Basics On Answering Machine Hacking (Winter, 2001-2002) ------------------------------------------------------- By horrid Before you all start complaining, I know that in the '80s and early '90s, about a million texts were being spread around BBSs about VMB (voice mailbox) and answering machine hacking. This article is, of course, more recent and contains more information about certain brands of answering machines to aid you in getting into an answering machine (provided you know what brand of machine it is). Also, it focuses more on three-digit passcodes as well as two-digit ones. If you don't know what brand the machine is, this article will also contain a generic overview of gaining remote access to answering machines. Why would you want to hack an answering machine? There are a number of reasons such as spying on people (such as your girlfriend/boyfriend/wife/husband) or just for fun and games (pranking or changing the outgoing message or OGM). Once you are into an answering machine you can listen/delete messages and/or change the OGM to say whatever you want it to. You decide for yourself why you would want to hack an answering machine. Most answering machines require you to enter the password while the OGM is being played. However, some require you to hit a certain key (such as "0," "*," or "#") after which it will say "please enter your password" or perform a series of beeps. A few answering machines require the password after the OGM has finished and the long beep has been played. Some answering machines will disconnect you after you enter a certain number of digits (in which case, you ll need to call back and start again). Case in point, the Panasonics made in the early '90s (and maybe afterwards?) require a two-digit passcode during the OGM and will disconnect you after six digits have been entered if they don't contain the password sequence. If you think you are dealing with an old answering machine that uses a two-digit passcode (such as fairly old Panasonic or AT&T answering machines), there is an easy way to break into it or any two-digit machine that is simply listening for the correct sequence of numbers. Simply call it and then enter this number during the OGM (or after you hit the initialization key to get the machine to listen for a passcode): 001020304050607080911213141516171819223242526272829334353637383944 5464748 4955657585966768697787988990 The above number works on every two-digit passcode (provided it is like most answering machines that don't read the digits in groups of two or three but rather just listen for the right sequence). It works because it contains every possible two-digit passcode. This is very effective. If you get cut off or don't get it all entered during the OGM, call back and start with the number you got cut off on. However, in this day and age, most answering machines use three-digit passcodes. Despite the digit increase, these passcodes are usually as easy (if not easier) to break. The reason for this is because the company wants the customer to be able to remember his/her passcode so it will be easier for them to access their messages away from home without remembering some random three-digit number the company came up with. These default passcodes are supposed to only be temporary. (The customer is supposed to change it shortly after they purchase the machine.) This is not usually the case, however, because most answering machine owners: * Don't even know it's possible to remotely access their answering machine. * Don't think they are vulnerable to attack. * Are too lazy to change their passcode. Also, after a power outage, most machines reset to the default passcode and answering machine owners will usually forget to change their passcode back or get ticked off and just leave the default passcode enabled. For this reason, you may have better luck right after a power outage. Most default three-digit passcodes are either the same number three times in a row ("000," "111" - to name some common ones) or three digits in numerical order ("123," "456," "789"). BellSouth's answering machines use the same digit three times in a row (usually "888"). "Is there one big number I can enter that will cover all three-digit possibilities, like the number for the two-digit passcodes?" The answer is yes. However, it is a lot larger. It's 1005 digits long and covers every possible three-digit combination. (Three passcodes are in the number twice, 988 889 898.) I couldn t stop those three codes from being repeated without screwing up the entire number. If someone comes up with a better number that contains all three-digit possibilities without repeating a three-digit sequence throughout, submit it: 000100200300400500600700800901101201301401501601701801902102202302 40250260270280290310320330340350360370380390410420430440450460470480 49051052053054055056057058059061062063064065066067068069071072073074 07507607707807908108208308408508608708808909109209309409509609709809 91112113114115116117118119122123124125126127128129132133134135136137 13813914214314414514614714814915215315415515615715815916216316416516 61671681691721731741751761771781791821831841851861871881891921931941 95196197198199222322422522622722822923323423523623723823924324424524 62472482492532542552562572582592632642652662672682692732742752762772 78279283284285286287288289293294295296297298299333433533633733833934 43453463473483493543553563573583593643653663673683693743753763773783 79384385386387388389394395396397398399444544644744844945545645745845 94654664674684694754764774784794854864874884894954964974984995556557 55855956656756856957657757857958658758858959659759859966676686696776 7867968768868969769869977787797887897987998889898899900 The number may be intimidating at first, but think of it this way: 1. You would normally have to enter 1,000 passcodes to cover all possible combinations. A combination is three digits long, so that is 3,000 digits. This number cuts the number of digits you would normally have to enter by almost two thirds. 2. You only need to use this number as a last resort if the answering machine doesn't accept the normal default passcodes mentioned above. (I would venture to say at least 80 to 90 percent do.) 3. You will most likely come across the three-digit combination before you have entered all 1,005 digits. Some BellSouth answering machines beep after every digit that is entered. In this case you must slow down so that you get one beep per number and the answering machine doesn't miss any. Also, if you get cut off while entering this number, just call back and start one number before the last one you entered. Once you have gotten into the machine, BellSouth machines, along with most others, have a recording that tells you what numbers perform certain commands. Another way you can get the passcode to BellSouth machines (and others) is if you are at that person's house (such as your friend or girlfriend); simply press the "code" button when no one is looking. The LCD screen that usually displays the number of messages recorded on the machine will flash the three-digit passcode for that machine. Another good way to get into answering machines (if you know what brand/model they use) is to go to a place like Wal-Mart or Radio Shack and ask to see a user's manual on them. This works only if they have the model in stock. You might also want to tell them you bought the machine and lost your user manual. The vulnerabilities mentioned in this article should not be confined to individual's machines. Company answering machines (we'll let you decide what kind of company) are just as vulnerable. Greets: Necro, Vega, Jizz, Telepathy, and Seek.