DTMF brute force for answering machines

#1

I dont think anyone even uses answering machines anymore, but back in the day, when they were more popular, they were also hackable. They all had the functionality to listen left voice messages via the phone. This required a 3-digit pin, which you would input during the welcome message and then it would report on how many messages you have and you could select to listen/delete them.

Since it’s only 3 digits, it’s quite easy to brute force. What I did was I just played DTMF signals from 000 to 999 in a row quite fast.

But there is e more efficient way even. Since it needs to be 3 digits, then it can be overlapping in the sequence, meaning for example the sequence 1234567890 actually contains 123, 234, 345, 456, 567, 678, 789 and 890.

[123]4567890
1[234]567890
123[456]7890
1234[567]890
12345[678]90
etc

I have never managed to solve the creation on the most efficient sequence of numbers that contain all 3-digit numbers from 000 to 999. What I have managed to find out is that it is called a ‘de Bruijn sequence’, but im not that savvy to understand the algorithm that is used to generate it. Maybe someone here can solve this, I’d really like to see the sequence, this has been on my mind for 10+ years :slight_smile:

Anyway, as I just got the DTMF dolphin on my F0, it brought back those good old memories and I thought it would be a cool addition to the functionality of DTMF dolphin…

1 Like
#2

http://www.hakank.org/comb/debruijn.cgi?k=10&n=3&submit=Ok
Sequence:
0 0 0 1 0 0 2 0 0 3 0 0 4 0 0 5 0 0 6 0 0 7 0 0 8 0 0 9 0 1 1 0 1 2 0 1 3 0 1 4 0 1 5 0 1 6 0 1 7 0 1 8 0 1 9 0 2 1 0 2 2 0 2 3 0 2 4 0 2 5 0 2 6 0 2 7 0 2 8 0 2 9 0 3 1 0 3 2 0 3 3 0 3 4 0 3 5 0 3 6 0 3 7 0 3 8 0 3 9 0 4 1 0 4 2 0 4 3 0 4 4 0 4 5 0 4 6 0 4 7 0 4 8 0 4 9 0 5 1 0 5 2 0 5 3 0 5 4 0 5 5 0 5 6 0 5 7 0 5 8 0 5 9 0 6 1 0 6 2 0 6 3 0 6 4 0 6 5 0 6 6 0 6 7 0 6 8 0 6 9 0 7 1 0 7 2 0 7 3 0 7 4 0 7 5 0 7 6 0 7 7 0 7 8 0 7 9 0 8 1 0 8 2 0 8 3 0 8 4 0 8 5 0 8 6 0 8 7 0 8 8 0 8 9 0 9 1 0 9 2 0 9 3 0 9 4 0 9 5 0 9 6 0 9 7 0 9 8 0 9 9 1 1 1 2 1 1 3 1 1 4 1 1 5 1 1 6 1 1 7 1 1 8 1 1 9 1 2 2 1 2 3 1 2 4 1 2 5 1 2 6 1 2 7 1 2 8 1 2 9 1 3 2 1 3 3 1 3 4 1 3 5 1 3 6 1 3 7 1 3 8 1 3 9 1 4 2 1 4 3 1 4 4 1 4 5 1 4 6 1 4 7 1 4 8 1 4 9 1 5 2 1 5 3 1 5 4 1 5 5 1 5 6 1 5 7 1 5 8 1 5 9 1 6 2 1 6 3 1 6 4 1 6 5 1 6 6 1 6 7 1 6 8 1 6 9 1 7 2 1 7 3 1 7 4 1 7 5 1 7 6 1 7 7 1 7 8 1 7 9 1 8 2 1 8 3 1 8 4 1 8 5 1 8 6 1 8 7 1 8 8 1 8 9 1 9 2 1 9 3 1 9 4 1 9 5 1 9 6 1 9 7 1 9 8 1 9 9 2 2 2 3 2 2 4 2 2 5 2 2 6 2 2 7 2 2 8 2 2 9 2 3 3 2 3 4 2 3 5 2 3 6 2 3 7 2 3 8 2 3 9 2 4 3 2 4 4 2 4 5 2 4 6 2 4 7 2 4 8 2 4 9 2 5 3 2 5 4 2 5 5 2 5 6 2 5 7 2 5 8 2 5 9 2 6 3 2 6 4 2 6 5 2 6 6 2 6 7 2 6 8 2 6 9 2 7 3 2 7 4 2 7 5 2 7 6 2 7 7 2 7 8 2 7 9 2 8 3 2 8 4 2 8 5 2 8 6 2 8 7 2 8 8 2 8 9 2 9 3 2 9 4 2 9 5 2 9 6 2 9 7 2 9 8 2 9 9 3 3 3 4 3 3 5 3 3 6 3 3 7 3 3 8 3 3 9 3 4 4 3 4 5 3 4 6 3 4 7 3 4 8 3 4 9 3 5 4 3 5 5 3 5 6 3 5 7 3 5 8 3 5 9 3 6 4 3 6 5 3 6 6 3 6 7 3 6 8 3 6 9 3 7 4 3 7 5 3 7 6 3 7 7 3 7 8 3 7 9 3 8 4 3 8 5 3 8 6 3 8 7 3 8 8 3 8 9 3 9 4 3 9 5 3 9 6 3 9 7 3 9 8 3 9 9 4 4 4 5 4 4 6 4 4 7 4 4 8 4 4 9 4 5 5 4 5 6 4 5 7 4 5 8 4 5 9 4 6 5 4 6 6 4 6 7 4 6 8 4 6 9 4 7 5 4 7 6 4 7 7 4 7 8 4 7 9 4 8 5 4 8 6 4 8 7 4 8 8 4 8 9 4 9 5 4 9 6 4 9 7 4 9 8 4 9 9 5 5 5 6 5 5 7 5 5 8 5 5 9 5 6 6 5 6 7 5 6 8 5 6 9 5 7 6 5 7 7 5 7 8 5 7 9 5 8 6 5 8 7 5 8 8 5 8 9 5 9 6 5 9 7 5 9 8 5 9 9 6 6 6 7 6 6 8 6 6 9 6 7 7 6 7 8 6 7 9 6 8 7 6 8 8 6 8 9 6 9 7 6 9 8 6 9 9 7 7 7 8 7 7 9 7 8 8 7 8 9 7 9 8 7 9 9 8 8 8 9 8 9 9 9 (0 0)

2 Likes
#3

thanks a lot!

#4

They aren’t all 3 digit sequences. I’ve seen many with 4. The older ones tended to have insecure default pin codes as well. Such as 0000 and 0123. Best to try low hanging fruit first. Later models had random pin codes that were often written on the answering machine. Those could be changed though. Often with old landlines people used common words and easy to remember pins because the number map to letters. Later on with cell phones we still have voicemail. Many had a default password that were the last four digits of the phone number. To access voicemail from another phone which is usually possible you would need to press the * or # key depending on the carrier. Hacking voicemail is indeed alive and well even though answering machines are dead. Some of the sleazy tabloids for instance have been caught hacking celebrities voicemail. In some cases they even hacked the voicemails of crime victims in high profile cases.

#5

I had one of those many years ago with a small tape for recordings and it would have a nice setting that would ring for example 3 times if no message were saved and would ring just one if there were messages so that you would know (without spending money on phone call) that you have messages to listen, then you would send the pin to access the machine remotely. On my case it was a 4 digit pin … But it would be very cool to have that sequence on DTFM tool on flipper … even the one for 3 digit pin.

I still have my device stored in my collection storage room and it should still be working…

1 Like