WATS Version 1.0 by Professor Falken & The Aptolcater

(v1.0)(c)1992
(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)

*
*
**
***
**** **** ******* ************** ******
**** * **** *** *** ************ *****
**** *** **** *** *** **** *****
**** *** **** *** ** *** **** *****
**** * * **** *** *** **** *****
***** ***** *** *** **** *****
**** **** *** *** ******
*** ** *******
** * ********
*

VERSION 1.0

800 / 900 Company Ownership Reverse Database

by

Professor Falken & The Aptolcater

(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)
(K-k00L graFiX!)

INTRODUCTION
————

Welcome to WATS!!! WATS is basically an 800 or 900 company exchange
ownership definer. It is VERY similar to the ‘800’ reverse directory
option off of my old program ‘Phreak Tools.’ However, this version is
command line driven, much like my last program ‘CNA Finder v2.0’. This
program has been written under Microsoft C/C++ 7.0 and uses full optimization
for speed of use. WATS is very well behaved, so don’t fear its use under a
multitasking / DOS shell environment.

800 BACKGROUND
————–

The Bell System offered some of the first ‘collect’ calls to numbers
under the ‘ZENITH’ program. To place a collect call to a party which has
been designated a ‘ZENITH’ (Today it would be a normal 800 WATS-line)
telephone number, the caller would dial the operator and give her a
ZENITH number. Usually the ZENITH numbers were four digits long,
the ones I can remember always ended with x000’s. For instance, Northern
States Power’s old Power-Line Emergency number was ZENITH 7000. While
ZENITH guaranteed a called parties acceptance of a charge call, it
still required an operator to manually route the call, putting an extra
burden on the telephone system (yeah right, it MADE jobs!).

But low and behold, a better way of dialing collect was devised,
the 800 WATS areacode. 800 WATS service was made available to the general
public in 1967. At the time, exchanges of WATS numbers were associated with
exact geographic areas. For instance the (800)421-xxxx exchange was routed
to the 213 (now 310) areacode which is Los Angeles California. However,
using this type of routing calls proved to be bamb00zled, because for each
areacode, they needed an 800 exchange.

But after 15 years of scratching Ma’Bells head they decided to change
the way 800 service was set up. In 1982, a computer database was setup to
match the number called to its corresponding set of routing instructions.
Allowing overflow traffic on one companies WATS line to be routed to
another office location of the same company. At the time, this was an
engineering marvel, and Bellcore patted their heads and scratched their
tummys for many days, but possibly not in that order.

In 1984 after the breakup of the Bell System, Bell’s research and
development labs ‘BELLCORE’ assumed the allocation of 800 exchanges.
Then in 1986, Bellcore FROZE all but 35 of AT&T’s 800 exchanges.
The frozen exchanges could not be assigned unless AT&T demonstrated that
70% of all its exchanges were being used. Since 1986, Bellcore has
unfrozen quite a few exchanges to supply the demand of the booming WATS
market. In the ‘WATS’ program, 65 of AT&T’s 800 exchanges are shown as
‘assignable’ and 116 exchanges are shown as ‘frozen’. Those two numbers
correspond to the original 181 geographic exchanges that were in effect
in 1982.

In 1987, Microwave Communications Inc. (MCI) became the first WATS
carrier to directly compete with AT&T in that market. Since then
many companies from US Sprint to Joe Shmo’ and his sister Ho, have started
their own WATS service. Currently, companies wanting to offer 800 service
are assigned an exchange by Bellcore. For instance, if you were to dial
(800)286-xxxx it would be routed to the equipment owned by Southern New
England Telephone.

Mathematically, there are 1000 different exchanges which can be
issued, and there are 10,000 different numbers per exchange. This creates
a grand total of 10 million possible WATS telephone customers. However,
only 80% of those 10 million are ‘usable’ combinations. Those exchanges
that have been deemed unsuitable by Bellcore are any exchanges that start
with 0 or 1, and 211,311,611, and 911 etc. As of this writing only 180
suitable and assignable exchanges remain at Bellcore’s dispensory.

Exchanges assigned by Bellcore do not neccesarily have to be in use.
Sometimes companies are assigned WATS exchanges, yet they have not even
begun operations. In other cases, firms may have merged or terminated
operations and their numbers have not been reassigned at publication time.
Some unused exchanges DO NOT appear in the program as even being assigned.
One small detail is that it is possible for a corporation to be assigned an
exchange and use it exclusively for its own use, rather than selling long
distance time on it.

900 BACKGROUND
————–

The 900 areacode was the first Pay-per-Call / Pay-per-Minute
type of service available to the public. In 1987, the first 900 exchanges
were opened assigned to companies wanting to compete with AT&T. Telesphere
became the first company to offer competing service with AT&T. The assignment
of 900 exchanges is similar to the assignment of 800 exchanges. Because 900
service is still in its infant years (on a Bell scale) not very many exchanges
have been assigned, and those that have been assigned, have not yet begun
service.

INSTRUCTIONS
————

Using WATS is simpler than hacking a Unix, even your crippled
grandmother can use it! For instance, I just got a PBX from some k0de d00d
and I want to know the possibilities of getting busted when I call all my
k-rAdIkal phriends to let them know I just got a k0de. So I check out the
PBX number (800)255-8415 (Actually the National Security Agency). Since
its an 800 number, the first argument on the command line is an ‘8’. The
exchange is 255 and it is the last argument on the command line. You would
type:

——-
[C:\] wats 8 255

WATS v1.0 – 800/900 Exchange Database
Written by Professor Falken & The Aptolcater
Copyright (c) 1992 – Released 8/19/92

Calls placed to (800)255-xxxx are routed through AT&T-C’s Assignable equipment.

[C:\]
——-

This means that the 255 exchange is owned by the AT&T Company, and its
assignable. Doesn’t need much decipherment does it?

To find out who owns a 900 fuckshop exchange, its basically the same as the
800 search. I take my number (900)468-3825 (900-HOT-FUCK) and:

——-
[C:\] wats 9 468

WATS v1.0 – 800/900 Exchange Database
Written by Professor Falken & The Aptolcater
Copyright (c) 1992 – Released 8/19/92

Calls placed to (900)468-xxxx are routed through US Sprint equipment.

[C:\]
——-

Why you would want this type of 900 information, I do not know. Unless you
were going to social engineer yourself a free phone orgasm. Anyhow, this
information is included anyway…

If you ever forget how to run the program just type:
——
[C:\] wats

——

And at the prompt and you will get a quick-usage screen which hopefully
will be helpful, if not you must have the IQ of a retarted lineman- Please
go back and review your 3rd grade homework again.

CONCLUSION & GREETS
——————-

This is the ending of the docs for WATS if there are any bugs or any
questions, I can be reached on the following boards:

806-793-4616 Celestial Woodlands
602-894-1757 UPT Private

Or if you prefer, I can be reached at the following:

Internet: pfalken@mindvox.phantom.com

Of course this documentation would not be complete without the legals…

—————————————————————————-
All company names listed within the WATS program and this document are
registered trademarks. The manner in which they are given here is the way
they are shown in FCC / Bellcore records. This may vary to one extent or
another from their full, official, or corporate names.

The information herein was believed to be complete and correct at
publication time, but is subject to change. The writers assumes no
responsibility for the uses to which this information may be put.

Any relation to persons living or dead is purely coincidential.
—————————————————————————-

Greetings go out to: All X-LOD/H members, X-Phortune 500 members, DPAK,
Neon Knights, Bellcore, Cult of the Dead Cow -cDc- (what happened to Black
Sept again?), Phrack Magazine, 2600 Magazine, Mondo 2000 (RU Sirius/Queen B
your mag is turning lame), Lex, The Ronz!(haha), Red Rebel, The Rebel (718),
Agent Steal, Taran King, Knight Lightning, Doctor Dissector & KC,
Prometheus-BRUTE!, Anarchy, Wintermute, Dr. Cyclops, PJ, Digitone Cypher,
Luis Cipher, INVALiD MEDiA, The VIZ, Twisted Sector, The Ranger, and
Psychedelic C00kie.

Many thanks to The Aptolcater! Later all…

Professor Falken
X-Legion of Doom Hackers!
X-Phortune 500

WATS v1.0 – 800/900 Exchange Database
Written by Professor Falken & The Aptolcater
Copyright (c) 1992 – Released 8/19/92




ToneLoc v0.98 User Manual, by Minor Threat and Mucho Maas

ToneLoc v0.98

User Manual

by

Minor Threat & Mucho Maas

ToneLoc is short for Tone Locator, and is a bit of a wild thing.
What it does is simple: it dials numbers, looking for some kind of tone.
It can also look for carriers like an ordinary wardialer.

It is useful for:

1. Finding PBX’s.
2. Finding loops or milliwatt test numbers.
3. Finding dial-up long distance carriers.
4. Finding any number that gives a constant tone, or something
that your modem will recognize as one.
5. Finding carriers (other modems)
6. Hacking PBX’s.

Before you even start using ToneLoc, PLEASE PLEASE take the time to
print out and read the docs. Well, you don’t have to print them out,
but at LEAST read them. ToneLoc is extremely flexible and can be
configured to work on almost any modem under almost any environment. It
has been extensively tested on everything from generic 1200’s to USR
16.8k duals. Unfortunately, flexibility has its price. You can
probably get just about anything short of an acoustic coupler to work
with ToneLoc, but you’ll need to spend some time configuring it
properly. Trust us, reading the docs now will alert you to many useful
features, and save you headaches later. To sum it up, ToneLoc rocks and
if you don’t read the docs, you’re a LAMER!

Here are the command line options for ToneLoc:

ToneLoc [DataFile] /M:[Mask] /R:[Range] /D:[ExRange] /X:[ExMask]
/C:[Config] /S:[StartTime] /E:[EndTime] /H:[Hours] /T[-] /K[-]

You can use “:” or “-” as a delimiter. If you don’t use “:” or “-“,
ToneLoc will assume there is no delimiter. Example: ToneLoc [DataFile]
/M[Mask] …

When you run ToneLoc you need to give it at least one command line
parameter. The only required parameter is a data filename; the rest are
optional. The optional parameters can come in any order. If you only
provide a filename, the filename is also used as the mask. A mask tells
ToneLoc what numbers to dial. A mask will look something like this:
555-1XXX. The X’s are replaced by ToneLoc with random numbers. It will
never dial the same random number twice in the same mask. If you exit
before the mask has been exhausted, ToneLoc will save the array of
numbers dialed and their results in the data file. You should never
have more than 4 X’s in a mask. ToneLoc will run, but since ToneLoc
uses integer variables, the numbers will be all screwed up, since 5 X’s
would have 100,000 possible numbers which is more than 32,768 (integer)
and 65,536 (word). If you have no idea what we’re talking about, just
trust us and don’t put 5 X’s in the mask.

The next command line parameter is the Mask (/M). If you use this,
your data filename can be anything you want, and the mask will be taken
from the string following /M.

The next parameter is the range to dial (/R). This makes it easier
to specify a range of numbers without having to exclude numbers. Say
you want to dial from 835-1000 to 835-2000, you would run:
TONELOC 835-XXXX /R:1000-2000.

The next parameter is the range to NOT dial (/D). Say you want to
dial 345-xxxx, but you know that 345-9000 – 345-9999 are all payphones.
Run: TONELOC 345-XXXX /D:9000-9999. ToneLoc would dial everything
except the 9000-9999 range.

Another way to accomplish the same thing would be to use an Exclude
mask. (/X) This is a mask of numbers NOT to dial. To dial the entire
345 prefix, EXCEPT the 5000-5999 range, you could run:

TONELOC 345-XXXX /X:5XXX

Notice that is “/X:5XXX” and not “/X:345-XXXX”. The Exclude mask must be
a subset of the original mask. You can specify up to 10 exclude masks.

Excluded numbers (from masks or ranges) are only excluded for the
current run of ToneLoc – the flagging is not permanent. Between your
dial masks and ranges you should be able to obtain a good degree of
specificity in your scan.

The next command line parameter (/C) is which configuration file to
use (.CFG). This file contains all of the configuration data for ToneLoc,
such as which COM port to use, the baud rate, window colors, dial string,
etc. See the configuration file for details.

The next parameter is the starting time (/S). ToneLoc will wait
until this time to begin the dial scan. You can use either standard
time notation (5:30p) or military time (17:30) for any time parameter.
You can hit any key to start early.

The next parameter is the ending time (/E). When this time is
reached ToneLoc will end the current scan.

The next parameter is a useful shortcut (/H). It specifies an end
time at a certain number of hours and minutes past the start time. If
you specify a start time and a number of hours (/S:10:00p /H:5:30), the
end time will be the start time plus the number of hours desired (3:30
AM). If you specify both an end time and a number of hours, the number
of hours will take precedence.

The next few parameters are overrides for the scan type (/T, /K,
/T-, /K-). This is usually set in the config file, but this parameter
overrides it. To scan for tones you’d use /T. To scan for everything
except tones use /T-. To scan for carriers you’d use /K, to scan for
everything except carriers use /K-. The inverted scan modes are useful
for hacking a PBX; see below on hacking PBX’s.

The datafile should be 10016 bytes at all times. If you have data
files from previous versions of ToneLoc, there is a utility included with
ToneLoc called “TCONVERT” that will bring your data files up-to-date.
There can be as many data files in the directory as you want. Don’t
forget to SAVE your data files, they don’t take too much space, and they
are great with ToneMap (see below).

Here are a few example command lines:

ToneLoc 346-XXXX – Dial 346-0000 to 346-9999 using the
default configuration file, saving
responses to the data file 346-XXXX.DAT.

ToneLoc 950-5XXX /C:NINE5 – Dial 1000 numbers, from 950-5000 to 950-5999
(randomly), and use the configuration file
NINE5.CFG. This configuration file might
skip rings and have a short wait. This
could be used for dialups.

ToneLoc 474-9XXX /X:1XX – Dial 1000 numbers, from 474-9000 to 474-9999
(randomly), using the default configuration
file TONELOC.CFG, but exclude 474-9100 to
474-9199. Also see next example.

ToneLoc 474-XXXX /R:9000-9999 /X:91XX
– Same as above, but easier to understand.
This method is better for another reason:
If you scan 9000-9999 now, and later decide
to scan the rest of the prefix, this method
would keep the whole scan in one data file,
rather than having 474-9XXX.DAT and
474-XXXX.DAT.

ToneLoc 474-XXXX /R:9000-9999 /D:9100-9199
– Another version of the above.

ToneLoc 836-99XX /C:LOOP /S:21:30
– Dial from 836-9900 to 836-9999 (100 numbers)
using the config file LOOP.CFG, but waiting
until 9:30 PM to begin dialing.

ToneLoc TEST /M555-1XXX /H:5:00 /x:3XX /x:1XX
– Dial the numbers from 555-1000 to 555-1999
for five hours maximum, saving the dialed
numbers to TEST.DAT, and excluding the
ranges 1300-1399 and 1100-1199.

ToneLoc 677-8xxx /E:8:30a – Dial the numbers 677-8000 to 677-8999
until 8:30 AM, saving the dialed numbers
to 677-8XXX.DAT.

The optional parameters can come in any order, but the name of the
datafile MUST be the first parameter. If there is no mask specified, the
data file name is used as the mask.

We hope you are impressed by the way the screen looks while dialing.
The screen is split up into 3 major windows. The first window, called the
Activity Log, takes up the entire left half of the screen. It tells you
what is going on. If LOGGING is ON, everything that appears here also
goes to the log file. The following messages may appear in the message
log:

22:54:09 ¯
This is written at the beginning of each run. It makes it
easier for you to separate ToneLoc runs in the log file.

22:53:53 ToneLoc started on 31-Jan-93
This is self explanatory.

22:53:53 Data file: 403-XXXX.DAT
This shows which file ToneLoc is using to store the dialed
numbers.

22:53:53 Config file: TONELOC.CFG
This shows which file ToneLoc has loaded the configuration
information from. TONELOC.CFG is the default configuration
file.

22:53:53 Log file: TONE.LOG
This shows which file ToneLoc is logging the scan to. This
file name is set in the configuration file and can be changed
there.

22:53:53 Mask used: 403-XXXX
This tells what mask you used for the current run.

22:53:53 Exclude mask 1: 8XXX
Shows which numbers you AREN’T dialing in the current run.

22:53:53 Initializing modem …
ToneLoc is trying to initialize the modem. It will either
give a “Done” message or a “Failed” Message. Toneloc will
try 3 times to initialize the modem.

22:53:53 Waiting until 09:30:00
ToneLoc is waiting until 9:30 AM to start the current scan.
You can hit any key to start early.

23:30:44 474-5294 – Timeout (1)
This means the number was dialed, it rang ONCE (notice the ‘(1)’ ),
and then it timed out without finding anything.

23:30:56 474-5335 – Timeout (3)
This means the number was dialed, and nothing was found during
the WaitDelay. The (3) indicates there were three rings.

23:31:00 474-5978 – No Dialtone #1
This means when ToneLoc tried to dial, there was no dial tone
found (your dialtone). When this happens, ToneLoc tries the
same number again, until it has tried the number of times by
specified by NoToneAbort in the config file.

23:39:02 474-5685 – Busy
This means the number dialed was busy.

00:24:26 474-5989 – ** TONE **
Holy Shit! You found a tone. It is probably either a loop,
PBX, or dial-up LD carrier. Now its your job to hack it out
and use it!

09:14:34 353-0911 – * CARRIER *
Even better! You found a carrier. If you’re lucky, it’s
your DATAKIT dialup. Otherwise, it could be a BellCore
unix! Of course it could be a do-nothing carrier. Those suck.

00:24:26 474-5489 – Voice (1)
This means your modem detected a voice answer. Good modems
like the USR HST/DS can detect voice. X5 or X6 in your init
string will enable this on a HST/DS. CAUTION: the “VOICE”
response can be triggered by some dialtones, so you may want
to disable this if you are scanning for tones. See below.

06:45:43 Ringout (3)
This means MaxRings (in this case 3) was reached and the dial
was aborted. See below for a discussion of rings.

15:11:23 474-5555 – * Blacklisted #5 *
This means the number was found in the BlackList file
(the 5th entry), so it was not dialed. This is highly
recommended for areas with Caller ID and ex-girlfriends.

00:45:01 Autosaving
This means Toneloc is backing up the .DAT file after the
interval set in the config file.

04:53:12 Stopping at 10:00:21
ToneLoc has reached the stop time specified after /E and is
exiting the current scan.

03:00:32 All 10000 codes exhausted
Damn, you dialed every possible number! 3 X’s means 1000
numbers are possible. 4 X’s means 10,000 numbers are
possible, etc. Like this: 10^X, where X is the number of X’s
in the mask. Math sucks.

Other messages are in response to input:

00:25:31 474-5629 – Speaker ON
By hitting S you can toggle the speaker on and off DURING a
scan. ToneLoc will beep high (ON) or low (OFF) depending on
the status of the speaker. ToneLoc waits until it is finished
with the current dial to toggle the speaker.

00:28:45 474-9091 – Volume set to 3
By hitting a number 0-9 you can set the volume level with the
commands defined in the Config file. You can also use them for
customized commands.

00:25:59 474-5985 – * Noted *
You can hit N to make a note in the log next to this number.
Aborts current number. Use it when you find something
interesting like a drunk cowboy yelling at you through the
phone. Other note keys are:
C – Carrier
F – Fax
G – Girl
K – Custom note (you can type a note yourself)
V – VMB
Y – Yelling asshole

00:27:23 474-5239 – Jumped to DOS
Hit J to shell to DOS. Just type EXIT to return. This will
abort the current number being dialed, but ToneLoc will redial
it after you return from DOS. Be careful to “exit” and not
to just re-run Toneloc.

00:27:45 474-5722 – Redialing
Hit R to redial the current number. Useful if a number doesn’t
“take” or you want to fuck with that drunk cowboy who answered
last time.

00:30:45 474-5123 – Escaped
03:30:45 Dials/hour : 225
00:30:46 ToneLoc Exiting …
Hitting escape will abort the current number and exit the
program. ToneLoc writes the average number of dials per hour
to the log file.

00:28:12 474-5756 – Aborted
Hitting the Spacebar will abort the current number.

00:45:23 454-5365 – Paused
Pressing P will stop the current dial and wait for another
keypress before continuing. Good in case you want to use
the phone for a sec.

A few keys don’t have screen responses:

X : Adds 5 seconds to the WaitDelay time for this dial only. Can be
used repeatedly on the same dial.

Ok, on to the next window. The top-right corner of your screen is
the modem window. Everything that is returned from your modem is shown
here. This isn’t very useful, except maybe for debugging, but it looks
neat.
The last window is in the bottom-right part of the screen. Its
called the Statistics window. It shows a bunch of cool stuff like….

þ The time you began scanning.
þ The current time.
þ The maximum number of possible numbers,
based on your mask and negative mask.
þ The number of numbers already dialed.
þ Number of responses for CD (carriers), Tone, Voice, Busy, & Ringout.
þ The average number of dials per hour.
þ ETA – Estimated Time to Arrival (or completion).
This is the number of hours and minutes left in the scan, based
on your current dials per hour and numbers left.
þ The number of rings so far in the current dial.
þ Last 5 tones or carriers found.

You’ll also notice (you better!) the meter at the bottom right.
Pretty cool huh? It just shows the progress of the current call. This
is a graphic representation of the elapsed wait time as set in the config
file. If you can’t stand to look at a still screen, set a fancy meter
wipe option in the config file.

The Black List File:
——————–

This is a file of up to 1000 numbers that ToneLoc should never dial.
Put your own numbers here, your friends numbers, the police department,
fire department, etc. Each number should be on its own line exactly as
ToneLoc will dial them. For example the entry “555-1212” will only
blacklist the number “555-1212”, not “1-555-1212” or “5551212”. If
ToneLoc comes up with one of these numbers as a candidate for a dial
attempt, it will skip it and move on to the next number. Anything after
a semicolon (;) is ignored, so you can comment this file.

Rings And The X Parameter:
————————–

This discussion refers in particular to newer USRobotics modems. If
you are using another brand of modem you’ll probably have to sort
through the details yourself.

This can get a little confusing so a little detail is in order.
There are several ways to deal with the RINGING message that your modem
can generate. The simplest is to simply disable it with the X4 command
in your modem init string. With X4, RINGING and VOICE will be supressed
as responses. This is simple enough, but you won’t get much diagnostic
detail in your logs or .DAT files, and your scan will take longer
because more of the calls will go all the way until timeout instead of
aborting earlier because of a Ringout or Voice response. You can enable
these messages with the X6 flag, which will respond with VOICE and
RINGING when it is detected. Unfortunately, the USR is no AppleCat, and
VOICE can give a false response when you are looking for dialtones. Of
particular importance, the high pitched tone (2600hz aka wink-start)
which precedes many PBX’s initial dialtone will cause a VOICE response.

X7 supresses the VOICE response, but leaves the RINGING response.
In our experience RINGING is seldom a false response, and any potential
VOICE responses will show up as BUSY’s. If you decide to use X7, you’ll
need to adjust the MaxRings parameter in your config file. Experiment a
little bit to decide how to set it. If you set it to 0, the number of
rings will be recorded, but ToneLoc will never abort because of rings.

If you are using a USRobotics modem to scan for carriers, however,
you should use the X6 command since the modem will never give a false
response when looking for carriers. Your scan will go faster, and your
.DAT file will be more detailed.

After the Scan:
—————

Well now that I have some dial tones, what the fuck do I do with
them? First, figure out what kind of a number it is.

PBX’s usually have a 3-8 digit code, but they can be longer, or they
can have NO code. If you enter the correct code, you will hear a second
dial tone. Otherwise you will probably get a reorder (fast busy), busy,
a hangup, or ringing. Sometimes it will ring the PBX attendant (the
operator – ugh). But ringing the attendant is a good way to find out
who owns the PBX. Once you get the second dialtone, dial 9+ACN (sometimes
X+ACN, where X is often 7 or 8, and less frequently other digits) to make
a long distance call. (NOTE: ACN = Area Code & Number) Some PBX’s have
no code, you just need to dial 9. Sometimes the code will follow the
number in the format 9+ACN+Code. Sometimes you’ll need to dial 1 first.
Many will also call international. Experiment. See below on hacking them.

It might also be a long-distance extender dial-up. You’ll find many
of them in the prefix 950-xxxx. Sometimes it is easy to hack a code, but
please be careful! They are easy to get busted on. MCI people are dicks.
They get off on busting people, and announcing it to the world. Sprint
doesn’t fuck around either, they’ll bust you, but they like to keep it
quiet. And the little guys are getting smarter too. Consult with
local phreaks before experimenting with an unfamiliar extender.

Here’s a tip. If you scan 950’s you’ll find most will give either a
result of Voice, Ring, or Busy. A few will be Tones, but also a few will
be Timeouts. Investigate these – you may find something interesting,
like a voice-prompted dialup or a modem carrier.

You may also find “Phantoms”. In Mucho’s area there are several MCI
dialup ports that are no longer in use since the full implementation of
Equal Access. Hack all day, you won’t find a code. Try and figure out
what you are hacking before you waste time on a dead end.

Now, for an explanation of loops. We’ll tell you what we know about
them, which ain’t a whole lot. Loops are a pair of phone numbers,
usually consecutive, like 836-9998 and 836-9999. They are used by the
phone company for testing. What good do loops do us? Well, they are
cool in a few ways. Here is a simple use of loops. Each loop has two
ends, a ‘high’ end, and a ‘low’ end. One end gives a (usually) constant,
loud tone when it is called. The other end is silent. Loops don’t usually
ring either. When BOTH ends are called, the people that called each end
can talk through the loop. Some loops are voice filtered and won’t pass
anything but a constant tone; these aren’t much use to you. Here’s what
you can use working loops for: billing phone calls! First, call the end
that gives the loud tone. Then if the operator or someone calls the other
end, the tone will go quiet. Act like the phone just rang and you answered
it … say “Hello”, “Allo”, “Chow”, “Yo”, or what the fuck ever. The
operator thinks that she just called you, and that’s it! Now the phone
bill will go to the loop, and your local RBOC will get the bill! Use this
technique in moderation, or the loop may go down. Loops are probably most
useful when you want to talk to someone to whom you don’t want to give
your phone number.

As for carriers.. well, we would hope you know what to do with a
carrier by now. But if you don’t, a good place to start is The Mentor’s
Guide to Hacking (Phrack, I forget which issue).

ToneMap – Something New
————————

When we first wrote and ran ToneMap, we were amazed by what we saw.
ToneMap reads a ToneLoc .DAT file, and displays the data visually on the
screen. Big deal, right? Actually, it can be useful. We saw more than
just scattered colors. We saw definate patterns within the prefixes we
scanned. Hopefully you took the time to print this doc file out, because
We are going to go over one of the example .DAT files with you.

Run ToneMap like this: “TONEMAP 555-XXXX” and press Enter. (You’ll
need VGA). You should see a square of colors that takes about 2/3 of the
screen, and a key to the colors on the right. Each square represents a
response type of a single phone number in the prefix. It starts at the top
left (0000) and works down and to the right (9999). Each vertical column
is 100 numbers.

Here’s an explanation of the colors:

BLACK = Undialed (Not yet dialed by ToneLoc)
GREY = Timeout (Lighter = more rings before timeout)
ORANGE/RED = Busy number.
DARK BLUE = Blacklisted number.
DARK GREEN = RingOut. (Rang too many times)
LIGHT GREEN = Tone
LIGHT YELLOW = Carrier
CYAN = NOTED Number (‘N’ was pressed)
DARK RED = Aborted (spacebar pressed)

There are other colors too, as you can see in the key, but the ones
above are the important ones. Unless you’re colorblind, you have
probably already noticed a pattern to this prefix. There are some
vertical bands in the middle of the prefix (from about 3900-5900). In
fact, one entire column (3900) is all busy numbers. Use the cursor keys
to move the white cursor around the map. The number on the bottom right
corner will change and you’ll see the result type and color for that
number.

You can get a little or a lot from a .DAT map. If the exchange is
a rural or residential one you’ll probably see an even distribution of
result codes, with a certain level of each major result code. Besides a
different number of timeouts, ringouts, or busys, most residential
exchanges look very similar – an even distribution with no pattern.

In a business exchange you are much more likely to find patterns.
You may find a string or cluster of modems, a large range of similar
timeouts or voice responses, etc. Ranges that are busy (like the 3900
column in our example) could be permanently busy, or some message which
the modem detects as a busy. A series of ringouts could indicate part
of a PBX’s DID (Direct Inward Dial) group. It varies widely, and your
best bet is to always check it out manually – you never know what you’ll
find.

It behooves you to scan your prefixes and study your results. It
is best to scan a prefix in one big scan (555-xxxx rather than 555-0xxx,
555-1xxx, etc) so you can see the whole prefix at once. We would love
to have a look at your results and have a look at your .DAT files – try
to get in touch with us! Who knows … maybe your ToneMap will end
up on a T-shirt someday!

Hacking PBX’s:
————–

If the PBX code is 4 digits or less you can use ToneLoc to hack it.
The simplest way is to use ToneLoc to look for an internal dialtone.
Lets say you found a 3 digit PBX at 555-9999 which hangs up on you after
you enter a bad code. You’d use ToneLoc like this:

ToneLoc Example1 /m:555-9999Wxxx

(EXAMPLE1.DAT will be the .dat file, /m: specifies the mask.)

This will produce dialing strings like this: ATDT 555-9999Wxxx W;
ToneLoc will dial the number, wait for a dialtone, try a code, then wait
for a second dialtone. If you get the right code, you’ll get the second
dialtone, otherwise you’ll just get a timeout.

Some PBX’s have alert tones for invalid codes which the W command
will hear as a dialtone. You can’t look for a second dialtone directly
with the W command on these PBX’s, but Toneloc has a scan mode designed
specifically for this problem. Set the scan mode to look for everything
except tones, either in the config file or on the command line, and use
ToneLoc like this:

ToneLoc example2 /m:555-8999WxxxW1

This will produce dialing strings like this: ATDT 555-8999WxxxW1 W;.
Toneloc will dial the number, wait for the first dialtone, dial the
code, wait for a dialtone, dial 1, then wait for a dialtone. If the
code is invalid, the second W command will hear the alert tones as a
dialtone and dial 1. The tones should keep playing, and the third W
will respond to the alert tones too, giving a final response of Tone.
If the code is valid, the second W command will hear the internal
dialtone and the 1 will immediately quiet it since 1xx or 1xxx is a
valid extension on most PBX’s. This would give a final response of
Timeout since the third W command won’t find a tone – and voila, you
have your code. Are you confused yet?

This method might not work if 1xx or 1xxx isn’t a valid extension
on the PBX you are trying to hack, since some PBX’s will immediately
give an alert tone if you dial the first digit of an invalid extension.
If you fail the first time around, and think you might have this
problem, have a look at the phone number for the PBX indial. For
example, if the PBX indial is 555-4321, it’s a good bet that some valid
DID extensions are in or near 4xxx, 3xx, or 2x. Therefore, 4, 3 or 2 is
probably going to be the first digit of a valid extension, making them
good candidates for your terminal digit.

Apparently some PBX’s will respond with a carrier blast to an
invalid code, although we’ve never found one. You can use the
everything-but-a-carrier scan mode for these, or just look for an
internal dialtone if carriers don’t appear as tones to the W command.
(See Dual Scanning).

Cautions & Usage Notes:
———————–

We do not have personal experience scanning 1-800 exchanges with
ToneLoc but we recommend that you exercise caution. For a classic
example, see the Fall 1992 issue of 2600 magazine. There is a letter
in there that Minor Threat received once after dialing about 100
1-800 numbers by HAND sequentially! First of all, if you are are
looking for tones you may not get much. Many of the PBX’s or extenders
you would be looking for will answer with a short tone, about the length
of a ring. That’s how ToneLoc will perceive those tones – as a ring.
Many of the PBX’s may also answer with silence, and need # or 9 to
activate their tone. Local PBX’s can answer like this as well, however
the 800 exchanges are more likely to have better security since they
are under constant pressure from call-sell operations as well as every
code abuser in the nation. Second, MCI and Sprint can get irritated when
someone makes thousands of calls into their 800 exchange, and, unlike a
local number, they WILL have easy access to at least your area code and
exchange, and probably your entire phone number. Since each 800 call
costs somebody money, and you aren’t conducting legitimate business during
these calls, it might also be considered theft of service.

Hacking an 800 system of any kind, be it a computer, long distance
extender, PBX, or even a VMB system, can be extremely risky. We urge you
to use good judgment. Find a local PBX and divert your call through it.

If you live in an area with the Call Return, Call Trace, or
Caller ID active, you will definitely experience some call returns with
ToneLoc. Politely explain to anyone who calls back that you dialed a
wrong number – don’t provoke them into a Call Trace. Who knows, you
may even meet a fellow hacker (It’s happened to us – TWICE!). If Caller
ID is active, use more caution – they could have your phone number and
scanning could be construed as harrassment, especially if it happens at
3:00 am.

In any case, please use some intelligence if you are scanning a
range that belongs to a large company. Often the same operator will have
to answer dozens of incoming phone numbers, and your strange hangups may
get tiresome enough in the course of the day that he or she might decide
to do something about it. Listen in on ToneLoc to figure out what kind
of an exchange you are scanning. If it is principally a business exchange,
consider only scanning at night when the affected businesses are closed.
If it is mostly residential you might want to scan during the day. Make
intelligent use of the exclude mask to eliminate ranges that will most
likely be unproductive – unused ranges, pager numbers, answering services,
cellular phones, etc. If you want an overview of your local exchanges,
first try the yellow pages. You will quickly discover where promising
exchanges are. If you want greater depth, go to your local public library
and ask at the reference desk for the criss-cross directory. A section
of this directory is a listing of the telephone numbers in an exchange.
It does not list unlisted or nonpublished numbers (PBX’s will not show up,
although the PBX billing number might), but it will show you if the
exchange is a residential one or not. Ten minutes of thought can save
you 50 hours of scanning.

When hacking a PBX, have some sense and do it late at night when
nobody is using the PBX. Have a little patience; you’ll be glad you did.
Make sure you hack RANDOMLY – sequential hacking is always a good
way to get noticed (although it probably won’t make a difference in this
case), and besides ToneLoc has a better chance of finding the code sooner.

Is Scanning Illegal? (Who cares)
——————–

We don’t know. We’ve heard it is legal to scan during business
hours when the call would not be harrasment. We’ve heard it’s not
illegal if you only call once. We’ve heard that scanning with intent to
hack is illegal, as if such a thing could be proven. (Some people
suggest not using the same phone line for hacking and scanning).
Remember, the most important thing is not whether it is illegal, but
whether you piss someone off or attract attention.

Here’s what the staff at 2600 magazine have to say about wardialing:

“In some places, scanning has been made illegal. It would be hard,
though, for someone to file a complaint against you for scanning since
the whole purpose is to call every number once and only once. It’s not
likely to be thought of as harassment by anyone who gets a single phone
call from a scanning computer. Some central offices have been known to
react strangely when people start scanning. Sometimes you’re unable to
get a dialtone for hours after you start scanning. But there is no
uniform policy. The best thing to do is to first find out if you’ve got
some crazy law saying you can’t do it. If, as is likely, there is no
such law, the only way to find out what happens is to give it a try.”
[2600, Spring 1990, Page 27.]

Problems? (Or; Why doesn’t Toneloc work with my modem?)
———

ToneLoc’s tone scanning mode may not work for everyone’s modem.
ToneLoc looks for tones by dialing strings like this: “ATDT 555-1234 W;”.
This tells the modem to dial the number 555-1234, wait for dialtone, and
then return to the command line. ToneLoc then waits for a result code.
If it gets Ringing, Voice, Busy, etc. it moves on to the next number.
If it gets nothing, the modem never heard a dialtone, so ToneLoc hangs
up and moves on – this is a timeout. If it gets “OK” as a result code
the modem has heard a tone (W waits for a dialtone) and returned to
the command line (semicolon (;) returns to the command line).

ToneLoc won’t work if your modem isn’t discriminative. Some cheap
modems “detect” dial tones just fine, but they also “detect” everything
else – rings, busys, even silence. Other modems won’t wait long enough,
and will move from W to ; very quickly. If you have a problem that
doesn’t stem from either of these, let us know and we’ll see what we can
do to help.

Dual Scanning:
————–

For a long time now we have been asked if it was possible to scan for
tones and carriers at the same time. At last, we have found a way.

The USR Courier 2400 was a great modem in it’s time, and it is the best
modem we have found for scanning. The Courier 2400 has several unique
features. First, it detects carriers as tones. This means a tone scan
should pick up both carriers and tones, and a good number of falses.
This works fine, but it’s a pain to manually sort out the carriers from
the many false responses you inevitably get when scanning for tones.

Recently, however, we discovered that the Courier 2400 will give a “NO
CARRIER” in response to a dialtone during a carrier scan. If you set your
ToneResponse to NO CARRIER in your config file, and scan for carriers,
you will pick up all the carriers and tones separately, on one pass!

There’s a good chance other modems may behave similarly. Try it with
your modem and see. If you find one that works well, tell us about it
and we’ll include a note in the next version of Toneloc. If not, you
should be able to pick up a used Courier 2400 for cheap.

Credits:
——–

We hope you find this program useful. Give it to anyone and
everyone who deserves to have it. If you think it is very cool and
useful, try to contact us somehow. If you think it is a piece of shit
and the directions totally misguided, try to contact us anyway. Our
handles are Minor Threat and Mucho Maas. Minor Threat can be reached on
CelerityNet, our internet address <tone@ccwf.cc.utexas.edu>, or IRC.
Mucho Maas can be reached at the internet address as well.

ToneLoc is written in C and assembly. Assembled by Turbo
Assembler, and compiled by Borland C++ 3.1. Window routines are from
CXL v5.2. The built-in SERIAL routines are based on code from an
excellent book : “Serial Communications in C and C++” by Mark Goodwin.

Minor Threat Sez:

Thanks to Alexis Machine and Marko Ramius for getting me started
phreaking. Thanks to our beta testers, and thanks Alexander Bell for
inventing the telephone. I know he had us in mind.

Mucho Maas Sez:

Thanks to Minor Threat for helping me work on ToneLoc. It should be
noted that the lion’s share of the programming was done by him, and that
his code is a hell of a lot cleaner than mine. Still, somebody had to
get Threat off his ass, and give him features to re-write. Credit for
the PBX hacking technique described here goes to an old text file by Steve
Dahl.

——————————————————————————
One last quote: from a newspaper editorial in the 1870’s

‘… carrying human voice over copper wires is impossible, and even if
it was possible, the thing would have no practical use.’

HA!

Hacking Rampart Systems by Whackoland Part II

!WHACKOLAND!WHACKOLAND!
W HACKING RAMPART W
H SYSTEMS H
A A
C PART II….. C
K K
O IN DEPTH O
L DESCRIPTIONS OF L
A COMMANDS A
N & N
D SUB-CMDS D
!WHACKOLAND!WHACKOLAND!

THIS IS THE SECOND PART OF IN-DEPTH
COMMAND & SUB COMMAND’S. READ PART I
OF HACKING RAMPART SYSTEMS BEFORE THIS.

->PUT

THESE COMMANDS ALTER THE CONFIGURATION
OF RAMPART EQUIPMENT

FORMAT: PUT (OR PLACE) QUALIFIER IN
(OR OUT OF SERVICE)

] PUT(OR PLACE) SUB CMDS [

TESTLINE
PORT
ROTL

->PUT TESTLINE

PUT TYPE TESTLINE (AT) CENTRAL^OFFICE
IN (OR OUT OF SERVICE)

MAKES A TESTLINE AVAILABLE OR UN-
AVAILABLE FOR TESTING BY RAMPART (HAS
NO PHYSICAL EFFECT ON THE EQUIPMENT
ITSELF.)

O POSSIBLE TESTLINE TYPES: 100, 102,
103, 104, 105

O CENTRAL^OFFICE CAN BE A COMMON
LANGUAGE CODE OR A LITERAL CENTRAL
OFFICE NAME (CON).

->PUT PORT

PUT PORT NUMBER (OR ALL) QUALIFIER

ALTERS THE CONFIGURATION OF RAMPART
TEST PORTS.

->PUT PORT SUB CMDS

IN OUT
PBX
WATS
DTMF DP

->PUT PORT NUMBER (OR ALL) PBX
(OR NO PBX)

ENABLES OR DISABLES DIALING ‘9’ AND
WAITING FOR DIAL TONE BEFORE DIALING
ROTL ACCESS NUMBERS.

->PUT PORT WATS

PUT PORT NUMBER (OR ALL) WATS (OR
NO WATS)

ENABLES OR DISABLES DIALING ‘8’ AND
WAITING FOR DIAL TONE BEFORE DIALING
ROTL ACCESS NUMBERS

->PUT PORT DTMF

PUT PORT NUMBER (OR ALL)
(OR NO DP) CAUSES THE SPECIFIED PORT(S)
TO USE DIAL PULSE OUTDIALING

->DISPLAY

THESE COMMANDS RETURN A DISPLAY TO THE
USER OF SYSTEM PARAMETERS AND STORED
TEST RESULTS.

FORMAT: DISPLAY (OR SHOW) QUALIFIER

ABBREVIATIONS: DP,?

->DISPLAY SUB CMDS

ROTL
TESTLINE
PORT
RES-ULTS
DEMAND
TRUNK
RUT

->TERMINAL

TERMINL <(IS) [email protected]>

DISPLAYS THE DEVICE NUMBER OF THE
TERMINAL CURRENTLY IN USE & OPTIONALLY
DEFINES THE TERMINAL USER’S TERMINAL
TYPE.

VALUES FOR ‘[email protected]’:CRT, NO CRT,
VT100, VT101, VT131, VT125 (USE ‘NO
CRT’ FOR HARD COPY TERMINALS. NO CRT IS
THE DEFAULT WHEN LOGGING IN ON REMOTE
TERMINALS)

NOTE: THE CORRECT TERMINAL TYPE MUST BE
DEFINED TO ENABLE CERTAIN PLOTS AND
GRAPHS ON THE RAMPART SYSTEM.

->TEST

THIS CLASS OF CMDS ENABLES THE RAMPART
USER TO PERFORM DEMAND TESTS. IF ALL
TEST PORTS ARE IN USE, DEMAND REQUESTS
ARE PUT INTO THE DEMAND QUEUE & TESTED
IN ‘FIRST IN – FIRST OUT’ ORDER.

FORMAT: TEST TESTLINE (FROM) NEAREND
(TO) FAREND (ON GROUP) GROUP ID
<(ON TRUNKS)TRUNK NUMBERS> >PERFORMING
TESTS>SWITCHES>

TEST TESTLINE REFERRRAL NUMBER <(ON TRUNKS) TRUNK NUMBERS><(PERFORMING) TESTS>

O ‘TESTLINE’ DEFAULTS TO 105 IF NOT
SPECIFIED.

O ‘TRUNK NUMBERS’ DEFAULT TO ENTIRE
TRUNK GROUP IF NOT SPECIFIED

O ‘TESTS’ DEFAULT TO 2-WAY LOSS AND
NOISE.

->TEST SUB CMD’S

NEAREND FAREND
TESTLINE
TESTS
SWITCHES
[email protected]
REP-EAT

THE TESTS THE THE RAMPART SYSTEM IS
CAPABLE TO PERFORM ARE:

‘L’=TWO WAY LOSS AT 1004 HZ
‘L4’=TWO WAY LOSS AT 404 HZ,-16 DB
‘L10’=TWO WAY LOSS AT 1004 HZ, -16 DB
‘L28’=TWO WAY LOSS AT 2804 HZ, -16 DB
‘N’=NEAR TO FAR NOISE
‘RN’=FAR TO NEAR NOISE
‘NT’=TWO WAY NOISE WITH TONE
‘ERL’=ECHO RETURN LOSS
‘SRL’=SINGING RETURN LOSS
‘SRLHI’=HIGH SINGING RETURN LOSS

‘ALL’ PERFORMS ALL TESTS AVAILABLE ON
FAREND RESPONDER SPECIFIED.

AVAILABLE SELFCHECKS:
‘LSC’, ‘LSC4’, ‘LSC10’, ‘LSC28’, ‘NSC’
‘RNSC’,’NTSC’, ‘ERLSC’, ‘SRLSC’,’SHISC’

->REPORT RUT

ALLOWS THE USER TO SPECIFY REPORTING ON
ALL THE SPECIFIED RUT PW IN THE DB.
IF THE RUT PW IS NOT SPECIFIED IN THE
CMD LINE, THE USER IS PROMPTED FOR THE
RUT PW TO USE IN REPORT SELECTION
(RUT IS A ACRONYM FOR REMOTE USER
TERMINAL)

EXAMPLE: ‘REPORT RUT AAA’
‘REPORT RUT’ (PROMPTS FOR RUT
PW)

-> REPORT RUT TESTS

ORIGINATING TERMINAL TT4:

DEMAND TEST-TRUNK GROUP DALTER2004,CINDSROTL TO DALCTSSROTL
EML @NE @FE 0.0
Q1 LOSS LIMIT 2.0 Q2 LOSS LIMIT 04.0
Q1 ERL LIMIT 00. Q2 ERL LIMIT 00.
Q1 NOISE LIMIT 44. Q2 NOISE LIMIT 47.
Q1 NTONE LIMIT 44. Q2 NTONE LIMIT 47.

PORT 2, 20-NOV-85 00:21:00 REF PFX:100
TRANSMISSION 105 TEST (RESULTS STORED)
ROTL ACCESS: 3217006

TRUNK1/ 6001 > 00:22:06 KP 05200460010003214007 ST
L F-N -06.1 N-F -00.1
RN F-N * *

THESE TESTS ARE BEING ROUTED THROUGH
EITHER THE WATS OR PBX, OR NO PBX. YOU
CAN TOGGLE THESE.

!WHACKOLAND!WHACKOLAND!
! !
T LOOK FOR PART III.. T
>T< W HACKING RAMPART W C CL 1, CL2, CL3 C B MAIN SYSTEM B ! (314) 256 8220 ! !WHACKOLAND!WHACKOLAND!  DOWNLOADED FROM P-80 SYSTEMS..... �����������������������������������������������������������������

Hacking Rampart Systems Part 2

==)— P TO PAUSE S TO STOP —(==

 !WHACKOLAND!WHACKOLAND!
W HACKING RAMPART W
H SYSTEMS H
A A
C PART II….. C
K K
O IN DEPTH O
L DESCRIPTIONS OF L
A COMMANDS A
N & N
D SUB-CMDS D
!WHACKOLAND!WHACKOLAND!

THIS IS THE SECOND PART OF IN-DEPTH
COMMAND & SUB COMMAND’S. READ PART I
OF HACKING RAMPART SYSTEMS BEFORE THIS.

->PUT

THESE COMMANDS ALTER THE CONFIGURATION
OF RAMPART EQUIPMENT

FORMAT: PUT (OR PLACE) QUALIFIER IN
(OR OUT OF SERVICE)

] PUT(OR PLACE) SUB CMDS [

TESTLINE
PORT
ROTL

->PUT TESTLINE

PUT TYPE TESTLINE (AT) CENTRAL^OFFICE
IN (OR OUT OF SERVICE)

MAKES A TESTLINE AVAILABLE OR UN-
AVAILABLE FOR TESTING BY RAMPART (HAS
NO PHYSICAL EFFECT ON THE EQUIPMENT
ITSELF.)

O POSSIBLE TESTLINE TYPES: 100, 102,
103, 104, 105

O CENTRAL^OFFICE CAN BE A COMMON
LANGUAGE CODE OR A LITERAL CENTRAL
OFFICE NAME (CON).

->PUT PORT

PUT PORT NUMBER (OR ALL) QUALIFIER

ALTERS THE CONFIGURATION OF RAMPART
TEST PORTS.

->PUT PORT SUB CMDS

IN OUT
PBX
WATS
DTMF DP

->PUT PORT NUMBER (OR ALL) PBX
(OR NO PBX)

ENABLES OR DISABLES DIALING ‘9’ AND
WAITING FOR DIAL TONE BEFORE DIALING
ROTL ACCESS NUMBERS.

->PUT PORT WATS

PUT PORT NUMBER (OR ALL) WATS (OR
NO WATS)

ENABLES OR DISABLES DIALING ‘8’ AND
WAITING FOR DIAL TONE BEFORE DIALING
ROTL ACCESS NUMBERS

->PUT PORT DTMF

PUT PORT NUMBER (OR ALL)
(OR NO DP) CAUSES THE SPECIFIED PORT(S)
TO USE DIAL PULSE OUTDIALING

->DISPLAY

THESE COMMANDS RETURN A DISPLAY TO THE
USER OF SYSTEM PARAMETERS AND STORED
TEST RESULTS.

FORMAT: DISPLAY (OR SHOW) QUALIFIER

ABBREVIATIONS: DP,?

->DISPLAY SUB CMDS

ROTL
TESTLINE
PORT
RES-ULTS
DEMAND
TRUNK
RUT

->TERMINAL

TERMINL <(IS) [email protected]>

DISPLAYS THE DEVICE NUMBER OF THE
TERMINAL CURRENTLY IN USE & OPTIONALLY
DEFINES THE TERMINAL USER’S TERMINAL
TYPE.

VALUES FOR ‘[email protected]’:CRT, NO CRT,
VT100, VT101, VT131, VT125 (USE ‘NO
CRT’ FOR HARD COPY TERMINALS. NO CRT IS
THE DEFAULT WHEN LOGGING IN ON REMOTE
TERMINALS)

NOTE: THE CORRECT TERMINAL TYPE MUST BE
DEFINED TO ENABLE CERTAIN PLOTS AND
GRAPHS ON THE RAMPART SYSTEM.

->TEST

THIS CLASS OF CMDS ENABLES THE RAMPART
USER TO PERFORM DEMAND TESTS. IF ALL
TEST PORTS ARE IN USE, DEMAND REQUESTS
ARE PUT INTO THE DEMAND QUEUE & TESTED
IN ‘FIRST IN – FIRST OUT’ ORDER.

FORMAT: TEST TESTLINE (FROM) NEAREND
(TO) FAREND (ON GROUP) GROUP ID
<(ON TRUNKS)TRUNK NUMBERS> >PERFORMING
TESTS>SWITCHES>

TEST TESTLINE REFERRRAL NUMBER <(ON TRUNKS) TRUNK NUMBERS><(PERFORMING) TESTS>

O ‘TESTLINE’ DEFAULTS TO 105 IF NOT
SPECIFIED.

O ‘TRUNK NUMBERS’ DEFAULT TO ENTIRE
TRUNK GROUP IF NOT SPECIFIED

O ‘TESTS’ DEFAULT TO 2-WAY LOSS AND
NOISE.

->TEST SUB CMD’S

NEAREND FAREND
TESTLINE
TESTS
SWITCHES
[email protected]
REP-EAT

THE TESTS THE THE RAMPART SYSTEM IS
CAPABLE TO PERFORM ARE:

‘L’=TWO WAY LOSS AT 1004 HZ
‘L4’=TWO WAY LOSS AT 404 HZ,-16 DB
‘L10’=TWO WAY LOSS AT 1004 HZ, -16 DB
‘L28’=TWO WAY LOSS AT 2804 HZ, -16 DB
‘N’=NEAR TO FAR NOISE
‘RN’=FAR TO NEAR NOISE
‘NT’=TWO WAY NOISE WITH TONE
‘ERL’=ECHO RETURN LOSS
‘SRL’=SINGING RETURN LOSS
‘SRLHI’=HIGH SINGING RETURN LOSS

‘ALL’ PERFORMS ALL TESTS AVAILABLE ON
FAREND RESPONDER SPECIFIED.

AVAILABLE SELFCHECKS:
‘LSC’, ‘LSC4’, ‘LSC10’, ‘LSC28’, ‘NSC’
‘RNSC’,’NTSC’, ‘ERLSC’, ‘SRLSC’,’SHISC’

->REPORT RUT

ALLOWS THE USER TO SPECIFY REPORTING ON
ALL THE SPECIFIED RUT PW IN THE DB.
IF THE RUT PW IS NOT SPECIFIED IN THE
CMD LINE, THE USER IS PROMPTED FOR THE
RUT PW TO USE IN REPORT SELECTION
(RUT IS A ACRONYM FOR REMOTE USER
TERMINAL)

EXAMPLE: ‘REPORT RUT AAA’
‘REPORT RUT’ (PROMPTS FOR RUT
PW)

-> REPORT RUT TESTS

ORIGINATING TERMINAL TT4:

DEMAND TEST-TRUNK GROUP DALTER20         <G>Hacking Ar

Collection of Hacking Files (Should Eventually be Split up)

Feature Sections – Menu :
:::::::::::::::::::::::::::::::::::::::

[1]…Krakowicz’s Kracking Korner
[2]…Software Documentation
[3]…Software Documentation Vol.2
[4]…Telecommunications Info
[5]…Miscellaneous stuff
[6]…Adventure Hints & Solutions
[7]…Fantasy Adventure Soft-Docs

Enter section (1-7, M=Menu, Q=Quit) :4

=======================================

::: Telecommunications Info :::

—————————————
<#> Date Topic name
—————————————
[1] 03/20 AE Macros
[2] 03/20 Extenders List
[3] 03/20 Loops
[4] 03/20 Three Way Phones
[5] 04/20 Main Frame Numbers
[6] 03/20 Equal Access Info
[7] 03/20 History of ESS
[8] 03/20 Metro Access Numbers
[9] 05/19 Hackers Atlas //
[10] 06/08 PBX Tutorial
??????????
Select 1-10 (M=Menu, Q=Quit) :9

—————————————
[Ctrl-S pauses/Space=quit]

%*%*%*%*%*%*%*%*%*%
* *
% HACKER’S ATLAS %
* *
%*%*%*%*%*%*%*%*%*%
* *
%*%*%*%*%*%*%*%*%*%

WRITTEN BY : THE WYVERN
DONATED TO : THE GRAVEYARD
202-396-4137

#^#^#^#^#^#^#^#^#^#^#^#^#^#^#^#^#^#^#^#

NOW INTO THE SUBJECT OF HACKING , THIS
FILE SHOULD GIVE ALL OF YOU PEOPLE OUT
THERE WHO ARE BORED AND HAVE NOTHING TO
DO, SOMETHING TO DO… IF IT DOESNT
THEN I GUESS IT DOESNT. LOOK FOR ISSUE
2 WHICH IS COMMING SOON.

HOW BOUT SOME INTERNATIONAL NUMBERS?

QUEEN ELIZABETH LOVES TO TALK TO
COMPUTER HACKERS AND CAN USUALLY BE
REACHED AT 011-441-930-482…

SOME OTHER MISC ONES :

LODON RADIO 44-1-246-8035
DIALING INSTRUCTIONS 44-1-246-8017
CIVIL EMERGENCIES 44-1-246-8088

A FUN THING TO DO IS….SOMETIMES WHEN
YOU ARE CALLING A FRIEND, BOARD OR
WHATEVER YOU WILL GET A CROSS LINE
(USUALLY LONG DISTANCE) WHERE YOU CAN
HERE SOME OTHER LOZERS TALKING, WELL
ITS PRETTY FUN TO LISTEN INTO THEIR
CONVERSATIONS…I HAVE HEARD SOME VERY
INTERESTING ONES…IF YOU ARE LUCKY
THEY WILL BE ABLE TO SORTA HEAR YOU,
AND THATS WHEN YOU DO STUFF LIKE “THIS
IS AN EMERGENCY INTERUPTION, PLEASE
HANG UP IMEDIATLY AND PREPARE FOR AN
EMEGENCY CALL” OR START CUSSING THEM
OUT OR ANYHTING YOU WANT TO DO!

SO ANYWAY FOR ALL YOU DIAL-A-“NUTS” OUT
THERE YOU MIGHT AS WELL PICK UP SOME
NEW INTERESTS AND CALL

DIAL-A-FAG 415-685-6790
DIAL-A-TEENAGER 714-346-7673
DIAL-A-ATHEIST 213-254-4914
DIAL-A-IDIOT 212-934-9090

MAYBE YOUR THE KIND THAT LIKES TO
LISTEN TO RECORDINGS? WELL THEN HOW
ABOUT CALLING 512-472-9941 AND
LISTENING TO THE “INSERT 25 CENT”
RECORDING A COUPLE HUNDRED TIMES?

HERE ARE SOME CARRIER NUMBERS IN 805

683-3831
3832
3833
3834
3835

AS FAR AS I KNOW THEY ALL BELONG TO
A CORP. CALLED SIGNAL TECH., THE FIRST
ONE IS AT LEAST, HIT RETURN A FEW TIMES
AND THERE YOU ARE, HACKING TIME.

SHEESH? STILL BORED EH? WELL WHY NOT
GO AHEAD AND GET ONA 6 WAY CONFERENCE
!??! GTE ON FROM 7-9PM (EASTERN STAND.)
301-736-3070….

OPERATOR TRUNK [LR*2II)X]

(TRY THESE IN THAT TRUNK!)

CONFERENCE OPERATOR XXX+11511
COIN REFUND OPERATOR XXX+181

NAW, YOUR THE 800 EXTENDER TYPE EH?
WELL GET OUT YOUR PROGRAM AND HACK
THESE BABYS:

1-800-221-1950
8190
5670
5430
5665
223-7854
243-7854
255-2255
327-0005
0326
2703
6713
9136
9895
547-6754
237-2618 (CODE : 115342 MAY WORK)

WELL IM NOT SURE WHICH NUMBER IT IS
BUT ITS EITHER

1-805-965-3608
6308

ANYWAYS THATS SOME STATE FARM INSURANCE
RECORDING MACHINE, AND AS FAR AS I KNOW
YOUR PHONE BUTTONS 0-9 WILL DO STUFF
LIKE REWIND, FAST FORWARD, READ, LEAVE
MSGS, ETC, ILL HAVE MORE INFO ON IT IN
THE NEXT ATLAS!

EXTENDERS….322-1415, 255-2255
NEWSNET……215-668-2645
XEROX COMPUTING 312-922-4601
ON:XC56TS
PW:[HIT RETURN]

800-621-3026 SPECIAL OPERATOR
205-235-6205 ARMY POST
713-241-6421 SHELL OIL
800-323-7751 MCI MAIL
800-233-3312
800-223-2283 CITY BANKS
800-223-3450 WUI SAFE

SAY GUYS HERE ARE SOME BEAUTY GIVE
AWAYS FOR YOU :

WARNER 228-3333 (PWS ON KNOWN (AWW))

ACCURAY (K00L SYSTEM)
261-2140
ENTER
GAMES

???????
436-9687
6/24
JOHN12

OHIO STATE
LIBRARY…
(LOGON IN HALF DUP.)
422-5025
(MORE ON USING THIS IN NEXT ATLAS)

ALL OF THE ABOVE ARE IN THE 614 AREA
CODE. IN THE NEXT ATLAS THE NUMBER
FOR WENDY’S COMPUTER!

MISC. 614-481 EXCHANGE :

8049
8194
8754
8764
8771

(ALL ABOVE WITH CARRIER)

TRAVELNET : 800-521-8400 (VOICE 800
EXTENDER)

[) HEY GUYS! THESE GUYS LOVE YOU:

THE PENTAGON……202-694-0814
WATERGATE………202-965-2900
WHITE HOUSE…….202-456-1414

HERE ARE SOME PRESSES FOR YOU TO CALL:

RONNIE’S PRESS 800-424-9009 (?)
WHITE HOUSE ” 800-248-0151

HERE ARE SOME REAL NICE ONES:

213 AREA CODE

974-6624 DEATH RECORDS INFO
6621 BIRTH REOCRDS INFO

*** MORE MISC. NUMBERS ***

LOWELL U….617-459-0159
RECORD A VOICE….800-858-9313

*** A FEW EXTENDERS ***

1-800-547-1784
323-8126
521-8000
743-7481

THAT’S IT! WATCH FOR HACKER’S ATLAS II
SOON!

Courtesy of The Shaolin Temple
408/997/0440

—————————————

Select 1-10 (M=Menu, Q=Quit) :10

—————————————
[Ctrl-S pauses/Space=quit]

3

—————————————
[Ctrl-S pauses/Space=quit]

View: PBX SYSTEM TUTORIAL

Steve Dahl
AND
The Legion Of Doom!
Present:

PBX’s (Private Branch Exchanges)
Local and WATS

Because of the danger of using a
blue box, many phreakers have turned
to MCI, sprint, and other SCC’s in
order to get free calls. However, these
services are getting more and more
dangerous, and even the relatively
safe ones like metrofone and all-net
are beginning to trace and bust people
who fraudulantly use their services.
However, (luckily), there is another,
safer way. This is the local and WATS
PBX. If you have a modem or interface
for your computer capable of tone dial-
ing, you can find and make good use of
a great many of these “useful” numbers.
If you don’t have the hardware, it is
still possible, although it would be a
VERY tedious process.
The PBX, or private branch exchange,
is a private switchboard set up in
office buildings, hotels, etc. It
allows people within the PBX to dial
other exchanges directly, to place out-
going calls (what we’re interested in),
and sometimes to transmit their voice
ver the intercom system (lots of
PHUN!) There will at least 1 line
going out of the PBX to the telco set
up for outgoing calls only, and there
will also be at least one incoming line
to the switchboard. This is what we are
interested in. Some of the incoming
lines are always answered by the
switchboard operator, but some will be
answered by the PBX equipmemt. It will
usually answer with a dialtone, the
tone will sound different for different
systems. Some even answer with a
synthesized voice! (These are very hard
to find, though.) The ones which answer
with a dialtone are easy to find if
you have a modem or hardware device
which can “hear” what’s going on on
the phone line.
To find these fun thingies, you
will have to write a scanner program
which will dial each number in a pre-
fix, either sequentially or in a random
order, it really doesn’t matter, and
“listen” on the line for a constant
sound longer than the normal length of
a ring. This could be done manually
but it would take a hell of a long
time. Whenever the program finds a
number that makes a constant tone
longer than a ring, it should record
the number in an array or something.
Now, this number can be one of a few
things. A noisy answering machine, a
sprint, MCI, etc access node, a person
who yells in the fone, the tone side of
a loop (nice), possibly a carrier if
your modem can “hear” tones that high,
or, hopefully, a PBX line. All your
scanning should be done between 6 PM
and 7 AM because between 7 AM and 6 PM,
many of these numbers will be answered
by the switchboard operator. When you
are checking out your results the next
day and come accross a dialtone, enter
some touch-tone (TM) digits. Depending
on which type of PBX equipment and the
length of the codes, after 3-8 digits
it should either give a busy signal,
a “reeler tone” (high-low tone), or
hang up on you, or possibly tell you
you entered a bad code. Now it is time
to write a hacker for this PBX. If the
codes are 3 or 4 digits, there will
most likely only be one code, but if
they are 5 or more digits there may
be more than one. If there are 3 or 4,
your hacker should dial the access
number, wait for a dialtone, then dial
the digits and wait for a second,
then dial a “1” (the reason for this
will be explained shortly), and then
“listen” for a dialtone. This would
be a hacker for a system that gives
a reeler tone, listening for the dial-
tone and hearing it would really mean
the presence of the reeler tone and
mean that a bad code had been entered.
The reason 1 is entered is to “quiet”
the dialtone” If it was a good code,
1XX or 1XXX will be valid extentions
on practically all PBX’s. If your
system gives a re-order or hangs up
after a bad code, forget the one and
just listen for a dialtone, this will
be a good code. If there are 3 or 4
digits, they should be tried sequen-
tiallly (becuase there will probably
only be one good one), if there are
more, take your pick between random and
sequental. Now, when you (finally!!)
get a good code, you will call the
number and enter the code and be
confronted with a second dialtone. THIS
IS THE EXACT SAME DIALTONE THAT ANYONE
WHO PICKS UP A PHONE IN THAT PBX SYSTEM
GETS. The reason this is important is
because if they want to make an out-
going call, they will usually pick up
the fone and dial 8, 9, or sometimes 7,
and get another dialtone and then make
their call, local or long distance. And
you can do the same thing right now!
These numbers also make a good tool to
avoid being traced on telenet, etc, it
will just be traced back to the
company which owns the PBX.
Now for some phun with the PBX you
have just broken into to. You can dial
all extentions directly on it (which
is what local PBX’S are primarially
used for legitimately, unless the com-
pany has OUTWATS lines.) The most
phun extention of all is the PA system.
On some of these, you can get on the
PA (intercom) and actutually talk over
it from your house! It can be on almost
any extention though, so you may have
to hunt for it. On some, 797 or 1234
used to work, but those have mostly
been eliminated, not due to phreakers
but because people inside the company
were figuring them out and using them!
Some PBX’s don’t even have security
codes, you can just call up and dial
9 and call wherever you want. On a few
that I know of you enter the number
and then the code. If you want to know
what these systems “sound” like, there
are files on this and other systems
with long lists of WATS PBX numbers.
The local ones are much safer to hack
though because you are not making a
whole bunch of 800 calls which tends
to get bell very pissed. Also, I have
actually found modems and other wierd
things on some exchanges of PBX’s, it
might be worthwhile to scan the numbers
inside the PBX once to see what you
find.
An important safety note: if you
heavily abuse a PBX and make many
outgoing calls on it, after a few
weeks (or whenever their fone bill
shows up!) it is a good idea to lay off
of it for a couple of months or so
because they could get a trace on it
easilly, just like 800’s. They will
usually just change the code, though.
One more interesing note, I once
found a PBX which had a direct link-
up to sprint! So by dialing 8 I got
a line to sprint, no access codes,
just area code and number. It’s phun
to phuck up sprint and have them not
know who the hell you are or where the
hell you are!!

If you have any comments, sug-
gestions, corrections, or questions,
leave e-mail to Steve Dahl on any major
phreak board, I will be happy to reply.

Steve Dahl
5/1/84

This phile is copyrighted 1984 by
LOD/PNET Telecommunications and Steve
Dahl and is not to be re-posted w/out
the author’s consent!
(>
—————————————

Enter (1-9, M=Menu, Q=Quit) :
—————————————

Select 1-10 (M=Menu, Q=Quit) :8

—————————————
[Ctrl-S pauses/Space=quit]

METROPHONE ACCESS NUMBERS

ANAHEIM, CA (714)527-7055
ATLANTA, GA (404)223-1000
AUSTIN, TX (512)474-6057
BALTIMORE, MD (301)659-7700
BEAUMONT, TX (713)833-9331
BOSTON, MA

—————————————

Select 1-10 (M=Menu, Q=Quit) :7

—————————————
[Ctrl-S pauses/Space=quit]

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$ $
$ THE HISTORY OF ESS $
$ — ——- — — $
$ $
$ $
$ Another original phile by: $
$ $
$ $
$$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$$ $ $ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Of all the new 1960s wonders of telephone technology - satelites, ultra modern Traffic Service Positions (TSPS) for operators, the picturephone, and so on - the one that gave Bell Labs the most trouble, and unexpectedly became the greatest development effort in Bell System's history, was the perfection of an electronic switching system, or ESS. It may be recalled that such a system was the specific end in view when the project that had culminated in the invention of the transistor had been launched back in the 1930s. After successful accomplishment of that planned miracle in 1947-48, further delays were brought about by financial stringency and the need for further development of the transistor itself. In the early 1950s, a Labs team began serious work on electronic swithcing. As early as 1955, Western Electric became involved when five engineers from the Hawthorne works were assigned to collaborate with the Labs on the project. The president of AT&T in 1956, wrote confidently, "At Bell Labs, developement of the new electronic switching system is going full speed ahead. We are sure this will lead to many improvements in service and also to greater efficiency. The first service trial will start in Morris, Ill., in 1959." Shortly thereafter, Kappel said that the cost of the whole project would probably be $45 million. But it gradually became apparent that the developement of a commercially usable electronic switching system - in effect, a computerized telephone exchange - presented vastly greater technical problems than had been anticipated, and that, accordingly, Bell Labs had vastly underestimated both the time and the investment needed to do the job. The year 1959 passed without the promised first trial at Morris, Illinois; it was finally made in November 1960, and quickly showed how much more work remained to be done. As time dragged on and costs mounted, there was a concern at AT&T and some- thing approaching panic at Bell Labs. But the project had to go forward; by this time the investment was too great to be sacrificed, and in any case, forward projections of increased demand for telephone service indicated that within a phew years a time would come when, without the quantum leap in speed and flexibility thaty electronic switching would provide, the national network would be unable to meet the demand. In November 1963, an all-electronic switching system went into use at the Brown Engineering Company at Cocoa Beach, Florida. But this was a small installation, essentially another test installation, serving only a single company. Kappel's tone on the subject in the 1964 annual report was, for him, an almost apologetic: "Electronic switching equipment must be manufactured in volume to unprecedented standards of reliability.... To turn out the equipment economically and with good speed, mass production methods must be developed; but, at the same time, there can be no loss of precision..." Another year and millions of dollars later, on May 30, 1965, the first commercial electric centeral office was put into service at Succasunna, New Jersey. Even at Succasunna, only 200 of the town's 4,300 subscribers initially had the benefit of electronic switching's added speed and additional services, such as provision for three party conversations and automatic transfer of incoming calls. But after that, ESS was on its way. In January 1966, the second commercial installation, this one serving 2,900 telephones, went into service in Chase, Maryland. By the end of 1967 there were additional ESS offices in California, Connecticut, Minnesota, Georgia, New York, Florida, and Pennsylvania; by the end of 1970 there were 120 offices serving 1.8 million customers; and by 1974 there were 475 offices serving 5.6 million customers. The difference between conventional switching and electronic switching is the difference between "hardware" and "software"; in the former case, maintenence is done on the spot, with screwdriver and pliers, while in the case of electronic switching, it can be done remotely, by computer, from a centeral point, making it possible to have only one or two technicians on duty at a time at each switching center. The development program, when the final figures were added up, was found to have required a staggering four thousand man-years of work at Bell Labs and to have cost not $45 million but $500 million! The End Lex Luthor Courtesy of The Shaolin Temple 408/997/0440 --------------------------------------- Select 1-10 (M=Menu, Q=Quit) :6 --------------------------------------- [Ctrl-S pauses/Space=quit] * * * * * * * * * * * * * * * TESTS START FOR LONG DISTACE " EQUAL ACCESS " SWITCHING * * * * * * * * * * * * * * * FROM: <*>
* * * * * * * * * * * * * * *

Well, I’m sure most of you phreaks have
heard many rumors about gaining access
to MCI, SPRINT etc…

—————————————

Select 1-10 (M=Menu, Q=Quit) :Q

The Information Systems Security Monitor Volume 2 Number 4

ÚÄÄÄÄÄÄ InformationÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
³                          °°°Û   °°°°°Û  °°°°°Û   °°Û       °°Û     ³
ÃÄÄÄÄÄÄ Systems ÄÄÄÄÄÄÄÄÄÄÄ °Û ÄÄ °°°Û ÄÄ °°°Û ÄÄÄ °°°°Û ÄÄ °°°Û ÄÄÄÄ´
³                           °Û    °°°°°Û  °°°°°Û   °°°°°°°°°°°°Û     ³
ÃÄÄÄÄÄÄ Security ÄÄÄÄÄÄÄÄÄÄ °Û ÄÄÄÄÄ °°Û ÄÄÄ °°Û Ä °°Û Ä°°Û Ä°°Û ÄÄÄÄ´
³                          °°°Û   °°°°°Û  °°°°°Û   °°Û       °°Û     ³
ÀÄÄÄÄÄÄ Monitor ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

“Dedicated to the pursuit of security awareness.”

======================================================================
Volume 2 Number 4                                         October 1992
======================================================================

/////////////////////////// In this Issue \\\\\\\\\\\\\\\\\\\\\\\\\\\\

BPD Security BBS Interview

Did You Know That…

Public Debt “Hackers”

Clyde’s Hall Of Fame

“Dear Clyde…”

Computer Speak

Voice Mail Toll Fraud

Computer Security Day

///////////////////////////////////////////////////////////////////////

BPD SECURITY INTERVIEW

Editor’s Note:  The following interview was conducted by Jim
Thomas, Department of Sociology, NIU, Dekalb, Il., editor of
Computer underground Digest (CuD),  August 12, 1992.  Permission
to reprint the article has been given by the editors of CuD.
Computer Underground Digest is an open forum dedicated to sharing
information among computerists and to the presentation and debate
of diverse views.

(MODERATOR’s NOTE:  We heard about the AIS BBS from several
readers, and checked it out.  We were impressed by the collection
of text files, the attempt to bring different groups together for
the common purposes of security and civilizing the cyber frontier,
and the professionalism with which the board is run.  AIS BBS is
a first-rate resource for security personnel who are concerned with
protecting their systems).

THOMAS:  What is this Board?  (Name, number, who runs it (dept &
sysop).  What kind of software are you using? When did the board
go on-line?

CLANCY:  The Bulletin Board System (BBS) is run by the Bureau of
the Public Debt’s Office of Automated Information System’s Security
Branch.  The mission of the Bureau is to administer Treasury’s debt
finance operations and account for the resulting debt.  The OAIS
Security Branch is responsible for managing Public Debt’s computer
systems security.  The AIS BBS is open to the public and the phone
number for the Board is (304) 420-6083.  There are three sysops,
who manage the Remote Access software.  The BBS  operates on a
stand-alone PC and is not connected to any other Public Debt
system.  The Board is  not used to disseminate sensitive
information, and has been up operating for the past 15 months.

THOMAS:  What are the goals and purposes of the Board?

CLANCY:  The BBS was established to help manage Public Debt’s
security program.  Security managers are located throughout Public
Debt’s offices in Parkersburg, WV and Washington DC.  The security
programmers saw a need to disseminate large amounts of information
and provide for communication between program participants in
different locations.   Because the Board was established for
internal purposes, the phone number was not published.  However,
the number was provided to others in the computer security
community who could provide information and make suggestions to
help improve the Bureau’s security program. Gradually, others
became aware of the Board’s existence.

THOMAS:  What kinds of files and/or programs do you have on the
Board? Why/how do you choose the files you have on-line?

CLANCY:  There is a wide variety of files posted.  In the
beginning, we posted policy documents, newsletter articles from our
internal security newsletter, bulletins issued by CERT, such as
virus warnings, and others for internal use.  I located some
“underground” files that described  techniques for circumventing
security on one of the systems we manage.  The information, from
Phrack magazine, was posted for our security managers to use to
strengthen security. When we were called by others with the same
systems, we would direct them to those files as well.
Unexpectedly, the “hacker” that had written the file contacted me
through our BBS.  In his article he mentioned several automated
tools that had helped him take advantage of the system. I requested
that he pass on copies of the  programs for our use.  He agreed.
This is how our “hacker file areas” came to be.  Other hackers have
done the same, and we have also received many files that may be
useful.  It is, indeed, an unusual situation when hackers and
security professionals work together to help secure systems.
However, this communication has been beneficial in strengthening
an already secure system.

THOMAS: Since you and the Secret Service are both part of the U.S.
Treasury, was the Board set up to catch “hackers?”

CLANCY:  No, the BBS was designed to manage our internal security
program.  We do not allow individuals to sign on with “handles.”
We do not know if people are hackers when they sign on unless they
identify themselves.

THOMAS: How did you get the idea to set it up?

CLANCY:  The security branch accesses many BBSs on a daily basis
for research purposes, information retrieval and to communicate
with others. Since our security program is decentralized, the BBS
seemed to be an effective way of communicating with program
participants in diverse locations.

THOMAS: What distinguishes your board from sources like CERT, or
from “underground” BBSes?

CLANCY:  First, there is a wide diversity to our files, ranging
from CERT advisories to the 40Hex newsletters. Also, many of the
files on our system are posted as a resource we use for the
implementation of our security program.  For example, the Board
lists computer based training modules that we have developed,
policy documents, and position descriptions.  These are files that
other security programs can use to implement or help start their
programs.  On the message side of the BBS, what distinguishes it
would have to be the open interaction between hackers, virus
writers, phone phreaks and the security community.

THOMAS: What kinds of difficulties or problems have you
encountered, either from superiors or from users, in operating the
Board?

CLANCY:  I can recall few, if any, difficulties from anyone, users
or superiors.  Upper management understands the value of the
technology and has been extremely supportive.  All  users have been
courteous, professional, and supportive.  Security professionals
constantly thank us for providing “underground” information for
them.  It allows others in the field to gain access to valuable
information without having to access “underground” systems.  Users
appreciate the opportunity to share their knowledge with others and
seem grateful to have an avenue to communicate with security
professionals who will listen to “hackers” experiences.

THOMAS: Can you describe any unusual or humorous experiences you
have had with users while running the Board?

CLANCY:  It is unusual for “hackers” and security professionals to
work together to help secure systems, but that is what is occurring
on our system.  I have had requests from other government agencies
asking for resumes of “hackers” that may assist them.   I have been
contacted by numerous government and private agencies asking for
our “contacts.”  I just direct them to the BBS and advise that they
post messages regarding the questions they need answered.  If
anyone is interested in helping, they will respond.  It is an
unusual situation, but, in my opinion, I can attest that the
information we have received has been very useful to our security
program.

THOMAS: What future plans do you have for improving the hardware,
such as upgrading modem, number of lines, or storage capacity, or
for developing the services of the Board?

CLANCY:  Starting July 13th, the Board will be down periodically
for system upgrades.  We are adding an additional phone line, and
a 315 mb hard drive.  Also, we are going to make a few changes to
reorganize files. It is hoped that group information will be more
efficient in this manner.  We are also adding RIME relay net
conferences and will carry topics such as Data Protection.

THOMAS: What should potential users know about the Board or your
policies before attempting to receive access?

CLANCY:  Users must be aware that we do not allow handles on the
BBS.  If they sign on with a handle it will be deleted.  We also
reserve the right to review all E-mail, public and private.  All
users have access to the BBS upon sign on.  If a user wants access
to the “hacker” file area, they need to send a message to the sysop
requesting access.  Potential users should know they are welcome
to call in and communicate with us and others.

———————– End of Article ———————————

DID YOU KNOW THAT…

Public Debt’s ISSMs recently completed Disaster Recovery Training
at classes held in both Parkersburg and Washington.  The classes
consisted of both disaster recovery theory  and the use of the
Bureau’s purchased software product “DISASTAR”, which is to be used
to prepare each application’s own portion of a Bureau wide recovery
plan…
There is an ISSM meeting that is held every month.  Your ISSM would
be happy to hear from you about any computer security questions,
issues or concerns that you may have so that they can be addressed
at that meeting…

———————– End of Article ———————————

PUBLIC DEBT “HACKERS”

After reading the article in this issue of the ISSM about our
bulletin board system, it is no secret that we actively use hacking
tools against our computer systems to test their security.  One
tool I have used to test our security is called GETIT.COM. (later
known as THIEF) .  It is a program floating around the underground
community designed to capture logonids and passwords for Novell
Networks.  I must say I found the program pretty impressive.  It
is extremely easy to use and install and it works wel
Another file not included states that this program can be easily
spoofed if a user types “login userid”.  This allows the program
to only capture a password and not the logonid associated with it.
Of course, capturing passwords is not a good thing to let happen
but at least it does not give a person all the pieces at once.
Following is the documentation for the program.
Thief is a TSR (Terminate and Stay Resident) utility written in
8086 assembly language that attempts to steal Novell passwords.
It originates from a site with consummate hackers and a long,
colorful history of mischief: George Washington High School in
Denver, Colorado.
The school is well endowed with a large variety of IBM
microcomputers.  Five rooms of about 30 computers each are all tied
together on a Novell network.  Four of the five rooms solely use
boot proms* for initializing the workstations.  However, the fifth
houses IBM PS/2 model 80s with hard drives.  The power users tend
to congregate in this area, including the “administrators” with
Supervisor equivalence.  These machines do not use boot proms.
So it was on one of these computers where the “thief” was first
discovered because it takes advantage of weaknesses in the security
at the boot phase.  Into the regular flow of action in the
AUTOEXEC.BAT file, the creator inserted a line that executes the
(hidden) program copied onto the boot disk.  The TSR remains in the
background and the process continues.  Visual signs of thebreak-in
are imperceptible.
Then, as soon as a program named LOGIN is executed, the thief
springs to life and records all the keystroke action into a hidden
file on the boot disk.  The human thief may then later return to
the computer and see what the trap caught.    Before a more
detailed description of the “metabolism” of the thief, consider now
the weaknesses that led to the breach:

o  a localized boot process, or at least one that is corruptible.

o  physical access  to a sensitive computer.

Both are controllable, of course.  The boot prom is a solution
for the former, and lock and key (on the computer or a room that
surrounds it) is for the latter.    Now return to the “metabolism”.
Surprisingly, THIEF uses the same “hook” that the Novell shell
does!  That is, it captures the centralized portal to DOS interrupt
21h.**  Then, it intercepts all function calls.  Specifically, it
checks for the EXECute file function call and the “terminate”
interrupt.
Whenever an EXEC call is made with a filename LOGIN, THIEF
springs to life and records keystrokes until the program
terminates.  This is somewhat sophisticated; however, an even more
effective method could be realized:  it could simply wait for the
specialized Novell function call to log in, and record the calling
parameters.  Note that the above technique requires the program to
be loaded subsequent to the Netware shell.
By no means are these types of programs new; they have been
around as long as password-based program security.  Here, however,
is an example that is tangible and immediate.  Study of it is
beneficial because knowledge of Netware security is one thing;
knowledge of how to defeat it is quite another!  The latter demands
cutting-edge sophistication and comprehension.  The future will
certainly see improved identification techniques, and timeless,
devious ingenuity will be there to greet them.
Note: THIEF was formerly named GETIT by its creator, who was
careless and cocky enough to leave the source code.
*  “Boot proms”, for those not familiar, are accessory chips that
reside on network interface cards; they redirect local drive
activity to the server during the boot process, thus allowing a
workstation to initialize without a (boot) disk.
**  Interrupt 21h is that used by any program when requesting a DOS
function.  The Netware shell, of course, intercepts this regular
flow.  It may pass the information directly along to DOS or process
the call  itself.

———————— End of Article ——————————–

CLYDE’S SECURITY HALL OF FAME

Office of Public Debt Accounting (OPDA) inducted to Hall of Fame:

Through their dedication and commitment to information security,
they have helped Public Debt’s security program grow.  OPDA
management has dedicated the time and resources to ensure that
security issues are addressed to the utmost degree of accuracy and
completeness.  OPDA management recently mandated that all of their
users receive a two hour end user security training class.  This
was above and beyond the security training requirements currently
being fulfilled with the ISSM newsletter.  OPDA ISSMs, Sa
ndra Woods, Mike Goodwin, and Alex Kendjoria-Ganoe have assisted
the AIS Security Branch in developing procedures and guidelines
that will assist other ISSMs when its “their turn” to complete the
same tasks.  Their dedication and assistance has been extremely
beneficial to the development of Public Debt’s security program.
OPDA’a ISSMs have gone out of their way to tutor themselves in
computer security topics.  They have utilized the automated lesson
plans made available on our LAN and made extensive use of our
security library books, magazines, videos and audio tapes.  OPDA
has shown that the ISSM program works when the proper time and
resources are dedicated to the management of information systems
security.

Submitted by Kim Clancy, Manager of the AIS Security Branch

———————— End of Article ——————————–

“DEAR CLYDE…”

(Responses to questions for those who are searching for the truth.)

Dear Clyde;
I have a personal computer (PC) on my desk in the office.  What
types of security controls do I need to protect my computer?

PC (perplexed and confused)

Dear PC;
The greatest measure of security you can provide to your PC is to
physically secure it so that no one can gain access to it.  If that
is not possible, look for methods that will prevent someone from
powering up the computer or using the keyboard.  If I can gain
access to your computer, I have the capability to load programs
(called trojan horses, these are not the same trojan horses from
my day but follow the same logic) that can capture you logonids and
passwords as you sign on to systems.  That means I can act as you
on the computer and everything I do will be traced to you, not me.
If you leave your PC on at night with a modem set up so that you
can call in from home, you’ve made it possible for me to load the
same programs without having to gain physical access to your
computer.  That type of configuration should be reviewed by your
ISSM before setting it up.

————————– End of Article ——————————

COMPUTER SPEAK COMPUTER TERMS AND THEIR MEANINGS

CYBER –  As in CYBERSPACE
Term used to describe the electronic “playground” in which
computerists use, publish and share information with distant
computer users and electronic bulletin boards.
SUPERVISOR –
1)  Network Supervisor – Person responsible for the smooth
operation of the entire network.  The supervisor may also
install the network, maintain the network, reconfiguring and
updating it as the need arises.
2)  SUPERVISOR (as user) – Special username that is
automatically created when a file server is initialized.
This user is permanent and cannot be deleted or renamed.
The user SUPERVISOR has all rights in all file server volumes
and directories, and these rights cannot be revoked.
CERT – Computer Emergency Response Team

————————— End of Article —————————–

VOICE MAIL TOLL FRAUD

For computer hackers, PBX toll fraud has become an annual $500
million boon.  For corporations, it’s become a $500 million
nightmare.  Since only a fraction  of PBX toll fraud is actually
reported and compiled, this $500 million per  year estimate is a
rather modest one.   Historically, hackers broke into a PBX through
its Direct Inward System Access  (DISA) feature.  DISA allows
travelling employees to call into a switch and  avail themselves
of a company’s long distance services.  All too often, it is  now
offering hackers the same privilege.
Once a hacker has cracked a four- or six-digit DISA code, he can
commandeer  the long distance lines for his own unauthorized use.
DISA-based toll fraud  remains the simplest and most prevalent form
of PBX toll fraud.  Until  recently, it was considered the ony
form.
Jim Ross is president of Ross Engineering (Sterling, VA), a
surveillance  counter-measures firm.  During the past month, he
received two highly unusual  complaints of PBX toll fraud.  Instead
of using DISA, the culprits broke into  the PBX through the
voice-mail system.  They were able to whisk right through  voice
mail, obtain dialtone and make thousands of dollars worth of
international calls.
“In the first instance,” Jim recall, “the toll fraud artists
dialed into an  Octel voice-mail system with Aspen software and
attached to an AT&T System 75  PBX.  After hours, incoming 800
callers could grab dialtone after punching in  any three digit
sequence with ’75’ in it and dial into the outside world.” The
company was taken for a $170,000 long distance ride.
Jim stresses that all voice-mail systems “have some kind of
vulnerability and,  sooner or later, the hackers are going to
pinpoint it.”  In fact, he is quite  surprised that it has taken
them so long to discover this new point of entry.   “The easiest
way to prevent these assaults is to program your PBX to shut down
immediately whenever the caller reaches a second dialtone,” he
advises.   “Without the second dialtone, their hands are tied.”

Evasive Tactics

Toll fraud felons are experts in evasion.  Typically, they’ll
bounce the call from one to another, switching
interexchange carriers several times before  they invade the
targeted PBX.  They’ll make the calls from transient numbers,  as
opposed to their home phones.  These evasive tactics make them
quite  difficult, and sometimes impossible to trace.
Jim Ross provides an intriquing example.  “A few years back, a
Harrisburg, PA, company called us for assistance.  They were
getting burned badly.  Every night, the hackers dialed up their
DISA number and made thousands of dollars of calls to a single
number in Columbia.”
Although the company had recognized the problem, and had changed
the DISA access code from four to six digits, they could not stop
the deluge of unauthorized outbound calls.  They eventually had to
shut their PBX down while the local phone company investigated the
matter.
The investigation led from the local telco to AT&T, the
interexchange carrier, and on to the originating telco, New York
Tel.  By the time New York Tel managed to locate the originating
numbers, they had been terminated.  But they were able to outline
the makings of a clever, evasive and quite successful method of PBX
toll fraud.
According to New York Tel records, a mysterious company had put
in a request for 12 new telephone lines.  The company claimed to
be a construction  firm. Although they were planning to put up a
major  office tower, they had no references, and no credit history
to speak of.
New York Tel demands a healthy deposit to service such a shaky
entity.  The company paid the deposit in cash.  New York Tel duly
installed the 12 lines at a trailer on the edge of the alleged
construction site.
After a month, the company abandoned the deposit and the site.
But not before running up thousands of dollars in long-distance
charges on the Harrisburg PBX.  And probably several other switches
as well.

Some External Measures

In addition to implementing toll restriction, daily diagnostics
and other PBX procedures, there are several external ways to
control toll fraud.  A few companies are now issuing DISA smart
cards, with ID numbers which change every minute.  These cards are
virtually impervious to outside meddling.
Smart cards are not cheap.  They are an administrative pain.  And
it is often quite difficult to get the card back after an employee
resigns or quits. However, it remains one of the most effective
alternatives currently available.
Our own solution was to get rid of DISA altogether.  In its
place, we’d distribute corporate credit calling cards.  Each card
would be attached to the company account, not to its CO trunks.
Each would have a unique credit card number.
Thus, when an employee is terminated, so is his credit card
number.  If the card is stolen, the employee will report it
immediately and the other travelling execs could make calls as
usual.  If $500 worth of calls were made to Pakistan in the course
of an hour, the carrier could call the user’s beeper or the company
headquarters.  If neither responded, they could void the card
automatically.
“As far as the telecom industry is concerned, that’s an
excellent idea,” responds Jim Ross.  “But it won’t be acceptable
to the travelling executives.
“You’ve got to understand.  These guys get to be such big wigs
and muckety-mucks that they don’t want to fool around with a nine
digit credit card number, plus the seven-digit long distance
number.  The idea of dialing a few extra digits is an intolerable
burden to them.
“As a corollary, you may remember that former  secretary of
state Alexander Haig made a number of calls to the While House from
Air Force One.  This exchange was recorded by short wave radio
enthusiasts, who handed it over to the media.”  Faced with the
flak, the goverment contended that the encryption equipment in the
plane was just not compatible with that in the White House.
“Nonsense,” says Jim.  “Like many executives and high officials,
Haig just didn’t want to go through the hassle of using the
encrytion equipment or the hardship of listening to a warped,
encrypted voice.  Look at (Virginia) Governor Wilder.  He talks
about his nemesis, Senator Robb, in the clear.”
Jim asserts that there is only one foolproof method to eliminate
toll fraud. “If the FCC would demand that all interexchange
carriers and local telcos implement comprehensive, compulsory
caller identification, then you’ve done away with the problem.
You’ve also done away with bomb threats, harassment and obscene
phone calls, as well.”
Even the most evasive hackers would be instantly identified at
each point along their tortuous journey — from town to town, and
from carrier to carrier.  And they would open themselves to
exposure and apprehension, in real time.
Furthermore, hackers can not mask  Automatic Number
Identification (ANI) by obscuring digits.  Because caller
identification data is entered from your exchange, and not from
your phone, it is impervious to meddling.  Hackers could only avoid
ANI detection by dialing for live operator assistance.  Which
carries its own threat of exposure.
“Unfortunately, universal, compulsory caller identification is
‘pie-in-the-sky’ at this juncture,” laments Mr. Ross.  The
Pennsylvania Supreme Court has already prohibited caller ID, citing
right to privacy violations.  Even where the service is currently
offered, subscribers have the right to withhold their phone numbers
from public inspection.
The CIA would be a fine source for toll fraud prevention.
“Without doubt, our neighbors in Langley have purchased practically
every modern PBX and voice mail system to see what their weaknesses
are,” assents Jim.  “I wish that this information would be made
public.  I think it should be made public, since it is paid for
with our tax dollars.”
That’s only one of several things the CIA does that the American
people get no value from, the interviewer quipped.

Reprinted with permission of Teleconnect Magazine 800-799-0345
Subscription $15 per year

———————— End of Article ——————————–

COMPUTER SECURITY DAY

December 1, 1992 will mark the fifth annual nation-wide
observance of Computer Security Day.   Computer Security Day is our
opportunity to focus attention on our agenda – Computer Security.
Computer Security Day is the first  workday in December, although
official observances vary to avoid conflicts in some countries or
in some organizations.  Computer  Security Day keeps everyone alert
to proper computer security  procedures as the holiday season
approaches and security might  otherwise become lax.
The Bureau of Public Debt will participate this year in Computer
Security Day by holding a contest to select the best security
slogan as submitted by the ISSM Newsletter readership.
The slogan can relate to any computer security-related topic,
such as access security (“Logoff! – An open terminal is a hacker’s
terminal!”), or password security (“Share a Password, Share your
Protection!”).
First through third prizes will be awarded and will consist of
basketball hoop security reminders, as displayed throughout BPD,
Parkersburg.  Winning and runner-up slogans, plus the name of the
submitter, will be printed in future issues  of the ISSM
Newsletter, & be posted on physical security bulletin boards
throughout the building.

—————————– End of Article —————————

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

The AIS Security Branch Runs an Electronic BBS. Give us a call at
(304) 420-6083. An electronic version of the ISSM is posted on the
board and can be downloaded. Articles in the electronic version may
include more detail in that we are not limited by space constraints
as we are in the paper copy.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

The ISSM is a quarterly publication of the Department of Treasury,
Bureau of the Public Debt, AIS Security Branch, 200 3rd Street,
Parkersburg, WV 26101 (304) 420-6368.
Editors: Jim Heikkinen, Ed Alesius, Kim Clancy, Joe Kordella, Mary Clark

Downloaded From P-80 International Information Systems 304-744-2253

The International Hackers’ Association Issue #1

I.H.A. - International Hackers Association
We're not international yet,but we are national.Anyhow,the I.H.A. consists of
a hacker/phreaker wing,and an anarchy wing.This group was started with the
sharing of information and learning in mind.We are always looking for less and more
experienced people,so we can teach and learn more.We are always looking for
more members.

How do i become a member?
Well give one of these bbs's a call,i'm not going to give you the #,you can
find most of them in your local dialing directory on some of your favorite bbs's.
After you get the # for one of these bbs's,give it a call and download the
application of your choice.Either a hacking/phreaking application or an
anarchy application.Or both!Send it back to the bbs where you downloaded it
(after you fill it out).Then you will be notified of whether your membership
has been approved within 3 or 4 days.

Call-
I.H.A. HeadQuarters-I.H.A. World HeadQuarters

Purgatory-Western Sub HeadQuarters
The Crime Lab-Full support board
Boiler Room-Support board

Organization-
There are four positions you can hold in the I.H.A..

Head Organizer-Only one person can hold this position,currently me,the head
organizer has the final say over just about everything that has to do with the I.H.A.

Head Vice Organizer-There are,at the moment,two head vice organizers.Head vice
organizers in the I.H.A.,seek out support boards,manage vice organizers,manage
established support bbs's.

Vice Organizer-The vice organizer position is givin to all sysops carrying a
sub and a file base for the I.H.A..Vice organizers are expected to encourage
membership and promote the I.H.A..

Member-Members just live thier everyday hacking/phreaking/anarchy life,they
are expected to trade thier information with the other members,and expected to
promote the I.H.A..

What the I.H.A. really needs-
We need some programmers to do intro-screens and the like.We also need more
members.There are many benefits to joining.

The Future-
We plan on realeasing many more newsletters,bear with us if this one isn't so
hot.We are just starting out.We also plan on releasing some hacking utilities
in the future.If we get some programmers in the I.H.A.,they will be realeased
soon!We hope you enjoy the newsletter.

The information contained herein will not be altered without the the authors
consent and notification.The information contained herein may be reproduced
and distributed freely.

Head Organizer - BlackJack

Head Vice Organizers - Johnny Rotten,Wolfsblood

Vice Organizers - Dark Angel,The Serpent,Freddie Krueger

Members:
The Terrorist,Digital Deviant,UltraShock,Sarrigar,Huma DragonBane,Decoder,
Wizard,Code Of Honor,Billy The Kid.

Table of contents:

1).Building a divertor box---->Digital Deviant
2).Breaking into telephone company compounds and the vans within--->BlackJack
3).Your local southern bell manhole----->Johnny Rotten
4).SSCS,Splatter Security Control Systems--->The Terrorist,WolfsBlood
5).Making a test set------>Decoder
6).VMB Hacking,Funny side up----->Johnny Rotten
7).The Basics of phone anarchy----->Decoder
8).Bullshitting Big services out of the info you need---->WolfsBlood
9).WorldWide tymnet access numbers---->BlackJack

                                Article #1
OoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoO
oO                                                                         Oo
Oo                         Building a Diverter Box                         oO
oO                              Designed by:                               Oo
Oo                            Digital Deviant                              oO
oO                                                                         Oo
OoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOoOo 5/12/91 oOoO

Does the Menace of ESS have you down?Tired of worrying about getting nabbed
everytime you phreak?Well then the Diverter Box is for you.A few years back I
got plans for a box called the Gold Box.Most hackers soon found out that the
Gold Box did not work after trying to construct it.The Gold Box design was
totally fucked.I still see the plans on many boards to this day.Even though
they don't work.But it is those plans inspired me to design the Diverter Box.
The construction is fairly simple and cheap.You can get all of the needed
parts at your local Radio shack.

PARTS NEEDED:

=QTY=========ITEM====================================CAT NO======PRICE=======
  3          SPDT MICROMINIATURE PC RELAY            275-240     $1.99 EACH
  2          NEON LAMPS                              272-1100    $ .89 EACH
  2          PHOTOCELLS                              276-1657    $1.98 FOR 5
  1          200V SILICON CONTROLLED RECTIFIER (SCR) 276-1067    $ .99
  1          1:1 AUDIO TRANSFORMER                   273-1374    $3.59
  1          9V BATTERY SNAP CONNECTOR               270-325     $1.19 FOR 5
  1          9V BATTERY
  -          SOME WIRE, ELEC TAPE AND SOLDER
=============================================================================

CONSTRUCTION/ PLANS:

Ok,take the Neon Lamps and the Photocells and tape them together with the
electrical tape or any tape that will not allow light in.Tape them together
so that the Neon Lamp will shine directly on the photocell.Make sure that no
light can get in.Ok,now you will have two separate Optocouplers.In the plans
they will be labeled MOC1,and MOC2.It would be best to print the plans out,
so you can see the whole thing at one time.

     BLACK                                                 RED
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
                           ³ AUDIO     ³
Connect Wires to FONE #1   ³ TRANSFORMR³            Connect Wires to FONE #2
ÄÄÄÄÄÄÄÄÄÄÄÄ¿              ÃÄÄÄÄÄÄÄÄÄÄÄ´              ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
     WHITE  ³             W³        ÚÄÄÙ              ³    YELLOW
            ³             H³        ³Y                ³
            ³             IÀÄÄÄ¿    ³E                ³
            ³             T    ³    ³L                ³
            ³             E    ³    ³L                ³
            ³ ÚÄÄÄÄÄÄÄÄÄÄÄÄ¿   ³    ³W ÚÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³
            ÀÄÅÄoNO    NCo ³   ³    ÀÄÄÅÄoNO    NCo ³ ³
           ÚÄÄÅÄo  COIL  oÄÅÄÄijÄÄÄÄÄÄÄÅÄo  COIL  oÄÅijÄÄÄÄÄÄÄÄ¿
           ³  ³            ³   ³       ³            ³ ³        ³
           ³  ³            ³   ³       ³            ³ ³  +      ³
           ³  ³ o  COM   oÄÅÄÄÄÙ       ³ o  COM   oÄÅÄÙ        ³
           ³  ÀÄÄÄÄÄÄÄÄÄÄÄÄÙ           ÀÄÄÄÄÄÄÄÄÄÄÄÄÙ          ³
           ³    RELAY #1                 RELAY #2              ³   - NEGATIVE
           ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿                                 ÀÄÄÄÂÄÄÄÄÄÄÄÄ¿
              ÚÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³                                     ³   9V   ³
              ³ oNO    NCoÄÅÄÙ                                     ³ BATTERY³
         ÚÄÄÄÄÅÄo  COIL  oÄÅÄÄÄ¿        ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿    ÚÄÁÄÄÄÄÄÄÄÄÙ
         ³    ³            ³   ³        ³    ÚÄÄÄÄÄÄÄÄÄÄÄ¿  ³    ³ + POSITIVE
         ³    ³            ³   ³        ³    ³     ÚÄoÄ¿ ³  ³    ³
         ³    ³ o  COM   oÄÅÄÄÄ+ÄÄÄÄÄÄÄÄÙ    ³ SCR ÃÄÄÄ´ ³  ³    À¿
         ³    ÀÄÄÄÄÄÄÄÄÄÄÄÄÙ                 ³     ÃÄÂÄ´ ³  ³     ³
         ³      RELAY #3                     ³     ³ ³ ³ ³  ³     ³
         ³                           -       ³     1 2 3ÄÙ  ³     ³
         ³       Connect wire to the ³       ³     ³ ³      ³     ³
         ³       NEGATIVE terminal on³       ³     ÀÄÄÄÄÄÄÄÄÙ     ³
         ³       Battery             ³       ³       ³            ³
         ³       ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ       ³       ÀÄÄÄÄÄÄÄÄÄÄÄÄ+
         ³       ³                           ³                    ³
         ³       ³ PHOTOCELL                 ³                    ³
         ³       ³ LEADS                     ÀÄÄÄÄÄÄÄÄÄÄÄÄ¿       ³
         ÃÄÄÄÄÄÄÄ´                                        ³       ³
         ³ MOC1  ³                                        ³       ³ PHOTOCELL
         ÃÄÄÄÄÄÄÄ´                                        ³       ³ LEADS
         ³Connect³ NEON LAMP                              ³       ³
         ³  to   ³ LEADS                                  ³       ³
         ³FONE #3³                                        ÃÄÄÄÄÄÄÄ´
         ³       ³                                        ³ MOC1  ³
                                                          ÃÄÄÄÄÄÄÄ´
                                                          ³Connect³ NEON LAMP
                                                          ³  to   ³ LEADS
                                                          ³FONE #1³
                                                          ³       ³

USAGE/ TIPS:

You can probably find a better way to connect everything.I just drew the
schematics like that so they would be easy to understand.In the areas where a
wire crosses over another wire DO NOT connect them, UNLESS there is a "+" sign
where the wires cross.Now solder all the shit together.The polarity on the
Fone lines doesn't matter.So you won't have to spend time and frustration
trying to get the proper polarity connections.As you may have noticed you will
need three fone lines.FONE #1 will be the number you call to get a dial tone.
FONE #2 is the fone line that you will be dialing out from.You will call
FONE #3 to disconnect FONE #1 and FONE #2,in other words you will call this
number to cause them to hang up.If you know anything about electronics you
could hook up a tone detecting chip that would activate RELAY #3 when a
certain tone is played.This would cause the fones to hang up.FONE #2 MUST be a
regular fone line.FONE #1 and FONE #3 can be a Pay Fone Line or a regular Fone
Line.
A good place to hook this up would be at a Jiffy that has two pay fones.But
you would not be able to use your box until they close.Your best bet would be
to hook it up at a big hotel or motel.They have plenty of pay fones.You may
have to run some wire to connect to their PBX,but it can be done.After you've
got the device hooked up ANI Fone #1 and Fone #3...Now your all set.Dial with
care, but dial any where.Have phun!

DISCLAIMER:

This file is for INFORMATIONAL Purposes ONLY.The Diverter Box is not to be
used in any illegal manner(Yeah, thats it).I do NOT take any responsibility
for your actions!

-----------------------------------------------------------------------------
                               Article #2

              How to break into an AT&T/Bellsouth van/compound

First of all you might want to wear dark clothing,it shouldn't be to tight
nor too lose.When your jumping over fences it isn't to funny when you rip
your pants off!

Next you might need some wire-cutters,universal jimmy,set of lock picks
or mabye a rock rapped up in a towl.Any one of these will do.
The wire cutters are for (you guessed it!)cutiing the fence so you can get in
without having to scale barbed wire fences.The wire cutters should be fairly
big,linemans plyers will not work!

As for the universal jimmy,lockpicks, or rock in a towl.These are used to open
up the AT&T van.The best choice would be a blue tipped universal jimmy,you can
find them in cop cars and mabye a locksmithing van.Next best are lockpicks,
however,make sure you can use them before you try it on a van!Your only other
option would be a wire hanger(unwrapped) or a rock rapped in a towl or
something to muffel the noise.

Next you might need a friend with a car.It is very impossible to get away from
bell security when you have to run on foot with 50 lbs of shit on your back.
You might even want to employ a bb gun,this is for getting rid of those damn
lights!Don't forget your trusty scanner,this way you can monitor police
channels so you know what to expect.Make sure you have a backpack or something
to put all this shit in!

Procedure - If you decide to use a BB gun,drive to an UNMANNED headquarters if
you know of one,go and shoot out the lights in the parking compound.
If you can't find and unnmanned headquarters,shoot out the lights on a manned
headquarters.This however might bring some bell security running out from the
building if they happen to be on duty!After you do this,drive off and come
back the next night around the same time,look and see if the lights are
replaced yet,if not cool.DO this for a couple of days till they replace them.
Mark down how long it takes them,shoot out thelights again a week from then
and wait till the very last day to go and break into the van.

Breaking into the van/compound - All AT&T/Southern Bell Compounds look
basically like this.

   -----------------------------------------------------------------
  |                                              ----               |
  |                                             |Tra |              |
  |                                             | sh |              |
  |     -----------------------------            ----               |
  |    |                             |                              |
  |    |    Main Office              |                              |
  |    |                             |                              |
  |    |                             |                              |
  |    |                             | /\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
  |    |                             |    Barbed Wire Fence         |
  |    |                             |                              |
  |/\/\/\/\/\/\/\/\/\----------------        |----|                 |
  |                |----|                    |Van |                 |
  |                |Van |      |----|        |----|                 |
  |                |----|      |Van |                               |
  |                            |----|                               |
   -----------------------------------------------------------------

 Sneak out around 2 am or so....make sure you and the dude that is going in
 the compound with you have the right equipment.Get your friend with the
 car to pick you both up at a predesignated place(whereever).Drive to the
 compound.Have your friend drop you off somewhere out of sight,tell him to
 come back in 30 minutes or so to pick you up.Also tell him to drive in the
 area,just in case you were being chased on foot you could jump in your
 getaway car and be off.

After he drops you off,walk casually too the compound.Don't look suspicious
(off course at 2 am anyone looks suspicious!).Once you get there,walk around
the whole compound.Make sure there is no security or nosy neighbors.Once this
is done,you have 3 choices.

1.Go home
2.Cut the fence with yuor handy dandy wire cutters.
3.Jump the fence.

If it were my choice i would pick #2....but whatever suits your fancy.Anyhow,
after you are in the compound,get close to one of the vans and out of the
immediate light.Once you have done that,Get out your Jimmy,lockpicks,rock or
whatever.Gaining entry is your job.If you didn't use a rock or something to
break the window,climb in and shut the door.Look around outside to see if you
were observed,if not,clean the bitch out,there is some very nifty stuff in
there!
If you are a hacker,go for the technical manuals,if you are a phreaker,get the
electrical equipment.If your just a thief.GET EVERYTHING!
On fact,my recommendation,get everything anyways!

If you broke the window,get in thieve for about 30 seconds then get the hell
out of there!

From here you have 2 different choices.

1.Throw the shit over the fence,get out and come back for it later.
2.Keep it and get the hell outta there!(my choice).

Anyhow,after you do this,it would be wise to get home and go to bed.
Persons may have observed you doing this and reported it:

"Yes officer,i saw 2 boys dressed in black with backpacks walking down the
street."If you hang around they may catch your ass!
The next day bring your shit over a friends house and sort it out,It would not
be recommended to vandalize the van and everything around it.This will make
them notice it more,thus hightening thier security and making it harder the
next time to do!
------------------------------------------------------------------------------

                               Article #3

                   -=*Your local Southern Bell Manhole*=-

 Where would the fun in hacking be if all one did was sit behind a
moniter all day and type? Hacking is more than a test of intelligence.
The Art Of Hacking requires intelligence, savvy, criminal aptitude,
excellent physical condition, a lot of spare time, and a car. Actually,
a lot of spare time and a car will be enough.
 It seems that the phone company deems us (the public) idiots. They
place valuable items ten feet under the ground, cover them with 100
pound metal frisbees and expect everyone to leave them alone. The
truth is, they might as well hang a sign over each that reads "enter
after dark-bring a friend!".
 We don't want you hopping down a sewer hole, so here's a brief 
description of a Bell manhole. They are about two and a half feet in
diameter, with a Bell sign in the middle surrounded by a set of stars.
There are two holes on either side large enough to fit a crowbar in
comfortably. They are larger than the city sanitation manholes, and 
don't have "Sanitary" (now there's a contradiction in terms) written on
them. 
 Bell manholes are generally located two to three blocks apart on major
streets, more sparsely on smaller avenues. 
 If you search to no avail, simply go to your city's land records hall
and ask for a map of all the AT&T Bell manmholes in your area. If you
are lucky enough to get a smart-assed bitch who asks "What are these
for", you can answer the nosy cunt with a choice response. 
 "I NEED manholes!"
 "I'm hungry."
 "It's fun."
 "I got a Gestapho vehicle parked outside and someone stole the damn
maps outta my glove box!"
 "I'm doing research."
 "I dropped a nickel."
 "I plan on entering one illegally and stealing everything I can fit
in this duffel bag. Why did you think I needed it?"
 "You looked bored."
 "It's my legal right to be able to see this map, dammit, and I am 
going to see it!"
 If worse comes to worse, just look for the Gestapho working in a 
manhole-in other words, some overweight old foge wearing a utillity
belt (that weighs down his pants exposing half of his ass) haunched
over an open manhole holding onto a safety line.
 Now that you got one, enter at your own risk. If your manhole is 
located on a major road, it is best to do it between the hours of
the early morning-avoid 2am or whenever the bars close in your town-
the road is loaded with cops then. If you are lucky enough to find a 
manhole in a secluded area, take a lawn chair and a six pack and make
a day out of it. If your day is darkened by a gray AT&T van pulling
up, haul ass or beat ass. 
 Before leaving, make sure you have the following:

One or more friends.
A crowbar for every person.
A flashlight.
Random tools which include screwdrivers, wirecutters with insulated 
handles, wrenches (adjustable and 7/8 inch).

 Stick your crowbar into a hole (or if there is no hole by an odd 
twist of fate, stick it in the seam between the cover and the hole)
and push down with all your weight. Very few Bell manholes are cemented.
It would be prudent to choose one that isn't. Once you get the cover
off the ground (told you it was heavy), have a friend stick another
crowbar under the lid itself and slide it off to the side. If you don't
stand around with your dick in your hand, you should be done with this
inside a minute. Passing cars will usually slow down, honk, decide you
and your friends are idiots, then drive on. Very few passing cars will
be cops and/or good citizens who would report such activities.
 What are you waiting for? Get in! Go down with a duffel, one at a 
time. Have your other friends step out of view of the road. It is
not advisable to close the manhole cover once you are down there. 
There is no getting it of when you are down there. The air is extremely
bad, and weakening. If you are a smoker, wear a filter mask and don't
light up down there. Who knows? Methane from the sewers could have
leaked in. You don't want a fire in the hole, do you? When you have
descended the full ten feet, feel free to turn on a flashlight and
have a look around you. 
 You will be astonished to see a bunch of boxes on the wall. Among the
boxes there will be manuals (for the impaired technicians, and people
like you who don't know what the hell to do down there but have to pee
real bad), what always seems like miles of wire, and test sets (these 
are great fun). 
 The wire is nothing special. You can use the test sets to tap into
lines while down there or up on a pole. Look inside the newfound boxes.
There are 7/8 inch bolts on them. Turn them to the left about half a 
turn and viola! They open! You will be astounded by endless rows of
chips connected with many nondescript wires! If you are any good at 
translating the diagram on the side of the wall, you can figure out
whose line is connected to which wire. 
 Have a blast with the test set! There will be two screws for your test
set to connect to. Hook the clips on your test set up to these screws.
There will be two alligator clips hanging from the screws. Attach these
to the wires you want to tap into. If no one is using the phone, you 
will simply hear dial tone. But if someone is on, listen in. Who 
knows, you might not pick up boring stuff!
 When you have had your perverted fill, bag the test set and the 
manuals (always good conversational pieces). Overcome your urges to
wreck and decimate the manhole unless you don't mind it being 
concreted! Remember, moderation is the key. The techs probably won't
miss the test sets and manuals, but don't go taking every test set
in the city. 
 Remember, cops don't suddenly appear out of thin air. If you are 
slick, there is little risk. Leave things the way you found them
(covering the manhole is suggested). Flip through the manuals. You'll
probably know more by the end of this expedition than the dummies
who work on these things.
------------------------------------------------------------------------------

                                Article #4
                   SSCS-Splatter Security Control System

In recent months,the nypd in conjuction with securcomm have been developing
a new splatter security control system (sscs). the new system would be almost
impossible to break into (until this text cameout, which by the way, i got from a law enforcement
 officer, for $25 dollars...) from an outside terminal. the system would work
 on the boggle perception..in other words, its a system that fools most
 hackers....this is a very good and important text, so pass it out, with
 caution!!
 part i: getting in:the first part to getting in is finding out the
 local dial-up. operators ussually dont have splatter system dial-ups,
 seeing as how they operate alot like hotels clossed phone line systems...
 anyways..scan for the dial-up if you havent been able to find it out any
 other way. once you have the local dial-up, down grade to 1200 baud..thats
 the normal bps for splatter systems..if 1200 baud doesnt work, always go
 higher, splatter systems never work on less than 1200.Now to the logging on
 part...the system will ask you for your login identifier...this is always
 the the initials of the officer trying to get access to the system..if you
 call up your local police station and get the names offour or five police
 officers try them until you get a correct login...note: only officers who
 have asked for system access have, just becuase they are on the force does
 not mean they have a login...once you have logged in it will give a prompt
 like this:##%:thats the prompt for that officers password..now, heres where
 the scatter system comes in...all passwords must be six letters long, no
 more, no less...the splatter system is designed to fool the hacker in
 question..once you put the first letter in, it does not wait for a carriege,
it just continues in the following manner...(2) proceed:  at this time the
hacker thinks, yeah, im in...wrong, notice the number 2 in parenthesis..the
prompt is asking you for the second letter of the password..once the system
has gone through all six letters of the password, it will either give you an
error statement and disconnect or give you this prompt...##=: this prompt
means that the pasword you entered was correct..and remember the hackers law,
if at first you dont succeed, try and try again!!

i: getting around: the splatter system works on two letter commands...
tf: transfer to another section
dt: disconnect
do: page duty officer
sd: system directory
af: access files
ad: list of other local dial-ups
cr: roster of officers with access
lm: leave memo for another officer

well that sums up the commands...seeing as how the splatter security is
relatively new, this is all i have at the moment..updates will continue.
------------------------------------------------------------------------------

                                Article #5
                         Making your own test set

So, you want a lineman's test set, but are too scared to steal one and
don't want to pay $200.00 for one. Well, this file will tell you how.

        You will need :

                      3 aligator clips. (The extra for if you screw up one)
                      1 ONE PEICE phone (the kind you set down on a table to
                        hang up)

                     Optional:
                     1 wall mount phone jack (For noise-less conecting)

Ok. Now you have your shit, what do you do?

1. slice off the modular plug off the phone. KEEP THE PHONE CORD LONG!!
2. expose about 1/2 an inch of the conductor of the RED and GREEN wires.
2a If there is an black and yellow wire on the phone cord, cut them down to
   get them out of the way. You don't need them
3. Attach the alligator clips to the exposed wires (Try to color cordnate the
   clips so you know what is green and what is red)

easy huh?
                            ____phone
here is s diagram:         /
                          /
#######################################                      red
#                                     #                     /
#       # # # #              #   ###  #==================------==\= \___Clips
#       # # # #              #   ###  #==================------==\= /
#       # # # #                       #                    \
#######################################                     green

Optional modifications:

1) Keep the phone intact.  use the wall mount phone outlet and a peice of 2
 conductor wire (or phone cord type wire). Attach the wire to the block, and
 attach the clips to the wire as shown above.

2) If you have a little money and the phone line to tap has a close by AC
   outlet, use a cordless phone insted of the regular one.  This allows for
   you to be away from the base and still use the target line. Try to get a
   phone that uses CH 10. This ,I have found, is the clearest signal.

  Here is a diagram of the box method:
                         box
                        /
         _____________ /      red
        |             |      /
        |  __         |---------------===\=
        | |__|        |---------------===\=
        |             |    \
        |_____________|     green

------------------------------------------------------------------------------
                                 Article #6
                                VMB Hacking

This file is for all you limp dicked hermaphrodites who want a VMB.
Whether you want this to impress a friend, have people leave messages
or be able to call an 800 number and hear your own voice, this file
should be of aid. Grab a pencil or turn on the printer because we're
going to tell you how to get your own VMB. This file will describe
several methods for finding and/or hacking out VMBs. There is a
problem with VMBs, though.When a business notices a lot of bullshit on their
recorders, they'll switch the VMB line to a voice line and create a new line
for the mailbox service.
Here's a few commands. Grab the MEAD notebook. You'll be taking these
bitches to a lot of pay phones. This is due to the fact that you 
would not be reading this file if you knew what to do already. DO NOT
do this shit from home. Once you have established a VMB feel free to 
call it from your house as long as you don't do maintenance.

 # (pound sign)-Usually used to either to access the password prompt
or the dialing list. It is located right under the 9 key on your 
Southern Bell Pay Phone.

 * (asterisks)-This is usually used to abort the current menu or raise
the volume. We call this the Metallibanger option. This is located 
under the 7 key.

 0 (zero)-Used either to acces the password prompt or to chat with
the friendly neighborhood sub-human-stench-'o-rotten-yeast operator. 
This key is located under the 8 (eight) key and usually looks like a 
zero, or an O with a line through it.

 9 (nine)-This is occasionally used to hang up from the VMB service.
This is located under the 6 (six) key. It is one more than 8 (eight)
and one less than 10 (ten). Don't look for the ten key.
 It would be most useful to find an 800 VMB service. This way, you 
can call anytime from anywhere you like. For free (except in Florida
or Utah-just kidding). Try to find a 24 hour VMB service. This is 
not absolutely needed but is a nice convenience such as toilet paper.
Suppose there is a person in this world that does nocturnal things.
He probably wouldn't want to call your stupid VMB service with a 
chick on his pole.
Here we get into the meat of the file. You need to find out how many
digits the box address is on that particular VMB service. This is
especially a pain in the ass if the system requires you to press the
pound key (#) after you enter a box number. This is because the 
sytem will rarely tell you if you have entered an incorrect number
of digits. If you come across a system like this, good luck. Most
systems we have encountered in our many harsh years of hacking have
been 3 (three) or 4 (four) digit systems. Call up the system and
enter three digits from your touch tone phone. If the system says 
"Incorrect box number" or "Box 666 does not exist" the system is
three-digit oriented. If the system just hangs, it's more than likely
a four digit system. If you enter another digit and nothing happens,
you may have to enter the pound key (#) before or after the box number.
If, during your quest, you find a VMB serivce with more than four digit
boxes, it can mean one of two things. The sytem is very polish-oriented
or there is something very important on some of the boxes. Do as you 
will. Some systems have a time delay feature that will send you a 
message if you haven't entered the right box number in a given amount
of time. Avoid these, they are very confusing.
 Unless you have been unlucky enough to uncover the number to a profess-
ional VMB service, there will usually be 100-200 boxes in use at any given
time. These boxes may be found in clumped form or scattered form. 
Clumped boxes are when there are several boxes all in one area of the
system. This is usually the only area on the system where boxes are 
located. Occasionally, some VMB services have boxes that are scattered
all around the system. Scattered boxes occur when the boxes seem to
have no apparent order for their location. These are more difficult to
find boxes on, but are not impossible.
 Okay, kids, let's start looking for clumps. These are easier to find
than scattered boxes. Start entering numbers starting at 100 for three
digit boxes and 1000 for four digit boxes. Count upwards. Search in 
increments of 25-50 on a three digit system and 100-500 on a four
digit system. This will give you a better chance of finding the clumps
than just guessing. When you come upon a pre-recorded message, write
down the box number and proceeed in searching around the box in 
increments of five. You have probably just uncovered a clump. You're 
cool. If you get an incorrect box message, it doesn't nessecarily mean
that the area is not a clump, it may just mean that the particular 
box is empty. Due to your inexperience, it would be wise not to fool
around with scattered 4 digit systems and always use a condom. 
 Now try to find an empty box. It's easy to hack out a used box, but
a used box has a user or something like that. It is fun to hack out
used boxes if you don't care about the VMB system itself. We did a lot
of that on a paritcular VMB system. I came across a box that said "This
is Harold. Leave a message." I hacked the password to the box. The box
now greeted with "This is Satan. Suck me, Harold!" The box was registered
to Lucifer (BUAHAHAHA). Needless to say, this was an enjoyable message
to any other fellow hackers who came across the box. I got lots of
interesting messages. "Harold! Love the new attitude!" or "Since when
did you change your religion?" or even "Just letting you know, Harold,
I left my bra under your bed. Beter get it out before the wife 
vaccumes". Unfortunately, there was no presonal info available on 
my man Harold. However, the VMB was shut down two days after this 
vengeful escapade and hasn't been up since. Oh well. 
 After you have found a few clusters, you are almost there. All you need
to do is start searching around the numbers by increments of 1. Yep. You
heard me. 1. You are in search of boxes that will ask you to leave a
message bearing no pre-recorded message. Now all ya need to do is access
the password prompt. This command is usualy explained in the main 
menu. If it's not, some common password commands we have come across
are the mystical pound sign (#) and eight (8). The system will then ask
you for the password. This one's up to you. I can give you some 
suggestions, though. The password is USUALLY the same length as the
box numbers. Try some obvious selections. Try entering the box number,
the year (preferably on a four digit system), strings of common digits
such as 111, 1111, 123, 1234, 444, 3333, etc. etc.
 Now, unless God has stricken you down with some sort of inhumane 
ailment or deficency, you should have your own VMB. The default
passwords I listed above are by no means the only ones used. Assuming
you are persistent in your efforts, a box will be yours. The first 
thing you need to do is scan the messages. Ignore the content unless
it's obscene groaning or something and listen to the date of the message.
If the message was recorded a day ago or earlier, hack yourself out
another box to fall back on. The first thing you should do is 
personalize your mailbox. This option is usually thrust upon you in a
long recorded speech every time you access the password to your box.
You need to change the password first of all. Don't be a feeb and use
your phone number, but try to use some other code only the Rainman
could guess. Change the message your box gives to visitors. It's not
wise to leave a message like "I got GODs, I got AT&T Card #s, I got
PBXs, I got Compuserve accounts up the butt!". If you were planning on
leaving a message like that, why don't you cut through the bullshit
and say "I hacked out this VMB for the sole purpose of trading illegal
information. Please destroy this box." Instead, leave a message such as
"This is Erlynmydster. Leave me a message." Leave the hacking aliases
to the boards, guys.
 The box will give you a shitload of other options such as message
forwarding, call placements, group messages, message waiting status,
etc. etc. etc. If you want to fool with these, go ahead, but that's 
sending up the ol' attention flag to the operators.
 The rest of this file will describe the harsh reality of hacking VMBs.
 Hacking a VMB service, to my knowledge, is not a federal offense. You
won't be jailed, you won't be on TV or meet Manson or anything like that.
This means you don't have to jump up and down when you finally get a 
box. A VMB is a tool used by hackers to exchange information under a 
low profile.
  I, being one of the lazy ones, usually hack other's VMBs. I only hack
a mailbox when I need someone to leave me information during the next
day or so. No matter how slick you think you are, the element of chance
is always slicker. I had a dream one time of pulling up to a pay phone
and dialing my VMB. I tried to access the password. The recording claimed
"This box is currently in use". I slam the phone down in disgust. That's
when I notice the guy next to me doing the same thing.
 "Damn VMB's in use." I explain my brash behavior.
 "Yeah, mine too." He looks pissed.
 I dial again. He dials agian. Both in use. I guess you know who the man
standing next to me in this dream is. Harold, the man mentioned
earlier in the text file. After another five minutes of this we figure
out what's going on. Harold smiles and kills me. 
 If there's a lesson in life somewhere in there, I missed it. However,
it does illustrate very useful hacking etiquette. Keep your mouth shut.
This does not proceede "I didn't know what I was doing, honest".
 In summary, a VMB can be a great thing of convenience. The only problem
is, is that they don't last that long. Once you get the hang of it,
though, it will come easily.

------------------------------------------------------------------------------

                                 Article #7

                        The basics of phone anarchy

        This phile will teach you the basics of Phucking people up with
  simple eletronic telephone terrorism!

        1) Silent Phone Killer

        This is a device , easy to make, that will take a persons phone off
        the hook WITHOUT that phucking Alert noise!!

                1) Aquire a wall mount, NOT FLUSH MOUNT, phone jack block.
                   This is a square box about 2" X 2" X 1/2" and has a
                   modular jack in the middle (or about).

                2) Get a peice of thin wire (not unlike that used in the box)

                3) Run the wire from the red to the green terminals as so to
                   connect them.  Then Recover the box.
                   .
                   SIMPLE HUH?!

                4) Now, Plug this baby into the wall via a telephone type
                   wire with a modular plug at each end. ZAP.
                   .
                   Until the device is deteted and removed, it will do 2
                   things:
                      a) Put the circut off hook.
                      b) MUTE all other phone devices in the house by drawing
                         all the phone line current.  So it they pick up the
                         phone to try to dial, even IF the alert tone is on,
                         it will not be herd on the phone.

                         __________________________
    Diag. # 1           I                          I
                        I  MODULAR ####            I
                        I  PLUG -->####            I
                        I        /      \          I
                        I     |/          \|       I
                        I    =|============|=WIRE  I
                        I     |            |       I
                        I    RED         GREEN     I
                         --------------------------

        2)  Loss of hearing!!!

                   This one will make the victim HARD of HEARING.

                        1) Take a medium strength resistor.

                        2) Go outside their house.  Open the phone connection
                           Box on the side of their house.  Wire the resistor
                           in between the red in from the streen and the red
                           going to the home. HEHEHEHE. this will reduce
                           audio, along with causing nemerous other SMALL
                           bugs....

Diag. # 2

                         ---------------------------
                         I___________              I
                         I           I             I
                MODULAR --->####-----I -----^^^-R  I
                PLUG     I  ####-----I ---------G  I
                         I  \ \------I-\________Y  I
                         I    \----- I-\________B  I     ^^^ = RESISTOR
                         I           I             I
                         I           I             I
                         ---------------------------
                     (THIS IS WHAT MOST MODERN ONES LOOK LIKE)
                     (CHECK YOU TARGETS HOME FOR EXACT LAYOUT)

                          Well, That should keep ya busy

------------------------------------------------------------------------------
                               Article #8
                  Bullshitting for information you need

This text is simply a text that i put together from personal experiences.
Most of this information is handy to have and is easy to use, but dont get
too brave with it..or you might get busted.
PART 1
Almost everyone is familiar with quantum computer products, the makers of
quantumlink, pc link, and prodigy.Getting into these networks free of cost is
fairly simple, but most of these networks require private software, so first,
locate a copy of the software that has not been used yet...if it has been used, its of no use to you,
the information you give the network will be saved to your disk and then you
cannot re-use that disk, so if you come accross an un-used copy, make several
copies for your own use.Next thing you must do is get a system password and
certificate number, this is fairly easy unless it has been done too many times.Most of
the time you can call the people up and ask them for a certificate number, usually they will give it to you, but sometimes they want some information from you that they can verify..so heres what you do..
    find a friend thats good about not rollin over on you and that has a different type of computer than the one needed for the system
(the best is a friend that doesnt even have a computer) next..get that friend
to call and get the certificate number,most of the times,the operators will
just check with the local phone company in your area and verify the phone
number you gave them, then they will call you back with your certificate
number..when you get your certificate number,just make sure that your friend
knows what to do if the service people get in touch with him..
example:"yes mr.grungy butt, this is darlene calling for quantum computer
services, it seems that the certificate number we gave you was used for
illegal purposes...","what are you talking about, i dont even own a computer!"
or.."i dont even have the kind of computer needed to access your service!"
legally,quantum cant do anything,they cant prove anything,besides the fact
that someone made the call from that house...thats where this comes in..
"well i have friends over all the time,and they basicly do whatever they please,
one of them might have called.."If they ask for some of your friends names,
give them some, but never give the name of the person that really did it!
When you get your certificate number,give the system a call..they will ask
you for your name,address,and telephone number..If the telephone number
matches up to the area of the address you gave them, your account will be good
for about a month and a half..if they dont match up..your account will be good
for 2 to 3 days...they also ask you for the payment method you want to have,
tell them a credit card,give them a card number..they dont check to see if
the card info matches the name and other info you gave them..so dont worry..
they usually accept mastercard and visa only, so have a number handy when you
sign on..
PART 2
The best way i have found to get information on someone is to call that persons
school,if they are still in school...get the name of a local police officer
and call the school..example:"yes, this is deputy khoeler,with the clay county
sherriffs department..i need some personal information on one of your students
who we think is involved in illegal activities that i cannot discuss, all i
have is the persons name,and any other information you can give me on that
person would be greatly apreciated..thank you.."And then that person is fucked.
I havent quite perfected the method for getting info on other people that are
not in school, but i have had some good results with using the police scheme
and calling the persons place of business..but i wouldnt go to extremes, as it
might ruin the persons career, oh well, fuck'em!
PART 3
Well,thats it for this text,i will be writing followup texts, so dont miss'em!

greets to blackjack, digital deviant, johnny rotten and the other iha members..

this text is being distributed hy the iha and the bnw..two kick ass groups!

the fbi sucks big green donkey dicks!


------------------------------------------------------------------------------
                                  Article  #9

                            Tymnet Worldwide Access
                     Numbers sorted by,city,state and country.

                                           DIALUP ACCESS           M
                           PROV              100'S BPS             N
 NODE  CITY                 ST CNTRY DENS  3 12 24 96 ACCESS NO.   P COMMENTS
 ----- -------------------- -- ----- ----  ---------- ------------ - --------
 04003 Buenos Aires             ARG  2     C          (1) 40-01-91                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-92                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-93                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-94                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-95                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-96                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-97                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-98                    
 04003 Buenos Aires             ARG  2     C          (1) 40-01-99                    
 04003 All Cities               ATG  3     B B        809/462-0210                    
 04003 Melbourne                AUS  Pac   C C  C     (3)416-2146  Y                  
 07313 Melbourne                AUS  Pac   C C  C     (3)416-2146  Y                  
 03335 Sydney                   AUS  Pac   C C  C     (2)290-3400  Y                  
 04003 Sydney                   AUS  Pac   C C  C     (2)290-3400  Y                  
 04003 Outside Vienna           AUT  2       C  C     229015                          
 04003 Outside Vienna           AUT  2       C  C     229017                          
 04003 Outside Vienna           AUT  2     C C        229016                          
 04003 Vienna                   AUT  2       C  C     (222) 50143                     
 04003 Vienna                   AUT  2     C          (222) 50124                     
 03733 Brussels                 BEL  E1      C  C     (2) 725-5060 Y 48,              
 04003 Brussels                 BEL  E1      C  C     (2) 725-5060 Y 48,              
 04003 Mons                     BEL  E1      C  C     (65)36-0051                     
 11720 Mons                     BEL  E1      C  C     (65)36-0051                     
 04003 All Cities               BHR  3       C        245361                          
 04003 All Cities               BHR  3     C          242525                          
 04003 All Cities               BHS  3     B B  C     809/323-7799                    
 04003 All Cities               BMU  2     B B        809/292-4327                    
 04003 All Cities               BRB  3     B B        809/426-7760                    
 07540 Calgary              AB  CAN  CanH  C C  C     403/232-6653 Y                  
 11114 Calgary              AB  CAN  CANH          C  403/264-5472 Y                  
       Burnaby              BC  CAN  CanH  C C  C     604/683-7620 Y                  
       Vancouver            BC  CAN  CanH  C C  C     604/683-7620 Y                  
 06171 Halifax              NS  CAN  CANL  C C  C     902/492-4901 Y                  
 07675 Dundas               ON  CAN  CanH  C C  C     416/628-5908 Y                  
       Hull/Ottawa          ON  CAN  CanH       C     613/563-2970                    
       Hull/Ottawa          ON  CAN  CanH  C C        613/563-2910                    
       Kitchener            ON  CAN  CanL  C C  C     519/742-7613 Y                  
       Ottawa               ON  CAN  CanH       C     613/563-2970                    
       Ottawa               ON  CAN  CanH  C C        613/563-2910                    
       Toronto              ON  CAN  CanH  C C  C     416/365-7630 Y                  
       Windsor              ON  CAN  CanL       C     519/977-7619 Y                  
       Windsor              ON  CAN  CanL  C C        519/977-7256                    
       Montreal/St. Laurent QU  CAN  CanH       C     514/747-1370                    
       Montreal/St. Laurent QU  CAN  CanH  C C        514/747-2996                    
       Quebec City          QU  CAN  CanH  C C  C     418/647-1116 Y                  
 04003 All Cities               CAY  3     B B        809/949-7100                    
 02040 Geneva                   CHE  E1    C C  C     (22)782-9329                    
 04003 Geneva                   CHE  E1    C C  C     (22)782-9329                    
 05651 Zurich                   CHE  E1      C  C     (1) 730-9673                    
 04003 Zurich                   CHE  E1      C  C     (1) 730-9673                    
 04003 Cologne                  DDR  E1      C  C     (221)210196                     
 05664 Cologne                  DDR  E1      C  C     (221)210196                     
 03465 Frankfurt                DDR  E1      C        (69)666-8131                    
 03465 Frankfurt                DDR  E1    C          (69)668011                      
 03465 Frankfurt                DDR  E1    C C        (69)666-4021                    
 04003 Frankfurt                DDR  E1      C        (69)666-8131                    
 04003 Frankfurt                DDR  E1    C          (69)668011                      
 04003 Frankfurt                DDR  E1    C C        (69)666-4021                    
 03146 Munich                   DDR  E1    C C  C     (89)350-7682                    
 04003 Munich                   DDR  E1    C C  C     (89)350-7682                    
 04003 Copenhagen               DNK  E2    C C  C     31-18-63-33  Y                  
 07177 Copenhagen               DNK  E2    C C  C     31-18-63-33  Y                  
 04003 All Cities               DOM  3     B B        809/685-6155                    
 04003 Lyon                     FRA  E1    C C  C     (7) 8930173  Y                  
 07262 Lyon                     FRA  E1    C C  C     (7) 8930173  Y                  
 02005 Paris                    FRA  E1    C C  C     (1)46027003  Y                  
 02022 Paris                    FRA  E1      C        (1)47719133                     
 04003 Paris                    FRA  E1      C        (1)47719133                     
 04003 Paris                    FRA  E1      C  C     (1)46025500  Y                  
 04003 Paris                    FRA  E1    C C  C     (1)46025750                     
 04003 Paris                    FRA  E1    C C  C     (1)46027003  Y                  
 05555 Paris                    FRA  E1      C  C     (1)46025500  Y                  
 05555 Paris                    FRA  E1    C C  C     (1)46025750                     
 04003 Aberdeen                 GBR  1     C C  C     (224) 210701                    
 04003 Belfast                  GBR  1     C C  C     (232) 331284                    
 03627 Belfast                  GBR  E1    C C  C     (232) 234467 Y                  
 04003 Belfast                  GBR  E1    C C  C     (232) 234467                    
 04003 Birmingham               GBR  1     C C  C     (21)633-3474                    
 07663 Birmingham               GBR  E1    C C  C     (21)632-6636 Y                  
 04003 Birmingham               GBR  E1    C C  C     (21)632-6636                    
 04003 Bristol                  GBR  1     C C  C     (272) 211545                    
 11744 Bristol                  GBR  E1    C C  C     (272) 255392 Y                  
 04003 Bristol                  GBR  E1    C C  C     (272) 255392 Y                  
 04003 Cambridge                GBR  1     C C  C     (223) 460127                    
 04267 Cambridge                GBR  E1    C C  C     (223) 845860 Y                  
 04003 Cambridge                GBR  E1    C C  C     (223) 845860 Y                  
 04003 Cardiff                  GBR  1     C C  C     (222) 344184                    
 04003 Chelmsford               GBR  1     C C  C     (245) 491323                    
 04003 Edinburgh                GBR  1     C C  C     (31)313-2137                    
 06363 Edinburgh                GBR  E1    C C  C     (31)313-2172 Y                  
 04003 Edinburgh                GBR  E1    C C  C     (31)313-2172                    
 04003 Exeter                   GBR  1     C C  C     (392) 421565                    
 04003 Glasgow                  GBR  1     C C  C     (41)204-1722                    
 04003 Hastings                 GBR  1     C C  C     (424) 722788                    
 04003 Ipswich                  GBR  1     C C  C     (473) 210212                    
 04003 Kings Lynn               GBR  1     C C  C     (553) 691090                    
 04003 Leamington               GBR  1     C C  C     (926) 451419                    
 04003 Leeds                    GBR  1     C C  C     (532) 440024                    
 11736 Leeds                    GBR  E1    C C  C     (532) 341838 Y                  
 04003 Leeds                    GBR  E1    C C  C     (532) 341838 Y                  
 04003 Liverpool                GBR  1     C C  C     (51)255-0230                    
 04003 London                   GBR  1     C C  C     (71)490-2200                    
 11225 London                   GBR  E1    C C  C     (71)489-8571 Y                  
 11223 London                   GBR  E1    C C  C     (71)489-8571 Y                  
 04003 London                   GBR  E1    C C  C     (71)489-8571 Y                  
 11074 London                   GBR  E1    C C  C     (81)566-7260 Y                  
 11361 London                   GBR  E1    C C  C     (81)566-7260 Y                  
 04003 London                   GBR  E1    C C  C     (81)566-7260 Y                  
 04003 Luton                    GBR  1     C C  C     (582) 481818                    
 04003 Manchester               GBR  1     C C  C     (61)834-5533                    
 04003 Newcastle                GBR  1     C C  C     (91)261-6858                    
 04003 Northhampton             GBR  1     C C  C     (604) 33395                     
 04003 Nottingham               GBR  1     C C  C     (602) 506005                    
 04003 Oxford                   GBR  1     C C  C     (865) 798949                    
 04003 Plymouth                 GBR  1     C C  C     (752) 603302                    
 04003 Reading                  GBR  1     C C  C     (734) 500722                    
 04003 Southampton              GBR  1     C C  C     (703) 634530                    
 04003 Guatemala City           GTM  2       B        (2) 345-999                     
 04003 Guatemala City           GTM  2     B          (2) 345-599                     
 04003 Agana Heights            GUM  *     C C        671/477-2222                    
 04003 Hong Kong                HKG  2     B B  C     865-7414                        
 04003 All Cities               HND  2     B B        320-544                         
 04003 Afula                    ISR  3     B B  C     (6) 596658                      
 04003 Ashdod                   ISR  3     B B  C     (8) 542999                      
 04003 Bezeq                    ISR  3     B B  C     (57) 36029                      
 04003 Eilat                    ISR  3     B B  C     (59) 75147                      
 04003 Hadera                   ISR  3     B B  C     (6) 332409                      
 04003 Haifa                    ISR  3     B B  C     (4) 525421                      
 04003 Haifa                    ISR  3     B B  C     (4) 673235                      
 04003 Haifa                    ISR  3     B B  C     (4) 674203                      
 04003 Haifa                    ISR  3     B B  C     (4) 674230                      
 04003 Herzeliya                ISR  3     B B  C     (52) 545251                     
 04003 Jerusalem                ISR  3     B B  C     (2) 242675                      
 04003 Jerusalem                ISR  3     B B  C     (2) 246363                      
 04003 Jerusalem                ISR  3     B B  C     (2) 248551                      
 04003 Jerusalem                ISR  3     B B  C     (2) 814396                      
 04003 Nahariya                 ISR  3     B B  C     (4) 825393                      
 04003 Netanya                  ISR  3     B B  C     (53) 348588                     
 04003 Rechovot                 ISR  3     B B  C     (8) 469799                      
 04003 Tel Aviv                 ISR  3     B B  C     (3) 203435                      
 04003 Tel Aviv                 ISR  3     B B  C     (3) 546-3837                    
 04003 Tel Aviv                 ISR  3     B B  C     (3) 751-2504                    
 04003 Tel Aviv                 ISR  3     B B  C     (3) 751-3799                    
 04003 Tel Aviv                 ISR  3     B B  C     (3)752-0110                     
 04003 Tiberias                 ISR  3     B B  C     (6) 790274                      
 04003 Tzfat                    ISR  3     B B  C     (6) 973282                      
 04003 Milan                    ITA  E2      C  C     (2)26412450                     
 11665 Milan                    ITA  E2      C  C     (2)26412450                     
 04003 All Cities               JAM  2     B B        809/924-9915                    
 07406 Akita                    JPN  *       B        (188) 655733                    
 07406 Akita                    JPN  *       B  C     (188) 655734                    
 07406 Akita                    JPN  *     B          (188) 655735                    
 07406 Atsugi                   JPN  *       B  C     (462) 210404                    
 07406 Atsugi                   JPN  *     B          (462) 215331                    
 07406 Fukui                    JPN  *       B  C     (776) 358840                    
 07406 Fukui                    JPN  *     B          (776) 343308                    
 07406 Fukuoka                  JPN  *       B  C     (92)474-7196                    
 07406 Fukuoka                  JPN  *     B          (92)474-7076                    
 07406 Hamamatsu                JPN  *     B          (534) 567355                    
 07406 Hamanatsu                JPN  *       B  C     (534) 567231                    
 07406 Hiroshima                JPN  *       B  C     (82)243-9270                    
 07406 Hiroshima                JPN  *     B          (82)241-6857                    
 07406 Kagoshima                JPN  *       B        (992) 228954                    
 07406 Kagoshima                JPN  *       B  C     (992) 229154                    
 07406 Kagoshima                JPN  *     B          (992) 228598                    
 07406 Kanazawa                 JPN  *       B  C     (762) 242341                    
 07406 Kanazawa                 JPN  *     B          (762) 242351                    
 07406 Kobe                     JPN  *       B  C     (78)242-1115                    
 07406 Kobe                     JPN  *     B          (78)242-1097                    
 07406 Kumamoto                 JPN  *       B  C     (96)354-3065                    
 07406 Kumamoto                 JPN  *     B          (96)355-5233                    
 07406 Kyoto                    JPN  *       B  C     (75)431-6205                    
 07406 Kyoto                    JPN  *     B          (75)431-6203                    
 07406 Matsuyama                JPN  *       B  C     (899) 324207                    
 07406 Matsuyama                JPN  *     B          (899) 322975                    
 07406 Mito                     JPN  *       B  C     (292) 244213                    
 07406 Mito                     JPN  *     B          (292) 241675                    
 07406 Morioka                  JPN  *       B  C     (196) 547315                    
 07406 Morioka                  JPN  *     B          (196) 548513                    
 07406 Nagagsaki                JPN  *       B  C     (958) 286077                    
 07406 Nagagsaki                JPN  *     B          (958) 286088                    
 07406 Nagoya                   JPN  *       B  C     (52)204-1466                    
 07406 Nagoya                   JPN  *     B          (52)204-2275                    
 07406 Naha                     JPN  *       B  C     (988) 613414                    
 07406 Naha                     JPN  *     B          (988) 614002                    
 07406 Niigata                  JPN  *       B  C     (25)241-5410                    
 07406 Niigata                  JPN  *     B          (25)241-5409                    
 07406 Okayama                  JPN  *       B  C     (862) 314993                    
 07406 Okayama                  JPN  *     B          (862) 326760                    
 07406 Osaka                    JPN  *       B        (6) 271-9029                    
 07406 Osaka                    JPN  *       B  C     (6) 271-6876                    
 07406 Osaka                    JPN  *     B          (6) 271-9028                    
 07406 Sapporo                  JPN  *       B  C     (11)281-4421                    
 07406 Sapporo                  JPN  *     B          (11)281-4343                    
 07406 Sendai                   JPN  *       B  C     (22)231-5355                    
 07406 Sendai                   JPN  *     B          (22)231-5741                    
 07406 Shizuoka                 JPN  *       B  C     (542) 843398                    
 07406 Shizuoka                 JPN  *     B          (542) 843393                    
 07406 Takamatsu                JPN  *       B  C     (878) 230501                    
 07406 Takamatsu                JPN  *     B          (878) 230502                    
 07406 Tokyo                    JPN  *          C     (3)3555-9696                    
 07406 Tokyo                    JPN  *       B        (3)3555-9526                    
 07406 Tokyo                    JPN  *     B          (3)3555-9525                    
 07406 Toyama                   JPN  *       B  C     (764) 417769                    
 07406 Toyama                   JPN  *     B          (764) 417578                    
 07406 Tuchiura                 JPN  *       B  C     (298) 556121                    
 07406 Tuchiura                 JPN  *     B          (298) 555082                    
 07406 Urawa                    JPN  *       B  C     (488) 339341                    
 07406 Yokohama                 JPN  *       B  C     (45)453-7637                    
 07406 Yokohama                 JPN  *     B          (45)453-7757                    
 04003 Seoul                    KOR  3       C        (2) 792-1455                    
 04003 Curacao                  NDA  3     C C        (9) 239251                      
 04003 Curacao & St. Martin     NDA  3     C C        0251           Local No.        
 02477 Alkmaar                  NLD  E1    C C  C     (72) 155190  Y                  
 04003 Alkmaar                  NLD  E1    C C  C     (72) 155190  Y                  
 04003 Amsterdam                NLD  E1    C C  C  C  (20) 6610094 Y -75,             
 04274 Amsterdam                NLD  E1    C C  C  C  (20) 6610094 Y -75,             
 04003 Eindhoven                NLD  E1    C C  C     (4902) 45530 Y                  
 05205 Eindhoven                NLD  E1    C C  C     (4902) 45530 Y                  
 04003 Rotterdam                NLD  E1    C C  C  C  (010)4532002 Y -75,             
 12161 Rotterdam                NLD  E1    C C  C  C  (010)4532002 Y -75,             
 06111 The Hague                NLD  E1            C  (70) 3818448 Y 4800             
 04003 The Hague                NLD  E1            C  (70) 3818448 Y 4800             
 06111 The Hague                NLD  E1      C        (70) 3814641                    
 04003 The Hague                NLD  E1      C        (70) 3814641                    
 06111 The Hague                NLD  E1    C C  C     (70) 3475032 Y                  
 04003 The Hague                NLD  E1               (70) 3475032 Y                  
 04003 All Cities               PAN  3          C     636-727                         
 04003 All Cities               PAN  3     B B        639-055                         
 04003 Lima                     PER  4       C        (14) 240-478                    
 04003 Manila                   PHL  2     B B        (2) 815-1553                    
 04003 Manila                   PHL  2     B B        (2) 815-1555                    
 04003 Manila                   PHL  2     B B        (2) 817-1581                    
 04003 Manila                   PHL  2     B B        (2) 817-1791                    
 04003 Manila                   PHL  2     B B        (2) 817-1796                    
 04003 Manila                   PHL  2     C          (2) 521-7901                    
 04003 Manila                   PHL  2     C          (2) 817-8811                    
 04003 Manila                   PHL  2     C          (2) 819-1009                    
 04003 Manila                   PHL  2     C          (2) 819-1011                    
 04003 Manila                   PHL  2     C          (2) 819-1550                    
 04003 Mayaquez/Ponce           PRI  *     B B        809/462-4213                    
 04003 San Juan                 PRI  *          C     809/724-6070                    
 04003 San Juan                 PRI  *     B B        809/725-1882                    
 04003 San Juan                 PRI  *     B B        809/725-4343                    
 04003 San Juan                 PRI  *     C C        809/725-3501                    
 04003 San Juan                 PRI  *     C C        809/725-4702                    
 04003 Alkobar                  SAU  5       C        (3) 8981025                     
 04003 Jeddah                   SAU  5          C     (2) 6691377                     
 04003 Jeddah                   SAU  5       C        (2) 6690708                     
 04003 Riyadh                   SAU  5          C     (1) 4631038                     
 04003 Riyadh                   SAU  5       C        (1) 4658803                     
 04146 Stockholm                SWE  E2    C C  C     (8) 29-4782  Y                  
 04003 Stockholm                SWE  E2    C C  C     (8) 29-4782  Y                  
 04003 All Cities               TTO  2     C C        809/627-0854                    
 04003 All Cities               TTO  2     C C        809/627-0855                    
       Adak                 AK  USA  ALAS  B B  C     907/592-2557                    
       Anchorage            AK  USA  ALAS       C     907/258-6607 Y                  
       Anchorage            AK  USA  ALAS  B B        907/258-7222                    
       Barrow               AK  USA  ALAS  B B        907/852-2425   Stat Mux         
       Bethel               AK  USA  ALAS  B B        907/543-2411   Stat Mux         
       Cantwell             AK  USA  ALAS  B B  C     907/768-2700                    
       Cordova              AK  USA  ALAS  B B        907/424-3744                    
       Craig                AK  USA  ALAS  B B  C     907/826-2948                    
       Dead horse           AK  USA  ALAS  B B        907/659-2777                    
       Delta Junction       AK  USA  ALAS  B B        907/895-5070                    
       Dillingham           AK  USA  ALAS  B B        907/842-2688   Stat Mux         
       Dutch Harbor         AK  USA  ALAS  B B  C     907/581-1820                    
       Fairbanks            AK  USA  ALAS       C     907/452-5848 Y                  
       Fairbanks            AK  USA  ALAS  B B        907/456-3282                    
       Glennallen           AK  USA  ALAS  B B        907/822-5231                    
       Haines               AK  USA  ALAS  B          907/766-2171                    
       Healy                AK  USA  ALAS  B B  C     907/683-1350                    
       Homer                AK  USA  ALAS  B B        907/235-5239                    
       Juneau               AK  USA  ALAS       C     907/789-1976 Y                  
       Juneau               AK  USA  ALAS  B B        907/789-7009                    
       Kenai                AK  USA  ALAS  B B        907/262-1990                    
       Ketchikan            AK  USA  ALAS  B B        907/225-1871   Stat Mux         
       King Salmon          AK  USA  ALAS  B B        907/246-3049                    
       Kodiak               AK  USA  ALAS  B B        907/486-4061   Stat Mux         
       Kotzebue             AK  USA  ALAS  B B        907/442-2602                    
       Mcgrath              AK  USA  ALAS  B B        907/524-3256   Stat Mux         
       Menana               AK  USA  ALAS  B          907/832-5214                    
       Nome                 AK  USA  ALAS  B B        907/443-2256   Stat Mux         
       Northway             AK  USA  ALAS  B B        907/778-2301   Stat Mux         
       Palmer/Wasilla       AK  USA  ALAS  B B        907/745-0200                    
       Petersburg           AK  USA  ALAS  B          907/772-3878                    
       Prudhoe Bay          AK  USA  ALAS  B B        907/659-2777                    
       Seward               AK  USA  ALAS  B B        907/224-3126   Stat Mux         
       Sitka                AK  USA  ALAS  B B        907/747-5887   Stat Mux         
       Skagway              AK  USA  ALAS  B          907/983-2170                    
       Soldotna/Kenai       AK  USA  ALAS  B B        907/262-1990                    
       St. Paul             AK  USA  ALAS  B B        907/546-2320   Stat Mux         
       Tanana               AK  USA  ALAS  B B        907/366-7167   Stat Mux         
       Tok                  AK  USA  ALAS  B          907/883-4747                    
       Unalaska/Dutch Hbr.  AK  USA  ALAS  B B  C     907/581-1820                    
       Valdez               AK  USA  ALAS  B B        907/835-4987   Stat Mux         
       Wasilla              AK  USA  ALAS  B B        907/745-0200                    
       Whittier             AK  USA  ALAS  B B        907/472-2467   Stat Mux         
       Wrangell             AK  USA  ALAS  B          907/874-2394                    
       Yakutat              AK  USA  ALAS  B B        907/784-3453   Stat Mux         
 03324 Anniston             AL  USA  LOW   B B  C     205/236-3342 Y                  
 02246 Birmingham           AL  USA  HIGH  B B        205/942-4141                    
 03453 Birmingham           AL  USA  HIGH          C  205/942-0297 Y                  
 04415 Birmingham           AL  USA  HIGH       C     205/942-7898 Y                  
 07723 Dothan               AL  USA  LOW   B B  C     205/794-7954 Y                  
 05221 Florence             AL  USA  LOW   B B  C     205/760-0030 Y                  
 10305 Gadsden              AL  USA  LOW   B B  C     205/543-3550 Y                  
 03122 Huntsville           AL  USA  MED   B B        205/882-3003                    
 11006 Huntsville           AL  USA  MED        C     205/880-8912 Y                  
 03546 Mobile               AL  USA  MED   B B        205/343-8414                    
 11241 Mobile               AL  USA  MED        C     205/460-2515 Y                  
 03545 Montgomery           AL  USA  LOW   B B  C     205/265-4570 Y                  
 11321 Northport            AL  USA  LOW   B B  C     205/758-1116 Y                  
 05431 Opelika              AL  USA  LOW   B B  C     205/742-9040 Y                  
 11321 Tuscaloosa/Northport AL  USA  LOW   B B  C     205/758-1116 Y                  
 06305 Fayetteville         AR  USA  LOW   B B  C     501/442-0234 Y                  
 06771 Ft. Smith            AR  USA  LOW   B B  C     501/782-2486 Y                  
 07463 Hot Springs          AR  USA  LOW   B B  C     501/623-3576 Y                  
 07464 Jonesboro            AR  USA  LOW   B B  C     501/935-7957 Y                  
 11257 Little Rock          AR  USA  MED   B B  C     501/666-6886 Y                  
 11313 Little Rock          AR  USA  MED           C  501/666-1224 Y                  
 04073 Pine bluff           AR  USA  LOW   B B  C     501/535-2629 Y                  
 06305 Springdale/Fayettevl AR  USA  LOW   B B  C     501/442-0234 Y                  
 03471 Flagstaff            AZ  USA  LOW   B B  C     602/774-3857 Y                  
 02364 Mesa/Phoenix         AZ  USA  HIGH  B B        602/254-5811                    
 02425 Mesa/Phoenix         AZ  USA  HIGH       C     602/258-0554 Y                  
 03663 Mesa/Phoenix         AZ  USA  HIGH          C  602/258-4528 Y                  
 05763 Mesa/Phoenix         AZ  USA  HIGH       C     602/258-0554 Y                  
 02364 Phoenix              AZ  USA  HIGH  B B        602/254-5811                    
 02425 Phoenix              AZ  USA  HIGH       C     602/258-0554 Y                  
 03663 Phoenix              AZ  USA  HIGH          C  602/258-4528 Y                  
 03664 Phoenix              AZ  USA  HIGH          C  602/257-0629   TYM-X25          
 03664 Phoenix              AZ  USA  HIGH       C     602/254-3423   TYM-X25          
 05763 Phoenix              AZ  USA  HIGH       C     602/258-0554 Y                  
 04157 Tucson               AZ  USA  MED   B B  C     602/297-2239 Y                  
 05603 Yuma                 AZ  USA  LOW   B B  C     602/343-9000 Y                  
 04175 Alameda/Oakland      CA  USA  HIGH  B B        415/430-2900                    
 05341 Alameda/Oakland      CA  USA  HIGH       C     415/633-1896 Y                  
 11314 Alameda/Oakland      CA  USA  HIGH          C  415/638-7904                    
 03407 Alhambra             CA  USA  MED   B B        818/308-1800                    
 10244 Alhambra             CA  USA  MED        C     818/308-1994 Y                  
 02631 Anaheim/Newprt Beach CA  USA  HIGH  B B        714/756-8341                    
 02644 Anaheim/Newprt Beach CA  USA  HIGH          C  714/752-1493 Y                  
 04236 Anaheim/Newprt Beach CA  USA  HIGH       C     714/852-8141 Y                  
 06457 Anaheim/Newprt Beach CA  USA  HIGH       C     714/852-8141 Y                  
 05350 Antioch              CA  USA  LOW   B B  C     415/754-8222 Y                  
 03407 Arcadia/Alhambra     CA  USA  MED   B B        818/308-1800                    
 10244 Arcadia/Alhambra     CA  USA  MED        C     818/308-1994 Y                  
 03657 Bakersfield          CA  USA  LOW   B B  C     805/325-0371 Y                  
 04411 Belmont/Redwood City CA  USA  HIGH       C     415/361-8701 Y                  
 04603 Belmont/Redwood City CA  USA  HIGH  B B        415/366-1092                    
 06301 Belmont/Redwood City CA  USA  HIGH          C  415/367-0334 Y                  
 04175 Berkeley/Oakland     CA  USA  HIGH  B B        415/430-2900                    
 05341 Berkeley/Oakland     CA  USA  HIGH       C     415/633-1896 Y                  
 11314 Berkeley/Oakland     CA  USA  HIGH          C  415/638-7904 Y                  
 03235 Beverly Hills/Shr Ok CA  USA  MED   B B  C     818/789-9557 Y                  
 03410 Beverly Hills/Shr Ok CA  USA  MED   B B        818/789-9002                    
 04353 Beverly Hills/Shr Ok CA  USA  MED   B B  C     818/789-9557 Y                  
 02443 Burbank              CA  USA  LOW   B B  C     818/841-4795 Y                  
 04504 Burlingame/So. S.F.  CA  USA  LOW   B B  C     415/588-3043 Y                  
 03235 Canoga Park/Shrm Oak CA  USA  MED   B B  C     818/789-9557 Y                  
 03410 Canoga Park/Shrm Oak CA  USA  MED   B B        818/789-9002                    
 04353 Canoga Park/Shrm Oak CA  USA  MED   B B  C     818/789-9557 Y                  
 11271 Cathedral City       CA  USA  LOW   B B  C     619/324-0920 Y                  
 03307 Chico                CA  USA  LOW   B B  C     916/343-4401 Y                  
 02655 Colton               CA  USA  MED   B B        714/370-1200                    
 04046 Colton               CA  USA  MED           C  714/872-0394 Y                  
 05325 Colton               CA  USA  MED   B B  C     714/422-0222 Y                  
 04556 Concord/Walnut Creek CA  USA  MED   B B  C     415/935-1507 Y                  
 05362 Concord/Walnut Creek CA  USA  MED   B B  C     415/935-1507 Y                  
 10436 Concord/Walnut Creek CA  USA  MED   B B  C     415/935-1507 Y                  
 07652 Corona               CA  USA  LOW   B B  C     714/737-5510 Y                  
 04263 Covina/Diamond Bar   CA  USA  MED   B B  C     714/860-0057 Y                  
 07434 Davis                CA  USA  LOW   B B  C     916/758-3551 Y                  
 04263 Diamond Bar          CA  USA  MED   B B  C     714/860-0057 Y                  
 03407 El Monte/Alhambra    CA  USA  MED   B B        818/308-1800                    
 10244 El Monte/Alhambra    CA  USA  MED        C     818/308-1994 Y                  
 04755 El Segundo           CA  USA  MED   B B        213/643-2907                    
 10363 El Segundo           CA  USA  MED        C     213/643-4228 Y                  
 04262 Escondido/Vista      CA  USA  MED   B B  C     619/941-6700 Y                  
 11052 Eureka               CA  USA  LOW   B B  C     707/445-3021 Y                  
 11052 Eureka               CA  USA  LOW   B B  C     707/445-9271 Y                  
 10072 Fairfield            CA  USA  LOW   B B  C     707/426-5900 Y                  
 07117 Fremont              CA  USA  MED   B B  C     415/490-7366 Y                  
 04107 Fresno               CA  USA  LOW   B B  C     209/442-4328 Y                  
 02443 Glendale/Burbank     CA  USA  LOW   B B  C     818/841-4795 Y                  
 04175 Hayward/Oakland      CA  USA  HIGH  B B        415/430-2900                    
 05341 Hayward/Oakland      CA  USA  HIGH       C     415/633-1896 Y                  
 11314 Hayward/Oakland      CA  USA  HIGH          C  415/638-7904 Y                  
 05241 Inglewood/Vernon     CA  USA  HIGH  B B        213/587-0030                    
 05242 Inglewood/Vernon     CA  USA  HIGH  B B        213/587-0030                    
 06575 Inglewood/Vernon     CA  USA  HIGH  B B  C     213/587-7514 Y                  
 07533 Inglewood/Vernon     CA  USA  HIGH          C  213/588-8128 Y                  
 10325 Inglewood/Vernon     CA  USA  HIGH  B B  C     213/587-7514 Y                  
 02631 Irvine/Newport Beach CA  USA  HIGH  B B        714/756-8341                    
 02644 Irvine/Newport Beach CA  USA  HIGH          C  714/752-1493 Y                  
 04236 Irvine/Newport Beach CA  USA  HIGH  B B  C     714/852-8141 Y                  
 02614 Lancaster            CA  USA  LOW   B B  C     805/945-4962 Y                  
 03406 Long Beach           CA  USA  MED   B B        213/435-0900                    
 07404 Long Beach           CA  USA  MED   B B  C     213/436-6033 Y                  
 06022 Los Alamos/St. Maria CA  USA  LOW   B B  C     805/922-3308 Y                  
 03725 Los Altos/San Jose   CA  USA  HIGH          C  408/432-0804 Y                  
 06605 Los Altos/San Jose   CA  USA  HIGH  B B  C     408/432-8618 Y                  
 07205 Los Altos/San Jose   CA  USA  HIGH  B B        408/432-3430                    
 05241 Los Angeles/Vernon   CA  USA  HIGH  B B        213/587-0030                    
 05242 Los Angeles/Vernon   CA  USA  HIGH  B B        213/587-0030                    
 06575 Los Angeles/Vernon   CA  USA  HIGH  B B  C     213/587-7514 Y                  
 06733 Los Angeles/Vernon   CA  USA  HIGH          C  213/588-4712   TYM-X25          
 06733 Los Angeles/Vernon   CA  USA  HIGH       C     213/588-4639   TYM-X25          
 07533 Los Angeles/Vernon   CA  USA  HIGH          C  213/588-8128 Y                  
 10325 Los Angeles/Vernon   CA  USA  HIGH  B B  C     213/587-7514 Y                  
 04755 Mar Vista/El Segundo CA  USA  MED   B B        213/643-2907                    
 10363 Mar Vista/El Segundo CA  USA  MED   B B  C     213/643-4228 Y                  
 10363 MarinaDelRey/El Sgnd CA  USA  MED   B B  C     213/643-4228 Y                  
 04755 MarinaDelRey/El Sngd CA  USA  MED   B B        213/643-2907                    
 10036 Merced               CA  USA  LOW   B B  C     209/383-7593 Y                  
 11402 Modesto              CA  USA  LOW   B B  C     209/527-0150 Y                  
 10474 Monterey             CA  USA  LOW   B B  C     408/375-2644 Y                  
 11272 Moorpark             CA  USA  LOW   B B  C     805/523-0203 Y                  
 07632 Napa                 CA  USA  LOW   B B  C     707/257-6810 Y                  
 02631 Newport Beach        CA  USA  HIGH  B B        714/756-8341                    
 02644 Newport Beach        CA  USA  HIGH          C  714/752-1493 Y                  
 04236 Newport Beach        CA  USA  HIGH  B B  C     714/852-8141 Y                  
 05461 Newport Beach        CA  USA  HIGH          C  714/250-4909   TYM-X25          
 05461 Newport Beach        CA  USA  HIGH       C     714/250-3208   TYM-X25          
 03406 Norwalk/Long Beach   CA  USA  MED   B B        213/435-0900                    
 07404 Norwalk/Long Beach   CA  USA  MED   B B  C     213/436-6033 Y                  
 02076 Oakland              CA  USA  HIGH          C  415/568-1662   TYM-X25          
 02076 Oakland              CA  USA  HIGH       C     415/568-3551   TYM-X25          
 04175 Oakland              CA  USA  HIGH  B B        415/430-2900                    
 05341 Oakland              CA  USA  HIGH       C     415/633-1896 Y                  
 11314 Oakland              CA  USA  HIGH          C  415/638-7904 Y                  
 04263 Ontario/Diamond Bar  CA  USA  MED   B B  C     714/860-0057 Y                  
 04154 Oxnard/Port Hueneme  CA  USA  MED   B B  C     805/985-7843 Y                  
 04556 Pacheco/Walnut Creek CA  USA  LOW   B B  C     415/935-1507 Y                  
 05362 Pacheco/Walnut Creek CA  USA  MED   B B  C     415/935-1507 Y                  
 10436 Pacheco/Walnut Creek CA  USA  MED   B B  C     415/935-1507 Y                  
 11271 Palm Sprngs/Cath Cty CA  USA  LOW   B B  C     619/324-0920 Y                  
 04411 Palo Alto/Redwd City CA  USA  HIGH       C     415/361-8701 Y                  
 04603 Palo Alto/Redwd City CA  USA  HIGH  B B        415/366-1092                    
 06301 Palo Alto/Redwd City CA  USA  HIGH          C  415/367-0334 Y                  
 03407 Pasadena/Alhambra    CA  USA  MED   B B        818/308-1800                    
 10244 Pasadena/Alhambra    CA  USA  MED        C     818/308-1994 Y                  
 04014 Pleasanton           CA  USA  LOW   B B        415/462-2101                    
 04556 Pleasnthill/Walnt Ck CA  USA  LOW   B B  C     415/935-1507 Y                  
 05362 Pleasnthill/Walnt Ck CA  USA  MED   B B  C     415/935-1507 Y                  
 10436 Pleasnthill/walnt ck CA  USA  MED   B B  C     415/935-1507 Y                  
 04263 Pomona/Diamond Bar   CA  USA  MED   B B  C     714/860-0057 Y                  
 04154 Port Hueneme         CA  USA  MED   B B  C     805/985-7843 Y                  
 07653 Poway                CA  USA  LOW   B B  C     619/679-0200 Y                  
 04722 Redding              CA  USA  LOW   B B  C     916/241-4820 Y                  
 04411 Redwood City         CA  USA  HIGH  B B  C     415/361-8701 Y                  
 04603 Redwood City         CA  USA  HIGH  B B        415/366-1092                    
 06301 Redwood City         CA  USA  HIGH          C  415/367-0334                    
 02655 Riverside/Colton     CA  USA  MED   B B        714/370-1200                    
 04046 Riverside/Colton     CA  USA  MED           C  714/872-0394 Y                  
 05325 Riverside/Colton     CA  USA  MED        C     714/422-0222 Y                  
 03300 Sacramento           CA  USA  HIGH  B B        916/448-4300                    
 07542 Sacramento           CA  USA  LOW           C  916/442-0992                    
 07543 Sacramento           CA  USA  HIGH          C  916/442-0851   TYM-X25          
 07543 Sacramento           CA  USA  HIGH       C     916/442-0841   TYM-X25          
 10130 Sacramento           CA  USA  HIGH  B B  C     916/447-7434 Y                  
 03412 Salinas              CA  USA  LOW   B B  C     408/754-2206 Y                  
 02655 San Bernadino/Colton CA  USA  MED   B B        714/370-1200                    
 04046 San Bernadino/Colton CA  USA  MED           C  714/872-0394 Y                  
 05325 San Bernadino/Colton CA  USA  MED   B B  C     714/422-0222 Y                  
 11273 San Clemente         CA  USA  LOW   B B  C     714/240-9424 Y                  
 02665 San Diego            CA  USA  HIGH       C     619/296-8747 Y                  
 03057 San Diego            CA  USA  HIGH          C  619/497-0042   TYM-X25          
 03057 San Diego            CA  USA  HIGH       C     619/497-0040   TYM-X25          
 03510 San Diego            CA  USA  HIGH          C  619/497-0050 Y                  
 04360 San Diego            CA  USA  HIGH  B B        619/296-3370                    
 05646 San Diego            CA  USA  HIGH  B B  C     619/296-8747 Y                  
 03410 San Fernando/Shm Oak CA  USA  MED   B B        818/789-9002                    
 04353 San Fernando/Shr Oak CA  USA  MED   B B  C     818/789-9557 Y                  
 03235 San Fernando/Shr Ok  CA  USA  MED   B B  C     818/789-9557 Y                  
 02704 San Francisco        CA  USA  WATS  B B  C     800/###-#### Y                  
 03035 San Francisco        CA  USA  WATS  B B  C     800/###-#### Y                  
 03036 San Francisco        CA  USA  HIGH  B B        415/974-1300                    
 03041 San Francisco        CA  USA  HIGH          C  415/896-5578   TYM-X25          
 03041 San Francisco        CA  USA  HIGH       C     415/896-5569   TYM-X25          
 03706 San Francisco        CA  USA  HIGH  B B        415/974-1300                    
 07377 San Francisco        CA  USA  HIGH  B B  C     415/543-0691 Y                  
 07417 San Francisco        CA  USA  HIGH          C  415/495-7220 Y                  
 07420 San Francisco        CA  USA  HIGH  B B  C     415/543-0691 Y                  
 03725 San Jose             CA  USA  HIGH          C  408/432-0804 Y                  
 06605 San Jose             CA  USA  HIGH  B B  C     408/432-8618 Y                  
 07205 San Jose             CA  USA  HIGH  B B        408/432-3430                    
 10242 San Jose             CA  USA  HIGH          C  408/954-8481   TYM-X25          
 10242 San Jose             CA  USA  HIGH       C     408/954-8476   TYM-X25          
 10561 San Jose             CA  USA  WATS       C     800/###-####                    
 04255 San Luis Obispo      CA  USA  LOW   B B  C     805/549-0770 Y                  
 04504 San Mateo/So. S.F.   CA  USA  LOW   B B  C     415/588-3043 Y                  
 03406 San Pedro/Long Beach CA  USA  MED   B B        213/435-0900                    
 07404 San Pedro/Long Beach CA  USA  MED   B B  C     213/436-6033 Y                  
 11270 San Rafael           CA  USA  LOW   B B  C     415/453-2087 Y                  
 02631 Santa Ana/Newprt Bch CA  USA  HIGH  B B        714/756-8341                    
 02644 Santa Ana/Newprt Bch CA  USA  HIGH          C  714/752-1493 Y                  
 04236 Santa Ana/Newprt Bch CA  USA  HIGH       C     714/852-8141 Y                  
 11371 Santa Barbara        CA  USA  MED   B B        805/564-2354                    
 11372 Santa Barbara        CA  USA  MED        C     805/965-1612 Y                  
 03725 Santa Clara/San Jose CA  USA  HIGH          C  408/432-0804 Y                  
 06605 Santa Clara/San Jose CA  USA  HIGH       C     408/432-8618 Y                  
 07205 Santa Clara/San Jose CA  USA  HIGH  B B        408/432-3430                    
 10561 Santa Clara/San Jose CA  USA  WATS       C     800/###-####                    
 03505 Santa Cruz           CA  USA  MED   B B  C     408/475-0981 Y                  
 06022 Santa Maria          CA  USA  LOW   B B  C     805/922-3308 Y                  
 04755 Santa Monica/El Sgnd CA  USA  MED   B B        213/643-2907                    
 10363 Santa Monica/El Sgnd CA  USA  MED        C     213/643-4228 Y                  
 04153 Santa Rosa           CA  USA  LOW   B B  C     707/527-6180 Y                  
 03235 Sherman Oaks         CA  USA  MED   B B  C     818/789-9557 Y                  
 03410 Sherman Oaks         CA  USA  MED   B B        818/789-9002                    
 04353 Sherman Oaks         CA  USA  MED   B B  C     818/789-9557 Y                  
 04504 So. San Francisco    CA  USA  LOW   B B  C     415/588-3043 Y                  
 03522 Stockton             CA  USA  LOW   B B        209/467-0601                    
 03725 Sunnyvale/San Jose   CA  USA  HIGH          C  408/432-0804 Y                  
 06605 Sunnyvale/San Jose   CA  USA  HIGH       C     408/432-8618 Y                  
 07205 Sunnyvale/San Jose   CA  USA  HIGH  B B        408/432-3430                    
 05046 Upland               CA  USA  LOW   B B  C     714/985-1153 Y                  
 03120 Vallejo              CA  USA  LOW   B B  C     707/644-1192 Y                  
 03235 Van Nuys/Sherman Oak CA  USA  MED   B B  C     818/789-9557 Y                  
 03410 Van Nuys/Sherman Oak CA  USA  MED   B B        818/789-9002                    
 04353 Van Nuys/Sherman Oak CA  USA  MED   B B  C     818/789-9557 Y                  
 04154 Ventura/Port Hueneme CA  USA  MED   B B  C     805/985-7843 Y                  
 05241 Vernon               CA  USA  HIGH  B B        213/587-0030                    
 05242 Vernon               CA  USA  HIGH  B B        213/587-0030                    
 06575 Vernon               CA  USA  HIGH  B B  C     213/587-7514 Y                  
 07533 Vernon               CA  USA  HIGH          C  213/588-8128 Y                  
 10325 Vernon               CA  USA  HIGH  B B  C     213/587-7514 Y                  
 06147 Visalia              CA  USA  LOW   B B  C     209/625-4891 Y                  
 04262 Vista                CA  USA  MED   B B  C     619/941-6700 Y                  
 04263 W.Covina/Diamond Bar CA  USA  MED   B B  C     714/860-0057 Y                  
 04556 Walnut Creek         CA  USA  LOW   B B  C     415/935-1507 Y                  
 05362 Walnut Creek         CA  USA  MED   B B  C     415/935-1507 Y                  
 10436 Walnut Creek         CA  USA  MED   B B  C     415/935-1507 Y                  
 03235 West L.A./Shrmn Oaks CA  USA  MED   B B  C     818/789-9557 Y                  
 03410 West L.A./Shrmn Oaks CA  USA  MED   B B        818/789-9002                    
 07434 Woodland/Davis       CA  USA  LOW   B B        916/758-3551                    
 02414 Aurora/Denver        CO  USA  HIGH  B B        303/830-9210                    
 05500 Aurora/Denver        CO  USA  HIGH       C     303/832-3447 Y                  
 06651 Aurora/Denver        CO  USA  HIGH          C  303/830-8530 Y                  
 06655 Aurora/Denver        CO  USA  HIGH       C     303/832-3447 Y                  
 02414 Boulder/Denver       CO  USA  HIGH  B B        303/830-9210                    
 05500 Boulder/Denver       CO  USA  HIGH       C     303/832-3447 Y                  
 06651 Boulder/Denver       CO  USA  HIGH          C  303/830-8530 Y                  
 06655 Boulder/Denver       CO  USA  HIGH       C     303/832-3447 Y                  
 03603 Colorado Springs     CO  USA  MED   B B  C     719/590-1003 Y                  
 02414 Denver               CO  USA  HIGH  B B        303/830-9210                    
 02571 Denver               CO  USA  HIGH          C  303/830-9032   TYM-X25          
 02571 Denver               CO  USA  HIGH       C     303/830-9008   TYM-X25          
 05500 Denver               CO  USA  HIGH       C     303/832-3447 Y                  
 06651 Denver               CO  USA  HIGH          C  303/830-8530 Y                  
 06655 Denver               CO  USA  HIGH       C     303/832-3447 Y                  
 11266 Fort Collins         CO  USA  LOW   B B  C     303/224-9819 Y                  
 02347 Grand Junction       CO  USA  LOW   B B  C     303/241-1643 Y                  
 07322 Greeley              CO  USA  LOW   B B  C     303/352-0960 Y                  
 07200 Pueblo               CO  USA  LOW   B B  C     719/543-9712 Y                  
 02357 Bloomfield           CT  USA  HIGH  B B        203/242-7140                    
 03511 Bloomfield           CT  USA  HIGH       C     203/242-1986 Y                  
 03557 Bloomfield           CT  USA  HIGH          C  203/243-9446 Y                  
 04304 Bloomfield           CT  USA  HIGH       C     203/242-1986 Y                  
 05333 Bloomfield           CT  USA  HIGH          C  203/286-0712   TYM-X25          
 05333 Bloomfield           CT  USA  HIGH       C     203/243-8327   TYM-X25          
 07220 Bridgeport           CT  USA  MED   B B        203/579-1479                    
 11275 Bridgeport           CT  USA  MED        C     203/332-7256 Y                  
 04044 Danbury              CT  USA  LOW   B B        203/797-9539                    
 10113 Fairfield/Westport   CT  USA  MED   B B  C     203/454-2129 Y                  
 02357 Hartford/Bloomfield  CT  USA  HIGH  B B        203/242-7140                    
 03557 Hartford/Bloomfield  CT  USA  HIGH          C  203/243-9446 Y                  
 04304 Hartford/Bloomfield  CT  USA  HIGH       C     203/242-1986 Y                  
 03026 Meriden              CT  USA  LOW   B B        203/634-9249                    
 03026 Middletown/Meriden   CT  USA  LOW   B B        203/634-9249                    
 03415 New Haven/No. Haven  CT  USA  MED   B B        203/773-0082                    
 06624 New Haven/No. Haven  CT  USA  MED        C     203/787-4674 Y                  
 04040 New London           CT  USA  LOW   B B  C     203/444-7030 Y                  
 03415 North Haven          CT  USA  MED   B B        203/773-0082                    
 06624 North Haven          CT  USA  MED        C     203/787-4674 Y                  
 10113 Norwalk/Westport     CT  USA  MED   B B  C     203/454-2129 Y                  
 04040 Norwich/New London   CT  USA  LOW   B B  C     203/444-7030 Y                  
 10172 Somers               CT  USA  LOW   B B  C     203/763-3521 Y                  
 02653 Stamford             CT  USA  HIGH  B B        203/965-0000                    
 11362 Stamford             CT  USA  HIGH       C     203/327-2974 Y                  
 11275 Stratford/Bridgeport CT  USA  MED        C     203/332-7256 Y                  
 07220 Stratford/Bridgeprt  CT  USA  MED   B B        203/579-1479                    
 03356 Waterbury            CT  USA  LOW   B B        203/755-5994                    
 10113 Westport             CT  USA  MED   B B  C     203/454-2129 Y                  
 02035 Washington           DC  USA  HIGH       C     703/352-3136 Y                  
 02544 Washington           DC  USA  HIGH  B B        703/691-8200                    
 02545 Washington           DC  USA  HIGH  B B        703/691-8200                    
 04075 Washington           DC  USA  HIGH       C     703/352-3136 Y                  
 04346 Washington           DC  USA  HIGH  B B        703/691-8200                    
 06262 Washington           DC  USA  HIGH          C  703/352-2218   TYM-X25          
 06262 Washington           DC  USA  HIGH       C     703/352-2216   TYM-X25          
 06264 Washington/Fairfax   DC  USA  HIGH          C  703/385-7587 Y                  
 06265 Washington/Fairfax   DC  USA  HIGH          C  703/385-7587 Y                  
 12622 Dover                DE  USA  LOW   C C  C     302/678-3569 Y                  
 11702 Georgetown           DE  USA  LOW   B B  C     302/856-1788 Y                  
 04430 Newark/Wilmington    DE  USA  MED   B B        302/652-2060                    
 11304 Newark/Wilmington    DE  USA  MED        C     302/652-2036 Y                  
 04430 Wilmington           DE  USA  MED   B B        302/652-2060                    
 11304 Wilmington           DE  USA  MED        C     302/652-2036 Y                  
 07150 Boca Raton/Delray    FL  USA  LOW   B B  C     407/272-7900 Y                  
 03606 Boyntn Bch/WPalm Bch FL  USA  MED   B B  C     407/471-9310 Y                  
 03456 Clearwater           FL  USA  MED   B B        813/441-9017                    
 03737 Clearwater           FL  USA  MED           C  813/443-4515 Y                  
 11035 Clearwater           FL  USA  MED        C     813/441-1621 Y                  
 03213 Cocoa                FL  USA  LOW   B B  C     407/639-3022 Y                  
 07150 Delray               FL  USA  LOW   B B  C     407/272-7900 Y                  
 03405 Fort Meyers          FL  USA  LOW   B B  C     813/337-0006 Y                  
 05304 Fort Pierce          FL  USA  LOW   B B  C     407/466-5661 Y                  
 03165 Ft. Lauderdale       FL  USA  MED   B B        305/463-0882                    
 06770 Ft. Lauderdale       FL  USA  MED        C     305/467-1870 Y                  
 11346 Ft. Lauderdale       FL  USA  MED           C  305/779-3445 Y                  
 05733 Gainesville          FL  USA  LOW   B B  C     904/335-0544 Y                  
 06770 Hollywd/Ft Ldrdl     FL  USA  MED        C     305/467-1870 Y                  
 03165 Hollywd/Ft. Laudrdle FL  USA  MED   B B        305/463-0882                    
 11346 Hollywd/Ft. Laudrdle FL  USA  MED           C  305/779-3445 Y                  
 02521 Jacksonville         FL  USA  MED           C  904/724-5994 Y                  
 03100 Jacksonville         FL  USA  MED   B B        904/721-8100                    
 05043 Jacksonville         FL  USA  MED        C     904/721-8559 Y                  
 06376 Kissimmee            FL  USA  LOW   B B  C     407/933-8425 Y                  
 12263 Lakeland             FL  USA  LOW   B B  C     813/858-6970 Y                  
 04000 Longwood/Orlando     FL  USA  MED   B B        407/841-0020                    
 04142 Longwood/Orlando     FL  USA  MED        C     407/841-0217 Y                  
 03213 Melbourne/Cocoa      FL  USA  LOW   B B  C     407/639-3022 Y                  
 03213 Merrit Isle/Cocoa    FL  USA  LOW   B B  C     407/639-3022 Y                  
 03625 Miami                FL  USA  HIGH       C     305/599-2964 Y                  
 06574 Miami                FL  USA  HIGH  B B        305/599-2900                    
 07224 Miami                FL  USA  HIGH          C  305/592-2357 Y                  
 07264 Miami                FL  USA  HIGH             305/592-2357 Y                  
 07720 Miami                FL  USA  HIGH          C  305/599-9996   TYM-X25          
 07720 Miami                FL  USA  HIGH       C     305/599-9993   TYM-X25          
 10221 Naples               FL  USA  LOW   B B  C     813/434-8080 Y                  
 10213 Ocala                FL  USA  LOW   B B  C     904/732-3707 Y                  
 04000 Orlando              FL  USA  MED   B B        407/841-0020                    
 04142 Orlando              FL  USA  MED        C     407/841-0217 Y                  
 02326 Ormond Beach         FL  USA  LOW   B B  C     904/673-0034 Y                  
 07725 Panama City          FL  USA  LOW   B B  C     904/769-0709 Y                  
 03515 Pensacola            FL  USA  LOW   B B  C     904/477-3344 Y                  
 06770 Pompno Bch/Ft Ldrdl  FL  USA  MED        C     305/467-1870 Y                  
 03165 Pompno Bch/Ft. Ldrdl FL  USA  MED   B B        305/463-0882                    
 06346 Port St. Lucie       FL  USA  LOW   B B  C     407/337-1992 Y                  
 07043 Sarasota             FL  USA  LOW   B B  C     813/952-9000 Y                  
 03456 St. Petersbrg/Clrwtr FL  USA  MED   B B        813/441-9017                    
 11035 St. Petersbrg/Clrwtr FL  USA  MED        C     813/441-1621 Y                  
 12513 Tallahassee          FL  USA  LOW           C  904/422-0016 Y                  
 12513 Tallahassee          FL  USA  LOW   B B  C     904/422-0149 Y                  
 04064 Tampa                FL  USA  MED        C     813/933-6210 Y                  
 04100 Tampa                FL  USA  MED   B B        813/932-7070                    
 04141 Tampa                FL  USA  HIGH          C  813/933-7095   TYM-X25          
 04141 Tampa                FL  USA  HIGH       C     813/933-7561   TYM-X25          
 05761 Tampa                FL  USA  MED           C  813/932-1091 Y                  
 07712 Vero Beach           FL  USA  LOW   B B  C     407/569-8207 Y                  
 03606 West Palm Beach      FL  USA  MED   B B  C     407/471-9310 Y                  
 12263 Winterhaven/Lakeland FL  USA  LOW   B B  C     813/858-6970 Y                  
 07031 Albany               GA  USA  LOW   B B  C     912/888-9282 Y                  
 06412 Athens               GA  USA  LOW   B B  C     404/548-7006 Y                  
 10211 Atlanta              GA  USA  HIGH          C  404/455-9285   TYM-X25          
 10211 Atlanta              GA  USA  HIGH       C     404/455-7540   TYM-X25          
 10133 Atlanta/Doraville    GA  USA  HIGH  B B        404/451-2208                    
 10134 Atlanta/Doraville    GA  USA  HIGH  B B        404/451-2208                    
 10203 Atlanta/Doraville    GA  USA  HIGH       C     404/451-3362 Y                  
 10204 Atlanta/Doraville    GA  USA  HIGH       C     404/451-3362 Y                  
 10254 Atlanta/Doraville    GA  USA  HIGH          C  404/451-1546 Y                  
 03121 Augusta/Martinez     GA  USA  LOW   B B  C     404/855-0442 Y                  
 11322 Augusta/Martinez     GA  USA  LOW   B B  C     404/855-0442 Y                  
 04443 Columbus             GA  USA  LOW   B B  C     404/327-0597 Y                  
 10133 Doraville            GA  USA  HIGH  B B        404/451-2208                    
 10134 Doraville            GA  USA  HIGH  B B        404/451-2208                    
 10203 Doraville            GA  USA  HIGH       C     404/451-3362 Y                  
 10254 Doraville            GA  USA  HIGH          C  404/451-1546 Y                  
 06130 Macon/Warner Robins  GA  USA  LOW   B B  C     912/923-7590 Y                  
 10133 Marietta/Doraville   GA  USA  HIGH  B B        404/451-2208                    
 10134 Marietta/Doraville   GA  USA  HIGH  B B        404/451-2208                    
 10203 Marietta/Doraville   GA  USA  HIGH       C     404/451-3362 Y                  
 10204 Marietta/Doraville   GA  USA  HIGH       C     404/451-3362 Y                  
 10254 Marietta/Doraville   GA  USA  HIGH          C  404/451-1546 Y                  
 03121 Martinez             GA  USA  LOW   B B  C     404/855-0442 Y                  
 11322 Martinez             GA  USA  LOW   B B  C     404/855-0442 Y                  
 10133 Norcross/Doraville   GA  USA  HIGH  B B        404/451-2208                    
 10134 Norcross/Doraville   GA  USA  HIGH  B B        404/451-2208                    
 10203 Norcross/Doraville   GA  USA  HIGH       C     404/451-3362 Y                  
 10204 Norcross/Doraville   GA  USA  MED        C     404/451-3362 Y                  
 10254 Norcross/Doraville   GA  USA  HIGH          C  404/451-1546 Y                  
 07301 Rome                 GA  USA  LOW   B B  C     404/234-0102 Y                  
 03607 Savannah             GA  USA  LOW   B B  C     912/232-6751 Y                  
 06130 Warner Robins        GA  USA  LOW   B B  C     912/923-7590 Y                  
 10574 Hilo                 HI  USA  MED   B B        808/935-5717                    
 10631 Honolulu             HI  USA  MED   B B        808/545-7610                    
 10632 Honolulu             HI  USA  MED        C     808/528-5300 Y                  
 12534 Maui                 HI  USA  LOW   B B  C     808/661-7688 Y                  
 05671 Ames                 IA  USA  LOW   B B  C     515/232-0157 Y                  
 04114 Cedar Falls/Waterloo IA  USA  LOW   B B  C     319/236-9020 Y                  
 06407 Cedar Rapids         IA  USA  LOW   B B  C     319/363-7514 Y                  
 07306 Davenport/RockIsland IA  USA  MED   B B  C     309/788-3713 Y                  
 03461 Des Moines           IA  USA  MED        C     515/277-9684 Y                  
 03532 Des Moines           IA  USA  MED   B B        515/277-7752                    
 07456 Dubuque              IA  USA  LOW   B B  C     319/582-3599 Y                  
 10320 Iowa City            IA  USA  LOW   B B  C     319/354-3633 Y                  
 02026 Marshalltown         IA  USA  LOW   B B  C     515/753-0670 Y                  
 05021 Sioux City           IA  USA  LOW   B B  C     712/255-3834 Y                  
 04114 Waterloo             IA  USA  LOW   B B  C     319/236-9020 Y                  
 02565 Boise                ID  USA  MED   B B        208/343-0404                    
 04253 Boise                ID  USA  LOW        C     208/345-5951 Y                  
 05504 Coeur D'Alene        ID  USA  LOW   B B  C     208/765-1465                    
 03630 Idaho Falls          ID  USA  LOW   B B  C     208/522-3624 Y                  
 03521 Pocatello            ID  USA  LOW   B B  C     208/233-2501 Y                  
 05151 Twin Falls           ID  USA  LOW   B B  C     208/734-0221 Y                  
 03031 Aurora               IL  USA  LOW   B B        708/844-0700                    
 05437 Bloomington          IL  USA  LOW   B B  C     309/827-2748 Y                  
 10247 Bradley              IL  USA  LOW   B B  C     815/935-2352 Y                  
 02367 Champaign/Urbana     IL  USA  LOW   B B  C     217/344-3400 Y                  
 03151 Chicago              IL  USA  HIGH  B B        312/922-4601                    
 03152 Chicago              IL  USA  HIGH  B B        312/922-4601                    
 06313 Chicago              IL  USA  HIGH          C  312/427-1506   TYM-X25          
 06313 Chicago              IL  USA  HIGH       C     312/427-1453   TYM-X25          
 06321 Chicago              IL  USA  HIGH       C     312/922-6571 Y                  
 06324 Chicago              IL  USA  HIGH          C  312/427-7579 Y                  
 06325 Chicago              IL  USA  HIGH       C     312/922-6571 Y                  
 11150 Chicago              IL  USA  WATS  B B  C     800/###-#### Y                  
 11151 Chicago              IL  USA  WATS  B B  C     800/###-#### Y                  
 11152 Chicago              IL  USA  WATS  B B  C     800/###-#### Y                  
 07731 Cicero/Maywood       IL  USA  LOW   B B  C     708/345-9100 Y                  
 07303 Danville             IL  USA  LOW   B B  C     217/442-1452 Y                  
 04305 Decatur              IL  USA  LOW   B B  C     217/425-8864 Y                  
 02244 Downrs Grove/Gln Eln IL  USA  MED        C     708/790-4955 Y                  
 02465 Downrs Grove/Gln Eln IL  USA  MED   B B        708/790-4400                    
 10617 E. St. Louis         IL  USA  LOW   B B  C     618/874-5702 Y                  
 02256 Elgin                IL  USA  LOW   B B        708/888-8113                    
 07731 Forest Park/Maywood  IL  USA  LOW   B B  C     708/345-9100 Y                  
 07721 Freeport             IL  USA  LOW   B B  C     815/232-7111 Y                  
 02244 Glen Ellyn           IL  USA  MED        C     708/790-4955 Y                  
 02465 Glen Ellyn           IL  USA  MED   B B        708/790-4400                    
 10471 Joliet               IL  USA  LOW   B B        815/727-2169                    
 10247 Kankakee/Bradley     IL  USA  LOW   B B  C     815/935-2352 Y                  
 05551 Lake Bluff           IL  USA  LOW   B B  C     708/295-7075 Y                  
 05552 Lake Bluff           IL  USA  LOW   B B  C     708/295-7075 Y                  
 11242 Lake Zurich/Palatine IL  USA  LOW   B B  C     708/991-7171 Y                  
 10432 Lansing              IL  USA  LOW   B B        708/474-1422                    
 05551 Librtyvle/Lake Bluff IL  USA  LOW   B B  C     708/295-7075 Y                  
 05552 Librtyvle/Lake Bluff IL  USA  LOW   B B  C     708/295-7075 Y                  
 07731 Maywood              IL  USA  LOW   B B  C     708/345-9100 Y                  
 11743 Northfield           IL  USA  LOW   B B  C     708/501-4536 Y                  
 11207 O'Fallon             IL  USA  LOW   B B  C     618/632-3993 Y                  
 11242 Palatine             IL  USA  LOW   B B  C     708/991-7171 Y                  
 05307 Peoria               IL  USA  LOW   B B  C     309/637-5961 Y                  
 07306 Rock Island          IL  USA  MED   B B  C     309/788-3713 Y                  
 05605 Rockford             IL  USA  MED   B B        815/654-1900                    
 11307 Rockford             IL  USA  MED        C     815/633-2080 Y                  
 04311 Springfield          IL  USA  MED   B B        217/525-8025                    
 04475 Springfield          IL  USA  MED        C     217/544-0312 Y                  
 03031 St. Charles/Aurora   IL  USA  LOW   B B        708/844-0700                    
 02367 Urbana               IL  USA  LOW   B B  C     217/344-3400 Y                  
 02465 Wheaton/Glen Ellyn   IL  USA  MED   B B        708/790-4400                    
 02155 Bloomington          IN  USA  LOW   B B  C     812/332-0544 Y                  
 04161 Elkhart              IN  USA  LOW   B B  C     219/293-8860 Y                  
 03656 Evansville           IN  USA  LOW   B B  C     812/464-8181 Y                  
 03653 Ft. Wayne            IN  USA  LOW   B B  C     219/422-2581 Y                  
 06546 Gary                 IN  USA  LOW   B B  C     219/885-0002 Y                  
 06546 Hammond/Gary         IN  USA  LOW   B B  C     219/885-0002 Y                  
 06546 Highland/Gary        IN  USA  LOW   B B  C     219/885-0002 Y                  
 02066 Indianapolis         IN  USA  HIGH  B B        317/631-1002                    
 02074 Indianapolis         IN  USA  HIGH       C     317/632-6408 Y                  
 05672 Indianapolis         IN  USA  HIGH          C  317/687-0305 Y                  
 07650 Kokomo               IN  USA  LOW   B B  C     317/453-7818 Y                  
 07455 Lafayette            IN  USA  LOW   B B  C     317/423-4616 Y                  
 07733 Marion               IN  USA  LOW   B B  C     317/662-1928 Y                  
 03106 Mishawaka/South Bend IN  USA  MED   B B        219/234-5005                    
 11274 Mishawaka/South Bend IN  USA  MED        C     219/234-6410 Y                  
 07706 Muncie               IN  USA  LOW   B B  C     317/284-7821 Y                  
 03106 South Bend           IN  USA  MED   B B        219/234-5005                    
 11274 South Bend           IN  USA  MED        C     219/234-6410 Y                  
 07454 Terre Haute          IN  USA  LOW   B B  C     812/232-0112 Y                  
 03230 Kansas City/Mission  KS  USA  HIGH       C     913/384-5012 Y                  
 03572 Kansas City/Mission  KS  USA  HIGH       C     913/384-5012 Y                  
 04650 Kansas City/Mission  KS  USA  HIGH  B B        913/384-1226                    
 04363 Lawrence             KS  USA  LOW   B B  C     913/843-4870 Y                  
 07726 Leavenworth          KS  USA  LOW   B B  C     913/651-8094 Y                  
 05716 Manhattan            KS  USA  LOW   B B  C     913/776-9803 Y                  
 03230 Mission              KS  USA  HIGH       C     913/384-5012 Y                  
 03572 Mission              KS  USA  HIGH       C     913/384-5012 Y                  
 04650 Mission              KS  USA  HIGH  B B        913/384-1226                    
 04653 Mission              KS  USA  HIGH          C  913/384-0071 Y                  
 07730 Salina               KS  USA  LOW   B B  C     913/825-4845 Y                  
 03230 Shawnee/Mission      KS  USA  HIGH       C     913/384-5012 Y                  
 03572 Shawnee/Mission      KS  USA  HIGH       C     913/384-5012 Y                  
 04650 Shawnee/Mission      KS  USA  HIGH  B B        913/384-1226                    
 04653 Shawnee/Mission      KS  USA  HIGH          C  913/384-0071 Y                  
 06774 Topeka               KS  USA  LOW   B B  C     913/234-3070 Y                  
 05441 Wichita              KS  USA  MED   B B        316/681-0832                    
 05443 Wichita              KS  USA  MED        C     316/681-2719 Y                  
 07471 Bowling Green        KY  USA  LOW   B B  C     502/781-5711 Y                  
 03154 Frankfort            KY  USA  LOW   B B  C     502/223-0724 Y                  
 05774 Lexington            KY  USA  MED        C     606/266-7063 Y                  
 06626 Lexington            KY  USA  MED   B B        606/266-0019                    
 05520 Louisville           KY  USA  MED        C     502/499-9825 Y                  
 10337 Louisville           KY  USA  MED   B B        502/499-7110                    
 11323 Owensboro            KY  USA  LOW   B B  C     502/685-0959 Y                  
 05275 Alexandria           LA  USA  LOW   B B  C     318/445-2694 Y                  
 02723 Baton Rouge          LA  USA  MED   B B        504/924-5102                    
 02745 Baton Rouge          LA  USA  MED        C     504/291-0967 Y                  
 10510 Lafayette            LA  USA  LOW   B B  C     318/234-8255 Y                  
 05276 Lake Charles         LA  USA  LOW   B B  C     318/494-1991 Y                  
 07646 Monroe               LA  USA  LOW   B B  C     318/388-8810 Y                  
 06525 New Orleans          LA  USA  HIGH       C     504/525-2014 Y                  
 06532 New Orleans          LA  USA  HIGH  B B        504/522-1370                    
 07212 New Orleans          LA  USA  HIGH  B B  C     504/525-2014 Y                  
 11376 New Orleans          LA  USA  HIGH          C  504/524-1738 Y                  
 03731 Shreveport           LA  USA  LOW        C     318/688-5840 Y                  
 11026 Slidell              LA  USA  LOW   B B  C     504/646-2900 Y                  
 07735 Attleboro            MA  USA  LOW   B B        508/226-6441                    
 10031 Bedford              MA  USA  LOW   B B  C     617/271-0420 Y                  
 02253 Boston               MA  USA  HIGH          C  617/439-7628   TYM-X25          
 02253 Boston               MA  USA  HIGH       C     617/439-7626   TYM-X25          
 04060 Boston               MA  USA  HIGH          C  617/330-5110                    
 04713 Boston               MA  USA  HIGH          C  617/330-5110 Y                  
 07001 Boston               MA  USA  HIGH  B B        617/439-3400                    
 07525 Boston               MA  USA  HIGH  B B        617/439-3400                    
 10515 Boston               MA  USA  HIGH       C     617/439-3531 Y                  
 10520 Boston               MA  USA  HIGH       C     617/439-3531 Y                  
 10521 Boston               MA  USA  HIGH       C     617/439-3531 Y                  
 05464 Brockton/Randolph    MA  USA  LOW   B B        617/986-0500                    
 04060 Cambridge/Boston     MA  USA  HIGH          C  617/330-5110 Y                  
 04713 Cambridge/Boston     MA  USA  HIGH          C  617/330-5110 Y                  
 07001 Cambridge/Boston     MA  USA  HIGH  B B        617/439-3400                    
 07525 Cambridge/Boston     MA  USA  HIGH  B B        617/439-3400                    
 10515 Cambridge/Boston     MA  USA  HIGH       C     617/439-3531 Y                  
 10520 Cambridge/Boston     MA  USA  HIGH       C     617/439-3531 Y                  
 10521 Cambridge/Boston     MA  USA  HIGH       C     617/439-3531 Y                  
 07210 Fall River/Somerset  MA  USA  LOW   B B        508/676-3087                    
 07677 Fitchburg/Leominster MA  USA  LOW   B B  C     508/537-6451 Y                  
 11453 Groton               MA  USA  LOW   B B  C     508/448-9361 Y                  
 07743 Holyoke/Springfield  MA  USA  MED   B B        413/787-0048                    
 11306 Holyoke/Springfield  MA  USA  MED        C     413/785-1762 Y                  
 04027 Kingston             MA  USA  LOW   B B  C     617/585-7616 Y                  
 02502 Lawrence             MA  USA  LOW   B B  C     508/683-2680 Y                  
 06421 Lawrence             MA  USA  LOW   B B  C     508/683-2680 Y                  
 07677 Leominster           MA  USA  LOW   B B  C     508/537-6451 Y                  
 07625 Lowell               MA  USA  LOW   B B  C     508/452-5112 Y                  
 07610 Lynn                 MA  USA  LOW   B B        617/593-4051                    
 02616 Manchester           MA  USA  LOW   B B  C     508/526-1506 Y                  
 11405 Marlborough          MA  USA  LOW   B B  C     508/481-0026 Y                  
 03302 New Bedford          MA  USA  LOW   B B  C     508/999-4521 Y                  
 07332 Pittsfield           MA  USA  LOW   B B        413/499-0971                    
 05464 Randolph             MA  USA  LOW   B B        617/986-0500                    
 11422 Randolph             MA  USA  LOW   B B        617/986-0500                    
 07210 Somerset             MA  USA  LOW   B B  C     508/676-3087 Y                  
 07743 Springfield          MA  USA  MED   B B        413/787-0048                    
 11306 Springfield          MA  USA  MED        C     413/785-1762 Y                  
 07374 Taunton              MA  USA  LOW   B B  C     508/824-6692 Y                  
 10031 Woburn/Bedford       MA  USA  LOW   B B  C     617/271-0420 Y                  
 03675 Worcester            MA  USA  LOW   B B  C     508/791-9000 Y                  
 07315 Aberdeen             MD  USA  LOW   B B  C     301/273-7100 Y                  
 11663 Annapolis            MD  USA  LOW   B B  C     301-224-0520 Y                  
 02354 Baltimore            MD  USA  HIGH  B B        301/547-8100                    
 05023 Baltimore            MD  USA  HIGH          C  301/659-7430   TYM-X25          
 05023 Baltimore            MD  USA  HIGH       C     301/659-7410   TYM-X25          
 05553 Baltimore            MD  USA  HIGH       C     301/528-9296 Y                  
 05554 Baltimore            MD  USA  HIGH       C     301/528-9296 Y                  
 10034 Baltimore            MD  USA  HIGH          C  301/659-7460 Y                  
 02035 Bethesda             MD  USA  HIGH       C     703/352-3136 Y                  
 02544 Bethesda             MD  USA  HIGH  B B        703/691-8200                    
 02545 Bethesda             MD  USA  HIGH  B B        703/691-8200                    
 04075 Bethesda             MD  USA  HIGH       C     703/352-3136 Y                  
 06264 Bethesda/Fairfax     MD  USA  HIGH          C  703/385-7587 Y                  
 06265 Bethesda/Fairfax     MD  USA  HIGH          C  703/385-7587 Y                  
 11063 Cumberland           MD  USA  LOW   B B  C     301/777-9320 Y                  
 06242 Frederick/Myersville MD  USA  LOW   B B  C     301/293-9504 Y                  
 06242 Hagerstown/Myersvlle MD  USA  LOW   B B  C     301/293-9504 Y                  
 06242 Myersville           MD  USA  LOW   B B  C     301/293-9504 Y                  
 10560 Rockville            MD  USA  LOW   B B  C     301/869-2700 Y                  
 07571 Salisbury            MD  USA  LOW   B B  C     301/860-0480 Y                  
 11067 Auburn               ME  USA  LOW   B B  C     207/795-6013 Y                  
 10601 Augusta              ME  USA  LOW   B B  C     207/622-3083 Y                  
 11003 Bangor               ME  USA  LOW   B B  C     207/990-0529 Y                  
 11067 Lewiston/Auburn      ME  USA  LOW   B B  C     207/795-6013 Y                  
 04220 Portland             ME  USA  LOW   B B  C     207/775-5971 Y                  
 10103 Ann Arbor            MI  USA  MED           C  313/973-0166 Y                  
 10307 Ann Arbor            MI  USA  MED   B B  C     313/973-7935 Y                  
 11451 Battle Creek         MI  USA  LOW   B B  C     616/964-9303 Y                  
 04225 Benton Harbor        MI  USA  LOW   B B  C     616/925-3134 Y                  
 03344 Burton               MI  USA  LOW   B B  C     313/743-8350 Y                  
 07465 Cadillac             MI  USA  LOW   B B  C     616/775-9242 Y                  
 03530 Detroit              MI  USA  HIGH       C     313/963-3460 Y                  
 04355 Detroit              MI  USA  HIGH          C  313/965-4982   TYM-X25          
 04355 Detroit              MI  USA  HIGH       C     313/965-4980   TYM-X25          
 04455 Detroit              MI  USA  HIGH       C     313/963-3460 Y                  
 04501 Detroit              MI  USA  HIGH  B B        313/962-2870                    
 07005 Detroit              MI  USA  HIGH          C  313/964-1225 Y                  
 03344 Flint/Burton         MI  USA  LOW   B B  C     313/743-8350 Y                  
 04467 Freeland             MI  USA  LOW   B B  C     517/695-6751 Y                  
 04117 Grand Rapids         MI  USA  MED   B B  C     616/459-2304 Y                  
 11144 Grand Rapids         MI  USA  MED           C  616/458-9252                    
 02666 Jackson              MI  USA  LOW   B B  C     517/788-9191 Y                  
 03516 Kalamazoo            MI  USA  MED   B B  C     616/388-2130 Y                  
 03666 Lansing              MI  USA  MED   B B        517/482-5721                    
 11236 Lansing              MI  USA  MED        C     517/484-5344 Y                  
 06762 Marquette            MI  USA  LOW   B B  C     906/228-3780 Y                  
 04467 Midland/Freeland     MI  USA  LOW   B B  C     517/695-6751 Y                  
 07466 Muskegon             MI  USA  LOW   B B  C     616/739-3453 Y                  
 04542 Plymouth             MI  USA  MED   B B  C     313/451-2400 Y                  
 05366 Pontiac              MI  USA  LOW   B B        313/338-8384                    
 07467 Port Huron           MI  USA  LOW   B B  C     313/982-0301 Y                  
 06014 Roseville            MI  USA  LOW   B B        313/774-1000                    
 04467 Saginaw/Freeland     MI  USA  LOW   B B  C     517/695-6751 Y                  
 03654 Southfield           MI  USA  MED   B B  C     313/424-8024 Y                  
 11010 Southfield           MI  USA  MED           C  313/557-2106 Y                  
 04225 St. Joe/Benton Hrbr  MI  USA  LOW   B B  C     616/925-3134 Y                  
 05063 Traverse City        MI  USA  LOW   B B  C     616/947-0050 Y                  
 11741 Duluth               MN  USA  LOW   B B  C     218/722-0655 Y                  
 03614 Mankato              MN  USA  LOW   B B  C     507/387-7313 Y                  
 02377 Minneapolis          MN  USA  HIGH          C  612/338-0845 Y                  
 04316 Minneapolis          MN  USA  HIGH  B B        612/333-2799                    
 04321 Minneapolis          MN  USA  HIGH       C     612/332-4024 Y                  
 04425 Minneapolis          MN  USA  HIGH       C     612/332-4024 Y                  
 05410 Minneapolis          MN  USA  HIGH          C  612/332-2580   TYM-X25          
 05410 Minneapolis          MN  USA  HIGH       C     612/332-2345   TYM-X25          
 11671 Rochester            MN  USA  LOW   B B  C     507/282-0830 Y                  
 02323 St. Cloud            MN  USA  LOW   B B  C     612/251-4942 Y                  
 02377 St. Paul/Minneapolis MN  USA  HIGH          C  612/338-0845 Y                  
 04316 St. Paul/Minneapolis MN  USA  HIGH  B B        612/333-2799                    
 04764 Bridgeton/Hazelwood  MO  USA  HIGH  B B        314/731-8002                    
 04765 Bridgeton/Hazelwood  MO  USA  HIGH       C     314/731-8283 Y                  
 05715 Bridgeton/Hazelwood  MO  USA  HIGH       C     314/731-8283 Y                  
 05717 Bridgeton/Hazelwood  MO  USA  HIGH          C  314/731-0703 Y                  
 10602 Cape Girardeau       MO  USA  LOW   B B  C     314/335-1518 Y                  
 05044 Columbia             MO  USA  LOW   B B  C     314/874-2771 Y                  
 04764 Hazelwood            MO  USA  HIGH  B B        314/731-8002                    
 04765 Hazelwood            MO  USA  HIGH       C     314/731-8283 Y                  
 05715 Hazelwood            MO  USA  HIGH       C     314/731-8283 Y                  
 05717 Hazelwood            MO  USA  HIGH          C  314/731-0703 Y                  
 03572 Independence         MO  USA  HIGH       C     913/384-5012 Y                  
 03230 Independence/Mission MO  USA  HIGH       C     913/384-5012 Y                  
 04650 Independence/Mission MO  USA  HIGH  B B        913/384-1226                    
 05502 Jefferson City       MO  USA  LOW   B B  C     314/634-8296 Y                  
 03677 Joplin               MO  USA  LOW   B B  C     417/781-8718 Y                  
 03346 Kansas City          MO  USA  HIGH          C  913/384-0590   TYM-X25          
 03346 Kansas City          MO  USA  HIGH       C     913/677-5002   TYM-X25          
 03230 Kansas City/Mission  MO  USA  HIGH       C     913/384-5012 Y                  
 03572 Kansas City/Mission  MO  USA  HIGH       C     913/384-5012 Y                  
 04650 Kansas City/Mission  MO  USA  HIGH  B B        913/384-1226                    
 07126 Rolla                MO  USA  LOW   B B  C     314/364-2084 Y                  
 10673 Springfield          MO  USA  LOW   B B  C     417/881-6225 Y                  
 03144 St. Joseph           MO  USA  LOW   B B  C     816/232-1455 Y                  
 05726 St. Louis            MO  USA  HIGH          C  314/731-7841   TYM-X25          
 05726 St. Louis            MO  USA  HIGH       C     314/731-4507   TYM-X25          
 04764 St. Louis/Hazelwood  MO  USA  HIGH  B B        314/731-8002                    
 05717 St. Louis/Hazelwood  MO  USA  HIGH          C  314/731-0703 Y                  
 05147 Gulfport             MS  USA  LOW   B B  C     601/868-2331 Y                  
 02402 Hattiesburg          MS  USA  LOW   B B  C     601/582-0286 Y                  
 04621 Jackson              MS  USA  LOW   B B  C     601/355-9741 Y                  
 07714 Meridian             MS  USA  LOW   B B  C     601/482-4335 Y                  
 04354 Pascagoula           MS  USA  LOW   B B  C     601/769-0121 Y                  
 02674 Tupelo               MS  USA  LOW   B B  C     601/841-0090 Y                  
 05302 Vicksburg            MS  USA  LOW   B B  C     601/638-1551 Y                  
 03726 Billings             MT  USA  LOW   B B  C     406/252-4880 Y                  
 10570 Bozeman              MT  USA  LOW   B B  C     406/585-9719 Y                  
 07447 Butte                MT  USA  LOW   B B  C     406/494-6682 Y                  
 07154 Great Falls          MT  USA  LOW   B B  C     406/727-9510 Y                  
 05017 Helena               MT  USA  LOW   B B  C     406/443-0112 Y                  
 04111 Missoula             MT  USA  LOW   B B  C     406/721-8960 Y                  
 11356 Asheville            NC  USA  LOW   B B  C     704/253-8945 Y                  
 02613 Chapel Hill/Durham   NC  USA  MED   B B        919/549-8952                    
 06645 Chapel Hill/Durham   NC  USA  MED        C     919/549-9025 Y                  
 06105 Charlotte            NC  USA  HIGH  B B        704/377-0521                    
 07026 Charlotte            NC  USA  HIGH       C     704/374-0803 Y                  
 02613 Durham               NC  USA  MED   B B        919/549-8952                    
 06645 Durham               NC  USA  MED        C     919/549-9025 Y                  
 10567 Durham               NC  USA  MED   B B  C     919/549-9025 Y                  
 12054 Fayetteville         NC  USA  LOW   B B  C     919/424-9610 Y                  
 07607 Gastonia             NC  USA  LOW   B B  C     704/867-2203 Y                  
 03437 Greensboro           NC  USA  MED   B B  C     919/273-0332 Y                  
 07241 Greenville           NC  USA  LOW   B B  C     919/758-0102 Y                  
 07242 High Point           NC  USA  LOW   B B  C     919/883-6121 Y                  
 10027 Kannapolis           NC  USA  LOW   B B  C     704/932-4131 Y                  
 03624 Raleigh              NC  USA  LOW   B B        919/829-0536                    
 05264 Rocky Mount          NC  USA  LOW   B B  C     919/937-4828 Y                  
 07316 Wilmington           NC  USA  LOW   B B  C     919/762-1865 Y                  
 03720 Winston-Salem        NC  USA  MED   B B  C     919/765-1221 Y                  
 11161 Winston-Salem        NC  USA  MED   B B  C     919/765-1221 Y                  
 07124 Bismark              ND  USA  LOW   B B  C     701/255-0869 Y                  
 04751 Fargo                ND  USA  LOW   B B  C     701/280-0210 Y                  
 07340 Grand Forks          ND  USA  LOW   B B        701/746-0344                    
 07457 Minot                ND  USA  LOW   B B  C     701/839-4210 Y                  
 10730 Grand Island         NE  USA  LOW   B B  C     308/382-3176 Y                  
 11012 Lincoln              NE  USA  LOW   B B  C     402/464-6235 Y                  
 03254 Omaha                NE  USA  MED   B B  C     402/393-1305 Y                  
 06106 Omaha                NE  USA  MED   B B        402/393-0903                    
 04375 Concord              NH  USA  LOW   B B        603/228-4732                    
 05256 Durham               NH  USA  LOW   B B  C     603/868-1502 Y                  
 07375 Hanover              NH  USA  LOW   B B  C     603/643-4011 Y                  
 04122 Manchester           NH  USA  LOW   B B  C     603/623-0409 Y                  
 07042 Nashua               NH  USA  MED   B B  C     603/882-0435 Y                  
 03224 North Hampton        NH  USA  LOW   B B  C     603/964-7779                    
 02640 Peterborough         NH  USA  LOW   B B  C     603/924-7090 Y                  
 07042 Salem/Nashua         NH  USA  MED   B B  C     603/882-0435 Y                  
 04351 Atlantic City        NJ  USA  LOW   B B  C     609/345-4050 Y                  
 03401 Camden/Pennsauken    NJ  USA  LOW   B B        609/665-5600                    
 10105 Camden/Pennsauken    NJ  USA  MED        C     609/665-5902 Y                  
 03401 Cherry Hill/Pennskn  NJ  USA  LOW   B B        609/665-5600                    
 10105 Cherry hill/Pennskn  NJ  USA  MED        C     609/665-5902 Y                  
 05211 Eatontown/Red Bank   NJ  USA  LOW   B B  C     908/758-0337 Y                  
 02606 Elizabeth/Newark     NJ  USA  HIGH  B B        201/824-1212                    
 02744 Elizabeth/Newark     NJ  USA  HIGH       C     201/824-3044 Y                  
 05627 Elizabeth/Newark     NJ  USA  HIGH       C     201/824-3044 Y                  
 06035 Englewood Cliffs     NJ  USA  MED   B B        201/567-9841                    
 06037 Englewood Cliffs     NJ  USA  MED        C     201/567-8951 Y                  
 06035 Fair Lawn/Englwd Clf NJ  USA  MED   B B        201/567-9841                    
 02606 Jersey City/Newark   NJ  USA  HIGH  B B        201/824-1212                    
 02744 Jersey City/Newark   NJ  USA  HIGH       C     201/824-3044 Y                  
 05627 Jersey City/Newark   NJ  USA  HIGH       C     201/824-3044 Y                  
 05211 Long Branch/Red Bank NJ  USA  LOW   B B  C     908/758-0337 Y                  
 07432 Lyndhurst/Union City NJ  USA  HIGH  B B  C     201/864-8468 Y                  
 11305 Lyndhurst/Union City NJ  USA  HIGH          C  201/864-0995 Y                  
 04025 Morristown           NJ  USA  LOW   B B        201/539-1222                    
 02606 Newark               NJ  USA  HIGH  B B        201/824-1212                    
 02744 Newark               NJ  USA  HIGH       C     201/824-3044 Y                  
 05627 Newark               NJ  USA  HIGH       C     201/824-3044 Y                  
 07413 Newark               NJ  USA  LOW           C  201/824-4201 Y                  
 10110 Newark               NJ  USA  HIGH          C  201/824-4130   TYM-X25          
 10110 Newark               NJ  USA  HIGH       C     201/824-4128   TYM-X25          
 05456 Paterson             NJ  USA  MED        C     201/742-0752                    
 03401 Pennsauken           NJ  USA  LOW   B B        609/665-5600                    
 10105 Pennsauken           NJ  USA  MED        C     609/665-5902 Y                  
 06472 Piscataway           NJ  USA  HIGH  B B        908/562-8550                    
 06544 Piscataway           NJ  USA  HIGH       C     908/562-8550 Y                  
 10621 Princeton/So. Brnswk NJ  USA  HIGH  B B        609/452-1018                    
 04126 Rahway               NJ  USA  LOW   B B        908/396-8550                    
 05211 Red Bank             NJ  USA  LOW   B B  C     908/758-0337 Y                  
 05456 Ridgewood/Paterson   NJ  USA  MED        C     201/742-0752                    
 10153 S. Brunswick         NJ  USA  HIGH          C  609/452-8011   TYM-X25          
 10153 S. Brunswick         NJ  USA  HIGH       C     609/452-8640   TYM-X25          
 10153 South Brunswick      NJ  USA  HIGH          C  609/452-8388 Y                  
 10621 South Brunswick      NJ  USA  HIGH  B B        609/452-1018                    
 10622 South Brunswick      NJ  USA  HIGH       C     609/452-9529 Y                  
 03652 Trenton              NJ  USA  LOW   B B  C     609/394-1900 Y                  
 04166 Trenton              NJ  USA  LOW   B B  C     609/394-1900 Y                  
 07432 Union City           NJ  USA  HIGH  B B  C     201/864-8468 Y                  
 11305 Union City           NJ  USA  HIGH          C  201/617/9069 Y                  
 11305 Union City           NJ  USA  HIGH          C  201/617-9110   TYM-X25          
 11305 Union City           NJ  USA  HIGH       C     201/617-9103   TYM-X25          
 02606 Union/Newark         NJ  USA  HIGH  B B        201/824-1212                    
 02744 Union/Newark         NJ  USA  HIGH       C     201/824-3044 Y                  
 05627 Union/Newark         NJ  USA  HIGH       C     210/824-3044 Y                  
 02252 Vineland             NJ  USA  LOW   B B  C     609/691-6446 Y                  
 05456 Wayne/Paterson       NJ  USA  MED        C     201/742-0752                    
 02265 Albuquerque          NM  USA  MED        C     505/242-8931 Y                  
 04212 Albuquerque          NM  USA  MED   B B        505/242-8344                    
 02071 Las Cruces           NM  USA  LOW   B B  C     505/525-3401 Y                  
 07636 Santa Fe             NM  USA  LOW   B B  C     505/471-0606 Y                  
 03107 Boulder City         NV  USA  MED   B B        702/293-0300                    
 11360 Boulder City         NV  USA  MED        C     702/294-0602 Y                  
 03673 Carson City          NV  USA  MED   B B  C     702/885-8411 Y                  
 11360 Las Vegas/Bldr City  NV  USA  MED        C     702/294-0602 Y                  
 03107 Las Vegas/Bolder Cty NV  USA  MED   B B        702/293-0300                    
 03673 Reno/Carson City     NV  USA  MED   B B  C     702/885-8411 Y                  
 02045 Albany               NY  USA  MED        C     518/458-9724 Y                  
 03705 Albany               NY  USA  MED   B B        518/458-8300                    
 03533 Binghampton          NY  USA  LOW   B B  C     607/724-4351 Y                  
 10061 Buffalo              NY  USA  MED   B B        716/893-1306                    
 11123 Buffalo              NY  USA  MED        C     716/893-1014 Y                  
 05650 Centereach/Lk Grove  NY  USA  MED   B B  C     516/471-6080 Y                  
 07364 Corning              NY  USA  LOW   B B  C     607/962-4481 Y                  
 06660 Elmira               NY  USA  LOW   B B  C     607/737-9065 Y                  
 03540 Hempstead            NY  USA  HIGH          C  516/565-0111 Y                  
 03540 Hempstead            NY  USA  HIGH          C  516/486-2095   TYM-X25          
 03540 Hempstead            NY  USA  HIGH       C     516/292-6002   TYM-X25          
 03703 Hempstead            NY  USA  MED   B B        516/485-7422                    
 04325 Hempstead            NY  USA  MED        C     516/481-0150 Y                  
 04045 Huntington/Melville  NY  USA  MED   B B        516/420-1221                    
 04232 Huntington/Melville  NY  USA  MED        C     516/420-4579 Y                  
 04406 Ithaca               NY  USA  LOW   B B        607/257-6601                    
 10171 Jamestown            NY  USA  LOW   B B        716/488-0794                    
 10605 Kingston             NY  USA  LOW   B B  C     914/336-2790 Y                  
 05650 Lake Grove           NY  USA  MED   B B  C     516/471-6080 Y                  
 04045 Melville             NY  USA  MED   B B        516/420-1221                    
 04232 Melville             NY  USA  MED        C     516/420-4579 Y                  
 03703 Mineola/Hempstead    NY  USA  MED   B B        516/485-7422                    
 06347 New City             NY  USA  LOW   B B  C     914/634-0388 Y                  
 02304 New York             NY  USA  HIGH          C  212/269-4640 Y                  
 04515 New York             NY  USA  HIGH  B B        212/943-4700                    
 04516 New York             NY  USA  HIGH  B B        212/943-4700                    
 05373 New York             NY  USA  HIGH       C     212/809-9660 Y                  
 07054 New York             NY  USA  HIGH       C     212A  LOW   B B  C     814/943-5848 Y                  
 03662 Bethlehem            PA  USA  MED   B B  C     215/865-6978 Y                  
 03204 Butler               PA  USA  LOW   B B        412/283-2286                    
 05537 Coatesville          PA  USA  LOW   B B  C     215/383-0440 Y                  
 05537 Downington/Coatsvlle PA  USA  LOW   B B  C     215/383-0440 Y
------------------------------------------------------------------------------

Well thats it for this newsletter.Look for future newsletters containing
information on breaking into The Dod,Fbi,and some other high tech pig pens.

Hope you enjoyed it!

                                 I.H.A.
                         Realeased June 18,1991
              (C)opyright I.H.A. publications department