STATION ID - 7091/6.411

9x Datakit Network
FOR OFFICIAL USE ONLY

This is a 9x system, restricted to authorized persons and for
official 9x business only. Anyone using this system, network or data
is subject to being monitored at any time for system administration and
for identifying unauthorized users or system misuse. Anyone using this
system expressly consents to such monitoring and is advised that any
evidence of criminal activity revealed through such monitoring may be
provided to law enforcement for prosecution.

			Guide to Extenders and PBXs
			      By: quiksilver

Greets: 9x members, Substance, AgntOrng, c3l, T5-r, and the people I forgot.

I will probably use a few abbrevations in this, so its would be good to know
them.  Here they are:

PBX: Private Branch eXchange
ANI: Automatic Number Identification
LD: Long Distance
ACN: Area Code and Number
IES: Internal Extension System
SCC: Specialized Common Carrier
ESS: Electronic Switching System
CAMA: Centralized Automated Message Acounting

A PBX and a extender are not the same thing.  They are used as the same word because you can use them to accomplish the same goal: making a free ld or local call.  First, I will talk about PBXs.

A PBX is a baically a few telephone numbers owned by a company.  PBXs are present when a company has a IES.  An IES is a system in which a person at his desk can dial three numbers to reach another person's desk in the same office.  If the person wants to
 dial outside of their office or building, they must dial 9 then the acn.  I have also seen * and # instead of 9.  Some PBXs have dial up lines so the people can work from home.  This way, the employees don't have to pay for their business calls.  The com
pnay gives each employee a certain authorazation code, so they can call the dialup of the PBX, enter their authorazation code, and press 9 (or *,#), then the acn, and their compnay pays for the call.  You can tell if you've found a PBX if there is a diffe
rent ringback.  I suppose you'll know if you found one.  You can get them by randoming dailing numbers, or use your social engineering skills.

An extender is a service setup by a telephone company.  Basically, a extender has the same function as a phone card.  You dial the phone number the phone company gives you, enter your authorazation code, and the dial the acn (no 1).  Extenders can be foun
d in the 800 NPA or in the 950 range.  950 numbers are free from your house, but not a pay phone.  There a few possible ways to find extenders.  You could call the phone company and say you forgot the phone number where I can enter my authorozation code. 
 Another way is to randoming dialing numbers.  I would use 800 numbers first.  

Ways of knowing you found an extender.     
1.  Get a dialtone after dialing the number.
2.  Short beep then silence.
3.  Constant tone that stops when you dial something.
4.  If you are asked for the code and phone number  (kind of obvious)

So if you find one of those, then you MAY have found an extender.  Number three is most likely an extender.  I've never really seen any that aren't.  Once you have found an extender, you must find out how many digits are in the code, and if it wants the c
ode or acn first.  That's the hard part, I guess you should just play around with it.  Listen for tones.

Most extenders are 800 numbers, and most 800 numbers are equipped with the ability to trace.  Most extenders and PBXs have ANI which means it knows your phone number when you call.  PBXs can sometime be found in local areas.  Extenders can normally call a
nywhere to the US and Canada.  All the PBXs I use can call basically anywhere.  950 extenders have a nice clear connection, nice for data transfers.  

I must now explain something about the phone company so I can tell you how to not get caught. ESS has the ability to trace calls.  ANI is what enables ESS to trace.  ESS also has a tape which records information about phone calls.  This is called CAMA.  I
t records the number of the caller and receiver, the time of the call, if the reciever answered the phone, and what time the caller hangs up.  The tape is used for billing purposes.  Normally, 800 numbers and local calls are ignore when it is sent for bil
ling.  The billing machines are quite sensitive though.  

Here is a list of what extenders can detect (from my knoledge, I wouldn't be suprised if this list could be doubled.)
1.  Sequenticial Dialing (if you use this, you saying "I want to get caught.")
2.  Number of calls coming from a phone number (try to scan during the day, becuase who would make 400 calls at 3:00 a.m.?)
3.  Time between calls.  (like 5 calls in a minute, or if there is a code failure every couple of minutes.)
4.  Time it takes to dial a number.  (not many people can dial a phone number in 50 miliseconds.)
5.  Amount of time between each number.  (not many people can have exactly 1 milisecond between the 8 the 0 and the 0.)
6.  (I hear rumors that they have list of sprintnet and tymnet numbers, so don't call sprintnet and tymnet all the time, makes sense to be true).

Basically, what I'm getting at is to use randomnization.  I would recommend dialing everything by hand, but that would take to long, so find yourself a good code hacker that has randomnization.  I don't really use them, so I don't know of any.

Also, if you happen to find some codes, don't go crazy.  If you get 
caught, you probably won't go to court or anything like that.  The phone company will probably just send you a bill.  Some people say to distribute you authorozation codes so that the ph
one company can't bill all the people using their extenders or PBXs. In a case like this, they would probably bill the persons who used it most.

 * this is for information purposes only dont blame 9x