Spoofing Call Waiting ID

by Lucky225 (Lucky255@hotmail.com)

In this article I will explain how Caller ID on Call Waiting (Call Waiting ID) works and how it is possible to display messages on Caller ID equipment.

How It Works

When you have call waiting, you will notice that you hear two tones if you have Call Waiting ID.  The first is the Subscriber Alert Signal (SAS, or "call waiting beep") tone.  This is just your normal Call Waiting Beep (440 Hz for 330 ms).  The second tone is a CPE Alert Signal (CAS) tone.  This is a short 80 ms DTMF tone of 2130+2750 Hz.  This tone alerts the Customer Premise Equipment (CPE), in other words the Caller ID box, that there is a call waiting tone.   The CPE then mutes the handset and sends an acknowledgment tone (DTMF "A" or "D" tone) to the central office to tell the CO that it is O.K. to send Caller ID information in FSK format.  The name and number are displayed on the CPE and the CPE unmutes the handset.


To send a fake message to be displayed on the Caller ID box you will need a recording of a FSK transmission.  We are currently working on a program that will create an audio file with whatever information you want.  If you would like to help, please email me.  In the mean time, you can do the following.  Order Call Waiting ID or go to a friend's house who has it.  Call your phone when it's in use so you get a call waiting beep.  Make sure there are no CPEs on the line.  When you hear the CAS tone, send an acknowledgment tone back and the central office will send the FSK signal over the line.  Record this with a micro-recorder or some other recording device.  Once you have your FSK recorded, call the person you want to put the CID message on and play a CAS tone.  You'll hear his CPE chirp back with an acknowledgment tone.  Then play your recording of the FSK signal.  If you do it fast enough, the information will show up on his Caller ID screen.

Generating Tones

You can make an Orange Box (CAS tone generator) by modifying a tone dialer.  Just take out the 3.58 MHz crystal and put in a 8.192 MHz crystal and the star (*) button will create a CAS tone!  You can make acknowledgment by creating a Silver Box (plans found on the Internet).