`-`                                                 `_`
	TELUS Mobility; Panasonic EN-POWR Numeric Pager Exploit
        __                 |VERSION: 2.0|                    __


by: The Clone
written: Tuesday June 22, 1999
revised: Wednesday August 25, 1999


    Telus Mobility offers to its customers, 
few types of paging services. One type is called 'EN-POWR numeric pager'. 
With the EN-POWR numeric pager, you get total FLEX coverage. 
In other words, you get coverage all across Alberta.

The Panasonic EN-POWR pre-paid numeric pager is only $99.95, and it comes
with 6 months of enhanced service with a limited but nifty selection
of assorted colors to choose from. 

"But Clone, I have three kids to feed. 
I can't afford this type of service!"

It's completely understandable. That is why I wrote this file.
To show you how to get service that *should* be dirt cheap for 
absolutely free. 

Lets say that one day you were walking down the street minding your
own business, picking flowers, waving to Telus employees as they drive
past in their goodie-vans, when you trip over a pager that has the
word 'Panasonic' labeled on the top. 

This semi-transparent device, with its groovy design is the only thing 
stopping you from suing Telus for leaving its property laying around. 
Then you remember that it's an EN-POWR pre-paid numeric pager and it
has to be property of someone. 

"Hmm..." you think. At this point you can do one of two things;
you can call Telus reporting a missing pager, or you can try to
use your wits to find a way to exploit this.

First lets take a look at the pager features:

Pager features
--------------
· saves 23 messages
· message time stamp
· built in alarm clock
· silent vibration or audible alert
· low battery alert
· shows date and time of day
· selective erase/erase all
· locks important messages
· uses only one AAA battery
· FLEX technology gives you up to 
  four months battery life
· duplicate message indicator
· reminder alert
· backlit display
· automatic on/off


'Saves 23 messages', thought of anything yet? ;)
Sure you have my analytical friend. Along with numeric paging option, 
you also get a voice-mail paging option which requires you to dial the
number the pager is subscribed to.

So you think "How am I going to get this pager number?"
             ------------------------------------------
One easy way is to wait for someone to page you.

Usually friends of the pager customer, don't know the pager is in the
wrong hands so they unknowingly send them a voice-message. Bad idea.
The minute they send that message, the data is sent to the Telus Mobility
switch, and straight to the pager itself. What is displayed?
The pager number, silly!  

(note: if a numeric page is sent, the numbers
displayed on the screen are whatever the person who sent it typed.)

The next step is easy, you call the number. The next thing you'll hear
is one of two things; 1. the customers message, 2. Telus' default message.

By simply pressing '0' on the keypad, you'll next be prompted by an
automated voice saying: "Please enter your access code". 


"How do I acquire the access code?" 
--------------------------------

If the customer was stupid enough to set the default access code, 
all you do is look on the back of the EN-POWR numeric pager, 
and search for the "capcode".

The capcode is the series of numbers at the bottom of the label, 
below the Model, Serial Number, Country Code, and ISC code.
It's easily distinguishable by the letter E and a 7 digit code
after it. An example of a capcode is 'E1230948'. 

The default access code is the last 4 digits of the capcode.
0948 would be the access code for this pager. Now enter 0948. 
If you're lucky you'll get the main menu. My suggestion to you
is to change the access code as soon as possible.

If you're not so lucky, try guessing defaults. 1234, 1111, 1999, 2000, etc.
Until you come across the correct access code. 

(Note: There are smart customers who do change their access codes.
                Access codes can be from 4 to 8 digits.)


--
		Paging Command Options: 
 	    (For Use With Touch Tone Phone)


Lets assume you've hacked the pager's access code. 
Unless you've acquired yourself the user manual, you're probably not 
going to have an easy time messing around in this slow, half-assed system.
I apologize if any of you have gotten confused while in TELUS' paging 
system. These simple commands should help...


How To Use Voice Messaging Service
``````````````````````````````````
- Dial your Pager Number (mailbox) _______

- Press 0 during the Greeting Mode.

- Press your security access code (      )

- Press 1 0 to hear the number of messages in the mailbox.

- Press 3 to hear the most recent message.

- Press 5 to replay a message.

- Press 7 after a message to get the time and date it was sent.

- Press 2 to delete the message just played.

+ Press # and hang up to disconnect.
+ Press * if you need help at any time.
		
	    
How To Update Your Personal Greeting 
````````````````````````````````````
- Dial your Pager Number (mailbox) _______

- Press 0 during the Greeting Mode.

- Press your security access code (      )

- Press 1 1 to transfer to greeting message mode.

- Press 3 0 to begin recording new greeting.

- Press 1 to stop recording.

- Press 4 0 to playback your new greeting.

- Press 1 0 to re-enter message retrieval.

+ Press # and hang up to disconnect.
+ Press * if you need help at any time.


How To Change Your Personal Access Code
```````````````````````````````````````
- Dial your Pager Number (mailbox) _______

- Press 0 during the Greeting Mode.

- Press your security access code (      )

- Press 1 7 to use the Update Access Code feature.

- Press 3 + new access code (4 to 8 digits) + # sign.

- Press 4 to playback your new access code again.

+ Press # and hang up to disconnect.
+ Press * if you need help at any time.


Final words
-----------
Now that I've given you step by step instructions on how to
exploit the EN-POWR pre-paid pager, I hope that you've
learned a little bit about how it works.

In the next few months I can see the news talking about 
hundreds/thousands of Telus pagers going missing and then used for
the thieves' evil purposes. I'll sleep well at night knowing I was
the one responsible.

			      THE END


`Contact inf0
----
E-mail: theclone@code.penguinpowered.com
URL: Nettwerked - http://nettwerk.hypermart.net
Voice Mail: 1-800-909-6042

	
				A 
		        N E T T W E R K E D
			   P R O D U C T