access code, all you do is look on the back of the EN-POWR numeric pager, and search for the "capcode". The capcode is the series of numbers at the bottom of the label, below the Model, Serial Number, Country Code, and ISC code. It's easily distinguishable by the letter E and a 7 digit code after it. An example of a capcode is 'E1230948'. The default access code is the last 4 digits of the capcode. 0948 would be the access code for this pager. Now enter 0948. If you're lucky you'll get the main menu. My suggestion to you is to change the access code as soon as possible. If you're not so lucky, try guessing defaults. 1234, 1111, 1999, 2000, etc. Until you come across the correct access code. If you're still having trouble, try selling the pager to some moronic 14 year old who just wants to look cool in front of his sleezy 14 year old girlfriends'. Final words ----------- Now that I've given you step by step instructions on how to exploit the EN-POWR pre-paid pager, I hope that you've learned a little bit about how it works. In the next few months I can see the news talking about hundreds/thousands of Telus pagers going missing and then used for the thieves' evil purposes. I'll sleep well at night knowing I was the one responsible. THE END written by: The Clone June 22, 1999 `Contact inf0 ---- E-mail: theclone@edmc.net URL: Nettwerked - http://nettwerk.hypermart.net Voice Mail: So-Soft Corporation - 1-800-494-9831; box 407 __#~~_$$_#_#:; CNA List NPA TEL NO NPA TEL NO -------------------------------------- 201 201-676-7070 601 601-961-8139 202 304-343-7016 602 303-293-8777 203 203-789-6815 603 617-787-5300 204 204-949-0900 604 604-432-2996 205 205-988-7000 605 402-580-2255 206 206-382-5124 606 502-583-2861 207 617-787-5300 607 518-471-8111 208 303-293-8777 608 608-252-6932 209 415-543-2861 609 201-676-7070 212 518-471-8111 612 402-580-2255 213 415-781-5271 613 416-443-0542 214 214-464-7400 614 614-464-0123 215 412-633-5600 615 615-373-5791 216 614-464-0123 616 313-223-8690 217 217-525-5800 617 617-787-5300 218 402-580-2255 618 217-525-5800 219 317-265-4834 619 818-501-7251 301 304-343-1401 701 402-580-2255 302 412-633-5600 702 415-543-2861 303 303-293-8777 703 304-344-7935 304 304-344-8041 704 912-784-0440 305 912-784-0440 705 416-979-3469 306 306-347-2878 706 *** NONE *** 307 303-293-8777 707 415-543-6374 308 402-580-2255 709 *** NONE *** 309 217-525-5800 712 402-580-2255 312 312-796-9600 713 713-861-7194 313 313-223-8690 714 818-501-7251 314 314-721-6626 715 608-252-6932 315 518-471-8111 716 518-471-8111 316 816-275-2782 717 412-633-5600 317 317-265-4834 718 518-471-8111 318 504-245-5330 801 303-293-8777 319 402-580-2255 802 617-787-5300 401 617-787-5300 803 912-784-0440 402 402-580-2255 804 304-344-7935 403 403-425-0052 805 415-543-2861 404 912-784-0440 806 512-828-2501 405 405-236-6121 807 416-443-0542 406 303-293-8777 808 212-334-4336 408 415-543-6374 809 212-334-4336 409 713-861-7194 812 317-265-4834 412 413-633-5600 813 813-228-7871 413 617-787-5300 814 412-633-5600 414 608-252-6932 815 217-525-5800 415 415-543-6374 816 816-275-2782 416 416-443-0542 817 214-464-7400 417 314-721-6626 818 415-781-5271 418 514-725-2491 819 514-725-2491 419 614-464-0123 901 615-373-5791 501 405-236-6121 902 902-421-4110 502 502-583-2861 904 912-784-0440 503 206-382-5124 906 313-223-8690 504 504-245-5330 907 *** NONE *** 505 303-293-8777 912 912-784-0440 506 506-648-3041 913 816-275-2782 506 506-648-3041 913 816-275-2782 507 402-580-2255 914 518-471-8111 509 206-382-5124 915 512-828-2501 512 512-828-2501 916 415-543-2861 513 614-464-0123 918 405-236-6121 514 514-725-2491 919 912-784-0440 515 402-580-2255 516 518-471-8111 517 313-223-8690 518 518-471-8111 519 416-443-0542 900 201-676-7070 ##_$_$_~~..# ;^.**;^.**;^.**;^.**;^.**;^.**$ TELUS; 811 Self-Serve stratagem ;^.**;^.**;^.**;^.**;^.**;^.**$ -- Note; This file was created mainly for revenge purposes. I imagine someone with a bit of creativity could think of numerous ideas. TELUS; 811 Self-Serve stratagem contains step by step instructions, suggestions, etc. on how to fuck with people's phonebills. -- Telus believes that *most* of its customers are able to manage their phone bills by themselves with the help of a friendly easy-to-use automated self-serve system. So a couple of years ago they implemented this. When news comes that my phone company is creating "newer and better things", I feel it's my job to exploit them. By calling 811 in the 780 area code, you will be connected to Telus' automated system. The voice prompt answers by saying: "Welcome to Telus communications. If you are calling for services within Edmonton city, please press one." Immediately after hearing this, go ahead and press one. The next prompt you hear will be a voice saying: "Thank you for calling Telus communications. Please take a moment to listen to the following choices before making your selection." I won't waste your time by typing up every single option available because options change and darnit that'd just be plain silly! Residential self-serve is the option you want to chose. Do that by pressing '4'. The next annoying prompt starts off with a beep and an automated voice saying: "Good morning/afternoon/evening and welcome to Telus communications." The first option available is self-serve. Press '1' to access it. What you'll be prompted for next is your residential telephone number including your area code. Okay, so we enter '7-8-0 444-4444'. It takes a moment to process the request, but eventually you get another prompt. Don't bother even listening to the options. Press '1' immediately. Run out of patience yet? Good, press '1' again. What the voice asks for next is your 'personal identification number' formerly known as the 'express-line access number'. Telus is stupid. Your personal identification number is actually a series of numbers. On your Telus phonebill you have an account number (usually 13 digits long) at the top of your bill. Take a look at the last four digits. Those numbers are what makes up your personal identification number or PIN. By entering the PIN number, you now have the options of adding/removing calling features as well as disconnecting your telephone service. I hope I wasn't too vague with my option descriptions. But anyone with half a brain can figure out how to follow voice instructions. You're probably thinking: "Wow Clone, this is great. I just spent five minutes reading pointless blabber!" Don't think too soon! I took it a step further. I thought: "Imagine if I could get a hold of an enemy of mine's phonebill. What could I do to really piss them off?" I could easily do the same things previously mentioned; add/remove calling features, and/or disconnect telephone service. Sound too good to be true? Of course it doesn't. Acquiring a phonebill -- How easy is it? It all depends on where you look of course. It's my assumption that you probably won't be going over to your enemies house. Let alone be left unattended with a phonebill laying around for you to steal. There is one other possibility that comes to mind... trashing! The beautiful art of trashing. As hackers we do it. As phreakers we do it. But why do we do it? To find neat stuff of course! In this case we're only looking for phonebill(s). If your enemy lives in a house, go through his garbage can. If your enemy is the phone company, go through their trash bins. Simple as that. Hope you have fun and get arrested. Written by: The Clone Date: Wednesday, June 30, 1999 Contact info -- URL: Nettwerked - http://nettwerk.hypermart.net E-mail: theclone@edmc.net Voice Mail: So-Soft Corp; 1-800-494-9831, BOX 407 Shouts -- #canada on darkchylde.hackcanada.com, Edmonton 2600 krew, and the Hack Canada (www.hackcanada.com) krew ~EOF~ ;;>.... [SECTION II: www.edmc.net/~theclone/2k1ine/3.txt]