==Phrack Magazine==

                 Volume Six, Issue Forty-Seven, File 15 of 22


Substance's Complete Guide To Hacking Meridian Mail Systems (VMB) [PART 1]
--------------------------------------------------------------------------

Feb 1st, 1995  --Made for Phrack

Introduction To Meridian Mail Box Systems

By Substance @ Another Way of Life [hpavc] 5183831369

NOTE1: In case you didn't know VMB stands for Voice Mail Box

NOTE2: This is the information that I have gathered from hacking
       Meridians, and is not guaranteed to be 100% accurate

NOTE3: Disclaimer : There is none, I did this article to encourage people to
       go and fuck around with Meridians, so sue me.

------------
Introduction
------------

Before we begin, Let's shed a little light on the subject of Meridian.  This
is one of my favorite VMB systems to hack, because:

Number 1    : There are many Meridian VMB Systems throughout the country, in
--------      800 exchanges and numbers local to you. You can bet that there
              are at least 10 - 15 different corporations using Meridian
              throughout your area code

Number 2    : (The Most Important by far.)  Almost ALL Meridian mails
--------      use the Mail Box number as the default password. (Unless changed
              manually)

Number 3    : About 95 percent have outdialing features.  Most don't have long
--------      distance access, but this can still be very useful for diverting
              calls, and getting free calls in that area code.


Ok, enough light shed on the matter. Let's get to identifying and hacking
those fuckers!

--------------------------
Identifying Meridian VMB's
--------------------------

Most Meridian VMBs just come right out and say exactly what they are.  I'd
say about 8 out of 10 will just come out, right after it answers and say:

"MERIDIAN MAIL"
<wait 1 second>
"MAILBOX?"

or just

"MAILBOX?" (it is ALWAYS a female computer [digitized] voice)

Half the time you will only hear "RIDIAN MAIL". (This must be caused by
a timing bug in Meridian.)  Once you hear that, write the # down, since
it may be useful in the future for such things as 3rd party billing
(more on that later), as a code line or just as a personal VMB.  If you know
for a fact (or a guess in that matter) that this is a Meridian mailbox but
when you call it, it just says 'Leave a message' or has someone actually
talking instructing you to leave a message, then you have reached what might
be a direct VMB line. These are usually numbers people pay more money for, that
will give them a direct 800 number instead of going through the "mailbox #"
part.

These are the best, but probably the hardest to hack, because even though
(according to a recent poll) about 70% of people are stupid enough to leave
their mailbox number as their password, if you are serious and want to
pay that much for a direct line, you are probably going to change the
password. Even though I have seen many that do have the default, the
odds are against it.

Ok back to the point.  If you find a direct VMB, call all the numbers around
it, because chances good are that you will find the system that just asks
for a box number, very close.  I would recommend about +50 numbers and -50
numbers and you'll find the root system.  You will also find many other
direct boxes in your quest.

NOTE: The ROOT SYSTEM is the number you call and simply hear 'MAILBOX' or
      'MERiDiAN MAiL'

Another thing to remember is that you have to find out how many digits your
mailbox #'s are going to be.  The number of digits I've seen in my career
differs from about 2 digits (rare) to 6 (also fairly rare).  The most likely
# of digits it will probably have is 4, or 5...  Call your VMB and when it asks
for mailbox #, hit '111#' (Note: You ALWAYS have to end a command on a Meridian
mail system with an '#') if it says (with a quick response) 'INVALID box #'
then try a 4 digit code.  Sometimes (yeah, I know it sucks) you will
have to fuck around for a while before you can tell how many digits, or even
worse you may never know, and have to keep alternating #'s of digits, until
you hit a valid box.

Hacking The Fuckers:

First off, think of what you are going to record as an outgoing message before
you go and hack it.  Decide if this should be a code line, or a personal VMB,
or... Both?  Here are the first default boxes you should try before dialing
random ones:

111 222 333 444 555 666 777 888 999 000 100 200 300 400 500
600 700 800 900 123 234 345 456 567 678 789 890 901 121 212
etc. etc. etc.

If boxes are 4 digits, add a trailing number.  If you don't know the length,
mess around a while, you'll get one.

If you call someone's direct VMB and you hear a message like "You have
reached So&So's VMB please leave a message, and I will return your call as
soon as possible" there are a few ways to transfer to a different mailbox.
Try simply hitting #, that might just hang up on you, unfortunately.
Call back try hitting *.  When you hear 'MAiLBOX' you just struck home.
Try entering 123#.

Now, a few things can happen. Either:

        1  It will transfer you to 123's mailbox
        2  It will say invalid mailbox, or simply 'MAILBOX' again
        3  It will say Password

When you hear 123's mailbox you can try and hack it by hitting *, and hope
it will ask 'PASSWORD?'  If it doesn't then you can't do much with this
system except leave messages for that person (What Fun).  If it does ask
"PASSWORD?" then try the box # as the default password.  (On your quest for a
valid VMB you will find that MANY MANY people are total fucking morons
and keep their password at the default) others will make it something easy to
remember like 123# or 111# etc. etc. etc.  If the password is not the Default
then just write this number down in a notebook and move on.

If all else fails and you can't figure out how to get to the MAILBOX prompt you
should call all the #s around the one you found to try and find the root
system.


If you get in, (with the default or otherwise) it will probably say:

'MAILBOX EMPTY' or 'YOU HAVE n MESSAGES'

If you press 7* it will reply with:

Message option 0        (unknown at this time)
Reply 1                 (used to reply to a previous message)
Play envelope 2         (unknown at this time)
Forward 3               (Forward your mail to another box)
Reply all 4             (Reply with a multi-mail)
compose 5               (send multi-mail)
delete 6                (used to delete mail [duh])
send 9                  (sends single mail [must have mailbox number ready)


if you press 8* it will reply with:

Mailbox options 0       (Changes operator code (not useful)
login 1                 (Gives you the option to transfer mailbox's)
greeting 2              (Can change greeting (internal & external)
logoff 3                (Kicks you off the system)
password change 4       (Changes VMB password [verifies 2x]
distribution list 5     (Not useful)
goto 6                  (Takes you back to 'MAILBOX EMPTY'
Personal verification 9 (Lets you record a name for personal verify)
to exit press #         (logoff)

This is not all very useful, the most you can do with these commands is listen
to people's mail (which can be fun), and/or take it over for your own code line
or personal VMB.  The whole point of hacking Meridians is the outdial function.
Once you have successfully gotten into the VMB dial '0*' (Zero-Star).
It should say:

'YOU HAVE REACHED A SYSTEM THAT WILL CONNECT YOU TO THE NUMBER THAT YOU ENTER.
PLEASE ENTER THE NUMBER OR THE NUMBER OR THE NAME OF THE PERSON YOU WISH TO
REACH. PRESS 11 FOR A NAME, SPELL THE LAST NAME THEN THE FIRST NAME blah,
blah, blah.'

This is the jackpot.  With this you can call ANYWHERE (hopefully) for free, any
time (unless the VMB has hours [...some do...]) To dial out, try this first:

just dial a local number (ex 432-1342#)

>From there it may beep and say 'THAT # CANNOT BE REACHED' or it may connect
you.  If it connects you, great!  You just found an untraceable way of hacking!
Call back and try 1-npa/xxx-yyyy (if that works, then abuse the hell out of it
as soon as possible, because it wont last for long :) )  If those two methods
don't work try these.

                            9+1+npa/xxx-yyyy  (works most of the time)
                            8+1+npa/xxx-yyyy  (not probable)
                            0+1+npa/xxx-yyyy  (Possible)
                            9+xxx-yyyy
                            8+xxx-yyyy
                            0+xxx-yyyy

If none of those work, then you're shit out of luck. Use it for a code line.
If it did work, think of the possibilities, 900 numbers (for gaining access
to boards), Tons of free LD, untraceable calls............

On to the last subject of part 1.

------------------------------
Another Way To Make Free Calls
------------------------------

Sorry, this only works on Direct VMB's, sometimes only the ones in your local
exchange, its a long shot, but hell, its free.  (But don't do this from your
home phone, stupid.)

Change the outgoing message on the direct VMB to 'Operator, this number accepts
all collect and 3rd party billings'  Call up the operator and ask for AT&T,
once they come on tell her you would like to make a 3rd party billing.  Tell
her the number you're billing to is the VMB #, then tell her the number you
wish to call. She'll say, "wait," AND a few moments later she'll come back
and say they accepted.  Presto!  You're in!

If you get busted, say you read a text file on how to do it, you didn't think
it would work... (act innocent, alwayz worked for me :)


You can leave me comments, suggestions or threats at my VMB
(not a Meridian currently)  *(800)775-0728* (direct)...


-substance

[EOF]