Mobile Fraud


DEDICATION
~~~~~~~~~~
  I would like to dedicate this to the memory of Scantronics, which as the
logon said, was definantly 'The last of a dying breed'.  In early May /<ludge
got a visit from authorities who took all his gear, except his printer (oh,
how thoughtful).  You see, our enemies have finally realized one of the weaker
links in the H/P society... The distribution of information.  By hitting all of
the worthwhile boards, they can make it harder and harder to learn and swap
ideas.  Well, there isn't too much we can do about it, except start talking
with people one-on-one, and get a 'verbal network' going.  This is pretty much
all we can do.  Our Enemy is taking steps towards eradication of our chosen
hobby, and we must take steps to prevent it's distruction.  Well, enough with
the lecture, on with the file, and keep good thoughts for /<ludge...


INTRODUCTION
~~~~~~~~~~~~
  Ah yes, here I am again, writing like there's no tommorow, but even if there
was, who the hell would want it?  Anyways... I've been just doing my own thing
for the past couple months, let tax time go by, and decided I needed to give
some more of my helpful insight to the world.  Ok, this file is about the
closest thing to a hacking file as you'll probably see me write (especially
since hacking isn't my forte and I know many people out there who are better
at it than me (See Digital Hitler, I admitted that you're better, and in public
no less!)).  Ah well, this covers those wonderful UHF Mobile telephones that
are out and about... Not Cellular mind you, but UHF Mobile.  I will go into
detail on the Zetron series of Repeater Computers, which seem to be the most
common.


ME, YOU, AND THE REPEATER
~~~~~~~~~~~~~~~~~~~~~~~~~
  What you will be accessing is the repeaters in your local area.  Most large
cities have at very least 5, and some have upwards of 15.  Now each repeater
usually is accessable throughout the city, although they get better reception
in certain areas.  Soo, once you estabish the region that works best for you,
that will be the target repeater.  Now, when you dial the repeater, you will
get another tone, much like a PBX, where you are supposed to enter the extension
of the mobile phone you wish to reach.  Remember that each repeater is
independant, so you will need to program yourself on all the ones you wish to
use.  Also, choose one as your base channel, usually the one that is in the
region you will be around the most, and program this one for ringing capab-
ilities.  One of the real benifits of this is you can set up multiple extentions
on each repeater, and have tons of phone numbers and extensions.
  You can also access the voice paging feature, and capture a voice mail box.
This is accomplished by simply assigning yourself a 5-tone pager id, and then
finding the phone number of the VMB that corresponds to it.  This is especially
nice when you don't necessarily want people to realize where you are, or when
you want to call screen losers.


HACKING THE ZETRON
~~~~~~~~~~~~~~~~~~
  Here's the big joke of this... The 'hacking' process.  The admin extension
is usually 7 digits, and usually starts with 000.  Now that's still quite a
few possibilities, right?  Nope, the shitty designers of this system made it
so when you enter a incorrect number it gives you that wrong tone.  So say
the password is 0004311, when you call up, you enter 0, no tone?  Enter 0 again.
Still no tone?  Enter 0 a third time.  No tone again.  Now enter 0 a fourth
time.  Ding-dong... Wrong tone.  Now just repeat the first three, and try 1
for the fourth, and so on.  Basic.  And once you're in, there are no other
passwords... Boy these people sure are security concious.


THE SUPREME MENU
~~~~~~~~~~~~~~~~
  Here's a 'flow-chart' of the menu structure for most Zetron-series repeaters.
I include the main and sub-menus, and also all the possible selections for each
command.  Now remember, the system is hot-key, and you can type '!' anywhere
in it to get back to the main menu.  It's formatted a little past 80 columns
since it is more useful printed and I wanted it even-looking.  Here we go...

    [S]YSTEM --+--- [C]OR -------+-------0P. Polarity active high               Yes/No
               |                 +-------0H. Hold time (*100ms)                 0-50
               |                 +-------0Q. Quiet time (*100ms)                0-100
               |                 +-------0M. Mob Tx-to-Rx time (*100ms)         0-20
               |                 +-------0A. Mob act time (*sec)                15-255
               |                 +-------0V. COR validation active high         Yes/No
               |                 +-------0B. Channel busy active high           Yes/No
               |
               +--- [A]CCESS ------+----- S. Sign-on mode                       0-2
               |                   +----- D. DTMF timeout (*100ms)              30-250
               |                   +----- R. Min. regenerated digits            1-15
               |                   +----- U. Phone-to-mobile use ANI            Yes/No
               |                   +----- M. Mobile-to-mobile use ANI           Yes/No
               |                   +----- P. #+ANI disconnect                   Yes/No
               |                   +----- C. Dial click decode mode             0-3
               |
               +--- [H] DISPATCH ---+---- H. Repeater Hold Time (*100ms)        0-250
               |                    +----0S. CTCSS Hold Time (*100ms)           1-30
               |                    +----0T. Timeout (*min)                     1-10
               |                    +----0I. Hog Idle Time (*sec)               1-25
               |                    +----0L. Hog Limit Time (*min)              1-99
               |                    +----0P. Hog Penalty Time (*10sec)          1-250
               |                    +----0R. Dispatch ID Rate (*min)            1-99
               |                    +----0D. CTCSS for dispatch                 Yes/No
               |                    +----0O. Courtesy tone                      Yes/No
               |                    +----0M. Stuck Mic ID                       Yes/No
               |
               +--- [P]AGING ----+-------0D. Keyup delay (*25ms)                0-200
               |                 +-------0T. Talk time (*sec)                   5-25
               |                 +-------0V. Vox hold time (*100ms)             0-50
               |
               +--- STATION [I]D ----+---0M. Mode                               0-3
               |                     +---0I. Interval (*min)                    1-99
               |                     +---0S. Call sign (chrs)                   CCCC###
               |
               +--- AUTO[D]IALS ---+-----01.  (chrs)                            0-16 chars
               |                   +-----02.  (chrs)                            0-16 chars
               |                   +-----03.  (chrs)                            0-16 chars
               |                   +-----04.  (chrs)                            0-16 chars
               |                   +-----05.  (chrs)                            0-16 chars
               |                   +-----06.  (chrs)                            0-16 chars
               |                   +-----07.  (chrs)                            0-16 chars
               |                   +-----08.  (chrs)                            0-16 chars
               |                   +-----09.  (chrs)                            0-16 chars
               |
               +--- [V] TOLL RESTRICT -+-01. Max toll digits 1                  1-30
               |                       +-02. 1st digit restrict 1 (chrs)        0-4 chars
               |                       +-03. 2nd digit restrict 1 (chrs)        0-4 chars
               |                       +-04. Max toll digits 2                  1-30
               |                       +-05. 1st digit restrict 2 (chrs)        0-4 chars
               |                       +-06. 2nd digit restrict 2 (chrs)        0-4 chars
               |
               +--- [T]ELCO CONTROL --+--01. Call limit timer-1 (*min)          1-60
               |                      +--02. Call limit timer-2 (*min)          1-60
               |                      +--03. Channel ringouts-1                 1-25
               |                      +--04. Channel ringouts-2                 1-25
               |                      +--0O. Delay before dialout (*100ms)      5-100
               |                      +--0D. Disconnect on 2nd dialtone         Yes/No
               |                      +--0M. Dialout mode                       0-3
               |                      +--0V. Override dispatch                  Yes/No
               |
               +--- LINE [1] SETTING --+-0A. Rings until answer                 1-20
               |                       +-0D. Channel busy rings                 1-25
               |                       +-0M. Answer mode                        0-2
               |                       +-0U. Auto call user                     0-99
               |
               +--- LINE [2] SETTING --+-0A. Rings until answer                 1-20
               |                       +-0D. Channel busy rings                 1-25
               |                       +-0M. Answer mode                        0-2
               |                       +-0U. Auto call user                     0-99
               |                       +-0P. Priority override                  Yes/No
               |
               +--- [L]OCAL PHONE ---+---0D. Channel busy rings                 1-25
               |                     +---0M. Answer mode                        0-1
               |                     +---0U. Auto call user                     0-99
               |
               +--- [M]ISCELLANEOUS --+--0D. Courtesy tone duration (*25ms)     1-10
                                      +--0F. Courtesy tone frequency (*10Hz)    35-100
                                      +--0A. Automatic gain (AGC) on            Yes/No
                                      +--0H. High pass filter on                Yes/No
                                      +--0S. CTCSS add-in                       Yes/No
                                      +--0R. ANI for system relays (chrs)       1-8 chars
                                      +--01. User relay 1 mode                  0-4
                                      +--02. User relay 2 mode                  0-4
                                      +--0B. Run modem at 300 baud              Yes/No

    [U]SERS ---+---0[A]CCESS -------+----0U. User range                         1-325
               |                    +----0E. User enabled                       Yes/No
               |                    +----0M. Mobile-to-phone                    Yes/No
               |                    +----0P. Phone-to-mobile                    Yes/No
               |                    +----0B. Mobile-to-mobile                   Yes/No
               |                    +----0H. Dispatch                           Yes/No
               |                    +----0C. COR to answer                      Yes/No
               |                    +----0S. * to answer                        Yes/No
               |                    +----0D. # to disconnect                    Yes/No
               |                    +----0F. Fast ANI required                  Yes/No
               |                    +----0L. Line select                        Yes/No
               |                    +----02. Line 2 default                     Yes/No
               |                    +----0A. Autodial mode                      0-15
               |
               +--- [O]PERATION -----+---0U. User range                         1-325
               |                     +---0E. User enabled                       Yes/No
               |                     +---0Q. Equipment type                     0-4
               |                     +---0N. Number of ringouts mode            1-2
               |                     +---0S. Ringout style                      0-7
               |                     +---0O. Courtesy tone                      Yes/No
               |                     +---0X. Full-duplex mobile                 Yes/No
               |                     +---0P. Privacy                            Yes/No
               |                     +---0M. Call timer mode                    0-2
               |                     +---0T. Toll mode                          0-2
               |                     +---0D. DTMF thru                          Yes/No
               |                     +---0F. Page format                        0-5
               |                     +---0C. Tone/code drop mode                0-2
               |                     +---01. Enable relay 1                     Yes/No
               |                     +---02. Enable relay 2                     Yes/No
               |
    00         +--- [S]PECIFIC ----+-----0U. Current user                       1-325
               |                   +-----0E. User enabled                       Yes/No
               |                   +-----0A. ANI code (chrs)                    0-8 chars
               |                   +-----0F. Page format                        0-5
               |                   +-----0P. Page code (chrs)                   (Above #)
               |                   +-----0X. Tx tone/code                       0-38
               |                   +-----0R. Rx tone/code                       0-38
               |
               +--- [T]ONE DISPATCH -+--- U. Current user                       1-325
               |                     +---0E. Enabled                            Yes/No
               |                     +---0R. Reserved                           Yes/No
               |                     +---0X. Tx tone/code                       0-38
               |                     +---0T. Tone in tail                       Yes/No
               |                     +---0V. Privacy                            Yes/No
               |                     +---0O. Courtesy tone                      Yes/No
               |                     +---0H. Hog Mode                           Yes/No
               |                     +---0M. Morse ID (chrs)
               |
    00         +--- [L]IST ------+-------0U. User range                         1-325
                                 +-------0A. List ANI users                     Yes/No
                                 +-------0T. List tone dispatch users           Yes/No


    SUPER[V]ISOR +- A. Program mode ANI (chrs)                                  1-7 chars
00               +- N. Supervisor user number                                   0-99
00               +- S. Reset system programming                                 Yes/No
    00           +- D. Reset dispatch programming                               Yes/No
00               +- U. Reset ANI user programming                               Yes/No
00               +- M. Logon message                                            0-34 chars
    00           +- L. List system programming                                  Yes/No

    [A]CCOUNTING +-0M. Minimum call time (*sec)                                 0-180
00               +- U. User range                                               1-325
00               +- 2. List ANI accumulated                                     Yes/No
    00           +- 1. Clear ANI accumulated                                    Yes/No
00               +- 4. List tone dispatch accumulated                           Yes/No
00               +- 3. Clear tone dispatch accumulated                          Yes/No

    [T]EST ----+---0A. Tone 1 frequency (*10Hz)                                 35-100
00             +--- B. Tone 2 frequency (*10Hz)                                 35-100
00             +--- 1. Single tone (=Telco:1,Tx:2)                              0-2
    00         +--- 2. Dual tone (=Telco:1,Tx:2)                                0-2
00             +--- 3. CTCSS tone (=Tone)                                       0-38
00             +--- 4. Emphasis (=Off,On)                                       Yes/No
    00         +--- H. Hybrid adjust (=Off,On)                                  Yes/No
00             +--- D. DTMF/Click detect (=Telco:1,Rx:2)                        0-2
00             +--- C. COR detect                                               Yes/No
00             +--- K. Click calibrate                                          Yes/No
    00         +--- S. Sense line states                                        Yes/No
00             +--- T. CTCSS Decode                                             Yes/No
    00         +--- M. Memory                                                   Yes/No

[O]PTIONS --------- Lists the Tone and Normal Users

[E]XIT ------------ Hangs up the modem


PROGRAMMING THE SYSTEM
~~~~~~~~~~~~~~~~~~~~~~
  Ok, Here's a default settings buffer for the system, and I will explain what
each thing means in the next section, so read and absorbe...


        SYSTEM PROGRAMMING FOR phone # (repeater name) AS OF date

COR MENU
P. Polarity active high = Yes
H. Hold time (*100ms) = 1
Q. Quiet time (*100ms) = 50
M. Mob Tx-to-Rx time (*100ms) = 2
A. Mob act time (*sec) = 32
V. COR validation active high = Yes
B. Channel busy active high = No

ACCESS MENU
S. Sign-on mode = 0
D. DTMF timeout (*100ms) = 50
R. Min. regenerated digits = 7
U. Phone-to-mobile use ANI = Yes
M. Mobile-to-mobile use ANI = Yes
P. #+ANI disconnect = Yes
C. Dial click decode mode = 0

DISPATCH MENU
H. Repeater Hold Time (*100ms) = 30
S. CTCSS Hold Time (*100ms) = 8
T. Timeout (*min) = 3
I. Hog Idle Time (*sec) = 5
L. Hog Limit Time (*min) = 5
P. Hog Penalty Time (*10sec) = 30
R. Dispatch ID Rate (*min) = 15
D. CTCSS for dispatch = Yes
O. Courtesy tone = No
M. Stuck Mic ID = Yes

PAGING MENU
D. Keyup delay (*25ms) = 40
T. Talk time (*sec) = 10
V. Vox hold time (*100ms) = 1

STATION ID MENU
M. Mode = 2
I. Interval (*min) = 15
S. Call sign (chrs) = xxxxxxx

AUTODIALS MENU
1.  (chrs) = 
2.  (chrs) = 
3.  (chrs) = 
4.  (chrs) = 
5.  (chrs) = 
6.  (chrs) = 
7.  (chrs) = 
8.  (chrs) = 
9.  (chrs) = 

TOLL RESTRICT MENU
1. Max toll digits 1 = 15
2. 1st digit restrict 1 (chrs) = 1111
3. 2nd digit restrict 1 (chrs) = 0000
4. Max toll digits 2 = 7
5. 1st digit restrict 2 (chrs) = 00
6. 2nd digit restrict 2 (chrs) = 00

TELCO CONTROL MENU
1. Call limit timer-1 (*min) = 3
2. Call limit timer-2 (*min) = 3
3. Channel ringouts-1 = 4
4. Channel ringouts-2 = 4
O. Delay before dialout (*100ms) = 20
D. Disconnect on 2nd dialtone = Yes
M. Dialout mode = 1
V. Override dispatch = No

LINE 1 MENU
A. Rings until answer = 2
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 0

LINE 2 MENU
A. Rings until answer = 2
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 1
P. Priority override = No

LOCAL PHONE MENU
D. Channel busy rings = 6
M. Answer mode = 1
U. Auto call user = 0

MISCELLANEOUS MENU
D. Courtesy tone duration (*25ms) = 3
F. Courtesy tone frequency (*10Hz) = 54
A. Automatic gain (AGC) on = No
H. High pass filter on = Yes
S. CTCSS add-in = No
R. ANI for system relays (chrs) = *1
1. User relay 1 mode = 0
2. User relay 2 mode = 0
B. Run modem at 300 baud = Yes

** End of list **


IMPORTANT COMMANDS TO KNOW
~~~~~~~~~~~~~~~~~~~~~~~~~~

  Ok, Now I'll discuss some of the more necessary commands, and what they do.
Most of the others are pretty easy to figure out, or are not necessary.  The
only really useful area is in the TOLL RESTRICT, TELCO CONTROL, and menus.
  The system is usually split into two different systems, although on MOST they
only use one of them.  So, what you want to do is configure the [2] settings
for you, and leave the [1] settings untouched (so they are not aware of the
usage.
  You will want to change the following in the TOLL RESTRICT menu:

                4. Max toll digits 2 = 20               (Amount of numbers)
                5. 1st digit restrict 2 (chrs) =        (Non-allowed first digit)
                6. 2nd digit restrict 2 (chrs) =        (Non-allowed second digit)

    This will allow you to call oversears or special numbers with no hassle.
    Next in the TELCO CONTROL menu:

                2. Call limit timer-2 (*min) = 99       (The Maximum call time)
                4. Channel ringouts-2 = 9               (Number of rings before
                                                         giving up)

    This will configure your phone to allow 99 minutes per call, and let you
    ring someone nine times.
  Make sure not to edit anything within the STATION ID menu, since this will
bring the FCC down on the operators head, and we don't want the repeater to
get shut down.
  Also, if you were wondering what they do if they find out that you're in the
system, well, that's easy.  They disable the phone modem and enable the packet
one, so only people with HAM setups are able to call up and alter information.
This is a little extreme, but most of the time it will happen if you're billing
an enormous amount of calls to it, or taking up a massive amount of airtime
(and neglecting to cover it up).


VIEWING USER INFORMATION
~~~~~~~~~~~~~~~~~~~~~~~~
  This is one of the nicer and more useful functions of the system, this way
you can get a complete listing of all the repeater users, and what services
they have available.
  Here's a list of the most common (and most important abbreviations used in
the user list...

    A = Privacy           B = User enabled        C = * to Answer
    D = # to disconnect   E = DTMF thru           F = Number of ringouts mode
    K = Call timer mode   P = Mobile-to-phone     Q = Phone-to-mobile
            R = Mobile-to-Mobile        U = Toll mode

  PRIVACY means whenever you speak, the repeater will transmit a beeping sound,
so anyone listening will only be able to hear the person you call.  USER ENABLED
is self explanitory, * TO ANSWER means you will only need to dial '*' to answer
calls, instead of '*' plus your ANI.  # to disconnect is the same an answer, but
to cancel a call.  DTMF thru means the repeater will allow DTMF tones to be
transmitted.  NUMBER OF RINGOUTS MODE is which phone callout mode you have (set
this to [2], your custom callout setting).  P,Q,and R all pretty much are the
same, allowing users to call from on to the other.  TOLL MODE is another you
set to [2], altering from the default toll settings.
  Ok, and now here's what the user printout looks like.  USR is the actual user
number, the letters A-X correspond to the above list, ANI is the extension
number, RX is the recieve tone, TX is the transmit tone, TYPE is the type of
paging service, and PAGE is their 5 tone sub-audible...

Model xx (xxxxxxx)
Usr       Programming          ANI     Rx   Tx   Type   Page
--- ABCDEFGHIJKLMNOPQRSTUVWX -------- ---- ---- ------ --------
  1 nYYnY100nn1nnnnYYYnn200n D           0    0 *None* 
  2 nYYnY100nn1nnnnYYYnn200n 1000        2    2 *None*
  3 nYYnY100nn1nnnnYYYnn200n D           3    3 *None* 
  4 YYYnY100nn1nnnnYYYnn200n 1001        4    4 *None*
  5 nYnnY100nn1nnnnYYYnn200n 1002        5    5 *None*
  6 nYYYY100nn1nnnnYYYnn200n 1003        6    6 *None*
  7 nnYnY100nn1nnnnYYYnn200n D           7    7 *None* 
  8 nYYnY200nn1nnnnYYYnn200n 1004        8    8 *None*
  9 nYYYY100nn1nnnnYYYnn200n 1005        9    9 *None*
 10 nYYYY100nn1nnnnYYYnn200n 1006       10   10 *None*
 11 nnYYY100nn1nnnnYYYnn200n D           0    0 *None* 
 12 nYYYY100nn1nnnnYYYnn200n 1007       12   12 *None*
 13 YYYnY100nn1nnnnYYYnn200n 1008       13   13 *None*
 14 nnYYY100nn1nnnnYYYnn200n D          14   14 *None* 
 15 nnYYY100nn1nnnnYYYnn200n D           0    0 *None* 
 16 nYYYY100nn1nnnnYYYnn200n 1009       16    0 2 Tone 12345
 17 nnYYY100nn1nnnnYYYnn200n D          17   17 *None* 
 18 nnYYY100nn1nnnnYYYnn200n D          18    0 *None* 
 19 nYYYY100nn1nnnnYYYnn200n 1010       19   19 *None*
 20 nYYYY100nn1nnnnYYYnn200n D          20   20 *None* 
 21 nnYYY100nn1nnnnYYYnn200n D           0    0 *None*

** End of list **

  The ANI is what people calling you need to dial (i.e. your extension), and
the number you need to dial in order to make calls out.  The best way to use
this is to just piggy-back someones existing account.  They definantly won't
complain when they get all the wonderful features, and then that also leaves
a very obvious (and innocent) scapegoat... My favorite kind.
  The tone userlist is a little different than the mobile users...  This is
mainly for pagers that happen to be using the same repeater, although that is
highly uncommon.  Here it is...

        TONE DISPATCH LIST FOR xxx-xxxx (xxxxxxxxx)

Model xx (xxxxxxx)
Usr   Programming   Out Tone     ID
------ ABCDEFG -------------------------
  1    nnnnnnn          1       
  2    nnnnnnn          2       
  3    nnnnnnn          3       
  4    nnnnnnn          4       
  5    nnnnnnn          5       
  6    nnnnnnn          6       
  7    nnnnnnn          7       
  8    nnnnnnn          8       
  9    nnnnnnn          9       
 10    nnnnnnn         10       
 11    nnnnnnn         11       
 12    nnnnnnn         12       
 13    nnnnnnn         13       
 14    nnnnnnn         14       
 15    nnnnnnn         15       
 16    nnnnnnn         16       
 17    nnnnnnn         17       
 18    nnnnnnn         18       
 19    nnnnnnn         19       
 20    nnnnnnn         20       
 21    nnnnnnn         21

** End of list **

  There has never been any configured on any of the systems I've been on, so
I can't really tell you too much about the configuration information, although
that would lead me to believe that the feature isn't very exciting.


THE CALLER LOG... THE ENEMY
~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Unfortunantly, as with everything in life, there's always a snag... The
caller log, although in this case it just takes a little extra effort to trick
the ever present enemy.  Every space means there were some accounts inbetween
the used accounts that are deactivated.  Here's what the log looks like...

        CALLER LOG FOR xxx-xxxx (xxxxxxxxx)

User   6      01:22:30       87 Access(es)

User  12      00:37:02       48 Access(es)
User  13      00:27:01       40 Access(es)

User  16      00:23:56       49 Access(es)

User  19      00:28:26       33 Access(es)

User  21      00:11:18       14 Access(es)

** End of list **

  On the surface this may appear to be fairly useless, but there is something
to be feared here.  Many of the companies take it upon themselves to total the
time used, and then divide by the number of accesses.  Now what this tells them
is the average call length... And if you're making 45 minute calls, this is
going to boost the call time just a LITTLE past 3 minutes, then all they do is
the same thing on a user by user basis and wala, they know whose account you're
on.
  It only takes a little bit of extra effort to cancel this out though.  Just
place a shitload of small calls, like 10 secs, and one of those for every 2 or
3 minutes you've used on your long call.  This safely masks your using of the
system, as long as you aren't calling Alliance or making LD calls.
  It is true that you can zero this list in the accounting menu, and that's
another way you can get around it, although this alerts them as to there is
either someone else on the system (and they're trying to hid something), or that
there is some sort of problem with the system, and they either try to fix what
is not wrong, or give up and write off the problem (and this is what you hope).
  For those who wish to have all the reference, here's the Tone Dispatch Log...

        TONE DISPATCH LOG FOR xxx-xxxx (xxxxxxxxxxxxx)

User   1      00:07:53
User   2      00:13:53
User   3      00:23:14
User   4      00:01:23
User   5      00:13:09
User   6      00:02:04
User   7      00:05:14
User   8      00:01:00

User  10      00:03:43
User  11      00:00:02
User  12      00:42:40
User  13      00:02:07

User  15      00:00:03
User  16      00:15:46
User  17      00:01:22
User  18      00:14:22
User  19      00:01:34
User  20      00:01:55
User  21      00:00:33

** End of list **


FREQUENCIES
~~~~~~~~~~~
  Here's the technical description of the frequencies they use:

                405-425, 440-460, 450-470 (in 12.5kHz steps)

  Now since this even though this isn't dual-synchronis, is does use two
freqencies per channel.  Now, is the first frequency was 405.000kHz, the sister
frequency would be 405.900kHz.  Pretty basic, eh?  The second frequency (your
transmit one) is always 0.900 kHz above the recieve.  Usually you can call up
your local mobile phone company and find out their repeater frequencies... Hell,
several have faxed me complete listings and their effective range, I sure do
love companies with great customer service!
  The tones which are used by the repeaters (both audible and subaudible) are
FCC regulated, so they are a standard... Meaning the repeaters tone 13 will
be the same as the Yaesu's tone 13.  For more information on the tones, simply
go to your local library and see what the government has regulated for your
area.


CAN YOU SAY... YAESU?
~~~~~~~~~~~~~~~~~~~~~
  Now there are many different manufactures of UHF phones out there, but the
one I would recommend over Motorola and Maxon would be Yaesu.  They started
out as a pro equiptment dealer only, selling some of the best HAM radio gear
around, then about 2 years ago they entered into the commercial market.  Now
they heave several handheld units available, but I would recommend above all
the others the FTH-7008.  It sells for around $500 (but who's paying? (Refer to
Carding, My Way series)), and has a Priority Channel, Scan, Hi/Lo Power settings,
Auto-Squelch, and 15 channels (not crystals, but synthesis).  Now, you will also
need the FTT-4DT (make SURE it's the 4DT not just the 4, because otherwise it
won't work).  Now the FTT-4DT is a DTMF pad which goes on the unit between the
battery and the body, you can easily do the instilation yourself, and the unit
runs around $280.
  Now what this gives you above and beyond the keypad is a squelch which will
only turn off when it recieves a certain 2-tone combination or a 5-tone sub-
audible.  These are used to make the unit either ring for an incoming call, or
to respond when a page comes through.
  Now here's the beauty of Yaesu.  Your dealer can AND WILL sell you the
software and hardware necessary to program it yourself.  It runs around $80
and is for the IBM XT or better.  This drives the FCC CRAZY and gives you TOTAL
power... Now all you need to do is hack into the repeater and wala... Phone
service.


USES AND ABUSES
~~~~~~~~~~~~~~~
  Now here's the payoff... Not only can you make calls out, long distance or
otherwise, and not have to worry about being billed or located, but you can
recieve calls in an almost totally secure way.  Now you must keep in mind that
this is only half duplex, so the modem is out of the picture, but for voice
communication, from anywhere in you city and most likely ajacent cities, this
is the best thing since sliced bread!  Now you can assign yourself as many
different extensions as you want, and I would recommmend changing them fairly
frequently.  Also try to be away from home and/or on the move when calling,
since this will reduce the chances of being located if they should somehow
become suspicious.  About the only way they will is if you do bill long distance
numbers to the Repeater, or if you dominate the airtime on it.
  Once a month the owner of the repeater goes out on sight and gets a usage
log.  Usually calls are limited to 3 minutes, so the average call is 2 minutes.
Now, if you're dominating the system, the average call is going to be quite
alot more than 3 mins, and he's going to know something strange is going on.
Of course, all he can do is change the password, and we all know how 'secure'
that is... hehe.
  Now there are also companies (real bastard ones, who deserve to be fucked)
that run mobile like it was cellular, and charge minutely.  Now these guys are
EASY to fuck with, since you can create yourself an account, take it off the
minutely billing cycle, and just don't make LD calls, only recieve calls... Wala
now you have a RADICAL phone, which will most likely never be discovered (mine
hasn't been for close to 4 months, and boy is it nice!).
  Now one note on this... Usually it isn't the cops who deal with this, it's
the FCC, and believe it or not, they actually do get the job done fairly well.
But this by no means says it's dangerous... On the offical Vindicator Danger
scale this only rates a 3... And even lower if you're cautious.

