Fun in a Reno Hotel

A Yaesu, a scanner and some notesDuring a recent stay at a very nice and very large hotel in Reno, we decided that lots of fun would happen if we could just find the frequencies to our hotel. Using information given to the maids and maintenance people has always worked out for us in the past. Eventually we got several hotel frequencies by calling up housekeeping and talking a maid out of the FCC ID on her radio. She was more than happy enough to pull the battery out of her radio and read the information to us. Using the FCC’s FCC ID search we were able to find several hotel frequencies and put them to good use. Wait a second, that’s not what this update is about.

This update is about opening up phone jacks in hotel rooms. For some reason, pretty much any large hotel in America thinks a flimsy piece of plastic is adequate protection against people who might want to tap into the phone lines of other rooms in a hotel. When you open up the phone jack in a hotel room, you’ll see something like this:

hotel room phone jack

A hotel phone jack should only have one set of wires in it. The wires for your phone line(s). But as you see in the picture, the area behind my phone jack had 3 extra cat5 cables running through it, all easily accessible to anyone with a screwdriver. Using a Leatherman, I was able to strip the insulation from the wires and test the lines on each one. Each of the 3 lines had a dial tone. I only tried the blue/blue-white wires in each cat5 cable since that’s what my phone line was hooked to. But I bet if I kept stripping wires I probably could have found more.

Now a sensible, morally grounded hacker would have said, “Hmmm, that’s interesting” and put the jack back on the wall and maybe anonymously alerted someone in charge of this security flaw. But I’m no hacker – I’m a huge asshole. Team Spessa and I used this elite exploit to irritate dozens of hotel guests and employees in the middle of the night.

I found out the room numbers of each line by calling the front desk from each of them, asking a random question and then saying, “Oh, by the way, what’s our room number?” We ended up with the phone lines for a room upstairs, the room next door to us, and a room two doors down. But I needed to be able to switch between lines so that when hotel security started banging on our door, I could quickly switch them back before answering the door. I’m paranoid, okay? I mean really, what are the odds that anyone would figure it out?

I walked around the streets of Reno, looking for a place that might sell some phone jacks or wiring since I hadn’t come prepared with anything that I could easily hook into these extra lines. During my search I ended up in a sleazy-looking liquor store and was surprised to find that they sold the perfect item – a dual line in-wall phone jack. It was so strange that a liquor store would sell this item. It was the only phone-related item on their shelf, yet it was perfect for my needs. The phone gods were looking out for me. I paid my $2.99 and headed back to the hotel.

hotel room phone jack

Since the jack had two separate RJ-11 jacks on it, I was able to hook our own room onto the top jack and then one of the other rooms into the bottom jack. This way we could have easy access to another room’s phone jack for days and the maid would never notice it. In the end it looked like this:

hotel room phone jack

On our last night at the hotel, after a late night of gambling, we entered our room at 2am and began making calls. Team Spessa came up with the crazy idea of pissing off as many people as we possibly could for the sole purpose of going into the lobby and witnessing the chaos. Pissing off the guests was easy enough. Our page of hotel prank calls will convince you of that. But tonight our goal was to get as many guests down in the lobby as possible, so many of our calls were very generic, made for the sole purpose of getting people into the lobby instead of being simply to make us giggle. The giggling would come later. Here’s an idea of how many of the calls went…

Switch Rooms Tonight We call up a lady and ask her to switch rooms so a celebrity can have their favorite room. Notice how when she’s in doubt and asks if this is a joke, all we have to do is tell her that it’s not a joke and she’s completely convinced. This happened in almost all the calls.

For close to an hour we called random rooms all over the hotel. We told one guy that our geiger counter was showing unusual levels of radiation around his room and we needed to move him out of his room. Others were told that they were making too much noise and they needed to come down and prove that they were quiet people. Many of them were upset that we were insisting that they’d ordered room service and would have to come down to have the charges removed. And then there were these people…

Carrot Top This lady is appalled that she has to leave her room at 3:00am just so a celebrity can have his favorite room. But when she finds out that the celebrity is Carrot Top, she has a fit. Full credit for this one goes to Mr. Spessa who kept whispering at me what to say. I ruin it in the end and the lady probably doesn’t come to the front desk, but the call is just too funny not to post here.

Room Service This stuttering lady is extremely upset that the front desk is charging her for room service as her husband rants in the background about calling the cops.

Noisy BabyMr. Spessa tells a guest that they need to keep their baby quiet, then convinces him to come down to the front desk.

Shut The Fuck Up We kindly ask a guest to shut the fuck up and he doesn’t find anything strange about this. His wife sure isn’t happy, though.

Illegal Music A guest denies that they’re downloading music illegally from their hotel room. They finally agree to come to the front desk to assure us that their cell phone isn’t responsible.

In the end, about 40 hotel guests were called with nearly all of them agreeing to come down to the front desk. I visited the front desk near the beginning and witnessed a young couple complaining about their fake room service order to several perplexed employees. And later, Mr. Spessa went down and complained to the front desk about the call that he was going to have to vacate his room for a celebrity. He claimed that he had to wake his entire family and they were all packing their things so they could move to another room. As he stood at the front desk, other guests were complaining to other employees and phone calls from pissed off guests were coming in from other rooms. During this time, Spessa and I took turns looking through our door’s peephole at the guests coming out of their rooms to go to downstairs. The entire hotel was alive with very irritated people.

In the end, the hotel was nice enough to credit all of our nights except for one and apologized for the inconvenience about a bajillion times. So not only did we get to see live entertainment in the lobby, nearly our entire stay was free! Thanks, hotel people!

Be sure to listen to the rest of our hotel calls at There’s a few new calls up, including some that weren’t included in this update.

Brad Carter

I run this town.

13 thoughts on “Fun in a Reno Hotel

  • August 14, 2007 at 9:31 am

    That’s awesome. I was in a hotel the past weekend and only the presence of my family stopped me from doing something similar. Good to see you haven’t mellowed after all, MAKE A NEW PLA RADIO.

  • August 14, 2007 at 12:04 pm

    Now I see how influential I am on the people whose lives I touch! Being a grammar nazi left its mark on those forced to interact with me. I just thought I was annoying them…

    Just to prove I’m off my game: I almost wrote “people who’s lives” and “grammar nazi left it’s mark.” How embarassed I would have been with the extra useless apostrophes. Thankfully I put extra effort into making sure my grammar was A+ in a comment about how I’m a grammar nazi. Your welcome (giggle)

  • August 14, 2007 at 7:46 pm

    The phone part is great, it really is, but was there more to the radio frequency story? Reno has tons of frequencies worth messing with!

    P.S. That Yeasu hand held is one of the best in their product line. Great frequency coverage and its waterproof!

  • August 15, 2007 at 12:10 pm

    No Spessa on these calls? Bummer!

    More of Mr. Spessa would have been great too, his interactions with people are usually some of the best calls.

  • August 16, 2007 at 6:04 pm

    Hey, forget about the phone calls, I want audio of the radio thrashing

  • August 17, 2007 at 12:03 pm

    Fantastic update

    brings back fond memories of a certain hojo that was probably never the same after KP2 and i stayed there. the bastards fucking BOLTED the TV remote to the coffee table, pretty much negating the point of having a remote. so, the first thing i did was pick the lock… and of course, we removed the batteries before bolting it back in when we left…

    but that was only the beginning. i should write it up, sometime…

  • September 7, 2007 at 9:18 pm

    Is that an Icom IC-T90A? You have the same radio I do! Hacking it for out-of-band coverage is easy. :) Just get a knife and break off the diode under the flimsy plastic cover under the battery

  • October 7, 2007 at 10:32 am

    For the Carrot Top lady, you should have let her go after promising her that someone will come up in 15 minutes, and then called another guest and convinced them to move into her room. “Just knock on the door, we have a roomkeeper there waiting for you with the keys and everything.” Then you should have called her back as the new guest arrived. It would have made quite a saga novel!

  • January 23, 2008 at 4:29 am

    I did this the first defcon I ever attended, basically it’s easer to run a bunch of cables all the way up in the same place in a building, and thus the exploit remains. Another way to get the room # without talking to an operator(depending on the pbx) is to dial the code for voicemail, most places in vegas will say ‘Room 225, you have no messages’ It was like a room ANAC lol

Leave a Reply