Jump to content


Photo
- - - - -

Mystery Number 1-800-909-5109


  • Please log in to reply
20 replies to this topic

#1 orion1

orion1

    DDP Fan club member

  • Members
  • 50 posts

Posted 25 June 2009 - 12:26 AM

1-800-909-5109. Also 1-800-909-5108.

This was the number that answered with a Wargames WOPR computer voice that simply said "ENTER". As far as I could tell, this number worked since the 1990's, and was an "automated transmitter system". My mission was to quietly find out everything I could about this number, do a lot of work, and then present it to you.

Have you had the bad feeling of experiencing things as if you destroy everything you touch? Whenever you find some lost gem 20 years old or more, it always disappears right after you discover it. Well, sure enough, as soon as I was going to do a reverse spoof to obtain some CNAM info on the number hopefully, it no longer works. The message is you cannot dial this number as dialed. Or perhaps it is blocked to all but a few numbers now? I called it too much? Didn't even record the sound, either. Damn that pisses me off. I was so curious what this number was.

Does anyone know any info about this number? Maybe it moved to a different number? What is an automated transmitter system?

any info appreciated

#2 ThoughtPhreaker

ThoughtPhreaker

    BinRev veteran

  • Members
  • 1,228 posts
  • Gender:Male

Posted 25 June 2009 - 12:54 AM

Damn, I'm going to miss that number too. I loved the voice. Anyway, it's probably not all that unique. The two other commercial radio stations I've learn about from the outside-in have something like this, albeit a later model. These're meant for remote access to transmitter/repeater equipment. If you wanted to find one of these in your local area, your best bet would be to do some research into the stations there. A CNAM lookup wouldn't have done you much good anyway - toll-frees don't have such niftiness. If you want to find out more about it, though, the number was provided by MCI/Verizon Business. If you talk to them, I'm sure you can get some more information about the owners. A certain person that used to go on this board did something similar when an ANAC he liked went down.

Also, when I get my internet connection and my other machines back on their feet, I can show you the kind of place where you'd physically find something like this.

#3 The Philosopher

The Philosopher

    The phorce is with me!

  • Members
  • 73 posts
  • Gender:Female

Posted 25 June 2009 - 06:53 AM

1-800-909-5109. Also 1-800-909-5108.

This was the number that answered with a Wargames WOPR computer voice that simply said "ENTER". As far as I could tell, this number worked since the 1990's, and was an "automated transmitter system". My mission was to quietly find out everything I could about this number, do a lot of work, and then present it to you.


As usual, it seems that ThoughtPhreaker beat me to it. I also recall excitedly contemplating the possibilities of that number when I discovered it in The Clone's hand scan of that INWATS prefix a few years (or was it a year and a half?) ago (other, more immediately enticing projects, however, prompted me to delay my experimentation with it). ThoughtPhreaker is correct, also as usual. These numbers are indeed used for remote access to transmitter equipment. The "voice" of the WOPR was far more high-pitched, but I digress. It is unfortunate indeed that you were unable to follow your original intent for exploration; I suspect we would have all benefited greatly from the outcome. Fortunately, though, although I never directly experimented with it, I did happen to come across some slightly "juicier" (i.e., more interesting) information regarding the uses of such numbers as the above posted, that you might find extremely intriguing:

Although this may seem obvious once stated, such numbers to "automated transmitter systems" are/were used, as I understand, to facilitate the expedient transmission of EAS (Emergency Alert System) broadcasts/alerts. This little-known fact came to my attention slightly less than a year ago at Defcon 16, at which I attended the excellent talk (really one of the best at the conference, in my opinion) of DCFlux regarding the EAS and its predecessors, entitled "Flux on: EAS". It can be found here: http://yoire.com/dow...con-16-flux.pdf and here: https://miroguide.co...eds/9522?page=7 , in PDF and video respectively. I would highly recommend that you read/view it, especially in light of your interest in the aforementioned numbers. Although he never directly stated that these systems are used for EAS broadcasts, he did happen to mention in passing the role of remote access to transmitter equipment in emergencies. Intrigued, and impressed greatly with the talk in general, I spoke with him later in the conference, mentioning the number that I had discovered, and he said that, indeed, EAS broadcasts were/are a use of these systems and corresponding numbers, and he suggested furthermore that it may be possible, if one replicated the protocol/format of EAS broadcasts (fully outlined in the talk) and transmitted it through one, to send an alert. It seems surprisingly plausible, since the protocol is rigidly defined and all elements of it are replictable. In fact, an interesting, cryptic sentence is scribbled in my notes from the talk preceded by a rather conspicuous asterisk under the heading "Modulation Standards", derived from something that Flux must have mentioned during it: "Strange tones and baud rates seemingly offer the only forms of security to prevent people from sending tones." Hastily transcribed it is, to be certain, but it piqued my curiosity enough for me to inquire after Flux on the matter. Following the conference, I briefly entertained lofty notions (purely theoretical/conceptual, of course-a thought experiment) of "spoofing" an EAS broadcast, as it were, through access to such an "automated/remote transmitter system", with that particular number in mind...

Now, insofar as future access to such systems, I would ordinarily advise you to scan for more numbers to them, but since they seem to be quite rare (especially INWATS numbers), I would hardly bother. You may be able to attain them through social engineering, though. ThoughtPhreaker is correct in his statements regarding another unfortunate detail-the CNAM data for toll-free numbers is simply "TOLL FREE". However, all hope may not be lost. The toll-free number to this system may be down, but the ordinary number to which it routes may not be. The error message suggests, not being a "DISCO/NIS" message with the three ubiquitous S.I.Ts, that this 800 number may simply no longer route to the actual number of the system. (I am here assuming your awareness of the fact that all INWATS numbers (not "actual" INWATS, but toll-free 8XX numbers) route to an ordinary telephone number with an actual NPA. The routing is naturally far more complex than this woefully brief overview would imply, but the relevance of this to this particular topic is insufficient to justify the use of additional space to expound upon it-articles/material exists in abundance on the subject.) If you could somehow discover to which number this once routed, you may just find it to still be active-a remote possibility, but a possibility nonetheless.

Have you had the bad feeling of experiencing things as if you destroy everything you touch? Whenever you find some lost gem 20 years old or more, it always disappears right after you discover it.


Well, yes, I have experienced that feeling, in a more general context, and in a very few instances specific ones. Upon initially discovering the phreaking "scene" and all of the wonders therein throughout the years, I believed that I had discovered several "lost gem[s] twenty years old or more" in the form of several phreaking textfiles, most related to varieties of color boxing. Just as I had begun to read of the miracle that was redboxing, ACTS use (and payphones, for that matter) began to quickly diminish into oblivion, lost to the ages. I "lost" one (and nearly two) perfectly good years that I could have spent furthering my "H/P education" due to the tremendous despair that I felt upon realizing that little to none of the phreaking material I had acquired during this early and formative period was valid any longer. I vehemently advise you not to make the same mistake. You would be absolutely amazed, astounded at the amount of such gems in existence, lurking in the more obscure corners of the PSTN, the Internet, and every other network, just waiting to be discovered. If it is presently possible and practical, wardial/scan an entire prefix (local or 8XX, preferably the latter) and you will begin to understand this. Scan old x.25 networks with the same fervor. There is an entire underbelly of the world's communications/technological infrastructure, a seamy side in which many such things of interest are easily accessible, still, and the realization of its existence and exploration of it is the chief step, in my view, to graduating from an "outside-in" dabbler to a serious hacker/phreak. Again, there are a great many true gems, some years and more rarely decades old, for you to stumble upon. Not to gloat or fill anyone's imagination with false fancies, but yes, I speak from a great, great deal of experience. :) In the words of ls-la in the article, "Phreaking Your Local EWSD", "...that's all I have to say about that."

/me nudges everyone on my Binrev friends list, especially radio_phreak

I wish you the very best of fortune in all of your future H/P technological exploration/exploitation endeavors, and as usual, feel completely free and encouraged to PM, email, or otherwise contact me with any inquiries that you may harbor regarding specific technologies, general observations, or if you simply wish to discuss a bit of any of the above in more detail.

#4 orion1

orion1

    DDP Fan club member

  • Members
  • 50 posts

Posted 25 June 2009 - 02:16 PM

Thanks a lot, Philosopher. I assume you had to modem in at non standard rates and send tones that would not be casually accessible to get into the mystery number. I have a number for reporting trouble to that number.

trouble reporting number : 1-800-828-4984

800 - 909 - 5109

Number Status: WORKING
Status Date: 01/24/94
Company: Verizon Business
Contact Number: 8009425000

MCW22 may mean......

Verizon Business - MCW22
800-828-4984
MCI Wholesale - MCW22
866-603-4168

#5 orion1

orion1

    DDP Fan club member

  • Members
  • 50 posts

Posted 25 June 2009 - 02:22 PM

None of these 4 work anymore....5110 is a fax or something, probably not the same "pulse" sound as before.




1-800-909-5100
1-800-909-5101
1-800-909-5102
1-800-909-5103
1-800-909-5104
1-800-909-5105
1-800-909-5106
1-800-909-5106
1-800-909-5107
1-800-909-5108 - Short Beep
1-800-909-5109 - Robot "Enter" Voice
1-800-909-5110 - Pulse Tones
1-800-909-5111
1-800-909-5112
1-800-909-5156 - Ticking sound

#6 ozlo

ozlo

    Mack Daddy 31337

  • Members
  • 226 posts

Posted 27 June 2009 - 05:59 PM

I've encountered a few of these "ENTER" voice prompts in the past. I'll have to check my records and see if any of them are still active.

One of my favorite numbers was for a low power AM transmitter that broadcast information on historical landmarks of the area. The system allowed you to completely change the recordings it played on a loop. Unfortunately I think it's no longer active. :cry:

#7 ThoughtPhreaker

ThoughtPhreaker

    BinRev veteran

  • Members
  • 1,228 posts
  • Gender:Male

Posted 28 June 2009 - 06:36 AM

Reminds me a bit of those highway information stations you always see signs for on the interstates. Y'know, the ones with TTS voices that read off traffic and weather info?

There was this one time I was passing through Wyoming, and there was this really violent thunderstorms. In the background of the TTS station, you could faintly but distinctly hear a synthesized voice going 'HELP! HELP! HELP!' Eeiry...

#8 IndexPhinger

IndexPhinger

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 481 posts
  • Country:
  • Gender:Male
  • Location:192.168.0.254

Posted 29 June 2009 - 11:48 AM

Thats epic, I'm sure that some of the crappyer towns here have a few of the transmitter caretakers alive.

:P

#9 DCFluX

DCFluX

    Will I break 10 posts?

  • Members
  • 3 posts
  • Gender:Male

Posted 14 August 2009 - 03:26 PM

Amazing what comes up when you type your name into Google.

These transmitter controllers are made by Sine Systems, although it does seem odd to have a transmitter on an 800 number.

The Model is the RFC 1/B

http://www.sinesys.com/pages/rfc1.html

The phone number didn't work for me, but the earlier generations of RFC 1/B used the SPO-256 allophones processor as sold at Radioshack during the 80s, "Radio Waves" by Roger Waters uses this synthesizer as the voice of Billy if you want to know what it sounds like.

The later models use precanned words and curiously some 3 stooges audio clips recorded on an ISD chipcorder.

When prompted by "Enter" you have to enter up a 8 digit password. Try the station's phone numbers, address or frequencies or any mix. Factory default is 12345678.

While you could use the RFC 1/B, For dedicated EAS entry I would use a dial up adapter. I have the DR-10 on one of my stations. Those just beep to prompt for the password though.

http://www.sinesys.com/pages/dai2.html
http://www.broadcast...ts/dr10-ad.html

#10 ThoughtPhreaker

ThoughtPhreaker

    BinRev veteran

  • Members
  • 1,228 posts
  • Gender:Male

Posted 14 August 2009 - 08:22 PM

Oh, right, I was going to post some pictures of a transmitter site. Totally forgot about that.

http://thoughtphreak...te/IMG_0678.JPG

http://thoughtphreak...te/IMG_0681.JPG

http://thoughtphreak...te/IMG_0689.JPG

http://thoughtphreak...te/IMG_0693.JPG

http://thoughtphreak...te/IMG_0699.JPG

You'll have to excuse the brightnesss. These pictures were taken a little before sunset, but it was still ridiculously bright out. Like, as in, bright enough that you could barely see the LCD display.

Anyway, it's good to have someone here that can identify these things, I've been wondering for a long time about them. So the earlier generations are exactly the same as far as programming content goes? One other thing I was curious about, is there a low pass filter in the circuit? I noticed when you compare the sound files on the website to the real deal, they sound a lot more muted then normal telephone audio does.

Edited by ThoughtPhreaker, 14 August 2009 - 08:46 PM.


#11 DCFluX

DCFluX

    Will I break 10 posts?

  • Members
  • 3 posts
  • Gender:Male

Posted 17 August 2009 - 06:25 PM

So the earlier generations are exactly the same as far as programming content goes? One other thing I was curious about, is there a low pass filter in the circuit? I noticed when you compare the sound files on the website to the real deal, they sound a lot more muted then normal telephone audio does.


Pretty much I think the programming is the same, but there are like 5 different software versions and I think 2 major hardware revisions, the biggest change being the difference in speech generator.

Later versions might of also gone with a different DTMF decoder, the schematic I'm looking at right now uses the SSI-202, which curiously was also sold at Radio Shack. A more readily available device is the MT8870.

As for the audio, they probably just made a .wav sample with the audio that was recorded into the ISD2590, not the actual audio from a completed unit over a phone line. Because of its design the ISD chips have to be "programmed" with analog audio coming from a computer in real time and because the audio is stored in analog memory cells no 2 chips are ever 100% identical.

Also AM sites may have extra filtration to keep the station's audio out of the phone lines and you may be hearing that.

#12 IndexPhinger

IndexPhinger

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 481 posts
  • Country:
  • Gender:Male
  • Location:192.168.0.254

Posted 24 August 2009 - 01:59 AM

Amazing what comes up when you type your name into Google.

These transmitter controllers are made by Sine Systems, although it does seem odd to have a transmitter on an 800 number.

The Model is the RFC 1/B

http://www.sinesys.com/pages/rfc1.html

The phone number didn't work for me, but the earlier generations of RFC 1/B used the SPO-256 allophones processor as sold at Radioshack during the 80s, "Radio Waves" by Roger Waters uses this synthesizer as the voice of Billy if you want to know what it sounds like.

The later models use precanned words and curiously some 3 stooges audio clips recorded on an ISD chipcorder.

When prompted by "Enter" you have to enter up a 8 digit password. Try the station's phone numbers, address or frequencies or any mix. Factory default is 12345678.

While you could use the RFC 1/B, For dedicated EAS entry I would use a dial up adapter. I have the DR-10 on one of my stations. Those just beep to prompt for the password though.

http://www.sinesys.com/pages/dai2.html
http://www.broadcast...ts/dr10-ad.html



Heres my contribution :)

Attached Files

  • Attached File  001.wav   430.71KB   18 downloads


#13 ThoughtPhreaker

ThoughtPhreaker

    BinRev veteran

  • Members
  • 1,228 posts
  • Gender:Male

Posted 24 August 2009 - 04:03 AM

I'm a little confused here. A pitch-shifted controller with stereo noise?

#14 IndexPhinger

IndexPhinger

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 481 posts
  • Country:
  • Gender:Male
  • Location:192.168.0.254

Posted 24 August 2009 - 09:16 AM

I'm a little confused here. A pitch-shifted controller with stereo noise?


Well I didn't know what these units sounded like out in the field, so I put something together based on what I read about the RFC1/B and based it on the billy synth from "radio waves", and some AM and telephone static in the background.

#15 ThoughtPhreaker

ThoughtPhreaker

    BinRev veteran

  • Members
  • 1,228 posts
  • Gender:Male

Posted 24 August 2009 - 06:39 PM

Well I didn't know what these units sounded like out in the field, so I put something together based on what I read about the RFC1/B and based it on the billy synth from "radio waves"


Judging by the quality of the samples, it sounds to me like you were just using Chiptalk. Y'know, you can get a copy of samples that wasn't recorded by some guy with a noisy microphone, right? :) http://little-scale....ample-pack.html



#16 IndexPhinger

IndexPhinger

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 481 posts
  • Country:
  • Gender:Male
  • Location:192.168.0.254

Posted 25 August 2009 - 02:17 PM

Well I didn't know what these units sounded like out in the field, so I put something together based on what I read about the RFC1/B and based it on the billy synth from "radio waves"


Judging by the quality of the samples, it sounds to me like you were just using Chiptalk. Y'know, you can get a copy of samples that wasn't recorded by some guy with a noisy microphone, right? :) http://little-scale....ample-pack.html



yep, caught red handed, but yeah I think i'll redo it later today.

#17 DCFluX

DCFluX

    Will I break 10 posts?

  • Members
  • 3 posts
  • Gender:Male

Posted 01 September 2009 - 04:29 PM

The ones I have don't say "Incorrect", they just hang up after the access wrong code.

After the correct code is entered you will get something to the effect of "KGMN FM Transmitter"

At which time you can query the panels, Like 01 gets you "Panel Zero One, 3.02 kilo volts"

#18 IndexPhinger

IndexPhinger

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 481 posts
  • Country:
  • Gender:Male
  • Location:192.168.0.254

Posted 05 September 2009 - 03:45 AM

The ones I have don't say "Incorrect", they just hang up after the access wrong code.

After the correct code is entered you will get something to the effect of "KGMN FM Transmitter"

At which time you can query the panels, Like 01 gets you "Panel Zero One, 3.02 kilo volts"


Yeah, I could do that :p

#19 nwbell

nwbell

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 339 posts
  • Location:320-land

Posted 09 September 2009 - 10:37 AM

Yeah. I was going to add some tech info about those Sine Systems remotes, but you guys already beat me to it.

I had a client some time back for whom I built an Asterisk system; they had an RFC1 running out in the field, and were constantly bugging me when said remote would ignore their DTMF tones. They blamed it on the Asterisk box not generating long/loud/accurate enough tones; I blamed it on the remote being mostly deaf. After 8+ months of wrangling, we got the station engineer involved, and it turned out I was right :)

They used to send me recordings of the thing misbehaving on a regular basis. I'll see if I can dig some up and post 'em (seem to recall doing so a year or two back?).

#20 nwbell

nwbell

    SUPR3M3 31337 Mack Daddy P1MP

  • Members
  • 339 posts
  • Location:320-land

Posted 09 September 2009 - 11:15 AM

Guess you can't add attachments when editing... so here's another post with the goods. It's pretty much a mini-demo of what an RFC1 sounds like, made by me a while ago. I "bleeped out" the call letter ID at the beginning of the call, but the rest is intact.

Attached File  sineremote.wav   1.01MB   7 downloads




BinRev is hosted by the great people at Lunarpages!