___ __ __ / _ \/ / _______ ___ _/ /_____ / ___/ _ \/ __/ -_) _ `/ '_(_-< /_/ /_//_/_/ \__/\_,_/_/\_Y___/ ___ ____ ___/ / / _ `/ _ Y _ / _\_,_/_//_|_,_/ / ___/__ ___ / /_____ / (_ / -_) -_) '_(_-< \___/\__/\__/_/\_Y___/ Verizon's Call Intercept by decoder@phreaksandgeeks.com > This article appears in 2600: The Hacker Quarterly > Volume Twenty, Issue Four, Winter 2004 edition Introduction: ============= Call Intercept is a service offered by Verizon which prevents callers that do not send any caller id information from directly ringing your line. Instead, callers hear a recorded announcement informing them that you subscribe to this service, then they are prompted to record their name for identifcation. If the caller does not record their name, then your phone does not ring. If they choose to record their name, your phone rings with a distinctive pattern, and you have the choice of either accepting or denying the call through an automated menu. The monthly charge for this service is $6.00, although it is included in some of Verizon's premium plans. While this service does have some flaws, I feel that it is better than Anonymous Call Rejection (ACR) for certain types of annoyance calls. For instance, telemarketers can still get through to a line equipped with ACR without sending any caller id information. There are also some PICC's (Pre-subscribed Interexchange Carrier Codes, commonly referred to as 10-10 numbers) that can be used to bypass ACR. The reason for this is that ACR is meant to reject callers who block their number by using *67, however, if an ANI-F(ail) occurs, the caller id information is missing, and the call goes through just fine. The display will show 'out of area' and no phone number will appear. Keep in mind that *67 sends a caller id signal of it's own, while a Flex-ANI fail will cause the absence of any caller id information, due to the fact that caller id information is derived from the Flex-ANI. Call Intercept will not let ANY calls directly ring your line unless a number appears on the caller id display. ACR is designed to reject certain types of calls and let everything else through, Call Intercept is designed to accept only certain types of calls, and reject everything else. How It Works: ============= When Call Intercept is activated, anonymous callers trying to reach you will hear an announcement expalaining what Call Intercept is, then they will be prompted to record their name. They can also enter a four digit override code to bypass Call Intercept. (More on this later) At this point your phone will ring with a distinctive pattern, and your caller id display will notify you that it is a Call Intercept call. During this time, and until you decide how to handle the call, the caller will hear hold music. When you pick up the phone you will hear, "Someone is waiting to speak with you. For more information, press 1." You will then hear the callers name as they have recorded it, and you will have the options of accepting the call, denying the call, playing a 'sales call refusal' to the caller, or sending the call to your Home Voice Mail, if you subscibe to it. The 'sales call refusal' is pretty useful. If the caller is stupid enough to identify that they are a telemarketer, you can have this announcement played to them. It will inform the caller that you do not accept telephone solititations and wish to be placed on their Do Not Call list. I have never had a telemarketer attempt to ring my line through Call Intercept, although with the new National Do Not Call List, some of these phone solicitors may become desperate. I should note that Call Intercept may not interact well with certain Verizon services as well as some types of phone calls. You cannot have Anonymous Call Rejection active on your line with Call Intercept. I suppose the reason for this is that ACR would take precedent over Call Intercept, and all anonymous calls would get sent to the ACR intercept message. (We're sorry, the person you are calling does not wish to speak with callers that block delivery of their telephone number...or something like that, depending on where you live.) Also, you cannot use *57 to trace calls that came in through Call Intercept. Remember, *57 is a customer originated trace, and when you receive a call through Call Intercept, it is effectively a call transfer. International cellular calls as well as collect calls made without the assistance of a live operator may also experience difficulty completing calls to your line. My Experiences: =============== When I first subscribed to Call Intercept, I was asked to choose a four digit bypass code while on the phone with the customer service representative. This is the code that you would give to anyone who you wished to have the ability to bypass your Call Intercept service. Upon hearing the Call Intercept greeting, an authorized caller would enter the code, and then is able to directly ring your line, without sending any caller id transmission. The caller id display would read 'PRIORITY CALLER', accompanied by the distinctive ring. According to the Verizon Residence Services User Guide, in former GTE states, the subsciber would be able to access their Call Intercept service by calling a toll-free number. Instead of choosing a bypass code while on the phone with the customer service representative, as is done in former Bell Atlantic states such as my home state of New York, customers in the former GTE regions would have their bypass code defaulted to the last four digits of their home telephone number. When they called the toll-free number, they would be able to change the bypass code, as well as turn Call Intercept on and off. This number was not published in the User Guide. In the past, when someone would try to ring my line through Call Intercept, my caller id display would read 'CALL INTERCEPT' in the name field, and the phone number would come up as my area code followed by all ones. This was the case until recently, when the display began showing a toll-free number. It now displayed 1-800-527-7070 as the Call Intercept number. This is the number used in former GTE states for a service known as Call Gate. Basically, Call Gate lets you control your phone line in various ways. You can 'blacklist' and 'whitelist' certain incoming and outgoing numbers. You can block or unblock international calls and calls to premium (900) numbers. You can even block ALL incoming or outgoing calls. It pretty much gives you complete control of your dial-tone. These features, along with Call Intercept, are what Verizon refers to as "Advanced Services." When you call 1-800-527-7070, it informs you that you have reached Verizon's Advanced Services, and you are asked to enter your home telephone number. I recall attempting to call this number in the past, but it wouldn't accept my phone number because this service isn't available in my state. After seeing this number appear on my caller id display as the Call Intercept number, I tried calling again. When I entered my home telephone number this time, it accepted it. I was asked for my PIN which is, of course by default, the last four digits of my phone number. From here I was able to hear or change my bypass code, as well as turn Call Intercept on or off. Verizon never informed me that I was able to use this service, and when I first signed up with Verizon, it wouldn't work for me. Apparantly this number is now being used in the former Bell Atlantic states to control the Call Intercept feature. Hacking It: =========== This is where the security issue comes into play. You can call this toll-free number and enter in anyones phone number in New York State who subscribes to Call Intercept. The PIN will be default every time. The reason no one has changed their PIN is because Verizon has yet to inform anyone of this service. Anyone who subscibes to Call Intercept in New York is vulnerable. You simply dial 800-527-7070, and when prompted, enter the telephone number of someone in New York who subscibes to Call Intercept. When it asks for the PIN, enter the last four digits of their telephone number, and you're in. From this menu you can listen to their bypass code, change it, change the PIN for the toll-free number, or turn off Call intercept altogether. The service that they think is protecting them from unwanted and annoyance calls, can actually facilitate these types of calls because of a security hole. There is an easy solution to this security hole. Require ANI verification in order to initialize the service. It is a common practice for other services such as remote call forwarding. As a matter of fact, Verizon does require that the initialization be done from the line which subscibes to Call Intercept in every other former Bell Atlantic state except New York. If you were to call the toll-free number and enter a Call Intercept subscibers phone number in Vermont, Massachusetts, New Jersey, etc., you will be informed that the service must be initialized from the telphone number which subscribes to the service. Once the initialization is complete, you may access your services from any telephone. It is quite obvious that Verizon's customers in those states are also unaware of the toll-free number to control their service, because they haven't initialized it yet. Fortunately, ANI verification is used, so they are not left vulnerable. Why New York does not require ANI verification is unknown to me, but what I do know is that ANYONE was able to administrate my Call Intercept, and I would have never known. Conclusion: =========== Hopefully, Verizon rectifies this situation because it simply does not make sense to require ANI verification everywhere except New York. You could always spoof the ANI, or beige box from the customers line if you are determined to access someones Call Intercept, but in New York, you simply need to call a toll-free number from anywhere you wish and enter a default PIN code. Now you have control over their acceptance of anonymous calls. Other than a large security issue in New York, Call Intercept is a great service. By subscibing to it, you will recieve close to zero telemarketing calls. Having your anonymous callers hear hold music while you decide how to handle the call is pretty nifty as well. I have honestly enjoyed having this service and would highly recommend it to all Verizon customers. Just remember, if you are considering subscribing to Call Intercept, or if you already have it, call 1-800-527-7070 and change your PIN! Especially if you live in New York, unless I already have! shouts: Lucky225, accident, Licutis, NotTheory, w1nt3rmut3, ic0n, Captain B, Majestic, Scott, doug, phractal, Scr00, WhiteSword, RijilV, Eta, parano|a, dual_parallel & bland_inquisitor at Radio Freek America, Slipmode at www.slipnet.org and StankDawg at www.binrev.com Appendix: ========= From the Verizon Residence Services User Guide (VE-RS-E 5/02): -------------------------------------------------------------- CALL INTERCEPT -------------- Call Intercept allows you to manage your calls better by stopping invalid telephone numbers that typically appear as "unavailable," "private," "anonymous," or "out of area" on your Caller ID display. Call Intercept will tell callers that you do not accept unidentified calls and asks them to record their name. If an unidentified caller does not record his or her name, or enter your override code, your phone will not ring, thus eliminating interupptions from unidentified callers. By recording their name, you can hear who is calling, and you have several call handling options. You are in control How Call Intercept Works ------------------------ An announcement will be played for your unidentified caller, as follows: "the number you are calling has Call Intercept, a service that requires callers whose telephone number does not appear on the Caller ID display to identify themselves before the call can continue. To record your name please press the pound key or simply stay on the line." If your caller has your override code, which is also referred as your PIN number (see Override Code section), they should enter it now to be immediately connected to your phone. If the caller records their name, the call is connected to your phone. You hear ringing and your caller hears "Thank you. Please hold." They will hear music until you choose how you want to handle the call. The ringing pattern you hear will be different from your existing ringing patern and the words "Call Intercept" will appear on your Caller ID unit, so you will know it is a Call Intercept call. When you answer, the recorded name will play for you. Here are your five options and what your caller will hear: When you press: Your caller hears: --------------- ------------------ [1] Accept the call Music, until you answer the phone. [2] Decline the call "The person you are calling is not available. Thank you. Goodbye." [3] Refuse a sales call "The person you are calling does not accept phone solicitations. Please add their name to your Do Not Call list. Thank you. Goodbye." [4] Send to Verizon Connected to your Verizon Home Home Voice Mail Voice Mail service.* [5] Hear who is calling Music, until you answer the phone again or make a choice. If no one answers at home, the caller will be connected to your Verizon Home Voice Mail (HVM) service or your answering machine. If you do not have either HVM or an answering machine, then the caller will hear: "The person you are calling is not available at this time. Thank you. Goodbye." *you must subscribe to Verizon Home Voice Mail service to hear option [4] Unidentified long distance callers reaching Call Intercept will pay their normal rates for a completed call. Override Code or PIN -------------------- Call Intercept doesn't block calls from family members and friends. When you subscribed to Call Intercept, you were either asked to select a 4-digit Personal Identification Code (PIN) in the former Bell Atlantic states or told that your PIN defaulted to the last 4 digits of your home phone number and could change it by calling a toll free number in the former GTE states. You may now give that number out to family members and special friends who may find themselves calling you from a payphone, from various parts of the country where Caller ID information will not be provided, or if they choose to block their numbers from displaying on Caller ID display units. When these family members and friends encounter Call Intercept when calling you, they can enter your override code when asked to record their name. Their call with then bypass Call Intercept. Your phone will with a ringing pattern that is different from your existing ringing pattern to let you know that it is a Call Intercept call. This time, the words "Priority Caller" will appear on your Caller ID unit (or display phone) to let you know that it's a family member or friend using the override code to bypass Call Intercept. Useful Verizon Numbers (also from the User Guide): -------------------------------------------------- 1-800) 527-7070 Call Gate *(use for Call intercept in Bell Atlantic states) 1-800) 870-0000 Call if you misplace your PIN 1-800) 275-2355 Verizon Repair 1-800) 518-5507 Verizon Unlawful Call center 1-800) 254-5959 Verizon Unlawful Call center (TTY) 1-877) TRACE-4U Call Trace Information line 1-800) 257-2969 Call Trace line (for GTE states) 1-800) 562-5588 to test All Call Blocking (in PA only) 1-NPA) 890-1900 to test All Call Blocking (in NY & CT only) 1-888) 599-2927 to test All Call Blocking (in New England) 1-888) 294-1618 to initialize Ultra Forward service (call from ANI) 1-800) 284-1687 to initialize Ultra Forward service (in MA & NY) 1-800) 414-9898 to use Ultra Forward (in NY, CT, MA, ME, VT, NH & RI) 1-212) 338-8300 to use Ultra Forward (from anywhere else) 1-800) 483-1000 Customer Service (in PA & VA) 1-800) 234-2340 Verizon's Customer Information line (c) decoder 2003