8 replies to this topic

[awesomeusername]

I have been very interested for a while on how these restaurant pagers, like the kind you see at Red Lobster or Chili's, work. I don't know anything about pagers or what frequencies they use, but it would be awesome to know. Can anyone shed any light on this? To be able to create a device that can replicate the signal that is sent out to the pagers would be pricessless. Could you imagine the chaos it would create if everyone got up at the same time on a busy day?!

[friendless]

Hmmm I was actually interested in this before also... if you have a laptop you could probley sit outside your car with some kind a radio reciever and see what shows up...

or grab the device and just walk out and never come back and try things on it from there...

That or work there and find out what sends the signals

[awesomeusername]

Yeah, those are some options. What type of software/hardware is out there to intercept such signals and make sense of them? I guess buying the base station and a receiver would be a good way to test some stuff out. I wonder if each base station has its own key when it sends out broadcasts. I would imagine so because you couldn't have two restaurants in close proximity because they'd go apeshit. BUT, if this weren't the case, you could just buy a used base station and go to town.

[savant]

According to this ebay link, the devices operate on UHF radio.

http://www.jtech.com...PeopleAlert.pdf

This guy says that it operates in 450-474 mhz range, and even has a module to dial in over telephone. Sweeeet.

[awesomeusername]

Interesting manual I found:
http://www.blufiusa....HF-Commpass.pdf

Cap Codes
POCSAG (POC) pagers must receive a special seven-digit “address” to let it know that the message that follows is for this particular pager. This “Address” is referred to as its Cap Code. A Cap Code is the actual seven-digit numbers that must be received by a POCSAG pager to have the pager receive a message. The number of the pager is not necessarily the same as the Cap Code. JTECH assigns and manages unique 3-digit prefixes to provide site uniqueness and eliminate potential interference from other nearby businesses operating on the same frequency.

Edited by awesomeusername, 07 March 2008 - 11:25 PM.

[UTS_HOST]

i found one place in MN where they operated on 802.11 and was sending clear text commands to page it... lol

[spyhunter]

Once you go out of range they start beeping like crazy.. could be bad if your "getaway" is on a public bus or something..

or grab the device and just walk out and never come back and try things on it from there...

[PurpleJesus]

We were talking about something similar a while back.. Wonder if they share any special circuity?

http://www.binrev.co...showtopic=21354

Edited by PurpleJesus, 10 March 2008 - 11:56 PM.

[awesomeusername]

We were talking about something similar a while back.. Wonder if they share any special circuity?

http://www.binrev.co...showtopic=21354

Very cool thread. I know I saw some threads before but the search button wasn't being my friend. Those radioshack frequency scanner that they're talking about, can someone give me a link to the item on radioshack so I have an idea of what they are?

It seems quite simple to make a pager go off. I mean, all you would need would be to record the incoming frequency that sets off a pager. Then just play it back to make it go off again right? These pagers don't send any information back right? I'm under the impression it's a one-way type deal and there's no handshaking involved.

I was also thinking that one could create a brute force device that sends out every combination of the 7-digit sequence of numbers that identifies the pager to make them eventually all go off. I'm not sure how long it would take (10,000,000 combinations). I know that a 7 digit password can be bruteforced in no time at all with jack the ripper.

Edited by awesomeusername, 12 March 2008 - 12:37 PM.