Basics on Answering Machine Hacking
by horrid
Before you all start complaining, I know that in the 1980s and early 1990s, about a million texts were being spread around BBSes about Voice Mailbox (VMB) and answering machine hacking.
This article is, of course, more recent and contains more information about certain brands of answering machines to aid you in getting into an answering machine (provided you know what brand of machine it is).
Also, it focuses more on three-digit passcodes as well as two-digit ones. If you don't know what brand the machine is, this article will also contain a generic overview of gaining remote access to answering machines.
Why would you want to hack an answering machine? There are a number of reasons such as spying on people (such as your girlfriend/boyfriend/wife/husband) or just for fun and games (pranking or changing the Outgoing Message or OGM). Once you are into an answering machine you can listen/delete messages and/or change the OGM to say whatever you want it to. You decide for yourself why you would want to hack an answering machine.
Most answering machines require you to enter the password while the OGM is being played. However, some require you to hit a certain key (such as 0, *, or #) after which it will say "Please enter your password" or perform a series of beeps.
A few answering machines require the password after the OGM has finished and the long beep has been played. Some answering machines will disconnect you after you enter a certain number of digits (in which case, you'll need to call back and start again).
Case in point, the Panasonics made in the early-1990s (and maybe afterwards?) require a two-digit passcode during the OGM and will disconnect you after six digits have been entered if they don't contain the password sequence.
If you think you are dealing with an old answering machine that uses a two-digit passcode (such as fairly old Panasonic or AT&T answering machines), there is an easy way to break into it or any two-digit machine that is simply listening for the correct sequence of numbers. Simply call it and then enter this number during the OGM (or after you hit the initialization key to get the machine to listen for a passcode):
The above number works on every two-digit passcode (provided it is like most answering machines that don't read the digits in groups of two or three but rather just listen for the right sequence).
It works because it contains every possible two-digit passcode. This is very effective. If you get cut off or don't get it all entered during the OGM, call back and start with the number you got cut off on.
However, in this day and age, most answering machines use three-digit passcodes.
Despite the digit increase, these passcodes are usually as easy (if not easier) to break. The reason for this is because the company wants the customer to be able to remember his/her passcode so it will be easier for them to access their messages away from home without remembering some random three-digit number the company came up with. These default passcodes are supposed to only be temporary. (The customer is supposed to change it shortly after they purchase the machine.)
This is not usually the case, however, because most answering machine owners:
- Don't even know it's possible to remotely access their answering machine.
- Don't think they are vulnerable to attack.
- Are too lazy to change their passcode.
Also, after a power outage, most machines reset to the default passcode and answering machine owners will usually forget to change their passcode back or get ticked off and just leave the default passcode enabled. For this reason, you may have better luck right after a power outage.
Most default three-digit passcodes are either the same number three times in a row (000, 111 - to name some common ones) or three-digits in numerical order (123, 456, 789). BellSouth's answering machines use the same digit three times in a row (usually 888).
"Is there one big number I can enter that will cover all three-digit possibilities, like the number for the two-digit passcodes?" The answer is yes.
However, it is a lot larger. It's 1005-digits long and covers every possible three-digit combination.
Three passcodes are in the number twice, 988, 889, 898. I couldn't stop those three codes from being repeated without screwing up the entire number. If someone comes up with a better number that contains all three-digit possibilities without repeating a three-digit sequence throughout, submit it:
The number may be intimidating at first, but think of it this way:
1.) You would normally have to enter 1,000 passcodes to cover all possible combinations. A combination is three-digits long, so that is 3,000 digits. This number cuts the number of digits you would normally have to enter by almost two-thirds.
2.) You only need to use this number as a last resort if the answering machine doesn't accept the normal default passcodes mentioned above. (I would venture to say at least 80 to 90 percent do.)
3.) You will most likely come across the three-digit combination before you have entered all 1,005 digits.
Some BellSouth answering machines beep after every digit that is entered. In this case you must slow down so that you get one beep per number and the answering machine doesn't miss any. Also, if you get cut off while entering this number, just call back and start one number before the last one you entered.
Once you have gotten into the machine, BellSouth machines, along with most others, have a recording that tells you what numbers perform certain commands. Another way you can get the passcode to BellSouth machines (and others) is if you are at that person's house (such as your friend or girlfriend); simply press the Code button when no one is looking. The LCD screen that usually displays the number of messages recorded on the machine will flash the three-digit passcode for that machine.
Another good way to get into answering machines (if you know what brand/model they use) is to go to a place like Walmart or RadioShack and ask to see a user's manual on them. This works only if they have the model in stock. You might also want to tell them you bought the machine and lost your user manual.
The vulnerabilities mentioned in this article should not be confined to individual's machines. Company answering machines (we'll let you decide what kind of company) are just as vulnerable.
Greets: Necro, Vega, Jizz, Telepathy, and Seek.
2-Digits
0102030405060708090 112131415161718191 2232425262728292 33435363738393 445464748494 5565758595 66768696 778797 8898 993-Digits
000100200300400500600700800900 01101201301401501601701801901 02102202302402502602702802902 03103203303403503603703803903 04104204304404504604704804904 05105205305405505605705805905 06106206306406506606706806906 07107207307407507607707807907 08108208308408508608708808908 09109209309409509609709809909 11211311411511611711811911 12212312412512612712812912 13213313413513613713813913 14214314414514614714814914 15215315415515615715815915 16216316416516616716816916 17217317417517617717817917 18218318418518618718818918 19219319419519619719819919 222322422522622722822922 2323323423523623723823923 2424324424524624724824924 2525325425525625725825925 2626326426526626726826926 2727327427527627727827927 2828328428528628728828928 2929329429529629729829929 333433533633733833933 3434434534634734834934 3535435535635735835935 3636436536636736836936 3737437537637737837937 3838438538638738838938 3939439539639739839939 444544644744844944 4545545645745845945 4646546646746846946 4747547647747847947 4848548648748848948 4949549649749849949 555655755855955 5656656756856956 5757657757857957 5858658758858958 5959659759859959 666766866966 6767767867967 6868768868968 6969769869969 777877977 7878878978 7979879979 888988 8989989 999