
MSG LEFT BY: SIR THOMAS SCHMOLLING
DATE POSTED: 

HERE'S SOMETHING YOU GUYS MAY HAVE OVER
LOOKED: IMTS MOBILE TELEPHONE HACKING.
IF THERE IS ONE IN YOUR AREA, YOU CAN
HAVE SOME UNIQUE PHUN. A STANDARD IMTS
BASE STATION TRANSMITS A 2000HZ SIGNAL
CONTINUOUSLY SO THEY ARE EASY TO FIND
ON VHF AND UHF BANDS. HERE'S THE
PROCESS 
1. MOBILE PHONE FINDS THE 2000HZ TONE
AND SENDS A 2150HZ GUARD TONE, A SHORT
1633HZ CONNECT TONE (1663HZ SOUNDS FIM-
ILIAR, DON'T IT?), AND THEN GOES BACK
TO THE 2150HZ TONE.
2. BASE STATION SENDS A 1800HZ SEIZE
TONE TO NOTIFY THE MOBILE THAT IT'S
AWAKE AND WORKING.
3. MOBILE SENDS ITS MOBILE NUMBER IN AN
UNUSUAL PULSE FASHION. FOR EXAMPLE, IF
THE NUMBER IS 523...ETC, IT WOULD LOOK
LIKE THIS:
2150   - - - -    -    - -
1633  - - - - -  - -  - - -  ETC.
          5       2     3
EACH PULSE IS 10 PPS BUT I DON'T KNOW
WHAT THE SPACES ARE; I THINK THEY ARE
THE SAME REQUIREMENTS AS A PHONE LINE.
4. MOBILE GETS DIAL TONE (IF MOBILE NO.
IS ACCEPTED OF COURSE.)
5. MOBILE DIALS PHONE NUMBER IN THE
THE SAME F.S.K. FASHION BUT (I THINK)
THE PULSING IS 5 PPS.
6. TALK TALK TALK
7. MOBILE DISCONNECTS WITH 4 F.S.K.'S
 2150HZ/1336HZ.
 
THIS NO LESS OPENS A NEW WORLD FOR
PHONE PHREEKING. USUALLY MOBILES ARE
ALLOWED TO MAKE LONG DISTANCE CALLS AND
THE COMPANY NEVER GIVES A LIST OF THE
CALLS MADE. HOWEVER, THESE COMPANIES
AREN'T AS DUMB AS MA BELL AND WILL TAKE
MORE ACTION IF THEY THINK SOMETHING'S
UP.- SIR THOMAS JOHANNES SCHMOLLING
