"An Interesting Diversion"

By Lord Phreaker

From: 2600 magazine, October 1985


-------------------------------------------------------------------------------
A diverter is a form of call forwarding.  The phone phreak calls the customers
office phone number after hours, and the call is "diverted" to the customers
home.  This sort of service is set up so the phone subscriber does not miss
any important calls.  But why would a phreak be interested?  Well, often 
diverters leave a few seconds of the customers own dial tone as the customer
hangs up.  The intrepid phreak can use this brief window to dial out on the 
called party's dial tone, and, unfortunately, it will appear on the diverter
subscriber's bill.

HOW DIVERTERS ARE USED

One merely calls the customer's office number after hours and waits for him
to answer.  Then he either apologizes for "dialing a wrong number" or merely
remains silent so as to have the customer think it's merely a crank phone
call.  When the customer hangs up, he just waits for the few seconds of dial
tone and then dials away.  This would not be used as a primary means of
calling as it is illegal and multiple wrong numbers can lead to suspicion,
plus this method only works at night or after office hours.  Diverters are
mainly used for calls that cannot be made from extenders, International
calling, or the calling of Alliance Teleconferencing (see 2600, May 1985) are
common possibilities.  Another thing to remember is that tracing results in
the customer's phone number, so one can call up TRW or that DOD NORAD
computer with less concern about being traced.

Some technical problems arise when using diverters, so a word of warning is
in order.  Many alternate long distance services hang up when the called
party hangs up, leaving one without a dial tone or even back at the extender's
dial tone.  This really depends on how the extender interfaces with the local
phone network when it comes out of the long haul lines.  MCI and ITT are known
to do this frequently, but not all the time.  Also, hanging on the line until
"dial window" occurs doesn't work every time.

Now the really paranoid phreaks wonder, "How am I sure that this is ending
up on someone else's bill and not mine?"  Well, no method is 100% sure, but
one should try to recognize how a full disconnect sounds on the long distance
service of his choice.  The customer's hanging up will generate only one click,
because most diversions are local, or relatively local as compared with long 
distance.  Also, the customer hanging up won't result in winks - little beeps
of 2600 hertz tones heard when an in-band trunk is hung up.  The 2600 hertz
tone returns to indicate the line is free, and the beginning burst of it is
heard as it blows you off the line.  Also, if there are different types of
switching involved, the dial tone will sound radically different, especially
between an ESS and a crossbar or step-by-step, as well as sounding "farther 
away".  These techniques are good for undrstanding how phone systems work and
will be useful for further exploration.  The really paranoid should, at first,
try to dial the local ANI (automatic number ifentifier) for the called area
and listen to the number it reads off.  Or one merely cals the operator and
says, "This is repair service.  Could you tell me what pair I am coming in on?"
 If she reads off the phreak's own number, he must try again.

HOW TO FIND DIVERTERS

And now a phreak must wonder, "How are these beasties found?"  The best place
to start is the local yellow pages.  If one looks up the office numbers for
psychiatrists, doctors, real estate agents, plumbers, dentists, or any
professional who generally needs to be in constant contact with his customers
or would be afraid of losin gbusiness while at home.  Then one merely dials up
all these numbers after 6:00 or so, and listens for multiple clicks while the
call goes through.  Since the call is local, multiple clicks should not be the
norm.  Then the phreak merely follows through with the procedure above, and
waits for the window of vulnerability.

OTHER FORMS OF DIVERTERS

There are several other forms of diverters.  Phreaks have known for years of
recordings that leave a dial tone after "ending."  One eof the more famous was
the DoD Fraud Hotline's after hours recording, which finally ended, after
multiple clicks and disconnects, at an Autovon dial tone.  One common practice
occurs when a company finds its PBX being heavily abused after hours.  It puts
in a recording saying that the company cannot be reached now.  However, it
often happens that after multiple disconnects one ends up with a dial tone
inside the PBX, thus a code is not needed.  Also, when dialing a company and
talking (social engineering) with employees, one merely waits for them to hang
up and often a second dial tone is revealed.  976 (dial-it) numbers have been
known to do this as well.  Answering services also suffer  from this lack of
security.  A good phreak should learn never to hang up on a called party.  He
can never be sure what he is missing.  The best phreaks are always the last to
hang up the phone, and they will often wait on the line a few minutes until
they are sure it's all over.  One item of clarification - the recordings
mentioned above are not the telco standard "The number you have dialed..." or
the like.  However, telco newslines have been known to suffer from diverter
mis-disconnect.

DANGERS OF DIVERTING

So, nothing comes free.  What are the dangers of diverting?  Well, technically,
one is committing toll fraud.  However, a list of diverter numbers is just
that, a list of phone numbers.  Tracing is a distinct possibility but the
average diverter victim does not have the technical knowledge to identify
the problem.

There has been at least one investigation of diverter fraud involving the FBI.
However there were no arrests and the case was dropped.  It seems that one
prospective victim in Connecticut realized that he was being defrauded after
receiving multiple phone calls demanding that he put up his diverter NOW so
that a conference call could be made.  He then complained to the FBI.  
However, these aware customers are few and far between, and if a phreak does
not go to such radically obnoxious extremes, it is hard to be caught.  Unless
the same number is used to place many expensive calls.