Spoofing Call Waiting ID

                               by Lucky225
                           Lucky255@hotmail.com


In this article I will explain how Caller ID on Call Waiting (Call Waiting ID)
works and how it is possible to display messages on Caller ID equipment. 


How It Works

When you have call waiting you will notice that you hear two tones if you have
Call Waiting ID. The first is the Subscriber Alert Signal (SAS, or "call
waiting beep") tone. This is just your normal Call Waiting Beep (440hz for
330ms). The second tone is a CAS (CPE Alert Signal) tone. This is a short 80ms
DTMF tone of 2130+2750hz. This tone alerts the CPE (Customer Premise
Equipment, in other words the Caller ID box) that there is a call waiting
tone. The CPE then mutes the handset and sends an acknowledgement tone (DTMF
"A" or "D" tone) to the central office to tell the CO that it is OK to send
Caller ID information in FSK format.  The Name and Number are displayed on the
CPE and the CPE unmutes the handset. 


Spoofing

To send a fake message to be displayed on the Caller ID box you will need a 
recording of an FSK transmission.  We are currently working on a program that 
will create an audio file with whatever information you want. If you would
like to help please email me. In the mean time you can do the following. Order
Call Waiting ID or go to a friend's house who has it. Call your phone when
it's in use so you get a call waiting beep. Make sure there are no CPE's on
the line. When you hear the CAS tone send an acknowledgement tone back and the
central office will send the FSK signal over the line. Record this with a
micro-recorder or some other recording device.  Once you have your FSK
recorded, call the person you want to put the CID message on and play a CAS
tone. You'll hear his CPE chirp back with an acknowledgement tone. Then play
your recording of the FSK signal. If you did it fast enough the information
will show up on his caller ID screen. 


Obtaining Tones

You can make an orange box (CAS tone generator) by modifying a tone dialer.
Just take out the 3.58mhz crystal and put in an 8.192mhz crystal and the star
button will create a CAS tone!. You can make acknowledgement by creating a
silver box (plans found on the internet). 


2600 Magazine, Volume 16, Number 4, Winter 1999-1900