

	_+                                                   +_
	TELUS Mobility; Panasonic EN-POWR numeric pager exploit
        __                                                   __


    Telus Mobility offers to its customers, 
few types of paging services. One type is called 'EN-POWR numeric pager'. 
With the EN-POWR numeric pager, you get total FLEX coverage. 
In other words, you get coverage all across Alberta.

The Panasonic EN-POWR pre-paid numeric pager is only $99.95, and it comes
with 6 months of enhanced service with a limited but nifty selection
of assorted colors to choose from. 

"But Clone, I have three kids to feed. 
I can't afford this type of service!"

It's completely understandable. That is why I wrote this file.
To show you how to get service that *should* be dirt cheap for 
absolutely free. 

Lets say that one day you were walking down the street minding your
own business, picking flowers, waving to Telus employees as they drive
past in their goodie-vans, when you trip over a pager that has the
word 'Panasonic' labelled on the top. 

This semi-transparent device, with its groovy design is the only thing 
stopping you from suing Telus for leaving its property laying around. 
Then you remember that it's an EN-POWR pre-pad numeric pager and it
has to be property of someone. 

"Hmm..." you think. At this point you can do one of two things;
you can call Telus reporting a missing pager, or you can try to
use your wits to find a way to exploit this.

First lets take a look at the pager features:

Pager features
--------------
 saves 23 messages
 message time stamp
 built in alarm clock
 silent vibration or audible alert
 low battery alert
 shows date and time of day
 selective erase/erase all
 locks important messages
 uses only one AAA battery
 FLEX technology gives you up to 
  four months battery life
 duplicate message indicator
 reminder alert
 backlit display
 automatic on/off


'Saves 23 messages', thought of anything yet? ;)
Sure you have my analytical friend. Along with numeric paging option, 
you also get a voice-mail paging option which requires you to dial the
number the pager is subscribed to.

So you think "How am I going to get this pager number?"
             ------------------------------------------
One easy way is to wait for someone to page you.

Usually friends of the pager customer, don't know the pager is in the
wrong hands so they unknowingly send them a voice-message. Bad idea.
The minute they send that message, the data is sent to the Telus Mobility
switch, and straight to the pager itself. What is displayed?
The pager number, silly!  

(note: if a numeric page is sent, the numbers
displayed on the screen are whatever the person who sent it typed.)

The next step is easy, you call the number. The next thing you'll hear
is one of two things; 1. the customers message, 2. Telus' default message.

By simply pressing '0' on the keypad, you'll next be prompted by an
automated voice saying: "Please enter your access code". 


"How do I acquire the access code?" 
--------------------------------

If the customer was stupid enough to set the default access code, 
all you do is look on the back of the EN-POWR numeric pager, 
and search for the "capcode".

The capcode is the series of numbers at the bottom of the label, 
below the Model, Serial Number, Country Code, and ISC code.
It's easily distinguishable by the letter E and a 7 digit code
after it. An example of a capcode is 'E1230948'. 

The default access code is the last 4 digits of the capcode.
0948 would be the access code for this pager. Now enter 0948. 
If you're lucky you'll get the main menu. My suggestion to you
is to change the access code as soon as possible.

If you're not so lucky, try guessing defaults. 1234, 1111, 1999, 2000, etc.
Until you come across the correct access code. If you're still having
trouble, try selling the pager to some moronic 14 year old who just wants
to look cool in front of his sleezy 14 year old girlfriends'.


Final words
-----------
Now that I've given you step by step instructions on how to
exploit the EN-POWR pre-paid pager, I hope that you've
learned a little bit about how it works.

In the next few months I can see the news talking about 
hundreds/thousands of Telus pagers going missing and then used for
the thieves' evil purposes. I'll sleep well at night knowing I was
the one responsible.

			      THE END


written by: The Clone
June 22, 1999


`Contact inf0
----
E-mail: theclone@edmc.net
URL: Nettwerked - http://nettwerk.hypermart.net
Voice Mail: So-Soft Corporation - 1-800-494-9831; box 407



__#~~_$$_#_#:;




              CNA List 

NPA  TEL NO          NPA  TEL NO
--------------------------------------
201  201-676-7070    601  601-961-8139
202  304-343-7016    602  303-293-8777
203  203-789-6815    603  617-787-5300
204  204-949-0900    604  604-432-2996
205  205-988-7000    605  402-580-2255
206  206-382-5124    606  502-583-2861
207  617-787-5300    607  518-471-8111
208  303-293-8777    608  608-252-6932
209  415-543-2861    609  201-676-7070
212  518-471-8111    612  402-580-2255
213  415-781-5271    613  416-443-0542
214  214-464-7400    614  614-464-0123
215  412-633-5600    615  615-373-5791
216  614-464-0123    616  313-223-8690
217  217-525-5800    617  617-787-5300
218  402-580-2255    618  217-525-5800
219  317-265-4834    619  818-501-7251
301  304-343-1401    701  402-580-2255
302  412-633-5600    702  415-543-2861
303  303-293-8777    703  304-344-7935
304  304-344-8041    704  912-784-0440
305  912-784-0440    705  416-979-3469
306  306-347-2878    706  *** NONE ***
307  303-293-8777    707  415-543-6374
308  402-580-2255    709  *** NONE ***
309  217-525-5800    712  402-580-2255
312  312-796-9600    713  713-861-7194
313  313-223-8690    714  818-501-7251
314  314-721-6626    715  608-252-6932
315  518-471-8111    716  518-471-8111
316  816-275-2782    717  412-633-5600
317  317-265-4834    718  518-471-8111
318  504-245-5330    801  303-293-8777
319  402-580-2255    802  617-787-5300
401  617-787-5300    803  912-784-0440
402  402-580-2255    804  304-344-7935
403  403-425-0052    805  415-543-2861
404  912-784-0440    806  512-828-2501
405  405-236-6121    807  416-443-0542
406  303-293-8777    808  212-334-4336
408  415-543-6374    809  212-334-4336
409  713-861-7194    812  317-265-4834
412  413-633-5600    813  813-228-7871
413  617-787-5300    814  412-633-5600
414  608-252-6932    815  217-525-5800
415  415-543-6374    816  816-275-2782
416  416-443-0542    817  214-464-7400
417  314-721-6626    818  415-781-5271
418  514-725-2491    819  514-725-2491
419  614-464-0123    901  615-373-5791
501  405-236-6121    902  902-421-4110
502  502-583-2861    904  912-784-0440
503  206-382-5124    906  313-223-8690
504  504-245-5330    907  *** NONE ***
505  303-293-8777    912  912-784-0440
506  506-648-3041    913  816-275-2782
506  506-648-3041    913  816-275-2782
507  402-580-2255    914  518-471-8111
509  206-382-5124    915  512-828-2501
512  512-828-2501    916  415-543-2861
513  614-464-0123    918  405-236-6121
514  514-725-2491    919  912-784-0440
515  402-580-2255    516  518-471-8111
517  313-223-8690    518  518-471-8111
519  416-443-0542    900  201-676-7070

##_$_$_~~..#


;^.**;^.**;^.**;^.**;^.**;^.**$
TELUS; 811 Self-Serve stratagem
;^.**;^.**;^.**;^.**;^.**;^.**$


-- 
Note;

This file was created mainly for revenge purposes.
I imagine someone with a bit of creativity could
think of numerous ideas. 

TELUS; 811 Self-Serve stratagem contains step by step
instructions, suggestions, etc. on how to fuck with
people's phonebills.
--
  	
Telus believes that *most* of its customers are able to manage
their phone bills by themselves with the help of a friendly
easy-to-use automated self-serve system. So a couple of years ago they
implemented this. When news comes that my phone company is creating 
"newer and better things", I feel it's my job to exploit them.

By calling 811 in the 780 area code, you will be connected to
Telus' automated system. The voice prompt answers by saying:
"Welcome to Telus communications. If you are calling for services 
within Edmonton city, please press one." 

Immediately after hearing this, go ahead and press one. 
The next prompt you hear will be a voice saying: 
"Thank you for calling Telus communications. Please take a moment to listen 
to the following choices before making your selection."

I won't waste your time by typing up every single option available 
because options change and darnit that'd just be plain silly!
Residential self-serve is the option you want to chose. 
Do that by pressing '4'. The next annoying prompt starts off with a 
beep and an automated voice saying: 
"Good morning/afternoon/evening and welcome to Telus communications." 
The first option available is self-serve. Press '1' to access it.

What you'll be prompted for next is your residential telephone number
including your area code. Okay, so we enter '7-8-0 444-4444'.
It takes a moment to process the request, but eventually you get another
prompt. Don't bother even listening to the options. Press '1' immediately.
Run out of patience yet? Good, press '1' again. 

What the voice asks for next is your 'personal identification number'
formerly known as the 'express-line access number'. Telus is stupid.
Your personal identification number is actually a series of numbers.
On your Telus phonebill you have an account number (usually 13 digits long)
at the top of your bill.
Take a look at the last four digits. Those numbers are what makes up
your personal identification number or PIN. 

By entering the PIN number, you now have the options of adding/removing 
calling features as well as disconnecting your telephone service. 
I hope I wasn't too vague with my option descriptions. 
But anyone with half a brain can figure out how to follow 
voice instructions. 

You're probably thinking: 
"Wow Clone, this is great. I just spent five minutes reading 
pointless blabber!"

Don't think too soon! I took it a step further. I thought: 
"Imagine if I could get a hold of an enemy of mine's phonebill. 
What could I do to really piss them off?"

I could easily do the same things previously mentioned; add/remove calling
features, and/or disconnect telephone service. Sound too good to be true?
Of course it doesn't.


Acquiring a phonebill
--

How easy is it? It all depends on where you look of course.
It's my assumption that you probably won't be going over to your
enemies house. Let alone be left unattended with a phonebill laying around
for you to steal. There is one other possibility that comes to mind...
trashing! 

The beautiful art of trashing. As hackers we do it. As phreakers we do it.
But why do we do it? To find neat stuff of course! In this case we're only
looking for phonebill(s).

If your enemy lives in a house, go through his garbage can.
If your enemy is the phone company, go through their trash bins.
Simple as that. Hope you have fun and get arrested. 


Written by: The Clone
Date: Wednesday, June 30, 1999

Contact info
--
URL: Nettwerked - http://nettwerk.hypermart.net
E-mail: theclone@edmc.net
Voice Mail: So-Soft Corp; 1-800-494-9831, BOX 407


Shouts
--
#canada on darkchylde.hackcanada.com, Edmonton 2600 krew,
and the Hack Canada (www.hackcanada.com) krew


~EOF~ 

;;>....


[SECTION II: www.edmc.net/~theclone/2k1ine/3.txt]	

	

		


 	
		










		
			




			




	











	
















































