"An Interesting Diversion" By Lord Phreaker From: 2600 magazine, October 1985 ------------------------------------------------------------------------------- A diverter is a form of call forwarding. The phone phreak calls the customers office phone number after hours, and the call is "diverted" to the customers home. This sort of service is set up so the phone subscriber does not miss any important calls. But why would a phreak be interested? Well, often diverters leave a few seconds of the customers own dial tone as the customer hangs up. The intrepid phreak can use this brief window to dial out on the called party's dial tone, and, unfortunately, it will appear on the diverter subscriber's bill. HOW DIVERTERS ARE USED One merely calls the customer's office number after hours and waits for him to answer. Then he either apologizes for "dialing a wrong number" or merely remains silent so as to have the customer think it's merely a crank phone call. When the customer hangs up, he just waits for the few seconds of dial tone and then dials away. This would not be used as a primary means of calling as it is illegal and multiple wrong numbers can lead to suspicion, plus this method only works at night or after office hours. Diverters are mainly used for calls that cannot be made from extenders, International calling, or the calling of Alliance Teleconferencing (see 2600, May 1985) are common possibilities. Another thing to remember is that tracing results in the customer's phone number, so one can call up TRW or that DOD NORAD computer with less concern about being traced. Some technical problems arise when using diverters, so a word of warning is in order. Many alternate long distance services hang up when the called party hangs up, leaving one without a dial tone or even back at the extender's dial tone. This really depends on how the extender interfaces with the local phone network when it comes out of the long haul lines. MCI and ITT are known to do this frequently, but not all the time. Also, hanging on the line until "dial window" occurs doesn't work every time. Now the really paranoid phreaks wonder, "How am I sure that this is ending up on someone else's bill and not mine?" Well, no method is 100% sure, but one should try to recognize how a full disconnect sounds on the long distance service of his choice. The customer's hanging up will generate only one click, because most diversions are local, or relatively local as compared with long distance. Also, the customer hanging up won't result in winks - little beeps of 2600 hertz tones heard when an in-band trunk is hung up. The 2600 hertz tone returns to indicate the line is free, and the beginning burst of it is heard as it blows you off the line. Also, if there are different types of switching involved, the dial tone will sound radically different, especially between an ESS and a crossbar or step-by-step, as well as sounding "farther away". These techniques are good for undrstanding how phone systems work and will be useful for further exploration. The really paranoid should, at first, try to dial the local ANI (automatic number ifentifier) for the called area and listen to the number it reads off. Or one merely cals the operator and says, "This is repair service. Could you tell me what pair I am coming in on?" If she reads off the phreak's own number, he must try again. HOW TO FIND DIVERTERS And now a phreak must wonder, "How are these beasties found?" The best place to start is the local yellow pages. If one looks up the office numbers for psychiatrists, doctors, real estate agents, plumbers, dentists, or any professional who generally needs to be in constant contact with his customers or would be afraid of losin gbusiness while at home. Then one merely dials up all these numbers after 6:00 or so, and listens for multiple clicks while the call goes through. Since the call is local, multiple clicks should not be the norm. Then the phreak merely follows through with the procedure above, and waits for the window of vulnerability. OTHER FORMS OF DIVERTERS There are several other forms of diverters. Phreaks have known for years of recordings that leave a dial tone after "ending." One eof the more famous was the DoD Fraud Hotline's after hours recording, which finally ended, after multiple clicks and disconnects, at an Autovon dial tone. One common practice occurs when a company finds its PBX being heavily abused after hours. It puts in a recording saying that the company cannot be reached now. However, it often happens that after multiple disconnects one ends up with a dial tone inside the PBX, thus a code is not needed. Also, when dialing a company and talking (social engineering) with employees, one merely waits for them to hang up and often a second dial tone is revealed. 976 (dial-it) numbers have been known to do this as well. Answering services also suffer from this lack of security. A good phreak should learn never to hang up on a called party. He can never be sure what he is missing. The best phreaks are always the last to hang up the phone, and they will often wait on the line a few minutes until they are sure it's all over. One item of clarification - the recordings mentioned above are not the telco standard "The number you have dialed..." or the like. However, telco newslines have been known to suffer from diverter mis-disconnect. DANGERS OF DIVERTING So, nothing comes free. What are the dangers of diverting? Well, technically, one is committing toll fraud. However, a list of diverter numbers is just that, a list of phone numbers. Tracing is a distinct possibility but the average diverter victim does not have the technical knowledge to identify the problem. There has been at least one investigation of diverter fraud involving the FBI. However there were no arrests and the case was dropped. It seems that one prospective victim in Connecticut realized that he was being defrauded after receiving multiple phone calls demanding that he put up his diverter NOW so that a conference call could be made. He then complained to the FBI. However, these aware customers are few and far between, and if a phreak does not go to such radically obnoxious extremes, it is hard to be caught. Unless the same number is used to place many expensive calls.