Exploring Caves in Travelnet

One fine summer day several years ago, a phone phreak discovered yet another
interesting telephone number. What was it? A modem? A dial tone? A very special
operator? No to all of the above - this was something truly amazing and unique.
This was TRAVELNET.

Of course, he didn't know at the time what he had dialed into. But this is what
he heard. Two rings, a tone that lasted for about half a second (it had about
the same pitch of a Sprint tone), and then a voice! Not just a recording, not
just a human asking what it was you wanted, but a recording asking you what it
was you wanted! Sort of like hearing an answering machine for the first time.
But this was no answering machine.

"Authorization number, please," a sensual, husky female voice asked. And since
he was a rather clever guy, he hit his touch-tone keypad. Every time he
entered a tone, he heard a short "booop." like an acknowledgement of some
sort. After four of these "booops" the automated lady came back and said
"eighteightsevenzero." But, alas, those were not the keys he hit. In
semi-desperation, he hit another key. The female voice came back and said,
"Please repeat, yes or no?" But what was the question? He quickly realized that
she must have been somehow trying to confirm the entry of his numbers. But how
do you convey the word "no" on a touch-tone keypad?

He went through the whole process again and wound up getting dumped into a
recording that said (in an authoritative female voice), "The Travelnet number
you dialed is incorrect; please check the number and dial again."

He called back. Again he tried entering numbers and tried to figure out why
they wouldn t correspond. All of a sudden, his baby sister (who had been
growing increasingly bored with a rattle in the next room), decided to let out
the sort of scream that baby sisters are known for. What's important about this
is that after the scream was over, our friend heard quite distinctly over the
telephone lines: "booop."

"Wow." he said. "Booop." it repeated. It recognized speech! He called it back
and started entering numbers with his voice. It worked! After four numbers
were entered, it would repeat them back to him and he had the option of saying
either "yes" or "no."  If he said "yes" or remained silent, he had the
opportunity to enter four more numbers. If he said "no" the machine would make
every effort to find out what the number was by asking him twice just what it
was he meant to say. There were a few simple rules - he had to enunciate
clearly and say the word "zero" instead of "oh."

But what would this lady let him do if he guessed the right eight numbers? And
how could he possibly get such a long number anyway. Would he have to call up
the lady and slowly and patiently pronounce little words over and over? Since
he knew that there were over 100,000,000 possible combinations and that no more
than a thousand probably worked, he understood that it would take some thinking
to satisfy the mechanical voice. He needed to find some good old-fashioned
human incompetence. If the machine had trouble hearing him, or if he remained
silent, it would eventually say, "Sorry, we're having difficulties." Then it
would connect him to a human. He stuck on the line and when the operator
answered, he asked her what number he had dialed. "This is General Motors
Travelnet, sir," she replied.  "I'm terribly sorry," he said. "I was trying to
get the speaking clock." "That's okay," the operator said. "Good-bye."

So it was General Motors! This would be easy. He waited a day and called back.
He got connected to another operator, who asked him what he wanted. "This is
J.C. Steppleworth from Fort Wayne GMAC," he snarled. "And I've been having
trouble using this confounded phone system." "Well, why don't you call the
instruction number, sir?"  She gave him the number. He called this number and
heard a full demonstration on how to use the system. It was used to make phone
calls, which he sort of suspected. After you enter your 8-digit code, you enter
a 10-digit phone number or, if dialing internally within General Motors, a
7-digit number. The recording even spoke a demo authorization code to get the
point across. After hearing this, our friend wondered if he should try the demo
code. "No," he decided. "They couldn't possibly be that stupid.' He tried it
anyway and guess what? The moment he confirmed the last number, the lovely
voice asked a new question: "Destination code, please?" (In other words, the
phone number you're trying to call.)

It was an extender - a long- and short-distance phone service. He proceeded to
test it, out, and he found that he could call virtually anywhere in the country
for free. But who cares about free calls? He wanted to explore. And explore he
did. He tried many things and learned many things. He found that he could avoid
the lady's voice if he keypadded in the numbers before she could speak. This
way the call would go through normally without any arguments on pronunciation.
This allowed him to test many, many codes without much hassle. He found that by
mixing up his working code a little, he was able to find many new ones. The
simplicity was astounding. In a short time, he had found literally hundreds of
codes. After this, he sat down one day and stared at his list of codes. All of
a sudden, he realized something. Each group of four added up to either 9, 19,
or 29 - a sort of base-nine code. He wrote a short program and printed out all
possible four-digit combinations that added up to these magic numbers. He was
set for life.

He used the system to explore internal offices. If no area code was entered,
every exchange put you in a different part of the country. One exchange, 999,
simply dumped him into a feed from a Detroit radio station. One day, his
Demon-dialer, which is basically a touch-tone generator with a memory, came
across a reorder (a fast busy signal) that turned into a dial tone in 20
seconds. The connection wasn't great, but he found that he could make a direct
call anywhere. He could dial overseas directly. He figured that he was at the
switchboard of some office branch far away from where he originally called. He
found out what the number was by calling a friend person-to-person collect, who
then asked the operator for the number so that the "person" could call back
when he returned. When he called up the number he was dialing from, they
answered. "GMAC." So it was some distant office that he was making his calls
out of, using a Travelnet code and an internal number to get there. It was so
roundabout that he knew nobody would figure it out. In fact, several people
that he called received calls from that office asking if they knew anybody who
worked there that would call them at three in the morning. It was incredible!
Even if a friend had wanted to frame him, it was doubtful that they would
connect him with this distant city from which the call supposedly emanated. And
the funny thing was that the company was probably placing a 24-hour armed guard
on the building, thinking that someone was breaking in and making calls.
Someone was, but in a way they could never figure out.

There's much more to the world of Travelnet, particularly on their internal
network. And the same number works to this very day, which, by the way, is
toll-free. But we've heard of cases where people have been trapped into paying
for what they did and it's quite likely the system is heavily monitored.

A similar system called WIN was used by Westinghouse before they gave up in
disgust after their lines were constantly tied up by phreakers and hackers.
Honeywell makes the actual system and there are others in use around the
country - one, we hear, for the state offices of Illinois, another for
Ralston-Purina, the folks who blow up sewers in Louisville, KY.

As usual, nobody at Travelnet understood any of the questions we asked them and
no one returned our calls. Maybe the lines were all tied up.