[A Complete Guide To Hacking and Use of ASpEN Voice Mail Systems] [Written by: Caveman] [Introduction] ASpEN, or "Automated Speech Exchange Network," is a voice mail system used by small businesses for individual employees' when away from their desks. It is, in my opinion, by far the easiest system to use. There are other vms's to hack on, but many can be difficult, including systems that require a "box/password" number to be entered (which any stupid shit knows is as difficult as a GOOD meal with spam in it; close to impossible of course.) I will be discussing the basics and commands of the ASpEN systems, If you need information on voice mail systems in general, or info on another specific type of voice mail system, I highly suggest the LoL article on hacking voice mail boxes, as well as the article on hacking voice mail boxes by Night Ranger in Phrack #34, both are good sources of information. [Finding An ASpEN System] In order to find an ASpEN system, you will need to get some form of wardialer. I've heard a lot of shit about what's the best, I don't give a fuck, they all do the same damn thing. The easiest way to find a voice mail system is set up a wardialer, connect a spare phone to the second phone slot on your modem, and set up the wardialer to an exchange that is known to carry voice mail systems (i.e. 1-800-666-XXXX) After a shitload of ringings, stanky operators, and fax machine ringings, you will come across something that sounds like an answering machine. If you are extremely lucky, you will come across the generic message that comes with the ASpEN system. You will hear: "Hello, this is ASpEN, the Automated Speech Exchange Network. Please enter the number of the person you are calling. If you have a mailbox on this system, please press pound." Otherwise you will get a recording from the company itself, in which case you need to press the star key to enter the voice messaging system. If you get a message saying, "Mailbox number please" you have found a voice mail system. It is not necessarily an ASpEN system, it could be one of a number of systems. In order to know absolutely that the system you have found is ASpEN, you will need to recognize the ASpEN computer voice. If you need a sample of the voice, call 1-800-852-MAIL and press pound (#). You will get a sample of the ASpEN voice from this system. After determining that you have indeed found an ASpEN system, you are ready to go to work. You have already done the hardest part, finding an ASpEN system. [The 800 Exchange Problem] 1-800 voice mail systems are by far the most useful, for obvious reason of low cost calling from around the country, so that phreaks and hackers from coast- to-coast are able to contact you. However, there has been a problem with attempting to hack an 800 exchange. It is the simple fact the each time you call the 800 system, the system itself gets billed for the call. Even if you are lucky enough to find a local 800 voice mail system, the system will still be billed for the call. If you are calling a long distance 800 exchange, the system will be billed for the LONG DISTANCE bill. Thus, if you call the system many times in search of a box, then the System Administrator will be notified of irregular patterns in the bill at the end of the month, including multiple long distance calls from the same source in a short period of time. The System Administrator, if competent, will check the system for hackers, and will eventually find your box. The risk of the System Administrator sighting the irregular phone bill, or practicing "Preventive Maintanence Excercises," all depends on the size of the system, the size of the company paying for its use, as well as if the system regularly receives many long distance calls. [3-Digit Error] The reason that ASpEN is the easiest is some "errors" in the programming of the automated system. Among the most useful is the 3-digit error. If you enter three numbers SLOWLY, such as 1-5-2, taking your time with each number you enter, then at the end of the THIRD number, the ASpEN computer-generated voice will tell you: "Box 1-5-2 is not a recognized mailbox, please try again. Please re- enter your mailbox number." By not allowing the user to enter the fourth number, the ASpEN system has, in effect, told you that there are NO mailboxes in the 152 exchange, in other words, no 1520, 1521, 1522, 1523, etc... up to 1529. Instead of having to check all ten of these boxes, you only need enter the first three numbers slowly and wait for the system to tell you that they are invalid. If the 1-5-2 exchange is invalid, then try the next exchange, 1-5-3. However, if you enter 1-5-2 and the system pauses and waits for another number, then BINGO, orgasm, you have found a valid exchange, meaning that there is a valid mailbox between 1520 and 1529. In the pause between the 1-5-2 you entered and the computer voice not coming on, you then enter another number between 1-9. If you get the invalid box voice again, try another number between 1-9, if the system paused with this exchange, there is definately a box there. It may take you a while to find an exchange that the system will pause on, but I suggest looking in the range of 2400-6000, this is where I personally had the most success. Once you have found a mailbox, don't spooge in your pants yet, you must begin the next step, finding a box not in use. [Finding YOUR Box] First, I will stress NEVER FUCKING TAKE A BOX THAT IS ALREADY IN USE BY SOMEONE. I can tell you, all that this accomplishs is that you get a VMB and you feel good for a couple of days, but as soon as the owner checks their box, but finds that some little shit took it over, they will report directly to the System Administrator, who will make a complete system check, and destroy any other box that WASN'T origionally in use, that some hacker obtained through hard work. By finding a box that isn't already in use, you are insuring that other hackers on the system will not be caught, as well as guaranteeing the safety of your own box. So how DO you find a box not in use on an ASpEN system? Any box that is not in use is NOT going to have a recorded name (a feature discussed later in the text.) While trying to find a box in the 3-digit method described above, you will enter a box number and come up with the normal ASpEN voice stating the following: "Hello. This system can enable you to receive messages while you are away from your desk... [After a lot more shit, the voice will say] Your System Administrator has assigned you a temporary password. Please enter that password now." When you have come upon this generic message, you have found an activated mailbox that is not in use, but rather reserved for a future user of the system. NOW HOW CAN I PUT THIS KNOWLEDGE TO WORK FOR ME? At this time, you begin to try the defaults for the ASpEN systems as named in Night Ranger's article in Phrack #34. The defaults that I have had the most success with is 1111, the box number itself, and 1234. But before you give up, expend ALL of the defaults. [Once In The Box] Once you have entered the correct default password for the box that of course was NOT IN USE, the computer voice will say: "Thank you. You should now change the default password. Make it a number that will be easy for you to remember but hard for others to guess..." At this point, the ASpEN will also ask you to change your recorded name and recorded message (discussed later, and I'm sure, really difficult to figure out.) Now, you have complete control of the mailbox. Once you have a mailbox, post the number on your local board, so that others may share in your joy, and posting the default is helpful as well as the number range of the boxes. [Commands] When in your box, there will be a number of commands available to you. Once you are in your mailbox, the mailbox will tell you "No messages. Send, press two, check receipts press three.) The option that it does not tell you on some systems (the most important option) is "Personal Options," which menu you can enter by pressing 4 on your numeric telephone pad. The following is an outline of the options available from each menu that can be entered on the ASpEN system (all quoted options are taken from the "rapid prompts;" which is what I suggest you set your prompt level to when taking over the box): [MAIN MENU] "Send, press 2" - to send a message from YOUR mailbox to a fellow hacker on the system. It will record your message, then ask which box to send the message to. You can enter multiple box numbers, which serves as a multi-mail service. "Check receipts, press 3" - Once you have sent a message, and want to check whether the person has received the message, or if the message you have sent is still in their mailbox, you use this option. It will ask which box to check, once you have entered this, it will play their recorded name, and say either "One message from you in that mailbox" and play the message over to you, or say "All messages have been received." "Personal options, press 4" - This is basically command central of your box, a number of options are contained (see PERSONAL OPTIONS SUBMENU) "Restart, press 5" - This will bring you to the origional logon message of your particular voice messaging system. "Disconnect, press *" - If you cannot figure this out, you do not need a box. [PERSONAL OPTIONS SUBMENU] "Notification on or off, press 1" - This is an option that you NEVER WANT TO ACTIVATE. This is an option that will call your house whenever you receive an "urgent" message. Of course, if you activate this, and give your home phone number, then if the System Administrator is not a shit-for-brains (as many of them are) they will be able to contact you at your home and cause you more trouble than this option is worth. "Administrative options, press 2" - This is another submenu (see ADMINISTRATIVE OPTIONS SUBMENU) that contains the maintanence options. "Greetings, press 3" - This contains another submenu full of options for your greetings. (see GREETINGS SUBMENU) "Notification schedule" - This is the option to set the time that the system should call your house with "urgent" messages. As I said before, you've got to be fucked up to activiate this, it's a deathwish. [ADMINISTRATIVE OPTIONS SUBMENU] "Passwords, press 1" - Simply the passwords of your system. (see PASSWORDS SUBMENU) "Prompt level, press 3" - The level of explanation the ASpEN system gives you when reciting your options. Prompt level 1 is set for morons, level 2 is for a user just getting used to the commands of the ASpEN system, and level 3 is rapid prompts, the briefest ASpEN messages the system allows. "Date and time options, press 4" - This allows you to enable or disable the date and time option, which stamps each incoming message with the date and time of receipt. "To exit, press *" - Whenever you are in a submenu, and want to exit to the menu you were in prior to the submenu, press the star key. You will be transfered to the previous menu, or if you are in the main menu, you will disconnect. [GREETINGS SUBMENU] "Personal greeting, press 1" - Your personal greeting is what the caller will hear when calling your box. "Extended absence greeting, press 2" - This is used by companies when their employees take vacations, and there is no need for them to receive messages. With this option on, you will not be able to receive messages until the extended absence greeting is deleted. This is useful when you are switching mailboxes, and want to convey to the caller your new system and box number, and make it impossible for the caller to leave a message. "Recorded name, press 3" - This is the name that will played when you call your box to check your messages. Upon calling your box, the ASpEN system will say: "Hello, [recorded name played,] please enter your password." [PASSWORD SUBMENU] "Guest 1 password, press 1" - This is the password for a friend that you can leave messages to. This friend will have his own password, as well as message section, but will not have access to your messages, or personal options. "Guest 2 password, press 2" - This is the same as guest 1, but for another friend (if you have that many friends.) "Home password, press 3" - This password enables the user to access private messages, and send messages, and disconnect. No other options are available to the user with this password. "Secretary password, press 4" - This is of course for your secretary. The user of this password will have access only to hear message summaries, in other words, they will hear who the message is from, what time and date it was sent, and how long it is, but not the message itself. This was obviously designed with the thought that the secretary can use this to notify her boss that messages are waiting in his mailbox. "Your personal password, press 5" - This is the master password, the password that gives you access to ALL options of the box. You will be using this one, so change it from the default. [Avoiding Deletion] On all of the systems that I have been on, I have found that the System Administrators only check for hackers on the first of the month, every month. Some stupid System Administrators, such as the one in charge of the system I am on right now, will send a multi-mail to ALL users of the system, stating that they plan on shutting down the system for an hour on the first of the month for what they call "Preventive Maintanence Excercises." This means that the System Administrator on your ASpEN system will be checking all boxes for validity. Some systems will check at the first of the month WITHOUT sending such a helpful message. My suggestion is to change your recorded name as well as your message to say something like: "Hello, this is Joe Blow, I'm not in the office at the present time, if you leave me a message, I will get back to you as soon as possible. Thank you." Don't sound too fluent either, most users have no idea what the fuck they are doing. After the first of the month change your message back to normal, and you should be set until the next month. [A Complete Guide to Hacking and Use of ASpEN Voice Mail Systems: Part II] [Written by: Caveman] [Introduction] I wrote this second text file to clarify some points that I did not express in my last file: CAVEASP.ZIP. If you have not read that, I suggest you do so before proceeding with this file. It is the bulk of my experience with ASpEN voice mail systems, while this article is more issues that have been brought to my attention since the first text file was released. [800 Exchange: Part II] As stated in the first file, 800 voice mail boxes do not last for more than a month due to the fact that each time the box is called, the system itself foots the bill. However, Mr. Black (partner in crime) recently talked with one of the live operators sometimes reached after numerous logon errors, and from the information that he received, the OWNER of the box is charged per month. A voice mail box costs approximately $6.00 per month, and on some systems there is a 20 cent charge every time someone calls the box. Thus, there is very little chance that your 800 box will last after the end of the month. However, there are exceptions. Months after the "McGill Specialized Carriers" voice mail system eliminated its hacker problem (Reflector, Hellraiser, Night Ranger) the Synergist's box remained for several months. This is an indication that: 1] The box did not receive too many calls (and too many charges) 2] The company owning the voice mail system was rich and did not give a flying fuck about the charges to the system These cases are rare as shit and thus cannot be relied on. Although your 800 voice mailbox has the potential to last a month (if you take it over at the beginning of the month) it is unlikely that it will last longer than that. [ASpEN Software Upgrades] Just as all computer programs such as BBS software have various intermittent upgrades to improve upon glitches and errors in the system, ASpEN, being a computer-run software program, accordingly has come out with numerous upgrades, although unlike BBS software upgrades which most people get immediately after their release, the owners of the voice mail systems could care less about upgrades, and therefore there exist a number of different types of ASpEN voice mail systems out there. Each is different in a small (sometimes minute) way, but some new upgrades have made it increasingly more difficult to hack boxes. Different voice mail systems (even though they are all running ASpEN voice mail software) may have varying (some useful, some annoying) features. The first upgrades included the removal of the annoying ASpEN voice telling the caller each time he/she calls how to leave a message, when in reality it is so simple that my sperm could figure it out. Other smaller additions really have no effect on the voice mail hackers at all. However, the real killer was the upgrade which eliminated the 3-digit error described in CAVEASP.ZIP the first text file. This upgrade, which I personally have encountered more and more in recent months, sets the system up so that no longer does the ASpEN generic voice warn you when you have dialed a 3 digit extension in which no mailboxes exist. Therefore, with this improvement, the boxes will be more difficult to find for hackers. This upgrade has not been installed in nearly all of the ASpEN voice mail systems out there, but for those systems that it has been installed in, the 3-digit error described in the last file no longer works. [Direct Dial ASpEN Boxes] Once you have taken an ASpEN box over (this method also works for other systems), you should next check to see if it may be a direct dial. It is likely that your box is direct dial if its last four numbers of the box you have taken begin with the same two numbers as the last four numbers of the system itself. For instance (stay with me now) when I first hacked my box out, I accessed the system itself, at 202-637-1897. I hacked out a box, which started with the same two numbers as the system itself (look at the diagram below.) By combining the prefix exchange from the voice mail system with your personal box number, you may have a direct dial. Try calling the number, if you reach YOUR recorded message, you got a direct dial box. Press pound (#) from your message to access the box. DIAGRAM: System Number: 202-637-1897 Both the same ^^컴컴컴컴컴컴컴컴캑 My Personal Box Number: 1808 � ^^컴컴컴컴컴컴컴컴� My direct dial number: Prefix exchange (202-637) + Box number (1808) = (Direct dial box) 202-637-1808 The reasoning behind this direct dial method is the fact that the system number that you reach is nothing more than a box on the system that has been enabled by the system operator to reach other boxes from the system. If you think of 202-637-1897 as nothing more than another box, and you can reach this box directly, then therefore there must be other boxes nearby (in the 18XX range) that can also be reached directly, thus giving you a direct dial mailbox. [Forwarding] I have recently come across some ASpEN systems in which whenever a user attempts to access a voice mail box, the familiar ASpEN computer generated voice comes on and says "One moment please..." followed by a ringing. Whenever you come across a system like this, leave it alone. This result means that the system operator has integrated the ASpEN voice mail system into a PBX resulting in a system that forwards calls to individual offices, and the only way in which you can access the voice mailbox is if the person is NOT in the office at the time of call. Therefore, even if you did hack a box on this system, you or anyone else could not access or leave a message for the box during normal business hours. Therefore, you would have to tell everyone attempting to call your box of this condition, and a box that can only be accessed early in the morning or at night is impractical. [Commands: Part II] All of the commands once inside an ASpEN box were covered in the first file. However, I forgot to add one set of features. These are the features of the "send" command. From the main menu in the ASpEN box, the features (explained in first file) are send, check receipts, personal options, restart, and disconnect. I went into great detail about all of these options, except for send. Send is the option used to send messages from your box to another box on the voice mail system, say if you have an amigo on the same system as yourself. After completeing the message, the ASpEN voice will say: "Send message now, press pound (#). More options, press zero." The commands offered by pressing zero at this prompt are as follows: (Note: All commands below in quotes are exactly what the ASpEN computer voice will ask or tell you.) [MORE OPTIONS MENU] "Private, press 1" - This will tag your message as "private", meaning that if the person receiving the message has assigned multiple passwords and given his/her friends access to the box, only the owner of the box will receive this message. Usually not necessary if the owner of the box is the only user of the box. "Urgent, press 2" - This feature is only used if the owner of the box that you are sending the message to has activated the notification feature of the box (see CAVEASP.ZIP) If so, a couple of minutes after you leave the message on the person's box, the system will call their house with the message. Of course, only used in "urgent" situations. "Confirmation, press 3" - This is message confirmation (see CONFIRMATION SUBMENU) "Future Delivery, press 4" - (see FUTURE DELIVERY SUBMENU) [CONFIRMATION SUBMENU] "Message Confirmation, press 1" - This feature will send you a notice of confirmation stating that the message you sent was indeed received. When the message is listened to by the person you sent the message to, the next time you logon to your box, the system will tell you: "Your message to [NAME] sent [DATE SENT] at [TIME SENT] was received [DATE RECEIVED] at [TIME RECEIVED]. To repeat confirmation, press 1, to continue, press 2" This computer message will be given to you immediatly when you logon to your box, before you may listen to any messages waiting for you. "Notification of Non-Receipt, press 2" - This option sends a message back to you after a period of 20 days if the message you sent has not been received. [FUTURE DELIVERY SUBMENU] "Specify Date of Future Delivery, press 1" - This enables you to specify what date your message is sent to its destination. You will do this through use of your telephone touchpad. "Spell Day of the Week, press 2" - This option allows you to designate the day of the week that the message will be sent on. You will enter the first two letters of the day of the week from your touchtone telephone pad for this feature. Keep in mind that any command described above can be cancelled at any time by pressing the star (*) key. [Disclaimer] Anything written in this file was written for informational purposes only, which make it easier for you to hack an ASpEN box for yourself. However this was not the intention of the author. I claim no responsibility for the actions taken by anyone reading this article who is slow enough to actually get caught by any kind of law enforcement agency. [Bullshit] If you STILL have questions or comments after reading this, go FUCK yourself. I have explained everything possible in this article. However, if you still got something to say, you can reach me (Caveman) at 202-637-1808, or 301-921-3361. [PEACE] SHOUTS OUT TO: Mr. Black [Partner in Crime] Tomellicas Nat X G-Spot Albatross [The Boards] Legion [202][Will be back] The Empire [301] Nat's Atomic Dregg Bin [301] Solsbury Hill [301] Copyright 1992 [R.a.W] Productions. All Rights Reserved. {PEACE OUT}