STATION ID - 7047/3.12

9x Datakit Network
FOR OFFICIAL USE ONLY

This is a 9x system, restricted to authorized persons and for
official 9x business only. Anyone using this system, network or data
is subject to being monitored at any time for system administration and
for identifying unauthorized users or system misuse. Anyone using this
system expressly consents to such monitoring and is advised that any
evidence of criminal activity revealed through such monitoring may be
provided to law enforcement for prosecution.


                   .------------------------------------.
                   | HACKING THE CINDI VOICEMAIL SYSTEM |
                   |             BY STATD               |
                   `------------------------------------'

Werd up yo.  This document is more or less a nice little guide to acquiring
a voice mail box (VMB) on the computerized system called CINDI.  
Unfortunately, I don't know too much about the company, but it may be 
possible to order an official instruction system for this software if you
were to contact the company itself.  
Please excuse the "how-to" format I wrote this in.  It was really the only 
way I could write a text like this.  Not too much real theory in this, but
hopefully this will help revive VMBs in the scene.

Send all your complaints, comments, or anything else to my VMB at 
1-888-432-6245, ext. 212.

Greets to:   substance, phriend, pliny, oclet, kubiak, pioneer, all other 
             frequenters of #9x, syrus, thefloyd, akira, segv, andrewr, and 
             more and more people I can't think of right now.
                      

     OK.  This article will deal with breaking into CINDI voicemail systems.  
I have been working with this particular type of voicemail for almost two 
years now.  After reading this file, I hope that you will be able to get into
your own VMB (Voice Mail Box) on a CINDI system.
     I am assuming that you all know what 'scanning' is.  If not, this is
the basic concept:  call as many numbers as you can think of, random or
sequential, to find interesting or useful numbers.
     The first step to identifying a CINDI is to listen for an automated
menu.  This is usually just a recording of some lady in a noisy office telling
you what to press.  If the message mentions a directory of names, you *MIGHT*
be dealing with a CINDI.  If you are asked to press [1] for the directory, it
is a pretty good chance you're at one.  To be absolutely certain, press the
[#] key on your phone.  If it says "Please enter your mailbox" you've found a
CINDI.
     So, once you find a CINDI, write the number down and keep scanning until
you're satisfied.  Now it's time to get working.  Dial up your favorite CINDI
number.  Enter [1] for the names directory.  It will ask for a name of the
person you'd like to talk to.  Key in a common name like 'Smith' or 'Jones.'
It *SHOULD* give you a name and extension.  If the system can't find the name
specified, just enter two or three numbers and keep doing this until you find
a name.
     Now, assuming that you have name and extension (the name isn't really
important), get back to the menu you got when you called.  There is a nice
option in CINDI systems that makes our jobs a hell of a lot easier.  It's
called QuickMessage.  At the greeting message, hit the [*] key to enter this
mode.  Now, say the extension you got for Timmy Hincklebinder was 5593.  You
may wish to check that you got his extension right.  Simply enter his
extension at the voice prompt and it will play his recorded name (Umm...
h'llo... This is Timmy Hincklebinder.) and a nice lady's voice will say
'Recording...' followed by a short beep.
     OK.  You're sure that's him.  Now hit [#] followed by [*] to enter a new
extension.  The reason for getting Timmy's extension was to get a general idea
of where the boxes are.  So, at the voice prompt, enter in, perhaps, 5594.  If
you hear a person's name, keep repeating the process until you find one
without a name.  After entering, say, 5652, you hear nothing except for a
'Recording...' then you've found one of two things:

     (1).  A stupid individual who doesn't know how to record his name on
           the system.
     (2).  An empty box!  

     Now, we're really hoping that you've found the latter.  Be absolutely to
write down all numbers you find like this.  Once again, keep scanning until
you think you've got enough.
     You may think that hacking the box will be a problem, but that's where
you're wrong.  The hard part is pretty much over.  CINDI's are fairly
consistant with their default passwords for empty boxes.  Hit the [#] key and
listen for the 'Please enter your mailbox' prompt.  Say you have a list of
possible empty boxes - 5632, 5633, and 5634.  Enter 5632 at the prompt.  When
it asks for the security code, try one of the following:

     1111  -  Very common default code on CINDI systems.
     1234  -  Used sometimes, not as common as the former.
     9876  -  About the same as 1234.
     0000  -  If all else fails.

     If none of these work, the problem could be one of the two:  the system
has a nasty default code set for their boxes (NOT likely), or the box belongs
to someone, but they were too stupid to record their name.  If you believe
that your problem is of the former, try another CINDI.  The latter, keep
scanning for empty boxes.
     Well, let's move on now assuming you've gotten into a box.  Congrats!
CINDI systems are menu-driven and easy to understand from the inside of the
box.  Below are a few functions that you can do when inside a box:

     [5] - Play new messages, skip to next msg
     [3] - Delete current message
     [6] - Send a message
     [9] - Exit the box

     There are other functions, but as I can't remember ALL of them offhand,
once you're in a box, wait for the 'Ready' prompt and stay on the line.  It'll
read off more options.
     OK.  So after reading this text file, you should now be one of the two
things: one level dumber for having read this, or now fairly knowledgeable in
how to hack a CINDI.  You tell me.  Call my VMB at the number provided at the
top of the page, or reach me at chrono@nlcomm.com.

statd
9x