dbell@cup.portal.com (David J Bell) (08/05/90)
OK: here's one to research. My son told us of a friend at work, whose father had picked up from am aquaintance at a major aerospace/electronics company, a replacment chip for some model of cellular phone. This replacement chip (possibly a ROM or pROM) supposedly allows unlimited free calling. Now, I can see a probable difficulty in *receiving* calls on the modified phone, as the unit ID may be what gets modified/trashed, but it would seem at least possible that unlimited *outgoing* calls could go through without being billed. For example, the ROM could ID the unit as a service rig, and billing would be to the carrier's overhead... Any thoughs as to the likelihood of this being true? Where I could get such a beast (for educational purposes, only, of course!!)? Dave dbell@cup.portal.com {I am in no way affiliated with any cellular carrier, ICC, FCC, etc, etc}
brian@ucsd.Edu (Brian Kantor) (08/06/90)
The Electronic Serial Number of most cellular phones is contained in a read-only memory chip inside the phone. It is what identifies your phone and distinguishes it from all the other yuppies on the service. If the ESN were to be changed, one of the following would happen: 1) someone else would get billed for your calls 2) no one would get billed for your calls 3) you would not be able to make calls. (1) would happen if your new ESN duplicated a registered user's number. (2) would happen if the ESN landed on a demo or unassigned-but-authorized number (3) would happen if the ESN was not authorized #3 is probably most likely, but it depends on your local phone system. In any case, you probably would not be able to receive incoming calls, since the cellular system wouldn't know your phone's new ESN and couldn't map your cell-phone number to it. Most Cell-Phones have the ESN chip installed in a tamper-resistant manner. Sockets are rare - most are soldered in. Nearly all are covered with epoxy or some other goop that makes it hard to remove and replace the chip without permanent damage to the phone. Finally, it's illegal to avoid charges that way. - Brian
alan@mq.UUCP (Alan H. Mintz) (08/06/90)
In article <32457@cup.portal.com>, dbell@cup.portal.com (David J Bell) writes: > OK: here's one to research. My son told us of a friend at work, whose > father had picked up from am aquaintance at a major aerospace/electronics > company, a replacment chip for some model of cellular phone. This > replacement chip (possibly a ROM or pROM) supposedly allows unlimited > free calling. > > Now, I can see a probable difficulty in *receiving* calls on the > modified phone, as the unit ID may be what gets modified/trashed, but > it would seem at least possible that unlimited *outgoing* calls could > go through without being billed. For example, the ROM could ID the > unit as a service rig, and billing would be to the carrier's overhead... For most systems, ALL calls are billed to SOME account. I believe some switches may allow the existence of certain "Maintenance" numbers, but most carriers choose not to use this. Each cellular phone has an ESN (Electronic Serial Number) and a MIN (Mobile ID Number or Phone Number). The two must match the record in the switch in order for an incoming or outgoing call to be completed. These are usually stored in two separate places in the phone. The ESN is usually somehow affixed to the frame or buried or epoxied. The device that stores the MIN is easily changeable. You would have to change both to allow what you are talking about. In any case, it is clearly unlawful to alter the ESN of a cellular phone! This has been tried and proven in Federal Court under laws pertaining to altering of serial number of electronic equipment (about three years ago, in Florida I believe). -- < Alan H. Mintz | Voice +1 714 980 1034 > < Micro-Quick Systems, Inc. | FAX +1 714 944 3995 > < 10384 Hillside Road | uunet: mq!alan > < Alta Loma, CA 91701 USA | Internet: [pending] >
sheasby@dgp.toronto.edu (Michael C. Sheasby) (08/06/90)
The other day I was in a mall and noticed a few yahoos gathered around a pay phone... they looked around for cops and then unscrewed the receiver on the phone (the ear end, not the mouth end). They took out the small speaker and touched the two wires leading to it to the handset holder (the thing you put the phone back on when you finish the call). Then they dialed and quickly screwed the receiver cap back on. Apparently this saved them a quarter. I suppose it has something to do with a small current passing through the metal receiver hook and fooling the phone into thinking a quarter had been deposited. Anyone ever see this? can you do it any other way? ---Mike. .
robiner@oberon.usc.edu (08/07/90)
In article <1990Aug6.124516.8051@jarvis.csri.toronto.edu> sheasby@dgp.toronto.edu (Michael C. Sheasby) writes: > >The other day I was in a mall and noticed a few yahoos gathered >around a pay phone... they looked around for cops and then >unscrewed the receiver on the phone (the ear end, not the mouth >end). > >They took out the small speaker and touched the two wires >leading to it to the handset holder (the thing you put the >phone back on when you finish the call). Then they dialed >and quickly screwed the receiver cap back on. Apparently this >saved them a quarter. Well, now the phone companies are really gonna love this net... Matthew Broderick pulled this scam in the movie "War Games" but I don't know if it works in the real world. MOst pay phones have glued, or locked, or sealed mouth peices anyway, so it'd be very difficult (and illegal) to try tampering with them. =steve=
larry@rsiatl.UUCP (Larry Kahhan) (08/07/90)
In article <1990Aug6.124516.8051@jarvis.csri.toronto.edu> sheasby@dgp.toronto.edu (Michael C. Sheasby) writes: > >The other day I was in a mall and noticed a few yahoos gathered >around a pay phone... they looked around for cops and then >unscrewed the receiver on the phone (the ear end, not the mouth >end). > >They took out the small speaker and touched the two wires >leading to it to the handset holder (the thing you put the >phone back on when you finish the call). Then they dialed >and quickly screwed the receiver cap back on. Apparently this >saved them a quarter. > There are two basic type of pay telephones in existance; coin first and dial tone first. In dial tone first type telephonesa loop start interface is used. In coin first type telebphones, the circuit is a ground start. The ground start type phone is probably what they were using. At any rate, in this type circuit, the TIP lead coming from the central office is open, and the ring lead has -48V (current limited, usually through a resistive feed). Normally, the ring lead is grounded when you insert your quarter, the central office detects current flow, and then gives you a TIP ground, which allows you to complete the loop with the receiver off-hook, ultimately giving you dial tone. What these guys were doing was externally applying RING GROUND to the telephone loop, bypassing the coin mechanism. I wouldn't recommend making phone calls in this manner, as phone companies tend to get upset over theft of service issues. It's not worth it to try to save a quarter more or less on a telephone call. Larry Kahhan - NRA, NRA-ILA, CSG, GSSA , & GOA
wchan@umd5.umd.edu (Winthrop D Chan) (08/07/90)
In article <1990Aug6.124516.8051@jarvis.csri.toronto.edu> sheasby@dgp.toronto.edu (Michael C. Sheasby) writes: > >The other day I was in a mall and noticed a few yahoos gathered >around a pay phone... they looked around for cops and then >unscrewed the receiver on the phone (the ear end, not the mouth >end). > >They took out the small speaker and touched the two wires >leading to it to the handset holder (the thing you put the >phone back on when you finish the call). Then they dialed >and quickly screwed the receiver cap back on. Apparently this >saved them a quarter. > Well, I haven't seen that one, but I have seen people poke little holes with a nail into the 2nd hole from the bottom of the mouthpiece. They stick a paper clip into the hole and then dial the 1st 6 numbers, then they "short" the paper clip to something metal on the phone and dial the last digit before shorting it again. It was running rampant on this university for a while and only works on local calls. The phone company has replaced all the mouthpieces with ones that have a steel plate which makes it impossible to pull this trick again without severely damaging the mouthpiece. Winthrop ============================================================================= <------- ____ This is how most Computer Science majors look &&& / \ __ _____, after staying up all night for a few weeks `-- | o \' ` &&/ and living off of vending machine food. `| | o },-' \____( )__/ Winthrop Desmond Chan ,' \' \ /~~~~~~|. | .}~~~\ producer@cscwam.umd.edu producer@eng.umd.edu ,-----( . | .}--. | . /\___/ wchan@umd5.umd.edu wchan@linus.umd.edu `----^,\ \ wchan@snoopy.umd.edu wchan@umdd.umd.edu \_ | ACK! Disclaimer : "My employeer is not responsible for what I do or say here" ==============================================================================
whelan@huey.wslab.Hawaii.Edu (Jerry Whelan) (08/07/90)
In article <32457@cup.portal.com> dbell@cup.portal.com (David J Bell) writes:
=>OK: here's one to research. My son told us of a friend at work, whose
=>father had picked up from am aquaintance at a major aerospace/electronics
=>company, a replacment chip for some model of cellular phone. This
=>replacement chip (possibly a ROM or pROM) supposedly allows unlimited
=>free calling.
This sounds similar to those cable descrambler boxes one
can (could ?) buy.
The story I heard was that someone borrowed a legit box from
a friend, copied the eproms and then just started selling those,
without telling the friend what he did. So, as long as the
friend kept his subscription up, all the illegal eproms worked fine,
however when someone got caught, it was traced back to the original
owner who quite promptly changed his descrambler to a new one.
Suddenly (to hear the story) thousands of people were suddenly without
cable...
I wouldn't be surprised if this replacement chip is a pirated
copy of someone else's (probably corporate) cellular phone "identifier."
But, never even having touched such a beast I don't really know how
they work.
--
-------------------------------------------------------------------------------
whelan@ (uhunix.uhcc.hawaii.edu || uhccux.BITNET || nextsrv.uhcc.hawaii.edu)
whelan@huey.wslab.Hawaii.Edu (Jerry Whelan) (08/07/90)
In article <1990Aug6.124516.8051@jarvis.csri.toronto.edu> sheasby@dgp.toronto.edu (Michael C. Sheasby) writes:
=>They took out the small speaker and touched the two wires
=>leading to it to the handset holder (the thing you put the
=>phone back on when you finish the call). Then they dialed
=>and quickly screwed the receiver cap back on. Apparently this
=>saved them a quarter.
=>
=>I suppose it has something to do with a small current passing
=>through the metal receiver hook and fooling the phone into thinking
=>a quarter had been deposited.
=>
=>Anyone ever see this? can you do it any other way?
Yeah, at my boarding high school this was fairly common in the
dorms. However we didn't have to take it apart, rather we stuck a
wire in a hole in the speaker cap and touched the other end to
the metal cable that connected the handset to the rest of the phone.
Here at college I've noticed that a number of public phones have the
center hole in the speaker cap filled in, I assume this is to prevent
people from doing the above operation.
--
-------------------------------------------------------------------------------
whelan@ (uhunix.uhcc.hawaii.edu || uhccux.BITNET || nextsrv.uhcc.hawaii.edu)
bush@uhccux.uhcc.Hawaii.Edu (Anthony Bush) (08/15/90)
crossing of wires on the phone to get free calls is true.. the dorm I was in we used a paper clip and shoved it in where the cord goes into the reciever (you have to remove the rubber off first) then you jiggle it until you hear static then release it.. WALA! thats it. Warning.. dont do this at home.. it is not only illegal.. but also you get a mean shock if you do it wrong (it was fun watching the froshs getting shocked) :) aloha and mahalo from Hawaii! edman