CHiNA Newsletter #2 ------------------- +-------------------------------+ | | | A. T. M. Fraud Made Easy | | | | summary and research by | | Count Zero | | | | (A CHiNA Info-Net Prod) | | | +-------------------------------+ Have you ever looked longingly upon the sight of your local PULSE machine and thought, "There must be some way that I can make some money REAL easy here."? Well, there is. But it won't be easy. Protection methods can be overcome, but the technology involved must be understood IN ITS ENTIRETY before an attempt at illegal access is to be made. There are hundreds of people, guests of the state, that figured their plans infallible, only to fall victim to a well-hidden camera. This article will not be a lesson on HOW to break into the machine, it is merely a summary of the operations involved with a normal ATM transaction. This information is being presented on a "for information's sake"-only basis. I, Count Zero, do not promote nor remotely condone any illegal acts of any sort. So there. I. MAGNETIC STRIP FORMAT This would seem to be the most efficient method of trying to access illegal sums of cash. You could: a. steal somebody's card and PIN code b. synthesize a card c. attempt to "jackpot" the system We will only look at option B. As "A" is up to your own devices and "C" has several good text files written about it already. So "B" it is. Let's look at the format of the data written to the magnetic strips. This has been taken from a recent HARTWELL, INC manual. [ XX XX XX XX XX XX XX XX ] [ YYYY ] [ - 20 CHARS - ] [ ZZ ZZ ZZ ] [ CC CC ] \-----------------------/ \------/ \--------------/ \----------/ \-------/ Your individual acct. PIN Name of card Bank route CHKSUM number/serial code Code issuee code/rem. access # For validation, each entry is written twice but not written here for ease of typing. But it is repeated in the form of: "ACCT NUM" "ACCT NUM" "PIN CODE" "PIN CODE" etc... These codes may be examined by building a simple code-reader as many have done which can be easily interfaced to your IBM-PC. Full plans to be put into a future CHiNA newsletter. If you were to attempt to write a magnetic strip or change a currently existing one, you would need to be using a head-write circuit based on the popular Motorola BCX119221-A...C series of head control chips. NOTE: Make sure to change the last 2 values! They constitute the checksum of the entry. Merely add all existing characters written (only the first entry, not both of them) using the following chart: CHARACTER VALUE -------------------------------- 0..9 0..9 A..Z 10..36 EOL 37 EOT 38 CLR 39 HMX 40 PTT 41 RIA-1 42 RIA-2 43 I doubt anyone in the communications biz needs an explanation of these terms so I'll move on. II. ATM HARDWARE Usually consists of: ------------------------------------ | | \-----\ | B | | A | | | \-----\ ------------------------------------ | | | ----------- /---/ E | | / / / / ---- | | / C / / D / F | | / / / / ---- | | ------------ /---/ | | | ------------------------------------ A. Camera Mount B. Hidden Voice-Activated recorder & printout link C. Display Monitor D. Options buttons E. Card Slot F. Receipt Slot Your machine may vary slightly. But the concept will almost always hold true. Simple rules for each. A. Wear a paper bag or mask. See also Part II A B. Do NOT speak. This is the most crucial part! See also Part II A C. Nothing D. Wear gloves E. See Part I F. TAKE YOUR RECEIPT AND BURN IT!! One of the neat flaws in many machines made prior to 1989 involved the use of the "CANCEL" button. This button was made to be pressed when the user decided, at any time during the transaction, that he didn't wish to continue. The display would jump immediately to: "TRANSACTION CANCELLED - CHOOSE ANOTHER?" This was all well and good, but the machines did not disable this feature between the time your cash was dispensed and you were prompted for your next activity. In effect, you could push the "CANCEL" button after your money has been withdrawn and it would not be added to your account record! THIS STILL WORKS IN MANY PLACES! OVER 85% OF ALL MACHINES MADE BEFORE MAR. 1989 STILL HAVE NOT BEEN UPGRADED. Although most machines of that period would only work if you were withdrawing amounts larger than $20 (usually $25 is the next possible choice!) This is ideal if you are using another's card! II A. CAMERA/SOUND HARDWARE You can go other routes when dealing with camera systems. You do not have to wear a bag on your head (unless the cosmetic improvement is quite large) Thin alloy metal such as common aluminum/tin foil, which are full of impurities, react in a bizarre way when photographed through the special lenses that are commonly used. The effect is to "blur" or "bleed" the image, rendering it indestinguishable from an accident in your local Sherwin-Williams store. Most people prefer to make a "headband" of this metal, lined with copper wire in a sine wave pattern when accosting a machine. You should seriously consider this possibility! For further reading on this subject, consult: BANKER'S WORLD - Apr 1989 "Where Have All the Dollars Gone?" pp 24-29 P. I. - Apr 1989 "The Last Straw" pp 37-41 (p 38 in particular has a nice diagram. Fig 1) Sounds, these articles also suggest an indirect method of dealing with the voice-activated recording device. Oddly, a pure square wave tone (roughly around 3100 hz) will cause a major screwup in the sound-sensing abilities of the recorder. It usually will have to be replaced. Suggested volume, given at 6" range is 8.5+ db. Obviously, anything louder will do. An interesting side-note is that this has become a past-time of suburban teenagers! Well, hope this gets you started! More will be coming in the next exciting file! ---------------------------> OVER AND OUT! -----------> COUNT ZERO HAHAHAHA NAPPA IS A BUNCH OF FLY-BY-NIGHT LOSERS, EH CONFLICT?! Call us on: HYPERCARD BBS (406) 538-2101 1200/2400 BAUD (CHiNA Node #3) SYSOP: GEORGE VON JUNGLE FAWLTY TOWERS (202) 781-6420 2400 BAUD ONLY (CHiNA Node #9) SYSOP: BASIL FAWLTY A big hello to: Rubix the Cube, The Conflict, Monalisa Overdrive ---------------------------------------------------------------------------- R.O.L.M. Sorcerer XII PBX Remote System Control CHiNA By... The Conflict INTRO : I know right off you people are thinking, "How in the Hell do I know if I am calling a R.O.L.M. Sorcerer XII PBX?". Well, that will be covered here, along with all system commands available on that PBX.**Of course, this file is meant for educational purposes only. We at CHiNA hereby waive any legal reprimand due to misuse of the information contained in this file (so there!).** HOW : A R.O.L.M. Sorcerer XII PBX has a unique answer; thus, it IT is quite distinguishable from most other PBX's. I will list SOUNDS some PBX's with similar answer devices at the end of this section. The Sorcerer XII's answer consists of: A.) No ring, B.) A short diverting tone of 2600 Hz, and C.) A standard, no interrupt AT&T 4.2c dial tone. Unfortunately, there are four known PBX's that have a similar answer device, but not exact. These four are as follows: A.) R.O.L.M. Sorcerer III, B.) SouthWestern Bell WizSys I, C.) Northern Telecom SL-Net V, and D.) Siemans WebLink v.Ia. The slight differences between these systems answer devices are the dial tones. The dial differ either in tone, volume, or interrupt/no interrupt. With practice, you will find the Sorcerer XII easy to distinguish. WHAT : Now, most often Sorcerer XII requires a four digit code, but TO DO this can be altered at the source, so it is not entirely consistent. To be able to utilize the Remote System Control (RSC from here out) commands, you must obtain the System Command Code. The System Command Code consists of the original number of digits plus a two digit authorization check. Thus, if we were dealing with a four digit Sorcerer XII system, we would find the four digit System Command Code followed by two more digits. *How do you know if you have the first set of the SCC?* A four tone confirmation, similar to the one given by ASPEN VMNetworks, is given when you have the first digit set of the SCC; then, you must discover the two digit confirmation code. The confirmation code is updated every week. Finding the SCC is not going to be easy, as you can not utilize a cutesy code hacker on your computer. Essentially, the process will take dedicated hand hacking, and scanning for that matter. SYSTEM: Since this is a PBX, there are no voice instructions; thus, COMMAND you must know what the hell you're doing! After you have LEVEL obtained the correct confirmation code, two short beeps are transmitted. This is your cue; you're in! The commands are two digits followed by the asterisk (*) key. Since there are many commands, I will list only those which are essential to your life and needs. You can experiment with the other ones. 07* - input 1, 2, or 3; alters error transmission. 1 is fake carrier, 2 is fast-busy, 3 is sweep-siren. 19* - allows removal of codes from the programed code array. You must enter the code to be removed, followed by the pound key (#). 20* - allows insertion of codes. You must input the code, followed by the pound key (#). Be careful, as a precise log of all code insertions is kept. 43* - enables calls to toll numbers, such as 0700, 1900, and 976. 44* - disables calls to toll numbers. Be sure to disable the function immediately after you are done with it. If it is left on, the administrator knows what's going on and will investigate. 73* - enables making log of all calls placed through Sorcerer XII lines. 74* - disables making log of all calls placed through Sorcerer XII lines. Once again, disable 73 if you use it, as it is obvious to the administrator what's going on. 99* - disconnect from the system command level. Make sure to do this before hanging up, as it will hang the PBX, and things will definantly be switched around. Have fun, be careful, and take it easy. All the information included should be enough to provide hours of safe enjoyment. If you have any questions for CHiNA concerning anything, give us a call at one of the below-listed CHiNA Nodes. Spread this around!!! Tinsel Town Rebellion 12/24/96 713-451-9548 The Forbidden Passage 12/24 713-774-0449 Optical Illusions 12/24 713-578-0722 The Ultimate Revolution 12 713-492-0438 Later, The Conflict Thanks go out to Maxwell Smart for acquiring a partial R.O.L.M. manual; Count Zero for being a swell guy; The Viper for giving us a 'home'; Monalisa Overdrive for anti-procrastination support; and last but not least, NAP/PA for instilling in us a realization that we do not want to do nothing! ------------------------------------------------------------------------------ -- InfoFile on Operation Wolf -- CHiNA As most of you have now heard this wonderful long awaited game suddenly was released, but not by Taito, FiRM, PTL or MCM, but by a guy named General Zaroff. If you downloaded this 'game' somewhere then you probably noticed that it said it was cracked by PTL. How can PTL crack a game when it hasn't even been released out on the market, according to The Viper he called Taito and they told him that it wouldn't be released until the third week of July. Therefore this guy obviously did this to frame PTL (against FiRM) General Zarhoff (also known as The Gipper) did this Sunday I do believe and was stupid enough to put it up on his own board (where several people downloaded it) and then proceded to upload it to The House of Phreaks and you know how it goes it was easily distibuted around. This guy can be found around a few boards but you can pay him a personal visit on the board he runs Crystal Chasm (408) 997-9107 CASJO. I didn't think it would be neccesary to post his Voice #, Address and Real Name. o What the file does o When you first run the program it will tell you that it is PTL. Next it will ask you for your graphics mode and sound ability. After that it will clear the screen, delete Config.Sys Command.Com Autoexec.Bat IBMBIO.Com IBMCOM.Com and then it will lock up. The files are Wolf.001 Wolf.Exe Runme.Bat Title.Ptl The rest of the files on disk one are useless garbage and on Disk 2 the entire disk is all docs. I hope this file helped to prevent the use of this program and make sure you keep a look out for this guy because he is obviously wanted by PTL and FiRM. Created by : Maxwell Smart Thanks to : The Viper and Master Ryu (another CHiNA original) ----------------------------------------------------------------------------- ---- Exterior Terminal Telephones ----- CHiNA by... The Conflict.... Salutations and welcome to CHiNA InfoFile #5. What are Exterior Terminal Telephones? After reading this file, you should understand what an ETT is and how to manipulate it to your liking. We at CHiNA are supplying this information to educate the user. We do not condone implementing this information for illegal use. We at CHiNA hereby waive any legal reprimands which may be directed at us, and the USA protects us with its First Amendment priveleges (SO THERE!). Exterior Terminal Telephones are the extension phones located at various locations. Some commonplace locales include secured apartment buildings, small office buildings, or buildings with after business hours time locks. An ETT is a branch off of the building PBX. Most often, you dial in a four digit number, and the phone processes that and dials the seven digit pre-suff for your extension...the dial mode is commonly pulse. Remote tone controls often control security locks. Logically, if you seize the dial tone before any call goes through, you can call out using the PBX. This can be easily accomplished using a portable dual-tone multi-frequency generator. Either you can pre-record the destination numbers on a portable cassette, or you can contruct a portable DTMF generator. ---------------------------------------------------------------------------- Cellular Phone File - #1 written, created and tested by Count Zero {CHiNA} This simple (?) mod has been tested on the: UNIDEN CS-1000/1200 Series Cellular MPPS Red 12/13 (Pretty much same as above model) and has proven effective for over four months running. However, (yes, here comes the big disclaimer...) ---------------------------------------------------------------------------- D I S C L A I M E R CHiNA and its members claim no responsibility for irresponsible use of the information and designs contained herein. This file is being presented on a "for knowledge's sake" basis to the members of the modemming community at large. Any use of this file except for educational and operational efficiency purposes is hereby forbidden. So there! The Conflict * Maxwell Smart * Count Zero * Monalisa Overdrive * The Viper & Rubiks the Cube ---------------------------------------------------------------------------- What this mod does is prevent a correct unit identification code (called UIC from here on) from being transmitted. The messages sent to and from the local transmittal stations should be surpisingly familiar to any one of our readers. But here's the mod and a bit of theory that I used to discover it. (1) Your individual UID is "burned into" a simple 8x8 EPROM that may be erased and "re-written" to accomodate a new code. This may be difficult, and in fact IS difficult because you will have a lot of trouble finding where it begins and ends. (2) The contact sequence when you first power up the unit (which usually goes on while the handset's "NO SERVC" or "SVC UNAVAIL" is lit) goes like this: YOU A0 A0 A0 A0 A0 A0 A0 A0 IT ACK or NAK (up to a max of 4 times) YOU 12 3A + UID IT 12 3A + UID YOU ACK or NAK IT 00 00 00 or FF FF FF (Available / Not Available) The best route to handle this is to FORCE your system to ACK when asked if a false code is its code. The following should outline the procedure: You will need: * A Temperature-Controlled Soldering Iron * Rosin-Core Solder * Solder wick (for you slobs) * Pair of Diag-Cutters (or wire-cutters) * About 15 minutes of time. Step 1 - Unplug the unit and allow to sit for at least a half hour to allow all capacitors to become completely discharged. Also, as a precaution, "discharge" yourself on a common ground (no woolly socks, ok?) Remove cover from "handset" portion (yes, the one with the keypad) Step 2 - Locate the indicated EPROM should have a serial number that begins with an "IA" prefix and will be noted on the circuit board as "IC4" or "IC5". Given this knowledge and the following picture: +5v -!-------!- GND -! IA... !- RST -! !- +1.5v -! !- IC4 D1 -! !- D5 D2 -! !- D6 D3 -! !- D7 D4 -!-------!- D8 ...you should be able to find it. Step 3 - Cut the D1 pin and pull completely back from the motherboard at a 90 deg angle. This will not interfere with your system messages but will disable any "odd number" from being sent! Thus your code alone will come out false. Step 4 - Locate the following components: R14 - Resistor #14 1.5 ohm Cut and jumper with solder and small gauge wire R15 - Resistor #15 3.5 ohm Cut and replace with 1.5 ohm from previous step C22 - Capacitor #22 Cut and leave out! Now make sure you have no "cold" joints and all soldered points are secure! If you are going to screw up at any point in the procedure, this will be it. Make sure to double-check your work! I don't want anyone weeping to me because their handset if now fused to their right ear! Step 5 - (explanation of Step 4) This step "forces" the system to send an ACK (by routing the NAK trigger through ACK output) and thus verifying the bogus code. Step 6 - Reassemble handset. Just a hint, do NOT go overboard on your calls as these calls are not free, they are just being billed to another person's code (if it is a legit code) Again, re-read the disclaimer. Step 7 - Operate the unit normally. TROUBLESHOOTING: Problem Solution * NO POWER Be sure all power leads were reconnected correctly when you put the handset back together. * STILL GETTING CHARGED FOR Cut the correct pin from the IC! CALLS If still getting charged, cut D2 The House of Phreaks and you know how it goes it was easily disuted around. This guy can be found around a few boards but you can pay him a personal visit on the board he runs Crystal Chasm (408) 997-9107 CASJO. I didn't think it would be neccesary to post his Voice #, Address and Real Name. o What the file does o When you first run the program it will tell you that it is PTL. Next it will ask you for your graphics mode and sound ability. After that it will clear the screen, delete Config.Sys Command.Com Autoexec.Bat IBMBIO.Com IBMCOM.Com and then it will lock up. The files are Wolf.001 Wolf.Exe Runme.Bat Title.Ptl The rest of the files