Mastercall director
      -------------------
      by Talisman/ACU
      ---------------


     Mastercall directors are now being commonly installed around Australia by
   Telecom, So what do they do and what good are they to me?

   Principle of operation
   ----------------------
    The TELECOM DIRECTOR Call diverter enables an incoming call (from A-PARTY)
   to a customer's number (B-PARTY) to be diverted to another number (C-PARTY)
   When ring current is detected on the B-PARTY line, The unit loops the
   second line, dials out the diversion number in memory, and connects the
   two parties when the call is answered.

   The caller is not aware of any transfer, and at the completion of the call
   the director detects busy tone. dial tone or silence to automatically disconect
   within seconds.

   Lets phreak !
   --------------
     Directors can be used for most of the activites that are done on loops
   in the states. eg. You may wish someone to call you but do not want them to
   know your home number so simple tell them to call you at a certain time
   and give them the number of the director. About five minute before they
   are due to call reprogram the director to divert the call to you.
   Maybe you wish to hack something or make a malicous call and you are scared
   that you may be traced so program the director to divert you to there number
   then simply ring the main number. Try programming the director to divert
   calls to you then have your contact's call a operator and ask to see if
   you will except reverse charges,when the operator calls the director
   she/he/it won't be aware of the transfer and then you simply except the
   reverse charges which are really billed to the director..

   * All ways make sure whoever you call will deny all knowledge of the call *




   User Guide for REMOTE CONTROL DIVERSION
   ---------------------------------------

   To Activate diversion:
   ----------------------

   1. Lift reciever  (even lamers can do this one.)
   2. Dial the diverter line number (Line 2)
   3. After 4 double ring tones DIRECTOR answers
   4. Listen for message "Welcome to Telecom director enter P.I.N number"
   5. Enter Personal Identification Number with a touch phone
   6. Press "1"
      - If diverter responds "Divert On" hang up reciever
      - If diverter responds "Divert Off" press "1" agian and diverter will
        respond "Divert On"
   7. Enter other programme changes as desired.
   8. Hang up reciever

   To Deactivate diversion:
   ------------------------

   Repeat steps 1 to 5

   6. Press "1"
      - If diverter responds "Divert Off" hang up reciever
      - If diverter responds "Divert On" press "1" agian and diverter will
        respond "Divert Off"
   7. Enter other programme changes as desired.
   8. Hang up reciever

   To change 1st diversion number:
   --------------------------------

   Repeat steps 1 to 5

   6. Press "2" - diverter beeps and responds "Enter Number"
   7. Enter required diversion number   ("##" can causes a dial pause)
   8. Press "#" - diverter beeps and repeats diversion number
   9. Enter other programme changes as desired
   10.Hang up receiver.

   To change 2nd diversion number:
   --------------------------------
   NOTE: If a second diversion number is not required, enter a single "0"
         into the second number location.

   Repeat steps 1 to 5

   6. Press "5" - diverter beeps and responds "Enter Number"
   7. Enter second diversion number
   8. Press "#" - diverter beeps and repeats diversion number
   9. Enter other programme changes as desired
   10.Hang up receiver.

 ** REMBER BEFORE CHANGING THE DIVERSION NUMBER PRESS "#" TO FIND THE NORMAL
    DIVERSION NUMBER AND REPROGRAM IT AFTER YOU HAVE FINISHED **


 Now some ideas on how to Find & Hack them.

   1. Have contacts in Telecom.
   2. Find them by accident if you do find one by accident chances are
      you will have found the 2nd line (The one that asks for pin)

      Now what how do i find the main number to call and the pin ?
  Well i have noticed one thing that is when Telecom sets the director up they
  usually have a standard way programing the pin,but this seems to vary from
  area to area one common way is programming the pin seems to be the last 3
  digits of the diversion number..
             eg. 123-4567 maybe the diversion number so when it asks for
  the pin the first thing i try is "567".
   Director numbers are not free to call so its not really advisable to
  make 999 calls in a attempt to get the pin!

      Once your past the pin number and your now after the main number there
      are three ways that i use ..

      1. Type the Pin and press "#" write down the number your diverted to
         and call it, Then simply engage in some "Social Engineering" and
         try to find the main number. Or pretend to be a telecom tech.
      2. More "Social Engineering" if you know the number for the exchange
         that the diversion number is connected to call them say your
         a Tech trying to fix a fault on this line and you would like to know
         the main number of the director. (Called 1st leg by telecom)
      3. Just reprogram the director to call you and then wait for a call
         and ask them what number they were calling.

      Remember when ever you change the diversion number that person will also
      get calls for who ever owns the director so its a good idea to only do
      this late at night.

      Some facts about Director
      -------------------------
       - Will terminate calls lasting longer than 30 minutes and will send
         a warning tone to the C-PARTY, 30 seconds before.
       - May be programmed to send an indentification tone to the called
         party to indicate a diverted call, the caller does not hear this tone.
       - May be programmed to prevent the A-PARTY from hearing the STD pips
       - It only rembers the current diversion number as soon as you change it
         all record of were it used to divert to is lost.
       - It is usually installed in the exchange but maybe installed anywhere.
       - It stores a record of how many calls have been diverted.
       - It may be programed by a number pad on the director console
       - If two diversion numbers are programmed the diverter will try the
         two numbers alternately until the call is answered
       - Maximum of 16 digits in the diversion number
       - Not all Directors are remotely programable.
       - Designed,Manufactured and serviced in Australia by Design 2000
         pty ltd Melbourne
       - Does not appear to allow data over 300 baud through it.



     Special Thanxs to Code Tapper of THE FIRE STARTERS for starting me out
     in the world of Phreaking.. Sorry to hear you were busted..

     Have Fun and be cool!

                ** TALISMAN/AUSTRALIAN CRACKERS UNITED **