Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [7]
When the supervisor came on the line, I introduced myself again and said, “Did you get our memo that we’re changing our number?”
She went to check, came back on the line, and said, “No, we didn’t.”
I said, “You should be using 213 687-9962.”
“No,” she said. “We dial 213 320-0055.”
Bingo!
“Okay,” I told her. “We’ll be sending a memo to a second-level”—the phone company lingo for a manager—“regarding the change. Meanwhile keep on using 320-0055 until you get the memo.”
But when I called the Non-Pub Bureau, it turned out my name had to be on a list of authorized people, with an internal callback number, before they would release any customer information to me. A novice or inept social engineer might have just hung up. Bad news: it raises suspicions.
Ad-libbing on the spot, I said, “My manager told me he was putting me on the list. I’ll have to tell him you didn’t get his memo yet.”
Another hurdle: I would somehow have to be able to provide a phone number internal to the phone company that I could receive calls on!
I had to call three different business offices before I found one that had a second-level who was a man—someone I could impersonate. I told him, “This is Tom Hansen from the Non-Pub Bureau. We’re updating our list of authorized employees. Do you still need to be on the list?”
Of course he said yes.
I then asked him to spell his name and give me his phone number. Like taking candy from a baby.
My next call was to RCMAC—the Recent Change Memory Authorization Center, the phone company unit that handled adding or removing customer phone services such as custom-calling features. I called posing as a manager from the business office. It was easy to convince the clerk to add call forwarding to the manager’s line, since the number belonged to Pacific Telephone.
In detail, it worked like this: I called a technician in the appropriate central office. Believing I was a repair tech in the field, he clipped onto the manager’s line using a lineman’s handset and dialed the digits I gave him, effectively call-forwarding the manager’s phone to a phone company “loop-around” circuit. A loop-around is a special circuit that has two numbers associated with it. When two parties call into the loop-around, by dialing the respective numbers, they are magically joined together as if they called each other.
I dialed into the loop-around circuit and three-wayed in a number that would just ring, ring, and ring, so when Non-Pub called back to the authorized manager’s line, the call would be forwarded to the loop-around, and the caller would hear the ringing. I let the person hear a few rings and then I answered, “Pacific Telephone, Steve Kaplan.”
At that point the person would give me whatever Non-Pub information I was looking for. Then I’d call back the frame technician and have the call-forwarding deactivated.
The tougher the challenge, the greater the thrill. This trick worked for years and would very likely still work today!
In a series of calls over a period of time—because it would seem suspicious to ask Non-Pub to look up the numbers of several celebrities—I got the phone numbers and addresses of Roger Moore, Lucille Ball, James Garner, Bruce Springsteen, and a bunch of others. Sometimes I’d call and actually get the person on the line, then say something like, “Hey, Bruce, what’s up?” No harm done, but it was exciting to find anyone’s number I wanted.
Monroe High offered a computer course. I didn’t have the required math and science courses to qualify, but the teacher, Mr. Christ (pronounced to rhyme with “twist”), saw how eager I was, recognized how much I had already learned on my own, and admitted me. I think he came to regret the decision: I was a handful. I got his computer password to the school district’s minicomputer every time he changed it. In desperation, thinking to outfox me, he punched out his password on a piece of computer paper tape, which was the type of