*SWAT MAGAZINE ISSUE NINE: SEPTEMBER 1998* ********************************************************************** | .Meridain mail systems. | | By -=The Firestarter & =The-Doh-Boy= | ----------------------------------------------------------------------- This article will consist of what -=The Firestarter=- and =The-Doh-Boy= have both learned from being in Darkcyde communications. First off here is an extract from a phile I downloaded from the Darkcyde web site: MERIDIAN MAIL Copyright (c) Northern Telecom, 1993 Introduction To The Meridian Mail Voice Mail System INTRODUCTION This is an extract from an original document by coldfire. If you want the original text it should be still in the PHiLA archives. USING YOUR MAILBOX When you login to your mailbox there are several greetings you may hear: "your mail box is empty, to compose a message press 75, for mailbox commands press 8*" "You have X new messages, message X from " "You have no new messages, message one from " 0 - Zero on its own will transfer you to the operator assistance number. 011 will let you look up names in the directory. 0XXXX will dial that number, assuming its passes the call blocking mask. 1 - Rewinds the current message about 10 seconds 2 - Play message 3 - Fast Forwards the current message by 10 seconds 4 - Previous Message 5 - Record, used when composing or forwarding a message. 6 - Next Message 7 - Message Commands(Sub Menu) 0 - Message Options (Sub Menu, can only be used on outgoing messages) 1 - Urgent, tag a message for urgent delivery. 2 - Standard, tag a message for standard delivery. 3 - Economy, tag a message for economy deliver. 4 - Private, tag a message private (private messages cannot be forwarded to other users) 5 - Acknowledgement, tag a message for acknowledgement, you'll be send an acknowledgement message when the message is received. 6 - Timed Delivers, specify a time and date for delivery. 1 - Reply, sends a message to the sender of the message. Can only be used on incoming messages from mailboxes on the same system. 2 - Play envelope - Gives all the details of the messages, such as who its from, time, if it was urgent, attached messages etc., etc. 3 - Forward, forward the message to another user. 4 - Reply All, record a message to all the senders of the messages in your mailbox. 5 - Compose, compose a message to other users, either just one, a distribution list, or several boxes. 6 - Delete, deletes message, or if used on an deleted message restores it. 9 - Sends a message you've just recorded. 8 - Mail Box Commands (Sub Menu) 0 - Mailbox Options (Sub Menu) (Not always available on earlier versions of the software) 1 - Change Operator Assistance Number 1 - Login, enters the login process. 2 - Greeting (Sub Menu) 1 - External, record a greeting to be played to external callers. 2 - Internal, record a greeting to be played to internal callers. 3 - Log-off 4 - Password Change, change your password, enter your new password twice and your old password. 5 - Distribution Lists, create distribution lists. 6 - Goto, goto a message number in your mailbox. 9 - Personal Verification, record a personal verification which will be played instead of your mail box number to message recipients. 9 - Call Sender, when used on an incoming message will dial the extension of the sender, if the number is known. And here's =The-Doh-Boys= contribution. Meridian Mail is one of the better voicemail systems you are likely to find. I say this from a phreakers point of view. There are so many features to abuse on this system, such as Call Sender, where you can dial up the person who left you a message. This can be abused by getting mates to call up and leave messages from outside the box, then ringing them back through the mailbox courtesy of the owners. This is particularly handy when outdials are disabled. Changing the operator a ssistance number is also another feature which can be used to make free calls through your mailbox. Before you can use these though, your going to have to hack a mailbox!! So I thought I would share my limited knowledge on the subject and the methods which I find work well. I will go through the different kind of set ups which you are likely to find Meridian Mailbox systems on: Call Routing. ------------- This is one of the more advanced features of Meridian, but can also be found on Octel/Aspen systems, as for Nynex and the like I don't really have much experience with these so I couldn't tell you. Basically when you dial up these numbers you get a number of options i.e.: "Hello this is the voice mail for XXXXXX, please press 1 to login, 2 if you know the extension of the person you wish to reach, and press 0 for operator assistance." Most of these systems are very easy to hack, and this kind of system was the first one I ever hacked so it must be easy! First of all press the option to dial someones extension and plug numbers away randomly. If you get someones outgoing message then forget it. Wait until you get the woman saying: "Mailbox 1234, please leave a message at the beep." This is an empty box and normally the passcode is exactly the box number. So to login you dial back up and press the option to login. You know the box number and passcode and now you have a mailbox!! DDI Lines --------- These are the next in the scale of hacking potential, they are slightly harder to hack but it can be done. Usually these sound very much like an ansafone i.e.: "Hi these is Eric Sean and I can't come to the fone now coz' I have important business to attend to so please leave a message at the beep." When the beep sounds press the # key and she will say "recording s topped" now press 0 and then any old garbage and she'll say "BEEEP That number cannot be reached from this service" Then you can treat the box as though it were Call Routing. When you find an empty box dial back up and go through the above process but press 81 after the stopped recording bit. Login Boxes ----------- I used to think these were impossible to hack as quickly as the others, which is a pity because most companies with U.K. outdials have their boxes set up like this to stop the casual hacker getting free calls on their behalf. These sound like: "Meridian Mail, Mailbox?" As you can imagine there aren't any fast ways of finding empty boxes this way, except going through every box until you find one with the passcode the same as the box number. This could take months to go through all of them and this would certainly deter all but the most determined of us. Well it turns out that if you know someones box number (or use foneword in Bluebeep in the files library and type common names into it you could guess one) you can lock it out by entering the wrong passcode nine times in a row or less. Then when the legitimate user dials up and finds he can't get in he'll take it up with the sysadmin, who will reset the box to the default passcode (the box number). If you login before the user and change the passcode then you have his box. This is handy when using outdials because they wont hear any messages which may incriminate you. Call from a payfone because Meridian usually has CLI and can get your number, alternately dial 141 before you dial up and that stops it. This method can also be used against canny sysadmins who change the default passcode on the other setups. Call Answering -------------- Don't even bother yourself with this. This is just an ansafone and has no boxes on it. You could of course abuse it by changing the OGM to accept third party billing and get free calls that way. Thats about it for this one. Well that should give you enough info to gain unfettered access to almost all mailbox systems using Meridian. You may want to send me your thoughts on this or anything else by E-mailing me at Babel86@hotmail.com I really would like some reader feedback on my articles, so that I can concentrate on writing about what you want to know rather than what I want to tell you!!!