==Phrack Magazine== Volume Six, Issue Forty-Seven, File 15 of 22 Substance's Complete Guide To Hacking Meridian Mail Systems (VMB) [PART 1] -------------------------------------------------------------------------- Feb 1st, 1995 --Made for Phrack Introduction To Meridian Mail Box Systems By Substance @ Another Way of Life [hpavc] 5183831369 NOTE1: In case you didn't know VMB stands for Voice Mail Box NOTE2: This is the information that I have gathered from hacking Meridians, and is not guaranteed to be 100% accurate NOTE3: Disclaimer : There is none, I did this article to encourage people to go and fuck around with Meridians, so sue me. ------------ Introduction ------------ Before we begin, Let's shed a little light on the subject of Meridian. This is one of my favorite VMB systems to hack, because: Number 1 : There are many Meridian VMB Systems throughout the country, in -------- 800 exchanges and numbers local to you. You can bet that there are at least 10 - 15 different corporations using Meridian throughout your area code Number 2 : (The Most Important by far.) Almost ALL Meridian mails -------- use the Mail Box number as the default password. (Unless changed manually) Number 3 : About 95 percent have outdialing features. Most don't have long -------- distance access, but this can still be very useful for diverting calls, and getting free calls in that area code. Ok, enough light shed on the matter. Let's get to identifying and hacking those fuckers! -------------------------- Identifying Meridian VMB's -------------------------- Most Meridian VMBs just come right out and say exactly what they are. I'd say about 8 out of 10 will just come out, right after it answers and say: "MERIDIAN MAIL" "MAILBOX?" or just "MAILBOX?" (it is ALWAYS a female computer [digitized] voice) Half the time you will only hear "RIDIAN MAIL". (This must be caused by a timing bug in Meridian.) Once you hear that, write the # down, since it may be useful in the future for such things as 3rd party billing (more on that later), as a code line or just as a personal VMB. If you know for a fact (or a guess in that matter) that this is a Meridian mailbox but when you call it, it just says 'Leave a message' or has someone actually talking instructing you to leave a message, then you have reached what might be a direct VMB line. These are usually numbers people pay more money for, that will give them a direct 800 number instead of going through the "mailbox #" part. These are the best, but probably the hardest to hack, because even though (according to a recent poll) about 70% of people are stupid enough to leave their mailbox number as their password, if you are serious and want to pay that much for a direct line, you are probably going to change the password. Even though I have seen many that do have the default, the odds are against it. Ok back to the point. If you find a direct VMB, call all the numbers around it, because chances good are that you will find the system that just asks for a box number, very close. I would recommend about +50 numbers and -50 numbers and you'll find the root system. You will also find many other direct boxes in your quest. NOTE: The ROOT SYSTEM is the number you call and simply hear 'MAILBOX' or 'MERiDiAN MAiL' Another thing to remember is that you have to find out how many digits your mailbox #'s are going to be. The number of digits I've seen in my career differs from about 2 digits (rare) to 6 (also fairly rare). The most likely # of digits it will probably have is 4, or 5... Call your VMB and when it asks for mailbox #, hit '111#' (Note: You ALWAYS have to end a command on a Meridian mail system with an '#') if it says (with a quick response) 'INVALID box #' then try a 4 digit code. Sometimes (yeah, I know it sucks) you will have to fuck around for a while before you can tell how many digits, or even worse you may never know, and have to keep alternating #'s of digits, until you hit a valid box. Hacking The Fuckers: First off, think of what you are going to record as an outgoing message before you go and hack it. Decide if this should be a code line, or a personal VMB, or... Both? Here are the first default boxes you should try before dialing random ones: 111 222 333 444 555 666 777 888 999 000 100 200 300 400 500 600 700 800 900 123 234 345 456 567 678 789 890 901 121 212 etc. etc. etc. If boxes are 4 digits, add a trailing number. If you don't know the length, mess around a while, you'll get one. If you call someone's direct VMB and you hear a message like "You have reached So&So's VMB please leave a message, and I will return your call as soon as possible" there are a few ways to transfer to a different mailbox. Try simply hitting #, that might just hang up on you, unfortunately. Call back try hitting *. When you hear 'MAiLBOX' you just struck home. Try entering 123#. Now, a few things can happen. Either: 1 It will transfer you to 123's mailbox 2 It will say invalid mailbox, or simply 'MAILBOX' again 3 It will say Password When you hear 123's mailbox you can try and hack it by hitting *, and hope it will ask 'PASSWORD?' If it doesn't then you can't do much with this system except leave messages for that person (What Fun). If it does ask "PASSWORD?" then try the box # as the default password. (On your quest for a valid VMB you will find that MANY MANY people are total fucking morons and keep their password at the default) others will make it something easy to remember like 123# or 111# etc. etc. etc. If the password is not the Default then just write this number down in a notebook and move on. If all else fails and you can't figure out how to get to the MAILBOX prompt you should call all the #s around the one you found to try and find the root system. If you get in, (with the default or otherwise) it will probably say: 'MAILBOX EMPTY' or 'YOU HAVE n MESSAGES' If you press 7* it will reply with: Message option 0 (unknown at this time) Reply 1 (used to reply to a previous message) Play envelope 2 (unknown at this time) Forward 3 (Forward your mail to another box) Reply all 4 (Reply with a multi-mail) compose 5 (send multi-mail) delete 6 (used to delete mail [duh]) send 9 (sends single mail [must have mailbox number ready) if you press 8* it will reply with: Mailbox options 0 (Changes operator code (not useful) login 1 (Gives you the option to transfer mailbox's) greeting 2 (Can change greeting (internal & external) logoff 3 (Kicks you off the system) password change 4 (Changes VMB password [verifies 2x] distribution list 5 (Not useful) goto 6 (Takes you back to 'MAILBOX EMPTY' Personal verification 9 (Lets you record a name for personal verify) to exit press # (logoff) This is not all very useful, the most you can do with these commands is listen to people's mail (which can be fun), and/or take it over for your own code line or personal VMB. The whole point of hacking Meridians is the outdial function. Once you have successfully gotten into the VMB dial '0*' (Zero-Star). It should say: 'YOU HAVE REACHED A SYSTEM THAT WILL CONNECT YOU TO THE NUMBER THAT YOU ENTER. PLEASE ENTER THE NUMBER OR THE NUMBER OR THE NAME OF THE PERSON YOU WISH TO REACH. PRESS 11 FOR A NAME, SPELL THE LAST NAME THEN THE FIRST NAME blah, blah, blah.' This is the jackpot. With this you can call ANYWHERE (hopefully) for free, any time (unless the VMB has hours [...some do...]) To dial out, try this first: just dial a local number (ex 432-1342#) >From there it may beep and say 'THAT # CANNOT BE REACHED' or it may connect you. If it connects you, great! You just found an untraceable way of hacking! Call back and try 1-npa/xxx-yyyy (if that works, then abuse the hell out of it as soon as possible, because it wont last for long :) ) If those two methods don't work try these. 9+1+npa/xxx-yyyy (works most of the time) 8+1+npa/xxx-yyyy (not probable) 0+1+npa/xxx-yyyy (Possible) 9+xxx-yyyy 8+xxx-yyyy 0+xxx-yyyy If none of those work, then you're shit out of luck. Use it for a code line. If it did work, think of the possibilities, 900 numbers (for gaining access to boards), Tons of free LD, untraceable calls............ On to the last subject of part 1. ------------------------------ Another Way To Make Free Calls ------------------------------ Sorry, this only works on Direct VMB's, sometimes only the ones in your local exchange, its a long shot, but hell, its free. (But don't do this from your home phone, stupid.) Change the outgoing message on the direct VMB to 'Operator, this number accepts all collect and 3rd party billings' Call up the operator and ask for AT&T, once they come on tell her you would like to make a 3rd party billing. Tell her the number you're billing to is the VMB #, then tell her the number you wish to call. She'll say, "wait," AND a few moments later she'll come back and say they accepted. Presto! You're in! If you get busted, say you read a text file on how to do it, you didn't think it would work... (act innocent, alwayz worked for me :) You can leave me comments, suggestions or threats at my VMB (not a Meridian currently) *(800)775-0728* (direct)... -substance [EOF]