Fast-Food Phun (Summer, 1997) ----------------------------- By VaxBuster Before I start into having Phun with Phast Phood, I want to go over a few basic radio items. This will give you a general idea of the type of equipment involved and what kind of radio features you should look for to maximize your hacking potential. The first thing you want to look for is a ham radio that is dual-band. Whenever you see this word in various ham radio magazines, they are referring to the fact that the radio supports two bands. These bands most often are the 2-meter band (approximately 140-148 MHz) and the 70-cm band (approximately 440-450 MHz). These are both amateur bands and you will mostly hear a bunch of old farts talking about how ridiculous the no-code tech license is. The most important feature of the radio you're looking for is one that is easily modifiable. How do you know which are? Check out www.qrz.com. See, even with a license, the FCC regulates where you can transmit and receive. While looking through the mods, find one that you are technically capable of performing and also one that gives you transmit and receive capabilities in the following ranges. Note these ranges are approximate: * 140-174 MHz TX and RX * 440-475 MHz TX and RX * 800-900 MHz RX (cellular) Now although this might not seem like a big range, it is pretty much all you will need. These ranges are broken down into extremely small channels of only a few kilohertz wide. This will give you access to everything from handheld radios, police, fire, ambulance, fast food, cellular, I could go on forever. Now cordless phones operate on 46/49 MHz, but don't go looking for radios that will transmit on there, or transmit on cellular. In general, ham radio rigs won't support these ranges, even after modification. Trust me, you can have a ton of phun if your radio supports the frequencies I listed above. A couple of other important features to look for are CTCSS [Continuous Tone Coded Squelch] (I'll explain this later), DTMF [Dual Tone Multifrequency touchtone], lots of memory channels, and alpha tagging. OK, you've bought your radio. It's modified. It works. Now where do you tune to? I m not going to reprint the 19 lists that are out there on the net. If you do a web search for "fast food frequencies" you'll get plenty of hits. I'll give you a basic idea on where to look when scanning. Remember, when scanning, that the output side of the repeater is almost always broadcasting, meaning that your scanner will stop and you will hear basically an open customer mic on the output frequency. * Scan 30.xxxx to 35.xxxx for the output side of repeater * Scan 151.xxxx for the input (clerk) side * Scan 154.xxxx for the input (clerk) side * Scan 157.xxxx for the input (clerk) side * Scan 170.xxxx to 173.xxxx for the input (clerk) side * Scan 457.xxxx to 469.xxxx for input/output * FYI: 469.xxxx for output and 464.xxxx for input are popular. I realize this last range is pretty broad, and I apologize, but this list would be huge if I broke out each individual range. A radio repeater is basically a device that repeats a signal from one frequency to another. The repeater's antenna is usually placed high atop a mountain or building. The purpose of this is to get line-of-sight to as many points on the ground as possible. Once a signal is received, it is then transmitted out the output frequency at a high rate of power. The purpose of this device is to allow communication among a bunch of lowpower radios. Often, these low-power radios have much smaller antennas as to make them more portable. Fast food repeaters in general operate in this fashion. There is one frequency in which what the customer says is broadcast as well as what the clerk said is broadcast. You'll see me refer to this as the output side of the repeater. If you tuned to that frequency on your radio, what you'd hear is the same as if you were standing right next to the speaker at the drive thru. You would hear the entire conversation. This will be your receive frequency. Now the input side of the repeater is what you will be transmitting on. This frequency is what the clerk actually transmits on, both to talk to other clerks, and to talk to the customer. Now, the determining factor on whether or not the repeater transmits the signal to the customer's speaker is PL [Private Line]. This will be the transmitting frequency. Just FYI, if the repeater is using standard frequency pairing, the input frequency is 5 MHz below the output. This is true in the UHF (4xx MHz) band. So if you find the receive frequency at 469.0125, you know the transmit frequency is probably at 464.0125. The "security" that exists is designed to keep unwanted noise and parties from interfering with the communications and is pretty basic. It is not at all built to withstand hacker attempts to transmit through the repeaters, as I'll show. CTCSS, continuous tone coded squelch system, or PL, as it s more commonly known, is made up of a subaudible tone that is transmitted in-band along with the communication (usually voice). These low frequency tones must be received by the repeater at the same time as the communication. If the repeater does not receive the proper PL, it in essence ignores your communication by not repeating the signal to the output side of the repeater. If you do transmit the proper PL with your transmission, it will break the repeater's squelch and it will pass on your voice to the output side of repeater. There are a total of 32 PL tones ranging from 67.0 Hz to 250.3 Hz. As far as fast food is concerned, the PL tones vary from location to location. Since there is no standard, we need a method to find it. Sometime at dinner time, stop by your local joint, and tune to either the output or input side of the repeater. Once you ve tuned there, set your CTCSS squelch to ON. We re telling the radio to only receive transmissions with the PL you ve told it to receive. Since you can change the PL one at a time, you can go through all the possible PLs until you hear a transmission. To do this, select tone-select (or equivalent). A PL tone should appear. Spin your dial to select different PLs. Do this while they are transmitting of course. As soon as a transmission of theirs breaks the squelch, you'll hear the voice. Bingo, you have the proper PL. Adjust your transmit shift to the proper frequency. Key up. You are now broadcasting loud and clear out the PA speaker. Your voice will definitely override the clerk's because of the fact that your signal is much stronger. Go capture effect! From this point, feel free to add 20 burgers to the next order taking place, or curse at the customer. Feel free to use a crossband feature to link a McDonald s drive-thru to a Burger King clerk. The fun here is endless. Standard disclaimers apply. Don't be stupid and you won't get caught.