X2 Free SMS Exploit

Note: The information within this article is published for INFORMATION PURPOSES ONLY. The use of any or all of the following information can be considered defrauding the phone company. You have been warned.

By: Ninja

Okay guys, now for the exploit. We all remember the old straw
trick to make free phonecalls? Well the phone company patched
it up so it detects if that trick is being used. However, the
patch doesnt check when using the SMS feature on the newer X2
phone.

The X2 coinbox works on a weighting system, where the coins are
weighed and the weight is compared to the "apparent" credit that
is clocked on the display. The patch, makes the phone check the weight
as the call connects, so if their is a descrepancy, the call will drop
out.

The SMS system on the X2 works slightly differently, first sending
the message to the MTMS/Call Centre, and then deposits the money.
The straw trick works in this case as the service has completed by
the time the deposit takes place, so the message is sent before the
phone checks the money.
Exploit Method (this will require some knowledge of the straw trick):

1. Insert amount of coins into phone(usually SMS cost on X2 is 20c)

2. Using the straw trick, drop the money out.

3. Hit the button for SMS.

4. Type your message and send.

5. The phone will make someweird noises, and possibly call MTMS, after
the message is sent, the phone will work correctly in approx.
2minutes.

Straw Trick (for those that dont know):

1. Insert a straw, length ways, into the payphone,in the gap between
the top of the coin return and coin return flap.

2. Approx. 2/3 of the way from the left, approx. 10cm's back is a
little tab which you hit with the straw. This will return any
money in the payphone.

3. Repeat step 1 and 2 until appropriate total is reached.

1.) Basic Social Engineering Defense 101 - Israel
2.) How to Plan for a Possible Network Attack - Robert J. Shimonski.
3.) Brute Force - The Attackers Last Resort - Lineman
4.) X2 Free SMS Exploit - Ninja
5.) Proof Of Concept: 'Forced Analog Transmission Workaround' of the CDMA network - Ezekial
6.) Fun with Call Forwarding - Ninja