· 9 years ago · Dec 31, 2016, 07:38 PM
1
21
3
4
5
6 The Official Phreaker's Manual
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28 The Official Phreaker's Manual V1.1
29 Updated 2/14/87
30 Compiled, Wordprocessed, and Distributed by:
31 The Jammer
32 and
33 Jack the Ripper
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67 Page 1
68
69
70
71
72 The Official Phreaker's Manual
73
74 Introduction
75
76 What precedes this introduction is what I have termed "The Official
77Phreakers Manual", while it may not be. Many times I have been on a BBS, which
78has files claiming to have summed up all the ways to phreak in the U.S. and
79abroad, well those were pretty lame and a couple pages long. Now after many
80relentless hours of work, I have done it. This is an informative file and the
81authors of this and the authors from which I have gathered information, take
82absolutely NO responsibility and are not liable for, under any circumstances
83for damage, direct, indirect, incidental, or consequential.
84
85 Warning: Use of this material may shorten your life in the free world!
86
87 Ok enough of the bullshit, I readily admit that this is mainly a compilation
88of available phreak material and public resources. What I have done is to
89gather it all together and edit, compile, check for errors, put in a readable
90form, and finally to write what I know without echoing what others have said.
91I have set this up that it is good for all levels of phreaks, going from novice
92to advanced, and references and tables for easy reference in the back.
93 This manual is constantly being updated! If you have any contributions or
94corrections or comments, please leave messages to me (Jack the Ripper) on any
95BBS's I am on (probably where you got it). Thanks!
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133 Page 2
134
135
136
137
138 The Official Phreaker's Manual
139
140 **********************************************************************
141
142 Table of Contents
143
144 **********************************************************************
145
146
147I....... 005 Chapter 1
148I.1..... 006 Glossary of Phreaking terms
149I.2..... 010 Glossary of Phreaking terms cont.
150I.3..... 017 Boxes and Electronic Toll Fraud
151I.4..... 020 How to be a Real Phreak
152I.5..... 026 Basic Telecommunications I, A Phreaks guide
153
154II...... 031 Chapter 2
155II.1.... 033 Secrets of the Little Blue Box. Part 1
156II.2.... 041 Secrets of the Little Blue Box. Part 2
157II.3.... 050 Secrets of the Little Blue Box. Part 3
158II.4.... 058 Secrets of the Little Blue Box. Part 4
159II.5.... 062 The History of ESS
160II.6.... 064 History of British Phreaking
161II.7.... 067 Bad as Shit, an adventure story
162
163III..... 069 Chapter 3
164III.1... 070 Phreaking Cosmos
165III.2... 072 Cosmos Revamped
166III.3... 073 Telenet
167III.4... 075 Phreaking AT&T Cards
168III.5... 076 AT&T Forgery
169III.6... 078 Dealing with Operators
170III.7... 079 How to set up a Conference Call
171III.8... 081 Fone tapping
172III.9... 083 Fone tapping cont.
173III.10.. 085 Tracing, how dangerous is it
174III.11.. 086 How to avenge yourself
175III.12.. 088 Interesting things to do on Step lines
176III.13.. 089 Busted, An account of the Private Sector bust
177
178IV...... 092 Chapter 4
179IV.1.... 093 Basic Telecommunications II, Special #'s, Loops, Ani
180IV.2.... 101 Basic Telecommunications III, Direct Dialing, International
181IV.3.... 106 Basic Telecommunications IV, Telefone Hierarchy
182IV.4.... 113 Basic Telecommunications V, Subscriber fone electronics
183IV.5.... 120 Basic Telecommunications VI, Fortress fones
184
185V....... 123 Chapter 5
186V.1..... 124 Basic Telecommunications VII, Blue Boxing
187V.2..... 132 Better Homes & Blue Boxing, Part 1
188V.3..... 136 Better Homes & Blue Boxing, Part 2
189V.4..... 141 Better Homes & Blue Boxing, Part 3
190V.5..... 145 More on Blue Boxing by Fred Stienbeck
191V.6..... 146 Verification, Remob, etc., Is it possible?
192V.7..... 148 Equal Access and the American Dream, Another great article
193V.8..... 160 Equal access and Autodialing Modems
194V.9..... 161 ISDN, it will change telecommunications for ever
195V.10.... 163 ISDN, an article from Proto
196V.11.... 165 MCI Services what they are and how they are useful
197
198
199 Page 3
200
201
202
203
204 The Official Phreaker's Manual
205
206 **********************************************************************
207
208 Appendixes
209
210 **********************************************************************
211
212
213Appendix I...... 170 Reference tables and access lists
214Appendix I.1.... 171 Country Codes
215Appendix I.2.... 173 Country Codes cont.
216Appendix I.3.... 176 Country Codes cont.
217Appendix I.4.... 181 Max Access ports (Dialups)
218Appendix I.5.... 182 Metro Fone Access ports
219Appendix I.6.... 183 Area Codes
220Appendix I.7.... 185 Tac Dialups around the country
221Appendix I.8.... 193 Test numbers around the country
222Appendix I.9.... 196 What a TSPS operators console looks like
223
224Appendix II..... 197 Box plans
225Appendix II.1... 198 How to make an Infinity transmitter
226Appendix II.2... 203 How to make a silver box
227
228 204 Protection Page
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265 Page 4
266
267
268
269
270 The Official Phreaker's Manual
271
272 Chapter 1
273
274 Ok this chapter will cover the basic vocabulary of phreaking, it is a fairly
275long list, though not totally complete. After the vocab, will be some of the
276general rules for phreaking. Most of the rules are protection from the police
277and AT&T, but others are grammatical rules. These are not as important to your
278freedom, but many a phreak will think you are a twelve year old if you start
279talking like, "Hey dudz!^$(&, just got the latest warez! trade u for some
280soft/docs. Checkul8r". Well you get the point, here's your vocab list...
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331 Page 5
332
333
334
335
336 The Official Phreaker's Manual
337
338 ......................................................................
339 ......................................................................
340 . The Bell Glossary - ..
341 . by ..
342 . /X<X /X<X ..
343 . </X>X>ad </X>X>arvin ..
344 ......................................................................
345 ......................................................................
346
347ACD: Automatic Call Distributor - A system that automatically distributes calls
348to operator pools (providing services such as intercept and directory
349assistance), to airline ticket agents, etc.
350
351Administration: The tasks of record-keeping, monitoring, rearranging,
352prediction need for growth, etc.
353
354AIS: Automatic Intercept System - A system employing an audio-response unit
355under control of a processor to automatically provide pertinent info to callers
356routed to intercept.
357
358Alert: To indicate the existence of an incoming call, (ringing).
359
360ANI: Automatic Number Identification - Often pronounced "Annie," a facility for
361automatically identify the number of the calling party for charging purposes.
362
363Appearance: A connection upon a network terminal, as in "the line has two
364network appearances."
365
366Attend: The operation of monitoring a line or an incoming trunk for off-hook or
367seizure, respectively.
368
369Audible: The subdued "image" of ringing transmitted to the calling party during
370ringing; not derived from the actual ringing signal in later systems.
371
372Backbone Route: The route made up of final-group trunks between end offices in
373different regional center areas.
374
375BHC: Busy Hour Calls - The number of calls placed in the busy hour.
376
377Blocking: The ratio of unsuccessful to total attempts to use a facility;
378expresses as a probability when computed a priority.
379
380Blocking Network: A network that, under certain conditions, may be unable to
381form a transmission path from one end of the network to the other. In general,
382all networks used within the Bell Systems are of the blocking type.
383
384Blue Box: Equipment used fraudulently to synthesize signals, gaining access to
385the toll network for the placement of calls without charge.
386
387BORSCHT Circuit: A name for the line circuit in the central office. It
388functions as a mnemonic for the functions that must be performed by the
389circuit: Battery, Overvoltage, Ringing, Supervision, Coding, Hybrid, and
390Testing.
391
392Busy Signal: (Called-line-busy) An audible signal which, in the Bell System,
393comprises 480hz and 620hz interrupted at 60IPM.
394
395Bylink: A special high-speed means used in crossbar equipment for routing calls
396
397 Page 6
398
399
400
401
402 The Official Phreaker's Manual
403
404incoming from a step-by-step office. Trunks from such offices are often
405referred to as "bylink" trunks even when incoming to noncrossbar offices; they
406are more properly referred to as "dc incoming trunks." Such high-speed means
407are necessary to assure that the first incoming pulse is not lost.
408
409Cable Vault: The point which phone cable enters the Central Office building.
410
411CAMA: Centralized Automatic Message Accounting - Pronounced like Alabama.
412
413CCIS: Common Channel Interoffice Signaling - Signaling information for trunk
414connections over a separate, nonspeech data link rather that over the trunks
415themselves.
416
417CCITT: International Telegraph and Telephone Consultative Committee- An
418International committee that formulates plans and sets standards for
419intercountry communication means.
420
421CDO: Community Dial Office - A small usually rural office typically served by
422step-by-step equipment.
423
424CO: Central Office - Comprises a switching network and its control and support
425equipment. Occasionally improperly used to mean "office code."
426
427Centrex: A service comparable in features to PBX service but implemented with
428some (Centrex CU) or all (Centrex CO) of the control in the central office. In
429the later case, each station's loop connects to the central office.
430
431Customer Loop: The wire pair connecting a customer's station to the central
432office.
433
434DDD: Direct Distance Dialing - Dialing without operator assistance over the
435nationwide intertoll network.
436
437Direct Trunk Group: A trunk group that is a direct connection between a given
438originating and a given terminating office.
439
440EOTT: End Office Toll Trunking - Trunking between end offices in different toll
441center areas.
442
443ESB: Emergency Service Bureau - A centralized agency to which 911 "universal"
444emergency calls are routed.
445
446ESS: Electronic Switching System - A generic term used to identify as a class,
447stored-program switching systems such as the Bell System's No.1 No.2, No.3,
448No.4, or No.5.
449
450ETS: Electronic Translation Systems - An electronic replacement for the card
451translator in 4A Crossbar systems. Makes use of the SPC 1A Processor.
452
453False Start: An aborted dialing attempt.
454
455Fast Busy: (often called reorder) - An audible busy signal interrupted at twice
456the rate of the normal busy signal; sent to the originating station to indicate
457that the call blocked due to busy equipment.
458
459Final Trunk Group: The trunk group to which calls are routed when available
460high-usage trunks overflow; these groups generally "home" on an office next
461highest in the hierarchy.
462
463 Page 7
464
465
466
467
468 The Official Phreaker's Manual
469
470
471Full Group: A trunk group that does not permit rerouting off-contingent foreign
472traffic; there are seven such offices.
473
474Glare: The situation that occurs when a two-way trunk is seized more or less
475simultaneously at both ends.
476
477High Usage Trunk Group: The appellation for a trunk group that has alternate
478routes via other similar groups, and ultimately via a final trunk group to a
479higher ranking office.
480
481Intercept: The agency (usually an operator) to which calls are routed when made
482to a line recently removed from a service, or in some other category requiring
483another station, such as an Emergence Interrupt.
484
485Junctor: A wire or circuit connection between networks in the same office. The
486functional equivalent to an intraoffice trunk.
487
488MF: Multifrequency - The method of signaling over a trunk making use of the
489simultaneous application of two out of six possible frequencies.
490
491NPA: Numbering Plan Area.
492
493ONI: Operator Number Identification - The use of an operator in a CAMA office
494to verbally obtain the calling number of a call originating in an office not
495equipped with ANI.
496
497PBX: Private Branch Exchange - (PABX: Private Automatic Branch Exchange) An
498telephone office serving a private customer, Typically , access to the outside
499telephone network is provided.
500
501Permanent Signal: A sustained off-hook condition without activity (no dialing
502or ringing or completed connection); such a condition tends to tie up
503equipment, especially in earlier systems. Usually accidental, but sometimes
504used intentionally by customers in high-crime-rate areas to thwart off
505burglars.
506
507POTS: Plain Old Telephone Service - Basic service with no extra "frills".
508
509ROTL: Remote Office Test Line - A means for remotely testing trunks.
510
511RTA: Remote Trunk Arrangement - An extension to the TSPS system permitting its
512services to be provided up to 200 miles from the TSPS site.
513
514SF: Single Frequency. A signaling method for trunks: 2600hz is impressed upon
515idle trunks.
516
517Supervise: To monitor the status of a call.
518
519SxS: (Step-by-Step or Strowger switch) - An electromechanical office type
520utilizing a gross-motion stepping switch as a combination network and
521distributed control.
522
523Talkoff: The phenomenon of accidental synthesis of a machine-intelligible
524
525 Page 8
526
527
528
529
530 The Official Phreaker's Manual
531
532signal by human voice causing an unintended response. "whistling a tone".
533
534Trunk: A path between central offices; in general 2-wire for interlocal, 4-wire
535for intertoll.
536
537TSPS: Traffic Service Position System - A system that provides, under stored-
538program control, efficient operator assistance for toll calls. It does not
539switch the customer, but provides a bridge connection to the operator.
540
541X-bar: (Crossbar) - An electromechanical office type utilizing a "fine-motion"
542coordinate switch and a multiplicity of central controls (called markers).
543There are four varieties:
544 No.1 Crossbar: Used in large urban office application; (1938)
545 No 3 Crossbar: A small system started in (1974).
546 No.4A/4M Crossbar: A 4-wire toll machine; (1943).
547 No.5 Crossbar: A machine originally intended for relatively small
548suburban applications; (1948)
549 Crossbar Tandem: A machine used for interlocal office switching.
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591 Page 9
592
593
594
595
596 The Official Phreaker's Manual
597
598 ============================================================
599 _ _ _______
600 | X/ | / _____/
601 |_||_|etal / /hop
602 __________/ /
603 /___________/
604 (314) 432-0756
605
606 Proudly Presents
607
608 The MCI Telecommunications Glossary
609
610 Part I Volume I (A - D)
611
612 Typed by Knight Lightning
613
614 ============================================================
615
616- A -
617
618A & B LEADS: Designation of leads derived from the midpoints of the two 2-wire
619pairs comprising a 4-wire circuit.
620
621ABBREVIATED DIALING: The ability of a telephone user to reach frequently called
622numbers by using less than seven digits. Synonym: Speed Dialing
623
624ACCESS CHARGE: A fee paid for the use of local lines.
625
626ACCESS CODE: A digit or number of digits required to be connected to a private
627line arranged for dial access.
628
629ACCESS LINE: A telephone circuit which connects a customer location to a
630network switching center.
631
632AIRLINE MILEAGE: Calculated point-to-point mileage between terminal
633facilities.
634
635ALL TRUNKS BUSY (ATB): A single tone interrupted at a 120 ipm (impulses per
636minute) rate to indicate all lines or trunks in a routing group are busy.
637
638ALTERNATE ROUTE: A secondary communications path used to reach a destination if
639the primary path is unavailable.
640
641ALTERNATE USE: The ability to switch communications facilities from one type of
642service to another, i.e., voice to data, etc.
643
644ALTERNATE VOICE DATA (AVD): A single transmission facility which can be used
645for either voice or data.
646
647AMERICAN STANDARD CODE
648FOR INFORMATION INTERCHANGE
649(ASCII): An 8 level code developed for the interchange of information between
650data processing and communications systems.
651
652ANALOG SIGNAL: A signal in the form of a continuous varying physical quantity,
653e.g., voltage which reflects variations in some quantity, e.g., loudness in the
654human voice.
655
656
657 Page 10
658
659
660
661
662 The Official Phreaker's Manual
663
664ANNUNICATOR: An audible intercept device that states the condition or
665restrictions associated with circuits or procedures.
666
667ANSWER BACK: An electrical and/or visual indication to the calling or sending
668end that the called or received station is on the line.
669
670ANSWER SUPERVISION: An off-hook signal transmitted toward the calling end of a
671switched connection when the called party answers.
672
673AREA CODE: Synonym: Numbering Plan Area (NPA). A three digit number identifying
674more than 150 geographic areas of the United States and Canada which permits
675direct distance dialing on the telephone system. A similar global numbering
676plan has been established for international subscriber dialing.
677
678ATTENDANT POSITION: A telephone switchboard operator's position. It provides
679either automatic (cordless) or manual (plug and jack) operator controls for
680incoming and/or outgoing telephone calls.
681
682ATTENUATION: A general term used to denote the decrease in power between that
683transmitted and that received due to loss through equipment, lines, or other
684transmission devices. It is usually expressed as a ration in db (decibel).
685
686
687(B) ENTRANCE INTO THE DDD TOLL NETWORK MAY BE EFFECTED BY A PRETEXT CALL TO ANY
688OTHER TOLL-FREE # SUCH AS UNIVERSAL DIRECTORY ASSISTANCE (555-1212) OR ANY # IN
689THE INWATS NETWORK, EITHER INTER-STATE OR INTRA-STATE, WORKING OR NON-WORKING.
690
691(C) ENTRANCE INTO THE DDD TOLL NETWORK MAY ALSO BE IN THE FORM OF "SHORT HAUL"
692CALLING. A "SHORT HAUL" CALL IS A CALL TO ANY # WHICH WILL RESULT IN A LESSER
693AMOUNT OF TOLL CHARGES THAN THE CHARGES FOR THE CALL TO BE COMPLETED BY THE
694BLUE BOX. FOR EXAMPLE, A CALL TO BIRMINGHAM FROM ATLANTA MAY COST $.80 FOR THE
695FIRST 3 MINUTES WHILE A CALL FROM ATLANTA TO LOS ANGELES IS $1.85 FOR 3
696MINUTES. THUS, A SHORT HAUL, 3-MINUTE CALL TO BIRMINGHAM FROM ATLANTA, SWITCHED
697BY USE OF A BLUE BOX TO LOS ANGELES, WOULD RESULT IN A NET FRAUD OF $2.65 FOR A
6983 MINUTE CALL.
699
700(D) A BLUE BOX MAY BE WIRED INTO THE TELEPHONE LINE OR ACOUSTICALLY CONNECTED
701TO THE HANDSET. THE BLUE BOX MAY EVEN BE BUILT INSIDE A REGULAR TOUCH-TONE
702PHONE, USING THE PHONE'S PUSH BUTTONS FOR THE BLUE BOX'S SIGNALLING TONES.
703
704(E) A MAGNETIC TAPE RECORDING MAY BE USED TO RECORD THE BLUE BOX TONES
705REPRESENTATIVE OF SPECIFIC PHONE #'S. SUCH A TAPE RECORDING COULD BE USED IN
706LIEU OF
707A BLUE BOX TO FRAUDULENTLY PLACE CALLS TO THE PHONE #'S RECORDED ON THE
708MAGNETIC TAPE.
709
710 ALL BLUE BOXES, EXCEPT "DIAL PULSE" OR "ROTARY SF" BLUE BOXES, MUST HAVE
711THE FOLLOWING 4 COMMON OPERATING CAPABILITIES:
712
713(A) IT MUST HAVE SIGNALLING CAPABILITY IN THE FORM OF A 2600HZ TONE. THE TONE
714IS USED BY THE TOLL NETWORK TO INDICATE, EITHER BY ITS PRESENCE OR ITS ABSENCE,
715AN "ON HOOK" (IDLE) OR "OFF HOOK" (BUSY) CONDITION OF THE TRUNK.
716
717(B) THE BLUE BOX MUST HAVE A "KP" TONES THAT UNLOCKS OR READIES THE
718MULTI-FREQUENCY RECEIVER AT THE CALLED END TO RECEIVE THE TONES CORRESPONDING
719TO THE CALLED PHONE #.
720
721 Page 18
722
723
724
725
726 The Official Phreaker's Manual
727
728
729(C) THE TYPICAL BLUE BOX MUST BE ABLE TO EMIT MF TONES WHICH ARE USED TO
730TRANSMIT PHONE #'S OVER THE TOLL NETWORK. EACH DIGIT OF A PHONE # IS
731REPRESENTED BY A COMBINATION OF 2 TONES. FOR EXAMPLE, THE DIGIT 2 IS X-MITTED
732BY A COMBINATION OF 700HZ AND 1100HZ.
733
734(D) THE BLUE BOX MUST HAVE AN "ST" KEY WHICH CONSISTS OF A COMBINATION OF 2
735TONES THAT TELL THE EQUIPMENT AT THE CALLED END THAT ALL DIGITS HAVE BEEN SENT
736AND THAT THE EQUIPMENT SHOULD START SWITCHING THE CALL TO THE CALLED NUMBER.
737
738 THE "DIAL PULSER" OR "ROTARY SF" BLUE BOX REQUIRES ONLY A DIAL WITH A
739SIGNALLING CAPABILITY TO PRODUCE A 2600HZ TONE.
740
741*BLACK BOX*
742-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
743
744 THIS ETF DEVICE IS SO-NAMED BECAUSE OF THE COLOR OF THE FIRST ONE FOUND.
745IT VARIES IN SIZE AND USUALLY HAS ONE OR TWO SWITCHES OR BUTTONS. ATTACHED TO
746THE TELEPHONE LINE OF A CALLED PARTY, THE BLACK BOX PROVIDES TOLL-FREE CALLING
747*TO* THAT PARTY'S LINE. A BLACK BOX USER INFORMS OTHER PERSONS BEFOREHAND THAT
748THEY WILL NOT BE CHARGED FOR ANY CALL PLACED TO HIM. THE USER THEN OPERATES THE
749DEVICE CAUSING A "NON-CHARGE" CONDITION ("NO ANSWER" OR "DISCONNECT") TO BE
750RECORDED ON THE TELEPHONE COMPANY'S BILLING EQUIPMENT. A BLACK BOX IS
751RELATIVELY SIMPLE TO CONSTRUCT AND IS MUCH LESS SOPHISTICATED THAN A BLUE BOX.
752
753*CHEESE BOX*
754-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
755
756 ITS DESIGN MAY BE CRUDE OR VERY SOPHISTICATED. ITS SIZE VARIES; ONE WAS FOUND
757THE SIZE OF A HALF-DOLLAR. A CHEESE BOX IS USED MOST OFTEN BY BOOKMAKERS OR
758BETTERS TO PLACE WAGERS WITHOUT DETECTION FROM A REMOTE LOCATION. THE DEVICE
759INTER-CONNECTS 2 PHONE LINES, EACH HAVING DIFFERENT #'S BUT EACH TERMINATING AT
760THE SAME LOCATION. IN EFFECT, THERE ARE 2 PHONES AT THE SAME LOCATION WHICH ARE
761LINKED TOGETHER THROUGH A CHEESE BOX. IT IS USUALLY FOUND IN AN UNOCCUPIED
762APARTMENT CONNECTED TO A PHONE JACK OR CONNECTING BLOCK. THE BOOKMAKER, AT SOME
763REMOTE LOCATION, DIALS ONE OF THE NUMBERS AND STAYS ON THE LINE. VARIOUS
764BETTORS DIAL THE OTHER NUMBER BUT ARE AUTOMATICALLY CONNECTED WITH THE
765BOOKMAKER BY MEANS OF THE CHEESE BOX INTER-CONNECTION. IF, IN ADDITION TO A
766CHEESE BOX, A BLACK BOX IS INCLUDED IN THE ARRANGEMENT, THE COMBINED EQUIPMENT
767WOULD PERMIT TOLL-FREE CALLING ON EITHER LINE TO THE OTHER LINE. IF A POLICE
768RAID WERE CONDUCTED AT THE TERMINATING POINT OF THE CONVERSATIONS -THE LOCATION
769OF THE CHEESE BOX- THERE WOULD BE NO EVIDENCE OF GAMBLING ACTIVITY. THIS DEVICE
770IS SOMETIMES DIFFICULT TO IDENTIFY. LAW ENFORCEMENT OFFICIALS HAVE BEEN ADVISED
771THAT WHEN UNUSUAL DEVICES ARE FOUND ASSOCIATED WITH TELEPHONE CONNECTIONS THE
772PHONE COMPANY SECURITY REPRESENTATIVES SHOULD BE CONTACTED TO ASSIST IN
773IDENTIFICATION. (THIS PROBABLY WOULD BE GOOD FOR A BBS , ESPECIALLY WITH THE
774BLACK BOX SET UP. AND IF YOU EVER DECIDED TO TAKE THE BOARD DOWN, YOU WOULDN'T
775HAVE TO CHANGE YOUR PHONE #. IT ALSO MAKES IT SO YOU YOURSELF CANNOT BE TRACED.
776I AM NOT SURE ABOUT CALLING OUT FROM ONE THOUGH)
777
778*RED BOX*
779-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
780
781 THIS DEVICE IT COUPLED ACOUSTICALLY TO THE HANDSET TRANSMITTER OF A
782SINGLE-SLOT COIN TELEPHONE. THE DEVICE EMITS SIGNALS IDENTICAL TO THOSE TONES
783EMITTED WHEN COINS ARE DEPOSITED. THUS, LOCAL OR TOLL CALLS MAY BE PLACED
784WITHOUT THE ACTUAL DEPOSIT OF COINS.
785
786
787 Page 19
788
789
790
791
792 The Official Phreaker's Manual
793
794 /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/
795 /-/ /-/
796 /-/ Phreaker's /-/
797 /-/ PhunHouse /-/
798 /-/ /-/
799 /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/
800 /-/ By: /-/
801 /-/ The Traveler /-/
802 /-/ /-/
803 /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/
804 /-/ /-/
805 /-/ Call: /-/
806 /-/ Brainstorm BBS /-/
807 /-/ 612/345-2815 (300/1200) /-/
808 /-/ /-/
809 /-/ Little America /-/
810 /-/ 507/289-8211 (300) /-/
811 /-/ /-/
812 /-/ Tell 'em Traveler sent ya /-/
813 /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/
814
815 The long awaited prequil to Phreaker's Guide has finally arrived. Conceived
816from the boredom and loneliness that could only be derived from: The Traveler!
817But now, he has returned in full strength (after a small vacation) and is here
818to 'World Premiere' the new files everywhere.
819 Stay cool. This is the prequil to the first one, so just relax. This is not
820made to be an exclusive ultra elite file, so kinda calm down and watch in the
821background if you are too cool for it...
822
823/-/ Phreak Dictionary /-/
824
825 Here you will find some of the basic but necessary terms that should be known
826by any phreak who wants to be respected at all...
827
828 Phreak [fr'eek]:1. The action of using mischevious and mostly illegal ways
829in order to not pay for some sort of telecommunications bill, order, transfer,
830or other service. It often involves usage of highly illegal boxes and machines
831in order to defeat the security that is set up to avoid this sort of
832happening.
833 [fr'eaking]. v. 2. A person who uses the above methods of destruction and
834chaos in order to make a better life for all. A true phreaker will not not go
835against his fellows or narc on people who have ragged on him or do anything
836termed to be dishonorable to phreaks.
837 [fr'eek]. n. 3. A certain code or dialup useful in the action of being a
838phreak. (Example: "I hacked a new metro phreak last night.")
839
840 Switching System
841 [Swich'ing sis'tem]: 1. There are 3 main switching systems currently employed
842in the US, and a few other systems will be mentioned as background.
843A) SxS: This system was invented in 1918 and was employed in over half of the
844country until 1978. It is a very basic system that is a general waste of energy
845and hard work on the linesman. A good way to identify this is that it requires
846a coin in the phone booth before it will give you a dial tone, or that no call
847waiting, call forwarding, or any other such service is available. Stands for:
848Step by Step
849
850B) XB: This switching system was first employed in 1978 in order to take care
851of most of the faults of SxS switching. Not only is it more efficient, but it
852
853 Page 20
854
855
856
857
858 The Official Phreaker's Manual
859
860also can support different services in various forms. XB1 is Crossbar Version
8611. That is very limited and is hard to distinguish from SxS except by direct
862view of the wiring involved. Next up was XB4, Crossbar Version 4. With this
863system, some of the basic things like DTMF that were not available with SxS can
864be accomplished. For the final stroke of XB, XB5 was created. This is a service
865that can allow DTMF plus most 800 type services (which were not always
866available...) Stands for: Crossbar.
867C) ESS: A nightmare in telecom. In vivid color, ESS is a pretty bad thing to
868have to stand up to. It is quite simple to identify. Dialing 911 for
869emergencies, and ANI [see ANI below] are the most common facets of the dread
870system. ESS has the capability to list in a person's caller log what number was
871called, how long the call took, and even the status of the conversation (modem
872or otherwise.) Since ESS has been employed, which has been very recently, it
873has gone through many kinds of revisions. The latest system to date is ESS 11a,
874that is employed in Washington D.C. for security reasons. ESS is truly trouble
875for any phreak, because it is 'smarter' than the other systems. For instance,
876if on your caller log they saw 50 calls to 1-800-421-9438, they would be able
877to do a CN/A [see Loopholes below] on your number and determine whether you are
878subscribed to that service or not. This makes most calls a hazard, because
879although 800 numbers appear to be free, they are recorded on your caller log
880and then right before you receive your bill it deletes the billings for them.
881But before that they are open to inspection, which is one reason why extended
882use of any code is dangerous under ESS. Some of the boxes [see Boxing below]
883are unable to function in ESS. It is generally a menace to the true phreak.
884Stands For: Electronic Switching System. because they could appear on a filter
885somewhere or maybe it is just nice to know them any ways.
886 A) SSS: Strowger Switching System. First non-operator system
887available.
888 B) WES: Western Electronics Switching. Used about 40 years ago
889with some minor places out west.
890 Boxing [Boks'-ing]: 1) The use of personally designed boxes that emit or
891cancel electronical impulses that allow simpler acting while phreaking. Through
892the use of separate boxes, you can accomplish most feats possible with or
893without the control of an operator.
894 2) Some boxes and their functions are listed below. Ones
895marked with '*' indicate that they are not operatable in ESS.
896 *Black Box: Makes it seem to the phone company that the phone was never
897picked up.
898
899 Blue Box: Emits a 2600hz tone that allows you to do such things as stack
900a trunk line, kick the operator off line, and others.
901
902 Red Box: Simulates the noise of a quarter, nickel, or dime being
903dropped into a payphone.
904
905 Cheese Box: Turns your home phone into a pay phone to throw off traces (a
906red box is usually needed in order to call out.)
907
908 *Clear Box: Gives you a dial tone on some of the old SxS payphones without
909putting in a coin.
910
911into phone lines and extract by eavesdropping, or crossing wires, etc.
912 Purple Box: Makes all calls made out from your house seem to be local
913calls.
914 ANI [ANI]: 1) Automatic Number Identification. A service available on ESS
915that allows a phone service [see Dialups below] to record the number that any
916certain code was dialed from along with the number that was called and print
917
918 Page 21
919
920
921
922
923 The Official Phreaker's Manual
924
925both of these on the customer bill. 950 dialups [see Dialups below] are all
926designed just to use ANI. Some of the services do not have the proper equipment
927to read the ANI impulses yet, but it is impossible to see which is which
928without being busted or not busted first.
929 Dialups
930 [dy'l'ups]: 1) Any local or 800 extended outlet that allows instant access to
931any service such as MCI, Sprint, or AT&T that from there can be used by
932handpicking or using a program to reveal other peoples codes which can then be
933used moderately until they find out about it and you must switch to another
934code (preferably before they find out about it.)
935 2) Dialups are extremely common on both senses. Some dialups
936reveal the company that operates them as soon as you hear the tone. Others are
937much harder and some you may never be able to identify. A small list of
938dialups:
939 1-800-421-9438 (5 digit codes)
940 1-800-547-6754 (6 digit codes)
941 1-800-345-0008 (6 digit codes)
942 1-800-734-3478 (6 digit codes)
943 1-800-222-2255 (5 digit codes)
944 3) Codes: Codes are very easily accessed procedures when you call
945a dialup. They will give you some sort of tone. If the tone does not end in 3
946seconds, then punch in the code and immediately following the code, the number
947you are dialing but strike the '1' in the beginning out first. If the tone does
948end, then punch in the code when the tone ends. Then, it will give you another
949tone. Punch in the number you are dialing, or a '9'. If you punch in a '9' and
950the tone stops, then you messed up a little. If you punch in a tone and the
951tone continues, then simply dial then number you are calling without the '1'.
952 4) All codes are not universal. The only type that I know of that
953is truly universal is Metrophone. Almost every major city has a local Metro
954dialup (for Philadelphia, (215)351-0100/0126) and since the codes are
955universal, almost every phreak has used them once or twice. They do not employ
956ANI in any outlets that I know of, so feel free to check through your books and
957call 555-1212 or, as a more devious manor, subscribe yourself. Then, never use
958your own code. That way, if they check up on you due to your caller log, they
959can usually find out that you are subscribed. Not only that but you could set a
960phreak hacker around that area and just let it hack away, since they usually
961group them, and, as a bonus, you will have their local dialup.
962 5) 950's. They seem like a perfectly cool phreakers dream. They
963are free from your house, from payphones, from everywhere, and they host all of
964the major long distance companies (950-1044 <MCI>, 950-1077 <Sprint>, 950-1088
965<Skylines>, 950-1033 <Us Telecom>.) Well, they aren't. They were designed for
966ANI. That is the point, end of discussion.
967
968 A phreak dictionary. If you remember all of the things contained on that file
969up there, you may have a better chance of doing whatever it is you do. This
970next section is maybe a little more interesting...
971
972Blue Box Plans:
973---------------
974
975 These are some blue box plans, but first, be warned, there have been 2600hz
976tone detectors out on operator trunk lines since XB4. The idea behind it is to
977use a 2600hz tone for a few very naughty functions that can really make your
978day lighten up. But first, here are the plans, or the heart of the file:
979
980==============================================
981700 : 1 : 2 : 4 : 7 : 11 :
982900 : + : 3 : 5 : 8 : 12 :
983
984 Page 22
985
986
987
988
989 The Official Phreaker's Manual
990
9911100 : + : + : 6 : 9 : KP :
9921300 : + : + : + : 10 : KP2 :
9931500 : + : + : + : + : ST :
994 : 700 : 900 :1100 :1300 :1500 :
995==============================================
996
997 Stop! Before you diehard users start piecing those little tone tidbits
998together, there is a simpler method. If you have an Apple-Cat with a program
999like Cat's Meow IV, then you can generate the necessary tones, the 2600hz tone,
1000the KP tone, the KP2 tone, and the ST tone through the dial section. So if you
1001have that I will assume you can boot it up and it works, and I'll do you the
1002favor of telling you and the other users what to do with the blue box now that
1003you have somehow constructed it.
1004 The connection to an operator is one of the most well known and used ways of
1005having fun with your blue box. You simply dial a TSPS (Traffic Service
1006Positioning Station, or the operator you get when you dial '0') and blow a
10072600hz tone through the line. Watch out! Do not dial this direct! After you
1008have done that, it is quite simple to have fun with it. Blow a KP tone to start
1009a call, a ST tone to stop it, and a 2600hz tone to hang up. Once you have
1010connected to it, here are some fun numbers to call with it:
1011
10120-700-456-1000 Teleconference (free, because you are the operator!)
1013(Area code)-101 Toll Switching
1014(Area code)-121 Local Operator (hehe)
1015(Area code)-131 Information
1016(Area code)-141 Rate & Route
1017(Area code)-181 Coin Refund Operator
1018(Area code)-11511 Conference operator (when you dial 800-544-6363)
1019
1020 Well, those were the tone matrix controllers for the blue box and some other
1021helpful stuff to help you to start out with. But those are only the functions
1022with the operator. There are other k-fun things you can do with it...
1023 More advanced Blue Box Stuff:
1024 Oops. Small mistake up there. I forgot tone lengths. Um, you blow a tone
1025pair out for up to 1/10 of a second with another 1/10 second for silence
1026between the digits. KP tones should be sent for 2/10 of a second. One way to
1027confuse the 2600hz traps is to send pink noise over the channel (for all of you
1028that have decent BSR equalizers, there is major pink noise in there...)
1029Using the operator functions is the use of the 'inward' trunk line. That is
1030working it from the inside. From the 'outward' trunk, you can do such things as
1031make emergency breakthrough calls, tap into lines, busy all of the lines in any
1032trunk (called 'stacking'), enable or disable the TSPS's, and for some 4a
1033systems you can even re-route calls to anywhere.
1034
1035 All right. The one thing that every complete phreak guide should not be
1036without is blue box plans, since they were once a vital part of phreaking.
1037Another thing that every complete file needs is a complete listing of all of
1038the 800 numbers around so you can have some more fun.
1039
1040/-/ 800 Dialup Listings /-/
1041
10421-800-345-0008 (6) 1-800-547-6754 (6)
10431-800-245-4890 (4) 1-800-327-9136 (4)
10441-800-526-5305 (8) 1-800-858-9000 (3)
10451-800-437-9895 (7) 1-800-245-7508 (5)
10461-800-343-1844 (4) 1-800-322-1415 (6)
10471-800-437-3478 (6) 1-800-325-7222 (6)
1048
1049
1050 Page 23
1051
1052
1053
1054
1055 The Official Phreaker's Manual
1056
1057 All right, set Cat Hacker 1.0 on those numbers and have a fuck of a day. That
1058is enough with 800 codes, by the time this gets around to you I dunno what
1059state those codes will be in, but try them all out anyways and see what you
1060get. On some 800 services now, they have an operator who will answer and ask
1061you for your code, and then your name. Some will switch back and forth between
1062voice and tone verification, you can never be quite sure which you will be up
1063against.
1064 Armed with this knowledge you should be having a pretty good time phreaking
1065now. But class isn't over yet, there are still a couple important rules that
1066you should know. If you hear continual clicking on the line, then you should
1067assume that an operator is messing with something, maybe even listening in on
1068you. It is a good idea to call someone back when the phone starts doing that.
1069If you were using a code, use a different code and/or service to call him
1070back.
1071 A good way to detect if a code has gone bad or not is to listen when the
1072number has been dialed. If the code is bad you will probably hear the phone
1073ringing more clearly and more quickly than if you were using a different code.
1074If someone answers voice to it then you can immediately assume that it is an
1075operative for whatever company you are using. The famed '311311' code for Metro
1076is one of those. You would have to be quite stupid to actually respond, because
1077whoever you ask for the operator will always say 'He's not in right now, can I
1078have him call you back?' and then they will ask for your name and phone number.
1079Some of the more sophisticated companies will actually give you a carrier on a
1080line that is supposed to give you a carrier and then just have garbage flow
1081across the screen like it would with a bad connection. That is a feeble effort
1082to make you think that the code is still working and maybe get you to dial
1083someone's voice... a good test for the carrier trick is to dial a number that
1084will give you a carrier that you have never dialed with that code before, that
1085will allow you to determine whether the code is good or not.
1086 For our next section, a lighter look at some of the things that a phreak
1087should not be without. A vocabulary. A few months ago, it was a quite strange
1088world for the modem people out there. But now, a phreaker's vocabulary is
1089essential if you wanna make a good impression on people when you post what you
1090know about certain subjects.
1091
1092/-/ Vocabulary /-/
1093
1094 - Do not misspell except certain exceptions:
1095 phone -> fone
1096 freak -> phreak
1097 - Never substitute 'z's for 's's. (i.e. codez -> codes)
1098 - Never leave many characters after a post (i.e. Hey Dudes!#!@#@!#!@)
1099 - NEVER use the 'k' prefix (k-kool, k-rad, k-whatever)
1100 - Do not abbreviate. (I got lotsa wares w/ docs)
1101 - Never substitute '0' for 'o' (r0dent, l0zer).
1102 - Forget about ye old upper case, it looks ruggyish.
1103
1104 All right, that was to relieve the tension of what is being drilled into your
1105minds at the moment.. now, however, back to the teaching course. Here are some
1106things you should know about phones and billings for phones, etc.
1107
1108 LATA: Local Access Transference Area. Some people who live in large cities or
1109areas may be plagued by this problem. For instance, let's say you live in the
1110215 area code under the 542 prefix (Ambler, Fort Washington). If you went to
1111dial in a basic Metro code from that area, for instance, 351-0100, that might
1112not be counted under unlimited local calling because it is out of your LATA.
1113For some LATA's, you have to dial a '1' without the area code before you can
1114dial the phone number. That could prove a hassle for us all if you didn't
1115
1116 Page 24
1117
1118
1119
1120
1121 The Official Phreaker's Manual
1122
1123realize you would be billed for that sort of call. In that way, sometimes, it
1124is better to be safe than sorry and phreak.
1125 The Caller Log: In ESS regions, for every household around, the phone company
1126has something on you called a Caller Log. This shows every single number that
1127you dialed, and things can be arranged so it showed every number that was
1128calling to you. That's one main disadvantage of ESS, it is mostly computerized
1129so a number scan could be done like that quite easily. Using a dialup is an
1130easy way to screw that, and is something worth remembering. Anyways, with the
1131caller log, they check up and see what you dialed. Hmm... you dialed 15
1132different 800 numbers that month. Soon they find that you are subscribed to
1133none of those companies. But that is not the only thing. Most people would
1134imagine "But wait! 800 numbers don't show up on my phone bill!". To those
1135people, it is a nice thought, but 800 numbers are picked up on the caller log
1136until right before they are sent off to you. So they can check right up on you
1137before they send it away and can note the fact that you fucked up slightly and
1138called one too many 800 lines.
1139
1140Right now, after all of that, you should have a pretty good idea of how to grow
1141up as a good phreak. Follow these guidelines, don't show off, and don't take
1142unnecessary risks when phreaking or hacking.
1143
1144File Level:5
1145
1146 /-/ Credits /-/
1147
1148 To The Videosmith- for setting me straight on some shit.
1149 To The Linesman- for telling me to upload it to his AE line.
1150 To Modern Mutant- for making me into a phreaking freak.
1151 To Jack the Nibbler- for the basis of the blue box plans.
1152
1153 By using your new k-koool (hehe) phreaking knowledge, call a couple of these
1154BBS's around the country:
1155
1156 /---------------------------------X
1157 | Bulletin Board List |
1158 | --------------------- |
1159 | 215/844-8836 |
1160 | 7 Cities of Gold (3/12) 10megs |
1161 | 307/382-4006 |
1162 | Brainstorm BBS (3/12) |
1163 | 612/345-2815 |
1164 | Metal Shop (3/12) |
1165 | 314/432-0756 |
1166 X---------------------------------/
1167
1168 Stay free! And watch out soon for Deep Thought, somewhere in 215, that will be
1169a nice BBS that Ace of Spades and I will run. You will be the first to find out
1170about it, trust me...
1171
1172Later,
1173
1174The Traveler
1175Zer0-g
1176
1177
1178
1179
1180
1181
1182 Page 25
1183
1184
1185
1186
1187 The Official Phreaker's Manual
1188
1189 ************ << BIOC AGENT 003'S COURSE IN >> ************
1190 * *
1191 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
1192 * %$ BASIC TELECOMMUNICATIONS $% *
1193 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
1194 * PART I *
1195 * *
1196 **********************************************************
1197
1198
1199HOW TO BE A REAL PHREAK
1200<><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1201
1202 IN THE PHONE PHREAK SOCIETY THERE ARE CERTAIN VALUES THAT EXIST IN ORDER TO
1203BE A TRUE PHREAK, THESE ARE BEST SUMMED UP BY THE MAGICIAN:
1204
1205 "MANY PEOPLE THINK OF PHONE PHREAKS AS SLIME, OUT TO RIP OFF BELL FOR
1206ALL SHE IS WORTH. NOTHING COULD BE FURTHER FROM THE TRUTH! GRANTED, THERE ARE
1207SOME WHO GET THEIR KICKS BY MAKING FREE CALLS; HOWEVER, THEY ARE NOT TRUE PHONE
1208PHREAKS. REAL PHONE PHREAKS ARE 'TELECOMMUNICATIONS HOBBYISTS' WHO EXPERIMENT,
1209PLAY WITH AND LEARN FROM THE PHONE SYSTEM. OCCASIONALLY THIS EXPERIMENTING, AND
1210A NEED TO COMMUNICATE WITH OTHER PHREAKS ( WITH-OUT GOING BROKE), LEADS TO FREE
1211CALLS. THE FREE CALLS ARE BUT A SMALL SUBSET OF A TRUE PHONE PHREAKS
1212ACTIVITIES."
1213
1214THE PHONE PHREAK'S TEN COMMANDMENTS
1215<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1216
1217REPRINTED FROM TAP ISSUE #86. (TAP, ROOM 603, 147 W 42 STREET, NEW YORK, NY
121810036) SEND A SASE FOR THEIR INFO SHEET AND TELL THEM THAT BIOC AGENT 003 TOLD
1219YOU ABOUT IT.)
1220
1221
1222I. BOX THOU NOT OVER THINE HOME TELEPHONE WIRES, FOR THOSE WHO DOEST MUST
1223SURELY BRING THE WRATH OF THE CHIEF SPECIAL AGENT DOWN UPON THY HEADS.
1224
1225II. SPEAKEST THOU NOT OF IMPORTANT MATTERS OVER THINE HOME TELEPHONE WIRES,
1226FOR TO DO SO IS TO RISK THINE RIGHT OF FREEDOM.
1227
1228III. USE NOT THINE OWN NAME WHEN SPEAKING TO OTHER PHREAKS, FOR THAT EVERY
1229THIRD PHREAK IS AN FBI AGENT IS WELL KNOWN.
1230
1231IV. LET NOT OVERLY MANY PEOPLE KNOW THAT THY BE A PHREAK, AS TO DO SO IS TO
1232USE THINE OWN SELF AS A SACRIFICIAL LAMB.
1233
1234V. IF THOU BE IN SCHOOL, STRIVE TO GET THIN SELF GOOD GRADES, FOR THE
1235AUTHORITIES WELL KNOW THAT SCHOLARS NEVER BREAK THE LAW.
1236
1237VI. IF THOU WORKEST, TRY TO BE A EMPLOYEE, AND IMPRESSEST THINE BOSS WITH
1238THINE ENTHUSIASM, FOR IMPORTANT EMPLOYEES ARE OFTEN SAVED BY THEIR OWN BOSSES.
1239
1240VII. STOREST THOU NOT THINE STOLEN GOODS IN THINE OWN HOME, FOR THOSE WHO DO
1241ARE SURELY NON-BELIEVERS IN THE BELL SYSTEM SECURITY FORCES, AND ARE NOT LONG
1242FOR THIS WORLD.
1243
1244VIII. ATTRACTEST THOU NOT THE ATTENTION OF THE AUTHORITIES, AS THE LESS
1245NOTICEABLE THOU ART, THE BETTER.
1246
1247
1248 Page 26
1249
1250
1251
1252
1253 The Official Phreaker's Manual
1254
1255IX. MAKEST SURE THINE FRIENDS ARE INSTANT AMNESIACS AND WILL NOT REMEMBER
1256THAT THOU HAVE CALLED ILLEGALLY, FOR THEIR COOPERATION WITH THE AUTHORITIES
1257WILL SURELY LESSEN THINE TIME FOR FREEDOM ON THIS EARTH.
1258
1259X. SUPPORTEST THOU TAP, AS IT IS THINE NEWSLETTER, AND WITHOUT IT, THY WORK
1260WILL BE FAR MORE LIMITED.
1261
1262CN/A NUMBERS
1263<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1264
1265 CUSTOMER NAME & ADDRESS BUREAUS EXIST SO THAT AUTHORIZED BELL EMPLOYEES MAY
1266OBTAIN THE NAME & ADDRESS OF ANY CUSTOMER IN THE BELL SYSTEM BY GIVING THE CN/A
1267OPERATOR THE CUSTOMER'S TEL-#. ALL CUSTOMERS ARE MAINTAINED ON FILE INCLUDING
1268UNLISTED #'S. THESE BUREAUS HAVE MANY USES FOR PHREAKS.
1269 HERE IS HOW AN EMPLOYEE MIGHT GO ABOUT CALLING CN/A:
1270"HI, THIS IS JOHN DOE FROM THE MIAMI RESIDENTIAL SERVICE CENTER, CAN I HAVE THE
1271CUSTOMERS NAME AT (123) 555-1212."
1272
1273 THE EMPLOYEES USUALLY USE THESE FOR CHECKING WHO BELONGS TO A # THAT
1274SOMEONE CLAIMED THEY DIDN'T CALL.IF YOU SOUND CHEERY AND NATURAL THE OPERATOR
1275WILL NEVER ASK ANY QUESTIONS. IF YOU DON'T SOUND LIKE A MATURE ADULT, DON'T USE
1276IT! ALWAYS PRACTICE FIRST & SO YOU DON'T SCREW UP AND MAKE THE OPERATOR
1277SUSPICIOUS. USE NAME THAT SOUNDS REAL, NOT YOUR PIRATE NAME EITHER! ALSO SAY
1278THAT YOU ARE FRO A CITY THAT IS FAR AWAY FROM THE ONE THAT YOU ARE CALLING.
1279
1280 THE CN/A NUMBER FOR THE NY AREA & VICINITY (212, 315, 516, 518, 607, 716, &
1281914), IS 518/471-8111, AND IS OPEN DURING BUSINESS HOURS. DON'T ABUSE
1282IT!!!!!!!
1283
1284AT&T NEWSLINES
1285<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1286
1287 AT&T NEWSLINES ARE NUMBERS AT AREA PHONE OFFICES THAT TELCO EMPLOYEES CALL
1288TO FIND OUT THE LATEST INFO ON NEW TECHNOLOGY, STOCKS, ETC. THE RECORDED
1289REPORTS RANGE FROM VERY BORING TO VERY INTERESTING.
1290
1291HERE ARE A FEW OF THE NUMBERS:
1292
1293 *(201) 483-3800 NJ (518) 471-2272 NY
1294 (203) 771-4920 CN (717) 255-5555 PA
1295 (212) 393-2151 NY (717) 787-1031 PA
1296 (516) 234-9941 NY *(914) 948-8100 NY
1297
1298 SOME OF THESE NUMBERS ARE TOLL-FREE, BUT YOU CAN'T ALWAYS COUNT ON IT.
1299
1300* THESE NUMBERS ARE NOT ALWAYS UP!
1301
1302NUMBERS FROM OTHER AREAS ARE AVAILABLE BY REQUEST FROM F)BIOC L)AGENT 003.
1303
1304ANI NUMBERS
1305<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1306
1307 ANI NUMBERS IDENTIFY THE PHONE NUMBER THAT YOU ARE CALLING FROM. IT IS
1308USEFUL WHEN PLAYING IN CANS (THOSE BIG SILVER BOXES ON TELEPHONE POLES) TO FIND
1309OUT THE # OF THE LINE. IT IS ALSO GOOD TO FIND OUT THE # OF A PHONE THAT
1310DOESN'T HAVE IT PRINTED ON IT. IN THE 914 AREA CODE THE ANI # IS 990. IF YOU
1311JUST HAVE TO DIAL THE LAST 4 DIGITS FOR A LOCAL #, IE CONGERS (268), DIAL
13121-990-1111, WHERE 1111 ARE DUMMY DIGITS THERE IS ALSO A LESS USEFUL TYPE OF
1313
1314 Page 27
1315
1316
1317
1318
1319 The Official Phreaker's Manual
1320
1321ANI# WHICH WILL IDENTIFY THE AREA CODE & EXCHANGE. IT IS NXX-9901, WHERE 'NXX'
1322IS THE EXCHANGE. IN THE 212 & 516 AREA CODES THE ANI # IS 958.
1323
1324PHREAK NEWSLETTER
1325<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1326
1327 TAP IS THE "OFFICIAL" PHONE PHREAK NEWSLETTER, AND HAS EXISTED SINCE 1971.
1328EACH 4 PAGE ISSUE IS CRAMMED FULL OF INFORMATION ON PHONE PHREAKING, COMPUTER
1329PHREAKING, FREE GAS, FREE ELECTRICITY, FREE POSTAGE, BREAKING & ENTERING INFO,
1330ETC. IT IS LARGELY PHONE PHREAK ORIENTED, HOWEVER.
1331
1332 A 10 ISSUE SUBSCRIPTION COSTS $8.00, IF YOU GET A BULK RATE SEALED ENVELOPE
1333SUBSCRIPTION. I WOULD RECOMMEND THE FIRST CLASS SUBSCRIPTION, WHICH IS $10.
1334
1335 AS OF THIS WRITING (7-16-83), THE CURRENT ISSUE IS #86, AND ISSUE #50 IS 8
1336PAGES INSTEAD OF THE USUAL 4. BACK ISSUES ARE $0.75 EACH, AND ISSUE #50 IS
1337$1.50. A BRIEF INDEX TO THE FIRST 80 ISSUES IS AVAILABLE FOR A SASE, OR FREE
1338WITH A SUBSCRIPTION ORDER. TAP IS NON-PROFIT, AND IN DESPERATE NEED OF MATERIAL
1339(ARTICLES), MONEY, AND VOLUNTEERS.
1340
1341TAP
1342ROOM 603
1343147 WEST 42ND STREET
1344NEW YORK, NY 10036
1345
1346BELIEVE ME: IT WILL BE THE BEST $10 YOU WILL EVER SPEND...
1347
1348BLACK BOX
1349<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1350
1351 THE BLACK BOX IS A DEVICE THAT ATTACHED TO A CALLED PARTIES PHONE
1352THAT ALLOWS HIM/HER TO RECEIVE FREE LONG DISTANCE CALLS FROM FRIENDS WHO
1353CALL.
1354
1355 YOU ONLY NEED 2 PARTS: A SPST TOGGLE SWITCH AND A 10,000 OHM (10 K),
13561/2 WATT, 10% RESISTOR. ANY ELECTRONICS PLACE SHOULD HAVE THESE.
1357
1358 NOW, CUT TWO PIECES OF WIRE, ABOUT 6 INCHES, AND ATTACH THESE TO THE TWO
1359SCREWS ON THE SWITCH. TURN YOUR NORMAL DDSIDE DOWN AND UNSCREW THE 2 SCREWS.
1360LOCATE THE "F" AND "RR" SCREWS ON THE NETWORK BOX. WRAP THE RESISTOR BETWEEN
1361THESE 2 SCREWS AND MAKE SURE THAT THE WIRES TOUCH ONLY THE PROPER TERMINALS!
1362NOW CONNECT ONE WIRE FROM THE SWITCH TO THE RR TERMINAL. FINALLY, ATTACH THE
1363REMAINING WIRE TO THE GREEN WIRE (DISCONNECT IT FROM ITS TERMINAL). NOW BRING
1364THE SWITCH OUT THE REAR OF THE PHONE AND CLOSE IT UP. PUT THE SWITCH IN A
1365POSITION WHERE YOU GET A DIAL TONE, MARK THIS NORMAL. MARK THE OTHER SIDE
1366FREE.
1367
1368 WHEN YOUR FRIENDS CALL (AT A PREARRANGED TIME), QUICKLY LIFT & DROP THE
1369RECEIVER AS FAST AS POSSIBLE. THIS WILL STOP THE RINGING, IF NOT TRY AGAIN. IT
1370IS VERY IMPORTANT THAT YOU DO IT FAST! NOW PUT THE SWITCH IN THE FREE POSITION
1371AND PICK UP THE PHONE. KEEP ALL CALLS SHORT & UNDER 15 MINUTES.
1372
1373 WHEN SOMEONE CALLS YOU LONG-DISTANCE, THEY ARE BILLED FROM THE MOMENT YOU
1374ANSWER. THE TELCO KNOWS WHEN YOU ANSWER DUE TO A CERTAIN AMOUNT OF VOLTAGE THAT
1375FLOWS WHEN YOU PICK UP THE PHONE. HOWEVER, THE RESISTOR CUTS DOWN ON THE
1376VOLTAGE SO IT IS BELOW THE BILLING RANGE BUT SUFFICIENT ENOUGH TO OPERATE THE
1377MOUTHPIECE. ANSWERING THE PHONE FOR A FRACTION OF A SECOND STOPS THE RING BUT
1378IT IS NOT ENOUGH FOR BILLING TO START. IF THE PHONE IS ANSWERED FOR EVEN ONE
1379
1380 Page 28
1381
1382
1383
1384
1385 The Official Phreaker's Manual
1386
1387FULL SECOND, BILLING WILL START AND YOU WILL BE CUT OFF WHEN YOU HANG UP AND
1388SWITCH TO FREE.
1389
1390WARNING: BELL CAN RANDOMLY LOOK FOR BLACK BOXES SO BE CAREFUL!
1391
1392 _____________________________________
1393| |
1394---BLUE WIRE-->>F< |
1395| | | |
1396--WHITE WIRE---/ | |
1397| | |
1398| RESISTOR |
1399| | |
1400| | |
1401| >RR<-------SWITCH--X |
1402| | |
1403----GREEN WIRE--------------------/ |
1404| |
1405|_____________________________________|
1406
1407DIAL LOCKS
1408<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1409
1410 HAVE YOU EVER BEEN IN AN OFFICE OR SOMEWHERE AND WANTED TO MAKE A FREE FONE
1411CALL BUT SOME ASSHOLE PUT A LOCK ON THE FONE TO PREVENT OUT-GOING CALLS? FRET
1412KNOWLEDGE!
1413
1414 THERE ARE TWO WAYS TO BEAT THIS OBSTACLE, FIRST PICK THE LOCK, I DON'T HAVE
1415THE TIME TO TEACH LOCKSMITHING SO WE GO TO THE SECOND METHOD WHICH TAKES
1416ADVANTAGE OF TELEPHONE ELECTRONICS.
1417
1418 TO BE AS SIMPLE AS POSSIBLE, WHEN YOU PICK UP THE FONE YOU COMPLETE A
1419CIRCUIT KNOW AS A LOCAL LOOP. WHEN YOU HANG-UP YOU BREAK THE CIRCUIT. WHEN
1420YOU DIAL (PULSE) IT ALSO BREAKS THE CIRCUIT BUT NOT LONG ENOUGH TO HANG UP! SO
1421YOU CAN "PUSH-DIAL." TO DO THIS YOU >>> RAPIDLY <<< DEPRESS THE SWITCHHOOK.
1422FOR EXAMPLE, TO DIAL AN OPERATOR (AND THEN GIVE HER THE NUMBER YOU WANT CALLED)
1423>>> RAPIDLY <<< & >>> EVENLY <<< DEPRESS THE SWITCHHOOK 10 TIMES. TO DIAL
1424634-1268, DEPRESS 6 X'S PAUSE, THEN 3 X'S, PAUSE, THEN 4X'S, ETC. IT TAKES A
1425LITTLE PRACTICE BUT YOU'LL GET THE HANG OF IT. TRY PRACTICING WITH YOUR OWN #
1426SO YOU'LL GET A BUSY TONE WHEN RIGHT. IT'LL ALSO WORK ON TOUCH-TONE(TM) SINCE
1427A DTMF LINE WILL ALSO ACCEPT PULSE. ALSO, NEVER DEPRESS THE SWITCHHOOK FOR
1428MORE THAN A SECOND OR IT'LL HANG-UP!
1429
1430 FINALLY, REMEMBER THAT YOU HAVE JUST AS MUCH RIGHT TO THAT FONE AS THE
1431ASSHOLE WHO PUT THE LOCK ON IT!
1432
1433EXCHANGE SCANNING
1434<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1435
1436 ALMOST EVERY EXCHANGE IN THE BELL SYSTEM HAS TEST #'S AND OTHER "GOODIES"
1437SUCH AS LOOPS WITH DIAL-UPS. THESE "GOODIES" ARE USUALLY FOUND BETWEEN 9900 AND
14389999 IN YOUR LOCAL EXCHANGE. IF YOU HAVE THE TIME AND INITIATIVE, SCAN YOUR
1439EXCHANGE AND YOU MAY BECOME LUCKY!
1440
1441HERE ARE MY FINDINGS IN THE 914-268 EXCHANGE:
1442
1443
1444
1445 Page 29
1446
1447
1448
1449
1450 The Official Phreaker's Manual
1451
14529900 - ANI (SEE SEPARATE BULLETIN)
14539901 - ANI (SEE SEPARATE BULLETIN)
14549927 - OSC. TONE (POSSIBLE TONE SIDE OF A LOOP)
14559936 - VOICE # TO THE TELCO CENTRAL OFFICE
14569937 - VOICE # TO THE TELCO CENTRAL OFFICE
14579941 - COMPUTER (DIGITAL VOICE TRANSMISSION?)
14589960 - OSC. TONE (TONE SIDE LOOP) MAY ALSO BE A COMPUTER IN SOME EXCHANGES
14599961 - NO RESPONSE (OTHER END OF LOOP?)
14609962 - NO RESPONSE (OTHER END OF LOOP?)
14619963 - NO RESPONSE (OTHER END OF LOOP?)
14629966 - COMPUTER (SEE 9941)
14639968 - TONE THAT DISAPPEARS--RESPONDS TO CERTAIN TOUCH-TONE KEYS
1464
1465 MOST OF THE NUMBERS BETWEEN 9900 & 9999 WILL RING OR GO TO A "WHAT #,
1466PLEASE?" OPERATOR.
1467
1468HAVE PHUN AND REMEMBER IT'S ONLY A LOCAL CALL!
1469
1470TOUCH-TONE & FREE CALLS
1471<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1472
1473THERE ARE SEVERAL WAYS TO MAKE FREE CALLS (SPRINT, MCI, ETC.) USING A ROTARY
1474PHONE. THEY ARE:
1475
14761. USE A NUMBER THAT ACCEPTS VOICE AS WELL AS DTMF. SUCH A # IS (800)
1477521-8400. AS OF WRITING THIS, A CODE WAS 00717865.
1478
1479 A) IF USING VOICE, WAIT FOR THE COMPUTER TO SAY, "AUTHORIZATION #, PLEASE."
1480THEN SAY EACH DIGIT SLOWLY, IT WILL BEEP AFTER EACH DIGIT IS SAID. AFTER EVERY
1481GROUP OF DIGITS, IT WILL REPEAT WHAT YOU HAVE SAID, THEN SAY YES IF IT IS
1482CORRECT, OTHERWISE SAY NO. IF THE ACCESS CODE IS CORRECT, IT WILL THANK YOU AND
1483ASK FOR THE DESTINATION #, THEN SAY THE AREA CODE + NUMBER AS ABOVE. ANOTHER
1484SUCH # IS (800) 245-8173, WHICH HAS A 6 DIGIT ACCESS CODE. (NOTE: IF USING
1485TOUCH-TONE ON THIS #, ENTER THE CODE IMMEDIATELY AFTER THE TONE STOPS.)
1486
14872. HOOK UP A TOUCH-TONE FONE INTO YOUR ROTARY FONE. ATTACH THE RED WIRE FROM
1488THE TOUCH-TONE FONE TO THE "R" TERMINAL INSIDE THE FONE ON THE NETWORK BOX.
1489THEN HOOK THE GREEN WIRE TO THE "B" TERMINAL. TO USE THIS DIAL THE # USING
1490ROTARY & THEN USE THE TOUCH-TONE FOR THE CODES. (DON'T HANG UP THE ROTARY FONE
1491WHILE DOING THIS THOUGH!) IF THIS DOESN'T WORK THEN REVERSE THE 2 WIRES.
1492(NOTE:IF YOUR LINE CAN ACCEPT TOUCH-TONE BUT YOU HAVE A ROTARY FONE THEN YOU
1493CAN HOOK UP A TONE FONE DIRECTLY FOR ALL CALLS BUT THIS USUALLY ISN'T THE
1494CASE.) SUCH AS RADIO SHACK'S 43-138.
1495
1496OTHER ALTERNATIVES
1497<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
1498
14994. USE A CHARGE-A-CALL FONE. (THESE ALSO MAKE GREAT EXTENSIONS IF YOU REMOVE
1500IT USING A HEX WRENCH WITH A HOLE IN THE MIDDLE ON THE CENTER SCREW!)--(THESE
1501FONES, FOR THE BENEFIT OF THOSE WHO DON'T KNOW, ARE BLUE WITH NO COIN SLOTS).
1502
15035. USE A PAY FONE THAT WANTS YOUR MONEY BEFORE THE DIAL TONE. PUT IN YOUR
1504DIME, DIAL THE #; IF IT'S AN 800 # THEN YOUR DIME WILL COME BACK, IMMEDIATELY
1505PUT A DIME BACK IN (IT'LL COME BACK WHEN YOU HANG UP!) IF IT IS A TONE FIRST
1506FONE AND IT DISCONNECTS THE KEYPAD (SOME DON'T) THEN FIND ANOTHER FONE.
1507
1508
1509
1510
1511 Page 30
1512
1513
1514
1515
1516 The Official Phreaker's Manual
1517
1518 Chapter 2
1519
1520 Well now we know a little vocabulary, and now its into history, Phreak
1521history. Back at MIT in 1964 arrived a student by the name of Stewart Nelson,
1522who was extremely interested in the telephone. Before entering MIT, he had
1523built autodialers, cheese boxes, and many more gadgets. But when he came to
1524MIT he became even more interested in "fone-hacking" as they called it. After
1525a little while he naturally started using the PDP-1, the schools computer at
1526that time, and from there he decided that it would be interesting to see
1527whether the computer could generate the frequencies required for blue boxing.
1528The hackers at MIT were not interested in ripping off Ma Bell, but just
1529exploring the telephone network. Stew (as he was called) wrote a program to
1530generate all the tones and set off into the vast network.
1531 Now there were more people phreaking than the ones at MIT. Most people have
1532heard of Captain Crunch (No not the cereal), he also discovered how to take
1533rides through the fone system, with the aid of a small whistle found in a
1534cereal box (can we guess which one?). By blowing this whistle, he generated
1535the magical 2600hz and into the mouthpiece it sailed, giving him complete
1536control over the system. I have heard rumors that at one time he made about
15371/4 of the calls coming out of San Francisco. He got famous fast. He made the
1538cover of people magazine and was interviewed several times (as you'll soon
1539see). Well he finally got caught after a long adventurous career. After he
1540was caught he was put in jail and was beaten up quite badly because he would
1541not teach other inmates how to box calls. After getting out, he joined Apple
1542computer and is still out there somewhere.
1543 Then there was Joe the Whistler, blind form the day he was born. He could
1544whistle a perfect 2600hz tone. It was rumored phreaks used to call him to tune
1545their boxes.
1546 Well that was up to about 1970, then from 1970 to 1979, phreaking was mainly
1547done by college students, businessmen and anyone who knew enough about
1548electronics and the fone company to make a 555 Ic to generate those magic
1549tones. Businessmen and a few college students mainly just blue box to get free
1550calls. The others were still there, exploring 800#'s and the new ESS systems.
1551ESS posed a big problem for phreaks then and even a bigger one now. ESS was
1552not widespread, but where it was, blue boxing was next to impossible except for
1553the most experienced phreak. Today ESS is installed in almost all major cities
1554and blue boxing is getting harder and harder.
1555 1978 marked a change in phreaking, the Apple ][, now a computer that was
1556affordable, could be programmed, and could save all that precious work on a
1557cassette. Then just a short while later came the Apple Cat modem. With this
1558modem, generating all blue box tones was easy as writing a program to count
1559form one to ten (a little exaggerated). Pretty soon programs that could
1560imitate an operator just as good as the real thing were hitting the community,
1561TSPS and Cat's Meow, are the standard now and are the best.
1562 1982-1986: LD services were starting to appear in mass numbers. People now
1563had programs to hack LD services, telephone exchanges, and even passwords. By
1564now many phreaks were getting extremely good and BBS's started to spring up
1565everywhere, each having many documentations on phreaking for the novice. Then
1566it happened, the movie War Games was released and mass numbers of sixth grade
1567to all ages flocked to see it. The problem wasn't that the movie was bad, it
1568was that now EVERYONE wanted to be a hacker/phreak. Novices came out in such
1569mass numbers, that bulletin boards started to be busy 24 hours a day. To this
1570day, they still have not recovered. Other problems started to occur, novices
1571guessed easy passwords on large government computers and started to play
1572around... Well it wasn't long before they were caught, I think that many
1573people remember the 414-hackers. They were so stupid as to say "yes" when the
1574computer asked them whether they'd like to play games. Well at least it takes
1575the heat off the real phreaks/hacker/krackers.
1576
1577 Page 31
1578
1579
1580
1581
1582 The Official Phreaker's Manual
1583
1584 After a little history, how about a little thrill? I don't know if this
1585story is true but it sure is as bad as shit!
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643 Page 32
1644
1645
1646
1647
1648 The Official Phreaker's Manual
1649
1650 ***** The AAG Proudly Presents The AAG Proudly Presents *****
1651 * *
1652 * +----------------------------------------------+ *
1653 * *
1654 * Secrets of the Little Blue Box *
1655 * *
1656 * by Ron Rosenbaum *
1657 * Typed by One Farad Cap/AAG *
1658 * *
1659 * -A story so incredible it may even make you *
1660 * feel sorry for the phone company- *
1661 * *
1662 * (First of four files) *
1663 * *
1664 * +----------------------------------------------+ *
1665 * *
1666 ***** The AAG Proudly Presents The AAG Proudly Presents *****
1667
1668Dudes... These four files contain the story, "Secrets of the Little Blue Box",
1669by Ron Rosenbaum.
1670
1671-A story so incredible it may even make you feel sorry for the phone company-
1672
1673Printed in the October 1971 issue of Esquire Magazine. If you happen to be in
1674a library and come across a collection of Esquire magazines, the October 1971
1675issue is the first issue printed in the smaller format. The story begins on
1676page 116 with a picture of a blue box.
1677 --One Farad Cap, Atlantic Anarchist Guild
1678
1679
1680The Blue Box Is Introduced: Its Qualities Are Remarked
1681
1682I am in the expensively furnished living room of Al Gilbertson (His real name
1683has been changed.), the creator of the "blue box." Gilbertson is holding one of
1684his shiny black-and-silver "blue boxes" comfortably in the palm of his hand,
1685pointing out the thirteen little red push buttons sticking up from the console.
1686He is dancing his fingers over the buttons, tapping out discordant beeping
1687electronic jingles. He is trying to explain to me how his little blue box does
1688nothing less than place the entire telephone system of the world, satellites,
1689cables and all, at the service of the blue-box operator, free of charge.
1690
1691"That's what it does. Essentially it gives you the power of a super operator.
1692You seize a tandem with this top button," he presses the top button with his
1693index finger and the blue box emits a high-pitched cheep, "and like that" --
1694cheep goes the blue box again -- "you control the phone company's long-distance
1695switching systems from your cute little Princes phone or any old pay phone.
1696And you've got anonymity. An operator has to operate from a definite location:
1697the phone company knows where she is and what she's doing. But with your
1698beeper box, once you hop onto a trunk, say from a Holiday Inn 800 (toll-free)
1699number, they don't know where you are, or where you're coming from, they don't
1700know how you slipped into their lines and popped up in that 800 number. They
1701don't even know anything illegal is going on. And you can obscure your origins
1702through as many levels as you like. You can call next door by way of White
1703Plains, then over to Liverpool by cable, and then back here by satellite. You
1704can call yourself from one pay phone all the way around the world to a pay
1705phone next to you. And you get your dime back too."
1706
1707"And they can't trace the calls? They can't charge you?"
1708
1709 Page 33
1710
1711
1712
1713
1714 The Official Phreaker's Manual
1715
1716
1717"Not if you do it the right way. But you'll find that the free-call thing
1718isn't really as exciting at first as the feeling of power you get from having
1719one of these babies in your hand. I've watched people when they first get hold
1720of one of these things and start using it, and discover they can make
1721connections, set up crisscross and zigzag switching patterns back and forth
1722across the world. They hardly talk to the people they finally reach. They say
1723hello and start thinking of what kind of call to make next. They go a little
1724crazy." He looks down at the neat little package in his palm. His fingers are
1725still dancing, tapping out beeper patterns.
1726
1727"I think it's something to do with how small my models are. There are lots of
1728blue boxes around, but mine are the smallest and most sophisticated
1729electronically. I wish I could show you the prototype we made for our big
1730syndicate order."
1731
1732He sighs. "We had this order for a thousand beeper boxes from a syndicate
1733front man in Las Vegas. They use them to place bets coast to coast, keep lines
1734open for hours, all of which can get expensive if you have to pay. The deal
1735was a thousand blue boxes for $300 apiece. Before then we retailed them for
1736$1500 apiece, but $300,000 in one lump was hard to turn down. We had a
1737manufacturing deal worked out in the Philippines. Everything ready to go.
1738Anyway, the model I had ready for limited mass production was small enough to
1739fit inside a flip-top Marlboro box. It had flush touch panels for a keyboard,
1740rather than these unsightly buttons, sticking out. Looked just like a tiny
1741portable radio. In fact, I had designed it with a tiny transistor receiver to
1742get one AM channel, so in case the law became suspicious the owner could switch
1743on the radio part, start snapping his fingers, and no one could tell anything
1744illegal was going on. I thought of everything for this model -- I had it lined
1745with a band of thermite which could be ignited by radio signal from a tiny
1746button transmitter on your belt, so it could be burned to ashes instantly in
1747case of a bust. It was beautiful. A beautiful little machine. You should
1748have seen the faces on these syndicate guys when they came back after trying it
1749out. They'd hold it in their palm like they never wanted to let it go, and
1750they'd say, 'I can't believe it. I can't believe it.' You probably won't
1751believe it until you try it."
1752
1753The Blue Box Is Tested: Certain Connections Are Made
1754
1755About eleven o'clock two nights later Fraser Lucey has a blue box in the palm
1756of his left hand and a phone in the palm of his right. He is standing inside a
1757phone booth next to an isolated shut-down motel off Highway 1. I am standing
1758outside the phone booth.
1759
1760Fraser likes to show off his blue box for people. Until a few weeks ago when
1761Pacific Telephone made a few arrests in his city, Fraser Lucey liked to bring
1762his blue box (This particular blue box, like most blue boxes, is not blue.
1763Blue boxes have come to be called "blue boxes" either because 1) The first blue
1764box ever confiscated by phone-company security men happened to be blue, or 2)
1765To distinguish them from "black boxes." Black boxes are devices, usually a
1766resistor in series, which, when attached to home phones, allow all incoming
1767calls to be made without charge to one's caller.) to parties. It never failed:
1768a few cheeps from his device and Fraser became the center of attention at the
1769very hippest of gatherings, playing phone tricks and doing request numbers for
1770hours. He began to take orders for his manufacturer in Mexico. He became a
1771dealer.
1772
1773Fraser is cautious now about where he shows off his blue box. But he never
1774
1775 Page 34
1776
1777
1778
1779
1780 The Official Phreaker's Manual
1781
1782gets tired of playing with it. "It's like the first time every time," he tells
1783me.
1784
1785Fraser puts a dime in the slot. He listens for a tone and holds the receiver
1786up to my ear. I hear the tone. Fraser begins describing, with a certain
1787practiced air, what he does while he does it. "I'm dialing an 800 number now.
1788Any 800 number will do. It's toll free. Tonight I think I'll use the ----- (he
1789names a well-know rent-a-car company) 800 number. Listen, It's ringing. Here,
1790you hear it? Now watch." He places the blue box over the mouthpiece of the
1791phone so that the one silver and twelve black push buttons are facing up toward
1792me. He presses the silver button -- the one at the top -- and I hear that
1793high-pitched beep. "That's 2600 cycles per second to be exact," says Lucey.
1794"Now, quick. listen." He shoves the earpiece at me. The ringing has vanished.
1795The line gives a slight hiccough, there is a sharp buzz, and then nothing but
1796soft white noise.
1797
1798"We're home free now," Lucey tells me, taking back the phone and applying the
1799blue box to its mouthpiece once again. "We're up on a tandem, into a
1800long-lines trunk. Once you're up on a tandem, you can send yourself anywhere
1801you want to go." He decides to check out London first. He chooses a certain
1802pay phone located in Waterloo Station. This particular pay phone is popular
1803with the phone-phreaks network because there are usually people walking by at
1804all hours who will pick it up and talk for a while.
1805
1806of the box. "That's Key Pulse. It tells the tandem we're ready to give it
1807instructions. First I'll punch out KP 182 START, which will slide us into the
1808overseas sender in White Plains." I hear a neat clunk-cheep. "I think we'll
1809head over to England by satellite. Cable is actually faster and the connection
1810is somewhat better, but I like going by satellite. So I just punch out KP Zero
181144. The Zero is supposed to guarantee a satellite connection and 44 is the
1812country code for England. Okay... we're there. In Liverpool actually. Now
1813all I have to do is punch out the London area code which is 1, and dial up the
1814pay phone. Here, listen, I've got a ring now."
1815
1816I hear the soft quick purr-purr of a London ring. Then someone picks up the
1817phone.
1818
1819"Hello," says the London voice.
1820
1821"Hello. Who's this?" Fraser asks.
1822
1823"Hello. There's actually nobody here. I just picked this up while I was
1824passing by. This is a public phone. There's no one here to answer actually."
1825
1826"Hello. Don't hang up. I'm calling from the United States."
1827
1828"Oh. What is the purpose of the call? This is a public phone you know."
1829
1830"Oh. You know. To check out, uh, to find out what's going on in London. How
1831is it there?"
1832
1833"Its five o'clock in the morning. It's raining now."
1834
1835"Oh. Who are you?"
1836
1837The London passerby turns out to be an R.A.F. enlistee on his way back to the
1838base in Lincolnshire, with a terrible hangover after a thirty-six-hour pass.
1839
1840 Page 35
1841
1842
1843
1844
1845 The Official Phreaker's Manual
1846
1847He and Fraser talk about the rain. They agree that it's nicer when it's not
1848raining. They say good-bye and Fraser hangs up. His dime returns with a nice
1849clink.
1850
1851"Isn't that far out," he says grinning at me. "London, like that."
1852
1853Fraser squeezes the little blue box affectionately in his palm. "I told ya
1854this thing is for real. Listen, if you don't mind I'm gonna try this girl I
1855know in Paris. I usually give her a call around this time. It freaks her out.
1856This time I'll use the ------ (a different rent-a-car company) 800 number and
1857we'll go by overseas cable, 133; 33 is the country code for France, the 1 sends
1858you by cable. Okay, here we go.... Oh damn. Busy. Who could she be talking
1859to at this time?"
1860
1861A state police car cruises slowly by the motel. The car does not stop, but
1862Fraser gets nervous. We hop back into his car and drive ten miles in the
1863opposite direction until we reach a Texaco station locked up for the night. We
1864pull up to a phone booth by the tire pump. Fraser dashes inside and tries the
1865Paris number. It is busy again.
1866
1867"I don't understand who she could be talking to. The circuits may be busy.
1868It's too bad I haven't learned how to tap into lines overseas with this thing
1869yet."
1870
1871Fraser begins to phreak around, as the phone phreaks say. He dials a leading
1872nationwide charge card's 800 number and punches out the tones that bring him
1873the time recording in Sydney, Australia. He beeps up the weather recording in
1874Rome, in Italian of course. He calls a friend in Boston and talks about a
1875certain over-the-counter stock they are into heavily. He finds the Paris
1876number busy again. He calls up "Dial a Disc" in London, and we listen to
1877Double Barrel by David and Ansil Collins, the number-one hit of the week in
1878London. He calls up a dealer of another sort and talks in code. He calls up
1879Joe Engressia, the original blind phone-phreak genius, and pays his respects.
1880There are other calls. Finally Fraser gets through to his young lady in
1881Paris.
1882
1883They both agree the circuits must have been busy, and criticize the Paris
1884telephone system. At two-thirty in the morning Fraser hangs up, pockets his
1885dime, and drives off, steering with one hand, holding what he calls his "lovely
1886little blue box" in the other.
1887
1888You Can Call Long Distance For Less Than You Think
1889
1890"You see, a few years ago the phone company made one big mistake," Gilbertson
1891explains two days later in his apartment. "They were careless enough to let
1892some technical journal publish the actual frequencies used to create all their
1893multi-frequency tones. Just a theoretical article some Bell Telephone
1894Laboratories engineer was doing about switching theory, and he listed the tones
1895in passing. At ----- (a well-known technical school) I had been fooling around
1896with phones for several years before I came across a copy of the journal in the
1897engineering library. I ran back to the lab and it took maybe twelve hours from
1898the time I saw that article to put together the first working blue box. It was
1899bigger and clumsier than this little baby, but it worked."
1900
1901It's all there on public record in that technical journal written mainly by
1902Bell Lab people for other telephone engineers. Or at least it was public.
1903"Just try and get a copy of that issue at some engineering-school library now.
1904Bell has had them all red-tagged and withdrawn from circulation," Gilbertson
1905
1906 Page 36
1907
1908
1909
1910
1911 The Official Phreaker's Manual
1912
1913tells me.
1914
1915"But it's too late. It's all public now. And once they became public the
1916technology needed to create your own beeper device is within the range of any
1917twelve-year-old kid, any twelve-year-old blind kid as a matter of fact. And he
1918can do it in less than the twelve hours it took us. Blind kids do it all the
1919time. They can't build anything as precise and compact as my beeper box, but
1920theirs can do anything mine can do."
1921
1922"How?"
1923
1924"Okay. About twenty years ago A.T.&T. made a multi-billion-dollar decision to
1925operate its entire long-distance switching system on twelve electronically
1926generated combinations of twelve master tones. Those are the tones you
1927sometimes hear in the background after you've dialed a long-distance number.
1928They decided to use some very simple tones -- the tone for each number is just
1929two fixed single-frequency tones played simultaneously to create a certain beat
1930frequency. Like 1300 cycles per second and 900 cycles per second played
1931together give you the tone for digit 5. Now, what some of these phone phreaks
1932have done is get themselves access to an electric organ. Any cheap family
1933home-entertainment organ. Since the frequencies are public knowledge now --
1934one blind phone phreak has even had them recorded in one of the talking books
1935for the blind -- they just have to find the musical notes on the organ which
1936correspond to the phone tones. Then they tape them. For instance, to get Ma
1937Bell's tone for the number 1, you press down organ keys FD5 and AD5 (900 and
1938700 cycles per second) at the same time. To produce the tone for 2 it's FD5
1939and CD6 (1100 and 700 c.p.s). The phone phreaks circulate the whole list of
1940notes so there's no trial and error anymore."
1941
1942He shows me a list of the rest of the phone numbers and the two electric organ
1943keys that produce them.
1944
1945"Actually, you have to record these notes at 3 3/4 inches-per-second tape speed
1946and double it to 7 1/2 inches-per-second when you play them back, to get the
1947proper tones," he adds.
1948
1949"So once you have all the tones recorded, how do you plug them into the phone
1950system?"
1951
1952"Well, they take their organ and their cassette recorder, and start banging out
1953entire phone numbers in tones on the organ, including country codes, routing
1954instructions, 'KP' and 'Start' tones. Or, if they don't have an organ, someone
1955in the phone-phreak network sends them a cassette with all the tones recorded,
1956with a voice saying 'Number one,' then you have the tone, 'Number two,' then
1957the tone and so on. So with two cassette recorders they can put together a
1958series of phone numbers by switching back and forth from number to number. Any
1959idiot in the country with a cheap cassette recorder can make all the free calls
1960he wants."
1961
1962"You mean you just hold the cassette recorder up the mouthpiece and switch in a
1963series of beeps you've recorded? The phone thinks that anything that makes
1964these tones must be its own equipment?"
1965
1966"Right. As long as you get the frequency within thirty cycles per second of
1967the phone company's tones, the phone equipment thinks it hears its own voice
1968talking to it. The original granddaddy phone phreak was this blind kid with
1969perfect pitch, Joe Engressia, who used to whistle into the phone. An operator
1970could tell the difference between his whistle and the phone company's
1971
1972 Page 37
1973
1974
1975
1976
1977 The Official Phreaker's Manual
1978
1979electronic tone generator, but the phone company's switching circuit can't tell
1980them apart. The bigger the phone company gets and the further away from human
1981operators it gets, the more vulnerable it becomes to all sorts of phone
1982phreaking."
1983
1984A Guide for the Perplexed
1985
1986"But wait a minute," I stop Gilbertson. "If everything you do sounds like
1987phone-company equipment, why doesn't the phone company charge you for the call
1988the way it charges its own equipment?"
1989
1990"Okay. That's where the 2600-cycle tone comes in. I better start from the
1991beginning."
1992
1993The beginning he describes for me is a vision of the phone system of the
1994continent as thousands of webs, of long-line trunks radiating from each of the
1995hundreds of toll switching offices to the other toll switching offices. Each
1996toll switching office is a hive compacted of thousands of long-distance tandems
1997constantly whistling and beeping to tandems in far-off toll switching offices.
1998
1999The tandem is the key to the whole system. Each tandem is a line with some
2000relays wih the capability of signalling any other tandem in any other toll
2001switching office on the continent, either directly one-to-one or by programming
2002
2003a roundabout route through several other tandems if all the direct routes are
2004busy. For instance, if you want to call from New York to Los Angeles and
2005traffic is heavy on all direct trunks between the two cities, your tandem in
2006New York is programmed to try the next best route, which may send you down to a
2007tandem in New Orleans, then up to San Francisco, or down to a New Orleans
2008tandem, back to an Atlanta tandem, over to an Albuquerque tandem and finally up
2009to Los Angeles.
2010
2011When a tandem is not being used, when it's sitting there waiting for someone to
2012make a long-distance call, it whistles. One side of the tandem, the side
2013"facing" your home phone, whistles at 2600 cycles per second toward all the
2014home phones serviced by the exchange, telling them it is at their service,
2015should they be interested in making a long-distance call. The other side of
2016the tandem is whistling 2600 c.p.s. into one or more long-distance trunk lines,
2017telling the rest of the phone system that it is neither sending nor receiving a
2018call through that trunk at the moment, that it has no use for that trunk at the
2019moment.
2020
2021"When you dial a long-distance number the first thing that happens is that you
2022are hooked into a tandem. A register comes up to the side of the tandem facing
2023away from you and presents that side with the number you dialed. This sending
2024side of the tandem stops whistling 2600 into its trunk line. When a tandem
2025stops the 2600 tone it has been sending through a trunk, the trunk is said to
2026be "seized," and is now ready to carry the number you have dialed -- converted
2027into multi-frequency beep tones -- to a tandem in the area code and central
2028office you want.
2029
2030Now when a blue-box operator wants to make a call from New Orleans to New York
2031he starts by dialing the 800 number of a company which might happen to have its
2032headquarters in Los Angeles. The sending side of the New Orleans tandem stops
2033sending 2600 out over the trunk to the central office in Los Angeles, thereby
2034seizing the trunk. Your New Orleans tandem begins sending beep tones to a
2035tandem it has discovered idly whistling 2600 cycles in Los Angeles. The
2036receiving end of that L.A. tandem is seized, stops whistling 2600, listens to
2037the beep tones which tell it which L.A. phone to ring, and starts ringing the
2038
2039 Page 38
2040
2041
2042
2043
2044 The Official Phreaker's Manual
2045
2046800 number. Meanwhile a mark made in the New Orleans office accounting tape
2047notes that a call from your New Orleans phone to the 800 number in L.A. has
2048been initiated and gives the call a code number. Everything is routine so far.
2049
2050But then the phone phreak presses his blue box to the mouthpiece and pushes the
2051over the line again and
2052assumes that New Orleans has hung up because the trunk is whistling as if idle.
2053The L.A. tandem immediately ceases ringing the L.A. 800 number. But as soon as
2054the phreak takes his finger off the 2600 button, the L.A. tandem assumes the
2055trunk is once again being used because the 2600 is gone, so it listens for a
2056new series of digit tones - to find out where it must send the call.
2057
2058Thus the blue-box operator in New Orleans now is in touch with a tandem in L.A.
2059which is waiting like an obedient genie to be told what to do next. The
2060blue-box owner then beeps out the ten digits of the New York number which tell
2061the L.A. tandem to relay a call to New York City. Which it promptly does. As
2062soon as your party picks up the phone in New York, the side of the New Orleans
2063tandem facing you stops sending 2600 cycles to you and stars carrying his voice
2064to you by way of the L.A. tandem. A notation is made on the accounting tape
2065that the connection has been made on the 800 call which had been initiated and
2066noted earlier. When you stop talking to New York a notation is made that the
2067800 call has ended.
2068
2069At three the next morning, when the phone company's accounting computer starts
2070reading back over the master accounting tape for the past day, it records that
2071a call of a certain length of time was made from your New Orleans home to an
2072L.A. 800 number and, of course, the accounting computer has been trained to
2073ignore those toll-free 800 calls when compiling your monthly bill.
2074
2075"All they can prove is that you made an 800 toll-free call," Gilbertson the
2076inventor concludes. "Of course, if you're foolish enough to talk for two hours
2077on an 800 call, and they've installed one of their special anti-fraud computer
2078programs to watch out for such things, they may spot you and ask why you took
2079two hours talking to Army Recruiting's 800 number when you're 4-F.
2080
2081But if you do it from a pay phone, they may discover something peculiar the
2082next day -- if they've got a blue-box hunting program in their computer -- but
2083you'll be a long time gone from the pay phone by then. Using a pay phone is
2084almost guaranteed safe."
2085
2086"What about the recent series of blue-box arrests all across the country -- New
2087York, Cleveland, and so on?" I asked. "How were they caught so easily?"
2088
2089"From what I can tell, they made one big mistake: they were seizing trunks
2090using an area code plus 555-1212 instead of an 800 number. Using 555 is easy to
2091detect because when you send multi-frequency beep tones of 555 you get a charge
2092for it on your tape and the accounting computer knows there's something wrong
2093when it tries to bill you for a two-hour call to Akron, Ohio, information, and
2094it drops a trouble card which goes right into the hands of the security agent
2095if they're looking for blue-box user.
2096
2097"Whoever sold those guys their blue boxes didn't tell them how to use them
2098properly, which is fairly irresponsible. And they were fairly stupid to use
2099them at home all the time.
2100
2101"But what those arrests really mean is than an awful lot of blue boxes are
2102flooding into the country and that people are finding them so easy to make that
2103
2104 Page 39
2105
2106
2107
2108
2109 The Official Phreaker's Manual
2110
2111they know how to make them before they know how to use them. Ma Bell is in
2112trouble."
2113
2114And if a blue-box operator or a cassette-recorder phone phreak sticks to pay
2115phones and 800 numbers, the phone company can't stop them?
2116
2117"Not unless they change their entire nationwide long-lines technology, which
2118will take them a few billion dollars and twenty years. Right now they can't do
2119a thing. They're screwed."
2120
2121+-- End first file of four --+
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170 Page 40
2171
2172
2173
2174
2175 The Official Phreaker's Manual
2176
2177 ***** The AAG Proudly Presents The AAG Proudly Presents *****
2178 * *
2179 * +----------------------------------------------+ *
2180 * *
2181 * Secrets of the Little Blue Box *
2182 * *
2183 * by Ron Rosenbaum *
2184 * Typed by One Farad Cap/AAG *
2185 * *
2186 * -A story so incredible it may even make you *
2187 * feel sorry for the phone company- *
2188 * *
2189 * (Second of four files) *
2190 * *
2191 * +----------------------------------------------+ *
2192 * *
2193 ***** The AAG Proudly Presents The AAG Proudly Presents *****
2194
2195Captain Crunch Demonstrates His Famous Unit
2196
2197There is an underground telephone network in this country. Gilbertson
2198discovered it the very day news of his activities hit the papers. That evening
2199his phone began ringing. Phone phreaks from Seattle, from Florida, from New
2200York, from San Jose, and from Los Angeles began calling him and telling him
2201about the phone-phreak network. He'd get a call from a phone phreak who'd say
2202nothing but, "Hang up and call this number."
2203
2204When he dialed the number he'd find himself tied into a conference of a dozen
2205phone phreaks arranged through a quirky switching station in British Columbia.
2206They identified themselves as phone phreaks, they demonstrated their homemade
2207blue boxes which they called "M-Fers" (for "multi-frequency," among other
2208things) for him, they talked shop about phone-phreak devices. They let him in
2209on their secrets on the theory that if the phone company was after him he must
2210be trustworthy. And, Gilbertson recalls, they stunned him with their technical
2211sophistication.
2212
2213I ask him how to get in touch with the phone-phreak network. He digs around
2214through a file of old schematics and comes up with about a dozen numbers in
2215three widely separated area codes.
2216
2217"Those are the centers," he tells me. Alongside some of the numbers he writes
2218in first names or nicknames: names like Captain Crunch, Dr. No, Frank Carson
2219(also a code word for a free call), Marty Freeman (code word for M-F device),
2220Peter Perpendicular Pimple, Alefnull, and The Cheshire Cat. He makes checks
2221alongside the names of those among these top twelve who are blind. There are
2222five checks.
2223
2224I ask him who this Captain Crunch person is.
2225
2226"Oh. The Captain. He's probably the most legendary phone phreak. He calls
2227himself Captain Crunch after the notorious Cap'n Crunch 2600 whistle."
2228(Several years ago, Gilbertson explains, the makers of Cap'n Crunch breakfast
2229cereal offered a toy-whistle prize in every box as a treat for the Cap'n Crunch
2230set. Somehow a phone phreak discovered that the toy whistle just happened to
2231produce a perfect 2600-cycle tone. When the man who calls himself Captain
2232Crunch was transferred overseas to England with his Air Force unit, he would
2233receive scores of calls from his friends and "mute" them -- make them free of
2234charge to them -- by blowing his Cap'n Crunch whistle into his end.)
2235
2236 Page 41
2237
2238
2239
2240
2241 The Official Phreaker's Manual
2242
2243
2244"Captain Crunch is one of the older phone phreaks," Gilbertson tells me. "He's
2245an engineer who once got in a little trouble for fooling around with the phone,
2246but he can't stop. Well, they guy drives across country in a Volkswagen van
2247with an entire switchboard and a computerized super-sophisticated M-F-er in the
2248back. He'll pull up to a phone booth on a lonely highway somewhere, snake a
2249cable out of his bus, hook it onto the phone and sit for hours, days sometimes,
2250sending calls zipping back and forth across the country, all over the
2251world...."
2252
2253Back at my motel, I dialed the number he gave me for "Captain Crunch" and asked
2254for G---- T-----, his real name, or at least the name he uses when he's not
2255dashing into a phone booth beeping out M-F tones faster than a speeding bullet
2256and zipping phantomlike through the phone company's long-distance lines.
2257
2258When G---- T----- answered the phone and I told him I was preparing a story for
2259Esquire about phone phreaks, he became very indignant.
2260
2261"I don't do that. I don't do that anymore at all. And if I do it, I do it for
2262one reason and one reason only. I'm learning about a system. The phone
2263company is a System. A computer is a System, do you understand? If I do what
2264I do, it is only to explore a system. Computers, systems, that's my bag. The
2265phone company is nothing but a computer."
2266
2267A tone of tightly restrained excitement enters the Captain's voice when he
2268starts talking about systems. He begins to pronounce each syllable with the
2269hushed deliberation of an obscene caller.
2270
2271"Ma Bell is a system I want to explore. It's a beautiful system, you know, but
2272Ma Bell screwed up. It's terrible because Ma Bell is such a beautiful system,
2273but she screwed up. I learned how she screwed up from a couple of blind kids
2274who wanted me to build a device. A certain device. They said it could make
2275free calls. I wasn't interested in free calls. But when these blind kids told
2276me I could make calls into a computer, my eyes lit up. I wanted to learn about
2277computers. I wanted to learn about Ma Bell's computers. So I build the little
2278device, but I built it wrong and Ma Bell found out. Ma Bell can detect things
2279like that. Ma Bell knows. So I'm strictly rid of it now. I don't do it.
2280Except for learning purposes." He pauses. "So you want to write an article.
2281Are you paying for this call? Hang up and call this number." He gives me a
2282number in a area code a thousand miles away of his own. I dial the number.
2283
2284"Hello again. This is Captain Crunch. You are speaking to me on a toll-free
2285loop-around in Portland, Oregon. Do you know what a toll-free loop around is?
2286I'll tell you.
2287
2288He explains to me that almost every exchange in the country has open test
2289numbers which allow other exchanges to test their connections with it. Most of
2290these numbers occur in consecutive pairs, such as 302 956-0041 and 302
2291956-0042. Well, certain phone phreaks discovered that if two people from
2292anywhere in the country dial the two consecutive numbers they can talk together
2293just as if one had called the other's number, with no charge to either of them,
2294of course.
2295
2296"Now our voice is looping around in a 4A switching machine up there in Canada,
2297zipping back down to me," the Captain tells me. "My voice is looping around up
2298there and back down to you. And it can't ever cost anyone money. The phone
2299phreaks and I have compiled a list of many many of these numbers. You would be
2300surprised if you saw the list. I could show it to you. But I won't. I'm out
2301
2302 Page 42
2303
2304
2305
2306
2307 The Official Phreaker's Manual
2308
2309of that now. I'm not out to screw Ma Bell. I know better. If I do anything
2310it's for the pure knowledge of the System. You can learn to do fantastic
2311things. Have you ever heard eight tandems stacked up? Do you know the sound
2312of tandems stacking and unstacking? Give me your phone number. Okay. Hang up
2313now and wait a minute."
2314
2315Slightly less than a minute later the phone rang and the Captain was on the
2316line, his voice sounding far more excited, almost aroused.
2317
2318"I wanted to show you what it's like to stack up tandems. To stack up
2319tandems." (Whenever the Captain says "stack up" it sounds as if he is licking
2320his lips.)
2321
2322"How do you like the connection you're on now?" the Captain asks me. "It's a
2323raw tandem. A raw tandem. Ain't nothin' up to it but a tandem. Now I'm going
2324to show you what it's like to stack up. Blow off. Land in a far away place.
2325To stack that tandem up, whip back and forth across the country a few times,
2326then shoot on up to Moscow.
2327
2328"Listen," Captain Crunch continues. "Listen. I've got line tie on my
2329switchboard here, and I'm gonna let you hear me stack and unstack tandems.
2330Listen to this. It's gonna blow your mind."
2331
2332First I hear a super rapid-fire pulsing of the flutelike phone tones, then a
2333pause, then another popping burst of tones, then another, then another. Each
2334burst is followed by a beep-kachink sound.
2335
2336"We have now stacked up four tandems," said Captain Crunch, sounding somewhat
2337remote. "That's four tandems stacked up. Do you know what that means? That
2338means I'm whipping back and forth, back and forth twice, across the country,
2339before coming to you. I've been known to stack up twenty tandems at a time.
2340Now, just like I said, I'm going to shoot up to Moscow."
2341
2342There is a new, longer series of beeper pulses over the line, a brief silence,
2343then a ring.
2344
2345"Hello," answers a far-off voice.
2346
2347"Hello. Is this the American Embassy Moscow?"
2348
2349Moscow?"
2350
2351"Okay?"
2352
2353"Well, yes, how are things there?"
2354
2355"Oh. Well, everything okay, I guess."
2356
2357"Okay. Thank you."
2358
2359They hang up, leaving a confused series of beep-kachink sounds hanging in
2360mid-ether in the wake of the call before dissolving away.
2361
2362The Captain is pleased. "You believe me now, don't you? Do you know what I'd
2363
2364 Page 43
2365
2366
2367
2368
2369 The Official Phreaker's Manual
2370
2371like to do? I'd just like to call up your editor at Esquire and show him just
2372what it sounds like to stack and unstack tandems. I'll give him a show that
2373will blow his mind. What's his number?
2374
2375I ask the Captain what kind of device he was using to accomplish all his feats.
2376The Captain is pleased at the question.
2377
2378"You could tell it was special, couldn't you?" Ten pulses per second. That's
2379faster than the phone company's equipment. Believe me, this unit is the most
2380famous unit in the country. There is no other unit like it. Believe me."
2381
2382"Yes, I've heard about it. Some other phone phreaks have told me about it."
2383
2384"They have been referring to my, ahem, unit? What is it they said? Just out of
2385curiosity, did they tell you it was a highly sophisticated computer-operated
2386unit, with acoustical coupling for receiving outputs and a switch-board with
2387multiple-line-tie capability? Did they tell you that the frequency tolerance
2388is guaranteed to be not more than .05 percent? The amplitude tolerance less
2389than .01 decibel? Those pulses you heard were perfect. They just come faster
2390than the phone company. Those were high-precision op-amps. Op-amps are
2391instrumentation amplifiers designed for ultra-stable amplification, super-low
2392distortion and accurate frequency response. Did they tell you it can operate
2393in temperatures from -55 degrees C to +125 degrees C?"
2394
2395I admit that they did not tell me all that.
2396
2397"I built it myself," the Captain goes on. "If you were to go out and buy the
2398components from an industrial wholesaler it would cost you at least $1500. I
2399once worked for a semiconductor company and all this didn't cost me a cent. Do
2400you know what I mean? Did they tell you about how I put a call completely
2401around the world? I'll tell you how I did it. I M-Fed Tokyo inward, who
2402connected me to India, India connected me to Greece, Greece connected me to
2403Pretoria, South Africa, South Africa connected me to South America, I went from
2404South America to London, I had a London operator connect me to a New York
2405operator, I had New York connect me to a California operator who rang the phone
2406next to me. Needless to say I had to shout to hear myself. But the echo was
2407far out. Fantastic. Delayed. It was delayed twenty seconds, but I could hear
2408myself talk to myself."
2409
2410"You mean you were speaking into the mouthpiece of one phone sending your voice
2411around the world into your ear through a phone on the other side of your head?"
2412I asked the Captain. I had a vision of something vaguely autoerotic going on,
2413in a complex electronic way.
2414
2415"That's right," said the Captain. "I've also sent my voice around the world
2416one way, going east on one phone, and going west on the other, going through
2417cable one way, satellite the other, coming back together at the same time,
2418ringing the two phones simultaneously and picking them up and whipping my
2419voice both ways around the world back to me. Wow. That was a mind blower."
2420
2421"You mean you sit there with both phones on your ear and talk to yourself
2422around the world," I said incredulously.
2423
2424"Yeah. Um hum. That's what I do. I connect the phone together and sit there
2425and talk."
2426
2427"What do you say? What do you say to yourself when you're connected?"
2428
2429
2430 Page 44
2431
2432
2433
2434
2435 The Official Phreaker's Manual
2436
2437"Oh, you know. Hello test one two three," he says in a low-pitched voice.
2438
2439"Hello test one two three," he replied to himself in a high-pitched voice.
2440
2441"Hello test one two three," he repeats again, low-pitched.
2442
2443"Hello test one two three," he replies, high-pitched.
2444
2445"I sometimes do this: Hello Hello Hello Hello, Hello, hello," he trails off and
2446breaks into laughter.
2447
2448Why Captain Crunch Hardly Ever Taps Phones Anymore
2449
2450Using internal phone-company codes, phone phreaks have learned a simple method
2451for tapping phones. Phone-company operators have in front of them a board that
2452holds verification jacks. It allows them to plug into conversations in case of
2453emergency, to listen in to a line to determine if the line is busy or the
2454circuits are busy. Phone phreaks have learned to beep out the codes which lead
2455them to a verification operator, tell the verification operator they are
2456switchmen from some other area code testing out verification trunks. Once the
2457operator hooks them into the verification trunk, they disappear into the board
2458for all practical purposes, slip unnoticed into any one of the 10,000 to
2459100,000 numbers in that central office without the verification operator
2460knowing what they're doing, and of course without the two parties to the
2461connection knowing there is a phantom listener present on their line.
2462
2463Toward the end of my hour-long first conversation with him, I asked the Captain
2464if he ever tapped phones.
2465
2466"Oh no. I don't do that. I don't think it's right," he told me firmly. "I
2467have the power to do it but I don't... Well one time, just one time, I have to
2468admit that I did. There was this girl, Linda, and I wanted to find out... you
2469know. I tried to call her up for a date. I had a date with her the last
2470weekend and I thought she liked me. I called her up, man, and her line was
2471busy, and I kept calling and it was still busy. Well, I had just learned about
2472this system of jumping into lines and I said to myself, 'Hmmm. Why not just
2473see if it works. It'll surprise her if all of a sudden I should pop up on her
2474line. It'll impress her, if anything.' So I went ahead and did it. I M-Fed
2475into the line. My M-F-er is powerful enough when patched directly into the
2476mouthpiece to trigger a verification trunk without using an operator the way
2477the other phone phreaks have to.
2478
2479"I slipped into the line and there she was talking to another boyfriend.
2480Making sweet talk to him. I didn't make a sound because I was so disgusted.
2481So I waited there for her to hang up, listening to her making sweet talk to the
2482other guy. You know. So as soon as she hung up I instantly M-F-ed her up and
2483all I said was, 'Linda, we're through.' And I hung up. And it blew her head
2484off. She couldn't figure out what the hell happened.
2485
2486"But that was the only time. I did it thinking I would surprise her, impress
2487her. Those were all my intentions were, and well, it really kind of hurt me
2488pretty badly, and... and ever since then I don't go into verification trunks."
2489
2490Moments later my first conversation with the Captain comes to a close.
2491
2492"Listen," he says, his spirits somewhat cheered, "listen. What you are going
2493to hear when I hang up is the sound of tandems unstacking. Layer after layer of
2494tandems unstacking until there's nothing left of the stack, until it melts away
2495
2496 Page 45
2497
2498
2499
2500
2501 The Official Phreaker's Manual
2502
2503into nothing. Cheep, cheep, cheep, cheep," he concludes, his voice descending
2504to a whisper with each cheep.
2505
2506He hangs up. The phone suddenly goes into four spasms: kachink cheep. Kachink
2507cheep kachink cheep kachink cheep, and the complex connection has wiped itself
2508out like the Cheshire cat's smile.
2509
2510The MF Boogie Blues
2511
2512The next number I choose from the select list of phone-phreak alumni, prepared
2513for me by the blue-box inventor, is a Memphis number. It is the number of Joe
2514Engressia, the first and still perhaps the most accomplished blind phone
2515phreak.
2516
2517Three years ago Engressia was a nine-day wonder in newspapers and magazines all
2518over America because he had been discovered whistling free long-distance
2519connections for fellow students at the University of South Florida. Engressia
2520was born with perfect pitch: he could whistle phone tones better than the
2521phone-company's equipment.
2522
2523Engressia might have gone on whistling in the dark for a few friends for the
2524rest of his life if the phone company hadn't decided to expose him. He was
2525warned, disciplined by the college, and the whole case became public. In the
2526months following media reports of his talent, Engressia began receiving strange
2527calls. There were calls from a group of kids in Los Angeles who could do some
2528very strange things with the quirky General Telephone and Electronics circuitry
2529in L.A. suburbs. There were calls from a group of mostly blind kids in ----,
2530California, who had been doing some interesting experiments with Cap'n Crunch
2531whistles and test loops. There was a group in Seattle, a group in Cambridge,
2532Massachusetts, a few from New York, a few scattered across the country. Some
2533of them had already equipped themselves with cassette and electronic M-F
2534devices. For some of these groups, it was the first time they knew of the
2535others.
2536
2537The exposure of Engressia was the catalyst that linked the separate
2538phone-phreak centers together. They all called Engressia. They talked to him
2539about what he was doing and what they were doing. And then he told them -- the
2540scattered regional centers and lonely independent phone phreakers -- about each
2541other, gave them each other's numbers to call, and within a year the scattered
2542phone-phreak centers had grown into a nationwide underground.
2543
2544Joe Engressia is only twenty-two years old now, but along the phone-phreak
2545network he is "the old man," accorded by phone phreaks something of the
2546reverence the phone company bestows on Alexander Graham Bell. He seldom needs
2547to make calls anymore. The phone phreaks all call him and let him know what
2548new tricks, new codes, new techniques they have learned. Every night he sits
2549like a sightless spider in his little apartment receiving messages from every
2550tendril of his web. It is almost a point of pride with Joe that they call
2551him.
2552
2553But when I reached him in his Memphis apartment that night, Joe Engressia was
2554lonely, jumpy and upset.
2555
2556"God, I'm glad somebody called. I don't know why tonight of all nights I don't
2557get any calls. This guy around here got drunk again tonight and propositioned
2558me again. I keep telling him we'll never see eye to eye on this subject, if
2559you know what I mean. I try to make light of it, you know, but he doesn't get
2560it. I can head him out there getting drunker and I don't know what he'll do
2561
2562 Page 46
2563
2564
2565
2566
2567 The Official Phreaker's Manual
2568
2569next. It's just that I'm really all alone here, just moved to Memphis, it's
2570the first time I'm living on my own, and I'd hate for it to all collapse now.
2571But I won't go to bed with him. I'm just not very interested in sex and even
2572if I can't see him I know he's ugly.
2573
2574"Did you hear that? That's him banging a bottle against the wall outside.
2575He's nice. Well forget about it. You're doing a story on phone phreaks?
2576Listen to this. It's the MF Boogie Blues.
2577
2578Sure enough, a jumpy version of Muskrat Ramble boogies its way over the line,
2579each note one of those long-distance phone tones. The music stops. A huge
2580roaring voice blasts the phone off my ear: "AND THE QUESTION IS..." roars the
2581voice, "CAN A BLIND PERSON HOOK UP AN AMPLIFIER ON HIS OWN?"
2582
2583The roar ceases. A high-pitched operator-type voice replaces it. "This is
2584Southern Braille Tel. & Tel. Have tone, will phone."
2585
2586This is succeeded by a quick series of M-F tones, a swift "kachink" and a deep
2587reassuring voice: "If you need home care, call the visiting-nurses association.
2588First National time in Honolulu is 4:32 p.m."
2589
2590Joe back in his Joe voice again: "Are we seeing eye to eye? 'Si, si,' said the
2591blind Mexican. Ahem. Yes. Would you like to know the weather in Tokyo?"
2592
2593This swift manic sequence of phone-phreak vaudeville stunts and blind-boy jokes
2594manages to keep Joe's mind off his tormentor only as long as it lasts.
2595
2596"The reason I'm in Memphis, the reason I have to depend on that homosexual guy,
2597is that this is the first time I've been able to live on my own and make phone
2598trips on my own. I've been banned from all central offices around home in
2599Florida, they knew me too well, and at the University some of my fellow
2600scholars were always harassing me because I was on the dorm pay phone all the
2601time and making fun of me because of my fat ass, which of course I do have,
2602it's my physical fatness program, but I don't like to hear it every day, and if
2603I can't phone trip and I can't phone phreak, I can't imagine what I'd do, I've
2604been devoting three quarters of my life to it.
2605
2606"I moved to Memphis because I wanted to be on my own as well as because it has
2607a Number 5 crossbar switching system and some interesting little independent
2608phone-company districts nearby and so far they don't seem to know who I am so I
2609can go on phone tripping, and for me phone tripping is just as important as
2610phone phreaking."
2611
2612Phone tripping, Joe explains, begins with calling up a central-office switch
2613room. He tells the switchman in a polite earnest voice that he's a blind
2614college student interested in telephones, and could he perhaps have a guided
2615tour of the switching station? Each step of the tour Joe likes to touch and
2616feel relays, caress switching circuits, switchboards, crossbar arrangements.
2617
2618So when Joe Engressia phone phreaks he feels his way through the circuitry of
2619the country garden of forking paths, he feels switches shift, relays shunt,
2620crossbars swivel, tandems engage and disengage even as he hears -- with perfect
2621pitch -- his M-F pulses make the entire Bell system dance to his tune.
2622
2623Just one month ago Joe took all his savings out of his bank and left home, over
2624the emotional protests of his mother. "I ran away from home almost," he likes
2625to say. Joe found a small apartment house on Union Avenue and began making
2626phone trips. He'd take a bus a hundred miles south in Mississippi to see some
2627
2628 Page 47
2629
2630
2631
2632
2633 The Official Phreaker's Manual
2634
2635old-fashioned Bell equipment still in use in several states, which had been
2636puzzling. He'd take a bus three hundred miles to Charlotte, North Carolina, to
2637look at some brand-new experimental equipment. He hired a taxi to drive him
2638twelve miles to a suburb to tour the office of a small phone company with some
2639interesting idiosyncrasies in its routing system. He was having the time of
2640his life, he said, the most freedom and pleasure he had known.
2641
2642In that month he had done very little long-distance phone phreaking from his
2643own phone. He had begun to apply for a job with the phone company, he told me,
2644and he wanted to stay away from anything illegal.
2645
2646"Any kind of job will do, anything as menial as the most lowly operator.
2647That's probably all they'd give me because I'm blind. Even though I probably
2648know more than most switchmen. But that's okay. I want to work for Ma Bell.
2649I don't hate Ma Bell the way Gilbertson and some phone phreaks do. I don't
2650want to screw Ma Bell. With me it's the pleasure of pure knowledge. There's
2651something beautiful about the system when you know it intimately the way I do.
2652But I don't know how much they know about me here. I have a very intuitive
2653feel for the condition of the line I'm on, and I think they're monitoring me
2654off and on lately, but I haven't been doing much illegal. I have to make a few
2655calls to switchmen once in a while which aren't strictly legal, and once I took
2656an acid trip and was having these auditory hallucinations as if I were trapped
2657and these planes were dive-bombing me, and all of sudden I had to phone phreak
2658out of there. For some reason I had to call Kansas City, but that's all."
2659
2660A Warning Is Delivered
2661
2662At this point -- one o'clock in my time zone -- a loud knock on my motel-room
2663door interrupts our conversation. Outside the door I find a uniformed security
2664guard who informs me that there has been an "emergency phone call" for me while
2665I have been on the line and that the front desk has sent him up to let me
2666know.
2667
2668Two seconds after I say good-bye to Joe and hang up, the phone rings.
2669
2670"Who were you talking to?" the agitated voice demands. The voice belongs to
2671Captain Crunch. "I called because I decided to warn you of something. I
2672decided to warn you to be careful. I don't want this information you get to
2673get to the radical underground. I don't want it to get into the wrong hands.
2674What would you say if I told you it's possible for three phone phreaks to
2675saturate the phone system of the nation. Saturate it. Busy it out. All of
2676it. I know how to do this. I'm not gonna tell. A friend of mine has already
2677saturated the trunks between Seattle and New York. He did it with a
2678computerized M-F-er hitched into a special Manitoba exchange. But there are
2679other, easier ways to do it."
2680
2681Just three people? I ask. How is that possible?
2682
2683"Have you ever heard of the long-lines guard frequency? Do you know about
2684stacking tandems with 17 and 2600? Well, I'd advise you to find out about it.
2685I'm not gonna tell you. But whatever you do, don't let this get into the hands
2686of the radical underground."
2687
2688(Later Gilbertson, the inventor, confessed that while he had always been
2689skeptical about the Captain's claim of the sabotage potential of trunk-tying
2690phone phreaks, he had recently heard certain demonstrations which convinced him
2691the Captain was not speaking idly. "I think it might take more than three
2692people, depending on how many machines like Captain Crunch's were available.
2693
2694 Page 48
2695
2696
2697
2698
2699 The Official Phreaker's Manual
2700
2701But even though the Captain sounds a little weird, he generally turns out to
2702know what he's talking about.")
2703
2704"You know," Captain Crunch continues in his admonitory tone, "you know the
2705younger phone phreaks call Moscow all the time. Suppose everybody were to call
2706Moscow. I'm no right-winger. But I value my life. I don't want the Commies
2707coming over and dropping a bomb on my head. That's why I say you've got to be
2708careful about who gets this information."
2709
2710The Captain suddenly shifts into a diatribe against those phone phreaks who
2711don't like the phone company.
2712
2713"They don't understand, but Ma Bell knows everything they do. Ma Bell knows.
2714Listen, is this line hot? I just heard someone tap in. I'm not paranoid, but
2715I can detect things like that. Well, even if it is, they know that I know that
2716they know that I have a bulk eraser. I'm very clean." The Captain pauses,
2717evidently torn between wanting to prove to the phone-company monitors that he
2718does nothing illegal, and the desire to impress Ma Bell with his prowess. "Ma
2719Bell knows how good I am. And I am quite good. I can detect reversals, tandem
2720switching, everything that goes on on a line. I have relative pitch now. Do
2721you know what that means? My ears are a $20,000 piece of equipment. With my
2722ears I can detect things they can't hear with their equipment. I've had
2723employment problems. I've lost jobs. But I want to show Ma Bell how good I
2724am. I don't want to screw her, I want to work for her. I want to do good for
2725her. I want to help her get rid of her flaws and become perfect. That's my
2726number-one goal in life now." The Captain concludes his warnings and tells me
2727he has to be going. "I've got a little action lined up for tonight," he
2728explains and hangs up.
2729
2730Before I hang up for the night, I call Joe Engressia back. He reports that his
2731tormentor has finally gone to sleep -- "He's not blind drunk, that's the way I
2732get, ahem, yes; but you might say he's in a drunken stupor." I make a date to
2733visit Joe in Memphis in two days.
2734
2735+-- End second file of four --+
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760 Page 49
2761
2762
2763
2764
2765 The Official Phreaker's Manual
2766
2767 ***** The AAG Proudly Presents The AAG Proudly Presents *****
2768 * *
2769 * +----------------------------------------------+ *
2770 * *
2771 * Secrets of the Little Blue Box *
2772 * *
2773 * by Ron Rosenbaum *
2774 * Typed by One Farad Cap/AAG *
2775 * *
2776 * -A story so incredible it may even make you *
2777 * feel sorry for the phone company- *
2778 * *
2779 * (Third of four files) *
2780 * *
2781 * +----------------------------------------------+ *
2782 * *
2783 ***** The AAG Proudly Presents The AAG Proudly Presents *****
2784
2785A Phone Phreak Call Takes Care of Business
2786
2787The next morning I attend a gathering of four phone phreaks in ----- (a
2788California suburb). The gathering takes place in a comfortable split-level
2789home in an upper-middle-class subdivision. Heaped on the kitchen table are the
2790portable cassette recorders, M-F cassettes, phone patches, and line ties of the
2791four phone phreaks present. On the kitchen counter next to the telephone is a
2792shoe-box-size blue box with thirteen large toggle switches for the tones. The
2793parents of the host phone phreak, Ralph, who is blind, stay in the living room
2794with their sighted children. They are not sure exactly what Ralph and his
2795friends do with the phone or if it's strictly legal, but he is blind and they
2796are pleased he has a hobby which keeps him busy.
2797
2798The group has been working at reestablishing the historic "2111" conference,
2799reopening some toll-free loops, and trying to discover the dimensions of what
2800seem to be new initiatives against phone phreaks by phone-company security
2801agents.
2802
2803It is not long before I get a chance to see, to hear, Randy at work. Randy is
2804known among the phone phreaks as perhaps the finest con man in the game. Randy
2805is blind. He is pale, soft and pear-shaped, he wears baggy pants and a wrinkly
2806nylon white sport shirt, pushes his head forward from hunched shoulders
2807somewhat like a turtle inching out of its shell. His eyes wander, crossing and
2808recrossing, and his forehead is somewhat pimply. He is only sixteen years
2809old.
2810
2811But when Randy starts speaking into a telephone mouthpiece his voice becomes so
2812stunningly authoritative it is necessary to look again to convince yourself it
2813comes from a chubby adolescent Randy. Imagine the voice of a crack oil-rig
2814foreman, a tough, sharp, weather-beaten Marlboro man of forty. Imagine the
2815voice of a brilliant performance-fund gunslinger explaining how he beats the
2816Dow Jones by thirty percent. Then imagine a voice that could make those two
2817
2818He is speaking to a switchman in Detroit. The phone company in Detroit had
2819closed up two toll-free loop pairs for no apparent reason, although heavy use
2820by phone phreaks all over the country may have been detected. Randy is telling
2821the switchman how to open up the loop and make it free again:
2822
2823"How are you, buddy. Yeah. I'm on the board in here in Tulsa, Oklahoma, and
2824
2825 Page 50
2826
2827
2828
2829
2830 The Official Phreaker's Manual
2831
2832we've been trying to run some tests on your loop-arounds and we find'em busied
2833out on both sides.... Yeah, we've been getting a 'BY' on them, what d'ya say,
2834can you drop cards on 'em? Do you have 08 on your number group? Oh that's
2835okay, we've had this trouble before, we may have to go after the circuit. Here
2836lemme give 'em to you: your frame is 05, vertical group 03, horizontal 5,
2837vertical file 3. Yeah, we'll hang on here.... Okay, found it? Good. Right,
2838yeah, we'd like to clear that busy out. Right. All you have to do is look for
2839your key on the mounting plate, it's in your miscellaneous trunk frame. Okay?
2840Right. Now pull your key from NOR over the LCT. Yeah. I don't know why that
2841happened, but we've been having trouble with that one. Okay. Thanks a lot
2842fella. Be seein' ya."
2843
2844Randy hangs up, reports that the switchman was a little inexperienced with the
2845loop-around circuits on the miscellaneous trunk frame, but that the loop has
2846been returned to its free-call status.
2847
2848Delighted, phone phreak Ed returns the pair of numbers to the active-status
2849column in his directory. Ed is a superb and painstaking researcher. With
2850almost Talmudic thoroughness he will trace tendrils of hints through soft-wired
2851mazes of intervening phone-company circuitry back through complex linkages of
2852switching relays to find the location and identity of just one toll-free loop.
2853He spends hours and hours, every day, doing this sort of thing. He has somehow
2854compiled a directory of eight hundred "Band-six in-WATS numbers" located in
2855over forty states. Band-six in-WATS numbers are the big 800 numbers -- the
2856ones that can be dialed into free from anywhere in the country.
2857
2858Ed the researcher, a nineteen-year-old engineering student, is also a superb
2859technician. He put together his own working blue box from scratch at age
2860seventeen. (He is sighted.) This evening after distributing the latest issue
2861of his in-WATS directory (which has been typed into Braille for the blind phone
2862phreaks), he announces he has made a major new breakthrough:
2863
2864"I finally tested it and it works, perfectly. I've got this switching matrix
2865which converts any touch-tone phone into an M-F-er."
2866
2867The tones you hear in touch-tone phones are not the M-F tones that operate the
2868long-distance switching system. Phone phreaks believe A.T.&T. had deliberately
2869equipped touch tones with a different set of frequencies to avoid putting the
2870six master M-F tones in the hands of every touch-tone owner. Ed's complex
2871switching matrix puts the six master tones, in effect put a blue box, in the
2872hands of every touch-tone owner.
2873
2874Ed shows me pages of schematics, specifications and parts lists. "It's not easy
2875to build, but everything here is in the Heathkit catalog."
2876
2877Ed asks Ralph what progress he has made in his attempts to reestablish a
2878long-term open conference line for phone phreaks. The last big conference --
2879the historic "2111" conference -- had been arranged through an unused Telex
2880test-board trunk somewhere in the innards of a 4A switching machine in
2881Vancouver, Canada. For months phone phreaks could M-F their way into
2882Vancouver, beep out 604 (the Vancouver area code) and then beep out 2111 (the
2883internal phone-company code for Telex testing), and find themselves at any
2884time, day or night, on an open wire talking with an array of phone phreaks from
2885coast to coast, operators from Bermuda, Tokyo and London who are phone-phreak
2886sympathizers, and miscellaneous guests and technical experts. The conference
2887was a massive exchange of information. Phone phreaks picked each other's
2888brains clean, then developed new ways to pick the phone company's brains clean.
2889Ralph gave M F Boogies concerts with his home-entertainment-type electric
2890
2891 Page 51
2892
2893
2894
2895
2896 The Official Phreaker's Manual
2897
2898organ, Captain Crunch demonstrated his round-the-world prowess with his
2899notorious computerized unit and dropped leering hints of the "action" he was
2900getting with his girl friends. (The Captain lives out or pretends to live out
2901several kinds of fantasies to the gossipy delight of the blind phone phreaks
2902who urge him on to further triumphs on behalf of all of them.) The somewhat
2903rowdy Northwest phone-phreak crowd let their bitter internal feud spill over
2904into the peaceable conference line, escalating shortly into guerrilla warfare;
2905Carl the East Coast international tone relations expert demonstrated newly
2906opened direct M-F routes to central offices on the island of Bahrein in the
2907Persian Gulf, introduced a new phone-phreak friend of his in Pretoria, and
2908explained the technical operation of the new Oakland-to Vietnam linkages.
2909(Many phone phreaks pick up spending money by M-F-ing calls from relatives to
2910Vietnam G.I.'s, charging $5 for a whole hour of trans-Pacific conversation.)
2911
2912Day and night the conference line was never dead. Blind phone phreaks all over
2913the country, lonely and isolated in homes filled with active sighted brothers
2914and sisters, or trapped with slow and unimaginative blind kids in straitjacket
2915schools for the blind, knew that no matter how late it got they could dial up
2916the conference and find instant electronic communion with two or three other
2917blind kids awake over on the other side of America. Talking together on a
2918phone hookup, the blind phone phreaks say, is not much different from being
2919there together. Physically, there was nothing more than a two-inch-square wafer
2920of titanium inside a vast machine on Vancouver Island. For the blind kids
2921>there< meant an exhilarating feeling of being in touch, through a kind of
2922skill and magic which was peculiarly their own.
2923
2924Last April 1, however, the long Vancouver Conference was shut off. The phone
2925phreaks knew it was coming. Vancouver was in the process of converting from a
2926step-by-step system to a 4A machine and the 2111 Telex circuit was to be wiped
2927out in the process. The phone phreaks learned the actual day on which the
2928conference would be erased about a week ahead of time over the phone company's
2929internal-news-and-shop-talk recording.
2930
2931For the next frantic seven days every phone phreak in America was on and off
2932the 2111 conference twenty-four hours a day. Phone phreaks who were just
2933learning the game or didn't have M-F capability were boosted up to the
2934conference by more experienced phreaks so they could get a glimpse of what it
2935was like before it disappeared. Top phone phreaks searched distant area codes
2936for new conference possibilities without success. Finally in the early morning
2937of April 1, the end came.
2938
2939"I could feel it coming a couple hours before midnight," Ralph remembers. "You
2940could feel something going on in the lines. Some static began showing up, then
2941some whistling wheezing sound. Then there were breaks. Some people got cut
2942off and called right back in, but after a while some people were finding they
2943were cut off and couldn't get back in at all. It was terrible. I lost it
2944about one a.m., but managed to slip in again and stay on until the thing
2945died... I think it was about four in the morning. There were four of us still
2946hanging on when the conference disappeared into nowhere for good. We all tried
2947to M-F up to it again of course, but we got silent termination. There was
2948nothing there."
2949
2950The Legendary Mark Bernay Turns Out To Be "The Midnight Skulker"
2951
2952Mark Bernay. I had come across that name before. It was on Gilbertson's
2953select list of phone phreaks. The California phone phreaks had spoken of a
2954mysterious Mark Bernay as perhaps the first and oldest phone phreak on the West
2955Coast. And in fact almost every phone phreak in the West can trace his origins
2956
2957 Page 52
2958
2959
2960
2961
2962 The Official Phreaker's Manual
2963
2964either directly to Mark Bernay or to a disciple of Mark Bernay.
2965
2966It seems that five years ago this Mark Bernay (a pseudonym he chose for
2967himself) began traveling up and down the West Coast pasting tiny stickers in
2968phone books all along his way. The stickers read something like "Want to hear
2969an interesting tape recording? Call these numbers." The numbers that followed
2970were toll-free loop-around pairs. When one of the curious called one of the
2971numbers he would hear a tape recording pre-hooked into the loop by Bernay which
2972explained the use of loop-around pairs, gave the numbers of several more, and
2973ended by telling the caller, "At six o'clock tonight this recording will stop
2974and you and your friends can try it out. Have fun."
2975
2976"I was disappointed by the response at first," Bernay told me, when I finally
2977reached him at one of his many numbers and he had dispensed with the usual "I
2978never do anything illegal" formalities which experienced phone phreaks open
2979most conversations.
2980
2981"I went all over the coast with these stickers not only on pay phones, but I'd
2982throw them in front of high schools in the middle of the night, I'd leave them
2983unobtrusively in candy stores, scatter them on main streets of small towns. At
2984first hardly anyone bothered to try it out. I would listen in for hours and
2985hours after six o'clock and no one came on. I couldn't figure out why people
2986wouldn't be interested. Finally these two girls in Oregon tried it out and
2987told all their friends and suddenly it began to spread."
2988
2989Before his Johny Appleseed trip Bernay had already gathered a sizable group of
2990early pre-blue-box phone phreaks together on loop-arounds in Los Angeles.
2991Bernay does not claim credit for the original discovery of the loop-around
2992numbers. He attributes the discovery to an eighteen-year-old reform school kid
2993in Long Beach whose name he forgets and who, he says, "just disappeared one
2994day." When Bernay himself discovered loop-arounds independently, from clues in
2995his readings in old issues of the Automatic Electric Technical Journal, he
2996found dozens of the reform-school kid's friends already using them. However, it
2997was one of Bernay's disciples in Seattle that introduced phone phreaking to
2998blind kids. The Seattle kid who learned about loops through Bernay's recording
2999told a blind friend, the blind kid taught the secret to his friends at a winter
3000camp for blind kids in Los Angeles. When the camp session was over these kids
3001took the secret back to towns all over the West. This is how the original
3002blind kids became phone phreaks. For them, for most phone phreaks in general,
3003it was the discovery of the possibilities of loop-arounds which led them on to
3004far more serious and sophisticated phone-phreak methods, and which gave them a
3005medium for sharing their discoveries.
3006
3007A year later a blind kid who moved back east brought the technique to a blind
3008kids' summer camp in Vermont, which spread it along the East Coast. All from a
3009Mark Bernay sticker.
3010
3011Bernay, who is nearly thirty years old now, got his start when he was fifteen
3012and his family moved into an L.A. suburb serviced by General Telephone and
3013Electronics equipment. He became fascinated with the differences between Bell
3014and G.T.&E. equipment. He learned he could make interesting things happen by
3015carefully timed clicks with the disengage button. He learned to interpret
3016subtle differences in the array of clicks, whirrs and kachinks he could hear on
3017his lines. He learned he could shift himself around the switching relays of
3018the L.A. area code in a not-too-predictable fashion by interspersing his own
3019hook-switch clicks with the clicks within the line. (Independent phone
3020companies -- there are nineteen hundred of them still left, most of them tiny
3021island principalities in Ma Bell's vast empire -- have always been favorites
3022
3023 Page 53
3024
3025
3026
3027
3028 The Official Phreaker's Manual
3029
3030with phone phreaks, first as learning tools, then as Archimedes platforms from
3031which to manipulate the huge Bell system. A phone phreak in Bell territory
3032will often M-F himself into an independent's switching system, with switching
3033idiosyncrasies which can give him marvelous leverage over the Bell System.
3034
3035"I have a real affection for Automatic Electric Equipment," Bernay told me.
3036"There are a lot of things you can play with. Things break down in interesting
3037ways."
3038
3039Shortly after Bernay graduated from college (with a double major in chemistry
3040and philosophy), he graduated from phreaking around with G.T.&E. to the Bell
3041System itself, and made his legendary sticker-pasting journey north along the
3042coast, settling finally in Northwest Pacific Bell territory. He discovered
3043that if Bell does not break down as interestingly as G.T.&E., it nevertheless
3044offers a lot of "things to play with."
3045
3046Bernay learned to play with blue boxes. He established his own personal
3047switchboard and phone-phreak research laboratory complex. He continued his
3048phone-phreak evangelism with ongoing sticker campaigns. He set up two recording
3049numbers, one with instructions for beginning phone phreaks, the other with
3050latest news and technical developments (along with some advanced instruction)
3051gathered from sources all over the country.
3052
3053These days, Bernay told me, he had gone beyond phone-phreaking itself. "Lately
3054I've been enjoying playing with computers more than playing with phones. My
3055personal thing in computers is just like with phones, I guess -- the kick is in
3056finding out how to beat the system, how to get at things I'm not supposed to
3057know about, how to do things with the system that I'm not supposed to be able
3058to do."
3059
3060As a matter of fact, Bernay told me, he had just been fired from his
3061computer-programming job for doing things he was not supposed to be able to do.
3062he had been working with a huge time-sharing computer owned by a large
3063corporation but shared by many others. Access to the computer was limited to
3064those programmers and corporations that had been assigned certain passwords.
3065And each password restricted its user to access to only the one section of the
3066computer cordoned off from its own information storager. The password system
3067prevented companies and individuals from stealing each other's information.
3068
3069"I figured out how to write a program that would let me read everyone else's
3070password," Bernay reports. "I began playing around with passwords. I began
3071letting the people who used the computer know, in subtle ways, that I knew
3072their passwords. I began dropping notes to the computer supervisors with hints
3073that I knew what I know. I signed them 'The Midnight Skulker.' I kept getting
3074cleverer and cleverer with my messages and devising ways of showing them what I
3075could do. I'm sure they couldn't imagine I could do the things I was showing
3076them. But they never responded to me. Every once in a while they'd change the
3077passwords, but I found out how to discover what the new ones were, and I let
3078them know. But they never responded directly to the Midnight Skulker. I even
3079finally designed a program which they could use to prevent my program from
3080finding out what it did. In effect I told them how to wipe me out, The
3081Midnight Skulker. It was a very clever program. I started leaving clues about
3082myself. I wanted them to try and use it and then try to come up with something
3083to get around that and reappear again. But they wouldn't play. I wanted to
3084get caught. I mean I didn't want to get caught personally, but I wanted them
3085to notice me and admit that they noticed me. I wanted them to attempt to
3086respond, maybe in some interesting way."
3087
3088
3089 Page 54
3090
3091
3092
3093
3094 The Official Phreaker's Manual
3095
3096Finally the computer managers became concerned enough about the threat of
3097information-stealing to respond. However, instead of using The Midnight
3098Skulker's own elegant self-destruct program, they called in their security
3099personnel, interrogated everyone, found an informer to identify Bernay as The
3100Midnight Skulker, and fired him.
3101
3102"At first the security people advised the company to hire me full-time to
3103search out other flaws and discover other computer freaks. I might have liked
3104that. But I probably would have turned into a double double agent rather than
3105the double agent they wanted. I might have resurrected The Midnight Skulker
3106and tried to catch myself. Who knows? Anyway, the higher-ups turned the whole
3107idea down."
3108
3109You Can Tap the F.B.I.'s Crime Control Computer in the Comfort of Your Own
3110Home, Perhaps
3111
3112Computer freaking may be the wave of the future. It suits the phone-phreak
3113sensibility perfectly. Gilbertson, the blue-box inventor and a lifelong phone
3114phreak, has also gone on from phone-phreaking to computer-freaking. Before he
3115got into the blue-box business Gilbertson, who is a highly skilled programmer,
3116devised programs for international currency arbitrage.
3117
3118But he began playing with computers in earnest when he learned he could use his
3119blue box in tandem with the computer terminal installed in his apartment by the
3120instrumentation firm he worked for. The print-out terminal and keyboard was
3121equipped with acoustical coupling, so that by coupling his little ivory
3122Princess phone to the terminal and then coupling his blue box on that, he could
3123M-F his way into other computers with complete anonymity, and without charge;
3124program and re-program them at will; feed them false or misleading information;
3125tap and steal from them. He explained to me that he taps computers by busying
3126out all the lines, then going into a verification trunk, listening into the
3127passwords and instructions one of the time sharers uses, and them M-F-ing in
3128and imitating them. He believes it would not be impossible to creep into the
3129F.B.I's crime control computer through a local police computer terminal and
3130phreak around with the F.B.I.'s memory banks. He claims he has succeeded in
3131re-programming a certain huge institutional computer in such a way that it has
3132cordoned off an entire section of its circuitry for his personal use, and at
3133the same time conceals that arrangement from anyone else's notice. I have been
3134unable to verify this claim.
3135
3136Like Captain Crunch, like Alexander Graham Bell (pseudonym of a
3137disgruntled-looking East Coast engineer who claims to have invented the black
3138box and now sells black and blue boxes to gamblers and radical heavies), like
3139most phone phreaks, Gilbertson began his career trying to rip off pay phones as
3140a teenager. Figure them out, then rip them off. Getting his dime back from
3141the pay phone is the phone phreak's first thrilling rite of passage. After
3142learning the usual eighteen different ways of getting his dime back, Gilbertson
3143learned how to make master keys to coin-phone cash boxes, and get everyone
3144else's dimes back. He stole some phone-company equipment and put together his
3145own home switchboard with it. He learned to make a simple "bread-box" device,
3146of the kind used by bookies in the Thirties (bookie gives a number to his
3147betting clients; the phone with that number is installed in some widow lady's
3148apartment, but is rigged to ring in the bookie's shop across town, cops trace
3149big betting number and find nothing but the widow).
3150
3151Not long after that afternoon in 1968 when, deep in the stacks of an
3152engineering library, he came across a technical journal with the phone tone
3153frequencies and rushed off to make his first blue box, not long after that
3154
3155 Page 55
3156
3157
3158
3159
3160 The Official Phreaker's Manual
3161
3162Gilbertson abandoned a very promising career in physical chemistry and began
3163selling blue boxes for $1,500 apiece.
3164
3165"I had to leave physical chemistry. I just ran out of interesting things to
3166learn," he told me one evening. We had been talking in the apartment of the
3167man who served as the link between Gilbertson and the syndicate in arranging
3168the big $300,000 blue-box deal which fell through because of legal trouble.
3169There has been some smoking.
3170
3171"No more interesting things to learn," he continues. "Physical chemistry turns
3172out to be a sick subject when you take it to its highest level. I don't know.
3173I don't think I could explain to you how it's sick. You have to be there. But
3174you get, I don't know, a false feeling of omnipotence. I suppose it's like
3175phone-phreaking that way. This huge thing is there. This whole system. And
3176there are holes in it and you slip into them like Alice and you're pretending
3177you're doing something you're actually not, or at least it's no longer you
3178that's doing what you thought you were doing. It's all Lewis Carroll.
3179Physical chemistry and phone-phreaking. That's why you have these phone-phreak
3180pseudonyms like The Cheshire Cat, the Red King, and The Snark. But there's
3181something about phone-phreaking that you don't find in physical chemistry." He
3182looks up at me:
3183
3184"Did you ever steal anything?"
3185
3186
3187"Then you know! You know the rush you get. It's not just knowledge, like
3188physical chemistry. It's forbidden knowledge. You know. You can learn about
3189anything under the sun and be bored to death with it. But the idea that it's
3190illegal. Look: you can be small and mobile and smart and you're ripping off
3191somebody large and powerful and very dangerous."
3192
3193People like Gilbertson and Alexander Graham Bell are always talking about
3194ripping off the phone company and screwing Ma Bell. But if they were shown a
3195single button and told that by pushing it they could turn the entire circuitry
3196of A.T.&T. into molten puddles, they probably wouldn't push it. The
3197disgruntled-inventor phone phreak needs the phone system the way the lapsed
3198Catholic needs the Church, the way Satan needs a God, the way The Midnight
3199Skulker needed, more than anything else, response.
3200
3201Later that evening Gilbertson finished telling me how delighted he was at the
3202flood of blue boxes spreading throughout the country, how delighted he was to
3203know that "this time they're really screwed." He suddenly shifted gears.
3204
3205"Of course. I do have this love/hate thing about Ma Bell. In a way I almost
3206like the phone company. I guess I'd be very sad if they were to disintegrate.
3207In a way it's just that after having been so good they turn out to have these
3208things wrong with them. It's those flaws that allow me to get in and mess with
3209them, but I don't know. There's something about it that gets to you and makes
3210you want to get to it, you know."
3211
3212I ask him what happens when he runs out of interesting, forbidden things to
3213learn about the phone system.
3214
3215"I don't know, maybe I'd go to work for them for a while."
3216
3217"In security even?"
3218
3219
3220 Page 56
3221
3222
3223
3224
3225 The Official Phreaker's Manual
3226
3227"I'd do it, sure. I just as soon play -- I'd just as soon work on either
3228side."
3229
3230"Even figuring out how to trap phone phreaks? I said, recalling Mark Bernay's
3231game."
3232
3233"Yes, that might be interesting. Yes, I could figure out how to outwit the
3234phone phreaks. Of course if I got too good at it, it might become boring
3235again. Then I'd have to hope the phone phreaks got much better and outsmarted
3236me for a while. That would move the quality of the game up one level. I might
3237even have to help them out, you know, 'Well, kids, I wouldn't want this to get
3238around but did you ever think of -- ?' I could keep it going at higher and
3239higher levels forever."
3240
3241The dealer speaks up for the first time. He has been staring at the soft
3242blinking patterns of light and colors on the translucent tiled wall facing him.
3243(Actually there are no patterns: the color and illumination of every tile is
3244determined by a computerized random-number generator designed by Gilbertson
3245which insures that there can be no meaning to any sequence of events in the
3246tiles.)
3247
3248"Those are nice games you're talking about," says the dealer to his friend.
3249"But I wouldn't mind seeing them screwed. A telephone isn't private anymore.
3250You can't say anything you really want to say on a telephone or you have to go
3251through that paranoid bullshit. 'Is it cool to talk on the phone?' I mean,
3252even if it is cool, if you have to ask 'Is it cool,' then it isn't cool. You
3253know. 'Is it cool,' then it isn't cool. You know. Like those blind kids,
3254people are going to start putting together their own private telephone
3255companies if they want to really talk. And you know what else. You don't hear
3256silences on the phone anymore. They've got this time-sharing thing on
3257long-distance lines where you make a pause and they snip out that piece of time
3258and use it to carry part of somebody else's conversation. Instead of a pause,
3259where somebody's maybe breathing or sighing, you get this blank hole and you
3260only start hearing again when someone says a word and even the beginning of the
3261word is clipped off. Silences don't count -- you're paying for them, but they
3262take them away from you. It's not cool to talk and you can't hear someone when
3263they don't talk. What the hell good is the phone? I wouldn't mind seeing them
3264totally screwed."
3265
3266+-- End third file of four --+
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286 Page 57
3287
3288
3289
3290
3291 The Official Phreaker's Manual
3292
3293 ***** The AAG Proudly Presents The AAG Proudly Presents *****
3294 * *
3295 * +----------------------------------------------+ *
3296 * *
3297 * Secrets of the Little Blue Box *
3298 * *
3299 * by Ron Rosenbaum *
3300 * Typed by One Farad Cap/AAG *
3301 * *
3302 * -A story so incredible it may even make you *
3303 * feel sorry for the phone company- *
3304 * *
3305 * (Fourth of four files) *
3306 * *
3307 * +----------------------------------------------+ *
3308 * *
3309 ***** The AAG Proudly Presents The AAG Proudly Presents *****
3310
3311The Big Memphis Bust
3312
3313Joe Engressia never wanted to screw Ma Bell. His dream had always been to work
3314for her.
3315
3316The day I visited Joe in his small apartment on Union Avenue in Memphis, he was
3317upset about another setback in his application for a telephone job.
3318
3319"They're stalling on it. I got a letter today telling me they'd have to
3320postpone the interview I requested again. My landlord read it for me. They
3321gave me some runaround about wanting papers on my rehabilitation status but I
3322think there's something else going on."
3323
3324When I switched on the 40-watt bulb in Joe's room -- he sometimes forgets when
3325he has guests -- it looked as if there was enough telephone hardware to start a
3326small phone company of his own.
3327
3328There is one phone on top of his desk, one phone sitting in an open drawer
3329beneath the desk top. Next to the desk-top phone is a cigar-box-size M-F
3330device with big toggle switches, and next to that is some kind of switching and
3331coupling device with jacks and alligator plugs hanging loose. Next to that is
3332a Braille typewriter. On the floor next to the desk, lying upside down like a
3333dead tortoise, is the half-gutted body of an old black standard phone. Across
3334the room on a torn and dusty couch are two more phones, one of them a
3335touch-tone model; two tape recorders; a heap of phone patches and cassettes,
3336and a life-size toy telephone.
3337
3338Our conversation is interrupted every ten minutes by phone phreaks from all
3339over the country ringing Joe on just about every piece of equipment but the toy
3340phone and the Braille typewriter. One fourteen-year-old blind kid from
3341Connecticut calls up and tells Joe he's got a girl friend. He wants to talk to
3342Joe about girl friends. Joe says they'll talk later in the evening when they
3343can be alone on the line. Joe draws a deep breath, whistles him off the air
3344with an earsplitting 2600-cycle whistle. Joe is pleased to get the calls but he
3345looked worried and preoccupied that evening, his brow constantly furrowed over
3346his dark wandering eyes. In addition to the phone-company stall, he has just
3347learned that his apartment house is due to be demolished in sixty days for
3348urban renewal. For all its shabbiness, the Union Avenue apartment house has
3349been Joe's first home-of-his-own and he's worried that he may not find another
3350before this one is demolished.
3351
3352 Page 58
3353
3354
3355
3356
3357 The Official Phreaker's Manual
3358
3359
3360But what really bothers Joe is that switchmen haven't been listening to him.
3361"I've been doing some checking on 800 numbers lately, and I've discovered that
3362certain 800 numbers in New Hampshire couldn't be reached from Missouri and
3363Kansas. Now it may sound like a small thing, but I don't like to see sloppy
3364work; it makes me feel bad about the lines. So I've been calling up switching
3365offices and reporting it, but they haven't corrected it. I called them up for
3366the third time today and instead of checking they just got mad. Well, that
3367gets me mad. I mean, I do try to help them. There's something about them I
3368can't understand -- you want to help them and they just try to say you're
3369defrauding them."
3370
3371It is Sunday evening and Joe invites me to join him for dinner at a Holiday
3372Inn. Frequently on Sunday evening Joe takes some of his welfare money, calls a
3373cab, and treats himself to a steak dinner at one of Memphis' thirteen Holiday
3374Inns. (Memphis is the headquarters of Holiday Inn. Holiday Inns have been a
3375favorite for Joe ever since he made his first solo phone trip to a Bell
3376switching office in Jacksonville, Florida, and stayed in the Holiday Inn there.
3377He likes to stay at Holiday Inns, he explains, because they represent freedom
3378to him and because the rooms are arranged the same all over the country so he
3379knows that any Holiday Inn room is familiar territory to him. Just like any
3380telephone.)
3381
3382Over steaks in the Pinnacle Restaurant of the Holiday Inn Medical Center on
3383Madison Avenue in Memphis, Joe tells me the highlights of his life as a phone
3384phreak.
3385
3386At age seven, Joe learned his first phone trick. A mean baby-sitter, tired of
3387listening to little Joe play with the phone as he always did, constantly, put a
3388lock on the phone dial. "I got so mad. When there's a phone sitting there and
3389I can't use it... so I started getting mad and banging the receiver up and
3390down. I noticed I banged it once and it dialed one. Well, then I tried
3391banging it twice...." In a few minutes Joe learned how to dial by pressing the
3392hook switch at the right time. "I was so excited I remember going 'whoo whoo'
3393and beat a box down on the floor."
3394
3395At age eight Joe learned about whistling. "I was listening to some intercept
3396non working-number recording in L.A.- I was calling L.A. as far back as that,
3397but I'd mainly dial non working numbers because there was no charge, and I'd
3398listen to these recordings all day. Well, I was whistling 'cause listening to
3399these recordings can be boring after a while even if they are from L.A., and
3400all of a sudden, in the middle of whistling, the recording clicked off. I
3401fiddled around whistling some more, and the same thing happened. So I called
3402up the switch room and said, 'I'm Joe. I'm eight years old and I want to know
3403why when I whistle this tune the line clicks off.' He tried to explain it to
3404me, but it was a little too technical at the time. I went on learning. That
3405was a thing nobody was going to stop me from doing. The phones were my life,
3406and I was going to pay any price to keep on learning. I knew I could go to
3407jail. But I had to do what I had to do to keep on learning."
3408
3409The phone is ringing when we walk back into Joe's apartment on Union Avenue.
3410It is Captain Crunch. The Captain has been following me around by phone,
3411calling up everywhere I go with additional bits of advice and explanation for
3412me and whatever phone phreak I happen to be visiting. This time the Captain
3413reports he is calling from what he describes as "my hideaway high up in the
3414Sierra Nevada." He pulses out lusty salvos of M-F and tells Joe he is about to
3415"go out and get a little action tonight. Do some phreaking of another kind, if
3416you know what I mean." Joe chuckles.
3417
3418 Page 59
3419
3420
3421
3422
3423 The Official Phreaker's Manual
3424
3425
3426The Captain then tells me to make sure I understand that what he told me about
3427tying up the nation's phone lines was true, but that he and the phone phreaks
3428he knew never used the technique for sabotage. They only learned the technique
3429to help the phone company.
3430
3431"We do a lot of troubleshooting for them. Like this New Hampshire/Missouri
3432WATS-line flaw I've been screaming about. We help them more than they know."
3433
3434After we say good-bye to the Captain and Joe whistles him off the line, Joe
3435tells me about a disturbing dream he had the night before: "I had been caught
3436and they were taking me to a prison. It was a long trip. They were taking me
3437to a prison a long long way away. And we stopped at a Holiday Inn and it was
3438my last night ever using the phone and I was crying and crying, and the lady at
3439the Holiday Inn said, 'Gosh, honey, you should never be sad at a Holiday Inn.
3440You should always be happy here. Especially since it's your last night.' And
3441that just made it worse and I was sobbing so much I couldn't stand it."
3442
3443Two weeks after I left Joe Engressia's apartment, phone-company security agents
3444and Memphis police broke into it. Armed with a warrant, which they left pinned
3445to a wall, they confiscated every piece of equipment in the room, including his
3446toy telephone. Joe was placed under arrest and taken to the city jail where he
3447was forced to spend the night since he had no money and knew no one in Memphis
3448to call.
3449
3450It is not clear who told Joe what that night, but someone told him that the
3451phone company had an open-and-shut case against him because of revelations of
3452illegal activity he had made to a phone-company undercover agent.
3453
3454By morning Joe had become convinced that the reporter from Esquire, with whom
3455he had spoken two weeks ago, was the undercover agent. He probably had ugly
3456thoughts about someone he couldn't see gaining his confidence, listening to him
3457talk about his personal obsessions and dreams, while planning all the while to
3458lock him up.
3459
3460"I really thought he was a reporter," Engressia told the Memphis Press-Seminar.
3461"I told him everything...." Feeling betrayed, Joe proceeded to confess
3462everything to the press and police.
3463
3464As it turns out, the phone company did use an undercover agent to trap Joe,
3465although it was not the Esquire reporter.
3466
3467Ironically, security agents were alerted and began to compile a case against
3468Joe because of one of his acts of love for the system: Joe had called an
3469internal service department to report that he had located a group of defective
3470long-distance trunks, and to complain again about the New Hampshire/Missouri
3471WATS problem. Joe always liked Ma Bell's lines to be clean and responsive. A
3472suspicious switchman reported Joe to the security agents who discovered that
3473Joe had never had a long-distance call charged to his name.
3474
3475Then the security agents learned that Joe was planning one of his phone trips
3476to a local switching office. The security people planted one of their agents
3477in the switching office. He posed as a student switchman and followed Joe
3478around on a tour. He was extremely friendly and helpful to Joe, leading him
3479around the office by the arm. When the tour was over he offered Joe a ride back
3480to his apartment house. On the way he asked Joe -- one tech man to another --
3481about "those blue boxers" he'd heard about. Joe talked about them freely,
3482talked about his blue box freely, and about all the other things he could do
3483
3484 Page 60
3485
3486
3487
3488
3489 The Official Phreaker's Manual
3490
3491with the phones.
3492
3493The next day the phone-company security agents slapped a monitoring tape on
3494Joe's line, which eventually picked up an illegal call. Then they applied for
3495the search warrant and broke in.
3496
3497In court Joe pleaded not guilty to possession of a blue box and theft of
3498service. A sympathetic judge reduced the charges to malicious mischief and
3499found him guilty on that count, sentenced him to two thirty-day sentences to be
3500served concurrently and then suspended the sentence on condition that Joe
3501promise never to play with phones again. Joe promised, but the phone company
3502refused to restore his service. For two weeks after the trial Joe could not be
3503reached except through the pay phone at his apartment house, and the landlord
3504screened all calls for him.
3505
3506Phone-phreak Carl managed to get through to Joe after the trial, and reported
3507that Joe sounded crushed by the whole affair.
3508
3509"What I'm worried about," Carl told me, "is that Joe means it this time. The
3510promise. That he'll never phone-phreak again. That's what he told me, that
3511he's given up phone-phreaking for good. I mean his entire life. He says he
3512knows they're going to be watching him so closely for the rest of his life
3513he'll never be able to make a move without going straight to jail. He sounded
3514very broken up by the whole experience of being in jail. It was awful to hear
3515him talk that way. I don't know. I hope maybe he had to sound that way. Over
3516the phone, you know."
3517
3518He reports that the entire phone-phreak underground is up in arms over the
3519phone company's treatment of Joe. "All the while Joe had his hopes pinned on
3520his application for a phone-company job, they were stringing him along getting
3521ready to bust him. That gets me mad. Joe spent most of his time helping them
3522out. The bastards. They think they can use him as an example. All of sudden
3523they're harassing us on the coast. Agents are jumping up on our lines. They
3524just busted ------'s mute yesterday and ripped out his lines. But no matter
3525what Joe does, I don't think we're going to take this lying down."
3526
3527Two weeks later my phone rings and about eight phone phreaks in succession say
3528hello from about eight different places in the country, among them Carl, Ed,
3529and Captain Crunch. A nationwide phone-phreak conference line has been
3530reestablished through a switching machine in --------, with the cooperation of
3531a disgruntled switchman.
3532
3533"We have a special guest with us today," Carl tells me.
3534
3535The next voice I hear is Joe's. He reports happily that he has just moved to a
3536place called Millington, Tennessee, fifteen miles outside of Memphis, where he
3537has been hired as a telephone-set repairman by a small independent phone
3538company. Someday he hopes to be an equipment troubleshooter.
3539
3540"It's the kind of job I dreamed about. They found out about me from the
3541publicity surrounding the trial. Maybe Ma Bell did me a favor busting me.
3542I'll have telephones in my hands all day long."
3543
3544"You know the expression, 'Don't get mad, get even'?" phone-phreak Carl asked
3545me. "Well, I think they're going to be very sorry about what they did to Joe
3546and what they're trying to do to us."
3547
3548+-- End fourth file of four --+
3549
3550 Page 61
3551
3552
3553
3554
3555 The Official Phreaker's Manual
3556
3557 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
3558 $ $
3559 $ THE HISTORY OF ESS $
3560 $ --- ------- -- --- $
3561 $ $
3562 $ $
3563 $ Another original phile by: $
3564 $ $
3565 $ $
3566 $$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$$
3567 $ $
3568 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
3569
3570
3571 Of all the new 1960s wonders of telephone technology - satellites, ultra
3572modern Traffic Service Positions (TSPS) for operators, the picturephone, and so
3573on - the one that gave Bell Labs the most trouble, and unexpectedly became the
3574greatest development effort in Bell System's history, was the perfection of an
3575electronic switching system, or ESS.
3576
3577 It may be recalled that such a system was the specific end in view when the
3578project that had culminated in the invention of the transistor had been
3579launched back in the 1930s. After successful accomplishment of that planned
3580miracle in 1947-48, further delays were brought about by financial stringency
3581and the need for further development of the transistor itself. In the early
35821950s, a Labs team began serious work on electronic switching. As early as
35831955, Western Electric became involved when five engineers from the Hawthorne
3584works were assigned to collaborate with the Labs on the project. The president
3585of AT&T in 1956, wrote confidently, "At Bell Labs, development of the new
3586electronic switching system is going full speed ahead. We are sure this will
3587lead to many improvements in service and also to greater efficiency. The first
3588service trial will start in Morris, Ill., in 1959." Shortly thereafter, Kappel
3589said that the cost of the whole project would probably be $45 million.
3590
3591 But it gradually became apparent that the development of a commercially
3592usable electronic switching system -in effect, a computerized telephone
3593exchange - presented vastly greater technical problems than had been
3594anticipated, and that, accordingly, Bell Labs had vastly underestimated both
3595the time and the investment needed to do the job. The year 1959 passed without
3596the promised first trial at Morris, Illinois; it was finally made in November
35971960, and quickly showed how much more work remained to be done. As time
3598dragged on and costs mounted, there was a concern at AT&T and some-thing
3599approaching panic at Bell Labs. But the project had to go forward; by this
3600time the investment was too great to be sacrificed, and in any case, forward
3601projections of increased demand for telephone service indicated that within a
3602phew years a time would come when, without the quantum leap in speed and
3603flexibility that electronic switching would provide, the national network would
3604be unable to meet the demand. In November 1963, an all-electronic switching
3605system went into use at the Brown Engineering Company at Cocoa Beach, Florida.
3606But this was a small installation, essentially another test installation,
3607serving only a single company. Kappel's tone on the subject in the 1964 annual
3608report was, for him, an almost apologetic: "Electronic switching equipment must
3609be manufactured in volume to unprecedented standards of reliability.... To turn
3610out the equipment economically and with good speed, mass production methods
3611must be developed; but, at the same time, there can be no loss of precision..."
3612Another year and millions of dollars later, on May 30, 1965, the first
3613commercial electric central office was put into service at Succasunna, New
3614Jersey.
3615
3616 Page 62
3617
3618
3619
3620
3621 The Official Phreaker's Manual
3622
3623
3624 Even at Succasunna, only 200 of the town's 4,300 subscribers initially had
3625the benefit of electronic switching's added speed and additional services, such
3626as provision for three party conversations and automatic transfer of incoming
3627calls. But after that, ESS was on its way. In January 1966, the second
3628commercial installation, this one serving 2,900 telephones, went into service
3629in Chase, Maryland. By the end of 1967 there were additional ESS offices in
3630California, Connecticut, Minnesota, Georgia, New York, Florida, and
3631Pennsylvania; by the end of 1970 there were 120 offices serving 1.8 million
3632customers; and by 1974 there were 475 offices serving 5.6 million customers.
3633
3634 The difference between conventional switching and electronic switching is
3635the difference between "hardware" and "software"; in the former case,
3636maintenance is done on the spot, with screwdriver and pliers, while in the case
3637of electronic switching, it can be done remotely, by computer, from a central
3638point, making it possible to have only one or two technicians on duty at a time
3639at each switching center.
3640
3641 The development program, when the final figures were added up, was found to
3642have required a staggering four thousand man-years of work at Bell Labs and to
3643have cost not $45 million but $500 million!
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682 Page 63
3683
3684
3685
3686
3687 The Official Phreaker's Manual
3688
3689 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
3690 $ $
3691 $ THE HISTORY OF BRITISH PHREAKING $
3692 $ -=- -=-=-=- -- -=-=-=- -=-=-=-=- $
3693 $ $
3694 $ THE SECOND IN A SERIES OF $
3695 $ THE HISTORY OF.....PHILES $
3696 $ $
3697 $ WRITTEN AND UPLOADED BY: $
3698 $ $
3699 $$$$$$$$$$$$-=>LEX LUTHOR<=-$$$$$$$$$$$
3700 $ AND $
3701 $ THE LEGION OF DOOM! $
3702 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
3703
3704 NOTE: THE BRITISH POST OFFICE, IS THE U.S. EQUIVALENT OF MA BELL.
3705
3706 IN BRITAIN, PHREAKING GOES BACK TO THE EARLY FIFTIES, WHEN THE TECHNIQUE OF
3707'TOLL A DROP BACK' WAS DISCOVERED. TOLL A WAS AN EXCHANGE NEAR ST. PAULS
3708WHICH ROUTED CALLS BETWEEN LONDON AND NEARBY NON-LONDON EXCHANGES. THE TRICK
3709WAS TO DIAL AN UNALLOCATED NUMBER, AND THEN DEPRESS THE RECEIVER-REST FOR 1/2
3710SECOND. THIS FLASHING INITIATED THE 'CLEAR FORWARD' SIGNAL, LEAVING THE CALLER
3711WITH AN OPEN LINE INTO THE TOLL A EXCHANGE.THE COULD THEN DIAL 018, WHICH
3712FORWARDED HIM TO THE TRUNK EXCHANGE AT THAT TIME, THE FIRST LONG DISTANCE
3713EXCHANGE IN BRITAIN AND FOLLOW IT WITH THE CODE FOR THE DISTANT EXCHANGE TO
3714WHICH HE WOULD BE CONNECTED AT NO EXTRA CHARGE.
3715
3716 THE SIGNALS NEEDED TO CONTROL THE UK NETWORK TODAY WERE PUBLISHED IN THE
3717"INSTITUTION OF POST OFFICE ENGINEERS JOURNAL" AND REPRINTED IN THE SUNDAY
3718TIMES (15 OCT. 1972).
3719
3720 THE SIGNALLING SYSTEM THEY USE: SIGNALLING SYSTEM NO. 3 USES PAIRS OF
3721FREQUENCIES SELECTED FROM 6 TONES SEPARATED BY 120HZ. WITH THAT INFO, THE
3722PHREAKS MADE "BLEEPERS" OR AS THEY ARE CALLED HERE IN THE U.S. "BLUE BOX", BUT
3723THEY DO UTILIZE DIFFERENT MF TONES THEN THE U.S., THUS, YOUR U.S. BLUE BOX
3724THAT YOU SMUGGLED INTO THE UK WILL NOT WORK, UNLESS YOU CHANGE THE
3725FREQUENCIES.
3726
3727 IN THE EARLY SEVENTIES, A SIMPLER SYSTEM BASED ON DIFFERENT NUMBERS OF PULSES
3728WITH THE SAME FREQUENCY (2280HZ) WAS USED. FOR MORE INFO ON THAT, TRY TO GET A
3729HOLD OF: ATKINSON'S "TELEPHONY AND SYSTEMS TECHNOLOGY".
3730
3731 IN THE EARLY DAYS OF BRITISH PHREAKING, THE CAMBRIDGE UNIVERSITY TITAN
3732COMPUTER WAS USED TO RECORD AND CIRCULATE NUMBERS FOUND BY THE EXHAUSTIVE
3733DIALING OF LOCAL NETWORKS. THESE NUMBERS WERE USED TO CREATE A CHAIN OF LINKS
3734FROM LOCAL EXCHANGE TO LOCAL EXCHANGE ACROSS THE COUNTRY, BYPASSING THE TRUNK
3735CIRCUITS. BECAUSE THE INTERNAL ROUTING CODES IN THE UK NETWORK ARE NOT THE
3736SAME AS THOSE DIALED BY THE CALLER, THE PHREAKS HAD TO DISCOVER THEM BY 'PROBE
3737AND LISTEN' TECHNIQUES OR MORE COMMONLY KNOWN IN THE U.S.-- SCANNING. WHAT
3738THEY DID WAS PUT IN LIKELY SIGNALS AND LISTENED TO FIND OUT IF THEY SUCCEEDED.
3739THE RESULTS OF SCANNING WERE CIRCULATED TO OTHER PHREAKS. DISCOVERING EACH
3740OTHER TOOK TIME AT FIRST, BUT EVENTUALLY THE PHREAKS BECAME ORGANIZED. THE
3741"TAP" OF BRITAIN WAS CALLED "UNDERCURRENTS" WHICH ENABLED BRITISH PHREAKS TO
3742SHARE THE INFO ON NEW NUMBERS, EQUIPMENT ETC.
3743
3744 TO UNDERSTAND WHAT THE BRITISH BRITISH PHREAKS DID, THINK OF THE PHONE
3745NETWORK IN THREE LAYERS OF LINES: LOCAL, TRUNK, AND INTERNATIONAL.#IN THE UK,
3746SUBSCRIBER TRUNK DIALING (STD), IS THE MECHANISM WHICH TAKES A CALL FROM THE
3747
3748 Page 64
3749
3750
3751
3752
3753 The Official Phreaker's Manual
3754
3755LOCAL LINES AND (LEGITIMATELY) ELEVATES IT TO A TRUNK OR INTERNATIONAL
3756LEVEL.#THE UK PHREAKS FIGURED THAT A CALL AT TRUNK LEVEL CAN BE ROUTED THROUGH
3757ANY NUMBER OF EXCHANGES, PROVIDED THAT THE RIGHT ROUTING CODES WERE FOUND AND
3758USED CORRECTLY. THEY ALSO HAD TO DISCOVER HOW TO GET FROM LOCAL TO TRUNK LEVEL
3759EITHER WITHOUT BEING CHARGED (WHICH THEY DID WITH A BLEEPER BOX) OR WITHOUT
3760USING (STD). CHAINING HAS ALREADY BEEN MENTIONED BUT IT REQUIRES LONG STRINGS
3761OF DIGITS AND SPEECH GETS MORE AND MORE FAINT AS THE CHAIN GROWS, JUST LIKE IT
3762DOES WHEN YOU STACK TRUNKS BACK AND FORTH ACROSS THE U.S.#THE WAY THE SECURITY
3763REPS SNAGGED THE PHREAKS WAS TO PUT A SIMPLE 'PRINTERMETER' OR AS WE CALL IT:
3764A PEN REGISTER ON THE SUSPECTS LINE, WHICH SHOWS EVERY DIGIT DIALED FROM THE
3765SUBSCRIBERS LINE.
3766
3767 THE BRITISH PREFER TO GET ONTO THE TRUNKS RATHER THAN CHAINING. ONE WAY WAS
3768TO DISCOVER WHERE LOCAL CALLS USE THE TRUNKS BETWEEN NEIGHBORING EXCHANGES,
3769START A CALL AND STAY ON THE TRUNK INSTEAD OF RETURNING TO THE LOCAL LEVEL ON
3770REACHING THE DISTANT SWITCH. THIS AGAIN REQUIRED EXHAUSTIVE DIALING AND MADE
3771MORE WORK FOR TITAN; IT ALSO REVEALED 'FIDDLES', WHICH WERE INSERTED BY POST
3772OFFICE ENGINEERS.
3773
3774 WHAT FIDDLING MEANS IS THAT THE ENGINEERS REWIRED THE EXCHANGES FOR THEIR OWN
3775BENEFIT. THE EQUIPMENT IS MODIFIED TO GIVE ACCESS TO A TRUNK WITH OUT BEING
3776CHARGED, AN OPERATION WHICH IS PRETTY EASY IN STEP BY STEP (SXS)
3777ELECTROMECHANICAL EXCHANGES, WHICH WERE INSTALLED IN BRITAIN EVEN IN THE 1970S
3778(NOTE: I KNOW OF A BACK DOOR INTO THE CANADIAN SYSTEM ON A 4A CO., SO IF YOU
3779ARE ON SXS OR A 4A, TRY SCANNING 3 DIGIT EXCHANGES, IE: DIAL 999,998,997
3780ETC.#AND LISTEN FOR THE BEEP-KERCHINK, IF THERE ARE NO 3 DIGIT CODES WHICH
3781ALLOW DIRECT ACCESS TO A TANDEM IN YOUR LOCAL EXCHANGE AND BYPASSES THE AMA SO
3782YOU WON'T BE BILLED, NOT HAVE TO BLAST 2600 EVERY TIME YOU WISH TO BOX A CALL.
3783
3784 A FAMOUS BRITISH 'FIDDLER' REVEALED IN THE EARLY 1970S WORKED BY DIALING 173.
3785THE CALLER THEN ADDED THE TRUNK CODE OF 1 AND THE SUBSCRIBERS LOCAL NUMBER. AT
3786THAT TIME, MOST ENGINEERING TEST SERVICES BEGAN WITH 17X, SO THE ENGINEERS
3787COULD HIDE THEIR FIDDLES IN THE NEST OF SERVICE WIRES. WHEN SECURITY REPS
3788STARTED SEARCHING, THE FIDDLES WERE CONCEALED BY TONES SIGNALLING: 'NUMBER
3789UNOBTAINALBE' OR 'EQUIPMENT ENGAGED' WHICH SWITCHED OFF AFTER A DELAY. THE
3790NECESSARY RELAYS ARE SMALL AND EASILY HIDDEN.
3791
3792 THERE WAS ANOTHER SIDE TO PHREAKING IN THE UK IN THE SIXTIES. BEFORE STD WAS
3793WIDESPREAD, MANY 'ORDINARY' PEOPLE WERE DRIVEN TO.
3794
3795OCCASIONAL PHREAKING FROM SHEER FRUSTRATION AT THE INEFFICIENT OPERATOR
3796CONTROLLED TRUNK SYSTEM. THIS CAME TO A HEAD DURING A STRIKE ABOUT 1961 WHEN
3797OPERATORS COULD NOT BE REACHED. NOTHING COMPLICATED WAS NEEDED. MANY
3798OPERATORS HAD BEEN IN THE HABIT OF REPEATING THE CODES AS THEY DIALLED THE
3799REQUESTED NUMBERS SO PEOPLE SOON LEARNT THE NUMBERS THEY CALLED FREQUENTLY.
3800THE ONLY 'TRICK' WAS TO KNOW WHICH EXCHANGES COULD BE DIALLED THROUGH TO PASS
3801ON THE TRUNK NUMBER.CALLERS ALSO NEEDED A PRETTY QUIET PLACE TO DO IT, SINCE
3802TIMING RELATIVE TO CLICKS WAS IMPORTANT THE MOST FAMOUS TRIAL OF BRITISH
3803PHREAKS WAS CALLED THE OLD BAILY TRIAL.#WHICH STARTED ON 3 OCT. 1973.#WHAT
3804THEY PHREAKS DID WAS TO DIAL A SPARE NUMBER AT A LOCAL CALL RATE BUT INVOLVING
3805A TRUNK TO ANOTHER EXCHANGE THEN THEY SEND A 'CLEAR FORWARD' TO THEIR LOCAL
3806EXCHANGE, INDICATING TO IT THAT THE CALL IS FINISHED;BUT THE DISTANT EXCHANGE
3807DOESN'T REALIZE BECAUSE THE CALLER'S PHONE IS STILL OFF THE HOOK. THEY NOW
3808HAVE AN OPEN LINE INTO THE DISTANT TRUNK EXCHANGE AND SENDS TO IT A 'SEIZE'
3809SIGNAL: '1' WHICH PUTS HIM ONTO ITS OUTGOING LINES NOW, IF THEY KNOW THE
3810CODES, THE WORLD IS OPEN TO THEM. ALL OTHER EXCHANGES TRUST HIS LOCAL EXCHANGE
3811TO HANDLE THE BILLING; THEY JUST INTERPRET THE TONES THEY HEAR. MEAN WHILE,
3812THE LOCAL EXCHANGE COLLECTS ONLY FOR A LOCAL CALL. THE INVESTIGATORS
3813
3814 Page 65
3815
3816
3817
3818
3819 The Official Phreaker's Manual
3820
3821DISCOVERED THE PHREAKS HOLDING A CONFERENCE SOMEWHERE IN ENGLAND SURROUNDED BY
3822VARIOUS PHONE EQUIPMENT AND BLEEPER BOXES, ALSO PRINTOUTS LISTING 'SECRET' POST
3823OFFICE CODES. (THEY PROBABLY GOT THEM FROM TRASHING?) THE JUDGE SAID: "SOME
3824TAKE TO HEROIN, SOME TAKE TO TELEPHONES" FOR THEM PHONE PHREAKING WAS NOT A
3825CRIME BUT A HOBBY TO BE SHARED WITH PHELLOW ENTHUSIASTS AND DISCUSSED WITH THE
3826POST OFFICE OPENLY OVER DINNER AND BY MAIL. THEIR APPROACH AND ATTITUDE TO THE
3827WORLDS LARGEST COMPUTER, THE GLOBAL TELEPHONE SYSTEM, WAS THAT OF SCIENTISTS
3828CONDUCTING EXPERIMENTS OR PROGRAMMERS AND ENGINEERS TESTING PROGRAMS AND
3829SYSTEMS. THE JUDGE APPEARED TO AGREE, AND EVEN ASKED THEM FOR PHREAKING CODES
3830TO USE FROM HIS LOCAL EXCHANGE!!!
3831
3832# $-THE END-$
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880 Page 66
3881
3882
3883
3884
3885 The Official Phreaker's Manual
3886
3887 Bad as Shit
3888
3889 Recently, a telephone fanatic in the northwest made an interesting
3890discovery. He was exploring the 804 area code (Virginia) and found out that
3891the 840 exchange did something strange.
3892 In the vast majority of cases, in fact in all of the cases except one, he
3893would get a recording as if the exchange didn't exist. However, if he dialed
3894804-840 and four rather predictable numbers, he got a ring!
3895
3896 After one or two rings, somebody picked up. Being experienced at this kind
3897of thing, he could tell that the call didn't "supe", that is, no charges were
3898being incurred for calling this number.
3899 (Calls that get you to an error message, or a special operator, generally
3900don't supervise.) A female voice, with a hint of a Southern accent said,
3901"Operator, can I help you?"
3902
3903 "Yes," he said, "What number have I reached?"
3904
3905 "What number did you dial, sir?"
3906
3907 He made up a number that was similar.
3908
3909 "I'm sorry that is not the number you reached." Click.
3910
3911 He was fascinated. What in the world was this? He knew he was going to
3912call back, but before he did, he tried some more experiments. He tried the 840
3913exchange in several other area codes. In some, it came up as a valid exchange.
3914In others, exactly the same thing happened -- the same last four digits, the
3915same Southern belle. Oddly enough, he later noticed, the areas worked in
3916seemed to travel in a beeline from Washington DC to Pittsburgh, PA.
3917
3918 He called back from a payphone. "Operator, can I help you?"
3919
3920 "Yes, this is the phone company. I'm testing this line and we don't seem to
3921have an identification on your circuit. What office is this, please?"
3922
3923 "What number are you trying to reach?"
3924
3925 "I'm not trying to reach any number. I'm trying to identify this circuit."
3926
3927 "I'm sorry, I can't help you."
3928
3929 "Ma'am, if I don't get an ID on this line, I'll have to disconnect it. We
3930show no record of it here."
3931
3932 "Hold on a moment, sir."
3933
3934 After about a minute, she came back. "Sir, I can have someone speak to you.
3935Would you give me your number, please?"
3936
3937 He had anticipated this and he had the payphone number ready. After he gave
3938it, she said, "Mr. XXX will get right back to you."
3939
3940 "Thanks." He hung up the phone. It rang. INSTANTLY! "Oh my God," he
3941thought, "They weren't asking for my number -- they were confirming it!"
3942
3943 "Hello," he said, trying to sound authoritative.
3944
3945
3946 Page 67
3947
3948
3949
3950
3951 The Official Phreaker's Manual
3952
3953 "This is Mr. XXX. Did you just make an inquiry to my office concerning a
3954phone number?"
3955
3956 "Yes. I need an identi--"
3957
3958 "What you need is advice. Don't ever call that number again. Forget you
3959ever knew it."
3960
3961 At this point our friend got so nervous he just hung up. He expected to
3962hear the phone ring again but it didn't.
3963
3964 Over the next few days he racked his brains trying to figure out what the
3965number was. He knew it was something big -- that was pretty certain at this
3966point. It was so big that the number was programmed into every central office
3967in the country. He knew this because if he tried to dial any other number in
3968that exchange, he'd get a local error message from his CO, as if the exchange
3969didn't exist.
3970
3971 It finally came to him. He had an uncle who worked in a federal agency. He
3972had a feeling that this was government related and if it was, his uncle could
3973probably find out what it was. He asked the next day and his uncle promised to
3974look into the matter.
3975
3976 The next time he saw his uncle, he noticed a big change in his manner. He
3977was trembling. "Where did you get that number?!" he shouted. "Do you know I
3978almost got fired for asking about it?!? They kept wanting to know where I got
3979it."
3980
3981 Our friend couldn't contain his excitement. "What is it?" he pleaded.
3982"What's the number?!"
3983
3984"IT'S THE PRESIDENT'S BOMB SHELTER!"
3985
3986 He never called the number after that. He knew that he could probably cause
3987quite a bit of excitement by calling the number and saying something like, "The
3988weather's not good in Washington. We're coming over for a visit." But our
3989friend was smart. he knew that there were some things that were better off
3990unsaid and undone. <>
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004From @UICVM.uic.edu:TK0JUT2@NIU Tue Jun 12 06:40:26 1990
4005
4006
4007
4008
4009
4010
4011
4012
4013 Page 68
4014
4015
4016
4017
4018 The Official Phreaker's Manual
4019
4020 Chapter 3
4021
4022 This chapter is really just a bunch of FACS (pun intended). Here is where
4023random facts that really have something to do with everything else but nothing
4024to do with anything else, are presented. They cover various topics such as:
4025Conferencing, Tracing, Pen registers, Calling cards, and some basic FMF (Fool
4026the Mother Fuckers). The aspects covered here are very brief and could easily
4027be covered much more thoroughly, but it is no problem since they are not very
4028important topics. Something that would make a very nice gift is covered in the
4029article AT&T forgery. Just make up stationary with AT&T letter head and give
4030it as a present to your phriends who would appreciate it.
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079 Page 69
4080
4081
4082
4083
4084 The Official Phreaker's Manual
4085
4086 Phreaking COSMOS
4087 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4088
4089 COSMOS is Bell's computer for handling information on customer lines,
4090special services on lines, and orders to change line equipment, disconnect
4091lines, etc. COSMOS stands for Computerized System for Mainframe Operations. It
4092is based on the UNIX operating system and, depending upon the COSMOS and upon
4093your access, has some, many, or no UNIX standard commands. COSMOS is powerful,
4094but there is no reason to be afraid of it. This article will give some of the
4095basic, pertinent info on how users get in, account format, and a few other
4096goodies.
4097
4098 Password Identification
4099 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4100
4101 To get onto COSMOS you need a dialup, account, password, and wire center
4102(WC). Wire centers are two letter codes that tell what section of the COSMOS
4103you are in. There are different WC's f or different areas and groups of
4104exchanges. Examples are PB, SR, LK, et c. Sometimes there are accounts that
4105have no password; obviously such accounts are the easiest to hack.
4106
4107 Checking It Out
4108 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4109
4110 Let's suppose you have a COSMOS number which you obtained one way or
4111another. The first thing to do would be to make sure it is really a COSMOS
4112system, not some other Bell or AT&T computer. To do this, you would call it
4113and connect your modem,, then hit some returns until you got a response. It
4114should say:
4115
4116 ';LOGIN:' or 'NAME:'.
4117 If you enter some garbage it should say:
4118'PASSWORD:'.
4119 If you hit a return and it says 'WC?', it is a COSMOS system. If it says
4120something like 'TA%' then you're in business. If it doesn't do any of the
4121above, then it is either some other kind of system, or, if you're not getting
4122anything at all, the dialup has probably gone bad.
4123
4124 Getting In
4125 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4126
4127 COSMOS has certain accounts that are usually on the system, one of which
4128might not have a password. They consist of ROOT (most powerful and almost
4129always on the system), SYS (second most powerful, still many privileges), BIN
4130(a little less power), PREOP (a little less), and COSMOS (hardly any
4131privileges, like a normal user). The way to tell if they have passwords is by
4132entering accounts at the ';LOGIN:' or ' NAME:' prompt, and if it jumps straight
4133to 'WC?', all you need is a WC to get in. But suppose all of the accounts have
4134passwords? You have two choices. You can try to hack the password and WC to
4135one of the above accounts. I won't deal with this method, as is
4136self-explanatory. Or you can do something I find much easier...call the
4137COSMOS during business hours and hope that someone forgot to log off. Keep
4138calling until when you connect and hit return until you get a 'WC%' prompt.
4139'WC' is the WC that the account you found is currently in. You are now in!
4140
4141 What to Do while on-line
4142 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4143
4144
4145 Page 70
4146
4147
4148
4149
4150 The Official Phreaker's Manual
4151
4152 The first thing you want to do is write down the WC you are in. Only on our
4153first login it is a good idea to print everything or dump everything to a
4154buffer.
4155
4156 Commands
4157 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4158'WCFLDS'(!) : Should list all WC's.
4159'WHO' : Should print everyone currently logged on the system, giving
4160some accounts.
4161'TTY' : Tells what terminal port you are on.
4162'WHERE' : Should tell the location of the COSMOS installation.
4163'WHAT' : Tells what version of COSNIX, COSMOS's operating system, it
4164is.
4165'LS *' : Prints all the files you have access to.
4166'CD /dir' : Connects you to the directory '/dir'.
4167'CAT filename ' : Prints the file 'filename'.
4168'Q' : Quits the editor.
4169CTRL- Y. : Logs off
4170'TAT' : Sometimes prints a little help file.
4171'ISH' : Check someone's telefone #, type 'ISH' at the COSMOS 'WC%'
4172prompt. Then type.
4173'HTN XXX-XXXX' : (Hunt Telephone Number) to tell you about the local number
4174you are interested in.
4175
4176'CAT /ETC/PASSWD': Prints out the password file, if you have access. The
4177passwords are almost always encrypted, but you get a list of all the accounts.
4178If you are lucky, one of the lines will have two colons after the account name.
4179This means there is no prompt from the ';LOGIN:' or 'NAME:' prompts when you
4180enter that account.
4181
4182To run a file just type the name followed by a return.
4183
4184 When the system gives you a '-', you type a '.', and it will type all kinds
4185of info on the phone number you entered (in Bell abbreviations, of course). If
4186it is not a good exchange, it will say something to that effect. You type a
4187period to end the ISH.
4188 If you wish to learn more information about COSMOS, find yourself a COSMOS
4189manual or look at future issues of 2600. A UNIX manual would also be helpful
4190for standard UNIX commands.
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211 Page 71
4212
4213
4214
4215
4216 The Official Phreaker's Manual
4217
4218 FACS FACTS
4219 A LOOK AT THE NEW FACS SYSTEMS
4220 BY SHARP RAZOR
4221
4222
4223 BELL ATLANTIC (AND PROBABLY THE REST OF THE U.S. SOON ENOUGH) IS REVAMPING
4224COSMOS. THE PROJECT IS CALLED FACS (FACILITATED ASSIGNMENT AND CONTROL
4225SYSTEM).FACS IS COMPOSED OF 5 MODULES WHICH ARE DESIGNED TO FUNCTION AS A
4226UNIFIED SYSTEM. THE PREMIS AND THE COSMOS SYSTEMS CAN FUNCTION AS ST AND-ALONE
4227SYSTEMS.THE FIVE PARTS OF FACS ARE PREMIS,SOAC, LFACS,COSMOS,AND THE WM.
4228
4229 THE PREMIS (PREMISES INFORMATION SYSTEM) SUPPORTS BOTH RESIDENCE AND
4230BUSINESS ACCOUNTS. PREMIS IS USED FOR VARIOUS INQUIRIES FOR THE STREET ADDRESS
4231GUIDE(SAG),IE::PHONE NUMBERS,BILLING CHARGES,CREDIT,ETC.
4232
4233 THE SECOND PART OF FACS IS THE SOAC(SERVICE ORDER ANALYSIS AND CONTROL).
4234THIS IS PRIMARILY USED TO INPUT SERVICE ORDER DATA INTO FACS, AND TO GET THE
4235APPROPRIATE OUTPUT. SOAC INTERPRETS, VALIDATES,AND DECOMPOSES ALL INPUTED DATA
4236AND SENDS THE INFO TO THE COSMOS AND THE LFACS SYSTEMS.
4237
4238 THE THIRD PART OF THE SYSTEM IS LFACS(LOOP FACILITIES AND CONTROL SYSTEM).
4239THIS IS THE COMPONENT OF FACS THAT IS RESPONSIBLE FOR MAINTAINING THE
4240INVENTORY,DOING THE ASSIGNMENTS, ADMINISTRATING INQUIRIES AND REPORTS, AND IS
4241THE INVENTORY TRANSFORMATION CENTER. THIS PART OF FACS WILL BE MOSTLY USED FOR
4242AIDING THE AT&T LINEMEN.
4243
4244 THE COSMOS SYSTEM(COMPUTER SYSTEM FOR MAINFRAME OPERATIONS) COMPRISES THE
4245FOURTH PART OF THE FACS SYSTEM. COSMOS IS THE COMPONENT OF FACS THAT IS
4246RESPONSIBLE FOR MAINTAINING THE MECHANIZED INVENTORY OF MDF FACILITIES,STORING
4247CUSTOM CALL FEATURES(IE:SPEED DIALING NUMBERS),AND OTHER MISC. INFO.
4248
4249 THE FIFTH AND LAST PIECE OF THE FACS SYSTEM IS THE WORK MANAGER (WM). HIS
4250COMPONENT SERVES AS THE FRONT-END PROCESSOR FOR COSMOS. IT ENABLES A NUMBER OF
4251COSMOS COMPUTERS TO RELIABLY COMMUNICATE WITH THE OTHER FACS COMPONENTS. WM
4252SERVES AS THE MESSAGES SWITCHING SYSTEM FOR THE FACS PIECES, AND GENERALLY IS
4253THE "MESSENGER AND STABILIZER" OF THE SYSTEM.
4254
4255 THE HARDWARE THAT WILL RUN THIS FACS SYSTEM IS:
4256 COSMOS: 22-WECO. 3B-20S MINI COMPS.
4257 WM: 6-WECO. 3B-20S MINI COMPS.
4258 SOAC-LFACS-PREMIS: TWO SPERRY UNIVAC 1100/92 MAINFRAMES.
4259 BANCS 2 THP CYBER 1000 PROCESSORS.
4260
4261 THE FACS SYSTEM IS STARTING UP AT THIS VERY MOMENT. THIS IS BASICALLY A
4262BROAD VIEW OF THE FACS SYSTEM. AT&T SEEMS TO THINK THAT FACS WILL BE MORE
4263EFFICIENT,SAVE THEM MONEY IN THE LONG RUN, AND SAVE THEM WORKERS(HERE COME SOME
4264MASSIVE LAYOFFS!) WHAT THIS MEANS TO PHREAKERS AND HACKERS IS THAT YOU WILL NOW
4265HAVE AT LEAST FIVE DIAL-UPS IN AN AREA CODE WITH WHICH YOU CAN PHUCK WITH
4266AT&T!
4267
4268 ..LATER..
4269 ..SHARP RAZOR>>
4270 THE LEGION OF DOOM!
4271(NOTE: THE FACS SYSTEM HAS RECENTLY BEEN PUT INTO OPERATION(SUMMER 84) IN
4272ST.LOUIS MISSOURI)
4273
4274
4275
4276
4277 Page 72
4278
4279
4280
4281
4282 The Official Phreaker's Manual
4283
4284 Telenet
4285
4286 It seems that not many of you know that Telenet is connected to about 80
4287computer-networks in the world. No, I don't mean 80 nodes, but 80 networks with
4288thousands of unprotected computers. When you call your local Telenet- gateway,
4289you can only call those computers which accept reverse-charging- calls.
4290 If you want to call computers in foreign countries or computers in USA which
4291do not accept R-calls, you need a Telenet-ID. Did you ever notice that you can
4292type ID XXXX when being connected to Telenet? You are then asked for the
4293password. If you have such a NUI (Network-User-ID) you can call nearly every
4294host connected to any computer-network in the world. Here are some examples:
4295
4296026245400090184 :Is a VAX in Germany (Username: DATEXP and leave mail for
4297CHRIS !!!)
42980311050500061 :Is the Los Alamos Integrated computing network (One of the
4299hosts connected to it is the DNA (Defense Nuclear Agency)!!!)
43000530197000016 :Is a BBS in New Zealand
4301024050256 :Is the S-E-Bank in Stockholm, Sweden (Login as GAMES !!!)
430202284681140541 :CERN in Geneva in Switzerland (one of the biggest nuclear
4303research centers in the world) Login as GUEST
43040234212301161 :A Videotex-standard system. Type OPTEL to get in and use the
4305ID 999_ with the password 9_
43060242211000001 :University of Oslo in Norway (Type LOGIN 17,17 to play the
4307Multi-User-Dungeon !)
43080425130000215 :Something like ITT Dialcom, but this one is in Israel ! ID
4309HELP with password HELP works fine with security level 3
43100310600584401 :Is the Washington Post News Service via Tymnet (Yes, Tymnet is
4311connected to Telenet, too !) ID and Password is: PETER You can read the news
4312of the next day !
4313
4314The prefixes are as follows:
431502624 is Datex-P in Germany
431602342 is PSS in England
431703110 is Telenet in USA
431803106 is Tymnet in USA
431902405 is Telepak in Sweden
432004251 is Isranet in Israel
432102080 is Transpac in France
432202284 is Telepac in Switzerland
432302724 is Eirpac in Ireland
432402704 is Luxpac in Luxembourg
432505252 is Telepac in Singapore
432604408 is Venus-P in Japan
4327...and so on... Some of the countries have more than one
4328packet-switching-network (USA has 11, Canada has 3, etc).
4329
4330OK. That should be enough for the moment. As you see most of the passwords are
4331very simple. This is because they must not have any fear of hackers. Only a few
4332German hackers use these networks. Most of the computers are absolutely easy to
4333hack !!! So, try to find out some Telenet-ID's and leave them here. If you need
4334more numbers, leave e-mail.
4335I'm calling from Germany via the German Datex-P network, which is similar to
4336Telenet. We have a lot of those NUI's for the German network, but none for a
4337special Tymnet-outdial-computer in USA, which connects me to any phone #.
4338
4339CUL8R, Mad Max
4340
4341PS: Call 026245621040000 and type ID INF300 with password DATACOM to get more
4342
4343 Page 73
4344
4345
4346
4347
4348 The Official Phreaker's Manual
4349
4350Informations on packet-switching-networks !
4351
4352PS2: The new password for the Washington Post is KING !!!!
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379
4380
4381
4382
4383
4384
4385
4386
4387
4388
4389
4390
4391
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404
4405
4406
4407
4408
4409 Page 74
4410
4411
4412
4413
4414 The Official Phreaker's Manual
4415
4416 Phreaking AT&T Cards
4417 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
4418
4419 My topic will deal with using an AT&T calling card for automated calls. Ok
4420to place a call with an AT&T card, lift the handset (PAY PHONE) hit (0) and the
4421desired area code and the number to call. Also when calling the same number
4422that the card is being billed to you enter the phone number and at the tone
4423only enter the last four digits on the card. But we don't want to do that now,
4424do we. If additional calls are wanted all you do is hit the (#) and you will
4425get a new dial tone! After you hit (#) you do not have to re-enter the calling
4426card number simply enter your desired number and it will connect you.
4427 If the number you called is busy just keep hitting (#) and the number to be
4428called until you connect! Ok to calL the U.S. of a from another country, you
4429use the exact same format as described above!
4430 Ok now I will describe the procedure for placing calls to a foreign
4431country, such as CANADA,RUSSIA,SOUTH AMERICA, etc.. Ok first lift the handset
4432then enter (01) + the country code + the city code + the local telephone
4433number. Ok after you get the tone enter the AT&T calling card number. Ok if you
4434can not dial operator assisted calls from your area don't worry just jingle the
4435operator and she will handle your call, don't worry she can't see you!
4436 The international number on the AT&T calling card is used for calling the
4437US of A from places like RUSSIA, CHINA you never know when you might get stuck
4438in a country like those and you have no money to make a call! The international
4439operator will be able to tell you if they honor the AT&T calling card.
4440 Well I hope that this has straightened out some of your problems on the use
4441of an AT&T calling card! All you have to remember is that weather you are
4442placing the call or the operator, be careful and never use the calling card
4443from your home phone!! That is a BIG NO NO..
4444
4445 Also AT&T has came out with a new thing called (NEW CARD CALLER SERVICE)
4446they say that it was designed to meet the public's needs! These phones will be
4447popping up in many place such as airport terminals, hotels, etc... What the new
4448card caller service is, is a new type of phone that has a (CRT) screen that
4449will talk to you in a language of your choice. The service works something
4450like this, when you find a (NEW CARD CALLER PHONE), all you do is follow the
4451instructions on the (CRT) screen, then you insert the (NEW CARD CALLER CARD)
4452and there is a strip of magnetic tape on the card which reads the number, thus
4453no one can hear you saying your number or if there were a bug in the phone,no
4454touch tones will be heard!! You can also bill the call to a third party. that
4455is one that I am not totally clear on yet! The phone is supposed to tell you
4456how it can be done. That is after you have inserted your card and lifted the
4457receiver!
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475 Page 75
4476
4477
4478
4479
4480 The Official Phreaker's Manual
4481
4482 :%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%:
4483 :% %:
4484 :% AT&T FORGERY %:
4485 :% Written by The Blue Buccaneer %:
4486 :% %:
4487 :% CALL THE EVERLASTING SPEED DEMON BBS AT (415) 522-3074 %:
4488 :% Uploaded by Elric of Imrryr of Lunatic Labs UnLtd %:
4489 :%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%:
4490
4491
4492Here is a very simple way to either:
4493
4494[1] Play an incredibly cruel and realistic joke on a phreaking friend.
4495 -OR-
4496[2] Provide yourself with everything you ever wanted to be an AT&T person.
4497
4498 All you need to do is get your hands on some AT&T paper and/or business
4499cards. To do this you can either go down to your local business office and
4500swipe a few or call up somewhere like WATTS INFORMATION and ask them to send
4501you their information package. They will send you:
45021. A nice letter (with the AT&T logo letterhead) saying "Here is the info."
45032. A business card (again with AT&T) saying who the sales representative is.
45043. A very nice color booklet telling you all about WATTS lines.
45054. Various billing information. (Discard as it is very worthless)
4506
4507 Now take the piece of AT&T paper and the AT&T business card down to your
4508local print/copy shop. Tell them to run you off several copies of each, but to
4509leave out whatever else is printed on the business card/letter. If they refuse
4510or ask why, take your precious business elsewhere.
4511(This should only cost you around $2.00 total)
4512
4513 Now take the copies home and either with your typewriter, MAC, or Fontrix,
4514add whatever name, address, telephone number, etc. you like. (I would recommend
4515just changing the name on the card and using whatever information was on there
4516earlier)
4517
4518 And there you have official AT&T letters and business cards. As mentioned
4519earlier, you can use them in several ways. Mail a nice letter to someone you
4520hate (on AT&T paper..hehehe) saying that AT&T is onto them or something like
4521that. (Be sure to use correct English and spelling) (Also do not hand write
4522the letter! Use a typewriter! - Not Fontrix as AT&T doesn't use OLD ENGLISH or
4523ASCII BOLD when they type letters. Any IBM typewriter will do perfectly)
4524
4525 Another possible use (of many, I guess) is (if you are old enough to look
4526the part) to use the business card as some sort of fake id.
4527
4528 The last example of uses for the fake AT&T letters & b.cards is mentioned in
4529my textfile, BASIC RADIO CALLING. Briefly, send the station a letter that
4530reads:
4531 WCAT - FM202: (Like my examples? Haha!)
4532(As you probably know, radio stations give away things by accepting the 'x'
4533call. (ie: The tenth caller through wins a pair of Van Halen tickets) Sometimes
4534they may ask a trivia question, but that's your problem. Anyway, the letter
4535continues:)
4536 (You basically say that they have become so popular that they are getting too
4537many calls at once from listeners trying to win tickets. By asking them to
4538call all at the same time is overloading our systems. We do, of course, have
4539means of handling these sort of matters, but it would require you sending us a
4540
4541 Page 76
4542
4543
4544
4545
4546 The Official Phreaker's Manual
4547
4548schedule of when you will be asking your listeners to call in. That way we
4549would be able to set our systems to handle the amount of callers you get at
4550peak times..(etc..etc..more BS..But you get the idea, right?)
4551
4552Joseph Hakimout
4553AT&T Telecommunications
4554East Bumblefuck, Nowheresville 55555
4555
4556
4557 Ok, so it probably won't work (DJs just aren't that dumb, unless you really
4558do live in Nowheresville), but using AT&T paper and a business card might up
4559your chances some.
4560
4561 :-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607 Page 77
4608
4609
4610
4611
4612 The Official Phreaker's Manual
4613
4614 =><---------------------------------><=
4615 => A little something about <=
4616 => Your phone company <=
4617 =><---------------------------------><=
4618 => By Col. Hogan <=
4619 ========================================
4620
4621 Ever get an operator who gave you a hard time, and you didn't know
4622what to do? Well if the operator hears you use a little Bell jargon, she might
4623wise up. Here is a little diagram (excuse the artwork) of the structure of
4624operators
4625
4626/--------X /------X /-----X
4627!Operator!-- > ! S.A. ! --->! BOS !
4628X--------/ X------/ X-----/
4629 !
4630 !
4631 V
4632/-------------X
4633! Group Chief !
4634X-------------/
4635
4636 Now most of the operators are not bugged, so they can curse at you, if they
4637do ask INSTANTLY for the "S.A." or the Service Assistant. The operator does not
4638report to her (95% of them are hers) but they will solve most of your problems.
4639She MUST give you her name as she connects & all of these calls are bugged. If
4640the SA gives you a rough time get her BOS (Business Office Supervisor) on the
4641line. S/He will almost always back her girls up, but sometimes the SA will get
4642tarred and feathered. The operator reports to the Group Chief, and S/He will
4643solve 100% of your problems, but the chances of getting S/He on the line are
4644nill.
4645 If a lineman (the guy who works out on the poles) or an installation man
4646gives you the works ask to speak to the Installation Foreman, that works
4647wonders.
4648 Here is some other bell jargon, that might come in handy if you are having
4649trouble with the line. Or they can be used to lie your way out of
4650situations....
4651
4652 An Erling is a line busy for 1 hour, used mostly in traffic studies A
4653Permanent Signal is that terrible howling you get if you disconnect, but don't
4654hang up.
4655 Everyone knows what a busy signal is, but some idiots think that is the
4656*Actual* ringing of the phone, when it just is a tone "beeps" when the phone is
4657ringing, wouldn't bet on this though, it can (and does) get out of sync.
4658 When you get a busy signal that is 2 times as fast as the normal one, the
4659person you are trying to reach isn't really on the phone, (he might be), it is
4660actually the signal that a trunk line somewhere is busy and they haven't or
4661can't reroute your call. Sometimes you will get a Recording, or if you get
4662nothing at all (Left High & Dry in fone terms) all the recordings are being
4663used and the system is really overused, will probably go down in a little
4664while. This happened when Kennedy was shot, the system just couldn't handle the
4665calls. By the way this is called the "reorder signal" and the trunk line is
4666"blocked".
4667 One more thing, if an overseas call isn't completed and doesn't generate
4668any money for AT&T, is is called an "Air & Water Call".
4669
4670
4671
4672
4673 Page 78
4674
4675
4676
4677
4678 The Official Phreaker's Manual
4679
4680 [ESSENCE OF TELEPHONE CONFERENCING]
4681 [WRITTEN BY:]
4682 [FOREST RANGER]
4683
4684 TELEPHONE CONFERENCING IS AN EASY WAY OF GETTING MANY FRIENDS TOGETHER AT
4685ONCE. THIS CAN BE ACCOMPLISHED EASILY WITH LITTLE OR NO TROUBLE WHAT SO EVER.
4686THE TECHNIQUES THAT I WILL TEACH YOU DO NOT REQUIRE A BLUE BOX OR A TOUCH TONE
4687PHONE LINE. THE ONLY PREREQUISITE IS THAT YOU HAVE A PHONE THAT HAS A TONE
4688SWITCH ON IT OR HAVE A HOOKABLE TOUCH TONE KEYPAD. NOW, IF YOU ARE THE PARANOID
4689TYPE OF PERSON AND REFUSE TO USE YOUR OWN PHONE OUT OF YOUR HOUSE THEN HERE ARE
4690SOME SIMPLE WAYS OF GETTING CONFERENCES STARTED FROM ANOTHER PHONE. GO TO A
4691MALL OR A PLACE WHERE YOU KNOW THE PHONE IS BEING PAYED FOR BY THE BUSINESS IT
4692IS IN.
4693 NOW THERE ARE TWO TO CALL THE CONFERENCE OPERATOR; DIAL "0" TO GET YOUR
4694LOCAL OPERATOR SO SHE CAN PUT YOU THROUGH TO THE CONFERENCE OPERATOR OR DIAL
4695THE CONFERENCE OPERATOR DIRECTLY IF YOU HAVE THE NUMBER HANDY. THE SYSTEM YOU
4696WILL BE LINKED UP TO IS CALLED THE "ALLIANCE" SYSTEM. THERE ARE THREE BRANCHES;
46971000,2000,3000.
4698 NOW ONCE YOU HAVE GOTTEN THE CONFERENCE OPERATOR YOU TELL HER YOU WOULD
4699LIKE TO START A CONFERENCE AND YOU WOULD LIKE TO MAINTAIN CONTROL OF IT. SHE
4700WILL THEN PROCEED TO ASK YOU FOR YOUR NAME AND NUMBER. YOU WILL THEN GIVE HER A
4701FAKE NAME AND THE NUMBER OF THE PAY PHONE. SHE WILL HANG UP AND CALL YOU BACK
4702ONCE SHE HAS CHECKED THE NUMBER. THEY USUALLY DON'T REALIZE IT IS A PAYPHONE SO
4703DON'T THINK IT WON'T WORK! NOW ONCE THE OPERATOR HAS GIVEN YOU CONTROL YOU WILL
4704THEN PROCEED TO HACK MY VOICE PHONE AND PUT ME ON THE CONFERENCE.
4705 NOW, THE OTHER WAY OF STARTING A CONFERENCE IN WHICH YOU DON'T GET A LIVE
4706OPERATOR IS A "PBX". WITH THIS YOU WILL CALL A PBX NUMBER AND YOU WILL THEN
4707RECEIVE A RECORDING OF A BUSINESS OR OFFICE CO. THEN WHEN THE RECORDING IS OVER
4708YOU WILL HERE A BEEP...THEN AFTER ABOUT 10-30 SECONDS AFTER THE BEEP YOU WILL
4709GET A DIAL TONE ON THE ON THE END OF THE PBX. YOU WILL THEN TYPE THE PBX CODE
4710WHICH WILL THEN RESPOND WITH A RECORDING WELCOMING YOU TO THE CONFERENCING
4711NETWORK (WHICH WILL IN MOST IF NOT ALL BE THE "ALLIANCE" SYSTEM).
4712 IT WILL BE SELF EXPLANATORY FROM THERE. NOW IF YOU DON'T WISH TO CALL THE
4713CONFERENCE OPERATOR EITHER WAY ALREADY EXPLAINED THEN THERE IS A WAS OF GETTING
4714YOUR FRIENDS IN CONFERENCE. THIS IS DONE OVER A LOOP EXTENSION. NO ONE WILL
4715HAVE CONTROL, BUT YOU WILL STILL BE ON CONFERENCE. THIS IS CALLED THE SEVEN
4716LINE LOOP EXTENSION. THIS MEANS YOU CAN HAVE UP TO SEVEN MEMBERS, BUT THAT IS
4717IT! THE NUMBER IS IN LA, CA. 213-206-2820. THE LAST WAY I WILL EXPLAIN TO YOU
4718IF YOU ARE IN DESPERATE NEED OF A CONFERENCE IS TO GO TO PAY PHONE LIKE I
4719MENTIONED BEFORE ANY MAKE SURE SOME BUSINESS PAYS THE BILL FOR IT THEN CALL THE
4720CONFERENCE OPERATOR IN THE FASHIONS MENTIONED AND ASK THE CONFERENCE OPERATOR
4721TO PLACE CONFERENCE CALLS.
4722 THE WILL THEN ASK FOR THE NUMBERS OF THE PEOPLE TO PUT ON CONFERENCE, YOU
4723GIVE HER THE NUMBERS AND SHE WILL PUT YOU ALL ON CONFERENCE. WHEN YOU ARE DONE
4724YOU WILL HANG UP ON HER SO THERE WILL BE NO ONE IN CONTROL.THAT MEANS THE
4725CONFERENCE WILL BE BILLED TO THE PAYPHONE AND NO ONE CAN BE BLAMED FOR THE
4726CONFERENCE DUE TO NO ONE BEING IN CONTROL! ***NOTE*** THE CONFERENCE OPERATOR
4727WILL NOT BE ON WHILE YOU ARE ALL TALKING! REMEMBER THAT CONFERENCES ARE NOT
4728HARD AND IT IS VERY HARD TO GET ARRESTED ON ONE DUE TO WHAT I HAVE MENTIONED.
4729
4730 REMEMBER:REACH OUT AND PHREAK SOMEONE!
4731
4732
4733
4734[TELEPHONE CONFERENCE CONTROLS]
4735
4736 # - CONTROL MODE
4737 # - 6 PASSES CONTROL
4738
4739 Page 79
4740
4741
4742
4743
4744 The Official Phreaker's Manual
4745
4746 # - 1 + AREA CODE & NUMBER ADDS
4747 # - 9 SILENT MODE
4748 # - 7 GETS CONFERENCE OPERATOR
4749 * - ENDS CONFERENCE
4750
4751
4752 THE "#" IS THE CONTROL KEY ON YOUR CONFERENCES. WHEN YOU PASS CONTROL TO
4753SOMEONE ELSE HIT THE "#" THEN "6". WAIT FOR THE RECORDING TO SAY ENTER # OF
4754PERSON TO PASS CONTROL TO, THEN ENTER THE NUMBER OF THE PERSON YOU ARE GOING TO
4755GIVE CONTROL TO.
4756 TO ADD A PERSON ON TO THE CONFERENCE HIT "#" THEN "1","AREA CODE","NUMBER".
4757THEN WHEN THE PERSON ANSWERS WAIT FIVE SECONDS THEN HIT THE "#" TO ADD. IF YOU
4758ARE IN CONTROL OF THE CONFERENCE AND YOU WANT TO HEAR EVERYONE ELSE, BUT YOU DO
4759NOT WANT TO BE HEARD IT "#" THEN "9" THEN THE "#" TO REJOIN THE CONFERENCE.
4760REMEMBER AFTER ADDING SOMEONE ON OR PASSING CONTROL TO SOMEONE YOU MUST ALWAYS
4761HIT THE "#" TO REJOIN THE OTHERS ON CONFERENCE: PASSING CONTROL: "#","6", WAIT
4762FOR RECORDING TO SAY ENTER NUMBER OF PARTY TO GIVE CONTROL TO THEN ENTER NUMBER
4763AND HIT "#" TO REJOIN YOUR CONFERENCE.IF YOU EVER WANT TO GET A CONFERENCE
4764OPERATOR FOR SOME STRANGE REASON THEN HIT "#","7" AND WAIT FOR A CONFERENCE
4765OPERATOR TO CLICK ON. TO END A CONFERENCE HIT "*".
4766
4767 WITH HELP FROM: SILICON FALCON, SILVER CONDOR, AND THE ELIMINATOR.
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805 Page 80
4806
4807
4808
4809
4810 The Official Phreaker's Manual
4811
4812 Phone Tapping
4813
4814 HERE IS SOME INFO ON PHONE TAPS. I HAVE ENCLOSED A SCHEMATIC FOR A SIMPLE
4815WIRETAP & INSTRUCTIONS FOR HOOKING UP A TAPE RECORDER CONTROL RELAY TO THE
4816PHONE LINE.
4817 FIRST I'LL DISCUSS TAPS A LITTLE. THERE ARE MANY DIFFERENT TYPES OF TAPS.
4818THERE ARE TRANSMITTERS, WIRED TAPS AND INDUCTION TAPS TO NAME A FEW. WIRED AND
4819WIRELESS TRANSMITTERS MUST BE PHYSICALLY CONNECTED TO THE LINE BEFORE THEY'LL
4820DO ANY GOOD. ONCE A WIRELESS TAP IS CONNECTED TO THE LINE, IT CAN TRANSMIT ALL
4821CONVERSATIONS OVER A LIMITED RANGE. THE PHONES IN THE HOUSE CAN EVEN BE
4822MODIFIED TO PICK UP CONVERSATIONS IN THE ROOM & TRANSMIT THEM TOO! THESE TAPS
4823ARE USUALLY POWERED OFF THE PHONE LINE, BUT CAN HAVE AN EXTERNAL POWER SOURCE.
4824 WIRED TAPS, ON THE OTHER HAND, NEED NO POWER SOURCE, BUT A WIRE MUST BE
4825RUN FROM THE LINE TO THE LISTENER OR TO A TRANSMITTER. THERE ARE OBVIOUS
4826ADVANTAGES OF WIRELESS TAPS OVER WIRED ONES. THERE IS ONE TYPE OF WIRELESS TAP
4827THAT LOOKS LIKE A NORMAL TELEPHONE MIKE. ALL YOU HAVE TO DO IS REPLACE THE
4828ORIGINAL MIKE WITH THIS & IT'LL TRANSMIT ALL CONVERSATIONS!
4829 THERE IS AN EXOTIC TYPE OF WIRED TAP KNOWN AS THE 'INFINITY TRANSMITTER' OR
4830'HARMONICA BUG'. IN ORDER TO HOOK UP ONE OF THESE, YOU NEED ACCESS TO THE
4831TARGET TELEPHONE. IT HAS A TONE DECODER & SWITCH INSIDE. WHEN IT IS
4832INSTALLED, SOMEONE CALLS THE TAPPED PHONE & *BEFORE* IT RINGS, BLOWS A WHISTLE
4833OVER THE LINE. THE X-MITTER RECEIVES THE TONE & PICKS UP THE PHONE VIA A
4834RELAY. THE MIKE ON THE PHONE IS ACTIVATED SO THE CALLER CAN HEAR ALL
4835CONVERSATIONS IN THE ROOM.
4836 THERE IS A SWEEP TONE TEST AT 415/BUG-1111 WHICH CAN BE USED TO DETECT ON
4837OF THESE TAPS. IF ONE OF THESE IS ON YOUR LINE & THE TEST # SENDS THE CORRECT
4838TONE, YOU'LL HEAR A CLICK.
4839 INDUCTION TAPS HAVE ONE BIG ADVANTAGE OVER TAPS THAT MUST BE PHYSICALLY
4840WIRED TO THE PHONE. THEY DON'T HAVE TO BE TOUCHING THE PHONE IN ORDER TO PICK
4841UP THE CONVERSATION. THEY WORK ON THE SAME PRINCIPLE AS THE LITTLE SUCTION-CUP
4842TAPE RECORDER MIKES YOU CAN GET AT RADIO SHACK. INDUCTION MIKES CAN BE HOOKED
4843UP TO A TRANSMITTER OR BE WIRED. HERE IS AN EXAMPLE OF INDUSTRIAL ESPIONAGE
4844USING THE PHONE:
4845 A SALESMAN WALKS INTO AN OFFICE & MAKES A FONE CALL. HE FAKES THE
4846CONVERSATION, BUT WHEN HE HANGS UP HE SLIPS SOME FOAM-RUBBER CUBES UNDER THE
4847HANDSET, SO THE FONE IS STILL OFF THE HOOK. THE CALLED PARTY CAN STILL HEAR
4848ALL CONVERSATIONS IN THE ROOM. WHEN SOMEONE PICKS UP THE FONE, THE CUBES FALL
4849AWAY UNNOTICED.
4850 I USE A TAP ON MY LINE TO MONITOR WHAT AE-PRO IS DOING WHEN IT AUTO-DIALS,
4851SINCE IT DOESN'T TAKE ADVANTAGE OF THE HANDSET ON THE APPLE CAT II. I CAN ALSO
4852HOOK UP THE TAP TO A CASSETTE RECORDER OR AMPLIFIER. HERE IS THE SCHEMATIC:
4853
4854-------)!----)!(------------->
4855 )!(
4856 CAP ^ )!(
4857 )!(
4858 )!(
4859 )!(
4860 ^^^^^---)!(------------->
4861 ^ 100K
4862 !
4863 !<INPUT
4864
4865THE 100K POT IS USED FOR VOLUME. IT SHOULD BE ON ITS HIGHEST (LEAST
4866RESISTANCE) SETTING IF YOU HOOK A SPEAKER ACROSS THE OUTPUT, BUT IT SHOULD BE
4867SET ON ITS HIGHEST RESISTANCE FOR A TAPE RECORDER OR AMPLIFIER. YOU MAY FIND
4868IT NECESSARY TO ADD ANOTHER 10-40K. THE CAPACITOR SHOULD BE AROUND .47 MFD.
4869IT'S ONLY PURPOSE IS TO PREVENT THE RELAY IN THE CO FROM TRIPPING & THINKING
4870
4871 Page 81
4872
4873
4874
4875
4876 The Official Phreaker's Manual
4877
4878YOU HAVE THE FONE OFF THE HOOK. THE AUDIO OUTPUT TRANSFORMER AVAILABLE AT
4879RADIO SHACK (273-1380) IS FINE FOR THE X-FORMER. THE BLACK & GREEN ARE FINE FOR
4880INPUT & THE RED & WHITE GO TO THE OUTPUT DEVICE. YOU MAY WANT TO EXPERIMENT
4881WITH THE X-FORMER FOR THE BEST OUTPUT.
4882 HOOKING UP A TAPE RECORDER CONTROL RELAY IS EAST. JUST ONE OF THE FONE
4883WIRES (USU. RED) BEFORE THE TELEPHONES & HOOK ONE END TO ONE WIRE OF THE RELAY
4884& THE OTHER END TO THE OTHER RELAY WIRE. LIKE THIS:
4885
4886------^^^^^^^^^------------
4887 ---------
4888 RELAY^^
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937 Page 82
4938
4939
4940
4941
4942 The Official Phreaker's Manual
4943
4944 ############################################################
4945 # #
4946 # WIRETAPPING AND DIVESTITURE: A LINEMAN SPEAKS OUT #
4947 # BY THE KNIGHTS OF SHADOW #
4948 # [2600 - JANUARY 1985] #
4949 # #
4950 ############################################################
4951
4952 NEVER MISSING AN OPPORTUNITY FOR SOCIAL ENGINEERING, THE KID & CO. AND I
4953NATURALLY CARRIED ON A CONVERSATION WITH THE NEW JERSEY BELL FONE INSTALLER
4954WHEN HE CAME TO PUT IN MY MODEM LINE. THE CONVERSATION TURNED TO FONE TAPPING,
4955AND SEVERAL INTERESTING DETAILS CAME TO LIGHT. HE SWORE UP AND DOWN THAT BELL
4956HAD NOTHING TO DO WITH WIRE TAPPING. HE SAID THE SUPERVISOR RECEIVES SEALED
4957ORDERS FROM THE SHERIFF'S OFFICE, MERELY PASSING THEM ON TO THE LINEMEN. THEN
4958THE LINEMEN FOLLOW THE ORDERS TO GO UP ON THE POLES AND MARK THE PAIR IN THE
4959"CAN" THAT FIT THE FONE LINE IN QUESTION, AND THEN LEAVE THE SITE.
4960
4961 ONE DAY, OUR LINEMAN DROVE BACK BY THE POLE HE HAD MARKED EARLIER IN THE
4962DAY, AND SAW A BELL TRUCK. WONDERING WHO IT WAS, HE STOPPED TO ASK. THE GUY
4963)zYSTERY MAN AS ONE OF THE LINEMEN FOR THE AREA, HE
4964ASKED HIS SUPERVISOR WHO IT COULD HAVE BEEN. HIS SUPERVISOR CURTLY TOLD HIM TO
4965FORGET THE ENTIRE INCIDENT.
4966
4967 THE LINEMAN TOLD US THAT IN THE OLD DAYS THE TELCO AND THE PROSECUTOR'S
4968OFFICE WORKED HAND-IN-HAND. THEY WOULD LET THE AUTHORITIES RIGHT INTO THE CO
4969TO LISTEN IN ON CONVERSATIONS. BUT THIS ENDED AROUND 1973 WHEN SOMEONE SUED
4970JERSEY BELL BECAUSE OF THIS TOO CLOSE INTERACTION. THE TELCO THEN REALIZED
4971THAT THEY DIDN'T HAVE TO GO THAT FAR IN ORDER TO HELP THE POLICE. AFTER THIS
4972THEY GRADUALLY BROKE FROM THE CLOSE RELATIONSHIP. NOW THE FONE COMPANY MERELY
4973MARKS THE LINES, AND THE PROSECUTOR'S OFFICE HANDLES THE REST. HE ALSO SAID
4974THAT NOW THE POLICE SOMETIMES USE ULTRASONIC WAVES BOUNCED OFF OF WINDOW PANES
4975TO LISTEN TO SUSPECTS, REMOVING ALL CONTACT WITH THE FONE LINES. SINCE THE
4976PRESENCE OF A FONE COMPANY TRUCK MESSING WITH TELEPHONE WIRES IS TAKEN FOR
4977GRANTED BY THE GENERAL POPULACE, THE SHERIFF'S OFFICE ALSO HAS A COUPLE OF THEM
4978FOR UNDERCOVER WORK. SINCE THEY GOT THEM BACK IN THE GOOD OLD DAYS OF BELL
4979FRIENDLINESS, THE TRUCKS TEND TO BE THE OLDER MODELS, WITH OUTDATED GEAR. THE
4980LINEMAN TOLD US A SURE WAY TO IDENTIFY THE LOCAL POLICE'S TRUCKS: THEY HAVE
4981WOODEN LADDERS. NEW JERSEY BELL SWITCHED OVER TO PLASTIC ONES YEARS AGO.
4982
4983 CONTINUING THE DISCUSSION WITH THE LINEMAN, WE COVERED THE BREAKUP. NEW
4984JERSEY BELL NOW NO LONGER GIVES AS MUCH OVERTIME AS IT ONCE DID. THE LINEMAN
4985COMPLAINED THAT HIS STANDARD OF LIVING HAD GONE DOWN SINCE THE BREAKUP AS HE NO
4986LONGER HAS AS MUCH TAKE HOME PAY. THE BREAKUP HAS CAUSED A TOTAL SEVERING OF
4987TIES WITH AT&T. HE PROFESSED TOTAL IGNORANCE ABOUT LONG DISTANCE CALLING. HE
4988HAD ORIGINALLY GONE WITH AT&T, BUT DISLIKED FIXING PBX'S AND COMPUTER SYSTEMS.
4989AS SOON AS HE COULD, HE SWITCHED BACK TO THE LOCAL OPERATING COMPANY.
4990
4991 HE TOLD US ABOUT A TECHNICAL INSTITUTE WESTERN UNION WAS OPERATING
4992SOMEWHERE IN THE MIDWEST. HE HAD GONE THERE TO LEARN ABOUT THE VARIOUS TYPES
4993OF SWITCHING SYSTEMS. ON CAMPUS WAS A GIGANTIC, MULTI-STORY BUILDING SPLIT UP
4994INTO ROOMS APPROXIMATELY THE SIZE OF GYMNASIUMS. IN EACH WAS A FULLY
4995OPERATIONAL SCALE MODEL OF EACH OF THE VARIOUS SWITCHING SYSTEMS. WESTERN
4996ELECTRIC MANUFACTURES, INCLUDING ALL THE ESS AND CROSSBAR MACHINES, AS WELL AS
4997SOME STEP-BY-STEP, AND SEVERAL TYPES OF PBX'S. THEY TROUBLE-SHOT AND REPAIRED
4998PROBLEMS IN THESE MACHINES IN ORDER TO LEARN ABOUT ACTUAL OPERATING EQUIPMENT.
4999
5000 WE TALKED ABOUT THE LOCAL SWITCHING EQUIPMENT, WHICH TURNED OUT TO BE A
5001
5002 Page 83
5003
5004
5005
5006
5007 The Official Phreaker's Manual
5008
5009#1A ESS. ACCORDING TO HIM, SOON ALL THE LOCAL CO'S WILL BE RUN AUTOMATICALLY
5010FROM CENTRAL LOCATIONS CALLED "HUBS". THE "HUB" HANDLES ANY OVERLOAD BETWEEN
5011CENTRAL OFFICES THAT MIGHT CAUSE THE DREADED "GRIDLOCK" OF THE FONE SYSTEM. IF
5012THE INTEROFFICE SIGNALING LINES GET OVERLOADED, THE CALLS ARE REROUTED THROUGH
5013THE HUB. THE HUB ALSO SERVES AS A CENTRAL SPOT WHERE TROUBLES AT THE LOCAL CO
5014ARE HANDLED IN THE FIRST STAGES OF TROUBLE-SHOOTING. THE "HUB" CONCEPT IS
5015ALIVE AND WELL IN OUR LOCAL AREA, WITH #5 ESS, THE THIRD INSTALLED IN THE
5016ENTIRE NATION, RUNNING THE WHOLE OPERATION.
5017
5018 WHEN HE WAS GETTING READY TO LEAVE HE THANKED US FOR THE INTERESTING
5019CONVERSATION, AND WE WAVED AT HIM AS HE PULLED OUT. I NOW NOT ONLY HAD A NEW
5020FONE LINE, BUT ALSO A LOT OF USEFUL AND INTERESTING INFO, AS WELL AS THE
5021SATISFACTION OF A FRIENDLY CHAT.
5022
5023 THE LESSON IS CLEAR. WHENEVER A BELL EMPLOYEE VISITS YOUR HOUSE, FELL
5024PHREE TO ASK WHATEVER YOU WANT, WITHIN REASON. MOST ARE EXTREMELY WILLING TO
5025SHOOT THE BULL ABOUT ALMOST ANYTHING OF WHICH THEY HAVE KNOWLEDGE. AT FIRST,
5026MERELY JOKE WITH THEM LIGHTHEARTEDLY, IN ORDER TO GET THEM OFF THERE GUARD.
5027LEGIT QUESTIONS ASKABLE BY A NORMAL CUSTOMER, SUCH AS EQUAL ACCESS CUTOVERS,
5028WILL GET THEM ROLLING, LEAVING YOU TO DIRECT THE CONVERSATION WHEREVER YOU
5029LIKE. ASKING ABOUT THE BREAKUP AND HOW IT AFFECTED THEM IS A SURE FIRE WAY TO
5030GET THEM TALKING. QUESTIONS LIKE "HOW DOES THE FONE NETWORK WORK?" ALSO ARE
5031GOOD, ESPECIALLY IF YOU GUIDE THEM INTO THE DISCUSSION OF SWITCHING
5032TECHNOLOGY. MOST BELL EMPLOYEES ARE REALLY GLAD TO TALK TO SOMEONE. REMEMBER,
5033THEY USUALLY INTERACT WITH DISGRUNTLED CUSTOMERS WITH COMPLAINTS. THEIR
5034SPOUSES PROBABLY YELL AT THEM, AND THEIR SUPERVISORS EITHER COMPLAIN ABOUT
5035THEIR PERFORMANCE OR IGNORE THEM. SOCIETY AT LARGE JUST DOESN'T CARE ABOUT
5036THEM. THEY'RE MOST PROBABLY DISENCHANTED WITH THE WORLD AT LARGE, AND MAYBE
5037EVEN DISSATISFIED WITH THEIR JOBS. THE CHANCE TO TALK TO SOME ONE WHO MERELY
5038WANTS TO LISTEN TO WHAT THEY SAY IS A WELCOME CHANGE. THEY WILL TALK ON AND ON
5039ABOUT ALMOST ANYTHING, FROM TELECOMMUNICATIONS TO THEIR HOME LIFE AND THEIR
5040CHILDHOOD. THE POSSIBILITIES FOR SOCIAL ENGINEERING ARE ENDLESS. REMEMBER,
5041BELL EMPLOYEES ARE HUMANS, TOO. ALL YOU HAVE TO DO IS LISTEN.
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068 Page 84
5069
5070
5071
5072
5073 The Official Phreaker's Manual
5074
5075 [PEN REGISTERING AND TRACING]
5076
5077 [WRITTEN BY:]
5078
5079 [FOREST RANGER]
5080
5081
5082 PEN REGISTERING IS A SPECIAL DEVICE USED BY AT&T. THIS DEVICE DECIPHERS THE
5083TONES USED WHEN PHREAKING PHONE CALLS. THIS MEANS THAT EACH TONE KEY PRESSED IS
5084DECIPHERED IF YOU HAD A PEN REGISTER ON YOUR LINE OR WERE BEING TRACED WITH A
5085PEN REGISTER, EVERY PHONE NUMBER YOU DIALED WOULD BE KNOWN. THAT MEANS EVERY
5086TIME YOU WOULD PHREAK A NUMBER NOT ONLY WOULD THE ACCESS NUMBER BE RECORDED,
5087BUT THE CODE BEING USED AND WHERE YOU CALLED TO! SO IF YOU KNOW YOU HAVE A PEN
5088REGISTER ON YOUR LINE THEN I WOULD ADVISE YOU NOT TO PHREAK!
5089
5090 TRACING - THE FBI DOES NOT TRACE,THE POLICE DO NOT TRACE. THE PHONE CO.
5091TRACES. IF THE FBI WANTS A TRACE ON YOUR LINE THEY SIMPLY CALL THE PHONE CO.
5092THE FBI DOES NOT SIT UP ALL NIGHT TO LISTEN IN ON YOUR PHONE. THEY DON'T TRACE
5093FOR YEARS OR 6 MONTHS, BUT JUST FOR A FEW DAYS AT A TIME IF AT ALL. THE POLICE
5094TRACES THE SAME WAY. IT COSTS TOO MUCH MONEY TO TRACE ALL THE COMPUTER
5095PHREAKERS AND HACKERS, SO THEY MERELY PICK ON A SELECT FEW. SO TRACING ISN'T AS
5096DANGEROUS AS IT SEEMS! THE PEOPLE THAT TELL YOU DIFFERENT HAVE BEEN WATCHING
5097TOO MANY LATE NIGHT FILMS! SO DON'T GET TOO PARANOID IF YOU THINK YOU ARE BEING
5098TRACED DUE TO THE FACTS MENTIONED ABOVE!
5099
5100
5101FOREST RANGER
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134 Page 85
5135
5136
5137
5138
5139 The Official Phreaker's Manual
5140
5141 ==Phrack Inc.==
5142
5143 Volume One, Issue One, Phile #4 of 8
5144
5145 THE PHONE PHREAK'S FRY-UM GUIDE
5146
5147 COMPILED BY THE IRON SOLDIER
5148
5149 WITH HELP FROM DR. DOVE
5150
5151
5152NOTE: THIS GUIDE IS STILL BEING COMPILED, AND AS PHONE PHREAKS LEARN MORE IN
5153THE ART OF VENGEANCE IT WILL ALWAYS EXPAND.
5154
5155
5156"Vengeance is mine", says the Phreak.
5157
5158
5159METHOD 1-PHONE LINE PHUN
5160
5161Call up the business office. It should be listed at the front of the white
5162 "Hello, this is Mr. Korman, I'm moving to California and would like to
5163have my phone service disconnected. I'm at the airport now. I'm calling from
5164a payphone, my number is [414] 445 5005. You can send my final bill to:
5165(somewhere in California). Thank you."
5166
5167
5168METHOD 2-PHONE BOOKS
5169
5170Call up the business office from a pay phone. Say :
5171 "Hello, I'd like to order a Phone Book for Upper Volta (or any out-of-the
5172way area with Direct Dialing). This is Scott Korman, ship to 3119 N. 44th St.
5173Milwaukee, WI 53216. Yes, I under stand it will cost $xx($25-$75!!). Thank
5174you."
5175
5176
5177METHOD 3-PHONE CALLS
5178
5179Call up a PBX, enter the code and get an outside line. Then dial 0+ the number
5180desired to call. You will hear a bonk and then an operator. Say, "I'd like to
5181charge this to my home phone at 414-445-5005. Thank you." A friend and I did
5182this to a loser, I called him at 1:00 AM and we left the fone off the hook all
5183night. I calculated that it cost him $168.
5184
5185
5186METHOD 4-MISC SERVICES
5187
5188Call up the business office once again from a payfone. Say you'd like call
5189waiting, forwarding, 3 way, etc. Once again you are the famed loser Scott
5190Korman. He pays-you laugh. You don't know how funny it was talking to him,
5191and wondering what those clicks he kept hearing were.
5192
5193
5194METHOD 5-CHANGED & UNPUB
5195
5196Do the same as in #4, but say you'd like to change and unlist your (Scott's)
5197number. Anyone calling him will get:
5198
5199 Page 86
5200
5201
5202
5203
5204 The Official Phreaker's Manual
5205
5206 "BEW BEW BEEP. The number you have reached, 445-5005, has been changed to
5207a non-published number. No further....."
5208
5209
5210METHOD 6-FORWRDING
5211
5212 This required an accomplice or two or three. Around Christmas time, go to
5213Toys 'R' Us. Get everyone at the customer service or manager's desk away
5214("Hey, could you help me"). then you get on their phone and dial (usually dial
52159 first) and the business office again. This time, say you are from Toys 'R'
5216Us, and you'd like to add call forwarding to 445-5005. Scott will get 100-600
5217calls a day!!!
5218
5219
5220METHOD 7-RUSSIAN CALLER
5221
5222 Call a payphone at 10:00 PM. Say to the operator that you'd like to book a
5223call to Russia. Say you are calling from a payphone, and your number is that
5224of the loser to fry (e.g. 445-5005). She will say that she'll have to call ya
5225back in 5 hours, and you ok that. Meanwhile the loser (e.g.) Scott, will get a
5226call at 3:00 AM from an operator saying that the call he booked to Russia is
5227ready.
5228
5229
5230IF YOU HAVE ANY QUESTIONS LEAVE E-MAIL FOR ME ON ANY BOARD I'M ON.
5231The Iron Soldier
5232TSF-The Second Foundation!
5233
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252
5253
5254
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265 Page 87
5266
5267
5268
5269
5270 The Official Phreaker's Manual
5271
5272 INTERESTING THINGS TO DO
5273 ON STEP LINES
5274 ===================================
5275 IF YOU HAVE STEP LINES IN YOUR PREFIX, (A GOOD WAY OF CHECKING TO SEE IF YOU
5276HAVE STEP IS TO LOOK AT THE PAYPHONES AROUND YOUR HOUSE, IF THEY ARE ROTARY,
5277THEN YOU HAVE STEP, IF NOT, YOUR OUTTA LUCK.)
5278 FROM YOUR HOUSE DIAL "0", (THIS WILL NOT WORK AT A PAYPHONE). YOU WILL HEAR A
5279FEW "KERPLUNKS", IF YOU HIT THE HANG UP BUTTON WHEN THE SECOND-TO-THE-LAST
5280"KERPLUNK" IS HEARD THEN THE OPERATOR WILL GET ON AND BE VERY CONFUSED. (I WILL
5281TELL WHY SHE IS CONFUSED IN JUST A SECOND, BUT FOR NOW JUST....) SAY THAT YOU
5282ARE TRYING TO COMPLETE A CALL WHEN SHE GOT ON. SHE WILL ASK FOR THE NUMBER YOU
5283ARE TRYING TO CALL. TELL HER THE NUMBER (LONG DISTANCE OF COURSE), AND SHE WILL
5284ASK YOU FOR YOUR NUMBER, PICK A NUMBER OUT OF YOUR HEAD, (IT MUST BE IN YOUR
5285PREFIX THOUGH), AND TELL HER IT. SHE WILL BELIEVE YOU AND WILL CONNECT YOU WITH
5286THE CHARGES CHARGED TO THE NUMBER YOU SAID. (IF YOU DIDN'T HIT THE BUTTON AT
5287THE CORRECT TIME JUST TELL THE OPERATOR YOUR SORRY, YOU WERE TRYING TO DUST THE
5288PHONE OR SOME OTHER BULLSHIT LIKE THAT.)
5289 WHAT YOU DID WAS SCREW UP THE AUTOMATIC NUMBER FIND THAT WAS BUILT INTO THE
5290FIRST STEP LINES. THIS IS WHAT WOULD TELL THE OPERATOR YOUR NUMBER SO SHE COULD
5291BILL YOU IF SHE HAD TO COMPLETE A CALL FOR YOU. THE OPERATOR WILL GET SOME
5292GARBAGE ON HER SCREEN THAT IS SUPPOSED TO BE YOUR NUMBER, BUT SINCE YOU
5293INTERRUPTED THAT PROCESS, IT LOOKS REALLY BIZZARE.
5294 WHAT IS REALLY PHUN TO DO IS COMPLAIN TO THE OPERATOR THAT THIS IS THE THIRD
5295TIME TODAY THAT YOU HAVE NOT BEEN ABLE TO GET THROUGH AND SHE WILL GIVE YOU
5296SOME SOB STORY ABOUT "WE'RE SORRY, BUT WE'VE HAD A COMPUTER MALFUNCTION AND IT
5297IS BEING FIXED RIGHT NOW".
5298 I'M KINDA SURE THAT THE PHONE COMPANY KNOWS NOTHING OF THIS. THE WORST THING
5299THAT COULD HAPPEN IS YOU GET A CALL ASKING WHY YOU'VE HUNG UP ON THE OPERATOR
5300SO MANY TIMES, (IF YOU DID THIS ALOT, THAT IS). JUST GIVE THEM SOME BULLSHIT
5301ABOUT A BABY BROTHER JUST LEARNING HOW TO USE THE PHONE, OR SOMETHING LIKE
5302THAT.
5303
5304LIVE LONG AND DON'T GET CAUGHT,
5305AGRAJAG
5306 ===================================
5307 BROUGHT TO YOU BY:
5308 AGRAJAG AND
5309 -=%> THE HITCHHINKERS <%=-
5310 BRING YOUR TOWEL
5311
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327Private Sector BBS, police assumed that the sysop was involved in illegal
5328activities. Six other computers were also seized in this investigation,
5329including those of Store Manager [perhaps they mean Swap Shop Manager? -
5330Shark] who ran a BBS of his own, Beowolf, Red Barchetta, the Vampire, NJ Hack
5331Shack, sysop of the NJ Hack Shack BBS, and that of the sysop of the Treasure
5332Chest BBS.
5333
5334 Immediately after this action, members of 2600 contacted the media, who
5335were completely unaware of any of the raids. They began to bombard the
5336Middlesex County Prosecutor's Office with questions and a press conference was
5337announced for July 16. The system operator of the Private Sector BBS attempted
5338to attend along with reporters from 2600. They were effectively thrown off
5339the premises. Threats were made to charge them with trespassing and other
5340crimes. An officer who had at first received them civilly was threatened with
5341the loss of his job if he didn't get them removed promptly. Then the car was
5342chased out of the parking lot. Perhaps prosecutor Alan Rockoff was afraid that
5343he presence of some technically literate reporters would ruin the effect of his
5344press release on the public. As it happens, he didn't need our help.
5345
5346 The next day the details of the press conference were reported to the
5347public by the press. As Rockoff intended, paranoia about hackers ran rampant.
5348Headlines got as ridiculous as hackers ordering tank parts by telephone from
5349TRW and moving satellites with their home computers in order to make free phone
5350calls. These and even more exotic stories were reported by otherwise
5351respectable media sources. The news conference understandably made the front
5352page of most of the major newspapers in the US, and was a major news item as
5353far away as Australia and in the United Kingdom due to the sensationalism of
5354the claims. We will try to explain why these claims may have been made in this
5355issue.
5356
5357 On July 18 the operator of The Private Sector was formally charged
5358with"computer conspiracy" under the above law, and released in the custody of
5359his parents. The next day the American Civil Liberties Union took over his
5360defense. The ACLU commented that it would be very hard for Rockoff to prove a
5361conspiracy just "because the same information, construed by the prosecutor to
5362be illegal, appears on two bulletin boards." especially as Rockoff admitted
5363that "he did not believe any of the defendants knew each other." The ACLU
5364believes that the system operator's rights were violated, as he was assumed to
5365
5366 Page 89
5367
5368
5369
5370
5371 The Official Phreaker's Manual
5372
5373be involved in an illegal activity just because of other people under
5374investigation who happened to have posted messages on his board.
5375
5376 In another statement which seems to confirm Rockoff's belief in guilt by
5377association, he announced the next day that "630 people were being investigated
5378to determine if any used their computer equipment fraudulently." We believe
5379this is only the user list of the NJ Hack Shack, so the actual list of those to
5380be investigated may turn out to be almost 5 times that. The sheer overwhelming
5381difficulty of this task may kill this investigation, especially as they find
5382that many hackers simply leave false information. Computer hobbyists all
5383across the country have already been called by the Bound Brook, New Jersey
5384office of the FBI. They reported that the FBI agents used scare tactics in
5385order to force confessions or to provoke them into turning in others. We would
5386like to remind those who get called that there is nothing inherently wrong or
5387illegal in calling any ANY BBS, nor in talking about ANY activity. The FBI
5388would not comment on the case as it is an "ongoing investigation" and in the
5389hands of the local prosecutor. They will soon find that many on the Private
5390Sector BBS's user list are data processing managers, telecommunications
5391security people, and others who are interested in the subject of the BBS,
5392hardly the underground community of computer criminals depicted at the news
5393conference. The Private Sector BBS was a completely open BBS, and police and
5394security people were even invited on in order to participate. The BBS was far
5395from the "elite" type of underground telecom boards that Rockoff attempted to
5396portray.
5397
5398 Within two days, Rockoff took back almost all of the statements he had
5399made at the news conference, as AT&T and the DoD [Department of Defense -
5400Shark] discounted the claims he had made. He was understandably unable to find
5401real proof of Private Sector's alleged illegal activity, and was faced with
5402having to return the computer equipment with nothing to show for his effort.
5403Rockoff panicked, and on July 31, the system operator had a new charge against
5404him, "wiring up his computer as a blue box." Apparently this was referring to
5405his Novation Applecat modem which is capable of generating any hertz tone over
5406the phone line. By this stretch of imagination an Applecat could produce a
54072600 hertz tone as well as the MF which is necessary for "blue boxing."
5408However, each and every other owner of an Applecat or any other modem that can
5409generate its own tones therefore has also "wired up his computer as a blue box"
5410by merely installing the modem. This charge is so ridiculous that Rockoff
5411probably will never bother to press it. However, the wording of WIRING UP THE
5412COMPUTER gives rockoff an excuse to continue to hold onto the computer longer
5413in his futile search for illegal activity.
5414
5415 "We have requested that the prosecutors give us more specific
5416information," said Arthur Miller, the lawyer for The Private Sector. "The
5417charges are so vague that we can't really present a case at this point."
5418Miller will appear in court on August 16 to obtain this information. He is
5419also issuing a demand for the return of the equipment and, if the prosecutors
5420don't cooperate, will commence court proceedings against them. "They haven't
5421been pa::icularly cooperative," he said.
5422
5423 Rockoff probably will soon reconsider taking Private Sector's case to
5424court, as he will have to admit he just didn't know what he was doing when he
5425seized the BBS. The arrest warrant listed only "computer conspiracy" against
5426Private Sector, which is much more difficult to prosecute than the multitude of
5427charges against some of the other defendants, which include credit card fraud,
5428toll fraud, the unauthorized entry into computers, and numerous others.
5429
5430 Both Rockoff and the ACLU mentioned the Supreme Court in their press
5431
5432 Page 90
5433
5434
5435
5436
5437 The Official Phreaker's Manual
5438
5439releases, but he will assuredly take one of his stronger cases to test the new
5440New Jersey computer crime law. by seizing the BBS just because of supposed
5441activities discussed on it, Rockoff raises constitutional questions. Darrell
5442Paster, a lawyer who centers much of his work on computer crime, says the New
5443Jersey case is "just another example of local law enforcement getting on the
5444bandwagon of crime that has come into vogue to prosecute, and they have
5445proceeded with very little technical understanding, and in the process they
5446have abused many people's constitutional rights. What we have developing is a
5447mini witch hunt which is analogous to some of the arrests at day care centers,
5448where they sweep in and arrest everybody, ruin reputations, and then find that
5449there is only one or two guilty parties." We feel that law enforcement, not
5450understanding the information on the BBS, decided to strike first and ask
5451questions later.
5452
5453 2600 magazine and the sysops of the Private Sector BBS stand fully behind
5454the system operator. As soon as the equipment is returned, the BBS will go
5455back up. We ask all our readers to do their utmost to support us in our
5456efforts, and to educate as many of the public as possible that a hacker is not
5457a computer criminal. We are all convinced of our sysop's innocence, and await
5458Rockoff's dropping of the charges.
5459
5460NOTE: Readers will notice that our reporting of the events are quite different
5461than those presented in the media and by the Middlesex County Prosecutor. We
5462can only remind you that we are much closer to the events at hand than the
5463media is, and that we are much more technologically literate than the Middlesex
5464County Prosecutor's Office. The Middlesex County Prosecutor has already taken
5465back many of his statements, after the contentions were disproven by AT&T and
5466the DoD. One problem is that the media and the police tend to treat the seven
5467cases as one case, thus the charges against and activities of some of the
5468hackers has been extended to all of the charged. We at 2600 can only speak
5469about the case of Private Sector.
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498 Page 91
5499
5500
5501
5502
5503 The Official Phreaker's Manual
5504
5505 Chapter 4
5506
5507 By now I assume that the reader has a fair idea of what phreaking is, and
5508know a little bit about how to go about it. From now on, I will assume that
5509the reader has read all the material before this or understands all the
5510material covered. Now we will take a journey into the "Basics of
5511Telecommunications" and learn a little about how everything works, and is
5512related to everything else. This series of articles is extremely good and
5513should be read by all levels of phreaks.
5514 As we go further into the advanced world of phreaking, we come closer to the
5515edge of technology. As we approach it, everything seems to become larger and
5516more complicated. We notice that many things that were possible aren't
5517anymore. Blue boxing is starting to become the only method of exploration as
5518Equal Access looms nearer and nearer. As it stands now, equal access is here,
5519and many LD services such as Sprint and MCI will be tougher to hack. Extenders
5520will become more used and abused, which will cause them to get access codes
5521miles long...
5522 Blue boxing becomes harder as all Bell switching and transmission facilities
5523go under to CCIS. Then to further complicate things, digital microwave, fiber
5524optic, and satellite transmission are all coming to be digital and do not
5525recognize 2600hz for the hang up signal. I predict that around 1990, blue
5526boxes will be obsolete from all major cities. A new type of box will have to
5527be invented, or you'll have to get two fone line to phreak with, on to place
5528the actual call and the other to tap into a COSMOS computer to change the
5529status of the call from toll to toll-free, ie. 800#.
5530 Well somethings will change for the better, with ISDN you'll get 144k bps
5531lines and some other neat stuff.
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
5545
5546
5547
5548
5549
5550
5551
5552
5553
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564 Page 92
5565
5566
5567
5568
5569 The Official Phreaker's Manual
5570
5571 ************* << BIOC AGENT 003'S COURSE IN >> *************
5572 * *
5573 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
5574 * BASIC TELECOMMUNICATIONS *
5575 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
5576 * PART II *
5577 * *
5578 ************************************************************
5579
5580 PREFACE:
5581 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5582
5583 IN PART II, WE WILL EXPLORE THE VARIOUS SPECIAL BELL#'S, SUCH AS: CN/A,
5584AT&T NEWSLINES, LOOPS, 99XX #'S, ANI, RINGBACK, AND A FEW OTHERS.
5585
5586 CN/A:
5587 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5588
5589 CN/A, WHICH STANDS FOR CUSTOMER NAME AND ADDRESS, ARE BUREAUS THAT EXIST SO
5590THAT AUTHORIZED BELL EMPLOYEES CAN FIND OUT THE NAME AND ADDRESS OF ANY
5591CUSTOMER IN THE BELL SYSTEM. ALL #'S ARE MAINTAINED ON FILE INCLUDING UNLISTED
5592#'S.
5593
5594HERE'S HOW IT WORKS:
5595
55961) YOU HAVE A # AND YOU WANT TO FIND OUT WHO OWNS IT, E.G. (914) 555-1234.
5597
55982) YOU LOOK UP THE CN/A # FOR THAT NPA IN THE LIST BELOW. IN THE EXAMPLE, THE
5599NPA IS 914 AND THE CN/A# IS 518-471-8111.
5600
56013) YOU THEN CALL UP THE CN/A # (DURING BUSINESS HOURS) AND SAY SOMETHING LIKE,
5602"HI, THIS IS JOHN JONES FROM THE RESIDENTIAL SERVICE CENTER IN MIAMI. CAN I
5603HAVE THE CUSTOMER'S NAME AT 914-555-1234. THAT # IS 914-555-1234." MAKE UP
5604YOUR OWN REAL SOUNDING NAME, THOUGH.
5605
56064) IF YOU SOUND NATURAL & CHEERY, THE OPERATOR WILL ASK NO QUESTIONS.
5607
5608 HERE'S THE LIST:
5609 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5610
5611 NPA CN/A # NPA CN/A #
5612 --- ------------ --- ------------
5613 201 201-676-7070 517 313-232-8690
5614 202 202-384-9620 518 518-471-8111
5615 203 203-789-6800 519 416-487-3641
5616 204 ****N/A***** 601 601-961-0877
5617 205 205-988-7000 602 303-232-2300
5618 206 206-382-8000 603 617-787-2750
5619 207 617-787-2750 604 604-432-2996
5620 208 303-232-2300 605 402-345-0600
5621 209 415-546-1341 606 502-583-2861
5622 212 518-471-8111 607 518-471-8111
5623 213 213-501-4144 608 414-424-5690
5624 214 214-948-5731 609 201-676-7070
5625 215 412-633-5600 612 402-345-0600
5626 216 614-464-2345 613 416-487-3641
5627 217 217-525-7000 614 614-464-2345
5628 218 402-345-0600 615 615-373-5791
5629
5630 Page 93
5631
5632
5633
5634
5635 The Official Phreaker's Manual
5636
5637 219 317-265-7027 616 313-223-8690
5638 301 301-534-11?? 617 617-787-2750
5639 302 412-633-5600 618 217-525-7000
5640 303 303-232-2300 701 402-345-0600
5641 304 304-344-8041 702 415-546-1341
5642 305 912-784-9111 703 804-747-1411
5643 306 ****N/A***** 704 912-784-9111
5644 307 303-232-2300 705 416-487-3641
5645 308 402-345-0600 707 415-546-1341
5646 309 217-525-7000 709 ****N/A*****
5647 312 312-769-9600 712 402-345-0600
5648 313 313-223-8690 713 713-658-1793
5649 314 314-436-3321 714 213-995-0221
5650 315 518-471-8111 715 414-424-5690
5651 316 816-275-2782 716 518-471-8111
5652 317 317-265-7027 717 412-633-5600
5653 318 318-227-1551 801 303-232-2300
5654 319 402-345-0600 802 617-787-2750
5655 401 617-787-2750 803 912-784-9111
5656 402 402-345-0600 804 804-747-1411
5657 403 403-425-2652 805 415-546-1341
5658 404 912-784-9111 806 512-828-2502
5659 405 405-236-6121 807 416-487-3641
5660 406 303-232-2300 808 212-226-5487
5661 408 415-546-1341 BERMUDA ONLY
5662 412 412-633-5600 809 212-334-4336
5663 413 617-787-2750 812 317-265-7027
5664 414 414-424-5690 813 813-228-7871
5665 415 415-546-1132 814 412-633-5600
5666 416 416-487-3641 815 217-525-7000
5667 417 314-436-3321 816 816-275-2782
5668 418 514-861-6391 817 214-948-5731
5669 419 614-464-2345 819 514-861-6391
5670 501 405-236-6121 901 615-373-5791
5671 502 502-583-2861 902 902-421-4110
5672 503 503-241-3440 903 ****N/A*****
5673 504 504-245-5330 904 912-784-9111
5674 505 303-232-2300 906 313-223-8690
5675 506 506-657-3855 907 ****N/A*****
5676 507 402-345-0600 912 912-784-9111
5677 509 206-382-8000 913 816-275-2782
5678 512 512-828-2501 914 518-471-8111
5679 513 614-464-2345 915 512-828-2501
5680 514 514-861-6391 916 415-546-1341
5681 515 402-345-0600 918 405-236-6121
5682 516 518-471-8111 919 912-784-9111
5683 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5684
5685 BELL USES THESE #'S MAINLY TO FIND OUT WHO OWNS A # THAT A CUSTOMER CLAIMS
5686HE NEVER CALLED.
5687
5688NOTE: THIS IS THE MOST COMPLETE LIST OF CN/A #'S IN MY POSSESSION (WITH ONLY
56895 #'S NOT AVAILABLE) THIS LIST WAS COPYRIGHTED IN 1982 BY "JUDAS GERARD" AS IT
5690ORIGINALLY APPEARED IN TAP ISSUE #78.
5691 AT&T NEWSLINES:
5692 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5693
5694 NEWSLINES ARE RECORDINGS THAT BELL EMPLOYEES CALL UP TO FIND OUT THE LATEST
5695
5696 Page 94
5697
5698
5699
5700
5701 The Official Phreaker's Manual
5702
5703INFO ON STOCK, TECHNOLOGY, ETC. CONCERNING THE BELL SYSTEM.
5704
5705 HERE ARE THE #'S THAT ARE CURRENTLY KNOWN TO PHREAKS (AT LEAST ME, ANYWAY):
5706 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5707
5708 201-483-3800 NJ 513-421-9060 OH
5709 203-771-4920 CT 516-234-9914 NY
5710 212-393-2151 NY 518-471-2272 NY
5711 213-621-4141 CA 617-955-1111 MA
5712 213-829-0111 CA (GTE) 702-789-6711 NV
5713 213-449-8830 CA 713-224-6116 TX
5714 312-368-8000 IL 714-238-1111 CA
5715 313-223-7223 MI 717-255-5555 PA
5716 314-247-5511 MO 717-787-1031 PA
5717 408-493-5000 CA 802-955-1111 VE
5718 412-633-3333 PA 808-533-4426 HI
5719 414-678-3511 WI 813-223-5666 FL
5720 416-929-4323 ONT. 914-948-8100 NY
5721 503-228-6271 OR 916-480-8000 CA
5722
5723 LOOPS
5724 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5725
5726 FIRST OF ALL, YOU MUST UNDERSTAND THE CONCEPT OF LOOPS. I THINK THAT THE
5727BEST WAY THAT THIS IS UNDERSTOOD IS THE WAY THAT PHRED PHREEK EXPLAINED IT...
5728
5729 "NO SELF-RESPECTING PHONE PHREAK CAN GO THROUGH LIFE WITHOUT KNOWING WHAT A
5730LOOP IS, HOW TO USE ONE, AND THE TYPES THAT ARE AVAILABLE. THE LOOP IS A GREAT
5731ALTERNATIVE COMMUNICATION MEDIUM THAT HAS MANY POTENTIAL USES THAT HAVEN'T EVEN
5732BEEN TAPPED YET. IN ORDER TO EXPLAIN WHAT A LOOP IS, IT WOULD BE HELPFUL TO
5733VISUALIZE TWO PHONE NUMBERS (LINES) JUST FLOATING AROUND IN THE TELCO CENTRAL
5734OFFICE (CO). NOW, IF YOU (AND A FRIEND PERHAPS) WERE TO CALL THESE TWO NUMBERS
5735AT THE SAME TIME, POOOOPFFF!!!, YOU ARE NOW CONNECTED TOGETHER. I HEAR WHAT
5736YOU'RE SAYING OUT THERE..., "BIG DEAL" OR "WHY SHOULD MA BELL COLLECT HERE TWO
5737MSU'S (MESSAGE UNITS) FOR ONE LOUSY PHONE CALL!?" WELL... THINK AGAIN. HAVEN'T
5738YOU EVER WANTED SOMEONE TO CALL YOU BACK BUT, WERE RELUCTANT TO GIVE OUT YOUR
5739HOME PHONE NUMBER (LIKE THE LAST TIME YOU TRIED TO GET YOUR FRIEND'S UNLISTED #
5740FROM THE BUSINESS OFFICE)? OR HOW ABOUT A COLLECT CALL TO YOUR FRIEND WAITING
5741ON A LOOP, WHO WILL GLADLY ACCEPT THE CHARGES? OR BETTER YET, STUMBLING UPON A
5742LOOP THAT YOU DISCOVER THAT HAS MULTI-USER CAPABILITY (FOR THOSE LATE-NIGHT
5743CONFERENCES). BEST OF ALL IS FINDING A NON-SUPERVISED LOOP THAT DOESN'T CHARGE
5744ANY MSU'S OR TOLLS TO ONE OR BOTH PARTIES. EXAMPLE: MANY MOONS AGO, A LOOP
5745AFFECTIONATELY KNOWN AS 'THE 332 LOOP' WAS NON-SUP (IE, NON-SUPERVISED) ON THE
5746TONE SIDE. I HAD MY FRIEND IN CALIFORNIA DIAL THE FREE (NON-SUP) SIDE, (212)
5747332-9906 AND I DIALED THE SIDE THAT CHARGED, 332-9900. AS YOU CAN SEE, I WAS
5748CHARGED ONE MSU, AND MY FRIEND AS CHARGED ZILCH, FOR AS LONG AS WE WISHED TO
5749TALK!!!"
5750
5751 **********
5752
5753 AHHH...HAVE I PERKED YOUR INTEREST YET? IF SO, HERE IS HOW TO FIND A LOOP
5754OF YOU VERY OWN. FIRST, DO ALL OF YOU LOOP SEARCHING AT NIGHT! THIS IS BECAUSE
5755THE LOOPS SERVE A GENUINE TEST FUNCTION WHICH TELCO USES DURING THE DAY. (WE
5756DON'T WANT TO RUN INTO AN IRATE LINEMAN NOW, DO WE?) TO FIND A LOOP, HAVING 2
5757#'S IS A DEFINITE PLUS. IF NOT, HAVE A FRIEND TO DIAL #'S AT HIS LOCATION.
5758LAST RESORT, TRY DIALING FROM TWO ADJACENT PAY PHONES. NOW GET YOUR TRUSTY
5759WHITE PAGES (*), AND TURN TO THE PAGE WHERE IT LISTS THE # OF MSU'S FROM YOUR
5760EXCHANGE (OR EXCHANGES IN YOUR PRIMARY CALLING AREA) THE IDEA IS TO FIND A LOOP
5761
5762 Page 95
5763
5764
5765
5766
5767 The Official Phreaker's Manual
5768
5769THAT IS WITHIN YOUR PRIMARY CALLING AREA OR IS ONLY 1 MSU IN YOUR AREA (CALL
5770AREA A). THIS IS SO YOU DON'T GO BANKRUPT TRYING TO FIND A LOOP. WRITE DOWN ALL
5771OF THESE EXCHANGES AND DO A 99XX SCAN OF THOSE EXCHANGES (99XX SCANNING WILL BE
5772DISCUSSED SHORTLY).
5773
5774 BEFORE WE GET UP TO 99XX SCANNING, WE WILL LOOK AT SOME OTHER LOOP INFO:
5775
5776 LOOPS ARE FOUND PAIRS WHICH ARE USUALLY CLOSE TO EACH OTHER. FOR EXAMPLE,
5777IN NPA 212, WHERE THE INFAMOUS LOOPS ARE FOUND, THERE IS A STANDARD LOOP
5778FORMAT:
5779
5780MANHATTAN & BRONX-------NNX-9977/9979
5781BROOKLYN & QUEENS-------NNX-9900/9906
5782
5783 NNX IS THE EXCHANGE TO BE SCANNED. HERE ARE SOME LOOPS THAT HAVE BEEN FOUND
5784IN NYC. THESE ARE USED MOSTLY BY PHREAKS AND CALL-IN LINES FOR PIRATE RADIO
5785STATIONS:
5786
5787212-220-9900/9906
5788212-283-9977/9979
5789212-352-9900/9906
5790212-365-9977/9979
5791212-529-9900/9906
5792212-562-9977/9979
5793212-982-9977/9979
5794212-986-9977/9979
5795
5796 THE LOWER # IS THE TONE SIDE (SINGING SWITCH). THE HIGHER # IS ALWAYS
5797SILENT. THE TONE DISAPPEARS ON THE LOWER # WHEN SOMEBODY DIALS IN THE OTHER
5798SIDE OF THE LOOP. IF YOU ARE ON THE HIGHER #, YOU'LL HAVE TO LISTEN TO THE
5799CLICKS TO SEE IF SOMEBODY DIALED-IN. THE NYC 982 & 986 LOOPS ARE DIFFERENT
5800FROM OTHERS. USUALLY WHEN YOU PARK ON A LOOP, YOU WILL HEAR WHO EVER CALLS IN
5801ON THE OTHER HALF. WHEN THEY'RE DONE, THE NEXT CALLER (IF ANY) WILL BE QUEUED
5802IN, ONE AFTER ANOTHER. ON THE NYC 982 & 986, YOU SOMETIMES CAN'T GET ANY MORE
5803CALLERS IN AFTER THE FIRST. FURTHERMORE, IF YOU PARK ONE OF THESE LOOPS AND
5804THERE IS NOBODY ON THE OTHER END FOR MORE THAN 4 MINUTES, YOU MAY BE
5805AUTOMATICALLY DISCONNECTED. THESE LOOPS ARE GOOD FOR BACK-UP PURPOSES WHEN ALL
5806OTHER LOOPS ARE BUSY.
5807
5808 99XX SCANNING:
5809 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5810
5811 MOST EVERY EXCHANGE IN THE BELL SYSTEM HAS A WIDE VARIETY OF TEST #'S AND
5812OTHER "GOODIES," SUCH AS LOOPS. THESE "GOODIES" ARE USUALLY FOUND BETWEEN 9900
5813AND 9999 IN YOUR LOCAL EXCHANGE. IF YOU HAVE THE TIME AND INITIATIVE, SCAN
5814YOUR EXCHANGE AND YOU MAY BECOME LUCKY!
5815
5816HERE ARE MY FINDINGS IN THE 914-268:
5817
58189901 - VERIFICATION (RECORDING OF A/C AND EXCHANGE)
58199936 - VOICE # TO THE TELCO CO
58209937 - VOICE # TO THE TELCO CO
58219941 - CARRIER
58229960 - OSC. TONE (TONE SIDE LOOP)
58239963 - TONE (STOPS: MUTED)
58249966 - CARRIER
58259968 - TONE THAT DISAPPEARS--RESPONDS TO CERTAIN TOUCH-TONE KEYS
5826
5827
5828 Page 96
5829
5830
5831
5832
5833 The Official Phreaker's Manual
5834
5835 MOST OF THE #'S BETWEEN 9900 & 9999 WILL RING, BE BUSY, GO TO A SPECIAL
5836INTERCEPT OPERATOR ("WHAT #, PLEASE?"), OR WILL GO TO A "THE # YOU HAVE
5837REACHED..." RECORDING. WHAT YOU FIND DEPENDS UPON THE SWITCHING EQUIPMENT IN
5838THE EXCHANGE AND THE TELCO OPERATING COMPANY.
5839
5840 WHEN SEARCHING FOR LOOPS, YOU MAY FIND ONE OF THE FOLLOWING POSSIBILITIES
5841WHEN YOU FIND ONE:
5842
58431. YOU CAN HEAR THROUGH THE LOOP (NOT MUTED), BUT THERE IS A 1/2 SECOND CLICK
5844EVERY 10 SECONDS THAT INTERRUPTS THE AUDIO. THIS TYPE IS GOOD FOR BACK-UP USE
5845BUT THE FUCKING CLICK IS SUPER ANNOYING.
5846
58472. ONE SIDE OF THE LOOP IS BUSY; TRY IT AGAIN LATER.
5848
58493. THE TONE DISAPPEARS, BUT YOU CANNOT HEAR THROUGH IT (THE LOOP IS MUTED, TRY
5850AGAIN IN A MONTH OR SO)
5851
58524. YOU GET "THE # YOU HAVE REACHED RECORDING." NO LOOP HERE!
5853
5854 MOST LOOPS ARE MUTED (#3), BUT THEIR STATUS DOES CHANGES FROM TIME-TO-TIME.
5855IT ALL DEPENDS IF THE TELCO MAINTENANCE PERSONNEL REMEMBER TO "THROW THE
5856SWITCH", IE, TURN OFF THE LOOP.
5857
5858 SINCE I HAVE DONE THE ABOVE 914-268 99XX SCAN, CONGERS (268) HAS INSTALLED
5859NEW SWITCHING EQUIPMENT (DMS100). SOME OF THE NUMBERS ARE THE SAME, BUT I HAVE
5860NOTICED THAT ON THE DMS100, THE RECORDINGS ARE ALSO STORED IN THIS AREA.
5861268-9903, 9906, 9909, & 9912 ARE ALL DIFFERENT RECORDINGS. ALSO, THERE ARE 2
5862FORTRESS FONE RECORDINGS AT 268-9911 (DEPOSIT 5 CENTS OR ELSE) AND 268-9913
5863(DEPOSIT 10 CENTS). NONE OF THESE RECORDINGS SUPE AND ALOT OF OTHER 99XX#'S
5864DON'T SUPE EITHER.
5865
5866 IN SOME AREAS (LIKE MD), 9906-7 IS RINGBACK. IN WASHINGTON, THERE IS A
5867SWEEP TONE TEST AT (202) 560-9944. IN NYC (212), YOU'LL FIND THE INFAMOUS LOOP
5868LINES (AS MENTIONED ABOVE).
5869 IT WILL BE EASIER TO SCAN YOUR EXCHANGE IF YOU MAKE UP A CHART LIKE THE ONE
5870BELOW:
5871
5872
5873 NPA-NNX-99XX SCAN
5874 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5875
5876 _________________________________________________________
5877 | 99X X>|0 |1 |2 |3 |4 |5 |6 |7 |8 |9 |
5878 |_______|____|____|____|____|____|____|____|____|____|____|
5879 | 990 | | | | | | | | | | |
5880 |_______|____|____|____|____|____|____|____|____|____|____|
5881 | 991 | | | | | | | | | | |
5882 |_______|____|____|____|____|____|____|____|____|____|____|
5883 | 992 | | | | | | | | | | |
5884 |_______|____|____|____|____|____|____|____|____|____|____|
5885 | 993 | | | | | | | | | | |
5886 |_______|____|____|____|____|____|____|____|____|____|____|
5887 | 994 | | | | | | | | | | |
5888 |_______|____|____|____|____|____|____|____|____|____|____|
5889 | 995 | | | | | | | | | | |
5890 |_______|____|____|____|____|____|____|____|____|____|____|
5891 | 996 | | | | | | | | | | |
5892 |_______|____|____|____|____|____|____|____|____|____|____|
5893
5894 Page 97
5895
5896
5897
5898
5899 The Official Phreaker's Manual
5900
5901 | 997 | | | | | | | | | | |
5902 |_______|____|____|____|____|____|____|____|____|____|____|
5903 | 998 | | | | | | | | | | |
5904 |_______|____|____|____|____|____|____|____|____|____|____|
5905 | 999 | | | | | | | | | | |
5906 |_______|____|____|____|____|____|____|____|____|____|____|
5907
5908 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5909
5910 THIS LEAVES YOU WITH 100 BOXES (1 FOR EACH # BETWEEN 9900 & 9999). YOU
5911SHOULD MAKE YOUR BOXES BIG ENOUGH SO YOU CAN WRITE SOME SORT OF SHORTHAND IN
5912THEM. FOR EXAMPLE:
5913
5914B - BUSY (TRY AGAIN AT ANOTHER TIME)
5915R - RINGS (TRY AGAIN AT ANOTHER TIME)
5916O - INTERCEPT OPERATOR ("WHAT # YOU CALLING?)
5917R1- RECORDING 1 (MAKE A MARGIN NOTE OF THE TYPES OF RECORDINGS YOU GET)
5918T - TONE ] TONE AT A LOWER # + IGNORE
5919I - IGNORE ] AT A HIGHER # = LOOP
5920V - VOICE # TO TELCO CO - THEY USUALLY ANSWER WITH THE CITY NAME OR AREA.
5921C - CARRIER
5922
5923 THERE WILL BE OTHERS AND YOU SHOULD USE OTHER CHARACTERS THAT YOU CAN
5924UNDERSTAND.
5925
5926 NOW, BACK TO LOOPS! AS YOU MAY HAVE NOTICED IN MY 914-268 SCAN, I FOUND A
5927MUTED LOOP AND A TONE SIDE. 914-268 FAILED TO COME UP WITH THE SILENT SIDE OF
5928A LOOP! THEREFORE, THERE IS NO LOOP IN THAT EXCHANGE. I THEN SCANNED ANOTHER
5929EXCHANGE IN MY PRIMARY CALLING AREA (914-634) AND I FOUND A LOOP!! "(914)
5930634-9923/9924" SO, IF AT FIRST YOU DON'T SUCCEED, MOVE ONTO ANOTHER EXCHANGE.
5931IF YOU USE THE BOX METHOD THAT I HAVE OUTLINED ABOVE, YOU WILL SEE A "T" & "I"
5932NEXT TO EACH OTHER FOR A LOOP.
5933 SOME EXCHANGES ARE SPECIAL. FOR EXAMPLE, 914-623 IS A TESTING BUREAU. IN
5934THIS EXCHANGE, NOT ONLY DID I FIND A LOOP, BUT I ALSO FOUND SEVERAL INTERESTING
5935TONES, NOISES, AND OTHER TEST FUNCTIONS. ALSO, THE MORE IMPORTANT THE EXCHANGE
5936IS, THE MORE YOU WILL FIND. FOR EXAMPLE, IN 914-623, I FOUND WELL OVER 10 VOICE
5937#'S!
5938 ALSO, LOOPS ARE USUALLY, BUT NOT EXCLUSIVELY, FOUND IN THE 99XX SERIES. FOR
5939EXAMPLE: "(713) 324-1799/1499" IS A LOOP.
5940
5941THE PERFECT LOOP? HERE IS WHAT I WOULD LOOK FOR:
5942
59431. NON-SUP ON ONE OR BOTH SIDES. TO CHECK FOR A NON-SUP LOOP, GO TO A
5944TONE-FIRST FORTRESS FONE AND DIAL THE #. IF IT ASKS FOR A DIME, IT IS
5945SUPERVISED. IF THE CALL GOES THROUGH, THEN IT IS NON-SUPED!
5946
59472. 800 LOOPS WOULD BE A PLUS. THEY ARE NOT NECESSARILY FOUND BETWEEN 9900 &
59489999 THOUGH. I WOULD CHECK THE 1XXX SERIES FIRST.
5949
59503. MULTI-USER LOOPS ARE ALSO A PLUS FOR THOSE LATE NIGHT CONFERENCES.
5951
5952 FINALLY, REMEMBER IT IS ONLY A LOCAL CALL TO FIND OUT WHAT YOU CO HAS IN
5953STORE FOR YOU. IF YOU FIND ANYTHING INTERESTING, BE SURE TO DROP ME A LINE.
5954
5955
5956NOTE: YOUR LOCAL WHITE PAGES CAN BE A VALUABLE ASSET. YOU CAN ALSO ORDER OTHER
5957FONE BOOKS FROM YOUR BUSINESS OFFICE (USUALLY FREE FOR BOOKS WITHIN YOUR
5958OPERATING COMPANY'S DISTRICT). A LARGE FONE BOOK, SUCH AS MANHATTAN, CONTAINS
5959
5960 Page 98
5961
5962
5963
5964
5965 The Official Phreaker's Manual
5966
5967MUCH MORE INFO IN THE FIRST FEW PAGES THAN OTHER BOOKS.
5968
5969 ANI
5970 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5971
5972 AUTOMATIC NUMBER IDENTIFICATION (ANI), IS A NUMBER THAT YOU CALL UP THAT
5973WILL TELL YOU WHAT # YOU ARE CALLING FROM.
5974 THIS HAS A FEW USES. FIRST, WERE YOU EVER SOMEWHERE AND THE FONE DIDN'T
5975HAVE A # PRINTED ON IT? OR PERHAPS YOU WERE FOOLING AROUND IN SOME CANS (THOSE
5976LARGE BOXES ON FONE POLES THAT CONTAIN TERMINALS FOR LINEMAN USE--TO BE
5977DISCUSSES IN A FUTURE CHAPTER.) AND YOU WANT TO KNOW WHAT WHAT THE LINE # IS.
5978IN NPA 914, THE ANI IS 990. IN NPA'S 212 & 516, ANI IS 958. THIS VARIES FROM
5979AREA TO AREA.
5980
5981HERE ARE SOME OTHER ANI'S THAT I HAVE SEEN:
5982
5983890-751-5191
5984202-222-2222
59851-XXX-1111 (IN SOME 914 AREAS, ESP. UNDER STEP-BY-STEP SWITCHING, YOU HAVE
5986TO DIAL 1-990-1111)
5987
5988 TO FIND ANI FOR OTHER AREAS, CHECK 3 DIGITS #'S FIRST, USUALLY IN THE 9XX
5989SERIES (EXCLUDING 911). IN AREAS UNDER STEP-BY-STEP (TO BE DISCUSSED IN THE
5990NEXT PART), TRY 1-9XX-1111.
5991 ANI MAY ALSO BE IN 99XX. LAST RESORT, TRY TO GET FRIENDLY WITH YOUR
5992NEIGHBOR WHO WORKS FOR THE FONE COMPANY.
5993
5994 RING BACK
5995 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
5996
5997 RINGBACK, AS ITS NAME IMPLIES, CALLS BACK THE # YOU ARE AT WHEN YOU DIAL
5998THE RINGBACK #. RINGBACK, IN NPA 914, IS 660. YOU DIAL 660+THE LAST 4 DIGITS OF
5999THE FONE. YOU WILL THEN GET A TONE, HANG-UP QUICKLY AND PICK-UP IN ABOUT 2
6000SECONDS. YOU WILL THEN GET A SECOND TONE, HANG-UP AGAIN AND THE FONE WILL
6001RING.
6002 IN NYC, IT IS ALSO 660, BUT YOU MAY HAVE TO PRESS 6 OR 7 BEFORE YOU HANG UP
6003FOR THE FIRST TIME (IE, AT THE FIRST TONE).
6004
6005
6006 OTHER RINGBACK #'S THAT I HAVE SEEN ARE:
6007
600826011 - THIS 5 DIGIT FORMAT IS USED PRIMARILY ON STEP-BY-STEP.
6009THE LAST 2 DIGITS (11) ARE DUMMY DIGITS.
6010
6011890-897-XXXX - XXXX ARE THE LAST 4 DIGITS OF THE FONE #.
6012
6013119911/11911/1199911 - GTE
6014
6015NNX-9906/9907 - NPA 301, NNX IS THE EXCHANGE
6016
6017
6018 THE REASON YOU GET THE TONE WHEN YOU PICK-UP AFTER IT RINGS IS BECAUSE IN
6019SOME AREAS, PEOPLE WERE USING RINGBACK AS AN IN-HOUSE INTERCOM. THEY WOULD
6020DIAL RINGBACK, AND WHEN IT STOPPED RINGING, THEY WOULD PICK-UP & TALK WITH THE
6021PERSON WHO PICKED UP THE OTHER EXTENSION. BELL DIDN'T LIKE THIS SINCE THERE IS
6022USUALLY ONLY 1 PIECE OF EQUIPMENT IN EACH EXCHANGE THAT DOES THE RINGBACK. WHEN
6023PEOPLE USED THIS AS AN INTERCOM, LINEMEN & REPAIRMEN COULDN'T GET THROUGH! IN
6024SOME AREAS, ESPECIALLY THOSE UNDER STEP-BY-STEP, RINGBACK CAN STILL BE USED AS
6025AN INTERCOM. ALSO, UNDER STEP-BY-STEP, THE RINGBACK PROCEDURE IT USUALLY
6026
6027 Page 99
6028
6029
6030
6031
6032 The Official Phreaker's Manual
6033
6034SIMPLE. FOR EXAMPLE, IN ONE AREA YOU WOULD DIAL 26011 AND HANG-UP; IT WOULD
6035THEN RINGBACK.
6036
6037 TOUCH-TONE TEST:
6038 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6039
6040 IN AREAS THAT HAVE A TOUCH-TONE TEST, YOU DIAL THE RINGBACK #. AT THE
6041FIRST TONE, YOU TOUCH-TONE DIGITS 1-0. IF THEY ARE CORRECT IT WILL BEEP
6042TWICE.
6043I HAVE ALSO SEEN A TT TEST IN SOME AREAS AT: 890-751-5191
6044
6045 COMING SOON:
6046 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6047
6048 IN THE NEXT PART, WE WILL LOOK AT VARIOUS SWITCHING EQUIPMENT AND THE
6049NETWORK.
6050
6051
6052 BREAK UP OF BELL:
6053 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6054
6055 THE OPERATING COMPANIES ARE NOT GOING TO CHANGE ALL THE SWITCHING EQUIPMENT
6056AROUND. WHILE THERE WILL BE SOME CHANGES, MOST OF THE INFORMATION PROVIDED
6057HERE WILL REMAIN PERTINENT AFTER JANUARY 1, 1984. JUST SUBSTITUTE THE WORD
6058"FONE NETWORK" FOR BELL SYSTEM.
6059
6060
6061AU REVOIR,
6062
6063*****BIOC
6064*=$=*AGENT
6065*****003
6066
6067DECEMBER 8, 1983
6068
6069ACKNOWLEDGEMENTS: TAP, PHRED PHREEK, JUDAS GERARD, THE MAGICIAN, DARK PRIEST,
6070& MYSELF. I WOULD ALSO LIKE TO THANK THE MULCHER ][ FOR HIS ASSISTANCE IN
6071DISTRIBUTING THIS TUTORIAL.
6072
6073
6074
6075
6076
6077
6078
6079
6080
6081
6082
6083
6084
6085
6086
6087
6088
6089
6090
6091
6092
6093 Page 100
6094
6095
6096
6097
6098 The Official Phreaker's Manual
6099
6100 ************* << BIOC AGENT 003'S COURSE IN >> *************
6101 * *
6102 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
6103 * %$ BASIC TELECOMMUNICATIONS $% *
6104 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
6105 * PART III *
6106 * *
6107 ************************************************************
6108
6109PREFACE:
6110
6111 IN PART III, WE WILL DISCUSS THE DIALING PROCEDURES FOR DOMESTIC AS WELL AS
6112INTERNATIONAL DIALING. WE WILL ALSO TAKE A LOOK AT THE TELEPHONE NUMBERING
6113PLAN.
6114
6115NORTH AMERICAN NUMBERING PLAN
6116<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6117
6118IN NORTH AMERICA, THE TELEPHONE NUMBERING PLAN IS AS FOLLOWS:
6119
6120A) A 3 DIGIT NUMBERING PLAN AREA (NPA) CODE, [IE, AREA CODE]
6121
6122B) A 7 DIGIT TELEPHONE # CONSISTING OF A 3 DIGIT CENTRAL OFFICE (CO) CODE PLUS
6123A 4 DIGIT STATION #.
6124
6125 THESE 10 DIGITS ARE CALLED THE NETWORK ADDRESS OR DESTINATION CODE. IT IS
6126IN THE FORMAT OF:
6127
6128AREA CODE TELEPHONE #
6129--------- -----------
6130 N*X NXX-XXXX
6131
6132WHERE: N = A DIGIT FROM 2-9
6133 * = THE DIGIT 0 OR 1
6134 X = A DIGIT 0-9
6135
6136AREA CODES
6137<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6138
6139 CHECK YOUR TELEPHONE BOOK OR THE SEPARATE LISTING OF AREA CODES FOUND ON
6140MANY BBS'S. HERE ARE THE SPECIAL AREA CODES (SAC'S):
6141
6142510 - TWX (USA)
6143610 - TWX (CANADA)
6144700 - NEW SERVICE
6145710 - TWX (USA)
6146800 - WATS
6147810 - TWX (USA)
6148900 - DIAL-IT SERVICES
6149910 - TWX (USA)
6150
6151 THE OTHER AREA CODES NEVER CROSS STATE LINES, THEREFORE EACH STATE MUST
6152HAVE AT LEAST ONE EXCLUSIVE NPA CODE. WHEN A COMMUNITY IS SPLIT BY A STATE
6153LINE, THE CO #'S ARE OFTEN INTERCHANGEABLE (IE, YOU CAN DIAL THE SAME # FROM 2
6154DIFFERENT AREA CODES)
6155
6156TWX:
6157<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6158
6159 Page 101
6160
6161
6162
6163
6164 The Official Phreaker's Manual
6165
6166
6167 TWX (TELEX II) CONSISTS OF 5 TELETYPE-WRITER AREA CODES. THEY ARE OWNED BY
6168WESTERN UNION. THESE SAC'S MAY ONLY BE REACHED VIA OTHER TWX MACHINES. THESE
6169RUN AT 110 BAUD. BESIDES THE TWX #'S, THESE MACHINES ARE ROUTED TO NORMAL
6170TELEPHONE #'S. TWX MACHINES ALWAYS RESPOND WITH AN ANSWERBACK. FOR EXAMPLE,
6171WU'S FYI TWX # IS (910) 988-5956, THE CORRESPONDING REAL NUMBER TO THIS IS
6172(201) 279-5956. THE ANSWERBACK FOR THIS SERVICE IS "WU FYI MAWA."
6173
6174 IF YOU DON'T WANT TO BUY A TWX MACHINE, YOU CAN STILL SEND TWX MESSAGES
6175USING EASYLINK [800/325-4112 - SEE TUC'S AND MY ARTICLE ENTITLED "HACKING
6176WESTERN UNION'S EASYLINK]
6177
6178700:
6179<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6180
6181 AT THE TIME OF THIS WRITING, THE 700 EXCHANGE DOES NOT YET EXIST. AT&T
6182PLANS TO USE IT SOON THOUGH. THEY PLAN TO MAKE IT A TYPE OF FANCY CALL
6183FORWARDING SERVICE. IT WILL BE TARGETED TOWARDS SALESMEN ON THE RUN.
6184
6185 TO UNDERSTAND HOW IT WORKS, I'LL EXPLAIN IT WITH AN EXAMPLE. LET'S SAY JOE
6186Q. SALESPIG WORKS FOR AT&T SECURITY AND HE IS ON THE RUN CHASING A PHREAK
6187AROUND THE COUNTRY WHO ROYALLY SCREWED UP AN IMPORTANT COSMOS SYSTEM. LET'S
6188SAY THAT JOE'S 700 # IS (700) 382-5968. EVERY TIME JOE GOES TO A NEW HOTEL, HE
6189DIALS A SPECIAL 700 #, ENTERS A CODE, AND THE # WHERE HE IS STAYING. NOW, IF
6190HIS BOSS RECEIVED SOME IMPORTANT INFO, ALL HE WOULD DO IS DIAL (700) 382-5968
6191AND IT WOULD RING WHEREVER JOE LAST PROGRAMMED IT TO. NEAT, HUH?
6192
6193800:
6194<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6195
6196 THIS SAC IS ONE OF MY FAVORITES SINCE IT ALLOWS FOR TOLL-FREE CALLS.
6197
6198INWARD WATS (INWATS): INWARD WIDE AREA TELECOMMUNICATIONS SERVICE IS THE 800
6199#'S THAT WE ARE ALL FAMILIAR WITH. 800 #'S ARE SET UP IN SERVICE AREAS OR
6200BANDS. THERE ARE 6 OF THESE. BAND 6 IS THE LARGEST AND YOU CAN CALL A BAND 6
6201# FROM ANYWHERE IN THE US EXCEPT THE STATE WHERE THE CALL IS TERMINATED (THIS
6202IS WHY MOST COMPANIES HAVE ONE 800 # FOR THE COUNTRY AND THEN ANOTHER FOR JUST
6203ONE STATE). BAND 5 INCLUDES THE 48 CONTIGUOUS STATES. ALL THE WAY DOWN TO
6204BAND 1 WHICH INCLUDES ONLY THE STATES CONTIGUOUS TO THAT ONE. THEREFORE, LESS
6205PEOPLE CAN REACH A BAND 1 INWATS # THAT A BAND 6 #.
6206
6207INTRASTATE INWATS #'S (IE, YOU CAN CALL IT FROM ONLY 1 STATE) ALWAYS HAVE A 2
6208AS THE LAST DIGIT IN THE EXCHANGE (IE, 800-NX2-XXXX). THE NXX ON 800 #'S
6209REPRESENT THE AREA WHERE THE BUSINESS IS LOCATED. FOR EXAMPLE, A # BEGINNING
6210WITH 800-431 WOULD TERMINATE AT A NEW YORK CO.
6211
6212800 #'S ALWAYS END UP IN A HUNT SERIES IN A CO. THIS MEANS THAT IT TRIES THE
6213FIRST # ALLOCATED TO THE COMPANY FOR THEIR 8P0 LINES; IF THIS IS BUSY IT WILL
6214THEN TRY THE NEXT #, ETC). YOU MUST HAVE A MINIMUM OF TWO LINES PER EACH 800
6215#. FOR EXAMPLE, TRAVELNET USES A HUNT SERIES. IF YOU DIAL (800) 521-8400, IT
6216WILL FIRST TRY THE # ASSOCIATED WITH 8400; IF IT IS BUSY IT WILL GO TO THE NEXT
6217AVAILABLE PORT, ETC. INWATS CUSTOMERS ARE BILLED BY THE # OF HOURS OF CALLS
6218THAT ARE MADE TO THEIR #.
6219
6220OUTWATS (OUTWARD WATS): OUTWATS ARE FOR MAKING OUTGOING CALLS ONLY. LARGE
6221COMPANIES USE OUTWATS SINCE THEY RECEIVE BULK-RATE DISCOUNTS. SINCE OUTWATS #
6222CANNOT HAVE INCOMING CALLS, THEY ARE IN THE FORMAT OF:
6223
6224
6225 Page 102
6226
6227
6228
6229
6230 The Official Phreaker's Manual
6231
6232(800) *XX-XXXX
6233
6234 WHERE * IS THE DIGIT 0 OR 1 WHICH CANNOT BE DIALED UNLESS YOU BOX THE CALL.
6235THE *XX IDENTIFIES THE TYPE OF SERVICE AND THE AREAS THAT THE COMPANY CAN
6236CALL.
6237
6238REMEMBER: INWATS + OUTWATS = WATS EXTENDER (SEE PART I)
6239900:
6240<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6241
6242 THIS DIAL-IT SAC IS A NATIONWIDE DIAL-IT SERVICE. IT IS USED FOR TAKING
6243TELEVISION POLLS AND OTHER STUFF. THE FIRST MINUTE CURRENTLY COSTS AN
6244OUTRAGEOUS 50 CENTS AND EACH ADDITIONAL MINUTE COSTS 35 CENTS. BELL TAKES IN
6245ALOT OF REVENUE IN THIS WAY.
6246
6247DIAL (900) 555-1212 TO FIND OUT WHAT IS CURRENTLY ON THE SERVICE.
6248
6249CO CODES:
6250<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6251
6252 THESE IDENTIFY THE SWITCHING OFFICE WHERE THE CALL IS TO BE ROUTED.
6253
6254THE FOLLOWING CO CODES ARE RESERVED NATIONWIDE:
6255
6256555 - DIRECTORY ASSISTANCE
6257844 - TIME ] THESE ARE NOW IN
6258936 - WEATHER ] THE 976 EXCHANGE
6259950 - FUTURE SERVICES
6260958 - PLANT TEST
6261959 - PLANT TEST
6262970 - PLANT TEST (TEMPORARY)
6263976 - DIAL-IT SERVICES
6264
6265 ALSO, THE 3 DIGIT ANI & RINGBACK #'S ARE REGARDED AS PLANT TEST AND ARE
6266THUS RESERVED. THESE NUMBERS VARY FROM AREA TO AREA.
6267
6268950: [ALSO SEE PART I]
6269<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6270
6271HERE ARE THE SERVICES THAT ARE CURRENTLY ON THE 950 EXCHANGE:
6272
62731000 - SPC
62741022 - MCI EXECUNET
62751033 - US TELEPHONE
62761044 - ALLNET
62771066 - LEXITEL
62781088 - SBS SKYLINE
6279
6280THESE SCC'S (SPECIALIZED COMMON CARRIERS) ARE FREE FROM FORTRESSES!
6281
6282Publishers note: Most 950's now require the station code (1022, 1000, 1088,
6283etc.) to be five digits long. MCI 950-10222, US telefone 10333, ALLNET 10444,
6284etc. Look in "Equal Access and the American Dream" p. for a complete list.
6285PLANT TESTS:
6286<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6287
6288THESE INCLUDE ANI, RINGBACK, AND OTHER VARIOUS TESTS.
6289
6290
6291 Page 103
6292
6293
6294
6295
6296 The Official Phreaker's Manual
6297
6298976:
6299<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6300
6301 DIAL 976-1000 TO SEE WHAT IS CURRENTLY ON THE SERVICE. ALSO, MANY BBS'S
6302HAVE A LISTING OF THESE #'S.
6303
6304
6305N11 CODES:
6306<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6307
6308 BELL IS TRYING TO PHASE SOME OF THESE OUT, BUT THEY STILL EXIST IN MANY
6309AREAS.
6310
6311011 - INTERNATIONAL DIALING PREFIX
6312211 - COIN REFUND OPERATOR
6313411 - DIRECTORY ASSISTANCE
6314611 - REPAIR SERVICE
6315811 - BUSINESS OFFICE
6316911 - EMERGENCY
6317
6318INTERNATIONAL DIALING
6319<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6320
6321 WITH INTERNATIONAL DIALING, THE WORLD HAS BEEN DIVIDED INTO 9 NUMBERING
6322ZONES.
6323
6324TO MAKE AN INTERNATIONAL CALL, YOU MUST DIAL: INT. PREFIX + COUNTRY CODE + NAT.
6325#
6326
6327 IN NORTH AMERICA, THE INTERNATIONAL DIALING PREFIX IS 011 FOR
6328STATION-TO-STATION CALLS AND 01 FOR OPERATOR- SERVICED CALLS. IDDD STANDS FOR
6329INTERNATIONAL DIRECT DISTANCE DIALING.
6330
6331 THE COUNTRY CODE, WHICH VARIES FROM 1 TO 3 DIGITS, ALWAYS HAS THE WORLD
6332NUMBERING ZONE AS THE FIRST DIGIT. FOR EXAMPLE, THE COUNTRY CODE FOR THE
6333UNITED KINGDOM IS 44, THUS IT IS IN WORLD NUMBERING ZONE 4.
6334
6335 SOME BOARDS MAY CONTAIN A COMPLETE LISTING OF OTHER COUNTRY CODES, BUT HERE
6336ARE A FEW:
6337
6338001 - NORTH AMERICA (US, CANADA,ETC)
6339020 - EGYPT
6340258 - MOZAMBIQUE
6341034 - SPAIN
6342049 - GERMANY
6343052 - MEXICO (SOUTHERN PORTION)
6344061 - AUSTRALIA
6345007 - USSR
6346081 - JAPAN
6347098 - IRAN
6348
6349 IF YOU CALL FROM AN AREA OTHER THAN NORTH AMERICA, THE FORMAT IS GENERALLY
6350THE SAME. FOR EXAMPLE, LET'S SAY YOU WANTED TO CALL THE WHITE HOUSE FROM
6351SWITZERLAND. FIRST YOU WOULD DIAL 00 (THE SWISS INTERNATIONAL DIALING PREFIX),
6352THEN 1 (THE US COUNTRY CODE), FOLLOWED BY 202-456-1414 (THE NATIONAL # FOR THE
6353WHITE HOUSE).
6354
6355 ALSO, COUNTRY CODE 87 IS RESERVED FOR MARITIME MOBILE SERVICE, IE CALLING
6356
6357 Page 104
6358
6359
6360
6361
6362 The Official Phreaker's Manual
6363
6364SHIPS:
6365
6366871 - MARISAT (ATLANTIC)
6367872 - MARISAT (PACIFIC)
6368873 - MARISAT (INDIAN )
6369
6370INTERNATIONAL SWITCHING:
6371<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6372
6373 IN NORTH AMERICA, THERE ARE CURRENTLY 7 NO. 4 ESS'S THAT PERFORM THE DUTY
6374OF ISC (INTERNATIONAL SWITCHING CENTERS). ALL INTERNATIONAL CALLS DIALED FROM
6375NUMBERING ZONE 1 WILL BE ROUTED THROUGH ONE OF THESE "GATEWAY CITIES." THEY
6376ARE:
6377
6378182 - WHITE PLAINS, NY
6379183 - NEW YORK, NY
6380184 - PITTSBURGH, PA
6381185 - ORLANDO, FL
6382186 - OAKLAND, CA
6383187 - DENVER, CO
6384188 - NEW YORK, NY
6385
6386 THE 18X SERIES ARE OPERATOR ROUTING CODES FOR OVERSEAS ACCESS (TO BE
6387FURTHER DISCUSSED WITH BLUE BOXES). ALL INTERNATIONAL CALLS USE A SIGNALING
6388SYSTEM CALLED CCITT. IT IS AN INTERNATIONAL STANDARD FOR SIGNALING.
6389
6390COMING SOON:
6391<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6392
6393 IN PART IV, WE WILL DISCUSS SWITCHING EQUIPMENT, VARIOUS OPERATORS, CO
6394TYPES, ETC.
6395
6396PHREAKING LIVES IN '84,
6397
6398*****BIOC
6399*=$=*AGENT
6400*****003
6401
6402<<=-FARGO 4A-=>>
640323-FEB-84
6404
6405REFERENCES/
6406ACKNOWLEDGEMENTS: NOTES ON THE NETWORK (AT&T), TAP (ROOM 603, 147W 42 ST,
6407NEW YORK, NY 10036),UNDERSTANDING TELEPHONE ELECTRONICS,AND MANY OTHERS/TUC,
6408MULCHER...
6409
6410
6411
6412
6413
6414
6415
6416
6417
6418
6419
6420
6421
6422
6423 Page 105
6424
6425
6426
6427
6428 The Official Phreaker's Manual
6429
6430 ************* << BIOC AGENT 003'S COURSE IN >> *************
6431 * *
6432 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
6433 * %$ BASIC TELECOMMUNICATIONS $% *
6434 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
6435 * PART IV *
6436 * *
6437 ************************************************************
6438
6439PREFACE:
6440<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6441
6442 PART IV WILL DEAL WITH THE VARIOUS TYPES OF OPERATORS, OFFICE HIERARCHY, &
6443SWITCHING EQUIPMENT.
6444
6445
6446OPERATORS:
6447<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6448
6449 THERE ARE MANY TYPES OF OPERATORS IN THE NETWORK AND THE MORE COMMON ONES
6450WILL BE DISCUSSED.
6451
6452TSPS OPERATOR:
6453____________________________________________________________
6454
6455 THE TSPS (TRAFFIC SERVICE POSITION SYSTEM) OPERATOR IS PROBABLY THE BITCH
6456(OR BASTARD FOR THE PHEMALE LIBERATIONISTS) THAT MOST OF US ARE USE TO HAVING
6457TO DEAL WITH.
6458
6459HERE ARE HER RESPONSIBILITIES:
6460
64611) OBTAINING BILLING INFORMATION FOR CALLING CARD OR 3RD NUMBER CALLS.
6462
64632) IDENTIFYING CALLED CUSTOMER ON PERSON-TO-PERSON CALLS.
6464
64653) OBTAINING ACCEPTANCE OF CHARGES ON COLLECT CALLS.
6466
64674) IDENTIFYING CALLING NUMBERS. THIS ONLY HAPPENS WHEN THE CALLING # IS NOT
6468AUTOMATICALLY RECORDED BY CAMA (CENTRALIZED AUTOMATIC MESSAGE ACCOUNTING) &
6469FORWARDED FROM THE LOCAL OFFICE. THIS COULD BE CAUSED BY EQUIPMENT FAILURES OR
6470IF THE OFFICE IS NOT EQUIPPED FOR CAMA (MOST ARE).
6471
6472 <I ONCE HAD AN EQUIPMENT FAILURE HAPPEN TO ME & THE TSPS OPERATOR CAME ON
6473AND SAID, "WHAT # ARE YOU CALLING FROM?" OUT OF CURIOSITY, I GAVE HER THE # TO
6474MY CO, SHE THANKED ME & THEN I WAS CONNECTED TO A CONVERSION THAT APPEARED TO
6475BE BETWEEN A FIRE MAN & HIS WIFE. THEN IT STARTED RINGING THE PARTY I
6476ORIGINALLY WANTED TO CALL & EVERYONE PHREAKED OUT (EXCUSE THE PUN). I
6477IMMEDIATELY DROPPED THIS DUAL LINE CONFERENCE!>
6478
6479 YOU SHOULDN'T MESS WITH THE TSPS OPERATOR SINCE SHE KNOWS WHERE YOU ARE
6480CALLING FROM. SHE ALSO KNOWS WHETHER OR NOT YOU ARE AT A FORTRESS FONE & SHE
6481CAN TRACE CALLS QUITE READILY. OUT OF ALL THE OPERATORS, SHE IS ONE OF THE
6482MOST DANGEROUS.
6483
6484INWARD OPERATOR:
6485____________________________________________________________
6486
6487 THIS OPERATOR ASSISTS YOUR LOCAL TSPS ("0") OPERATOR IN CONNECTING CALLS.
6488
6489 Page 106
6490
6491
6492
6493
6494 The Official Phreaker's Manual
6495
6496SHE WILL NEVER QUESTION A CALL AS LONG AS THE CALL IS WITHIN HER SERVICE AREA.
6497SHE CAN ONLY BE REACHED VIA OTHER OPERATORS OR BY A BLUE BOX. FROM A BB, YOU
6498WOULD DIAL KP+NPA+121+ST FOR THE INWARD OPERATOR THAT WILL HELP YOU CONNECT ANY
6499CALLS WITHIN THAT NPA AREA ONLY. (BLUE BOXING WILL BE DISCUSSED IN A FUTURE
6500PART OF BASIC TELCOM)
6501
6502DIRECTORY ASSISTANCE OPERATOR:
6503____________________________________________________________
6504
6505 THIS IS THE OPERATOR THAT YOU ARE CONNECTED TO WHEN YOU DIAL: 411 OR
6506NPA-555-1212. SHE DOES NOT READILY KNOW WHERE YOU ARE CALLING FROM. SHE DOES
6507NOT HAVE ACCESS TO UNLISTED #'S, BUT SHE DOES KNOW IF AN UNLISTED # EXISTS FOR
6508A CERTAIN LISTING.
6509
6510 THERE IS ALSO A DIRECTORY ASSISTANCE FOR DEAF PEOPLE WHO USE
6511TELETYPEWRITERS IF YOU MODEM CAN TRANSFER BAUDOT (THE APPLE CAT CAN), THEN YOU
6512CAN CALL HER UP AND HAVE AN INTERESTING CONVERSATION WITH HER. THE #
6513IS:800/855-1155. SHE USES THE STANDARD TELEX ABBREVIATIONS SUCH AS GA FOR GO
6514AHEAD. THEY TEND TO BE NICER & WILL TALK LONGER THAN YOUR REGULAR OPERATORS.
6515ALSO, THEY ARE MORE VULNERABLE INTO BEING TALKED OUT OF INFORMATION THROUGH THE
6516PROCESS OF "SOCIAL ENGINEERING" AS CHESHIRE CATALYST WOULD PUT IT.
6517
6518OTHER OPERATORS HAVE ACCESS TO THEIR OWN DA BY DIALING KP+NPA+131+ST (MF).
6519
6520 THIS IS A LITTLE OUT OF THE SCOPE OF THIS TUTORIAL, BUT MANY TELCO'S ARE
6521NOW CHARGING FOR CALLS TO DIR. ASST. YOU CAN BEAT THIS BY:
6522
6523(1) COUNT HOW MANY CALLS YOU MAKE TO DIRECTORY ASSISTANCE IN A BILLING PERIOD.
6524GO TO A FORTRESS FONE & DIAL DA. WHEN THE OPERATOR COMES ON, GIVE HER A NAME
6525THAT YOU KNOW HAS AN UNLISTED # OR ASK FOR A TOWN THAT ISN'T IN THE NPA. SHE
6526WILL THEN ASK FOR YOUR # SO SHE CAN CREDIT THE CALL TO YOU. GIVE HER YOUR HOME
6527#, SHE DOESN'T KNOW THAT YOU ARE MAKING A FREE CALL FROM THE FORTRESS. JUST
6528MAKE SURE THAT YOU DON'T CREDIT YOURSELF FOR MORE CALLS THAN YOU ACTUALLY MADE
6529OR YOU MIGHT HAVE A FEW PROBLEMS!
6530
6531(2) IF YOU HAVE A BAUDOT TERMINAL, USE THE 800 #, IT'S FREE & THERE IS ONE #
6532FOR ALL REQUESTS.
6533
6534C/NA OPERATORS:
6535____________________________________________________________
6536
6537 C/NA OPERATORS ARE OPERATORS THAT DO EXACTLY THE OPPOSITE OF WHAT DIRECTORY
6538ASSISTANCE OPERATORS ARE FOR. SEE PART II, FOR MORE INFO ON C/NA & #'S. IN MY
6539EXPERIENCES, THESE OPERATORS KNOW MORE THAN THE DA OP'S DO & THEY ARE MORE
6540SUSCEPTIBLE TO "SOCIAL ENGINEERING." IT IS POSSIBLE TO BULLSHIT A C/NA
6541OPERATOR FOR THE NON-PUB DA # (IE, YOU GIVE THEM THE NAME & THEY GIVE YOU THE
6542ANOTHER IN THE NETWORK.
6543
6544 PROBLEMS WITH AN OPERATOR? ASK TO SPEAK TO THEIR SUPERVISOR... WHICH IS
6545THE EQUIVALENT OF THE MADAME IN A WHOREHOUSE (IF YOU WILL EXCUSE THE ANALOGY).
6546
6547 BY THE WAY, SOME CO'S THAT WILL ALLOW YOU TO DIAL A 1 OR 0 AS THE 4TH
6548DIGIT, WILL ALSO ALLOW YOU TO CALL SPECIAL OPERATORS WITHOUT A BLUE BOX. THIS
6549IS VERY RARE THOUGH! FOR EXAMPLE, 212-121-1111 WILL GET YOU A NY INWARD
6550OPERATOR.
6551
6552OFFICE HIERARCHY
6553<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6554
6555 EVERY SWITCHING OFFICE OFFICE IN NORTH AMERICA (THE NPA SYSTEM), IS
6556ASSIGNED AN OFFICE NAME & CLASS. THERE ARE FIVE CLASSES OF OFFICES NUMBERED 1
6557THROUGH 5. YOUR CO IS MOST LIKELY A CLASS 5 OR END OFFICE. ALL LONG-DISTANCE
6558(TOLL) CALLS ARE SWITCHED BY A TOLL OFFICE WHICH CAN BE A CLASS 4, 3, 2, OR 1
6559OFFICE. THERE IS ALSO A 4X OFFICE CALLED AN INTERMEDIATE POINT. THE 4X OFFICE
6560IS A DIGITAL ONE THAT CAN HAVE AN UNATTENDED EXCHANGE ATTACHED TO IT (KNOWN AS
6561A REMOTE SWITCHING UNIT-RSU).
6562
6563 THE FOLLOWING CHART WILL LIST THE OFFICE #, NAME, & HOW MANY OF THOSE
6564OFFICES EXISTED IN NORTH AMERICA IN 1981.
6565
6566CLASS NAME ABB # EXISTING
6567----- ---------------- --- ------------
65681 REGIONAL CENTER RC 12
65692 SECTIONAL CENTER SC 67
65703 PRIMARY CENTER PC 230
65714 TOLL CENTER TC 1,30
65724P TOLL POINT TP ?
65734X INTERMEDIATE PT IP ?
65745 END OFFICE EO 19,000
6575R RSU RSU ?
6576
6577 WHEN CONNECTING A CALL FROM ONE PARTY TO ANOTHER, THE SWITCHING EQUIPMENT
6578USUALLY TRIES TO FIND THE SHORTEST ROUTE BETWEEN THE CLASS 5 END OFFICE OF THE
6579CALLER & THE CLASS 5 END OFFICE OF THE CALLED PARTY. IF NO INTER-OFFICE TRUNKS
6580EXIST BETWEEN THE 2 PARTIES, IT WILL THEN MOVE UPTO THE NEXT HIGHEST OFFICE FOR
6581SERVICING (CLASS 4). IF THE CLASS 4 OFFICE CANNOT HANDLE THE CALL BY SENDING
6582IT TO ANOTHER CLASS 4 OR 5 OFFICE, IT WILL BE SENT TO THE NEXT OFFICE IN THE
6583HIERARCHY (3). THE SWITCHING EQUIPMENT FIRST USES THE HIGH-USAGE INTEROFFICE
6584TRUNK GROUPS, IF THEY ARE BUSY IT THEN GOES TO THE FINAL TRUNK GROUPS ON THE
6585NEXT HIGHEST LEVEL. IF THE CALL CANNOT BE CONNECTED THEN, YOU WILL PROBABLY GET
6586A RE-ORDER (120IPM BUSY SIGNAL) SIGNAL. AT THIS TIME, THE GUYS AT NETWORK
6587OPERATIONS ARE PROBABLY SHITTING IN THEIR PANTS AND TRYING TO AVOID THE DREADED
6588NETWORK DREADLOCK (AS SEEN ON TV!).
6589
6590
6591 Page 108
6592
6593
6594
6595
6596 The Official Phreaker's Manual
6597
6598 IT IS ALSO INTERESTING TO NOTE THAT 9 CONNECTIONS IN TANDEM IS CALLED
6599RING-AROUND-THE ROSY AND IT HAS NEVER OCCURRED IN TELEPHONE HISTORY. THIS
6600WOULD CASE AN ENDLESS LOOP CONNECTION. [ A NEAT WAY TO REALLY SCREW-UP THE
6601NETWORK].
6602
6603 THE 10 REGIONAL CENTERS IN THE US & THE 2 IN CANADA ARE ALL INTERCONNECTED.
6604THEY FORM THE FOUNDATION OF THE ENTIRE TELEPHONE NETWORK. SINCE THERE ARE ONLY
660512 OF THEM, THEY ARE LISTED BELOW:
6606
6607CLASS 1 REGIONAL OFFICE LOCATION NPA
6608---------------------------------- ---
6609DALLAS 4 ESS 214
6610WAYNE, PA 215
6611DENVER 4T 303
6612REGINA NO.2 SP1-4W [CANADA] 306
6613ST. LOUIS 4T 314
6614ROCKDALE, GA 404
6615PITTSBURGH 4E 412
6616MONTREAL NO.1 4AETS [CANADA] 504
6617NORWICH, NY 607
6618SAN BERNARDINO, CA 714
6619NORWAY, IL 815
6620WHITE PLAINS 4T, NY 914
6621
6622 THE FOLLOWING DIAGRAM DEMONSTRATES HOW THE VARIOUS OFFICES MAY BE
6623CONNECTED:
6624
6625 _________________________
6626 _|_ _|_ _|_ REGIONAL
6627 | | | | | | OFFICES
6628 | 1 | <=--=> | 1 | <=--=> | 1 | <<==------
6629 |___| |___| |___|
6630 | OTHERSX/
6631 _________________|_______________________|
6632 _|_ _|_ _|_ _|__ _|_
6633| | | | | | | | | |
6634| 2 | | 3 | | 4 | | 4P | | 5 |
6635|___| |___| |___| |____| |___|
6636 | | | |
6637 |____ | _|__ |
6638 _|_ _|_ | __|_ _|_ X
6639| || || | || | |_____
6640| 3 || 4 || | 4X || 5 | _|__ _|_
6641|___||___|| |____||___|| || |
6642 | | | 4X || 5 |
6643 __|_ | |____||___|
6644 | ||_____________
6645 | 5R | _______|_________
6646 |____| | | |
6647 _|_ _|_ _|_ __|_
6648 | | | | | | | |
6649 | R | | 4 | | 5 | | 5R |
6650 |___| |___| |___| |____|
6651
6652NOTE: THE PRECEDING DIAGRAM USED SPECIAL SYMBOLS FROM AN APPLE //E THAT MAY NOT
6653BE VIEWED AS I INTENDED THEM IF YOU ARE NOT USING AN APPLE//E OR //C.
6654
6655SWITCHING EQUIPMENT
6656
6657 Page 109
6658
6659
6660
6661
6662 The Official Phreaker's Manual
6663
6664<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6665
6666 IN THE NETWORK, THERE ARE 3 MAJOR TYPES OF SWITCHING EQUIPMENT. THEY ARE
6667KNOWN AS: STEP, CROSSBAR, & ESS.
6668
6669
6670STEP-BY-STEP (SXS)
6671____________________________________________________________
6672
6673 THE STEP-BY-STEP, A/K/A THE STROWGER SWITCH OR TWO-MOTION SWITCH, WAS
6674INVENTED IN 1889 BY AN UNDERTAKER NAMED ALMON STROWGER. HE INVENTED THIS
6675MECHANICAL SWITCHING EQUIPMENT BECAUSE HE FELT THAT THE BIASED OPERATOR WAS
6676ROUTING ALL REQUESTS FOR AN 'UNDERTAKER' TO HER HUSBAND'S BUSINESS. BELL
6677STARTED USING THIS SYSTEM IN 1918 AS OF 1978, OVER 53% OF THE BELL EXCHANGES
6678USED THIS METHOD OF SWITCHING.
6679
6680 STEP-BY-STEP SWITCHING IS CONTROLLED DIRECTLY BY THE DIAL PULSES WHICH MOVE
6681A SERIES OF SWITCHES (CALLED THE SWITCH TRAIN) IN ORDER. WHEN YOU FIRST PICK UP
6682THE FONE UNDER SXS, A LINEFINDER ACKNOWLEDGES THE REQUEST (SOONER OR LATER) BY
6683SENDING A DIAL TONE. IF YOU THEN DIALED 1234, THE EQUIPMENT WOULD FIRST FIND
6684AN IDLE SELECTOR SWITCH. IT WOULD THEN MOVE VERTICALLY 1 PULSE, IT WOULD THEN
6685MOVE HORIZONTALLY TO FIND A FREE SECOND SELECTOR, IT WOULD THEN MOVE 2 VERTICAL
6686PULSES, STEP HORIZONTALLY TO FIND THE NEXT SELECTOR, ETC. THUS THE FIRST
6687SWITCH IN THE TRAIN TAKES NO DIGITS, THE SECOND SWITCH TAKES 1 DIGIT, THE THIRD
6688SWITCH TAKES 1 DIGIT, & THE LAST SWITCH IN THE TRAIN (CALLED THE CONNECTOR)
6689TAKES THE LAST 2 DIGITS & CONNECTS YOUR CALLS. A NORMAL (10,000 LINE) EXCHANGE
6690REQUIRES 4 DIGITS (0000-9999) TO CONNECT A LOCAL CALL & THUS IT TAKES 4
6691SWITCHES TO CONNECT EVERY CALL (LINEFINDER, 1ST & 2ND SELECTORS, & THE
6692CONNECTOR) .
6693
6694 WHILE IT WAS THE FIRST, SXS SUCKS FOR THE FOLLOWING REASONS:
6695
6696[1] THE SWITCHED OFTEN BECOME JAMMED THUS THE CALLS OFTEN BECOME BLOCKED.
6697
6698[2] YOU CAN'T USE DTMF (DUAL-TONE MULTI-FREQUENCY A/K/A TOUCH-TONE) DIRECTLY.
6699IT IS POSSIBLE THAT THE TELCO MAY HAVE INSTALLED A CONVERSION KIT BUT THEN THE
6700CALLS WILL GO THROUGH JUST AS SLOW AS PULSE, ANYWAY!
6701
6702[3] THEY USE A LOT OF ELECTRICITY & MECHANICAL MAINTENANCE. (BAD FROM TELCO
6703POINT OF VIEW)
6704
6705[4] EVERYTHING IS HARDWIRED.
6706
6707 THEY CAN STILL HOOK UP PEN REGISTERS & OTHER SHIT ON THE LINE SO IT IS NOT
6708EXACTLY A PHREAK HAVEN.
6709
6710YOU CAN IDENTIFY SXS OFFICES BY:
6711
6712(1) LACK OF DTMF OR PULSING DIGITS AFTER DIALING DTMF.
6713
6714(2) IF YOU GO NEAR THE CO, IT WILL SOUND LIKE A TYPEWRITER TESTING FACTORY.
6715
6716(3) LACK OF SPEED CALLING, CALL FORWARDING, & OTHER CUSTOMER SERVICES.
6717
6718(4) FORTRESS FONES THAT WANT YOUR MONEY FIRST (AS OPPOSED TO DIAL TONE FIRST
6719ONES).
6720
6721 THE PRECEDING DON'T NECESSARILY IMPLY THAT YOU HAVE SXS BUT THEY SURELY
6722
6723 Page 110
6724
6725
6726
6727
6728 The Official Phreaker's Manual
6729
6730GIVE EVIDENCE THAT IT MIGHT BE. ALSO, IF ANY OF THE ABOVE CHARACTERISTICS
6731EXIST, IT CERTAINLY ISN'T ESS! ALSO, SXS HAVE PRETTY MUCH BEEN ERADICATED FROM
6732LARGE METROPOLITAN AREAS SUCH AS NYC (212).
6733
6734CROSSBAR:
6735____________________________________________________________
6736
6737 THERE ARE 3 MAJOR TYPES OF CROSSBAR SYSTEMS CALLED: NO. 1 CROSSBAR (1XB),
6738NO. 4 CROSSBAR (4XB), & NO. 5 CROSSBAR (5XB). 5XB HAS BEEN THE PRIMARY END
6739OFFICE SWITCH OF BELL SINCE THE 60'S AND THUS IT IS IN WIDE-USE.
6740
6741 CROSSBAR USES A COMMON CONTROL SWITCHING METHOD. WHEN THERE IS AN INCOMING
6742CALL, A STORED PROGRAM DETERMINES ITS ROUTE THROUGH THE SWITCHING MATRIX.
6743
6744POINT WHERE THESE 2 LINES MEET IN THE MATRIX IS THE CONNECTION.
6745
6746
6747ESS
6748____________________________________________________________
6749
6750ELECTRONIC SWITCHING SYSTEM (ESS) THE PHREAK'S NIGHTMARE COME TRUE (OR ORWELL'S
6751PROPHECY AS 2600 PUTS IT)
6752
6753 ESS IS BELL'S MOVE TOWARDS THE AIRSTRIP ONE SOCIETY DEPICTED IN ORWELL'S
67541984. WITH ESS, EVERY SINGLE DIGIT THAT YOU DIAL IS RECORDED--EVEN IF IT IS A
6755MISTAKE. THEY KNOW WHO YOU CALL, WHEN YOU CALL, HOW LONG YOU TALKED FOR, &
6756PROBABLY WHAT YOU TALKED ABOUT (IN SOME CASES). ESS CAN (AND IS) ALSO
6757PROGRAMMED TO PRINT OUT #'S OF PEOPLE WHO MAKE EXCESSIVE CALLS TO 800 #'S OR
6758DIRECTORY ASSISTANCE. THIS IS CALLED THE "800 EXCEPTIONAL CALLING REPORT." ESS
6759COULD ALSO BE PROGRAMMED TO PRINT OUT LOGS OF WHO CALLS CERTAIN #'S--LIKE A
6760BOOKIE, A KNOWN COMMUNIST, A BBS, ETC THE THING TO REMEMBER WITH ESS IS THAT IT
6761IS A SERIES OF PROGRAMS WORKING TOGETHER. THESE PROGRAMS CAN BE VERY EASILY
6762CHANGED TO DO WHATEVER THEY WANT IT TO DO. ONE PHREAK WHOM I KNOW HAS SOME ESS
6763SOURCE CODE LISTING WHICH IS INCREDIBLY COMPLEX (AS WELL AS DOCUMENTED--GRACIAS
6764DIOS). THIS SYSTEM MAKES THE JOB OF BELL SECURITY, THE FBI, NSA, & OTHER
6765ORGANIZATIONS THAT LIKE TO INVADE PRIVACY INCREDIBLY EASY.
6766
6767 WITH ESS, TRACING IS DONE IN MICROSECONDS (EINE AUGENBLICK) & THE RESULTS
6768ARE PRINTED AT THE CONSOLE OF A BELL GESTAPO OFFICER. ESS WILL ALSO PICK UP
6769ANY "FOREIGN" TONES ON THE LINE SUCH AS 2600 HZ!
6770
6771 BELL PREDICTS THAT THE COUNTRY WILL BECOME TOTALLY ESS BY THE 1990'S.
6772
6773 YOU CAN IDENTIFY ESS BY THE FOLLOWING WHICH ARE USUALLY ESS FUNCTIONS:
6774
6775[1] DIALING 911 FOR HELP.
6776[2] DIAL-TONE-FIRST FORTRESSES.
6777[3] CUSTOM CALLING SERVICES SUCH AS:CALL FORWARDING, SPEED DIALING, & CALL
6778WAITING. (ASK YOUR BUSINESS OFFICE IF YOU CAN GET THESE.)
6779[4] ANI (AUTOMATIC NUMBER IDENTIFICATION) ON LD CALLS.
6780
6781 PHREAKING DOES NOT COME TO A COMPLETE HALT UNDER ESS THOUGH--JUST BE VERY
6782
6783 DUE TO THE FACT THAT ESS SENDS A COMPUTER GENERATED "ARTIFICIAL RING,"
6784WHERE THE VOICE IS NOT CONNECTED DIRECTLY TO THE CALLED PARTIES LINE UNTIL HE
6785
6786 Page 111
6787
6788
6789
6790
6791 The Official Phreaker's Manual
6792
6793PICKS UP, BLACK BOXES & INFINITY TRANSMITTERS WILL NOT WORK!
6794
6795NOTE: ANOTHER INTERESTING WAY TO FIND OUT WHAT TYPE OF EQUIPMENT YOU ARE ON IS
6796TO RAID THE TRASH CAN OF YOU LOCAL CO--THIS ART WILL DISCUSSED IN A SEPARATE
6797ARTICLE SOON.
6798
6799COMING SOON:
6800<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
6801
6802IN THE PART V, WE WILL START TO TAKE A LOOK AT TELEPHONE ELECTRONICS.
6803
6804FURTHER READING:
6805
6806FOR MORE INFORMATION ON THE ABOVE TOPICS, I SUGGEST THE FOLLOWING:
6807
6808NOTES ON THE NETWORK, AT&T, 1980.
6809
6810UNDERSTANDING TELEPHONE ELECTRONICS,TEXAS INSTRUMENTS, 1983.
6811
6812AND SUBSCRIPTIONS TO:
6813
6814TAP, ROOM 603, 147 W 42 ST, NEW YORK, NY 10036. SUBSCRIPTIONS ARE
6815$10/YEAR.#BACK ISSUES ARE $0.75. THE CURRENT ISSUES IS #90 (JAN/FEB 1984)
6816
68172600, BOX 752, MIDDLE ISLAND, NY 11953. SUBSCRIPTIONS ARE $10/YEAR. BACKISSUES
6818ARE $1 EACH. THE CURRENT ISSUE IS #4 (APRIL 1984).
6819
6820THEY ARE BOTH EXCELLENT SOURCES OF ALL SORTS OF INFORMATION (PRIMARILY
6821PHREAKING/HACKING).
6822
6823NOTE: FOR THE MOST PART, I HAVE ASSUMED THAT YOU HAVE READ MY PREVIOUS 3
6824COURSES IN THE BASIC TELCOM SERIES.
6825
6826HASTA LUEGO,
6827
6828*****BIOC
6829*=$=*AGENT
6830*****003
6831
6832APRIL 13, 1984 [THE YEAR OF BIG BROTHER]
6833
6834<<=-FARGO 4A-=>>
6835
6836
6837
6838
6839
6840
6841
6842
6843
6844
6845
6846
6847
6848
6849
6850
6851
6852 Page 112
6853
6854
6855
6856
6857 The Official Phreaker's Manual
6858
6859 ************* << BIOC AGENT 003'S COURSE IN >> *************
6860 * *
6861 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
6862 * %$ BASIC TELECOMMUNICATIONS $% *
6863 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
6864 * PART V *
6865 * *
6866 ************************************************************
6867
6868
6869PREFACE:
6870
6871 PREVIOUS INSTALLMENTS OF THIS SERIES WERE FOCUSED ON TELEPHONY FROM A
6872NETWORK POINT-OF-VIEW. PART V WILL DEAL WITH TELEPHONE ELECTRONICS FOCUSING
6873PRIMARILY ON THE SUBSCRIBER'S TELEPHONE. HERE-IN-AFTER SIMPLY REFERRED TO AS
6874"FONE."
6875
6876WIRING:
6877____________________________________________________________
6878
6879 ASSUMING A STANDARD ONE-LINE FONE, THERE ARE USUALLY 4 WIRES THAT LEAD OUT
6880OF THE FONE SET. THESE ARE STANDARDLY COLORED RED, GREEN, YELLOW, & BLACK.
6881THE RED & GREEN SIRES ARE THE TWO THAT ARE ACTUALLY HOOKED UP TO YOUR CO. THE
6882YELLOW WIRE IS SOMETIMES USED TO RING DIFFERENT FONES ON A PARTY LINE (IE, ONE
6883#, SEVERAL FAMILIES--FOUND PRIMARILY IN RURAL AREAS WHERE THEY PAY LESS FOR THE
6884SERVICE AND THEY DON'T USE THE FONE AS MUCH); OTHERWISE, THE YELLOW IS USUALLY
6885JUST IGNORED. ON SOME TWO-LINE FONES, THE RED & GREEN WIRES ARE USED FOR THE
6886FIRST FONE # AND THE YELLOW & BLACK ARE USED FOR THE SECOND LINE. IN THIS CASE
6887 IN TELEPHONY, THE RED & GREEN WIRES ARE OFTEN REFERRED TO AS TIP (T) & RING
6888(R). THE TIP IS USUALLY THE MORE POSITIVE OF THE TWO WIRES. THIS NAMING GOES
6889BACK TO THE OLD OPERATOR CORD BOARDS WHERE ONE OF THE WIRES WAS THE TIP OF THE
6890PLUG AND THE OTHER WAS THE RING (OF THE BARREL).
6891 A ROTARY FONE (AKA DIAL OR PULSE) WILL WORK FINE REGARDLESS WHETHER THE RED
6892(OR GREEN) WIRE IS CONNECTED THE TIP(+) OR RING(-). A TOUCH-TONE (TM) FONE IS
6893A DIFFERENT STORY, THOUGH. IT WILL NOT WORK EXCEPT IF THE TIP(+) IS THE GREEN
6894WIRE. [ALTHOUGH, SOME OF THE MORE EXPENSIVE DTMF FONES DO HAVE A RECTIFIER
6895BRIDGE WHICH COMPENSATES FOR POLARITY REVERSAL.] THIS I WHY UNDER CERTAIN
6896(NON-DIGITAL) SWITCHING EQUIPMENT YOU CAN REVERSE THE RED & GREEN WIRES ON A
6897TOUCH-TONE FONE AND RECEIVE FREE DTMF SERVICE. EVEN THOUGH IT WON'T BREAK DIAL
6898TONE, REVERSING THE WIRES ON A ROTARY LINE ON A DIGITAL SWITCH WILL CAUSE THE
6899TONES TO BE GENERATED.
6900
6901VOLTAGES, ETC.
6902____________________________________________________________
6903
6904 WHEN YOUR TELEPHONE IS ON-HOOK (IE, HUNG UP) THERE IS APPROXIMATELY 48
6905VOLTS OF DC CURRENT (VDC) FLOWING THROUGH THE TIP & RING. WHEN THE HANDSET OF
6906A FONE IS LIFTED A FEW SWITCHES CLOSE WHICH CAUSE A LOOP TO BE CONNECTED (KNOWN
6907AS THE "LOCAL LOOP") BETWEEN YOUR FONE & THE CO. ONCE THIS HAPPENS DC CURRENT
6908IS ABLE TO FLOW THROUGH THE FONE WITH LESS RESISTANCE. THIS CAUSES A RELAY TO
6909ENERGIZE WHICH CAUSES OTHER CO EQUIPMENT TO REALIZE THAT YOU WANT SERVICE.
6910EVENTUALLY, YOU SHOULD END UP WITH A DIAL TONE. THIS ALSO CAUSES THE 48 VDC TO
6911DROP DOWN INTO THE VICINITY OF 13 VOLTS. THE RESISTANCE OF THE LOOP ALSO DROPS
6912BELOW THE 2500 OHM LEVEL.
6913
6914 Page 113
6915
6916
6917
6918
6919 The Official Phreaker's Manual
6920
6921
6922 AS OF NOW, YOU ARE PROBABLY SAYING TO YOURSELF THAT THIS IS ALL NICE AND
6923TECHNICAL BUT WHAT THE HELL GOOD IS THE INFORMATION. WELL, ALSO CONSIDER THAT
6924THIS VOLTAGE (& RESISTANCE) DROP IS HOW THE CO DETECTS THAT A FONE WAS TAKEN
6925OFF HOOK (PICKED UP). IN THIS WAY, THEY KNOW WHEN TO START BILLING THE CALLING
6926NUMBER. NOW WHAT DO YOU SUPPOSE WOULD HAPPEN IF A DEVICE SUCH AS A RESISTOR OR
6927A ZENER DIODE WAS PLACED ON THE CALLED PARTIES LINE SO THAT THE VOLTAGE WOULD
6928DROP JUST ENOUGH TO ALLOW TALKING BUT NOT ENOUGH TO START BILLING? FIRST OFF,
6929THE CALLING PARTY WOULD NOT BE BILLED FOR THE CALL BUT CONVERSATION COULD BE
6930PURSUED. SECONDLY, THE CO EQUIPMENT WOULD THINK THAT THE FONE JUST KEPT ON
6931RINGING. THE TELCO CALLS THIS A "NO-NO" (TOLL FRAUD TO BE MORE SPECIFIC) WHILE
6932PHONE PHREAKS AFFECTIONATELY CALL THIS MUTE A BLACK BOX.
6933
6934 THE FOLLOWING ARE INSTRUCTIONS ON HOW TO BUILD A SIMPLE BLACK BOX. OF
6935COURSE, ANYTHING THAT PREVENTS THE VOLTAGE FROM DROPPING WOULD WORK.
6936YOU ONE OR TWO PARTS: A SPST TOGGLE SWITCH AND A 10,000 OHM (10 K), 1/2
6937WATT RESISTOR. ANY ELECTRONICS STORE SHOULD STOCK THESE PARTS.
6938
6939 NOW, CUT 2 PIECES OF WIRE (ABOUT 6 INCHES LONG) AND ATTACH ONE END OF EACH
6940WIRE TO ONE OF THE TERMINALS ON THE SWITCH. NOW TURN YOUR K500 (STANDARD DESK
6941FONE) UPSIDE DOWN AND TAKE OFF THE COVER. LOCATE THE 2 SCREWS ON THE NETWORK
6942BOX LABELED >F< AND >RR<. WRAP THE RESISTOR BETWEEN THE 2 SCREWS MAKING SURE
6943THAT IT DOESN'T TOUCH ANY OTHER TERMINALS!. NOW CONNECT ONE WIRE FROM THE
6944SWITCH TO THE RR TERMINAL. FINALLY, ATTACH THE REMAINING WIRE TO THE GREEN WIRE
6945(DISCONNECT IT FROM ITS TERMINAL). NOW BRING THE SWITCH OUT THE REAR OF THE
6946FONE AND REPLACE THE COVER.
6947
6948 PUT THE SWITCH IN A POSITION WHERE YOU RECEIVE A DIAL TONE. MARK THIS
6949POSITION NORMAL. MARK THE OTHER SIDE FREE.
6950
6951 WHEN YOUR PHRIENDS CALL (AT A PREARRANGED TIME), QUICKLY LIFT & DROP THE
6952RECEIVER AS FAST A POSSIBLE. THIS WILL STOP THE RINGING (DO IT AGAIN IF IT
6953DOESN'T) WITH OUT STARTING THE BILLING. IT IS IMPORTANT THAT YOU DO IT QUICKLY
6954(LESS THAN ONE SECOND THEN PUT THE SWITCH IN THE FREE POSITION AND PICK UP THE
6955FONE. KEEP ALL CALL SHORT AND PREFERABLY UNDER 15 MINUTES.
6956
6957NOTE: IF ANYONE PICKS UP AN EXTENSION IN THE CALLED PARTIES HOUSE AND THAT
6958FONE IS NOT SET FOR FREE THEN BILLING WILL START.
6959
6960NOTE: AN OLD WAY OF SIGNALING A PHRIEND THAT YOU ARE ABOUT TO CALL IS
6961MAKING A COLLECT CALL TO A NON-EXISTENT PERSON IN THE HOUSE. SINCE YOUR FRIEND
6962WILL NOT ACCEPT THE CHARGES, HE WILL KNOW THAT YOU ARE ABOUT TO CALL AND THUS
6963PREPARE THE BLACK BOX (OR VISA VERSA).
6964
6965WARNING: THE TELCO CAN DETECT BLACK BOXES IF THEY SUSPECT ONE ON YOUR LINE.
6966THIS IS DONE DUE TO THE PRESENCE OF AC VOICE SIGNAL AT THE WRONG DC LEVEL!
6967
6968PICTORIAL DIAGRAM: (STANDARD ROTARY K500 FONE)
6969____________________________________________________________
6970
6971 _____________________________________
6972| |
6973***BLUE WIRE**>>F< |
6974| * * |
6975**WHITE WIRE** * |
6976| * |
6977| RESISTOR |
6978| * |
6979
6980 Page 114
6981
6982
6983
6984
6985 The Official Phreaker's Manual
6986
6987| * |
6988| >RR<*******SWITCH**** |
6989| * |
6990****GREEN WIRE********************** |
6991| |
6992|_____________________________________|
6993
6994NOTE: THE BLACK BOX WILL NOT WORK UNDER ESS OR OTHER SIMILAR DIGITAL
6995SWITCHES SINCE ESS DOES NOT CONNECT THE VOICE CIRCUITS UNTIL THE FONE IS PICKED
6996UP (& BILLING STARTS). INSTEAD, ESS USES AN "ARTIFICIAL" COMPUTER GENERATED
6997RING.
6998
6999RINGING:
7000____________________________________________________________
7001
7002 TO INFORM A SUBSCRIBER OF AN INCOMING CALL, THE TELCO SENDS 90 VOLTS (RMS)
7003OF AC CURRENT DOWN THE LINE (AT AROUND 15 TO 60 HZ) IN STANDARD FONES, THIS
7004CAUSES A METAL ARMATURE TO BE ATTRACTED ALTERNATELY BETWEEN TWO ELECTRO-MAGNETS
7005THUS STRIKING 2 BELLS. OF COURSE, THE STANDARD BELL (PATENTED IN 1878 BY TOM
7006A. WATSON) CAN BE REPLACED BY A MORE MODERN ELECTRONIC BELL OR SIGNALING
7007DEVICE.
7008
7009 ALSO, YOU CAN HAVE LIGHTS AND OTHER SIMILAR DEVICES IN LIEU OF (OR IN
7010CONJUNCTION WITH) THE BELL. A SIMPLE NEON LIGHT (WITH ITS CORRESPONDING
7011RESISTOR) CAN SIMPLY BE CONNECTED BETWEEN THE RED & GREEN WIRES (USUALLY L1 &
7012L2 ON THE NETWORK BOX) SO THAT IT LIGHTS UP ON INCOMING CALLS. A REGULAR 60
7013WATT LIGHT BULB CAN ALSO BE HOOKED UP USING A SIMPLE (120 VAC) RELAY.
7014
7015WARNING: 90 & 120 VAC CAN GIVE QUITE A SHOCK. EXERCISE EXTREME CAUTION IF
7016YOU WISH TO FURTHER PURSUE THESE TOPICS.
7017
7018 ALSO INCLUDED IN THE RINGING CIRCUIT IS A CAPACITOR TO PREVENT THE DC
7019CURRENT FROM INTERFERING WITH THE BELL [A CAPACITOR WILL PASS AC CURRENT WHILE
7020IT WILL PREVENT DC CURRENT FROM FLOWING (BY STORING IT)].
7021 ANOTHER REASON THAT THE TELCO HATES BLACK BOXES IS BECAUSE RINGING USES
7022ALOT OF COMMON-CONTROL EQUIPMENT, IN THE CO, WHICH USE ALOT OF ELECTRICITY.
7023THUS THE RINGING GENERATORS ARE BEING TIED UP WHILE A FREE CALL IS BEING MADE.
7024USUALLY CALLS THAT ARE ALLOWED TO RING FOR A LONG PERIOD OF TIME MAY BE
7025CONSTRUED AS SUSPICIOUS. SOME OFFICES MAY BE SET UP TO DROP A TROUBLE CARD FOR
7026LONG PERIODS OF RINGING THEN A "NO-NO" DETECTION DEVICE MAY BE PLACED ON THE
7027LINE.
7028 INCIDENTALLY, THE TERM "RING TRIP" REFERS TO THE CO PROCESS INVOLVED TO
7029STOP THE AC RINGING SIGNAL WHEN THE CALLING FONE GOES OFF HOOK.
7030
7031NOTE: IT IS SUGGESTED THAT YOU ACTUALLY DISSECT FONES TO HELP YOU BETTER
7032UNDERSTAND THEM. IT WILL ALSO HELP YOU TO BETTER UNDERSTAND THE CONCEPTS HERE
7033IF YOU ACTUALLY PROVE THEM TO YOURSELF. FOR EXAMPLE, ACTUALLY TAKE THE VOLTAGE
7034READINGS ON YOUR FONE LINE [ANY SIMPLE MULTI-TESTER (A MUST) WILL DO.]
7035PHREAKING IS AN INTERACTIVE PROCESS NOT A PASSIVE ONE!
7036
7037DIALING:
7038____________________________________________________________
7039
7040 ON A STANDARD FONE, THERE ARE TWO COMMON TYPES OF DIALING: PULSE & DTMF.
7041OF COURSE, SOME PEOPLE INSIST UPON BEING DIFFERENT AND DON'T USE THE DT THUS
7042LEAVING THEM WITH MF (MULTI FREQUENCY, AKA OPERATOR, BLUE BOX) TONES. THIS IS
7043ANOTHER "NO-NO" AND THE TELCO SECURITY GENTLEMEN HAVE A SPECIAL KNACK FOR
7044DEALING WITH SUCH "PHREAKS" ON THE NETWORK.
7045
7046 Page 115
7047
7048
7049
7050
7051 The Official Phreaker's Manual
7052
7053 WHEN YOU DIAL ROTARY, YOU ARE ACTUALLY RAPIDLY BREAKING & RECONNECTING
7054(MAKING) THE LOCAL LOOP ONCE FOR EVERY DIGIT DIALED. SINCE THE PHYSICAL
7055CONNECTION MUST BE BROKEN, YOU CANNOT DIAL IF ANOTHER EXTENSION (OF THAT #) IS
7056OFF-HOOK. NEITHER OF THE FONES WILL BE ABLE TO DIAL PULSE UNLESS THE OTHER
7057HANGS UP.
7058 ANOTHER TERM OFTEN REFERRED TO IN TELEPHONE ELECTRONICS IS THE BREAK RATIO.
7059IN THE US, THERE ARE 10 PULSES PER SECOND (MAX). WHEN THE CIRCUIT IS OPENED IT
7060IS CALLED THE BREAK INTERVAL. WHEN IT IS CLOSED IT IS CALLED THE MAKE INTERVAL.
7061IN THE US, THERE IS A 60 MILLISECOND (MS) BREAK PERIOD AND A 40 MS MAKE PERIOD.
7062(60+40=100 MS = 1/10 MINUTE). THIS IS REFERRED TO AS A 60% BREAK INTERVAL.
7063SOME OF THE MORE SOPHISTICATED ELECTRONIC FONES CAN SWITCH BETWEEN A 60% & A
706467% BREAK INTERVAL. THIS IS DUE TO THE FACT THAT MANY FOREIGN NATIONS USE A
706567% BREAK INTERVAL.
7066 HAVE YOU EVER BEEN IN AN OFFICE OR A SIMILAR FACILITY AND SAW A FONE
7067WAITING TO BE USED FOR A FREE CALL BUT SOME ASSHOLE PUT A LOCK ON IT TO PREVENT
7068OUTGOING CALLS?
7069 WELL, DON'T FRET PHELLOW PHREAKS, YOU CAN SIMULATE PULSE DIALING BY RAPIDLY
7070DEPRESSING THE SWITCHOOK. (IF YOU DEPRESS IT FOR LONGER THAN A SECOND IT WILL
7071BE CONSTRUED AS A DISCONNECT.) BY RAPIDLY SWITCHOOKING YOU ARE CAUSING THE
7072LOCAL LOOP TO BE BROKEN & MADE SIMILAR TO ROTARY DIALING! THUS IF YOU CAN
7073MANAGE TO SWITCHOOK RAPIDLY 10 TIMES YOU CAN REACH AN OPERATOR TO PLACE ANY
7074CALL YOU WANT! THIS TAKES ALOT OF PRACTICE, THOUGH. YOU MIGHT WANT TO PRACTICE
7075ON YOUR OWN FONE DIALING A FRIEND'S # OR SOMETHING ELSE. INCIDENTALLY, THIS
7076METHOD WILL ALSO WORK WITH DTMF FONES SINCE ALL DTMF LINES CAN ALSO HANDLE
7077ROTARY.
7078 ANOTHER PROBLEM WITH PULSE DIALING IS THAT IT PRODUCES HIGH-VOLTAGE SPIKES
7079THAT MAKE LOUD NOISES IN THE EARPIECE AND CAUSE THE BELL TO "TINKLE." IF YOU
7080NEVER NOTICED THIS THEN YOUR FONE HAS A SPECIAL "ANTI-TINKLE" & EARPIECE
7081SHORTING CIRCUIT (MOST DO). IF YOU HAVE EVER DISSECTED A ROTARY FONE (A MUST
7082FOR ANY SERIOUS PHREAK) YOU WOULD HAVE NOTICED THAT THERE ARE 2 SETS OF CONTACT
7083THAT OPEN AND CLOSE DURING PULSING (ON THE BACK OF THE ROTARY DIAL UNDER THE
7084PLASTIC COVER). ONE OF THESE ACTUALLY OPENS AND
7085CLOSES THE LOOP WHILE THE OTHER MUTES THE EARPIECE BY SHORTING IT OUT. THE
7086SECOND CONTACTS ALSO ACTIVATES A SPECIAL ANTI-TINKLE CIRCUIT THAT PUTS A 340
7087OHM RESISTOR ACROSS THE RINGING CIRCUIT WHICH PREVENTS THE HIGH VOLTAGE SPIKES
7088FROM INTERFERING WITH THE BELL.
7089 DUAL TONE MULTI FREQUENCY (DTMF) IS A MODERN DAY IMPROVEMENT ON PULSE
7090DIALING IN SEVERAL WAYS. FIRST OF ALL, IT IS MORE CONVENIENT FOR THE USER
7091SINCE IT IS FASTER AND CAN BE USED FOR SIGNALING AFTER THE CALL IS COMPLETED
7092(IE, SCC'S, COMPUTERS, ETC.). ALSO, IT IS MORE UPTO PAR WITH MODERN DAY
7093SWITCHING EQUIPMENT (SUCH AS ESS) SINCE PULSE DIALING WAS DESIGNED TO ACTUALLY
7094MOVE RELAYS BY THE NUMBER OF DIGITS DIALED (IN SXS OFFICES).
7095
7096 EACH KEY ON A DTMF KEYPAD PRODUCES 2 FREQUENCIES SIMULTANEOUSLY (ONE FROM
7097THE HIGH GROUP AND ANOTHER FROM THE LOW GROUP).
7098
7099 _______________________________________________
7100LOW GROUP | | | | |
7101 697 HZ-| Q | ABC | DEF | |
7102 | 1 | 2 | 3 | A |
7103 |___________|___________|___________|___________|
7104 | | | | |
7105 770 HZ-| GHI | JKL | MNO | |
7106 | 1 | 2 | 3 | B |
7107 |___________|___________|___________|___________|
7108 | | | | |
7109 852 HZ-| PRS | TUV | WXY | |
7110 | 1 | 2 | 3 | C |
7111
7112 Page 116
7113
7114
7115
7116
7117 The Official Phreaker's Manual
7118
7119 |___________|___________|___________|___________|
7120 | | OPERATOR | | |
7121 941 HZ-| | Z | | |
7122 | * | 0 | # | D |
7123 |___________|___________|___________|___________|
7124 | | | |
7125 1209 HZ 1336 HZ 1477 HZ 1633 HZ
7126 HIGH GROUP
7127
7128A PORTABLE DTMF KEYPAD IS KNOWN AS A WHITE BOX.
7129
7130 THE FOURTH COLUMN (1633 HZ) IS NOT NORMALLY FOUND ON REGULAR FONES BUT IT
7131DOES HAVE SEVERAL SPECIAL USES. FOR ONE, IT IS USED TO DESIGNATE THE PRIORITY
7132OF CALLS ON AUTOVON, THE MILITARY FONE NETWORK. THESE KEY ARE CALLED: FLASH,
7133IMMEDIATE, PRIORITY, & ROUTINE (WITH VARIATIONS) INSTEAD OF ABCD. SECONDLY,
7134THESE KEYS ARE USED FOR TESTING PURPOSES BY THE TELCO. IN SOME AREA YOU CAN
7135FIND LOOPS AS WELL AS OTHER NEAT TESTS (SEE PART II) ON THE 555-1212 DIRECTORY
7136ASSISTANCE EXCHANGE. FOR THIS, YOU WOULD CALL UP AN DA IN CERTAIN AREAS [THAT
7137HAVE AN AUTOMATIC CALL DISTRIBUTOR (ACD)] AND HOLD DOWN THE "D" KEY WHICH
7138SHOULD BLOW THE OPERATOR OFF. YOU WILL THEN HEAR A PULSING DIAL TONE WHICH
7139INDICATES THAT YOU ARE IN THE ACD INTERNAL TESTING MODE. YOU CAN GET ON ONE
7140SIDE OF A LOOP BY DIALING A 6. THE OTHER SIDE IS 7. SOME PHREAKS CLAIM THAT
7141IF THE PERSON ON SIDE 6 HANGS UP, OCCASIONALLY THE EQUIPMENT WILL SCREW UP AD
7142START DIRECTING DIRECTORY ASSISTANCE CALLS TO THE OTHER SIDE OF THE LOOP.
7143ANOTHER ALLEGED TEST IS CALLED REMOB WHICH ALLOWS YOU TO TAP INTO LINES BY
7144ENTERING A SPECIAL CODE FOLLOWED BY THE 7 DIGIT NUMBER YOU WANT TO MONITOR.
7145THEN THERE IS THE POSSIBILITY OF MASS CONFERENCING.
7146 ACD'S ARE BECOME RARE THOUGH. YOU WILL PROBABLY HAVE TO MAKE SEVERAL
7147NPA-555- 1212 CALLS BEFORE YOU FIND ONE.
7148 YOU CAN MODIFY REGULAR FONES QUITE READILY SO THAT THEY HAVE A SWITCH TO
7149CHANGE BETWEEN THE 3RD AND 4TH COLUMNS. THIS IS CALLED A SILVER BOX (AKA GREY
7150BOX) AD PLANS CAN BE FOUND IN TAP AS WELL AS ON MANY BBS'S.
7151
7152TRANSMITTER/RECEIVER:
7153____________________________________________________________
7154
7155 WHEN YOU TALK INTO THE TRANSMITTER, THE SOUND WAVES FROM YOUR VOICE CAUSE A
7156DIAPHRAGM TO VIBRATE AND PRESS AGAINST THE CARBON GRANULES (OR ANOTHER SIMILAR
7157SUBSTANCE). THIS CAUSES THE CARBON GRANULES TO COMPRESS AND CONTRACT THUS
7158CHANGING THE RESISTANCE OF THE DC CURRENT FLOWING THROUGH IT. THEREFORE, YOUR
7159AC VOICE SIGNAL IS SUPERIMPOSED OVER THE DC CURRENT OF THE LOCAL LOOP. THE
7160RECEIVER WORKS IN A SIMILAR FASHION WHERE THE SIMPLE TYPES UTILIZE A MAGNET,
7161ARMATURE, & DIAPHRAGM.
7162
7163HYBRID/INDUCTION COIL:
7164____________________________________________________________
7165
7166 AS YOU MAY HAVE NOTICED, THERE ARE TWO WIRES FOR THE RECEIVER AND TWO FOR
7167THE TRANSMITTER IN THE FONE, YET THE LOCAL LOOP CONSISTS OF 2 WIRES INSTEAD OF
71684. THIS 4-WIRE TO 2-WIRE CONVERSION IS DONE INSIDE THE FONE BY A DEVICE KNOWN
7169AS AN INDUCTION COIL WHICH USES COUPLING TRANSFORMERS.
7170 THE REASON 2 SIRES ARE USED ON THE LOCAL LOOPS ARE BECAUSE IT IS ALOT
7171CHEAPER FOR THE TELCO. ALTHOUGH, ALL OF THE INTER-OFFICE TRUNKS UTILIZE 4
7172WIRES. THIS IS NECESSARY FOR FULL DUPLEX (IE, SIMULTANEOUS CONVERSATION ON
7173BOTH SIDES) AND FOR AMPLIFICATION DEVICES. THERE ARE SIMILAR DEVICES IN THE
7174CO'S, KNOWN AS A HYBRID, THAT COUPLE THE 4-WIRE TRUNKS TO THE 2-WIRE LOCAL
7175LOOPS AND VISA-VERSA.
7176
7177
7178 Page 117
7179
7180
7181
7182
7183 The Official Phreaker's Manual
7184
7185MISCELLANEOUS:
7186____________________________________________________________
7187
7188 IN THE TELEPHONE, THERE IS ALSO A BALANCING NETWORK CONSISTING OF A FEW
7189CAPACITORS & RESISTORS WHICH PROVIDE SIDETONE. SIDETONE ALLOWS THE CALLER TO
7190HEAR HIS OWN VOLUME IN THE RECEIVER. HE CAN THEN ADJUST HIS VOICE ACCORDINGLY.
7191THIS PREVENTS PEOPLE FROM SHOUTING OR SPEAKING TOO SOFTLY WITHOUT NOTICING IT.
7192
7193HOLD:
7194____________________________________________________________
7195
7196 WHEN A TELEPHONE GOES OFF HOOK, THE RESISTANCE DROPS BELOW 2500 OHMS. AT
7197THIS POINT, THE TELCO WILL SEND A DIAL TONE. TO PUT SOMEONE ON HOLD YOU MUST
7198PUT A 1000 OHM RESISTOR (1 WATT) ACROSS THE TIP & RING BEFORE IT REACHES THE
7199SWITCHOOK. IN THIS WAY, WHEN THE FONE IS HUNG UP (FOR HOLD) THE RESISTANCE
7200REMAINS BELOW 2500 OHMS WHICH CAUSES THE CO TO BELIEVE THAT YOU ARE STILL
7201OFF-HOOK. YOU CAN BUILD A SIMPLE HOLD DEVICE USING THE FOLLOWING PICTORIAL
7202DIAGRAM:
7203
7204(RED) O_________________________
7205 [L1] | | |
7206 | | |
7207 1000 OHM | X
7208 | | X
7209 RESISTOR RINGING |
7210 | CIRCUIT | -SWITCH
7211 | | | HOOK
7212 / | |
7213 / SPST SWITCH | X
7214 | | X
7215 | | |
7216 | | |
7217(GREEN) O__|_____________|______|
7218 [L2]
7219--> TO REST OF FONE
7220
7221CONCLUSION:
7222____________________________________________________________
7223
7224NOTE: MANY OF THE ELECTRONICS COMPONENTS OF NORMAL FONES (K500) ARE
7225ENCLOSED IN THE NETWORK BOX (WHICH SHOULDN'T BE OPENED).
7226
7227 I HAVE ASSUMED THAT THE READER HAS A BASIC KNOWLEDGE OF ELECTRONICS. ALSO,
7228I HAVE ASSUMED THAT YOU HAVE READ THE 4 PREVIOUS INSTALLMENTS OF THIS SERIES
7229(AND HOPEFULLY ENJOYED THEM).
7230
7231 IN PART VI, WE WILL TAKE A LOOK AT FORTRESS FONES.
7232
7233SUGGESTED FURTHER READING:
7234____________________________________________________________
7235
7236ELECTRONICS COURSES A-D, TAP, @ $.75 EACH.
7237
7238& OTHER ASSORTED SOURCES...
7239
7240TAP: ROOM 603/147 W 42 ST./NEW YORK, NY 10036. PLEASE SPECIFY BY BACKISSUE
7241#'S (NOT ARTICLE NAMES). ALL BACK-ISSUES ARE $1 EACH. SUBSCRIPTIONS ARE
7242$10/YEAR (10 ISSUES). SAY THAT BIOC AGENT 003 SENT YOU.
7243
7244
7245
7246
7247
7248
7249
7250
7251
7252
7253
7254
7255
7256
7257
7258
7259
7260
7261
7262
7263
7264
7265
7266
7267
7268
7269
7270
7271
7272
7273
7274
7275
7276
7277 Page 119
7278
7279
7280
7281
7282 The Official Phreaker's Manual
7283
7284 ************* << BIOC AGENT 003'S COURSE IN >> *************
7285 * *
7286 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
7287 * %$ BASIC TELECOMMUNICATIONS $% *
7288 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
7289 * PART VI *
7290 * *
7291 ************************************************************
7292
7293REVISED: 27-OCT-84
7294
7295Preface:
7296
7297 This article will focus primarily on the standard Western Electric
7298single-slot coin telephone (aka fortress fone) which can be divided into 3
7299types:
7300
7301- Dial-Tone First (DTF)
7302
7303- Coin-First (CF): (ie, it wants your $ before you receive a dial tone)
7304
7305- Dial Post-Pay Service (PP): you pay after the party answers
7306
7307Depositing Coins (Slugs):
7308____________________________________________________________
7309
7310 Once you have deposited your slug into a fortress, it is subjected to a
7311gamut of tests. The first obstacle for a slug is the magnetic trap. This will
7312stop any light-weight magnetic slugs and coins. If it passes this, the slug is
7313then classified as a nickel, dime, or quarter. Each slug is then checked for
7314appropriate size and weight. If these tests are passed, it will then travel
7315through a nickel, dime, or quarter magnet as appropriate. These magnets set up
7316an eddy current effect which causes coins of the appropriate characteristics to
7317slow down so they will follow the correct trajectory. If all goes well, the
7318coin will follow the correct path (such as bouncing off of the nickel anvil)
7319where it will hopefully fall into the narrow accepted coin channel.
7320 The rather elaborate tests that are performed as the coin travels down the
7321coin chute will stop most slugs and other undesirable coins, such as pennies,
7322which must then be retrieved using the coin release lever.
7323 If the slug miraculously survives the gamut, it will then strike the
7324appropriate totalizer arm causing a ratchet wheel to rotate once for every
73255-cent increment (eg, a quarter will cause it to rotate 5 times).
7326 The totalizer then causes the coin signal oscillator to readout a
7327dual-frequency signal indicating the value deposited to ACTS (a computer) or
7328the TSPS operator. These are the same tones used by phreaks in the infamous red
7329boxes.
7330 For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second (PPS).
7331A dime causes 2 beep tones at 5 - 8.5 PPS while a nickel causes one beep tone
7332at 5 - 8.5 PPS. A beep consists of 2 tones: 2200 + 1700 Hz.
7333 A relay in the fortress called the "B relay" (yes, there is also an 'A
7334relay') places a capacitor across the speech circuit during totalizer read-out
7335to prevent the "customer" from hearing the red box tones.
7336 In older 3 slot phones: one bell (1050-1100 Hz) for a nickel, two bells
7337for a dime, and one gong (800 Hz) for a quarter are used instead of the modern
7338dual-frequency tones.
7339
7340TSPS & ACTS
7341____________________________________________________________
7342
7343 Page 120
7344
7345
7346
7347
7348 The Official Phreaker's Manual
7349
7350
7351 While fortresses are connected to the CO of the area, all transactions are
7352handled via the Traffic Service Position System (TSPS). In areas that do not
7353have ACTS, all calls that require operator assistance, such as calling card and
7354collect, are automatically routed to a TSPS operator position.
7355 In an effort to automate fortress service, a computer system known as
7356Automated Coin Toll Service (ACTS) has been implemented in many areas. ACTS
7357listens to the red box signals from the fones and takes appropriate action. It
7358is ACTS which says, "Two dollars please (pause) Please deposit two dollars for
7359the next ten seconds" (and other variations). Also, if you talk for more than
7360three minutes and then hang-up, ACTS will call back and demand your money.
7361ACTS is also responsible for Automated Calling Card Service.
7362 ACTS also provide trouble diagnosis for craftspeople (repairmen
7363specializing in fortresses). For example, there is a coin test which is great
7364for tuning up red boxes. In many areas this test can be activated by dialing
736509591230 at a fortress (thanks to Karl Marx for this information). Once
7366activated it will request that you deposit various coins. It will then identify
7367the coin and outpulse the appropriate red box signal. The coins are usually
7368returned when you hang up.
7369 To make sure that there is actually money in the fone, the CO initiates a
7370"ground test" at various times to determine if a coin is actually in the fone.
7371This is why you must deposit at least a nickel in order to use a red box!
7372
7373Green Boxes:
7374____________________________________________________________
7375
7376 Paying the initial rate in order to use a red box (on certain fortresses)
7377left a sour taste in many red boxer's mouths thus the GREEN BOX was invented.
7378The green box generates useful tones such as COIN COLLECT, COIN RETURN, and
7379RINGBACK. These are the tones that ACTS or the TSPS operator would send to the
7380CO when appropriate. Unfortunately, the green box cannot be used at a fortress
7381station but it must be used by the CALLED party.
7382
7383Here are the tones:
7384
7385COIN COLLECT 700 + 1100 Hz
7386COIN RETURN 1100 + 1700 Hz
7387RINGBACK 700 + 1700 Hz
7388
7389 Before the called party sends any of these tones, an operator released
7390signal should be sent to alert the MF detectors at the CO. This can be
7391accomplished by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed
7392by a 60 ms gap and then the appropriate signal for at least 900 ms.
7393 Also, do not forget that the initial rate is collected shortly before the 3
7394minute period is up.
7395 Incidentally, once the above MF tones for collecting and returning coins
7396reach the CO, they are converted into an appropriate DC pulse (-130 volts for
7397return & +130 volts for collect). This pulse is then sent down the tip to the
7398fortress. This causes the coin relay to either return or collect the coins.
7399 The alleged "T-Network" takes advantage of this information. When a pulse
7400for COIN COLLECT (+130 VDC) is sent down the line, it must be grounded
7401somewhere. This is usually either the yellow or black wire. Thus, if the wires
7402are exposed, these wires can be cut to prevent the pulse from being grounded.
7403When the three minute initial period is almost up, make sure that the black &
7404yellow wires are severed; then hang up, wait about 15 seconds in case of a
7405second pulse, reconnect the wires, pick up the fone, hang up again, and if all
7406goes well it should be "JACKPOT" time.
7407
7408
7409 Page 121
7410
7411
7412
7413
7414 The Official Phreaker's Manual
7415
7416Physical Attack:
7417____________________________________________________________
7418
7419 A typical fortress weighs roughly 50 lbs. with an empty coin box. Most of
7420this is accounted for in the armor plating. Why all the security? Well, Bell
7421contributes it to the following:
7422
7423 "Social changes during the 1960's made the multislot coin station a
7424prime target for: vandalism, strong arm robbery, fraud, and theft of service.
7425This brought about the introduction of the more rugged single slot coin station
7426and a new environment for coin service."
7427
7428As for picking the lock, I will quote Mr. Phelps:
7429
7430 "We often fantasize about 'picking the lock' or 'getting a master
7431key.' Well, you can forget about it. I don't like to discourage people, but it
7432will save you from wasting alot of your time--time which can be put to better
7433use (heh, heh)."
7434
7435 As for physical attack, the coin plate is secured on all four side by
7436hardened steel bolts which pass through two slots each. These bolts are in
7437turn interlocked by the main lock.
7438 One phreak I know did manage to take one of the 'mothers' home (which was
7439attached to a piece of plywood at a construction site; otherwise, the permanent
7440ones are a bitch to detach from the wall!). It took him almost ten hours to
7441open the coin box using a power drill, sledge hammers, and crow bars (which was
7442empty -- perhaps next time, he will deposit a coin first to hear if it slushes
7443down nicely or hits the empty bottom with a clunk.)
7444 Taking the fone offers a higher margin of success. Although this may be
7445difficult often requiring brute force and there has been several cases of back
7446axles being lost trying to take down a fone! A quick and dirty way to open the
7447coin box is by using a shotgun. In Detroit, after ecologists cleaned out a
7448municipal pond, they found 168 coin phones rifled.
7449 In colder areas, such as Canada, some shrewd people tape up the fones using
7450duct tape, pour in water, and come back the next day when the water will have
7451froze thus expanding and cracking the fone open.In one case:
7452
7453 "unauthorized coin collectors" where caught when they brought $6,000 in
7454change to a bank and the bank became suspicious...
7455
7456 At any rate, the main lock is an eight level tumbler located on the right
7457side of the coin box. This lock has 390,625 possible positions (5 ^ 8, since
7458there are 8 tumblers each with 5 possible positions) thus it is highly pick
7459resistant! The lock is held in place by 4 screws. If there is sufficient
7460clearance to the right of the fone, it is conceivable to punch out the screws
7461using the drilling pattern below (provided by Alexander Mundy in TAP)
7462
7463
7464
7465
7466
7467
7468
7469
7470
7471
7472
7473
7474
7475 Page 122
7476
7477
7478
7479
7480 The Official Phreaker's Manual
7481
7482 Chapter 5
7483
7484 What is covered in these last few articles, is the essence of phreaking,
7485blue boxing & equal access. These last articles, I hope will be the final
7486stage of phreak education for now. Basic telecommunications 7 is a brief intro
7487to the art of blue boxing, while Better Homes & Blue Boxing will cover it in
7488full. Equal access will be an interesting switch, it is installed in my area
7489already and I have been investigating it. One thought is to call MCI operators
7490and box through them, over MCI lines...
7491
7492
7493
7494
7495
7496
7497
7498
7499
7500
7501
7502
7503
7504
7505
7506
7507
7508
7509
7510
7511
7512
7513
7514
7515
7516
7517
7518
7519
7520
7521
7522
7523
7524
7525
7526
7527
7528
7529
7530
7531
7532
7533
7534
7535
7536
7537
7538
7539
7540
7541 Page 123
7542
7543
7544
7545
7546 The Official Phreaker's Manual
7547
7548 ************* << BIOC AGENT 003'S COURSE IN >> *************
7549 * *
7550 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
7551 * %$ BASIC TELECOMMUNICATIONS $% *
7552 * $%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$ *
7553 * PART VII *
7554 * *
7555 ************************************************************
7556
7557Preface:
7558
7559 After most neophyte phreaks overcome their fascination with Metro codes and
7560WATS extenders, they will usually seek to explore other avenues in the vast
7561phone network. Often they will come across references such as "simply dial KP
7562+ 2130801050 + ST for the Alliance teleconferencing system in LA.". Numbers
7563such as the one above were intended to be used with a blue box; this article
7564will explain the fundamental principles of the fine art of blue boxing.
7565
7566Genesis:
7567____________________________________________________________
7568
7569 In the beginning, all long distance calls were connected manually by
7570operators who passed on the called number verbally to other operators in
7571series. This is because pulse (aka rotary) digits are created by causing
7572breaks in the DC current (see Basic Telcom V). Since long distance calls
7573require routing through various switching equipment and AC voice amplifiers,
7574pulse dialing cannot be used to send the destination number to the end local
7575office (CO).
7576
7577 Eventually, the demand for faster and more efficient long distance (LD)
7578service caused Bell to make a multi-billion dollar decision. They had to create
7579a signaling system that could be used on the LD Network. Basically, they had
7580two options:
7581
7582[1] To send all the signaling and supervisory information (ie, ON & OFF
7583HOOK) over separate data links. This type of signaling is referred to as
7584out-of-band signaling.
7585 -or-
7586[2] To send all the signaling information along with the conversation
7587using tones to represent digits. This type of signaling is referred to as
7588in-band signaling.
7589
7590 Being the cheap bastard that they naturally are, Bell chose the latter (and
7591cheaper) method -- IN-BAND signaling. They eventually regretted this, though
7592(heh, heh)...
7593
7594IN-BAND SIGNALING PRINCIPLES:
7595____________________________________________________________
7596
7597 When a subscriber dials a telephone number, whether in rotary or touch-tone
7598(aka DTMF), the equipment in the CO interprets the digits and looks for a
7599convenient trunk line to send the call on its way. In the case of a local
7600call, it will probably be sent via an inter-office trunk; otherwise, it will be
7601sent to a toll office (class 4 or higher -- see Telcom IV) to be processed.
7602
7603 When trunks are not being used there is a 2600 Hz tone on the line; thus,
7604to find a free trunk, the CO equipment simply checks for the presence of 2600
7605Hz. If it doesn't find a free trunk the customer will receive a re-order signal
7606
7607 Page 124
7608
7609
7610
7611
7612 The Official Phreaker's Manual
7613
7614(120 IPM busy signal) or the "all circuits are busy..." message. If it does
7615find a free trunk it "seizes" it -- removing the 2600 Hz. It then sends the
7616called number or a special routing code to the other end or toll office.
7617
7618 The tones it uses to send this information are called multi-frequency (MF)
7619tones. An MF tone consists of two tones from a set of six master tones which
7620are combined to produce 12 separate tones. You can sometimes hear these tones
7621in the background when you make a call but they are usually filtered out so
7622your delicate ears cannot hear them. These are NOT the same as touch-tones.
7623
7624 To notify the equipment at the far end of the trunk that it is about to
7625receive routing information, the originating end first sends a Key Pulse (KP)
7626tone. At the end of sending the digits, #he originating end then sends a STart
7627(ST) tone. Thus to call 914-359-1517, the equipment would send KP + 9143591517
7628+ ST in MF tones. When the customer hangs up, 2600 Hz is once again sent to
7629signify a disconnect to the distant end.
7630
7631History:
7632____________________________________________________________
7633
7634 In the November 1960 issue of The Bell System Technical Journal, an article
7635entitled "Signaling Systems for Control of Telephone Switching" was published.
7636This journal, which was sent to most university libraries, happened to contain
7637the actual MF tones used in signaling. They appeared as follows:
7638
7639Digit Tones
7640----- -----
7641 1 700 + 900 Hz
7642 2 700 + 1100 Hz
7643 3 900 + 1100 Hz
7644 4 700 + 1300 Hz
7645 5 900 + 1300 Hz
7646 6 1100 + 1300 Hz
7647 7 700 + 1500 Hz
7648 8 900 + 1500 Hz
7649 9 1100 + 1500 Hz
7650 0 1300 + 1500 Hz
7651 KP 1100 + 1700 Hz
7652 ST 1500 + 1700 Hz
7653 11 (*) 700 + 1700 Hz
7654 12 (*) 900 + 1700 Hz
7655 KP2 (*) 1300 + 1700 Hz
7656
7657(*) Used only on CCITT SYSTEM 5 for special international calling.
7658
7659 Bell caught wind of blue boxing in 1961 when it caught a Washington state
7660college student using one. They originally found out about blue boxes through
7661police raids and informants. In 1964, Bell Labs came up with scanning
7662equipment, which recorded all suspicious calls, to detect blue box usage.
7663These units were installed in CO's where major toll fraud existed. AT&T
7664Security would then listen to the tapes to see if any toll fraud was actually
7665committed. Over 200 convictions resulted from the project. Surprisingly
7666enough, blue boxing is not solely limited to the electronics enthusiast; AT&T
7667has caught businessmen, film stars, doctors, lawyers, college students, high
7668school students and even a millionaire financier (Bernard Cornfeld) using the
7669device. AT&T also said that nearly half of those that they catch are
7670businessmen.
7671
7672
7673 Page 125
7674
7675
7676
7677
7678 The Official Phreaker's Manual
7679
7680 Of course, phone phreaks have achieved an almost cult status. They have
7681also had their fair share of media. In October 1971, Esquire published the
7682infamous "Secrets of the Little Blue Box" article which featured phreaks such
7683as Captain Crunch, who took his name from the cereal which one gave away
7684whistles that produced a perfect 2600 Hz pitch; Joe Engressia, the blind
7685phreak; and Mark Bernay, one of the nation's first and oldest phreaks. Others
7686such as Apple computer co-founders Steve Wozniak & Steve Jobs have also had
7687blue box backgrounds. 1971 also saw the publication of the first issue of YIPL,
7688the phone phreak newsletter, (now TAP) under the editorship of supreme yippie
7689Abbie Hoffman.
7690
7691Usage:
7692____________________________________________________________
7693
7694 To use a blue box, one would usually make a free call to any 800 number or
7695distant directory assistance (NPA-555-1212). This, of course, is legitimate.
7696When the call is answered, one would then swiftly press the button that would
7697send 2600 Hz down the line. This has the effect of making the distant CO
7698equipment think that the call was terminated and it leaves the trunk hanging.
7699Now, the user has about 10 seconds to enter in the telephone number he wished
7700to dial -- in MF, that is. The CO equipment merely assumes that this came from
7701another office and it will happily process the call. Since there are no records
7702(except on toll fraud detection devices!) of these MF tones, the user is not
7703billed for the call. When the user hangs up, the CO equipment simply records
7704that he hung up on a free call.
7705
7706Detection:
7707____________________________________________________________
7708
7709 Bell has had 20 years to work on detection devices; therefore, in this day
7710and age, they are rather well refined. Basically, the detection device will
7711look for the presence of 2600 Hz where it does not belong. It then records the
7712calling number and all activity after the 2600 Hz. If you happen to be at a
7713fortress fone, though, and you make the call short, your chances of getting
7714caught are significantly reduced (see Telcom VI). Incidentally, there have been
7715rumors of certain test numbers (see Telcom II) that hook directly into trunks
7716thus avoiding the need for 2600 Hz and detection!
7717
7718 Another way that Bell catches boxers is to examine the CAMA (Centralized
7719Automatic Message Accounting) tapes. When you make a call, your number, the
7720called number, and time of day are all recorded. The same thing happens when
7721you hang up. This tape is then processed for billing purposes. Normally, all
7722free calls are ignored. But Bell can program the billing equipment to make note
7723of lengthy calls to directory assistance. They can then put a pen register
7724(aka DNR) on the line or an actual full-blown tap. This detection can be
7725avoided by making short-haul (aka local) calls to box off of.
7726
7727 It is interesting to note that NPA+555-1212 originally did not return
7728answer supervision. Thus the calls were not recorded on the AMA/CAMA tapes.
7729AT&T changed this though for "traffic studies!"
7730
7731CCIS:
7732____________________________________________________________
7733
7734 Besides detection devices, Bell has begun to gradually redesign the network
7735using out-of-band signaling. This is known as Common Channel Inter-office
7736Signaling (CCIS). Since this signaling method sends all the signaling
7737information over separate data lines, blue boxing is impossible under it.
7738
7739 Page 126
7740
7741
7742
7743
7744 The Official Phreaker's Manual
7745
7746
7747 While being implemented gradually, this multi-billion dollar project is
7748still strangling the fine art of blue boxing. Of course until the project is
7749totally complete, boxing will still be possible. It will become progressively
7750harder to find places to box off of, though. In areas with CCIS, one must find
7751a directory assistance office that doesn't have CCIS yet. Area codes in Canada
7752and predominately rural states are the best bets. WATS numbers terminating in
7753non-CCIS cities are also good prospects.
7754
7755Pink Noise:
7756____________________________________________________________
7757
7758 Another way that may help to avoid detection is too add some "pink noise"
7759to the 2600 Hz tone. Since 2600 Hz tones can be simulated in speech, the
7760detection equipment must be careful not to misinterpret speech as a disconnect
7761signal. Thus a virtually pure 2600 Hz tone is required for disconnect.
7762
7763 Keeping this in mind, the 2600 Hz detection equipment is also probably
7764looking for pure 2600 Hz or else is would be triggered every time someone hit
7765that note (highest E on a piano =2637 Hz). This is also the reason that the
77662600 Hz tone must be sent rapidly; sometimes, it won't work when the operator
7767is saying "Hello, hello." It is feasible to send some "pink noise" along with
7768the 2600 Hz. Most of this energy should be above 3000 Hz. The pink noise
7769won't make it into the toll network (where we want our pure 2600 Hz to hit) but
7770it should make it past the local CO and thus the fraud detectors.
7771
7772Construction:
7773____________________________________________________________
7774
7775 While step-by-step details for the construction of a blue box is beyond the
7776scope of this tutorial, it is worthwhile to mention some of the details.
7777
7778 First there are some alternatives but they are not as good as an actual
7779blue box. Many computers are capable of generating MF tones. Thus, your local
7780phriendly software pirate should have a program compatible for your computer.
7781
7782 However, it is highly advisable not to box from home as stated in The Ten
7783Commandments (as interpreted for phreaks by Fred Steinbeck -- TAP #86).
7784
7785I. Box thou not over thine home telephone wires, for those who doest must
7786surely bring the full wrath of the Chief Special Agent down upon thy heads.
7787
7788 Another alternative that has a moderate success rate involves recording the
7789tones from a phriend with a box or computer onto a cassette tape. They can
7790then be used at a fortress.
7791
7792 As for actual construction techniques, TAP has devoted many issues to blue
7793boxing. Basically, a blue box is merely a device capable of generating two
7794different tones simultaneously. There are two basic construction methods that I
7795will outline below for the electronics hobbyist.
7796
7797 The first involves the use of two 555 timer chips (or a 556 -- i.e., two
7798555's in one chip). It offers excellent frequency and voltage stability.
7799Also, it does not need a diode matrix keypad but used double-pole switches
7800instead. Schematics for this type of box can be found in TAP issue #29.
7801
7802 The other common box makes use of two Intersil 8038CC Function Generators.
7803It does require a diode matrix keypad though, potentiometers, an LM-100 voltage
7804
7805 Page 127
7806
7807
7808
7809
7810 The Official Phreaker's Manual
7811
7812regulator, a 741 Op-amp, and a handful of other parts. The schematics for this
7813type of blue box can be found in TAP #26. Both designs draw about 20 ma of
7814current.
7815
7816 Also, most blue boxes use telephone earpieces (with the varistor removed)
7817for speakers. These can be easily liberated from fortress fones with a small
7818coping saw.
7819
7820 Usually, the hardest part about building a blue box is the calibration. A
7821frequency counter is a must and an oscilloscope won't hurt.
7822
7823 Some boxes also take timing into account. It is feasible on the ESS
7824systems that they check to see if the digits are of uniform length. If they
7825aren't, they are probably from a blue box and a trouble card may be dropped.
7826With this in mind, the Bell standard for MF pulses and interdigit intervals is
7827around 75 ms. It varies with the equipment used since ESS can handle higher
7828speeds and doesn't need interdigit intervals.
7829
7830Applications:
7831____________________________________________________________
7832
7833 Besides dialing normal calls free, i.e., KP+NPA+NNX+XXXX+ST, blue boxes
7834offer the entire network for exploration. Emergency break-ins, service
7835monitoring (aka taps), stacking tandems (the art of busying out all trunks
7836between two points), re-routing calls, conference calls, and much, much more
7837... Inward Operator City Codes
7838
7839 Usually, the INWARD operator for an area is simply KP + NPA + 121 +
7840ST. In some area codes, though, there are several large cities and thus
7841
7842 Page 128
7843
7844
7845
7846
7847 The Official Phreaker's Manual
7848
7849several inwards. To find the inward for a specific city, you would say "916
7850756, operator route, please" to the R&R operator who will then tell you "916
7851plus 001 plus." This means that KP+ 916 + 001 + 121 + ST will get you an
7852inward for Sacramento, CA (916-756).
7853
7854... City names
7855
7856 If you want to know the city that corresponds to an area code and
7857exchange, you simply tell the R&R, "Place name, 914 390, please." In this
7858example, the R&R operator will respond with "White Plains, NY."
7859
7860... International Directory Assistance
7861
7862 If you need a directory route for London, you could say
7863"International, London, England. TSPS directory route, please." The R&R
7864operator will respond with "Directory to London, England. Country code 44 plus
78651 plus 986 plus 3611." Therefore to get a DA operator in London, you would
7866route yourself to an international sender and KP + 04419863611 + ST.
7867
7868... Country & City codes
7869
7870 If you need to know the country and city code for an international
7871number you can say "International, Sydney, Australia, TSPS numbers route,
7872please" and get "Country code 61 plus 2."
7873
7874... International Inwards Routes
7875
7876 To get routing codes for international inwards say "International,
7877London, England, TSPS inward route, please." The R&R Operator will respond with
7878"Country code 44 plus 121."
7879
7880 Finally, to get language assistance for completing a foreign call you can
7881tell the foreign inward, "United States calling. Language assistance in
7882completing a call to (called party) at (called number)."
7883
7884151 -- Overseas incoming (212 +& 914+)
7885160-XX0 -- Various Overseas Operators
7886161 -- Trouble reporting operator (defunct)
7887181 -- Coin Refund Operator
788818X -- Overseas senders
7889
7890 To make an international call, one would KP + 011 + 0CC + ST where CC is
7891the country code. This will route you to the appropriate overseas sender. You
7892will then receive a 480 Hz dial tone. Here you enter KP + 0CC + city code +
7893local number + ST and the call is on its way.
7894
7895 Country codes can be either 1, 2, or 3 digits but they must be padded for
7896three digits to create a pseudo-country code with extra zero's if necessary.
7897For example, England, country code 44, becomes 044.
7898
7899 To see which international sender a certain country (lets use French
7900Guiana, country code 594, for example) goes through, you can dial KP + 011 +
7901594 + ST, wait for the Proceed to Send tone then KP + 000 + 0000 + ST and you
7902will receive a recording saying which ISC (International Switching Center) it
7903is. For the example it will say, "This is the international switching center
7904in Pittsburg, PA -- This is a recording - 4121." You can actually route calls
7905to certain senders yourself (KP + NPA + 18X + ST) but it is better off not to
7906since it may look suspicious if a call is sent through a sender that it
7907
7908 Page 129
7909
7910
7911
7912
7913 The Official Phreaker's Manual
7914
7915shouldn't go through. Here are the senders:
7916
7917182 -- White Plains, NY
7918183 -- New York, NY
7919184 -- Pittsburg, PA
7920185 -- Orlando, FL
7921186 -- Oakland, CA
7922187 -- Denver, CO
7923188 -- New York, NY
7924
7925 Also, there tends to be alot of talk about the Code 11, Code 12, KP2, STP,
7926ST3P, & ST2P keys. While they do exist the blue boxer need not concern himself
7927with them. The first three are used on CCITT System 5. This is the signaling
7928system that the International Senders use to send information to other
7929countries. These codes are usually added automatically just like the language
7930assistance digit [which distinguishes operator (or blue box) dialed calls from
7931customer dialed calls]. The STP, ST3P, & ST2P tones are used when equipment is
7932communicating with the TSPS. These also are automatically added when needed in
7933most cases.
7934
7935[see Telcom III for more on International Switching Centers (ISC)]
7936
793711XXX -- miscellaneous operators
793811501 -- universal cordboard operator
793911511 -- conference operator
794011521 -- mobile operator
794111531 -- marine operator
794211541 -- LD incoming switchboard
794311551 -- leave word for time & charges (neat stuff)
794411561 -- same as 11551 but for hotel/motels
794511571 -- overseas operators (language assistance)
7946
7947 The 11XXX series is interesting scanning material.
7948
7949Miscellaneous Routing Codes :
7950____________________________________________________________
7951
7952 Alliance Teleconferencing has several numbers, a few of which are listed
7953below:
7954
7955KP + 213 080 XXXX + ST
7956KP + 305 025 XXXX + ST
7957KP + 312 001 XXXX + ST
7958XXXX = 1050, 1100, or a few others
7959
7960 Also, at KP + 317 009 + ST there is a MF tone checker. After the
7961beep-kerclunk, dial in KP + 999 1234567 890 + ST and it will repeat the digits
7962that you pulsed if they are of the right frequency.
7963
7964Tandem Scanning:
7965____________________________________________________________
7966
7967 To find all sorts of interesting things, you must look. Begin scanning
7968three digit codes in your area (i.e., KP + 000 + ST, KP + 001 + ST, etc.). Keep
7969track of all of your results. Sometimes you must probe things, send additional
7970digits and see what happens, send touch-tone, send it 2600 Hz, rip it apart.
7971You never know, you may run into something phun, like a computer that checks CC
7972numbers.
7973
7974 Page 130
7975
7976
7977
7978
7979 The Official Phreaker's Manual
7980
7981
7982 Incidentally, in some exchange you can dial inwards and other box codes
7983directly! For example, 914-121-1111 will get you a NY inward. The only problem
7984is that a 0 or 1 as the first digit of the exchange is usually *prohibited in
7985customer dialing. Somebody may have "accidentally" changed this screening code
7986on your ESS's computer, though -- you never know and it can't hurt to try.
7987WATS translation numbers also take up some of the 0XX & 1XX codes.
7988
7989 Finally, certain tones on the blue box can also be used for other purposes.
7990An MF "2" corresponds to COIN COLLECT while "KP" corresponds to COIN RETURN.
7991Thus every blue box is also a green box (see Telcom VI).
7992
7993Coming soon:
7994
7995Telcom VIII will deal with cordless phones, mobile phones, and other neat
7996things.
7997
7998Be careful and have phun,
7999
8000*****BIOC
8001*=$=*Agent
8002*****003
8003
8004
8005
8006
8007
8008
8009
8010
8011
8012
8013
8014
8015
8016
8017
8018
8019
8020
8021
8022
8023
8024
8025
8026
8027
8028
8029
8030
8031
8032
8033
8034
8035
8036
8037
8038
8039
8040
8041 Page 131
8042
8043
8044
8045
8046 The Official Phreaker's Manual
8047
8048The Mark Tabas encounter series presents:
8049
8050 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
8051 Better Homes and Blue Boxing
8052
8053 Part I
8054
8055 Theory of Operation
8056 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8057
8058 To quote Karl Marx, blue boxing has always been the most noble form of
8059phreaking. As opposed to such things as using an MCI code to make a free fone
8060call, which is merely mindless pseudo-phreaking, blue boxing is actual
8061interaction with the Bell System toll network. It is likewise advisable to be
8062more cautious when blue boxing, but the careful phreak will not be caught,
8063regardless of what type of switching system he is under.
8064
8065 In this part, I will explain how and why blue boxing works, as well as where.
8066In later parts, I will give more practical information for blue boxing and
8067routing information.
8068
8069 To begin with, blue boxing is simply communicating with trunks. Trunks must
8070not be confused with subscriber lines (or "customer loops") which are standard
8071telefone lines. Trunks are those lines that connect central offices. Now, when
8072trunks are not in use (i.e., idle or "on-hook" state) they have 2600Hz applied
8073to them. If they are two-way trunks, there is 2600Hz in both directions. When a
8074trunk IS in use (busy or "off-hook" state"), the 2600Hz is removed from the
8075side that is off-hook. The 2600Hz is therefore known as a supervisory signal,
8076because it indicates the status of a trunk; on hook (tone) or off-hook (no
8077tone). Note also that 2600Hz denoted SF (single frequency) signalling and is
8078"in-band." This is very important. "In-band" means that is is within the band
8079of frequencies that may be transmitted over normal telefone lines. Other SF
8080signals, such as 3700Hz are used also. However, they cannot be carried over the
8081telefone network normally (they are "out-of-band") and are therefore not able
8082to be taken advantage of as 2600Hz is.
8083
8084 Back to trunks. Let's take a hypothetical phone call. You pick up your fone
8085and dial 1+806-258-1234 (your good friend in Armarillo, Texas). For ease, we'll
8086assume that you are on #5 Crossbar switching and not in the 806 area. Your
8087central office (CO) would recognize that 806 is a foreign NPA, so it would
8088route the call to the toll centre that serves you. [For the sake of accuracy
8089here, and for the more experienced readers, note that the CO in question is a
8090class 5 with LAMA that uses out-of-band SF supervisory signalling]. Depending
8091on where you are in the country, the call would leave your toll centre (on more
8092trunks) to another toll centre, or office of higher "rank". Then it would be
8093routed to central office 806-258 eventually and the call would be completed.
8094Illustration:
8095
8096A---CO1-------TC1------TC2----CO2----B
8097
8098A=you
8099CO1=your central office
8100TC1=your toll office.
8101TC2=toll office in Amarillo.
8102CO2=806-258 central office.
8103B=your friend (806-258-1234)
8104
8105 In this situation it would be realistic to say that CO2 uses SF in-band
8106
8107 Page 132
8108
8109
8110
8111
8112 The Official Phreaker's Manual
8113
8114(2600Hz) signalling, while all the others use out-of-band signalling (3700Hz).
8115If you don't understand this, don't worry too much. I am pointing this out
8116merely for the sake of accuracy. The point is that while you are connected to
8117806-258-1234, all those trunks from YOUR central office (CO1) to the 806-258
8118central office (CO2) do *NOT* have 2600Hz on them, indicating to the Bell
8119equipment that a call is in progress and the trunks are in use.
8120
8121 Now let's say you're tired of talking to your friend in Amarillo
8122(806-258-1234) so you send a 2600Hz down the line. This tone travels down the
8123line to your friend's central office (CO2) where it is detected. However, that
8124CO thinks that the 2600Hz is originating from Bell equipment, indicating to it
8125that you've hung up, and thus the trunks are once again idle (with 2600Hz
8126present on them). But actually, you have not hung up, you have fooled the
8127equipment at your friend's CO into thinking you have. Thus,it disconnects him
8128and resets the equipment to prepare for the next call. All this happens very
8129quickly (300-800ms for step-by-step equipment and 150-400ms for other
8130equipment).
8131
8132 When you stop sending 2600Hz (after about a second), the equipment thinks
8133that another call is coming towards it (e.g. it thinks the far end has come
8134"off-hook" since the tone has stopped. It could be thought of as a toggle
8135switch: tone --> on hook, no tone -->off hook. Now that you've stopped sending
81362600Hz, several things happen:
8137
81381) A trunk is seized.
8139
81402) A "wink" is sent to the CALLING end from the CALLED end indicating that the
8141CALLED end (trunk) is not ready to receive digits yet.
8142
81433) A register is found and attached to the CALLED end of the trunk within about
8144two seconds (max).
8145
81464) A start-dial signal is sent to the CALLING end from the CALLED end
8147indicating that the CALLED end is ready to receive digits.
8148
8149Now, all of this is pretty much transparent to the blue boxer. All he really
8150hears when these four things happen is a <beep><kerchunk>. So, seizure of a
8151trunk would go something like this:
8152
81531> Send a 2600Hz
81542> Terminate 2600Hz after 1-2 secs.
81553> [beep][kerchunk]
8156
8157 Once this happens, you are connected to a tandem that is ready to obey your
8158every command. The next step is to send signalling information in order to
8159place your call. For this you must simulate the signalling used by operators
8160and automatic toll-dialing equipment for use on trunks. There are mainly two
8161systems, DP and MF. However, DP went out with the dinosaur , so I'll only
8162discuss MF signalling. MF (multi-frequency) signalling is the signalling used
8163by the majority of the inter- and intra-lata network. It is also used in
8164international dialing known as the CCITT no.5 system.
8165
8166 MF signalling consists of 7 frequencies, beginning with 700Hz and separated
8167by 200Hz. A different set of two of the 7 frequencies represent the digits 0
8168thru 9, plus an additional 5 special keys. The frequencies and uses are as
8169follows:
8170
8171Frequencies (Hz) Domestic Int'l
8172
8173 Page 133
8174
8175
8176
8177
8178 The Official Phreaker's Manual
8179
8180--------------------------------------
8181 700+900 1 1
8182 700+1100 2 2
8183 900+1100 3 3
8184 700+1300 4 4
8185 900+1300 5 5
81861100+1300 6 6
8187 700+1500 7 7
8188 900+1500 8 8
81891100+1500 9 9
81901300+1500 0 0
8191 700+1700 ST3p Code 11
8192 900+1700 STp Code 12
81931100+1700 KP KP1
81941300+1700 ST2p KP2
81951500+1700 ST ST
8196
8197 The timing of all the MF signals is a nominal 60ms, except for KP, which
8198should have a duration of 100ms. There should also be a 60ms silent period
8199between digits. This is very flexible, however, and most Bell equipment will
8200accept outrageous timings.
8201
8202 In addition to the standard uses listed above, MF pulsing also has expanded
8203usages known as "expanded inband signalling" that include such things as coin
8204collect, coin return, ringback, operator attached, and operator released. KP2,
8205code 11, and code 12 and the ST_ps (STart "primes") all have special uses which
8206will be mentioned only briefly here.
8207
8208 To complete a call using a blue box, once seizure of a trunk has been
8209accomplished by sending 2600Hz and pausing for the <beep><kerchunk>, one must
8210first send a KP. This readies the register for the digits that follow. For a
8211standard domestic call, the KP would be followed by either 7 digits (if the
8212call were in the same NPA as the seized trunk) or 10 digits (if the call were
8213not in the same NPA as the seized trunk). [Exactly like dialing a normal fone
8214call]. Following either the KP and 7 or 10 digits, a STart is sent to signify
8215that no more digits follow. Example of a complete call:
8216
82171> Dial 1-806-258-1234
82182> wait for a call-progress indication (such as ring, busy, recording, etc.)
82193> Send 2600Hz for about 1 second.
82204> Wait for about 2 seconds while a trunk is seized.
82215> Send KP+305+994+9966+ST
8222
8223 The call will then connect if every-thing was done properly. Note that if a
8224call to an 806 number were being placed in the same situation, the area code
8225would be omitted and only KP+ seven digits+ST would be sent.
8226
8227 Code 11 and code 12 are used in international calling to request certain
8228types of operators. KP2 is used in international calling to route a call other
8229than by way of the normal route, whether for economic or equipment reasons.
8230
8231 STp, ST2p, and ST3p (prime, two prime, and three prime) are used in TSPS
8232signalling to indicate calling type of call (such as coin-direct dialed).
8233
8234 This has been Part I of Better Homes and Blue Boxing. I hope you enjoyed and
8235learned from it. If you have any questions, comments, threats or insults,
8236please fell free to drop me a line. If you have noticed any errors in this text
8237(yes, it does happen), please let me know and perhaps a correction will be in
8238
8239 Page 134
8240
8241
8242
8243
8244 The Official Phreaker's Manual
8245
8246order. Part II will deal mainly with more advanced principles of blue boxing,
8247as well as routings and operators.
8248
8249 Note 1: other highly trunkable areas include: 816,305,813,609,205. I
8250personally have excellent luck boxing off of 609-953-0000. Try that if you have
8251any trouble.
8252
8253
8254
8255
8256
8257
8258
8259
8260
8261
8262
8263
8264
8265
8266
8267
8268
8269
8270
8271
8272
8273
8274
8275
8276
8277
8278
8279
8280
8281
8282
8283
8284
8285
8286
8287
8288
8289
8290
8291
8292
8293
8294
8295
8296
8297
8298
8299
8300
8301
8302
8303
8304
8305 Page 135
8306
8307
8308
8309
8310 The Official Phreaker's Manual
8311
8312 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8313 Better Homes and Blue Boxing
8314
8315 Part II
8316
8317 Practical Applications
8318 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8319
8320(It is assumed that the reader has read and understood Part I of this series).
8321
8322 The essential purpose of blue boxing in the beginning was merely to receive
8323toll services free of charge. Though this can still be done, blue boxing has
8324essentially outlived its usefulness in this area. Modern day "extenders" and
8325long distance services provide a safer and easier way to make free fone calls.
8326However, you can do things with a blue box that just can't be done with
8327anything else. For ordinary toll-fraud, a blue box is impractical for the
8328following reasons:
8329
83301. Clumsy equipment required (blue box or equivalent)
83312. Most boxed calls must be made through an extender. Not for safety reasons,
8332but for reasons I'll explain later.
83333. Connections are often sacrificed because considerable distances must be
8334dialed to cross a seizable trunk, in addition to awkward routing.
8335
8336 As stated in reason #2, boxed calls are usually made through an extender.
8337This is for billing reasons. If you recall from Part i, 2600Hz is used as a
8338"supervisory" signal. That is, it signals the status of a trunk--"on-hook" or
8339"off-hook." When you seize a trunk (by briefly sending 2600Hz), your end (the
8340CALLING end) goes on hook for the duration of the 2600Hz and then goes off-hook
8341once again when the 2600Hz is terminated. The CALLED end recognizes that a
8342call is on the way and attaches a register, which interprets the digits which
8343are to be sent. Now, understand that even though your end has come off-hook (no
83442600Hz present), the other end is still on-hook. You may wonder then, why, if
8345the other end (the CALLED end) is still on-hook, there is no 2600Hz coming the
8346other way on the trunk, when there should be. This is correct. 2600Hz *IS*
8347present on the trunk when you seize it and afterwards, but you cannot hear it
8348because of a Band Elimination Filter (BEF) at your central office.
8349
8350 Back to the problem. Remember that when you seize a trunk, 2600Hz is indeed
8351coming the other way on the trunk because the CALLED end is still on-hook, but
8352you don't actually hear it because of a filter. However, the Bell equipment
8353knows it's there (they can "hear" it). The presence of the 2600Hz is telling
8354the billing equipment that your call has not yet been completed (i.e., the
8355CALLED end is still on-hook). When finally you do connect with your boxed call,
8356the 2600Hz from the called end terminates. This tells the billing equipment
8357that someone picked up the fone at the CALLED end and you should begin to be
8358billed. So you do start to get billed, but for the call to the trunk, NOT the
8359boxed call. Your billing equipment thinks that you've connected with the number
8360you used to seize the trunk. Illustration:
8361
83621. You call 1+806-258-2222 (directly)
83632. Status of trunks:
8364
8365<----------------------------------->
8366(You) 806-258-2222
8367No 2600Hz-------> <------------2600Hz
8368
8369 When you seize a trunk (before the number you called answers) there is no
8370
8371 Page 136
8372
8373
8374
8375
8376 The Official Phreaker's Manual
8377
8378affect on your billing equipment. It simply thinks that you're still waiting
8379for the call to complete (the CALLED end is still on-hook; it is ringing, busy,
8380going to recorder or intercept operator.
8381
8382 Now, let's say that you've seized a trunk (806-258-2222) and for example,
8383KP+314+949+1705+ST. The call is routed from the tandem you seized to:
8384314-949-1705. Illustration:
8385
8386<------------------>O<--------------->
8387(You) 806 314-949
8388 tandem
8389No 2600Hz----------> <----------2600Hz
8390
8391 Note that the entire path towards the right (the CALLED end) has no 2600Hz
8392present and is therefore "off-hook." The entire path towards the left (the
8393CALLING end) does have 2600Hz present on it, indicating that the CALLED end has
8394not picked up (or come "off-hook"). When 314-949-1705 answers, "answer
8395supervision" is given and the 2600Hz towards the left (the CALLING end)
8396terminates. This tells your billing equipment, which thinks that you're still
8397waiting to be connected with 806-258-2222, that you've finally connected.
8398Billing then begins to 806-258-2222. Not exactly an auspicious beginning for an
8399aspiring young phone phreak.
8400
8401 To avoid this, several actions may be taken. As previously mentioned, one may
8402avoid being charged for the number called to seize a trunk by using an extender
8403(in which case the extender will get billed). In some areas, boxing may be
8404accomplished using an 800 number, generally in the format of 800-858-xxxx (many
8405Amarillo numbers) or 800-NN2-xxxx (special intra-state class in-WATS numbers).
8406However, boxing off of 800 numbers is impossible in many areas. In my area,
8407Denver, I am served by #1A ESS and it is impossible for me to box off of any
8408800 number.
8409
8410 Years ago, in the early days of blue boxing (before my time), phreaks often
8411used directory assistance to box off of because they were "free" long distance
8412calls. However, because of competitive long distance companies, directory
8413assistance surcharges are now $0.50 in many areas. It is additionally advised
8414that directory assistance numbers not be used to box from because of the
8415following:
8416
8417 Average DA calls last under 2 minutes. When you box a call, chances are that
8418it will last considerably longer. Thus, the Bell billing equipment will make a
8419note of calls to directory assistance that last a long time. A call to a
8420directory assistant lasting for 4 hours and 17 minutes may appear somewhat
8421suspicious.
8422
8423 Although the date, time, and length of a DA call do not appear on the bill,
8424it is recorded on AMA tape and will trip a trouble report if it were to last
8425too long. This is how most phreaks were discovered in the old days. Also,
8426sometimes too many calls lasting too long to one 800 number may raise a few
8427eyebrows at the local security office.
8428
8429 Assuming you can complete a blue box call, the following are listed routings
8430for various Bell internal operators. These are in the format of KP+NPA+
8431special routing+1X1+ST, which I will explain later. The 1X1 is the actual
8432operator routing, and NPA and NPA+ special routing are used for out-of-area
8433code calls and out-of-area code calls requiring special routing, respectively.
8434
8435KP+101+ST ...... Toll test board.
8436
8437 Page 137
8438
8439
8440
8441
8442 The Official Phreaker's Manual
8443
8444KP+121+ST ...... Inward Operator.
8445KP+131+ST ...... Directory assistance.
8446KP+141+ST ...... was rate & route. Now only works in 312, 815, 717, and a few
8447others. It has been replaced with a universal rate & route number
8448800+141+1212.
8449KP+151+ST ...... Overseas completion operator (inbound). Works only in certain
8450NPAs, such as 303.
8451KP+181+ST ...... In some areas, toll station for small towns.
8452
8453 Thus, if you seize a trunk in 806 NPA and wanted an inward (in 806), then you
8454would dial KP+121+ST. If you wanted a 312 inward and were dialing on an 806
8455trunk, an area code would be required. Thus, you would dial KP+312+121+ST.
8456Finally, some places in the network require special routing, in addition to an
8457area code. An example is Franklin Park, Ill. It requires a special routing of
8458032. For this, you would dial KP+312+032+121+ST for a Franklin Park inward
8459operator.
8460
8461 Special routings are in the format of 0XX. They are used primarily for load
8462balance, so that traffic flow may be evenly distributed. About half of the
8463exchanges in the network require special routing. Note that special routings
8464are NEVER EVER EVER used to dial normal telephone numbers, only operators.
8465
8466 Operator functions:
8467
8468TOLL TEST BOARD- Generally a cordboard position that assists in trunk testing.
8469They are not used by operators, only switchmen.
8470
8471INWARD- Assists the normal TSPS (0+) operator in completing calls out of the
8472TSPS's area. Also, inwards perform emergency interrupts when the number to be
8473interrupted is out of the area code of the original (TSPS) operator. For
8474example, a 303 operator has a customer that needs an emergency interrupt on
8475215-647-6969. The 303 operator gets the routing for the inward that covers
8476215-647, since she cannot do the interrupt herself. The routing is found to be
8477only 215+ (no special routing required). So, the 303 operator keys
8478KP+215+121+ST. An inward answers and the 303 says to her, "Inward, this is
8479Denver. I need an emergency interrupt on 215-647-6969. My customer's name is
8480Mark Tabas." The inward will then do the interrupt (off the line, of course).
8481If the number to be interrupted had required special routing, such as, say,
8482312-456-1234 (spec routing 032), then the 303 operator would dial
8483KP+312+032+121+ST for the inward to do that interrupt.
8484
8485DIRECTORY ASSISTANCE- These are the normal NPA+555+1212 operators that assist
8486customers with obtaining telefone directory listings. Not much toll-fraud
8487potential here, except maybe $0.50.
8488
8489RATE AND ROUTE- These operators are reached by dialing KP+800+141+1212+ST.
8490They assist normal (TSPS) operators with rates and routings (thus the name).
8491The only uses I typically have for them are the following:
8492
8493 1. Routing-
8494 Information- In the above example, when the 303 operator needed to dial
8495an inward that served 215-647, she needed to know if any special routing was
8496required and, if so, what it was. Assuming she would use rate and route, she
8497would dial them and say nicely, "Operator's route, please, for 215-647." Rate &
8498route would respond with "215 plus." This means that the operator would dial
8499KP+215+121+ST to reach the inward that serves 215-647. If there were special
8500routing required, such as in 312-456, rate & route would respond with "312 plus
8501032 plus." In that case, the operator would dial KP+312+032+ST for the inward
8502
8503 Page 138
8504
8505
8506
8507
8508 The Official Phreaker's Manual
8509
8510that serves 312-456.
8511
8512 It is good practice to ask for "operator's route" specifically, as there are
8513also "numbers route" and "directory routes." If you do not specifically ask for
8514operator's route, rate & route will generally assume that is what you want
8515anyway.
8516
8517"Numbers" route refers to overseas calls. Example, you want to know how to
8518reach a number in Geneva, Switzerland (and you already have the number). You
8519would call routing and say "Numbers route, please, Geneva, Switzerland." The
8520operator would respond with: "Mark 41+22. 011+041+ST (plus) 041+22" The "Mark
852141+22" has to do with billing, so disregard it. The 011+041 is access to the
8522overseas gateway (to be discussed in Part iii) and the 041+ 22+ is the routing
8523for Geneva from the overseas sender.
8524
8525"Directory" routings are for directory assistance overseas. Example: you want a
8526DA in Rome, Italy. You would call rate & route and say, "Directory routing
8527please, for Rome, Italy." They would respond with "011+039+ST (plus) 039+1108
8528STart." As in the previous example, the 011+039 is access to the overseas
8529gateway. The 039+1108 is a directory assistant in Rome.
8530
8531 2. Nameplace information- Rate & Route will give you the location of an NPA+
8532exchange. Example: "Nameplace please, for 215-648." The operator would respond
8533with "Paoli, Pennsylvania." This isn't especially useful, since you can get the
8534same information (legally) by dialing 0, but using rate & route is often much
8535faster and it avoids having to hang up when you are already on a trunk.
8536
8537*NOTE* On Rate & Route: As a blue boxer, always ask for "IOTC" routings.
8538(e.g., "IOTC operator's route", "IOTC numbers route", etc.) This tells them
8539that you want cordboard-type routings, not TSPS, because a blue boxer is
8540actually just a cordboard position (that Bell doesn't know about).
8541
8542OVERSEAS COMPLETION
8543OPERATOR (inbound)- These operators (KP+151+ST) assist in the completion of
8544calls coming in to the United States from overseas. There are KP+151+ST
8545operators only in a few NPAs in the country (namely 303). To use one, you would
8546seize a trunk and dial KP+303+151+ST. Then you would tell the operator, for
8547example, "This is Bangladesh calling. I need U.S. number 215-561-0562 please."
8548[in a broken Indian accent]. She would connect you, and the bill would be sent
8549to Bangladesh (where I've been billing my KP+151+ST calls for two years).
8550
8551Other internal Bell Operators.
8552
8553KP+11501+ST ...... universal operator
8554KP+11511+ST ...... conference op
8555KP+11521+ST ...... mobile op
8556KP+11531+ST ...... marine op
8557KP+11541+ST ...... long distance terminal
8558KP+11551+ST ...... time & charges op
8559KP+11561+ST ...... hotel/motel op
8560KP+11571+ST ...... overseas (outbound) op
8561
8562 These 115X1 operators are identical in routing to the 1X1 operators listed
8563previously, with one exception. If special routing is required (0XX), then the
8564trailing 1 is left off.
8565
8566Examples:
8567
8568
8569 Page 139
8570
8571
8572
8573
8574 The Official Phreaker's Manual
8575
8576A 312 universal op ... KP+312+11501+ST
8577A Franklin Park (312-456) universal op (special routing 032 required)........
8578KP+312+032+1150+ST [The trailing 1 of 11501 is left off].
8579
8580Purposes of 115X1 operators.
8581
8582UNIVERSAL- Used for collect/callback calls to coin stations.
8583
8584CONFERENCE- This is a cordboard conference operator who will set up a
8585conference for a customer on a manual operation basis.
8586
8587MOBILE- Assists in completion of calls to mobile (IMTS) type telefones.
8588
8589MARINE- Assists in completion of calls to ocean going vessels.
8590
8591LONG DISTANCE TERMINAL- Now obsolete.Was used for completion of long distance
8592calls.
8593
8594TIME & CHARGES- Will give exact costs of calls. Used to time calls and inform
8595customer of exactly how much it cost.
8596
8597HOTEL/MOTEL- Handles calls to/from hotels and motels.
8598
8599OVERSEAS
8600COMPLETION (outbound)- assists in completion of calls to overseas points. Only
8601works in some, if any NPAs, because overseas assistance has been centralized to
8602IOCC (covered in Part III).
8603
8604 Note that all KP+1X1+ST and KP+115X1+ST operators automatically assume that
8605you are a TSPS or cordboard operator assisting a customer with a call. DO NOT
8606DO ANYTHING TO JEOPARDIZE THIS! If you do not know what to do, don't call these
8607operators! Find out what to do first.
8608
8609 This concludes Part II. There is one final part in which I will explain
8610overseas dialing, IOCC (International Overseas Completion Centre), RQS
8611(Rate/Quote System), and some basic scanning.
8612
8613
8614
8615
8616
8617
8618
8619
8620
8621
8622
8623
8624
8625
8626
8627
8628
8629
8630
8631
8632
8633
8634
8635 Page 140
8636
8637
8638
8639
8640 The Official Phreaker's Manual
8641
8642 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8643 Better Homes and Blue Boxing
8644
8645 Part III
8646
8647 Advanced Signalling
8648=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
8649
8650(It is assumed that the reader has read and understood parts i & ii before
8651proceeding to this part).
8652
8653 In Parts I & II, I covered basic theory and domestic signalling and
8654operators. In this part I will explain overseas direct boxing, the IOCC, the
8655RQS, and some basic scanning methods.
8656
8657Overseas Direct Boxing.
8658
8659 Calling outside of the United States and Canada is accomplished by using an
8660"overseas gateway." There are 7 over-seas gateways in the Bell System, and each
8661one is designated to serve a certain region of the world. To initiate an
8662overseas call, one must first access the gateway that the call is to be sent
8663on. To do this automatically, decide which country you are calling and find its
8664country code. Then, pad it to the left with zeros as required so it is three
8665digits. [Add 1, 2, or 3 zeros as required].
8666
8667Examples:
8668
8669Luxembourg (352) is 352 (stays the same)
8670Spain (34) becomes 034 (1 zero added)
8671U.S.S.R. (7) becomes 007 (2 zeros added)
8672
8673 Next, seize a trunk and dial KP+011+ CC+ST. Note that CC is the three digit
8674padded country code that you just determined by the above method. [For
8675Luxembourg, dial KP+011+352+ST, Spain KP+011+034+ST, and the U.S.S.R. KP+011+
8676007+ST]. This is done to route you to the appropriate overseas gateway that
8677handles the country you are dialing. Even though every gateway will allow you
8678to dial every dialable country, it is good practice to use the gateway that is
8679designated for the country you are calling.
8680
8681 After dialing KP+011+CC+ST (as CC is defined above) you should be connected
8682to an overseas gateway. It will acknowledge by sending a wink (which is audible
8683as a <beep><kerchink> and a dial tone. Once you receive international dial
8684tone, you may route your call one of two ways: a) as an operator-originated
8685call, or b) as a customer-originated call. To go as a operator-originated call,
8686key KP+ country code (NOT padded with zeros)+ city code+number+ST. You will
8687then be connected, providing the country you are calling can receive
8688direct-dialed calls. The U.S.S.R. is an example of a country that cannot.
8689
8690Example of a boxed int'l call:
8691
8692To make a call to the Pope (Rome, Italy), first obtain the country code, which
8693is 39. Pad it with zeros so that it is 039. Seize a trunk and dial
8694KP+011+039+ST. Wait for sender dial tone and then dial KP+39+6+6982+ST. 39 is
8695the country code, 6 is the city code, and 6982 is the Pope's number in Rome. To
8696go as an operator-originated call, simply place a zero in front of the country
8697code when dialing on the gateway. Thus, KP+0+39+6+6982+ST would be dialed at
8698sender dial tone. Routing your call as operator-originated does not affect much
8699unless you are dialing an operator in a foreign country
8700
8701 Page 141
8702
8703
8704
8705
8706 The Official Phreaker's Manual
8707
8708
8709 To dial an operator in a foreign country, you must first obtain the operator
8710routing from rate & route for that country. Dial rate & route and if you're
8711trying to get an operator in Yugoslavia, say nicely, "IOTC Operator's route,
8712please, for Yugoslavia." [In larger countries it may be necessary to specify a
8713city]. Rate & route will respond with, "38 plus 11029". So, dial your overseas
8714gateway, KP+011+038+ST, wait for sender dial tone, and key KP+0+38+11029+ST.
8715You should then get an operator in Yugoslavia. Note that you must prefix the
8716country code on the sender with a 0 because presumably only an operator here
8717can dial an operator in a foreign country.
8718
8719 When you dial KP+011+CC+ST for an overseas gateway, it is translated to a
87203-digit sender code of the format 18X, depending on which sender is designated
8721to handle the country you are dialing. The overseas gateways and their 3-digit
8722codes are listed below.
8723
8724182 ..... White Plains, NY
8725183 ..... New York, NY
8726184 ..... Pittsburg, PA
8727185 ..... Orlando, FL
8728186 ..... Oakland, CA
8729187 ..... Denver, CO
8730188 ..... New York, NY
8731
8732 Dialing KP+182+ST would get you the sender in White Plains, and KP+183+ST
8733would get the sender in NYC, etc., but the KP+011+CC+ST is highly suggested (as
8734previously mentioned). To find out what sender you were routed to after dialing
8735KP+011+CC+ST, dial (at int'l dial tone): KP+0000000+ST.
8736
8737 If you have difficulty in reaching a sender, call rate and route and ask for
8738a numbers route for the country you're dialing. Sometimes, KP+011+ padded
8739country code+ST will not work. I have found this in many 3-digit country
8740codes. Luxembourg, country code 352, for example, should be KP+011+352+ST
8741theoretically. But it is not. In this case, dial KP+011+ 003+ST for the
8742overseas gateway. If you have trouble, try dialing KP+00+ first digit of
8743country code+ST, or call rate The IOCC.
8744
8745 Sometimes when you call rate and route and ask for an "IOTC numbers route" or
8746"IOTC operators route" for a foreign country, you will get something like
8747"160+700" (as in the case of the Soviet Union). This means that the country is
8748not dialable directly and must be handled through the International Overseas
8749Completion Centre (IOCC). For an IOCC routing, pad the country code to the
8750RIGHT with zeros until it is 3 digits. Then KP+160 is dialed, plus the padded
8751country code, plus ST. Examples:
8752
8753The U.S.S.R. (7) ...... KP+160+700+ST
8754Japan (81) ............ KP+160+810+ST
8755Uraguay (598) ......... KP+160+598+ST
8756
8757 You will then be routed to the IOCC in Pittsburg, PA, who will ask for
8758country, city, and number being dialed. Many times they will ask for a
8759ringback [thanks to Telenet Bob] so have a loop ready. They will then place the
8760call and call you back (or sometimes put you through directly). Some calls,
8761such as to Moscow, take several hours.
8762
8763The Rate Quote System (RQS).
8764
8765 The RQS is the operator's rate/quote system. It is a computer used by TSPS
8766
8767 Page 142
8768
8769
8770
8771
8772 The Official Phreaker's Manual
8773
8774(0+) operators to get rate and route information without having to dial the
8775rate and route operator. In Part ii, I discussed getting an inward routing for
8776dialing-assistance and emergency interrupts from the rate and route operators
8777(KP+800+141+1212+ST). The same information is available from RQS. Say you want
8778the inward routing for 305-994. You would seize a trunk and dial KP+009+ST (to
8779access the RQS). Sometimes, if you seize a trunk in an NPA not equipped with
8780RQS, you need to dial an NPA that is equipped with RQS first, such as 303.
8781Anyway, after you dial KP+009+ST or KP+303+009+ST, you will receive a wink
8782(<beep><kerchink>) and then RQS dial tone. At RQS dial tone, for an inward
8783routing for 305-994 you would dial KP+06+305+994+ST. That is,
8784KP+06+NPA+exchange+ST. RQS will respond with "305 plus 033 plus". This means
8785you would dial KP+305+033+121+ST for an inward that services 305-994. If no
8786special routing were required, RQS would have responded with "305 plus" and you
8787would simply dial: KP+305+121+ST for an inward.
8788
8789 Another RQS feature is the echo feature. You can use it to test your blue
8790box. Dial RQS (KP+009+ST) and then key KP+07+1234567890+ST. RQS will respond
8791with voice identification of the digits it recognized, between the KP+07 and
8792ST.
8793
8794 RQS can also be used for rates and directory routings, but those are seldom
8795needed, so they have been omitted here.
8796
8797Simple Scanning.
8798
8799 If you're interested in scanning, try dialing on a trunk, routings in the
8800format of KP+11XX1+ST. Begin with 11001 and scan to 11991. There are lots of
8801interesting things to be found there, as Doctor Who (413 area) can tell you.
8802Those 11XX1 routings can also be prefixed with an NPA, so if you want to scan
8803area code 212, dial KP+212+ 11XX1+ST.
8804
8805 There, now you know as much about blue boxing as most phreaks. If you read
8806and understand the material, and put aside preconceived ideas of what blue
8807boxing is that you may have acquired from inexperienced people or other
8808bulletin boards, you should be well on you way to an enlightening career in
8809blue boxing. If you follow the guidelines in Part I to box, you should have no
8810problem with the fone company. Comments made by "phreaks" on bulletin boards
8811that proclaim "tracing" of blue boxers are nonsense and should be ignored
8812(except for a passing chuckle).
8813
8814NOTE 1: CCIS and the downfall of blue boxing.
8815
8816CCIS stands for Common Channel Inter-office Signalling. It is a signalling
8817method used between electronic switching systems that eminiates the use of
88182600Hz and 3700Hz supervisory signals, and MF pulsing. This is why many places
8819cannot be boxed off of; they employ CCIS, or out-of-band signalling, which will
8820not respond to any tones that you generate on the line. Eventually, all
8821existing toll equipment will be upgraded or replaced with CCIS or T-carrier. In
8822this case, we'll all be boxing with microwave dishes. Until then (about 1995 by
8823current BOC/AT&T estimates), have fun!
8824
8825If you have ANY questions about this text, please feel free to drop me a line.
8826I will respond to all mail, messages, etc. Insults are also welcomed. And if
8827you discover anything interesting scanning, be sure to let me know.
8828
8829Mark Tabas
8830$LOD$
8831
8832
8833 Page 143
8834
8835
8836
8837
8838 The Official Phreaker's Manual
8839
8840This text was prepared in full by Mark Tabas for:
8841
8842K.A.O.S.
8843Philadelphia, PA.
8844[215-465-3593].
8845
8846Any sysop may freely download this text and use it on his/her BBS, provided
8847that none of it be altered in any way.
8848
8849Technical acknowledgements:
8850
8851Karl Marx, X-Man, High-Rise Joe, Telenet Bob, Lex Luthor, TUC, John Doe, Doctor
8852Who (413 area), The Tone Sweep, Mr. Silicon, K00L KAT, The Glump.
8853
8854References:
8855
88561. Notes on the BOC Intra-LATA Networks Bell System publication, 1983.
88572. Notes on the Network Bell System publication, 1983.
88583. Engineering and Operations in the Bell System Bell System publication,
88594. Notes on Distance Dialing Bell System publication, 1968.
88605. Early Medieval Architecture.
8861.......................................
8862(c) February 6, 1900 Mark Tabas
8863.......................................
8864
8865
8866
8867
8868
8869
8870
8871
8872
8873
8874
8875
8876
8877
8878
8879
8880
8881
8882
8883
8884
8885
8886
8887
8888
8889
8890
8891
8892
8893
8894
8895
8896
8897
8898 Page 144
8899
8900
8901
8902
8903 The Official Phreaker's Manual
8904
8905 BY FRED STEINBECK (TAP #88)
8906
8907 IT SEEMS THAT FEWER AND FEWER PEOPLE HAVE BLUE BOXES THESE DAYS, AND
8908THAT IS REALLY TOO BAD. BLUE BOXES, WHILE NOT ALL THAT GREAT FOR MAKING FREE
8909CALLS (SINCE THE TPC CAN TELL WHEN THE CALL WAS MADE, AS WELL AS WHERE IT WAS
8910TOO AND FROM), ARE REALLY A LOT OF FUN TO PLAY WITH. SHORT OF BECOMING A REAL
8911LIVE TSPS OPERATOR, THEY ARE ABOUT THE ONLY WAY YOU CAN REALLY PLAY WITH THE
8912NETWORK.
8913 FOR THE FEW OF YOU WITH BLUE BOXES, HERE ARE SOME PHRASES WHICH MAY
8914MAKE LIFE EASIER WHEN DEALING WITH THE RATE & ROUTE (R&R) OPERATORS. TO GET
8915THE R&R OP, YOU SEND A KP + 141 + ST. IN SOME AREAS YOU MAY NEED TO PUT
8916ANOTHER NPA BEFORE THE 141 (I.E., KP + 213 + 141 + ST), IF YOU HAVE NO LOCAL
8917R&R OPS.
8918 THE R&R OPERATOR HAS A MYRIAD OF INFORMATION, AND ALL IT TAKES TO GET
8919THIS DATA IS MUMBLING CRYPTIC PHRASES. THERE ARE BASICALLY FOUR SPECIAL
8920PHRASES TO GIVE THE R&R OPS. THEY ARE NUMBERS ROUTE, DIRECTORY ROUTE, OPERATOR
8921ROUTE, AND PLACE NAME.
8922 YOU GET AN R&R AN AREA CODE FOR A CITY, ONE CAN CALL THE R&R OPERATOR
8923AND ASK FOR THE NUMBERS ROUTE. FOR EXAMPLE, TO FIND THE AREA CODE FOR CARSON
8924CITY, NEVADA, WE'D ASK THE R&R OP FOR "CARSON CITY, NEVADA, NUMBERS ROUTE,
8925PLEASE." AND GET THE ANSWER, "RIGHT... 702 PLUS." MEANING THAT 702 PLUS 7
8926DIGITS GETS US THERE.
8927 SOMETIMES DIRECTORY ASSISTANCE ISN'T JUST NPA + 131. THE WAY TO GET
8928THESE ROUTINGS IS TO CALL R&R AND ASK FOR "ANAHEIM, CALIFORNIA, DIRECTORY
8929ROUTE, PLEASE." OF COURSE, SHE'D TELL US IT WAS 714 PLUS, WHICH MEANS 714 + 131
8930GETS US THE D.A. OP THERE. THIS IS SORT OF POINTLESS EXAMPLE, BUT I COULDN'T
8931COME UP WITH A BETTER ONE ON SHORT NOTICE.
8932 LET'S SAY YOU WANTED TO FIND OUT HOW TO GET TO THE INWARD OPERATOR FOR
8933SACRAMENTO, CALIFORNIA. THE FIRST SIX DIGITS OF A NUMBER IN THAT CITY WILL BE
8934REQUIRED (THE NPA AND AN NXX). FOR EXAMPLE, LET US USEM 916 756. WE WOULD CALL
8935R&R, AND WHEN THE OPERATOR ANSWERED, SAY, "916 756, OPERATOR ROUTE, PLEASE."
8936THE OPERATOR WOULD SAY, "916 PLUS 001 PLUS." THIS MEANS THAT 916 + 001 + 121
8937WILL GET YOU THE INWARD OPERATOR FOR SACRAMENTO.
8938 DO YOU KNOW THE CITY WHICH CORRESPONDS TO 503-640? THE R&R OPERATOR
8939DOES, AND WILL TELL YOU THAT IT IS HILLSBORO, OREGON, IF YOU SWEETLY ASK FOR
8940"PLACE NAME, 503 640, PLEASE."
8941 FOR EXAMPLE, LET'S SAY YOU NEED THE DIRECTORY ROUTE FOR SVEG, SWEDEN.
8942SIMPLY CALL R&R, AND ASK FOR, "INTERNATIONAL, BADEN, SWITZERLAND. TSPS
8943DIRECTORY ROUTE, PLEASE." IN RESPONSE TO THIS, YOU'D GET, "RIGHT... DIRECTORY
8944TO SVEG, SWEDEN. COUNTRY CODE 46 PLUS 1170." SO YOU'D ROUTE YOURSELF TO AN
8945INTERNATIONAL SENDER, AND SEND 46 + 1170 TO GET THE D.A. OPERATOR IN SWEDEN.
8946 INWARD OPERATOR ROUTINGS TO VARIOUS COUNTRIES ARE OBTAINED THE SAME WAY
8947"INTERNATIONAL, LONDON, ENGLAND, TSPS INWARD ROUTE, PLEASE." AND GET "COUNTRY
8948CODE 44 PLUS 121." THEREFORE, 44 PLUS 121 GETS YOU INWARD FOR LONDON.
8949 INWARDS CAN GET YOU LANGUAGE ASSISTANCE IF YOU DON'T SPEAK THE
8950LANGUAGE. TELL THE FOREIGN INWARD, "UNITED STATES CALLING. LANGUAGE ASSISTANCE
8951IN COMPLETING A CALL TO (CALLED PARTY) AT (CALLED NUMBER)."
8952 R&R OPERATORS ARE PEOPLE ARE PEOPLE TOO, Y'KNOW. SO ALWAYS BE POLITE,
8953MAKE SURE USE OF 'EM, AND DIAL WITH CARE.
8954
8955NOTE: AS A RESULT OF THE BREAK-UP, R&R IS NOW KP+800+141+1212+ST
8956
8957
8958
8959
8960
8961
8962
8963
8964 Page 145
8965
8966
8967
8968
8969 The Official Phreaker's Manual
8970
8971 Verification
8972 By Fred Steinbeck
8973
8974>From TAP issue # 88 10-83
8975
8976 There has been a great deal of controversy in the realm of phreakdom over a
8977mysterious subject known under a number of different names, including
8978"Verification", "Autoverification", "Verify", "Autoverify", "Verify Busy", and
8979even "VFY BY". All of these names basically mean the same thing: the ability
8980to listen to another person's telephone line from any telephone in the
8981direct-dialable world.
8982 Needless to say, Bell System is very tight lipped about knowledge regarding
8983verification. Indeed, the infamous book 'Notes on long distance dialing' ('68
8984edition) says, "Care must be taken to insure that the customer never gains
8985verification capabilities." With a printed policy like that, you can imagine
8986what their real-world policy is like! Even their own rate and route operators
8987will not give verification on routing codes (at least in my experience), one
8988even responding, "What?! You must be crazy! We don't give those out!" Before
8989you get too far into this article, I will state simply: I don't know how to
8990verify. However, I have been fooling with various things related to it, and
8991collecting information on it for some time now. Therefore, while I can't do it
8992(yet), I may be able to point some other bright TAPer on the right track, and
8993perhaps he or she will show us all how. If you have knowledge not covered in
8994this article, but don't want to write an article on your own, please send your
8995ideas, comments, or information to Project Verify, C/O TAP Verify has also
8996been called "Autoverify", and I have no idea why. This is not, to my
8997knowledge, a Bell System term (at least I've never seen it in any manuals) As
8998far as I know, there is verify, which means being able to listen to speech
8999(kind of; see below) on a line, and there is the "Emergency Interrupt which
9000allows you to take part in the conversation taking place on the line in
9001question. It has been suggested that "Autoverify" is the same as an emergency
9002interrupt , but I tend to disagree with this idea. It should be noted that the
9003verification circuitry does not actually let an operator listen to a
9004conversation without making a beep on the line every so often. Instead, she
9005will hear encrypted speech. However, I believe with the proper methods, verify
9006can be converted to an emergency interrupt.
9007 Verification is normally done either by your normal "0" (TSPS) operator, if
9008the call is in your home NPA (HNPA), or by an inward operator (IO). If the
9009call is outside your HNPA, your normal operator will call the IO for the
9010NPA,and say, "Verify Busy" or "Emergency Interrupt" please, 555 1212." The IO
9011will perform whatever magic he or she must, and then report back. If the call
9012is in your HNPA, though, the "0" operator can do the verification herself by
9013using the "VFY BY" key on her keyshelf. However, in some areas, the operator
9014uses a routing code to accomplish verification, and this the is loop hole we
9015shall attack.
9016 It follows that if a IO or "0" operator can do it, so can we, with a blue box
9017Now, courtesy of Robert Allen (who brought it to my attention) and Susan
9018Thunder (who apparently discovered it), here is what used to work for getting
9019operators to hook you into conversations with other people (i.e.,let you listen
9020to them till you hung up): You'd call the operator and say "Operator, TSPS
9021Maintenance Engineer Calling. Ring forward to 001 + NPA + 7d, ring back to my
9022number, hit ring forward, no AMA, and then position release.
9023 This creates some problems, and you must be familiar with the TSPS
9024console(by dialing "0"), you are on the "back", or incoming part of a loop.
9025When she places a call for you, the call goes out on the "forward", or outgoing
9026part of the loop. If an operator wants to make a call, she punches KP FWD
9027(keypulse forward), the number, and ST. Ring FWD puts a 90 volt ringing signal
9028across the forward part of the line (and may dial the number as well). The
9029
9030 Page 146
9031
9032
9033
9034
9035 The Official Phreaker's Manual
9036
9037problem arises from the fact that I don't know if Ring FWD will actually dial a
9038call, and if there is some other subtle difference between it an KP FWD.
9039 Let us assume ringing forward makes a call from the TSPS console to whatever
9040number is given. Ring back causes your phone to ring (it is assumed you hung
9041up after giving her your instructions; if you didn't you'd hear an annoying 90
9042volts across the earpiece...) "No AMA" means "no automatic message accounting",
9043so nobody gets billed for the call, although it will show up on a tape
9044somewhere. "Position Release" removes the operator from the circuit, and
9045allows her to receive other calls. This leaves an unaccounted-for ring
9046forward.
9047 The verification circuit, as you know, likes to encrypt conversation, which
9048is something we don't want. Well, the second Ring FWD sends another 90 volts
9049crashing against the verify circuitry, which Juda Gerad thinks removes the
9050voice encryption from the line, puts the operator (and you) in circuit, and
9051puts a beep tone on the line every five seconds. This seems to make sense, and
9052I am inclined to agree with him.
9053 The bit about "....001 + NPA + 7D" causes the thought "MF routing code" to
9054spring immediately to mind. Now, the above trick was supposed to work in the
9055213 NPA. I have tried both "KP+001+213+7D+ST", and some other area codes. I
9056generally get nothing, a reorder signal, or a tandem recording.
9057 Here's some food for thought: On an official Telco sheet I have, labeled "
9058213 NPA MF Routing Codes", 001 is listed as "VFY BY", or verify busy for the
9059213 NPA. 002 is listed for the 805 NPA. Ma Bell likes to have standardized
9060routing codes, such logical, then, that 001 would be a sort of "standard"
9061verify code, and other prefixes would be tacked on at 002,003, etc. However, I
9062have heard from a retired operator that verification codes are different from
9063area to area, and are not always nice numbers like 001, 002. Ah, well, a guy
9064can hope, can't he?
9065 Some suggestions for future attacks on this dilemma: Everyone call your
9066operators and subtly ask questions. I have found the tend to give information
9067out easier if you ask for something that you would ordinarily have to be a
9068company employee to know about, such as rate steps, operator routings, etc.
9069 Casually let slip that you used to be (or still are) an operator, or that
9070you work for company security. Also, you might want to blue box some codes
9071like 001 followed by your NPA and the last 7D of a busy number. If you get a
9072sort of "whispery noise", try blasting the line with a ringing signal (you
9073might piggyback another line onto yours and call the piggyback to generate the
907490 volts) and see if that does anything.
9075
9076
9077
9078
9079
9080
9081
9082
9083
9084
9085
9086
9087
9088
9089
9090
9091
9092
9093
9094
9095
9096 Page 147
9097
9098
9099
9100
9101 The Official Phreaker's Manual
9102
9103 ===================================
9104 EQUAL ACCESS AND THE AMERICAN DREAM
9105 ===================================
9106
9107
9108by
9109
9110Mark Tabas
9111P.O. Box 620401
9112Littleton, CO 80162
9113
9114July 7, 1985
9115
9116
9117
9118 The American Dream means many things to many people. To the small, typical
9119businessman, it means building a good, strong business based on hard work and
9120perseverance; indeed, with nothing limiting his potential but he amount of work
9121he is willing to put into his business. To a large businessman, the American
9122Dream means living and working in a country where a single corporation can have
9123a profit exceeding the gross national product of an entire third world nation.
9124 To the individual, the American Dream is the right to choose -- everything
9125from one's breakfast cereal to a long-distance service, as well as the formal
9126right outlined by our founding fathers: those of life, liberty, and the pursuit
9127of happiness.
9128 To the phone phreak, I think the American Dream is, in a sort of twisted way,
9129the uninhibited pursuit of knowledge. This quest could scarcely remain
9130unchecked in many other countries. Analogous to this quest is the thriving of
9131the Bell System, which until January 1, 1984 consisted of the American
9132Telephone and Telegraph Company, the largest corporation in the history of the
9133world. Did the American Dream die on January first or did the divestiture of
9134AT&T cause a giant step forward for competition and free enterprise in the
9135United States? I do not know. I do know that the other nations of the world
9136were amazed that the United States would dissolve the entity that brought the
9137finest and most universal telephone system in the world, and did so at a time
9138when the majority of the rest of the world was still using two dixie cups and a
9139string.
9140 The unfairness of the situation is that AT&T built the telephone system of
9141this nation and is now being bound and gagged and having its possessions
9142distributed to others, whom AT&T also wrought. All in the name of fairness,
9143free competition, and "equal access". Where was was MCI during the century
9144that AT&T built he communications system of this nation? Well, I believe in
9145Equal Access, Wholly. And, since I believe in equal access and its
9146implications for equality for all so strongly, I feel that MCI, Sprint, and
9147others should take the same amount of time to build their respective toll
9148networks: 100 years. Therefore, if the United States Justice Department were
9149truly the fair and just administrator that it portrays itself to be, MCI would
9150not have a hand in the long-distance cache until about 2080. That's only
9151fair.
9152 There is no doubt that MCI is a sub-standard organization. They consist of
9153incompetent employees, inferior equipment, and an inferior marketing strategy.
9154They are mockingly imitative of AT&T, except in the quality of their service,
9155which is practically unusable. It is also interesting that with less than 2%
9156market share, MCI calls itself "the nation's long-distance company." The point
9157to this diatribe is this. It's time for these long-distance companies such as
9158MCI and Sprint to grow up. With Equal Access, they are going to become real
9159long-distance companies, not the joke organizations they are now, and I think
9160it may just take them one hundred years to do so.
9161
9162 Page 148
9163
9164
9165
9166
9167 The Official Phreaker's Manual
9168
9169
9170 ============
9171 Equal Access
9172 ============
9173
9174 Equal Access, as it applies to the telecommunications industry, is "the
9175requirement that each Bell Operating Company provide exchange access to all
9176long-distance carriers that is equal in type and quality to that provided AT&T
9177communications." This is the official provision set forth by the United States
9178Justice Department in the Modification of the Final Judgment, August 24, 1982.
9179All this means is that each long-distance-distance company will have "equal
9180access" to all of the same types of services that AT&T currently enjoys. There
9181are four types of long-distance carrier services, divided into "feature
9182groups." They follow.
9183
9184FG A: "line side access." This is the standard 7-digit dialup+code (for
9185billing purposes) +destination telephone number. It is currently in use by
9186most long-distance carriers.
9187
9188FG B: "trunk side access." These are the 950 exchange numbers. They also
9189utilize an authorization code for billing. As with FG A, automatic number
9190identification (ANI) (i.e. calling number) is not provided to the carrier, but
9191will be in the future.
9192
9193FG C: "1+ dialing." Currently, only AT&T is able to get this type of
9194service. It is 1/0+7 of 10 digit direct long distance dialing. ANI (for
9195billing) is provided.
9196
9197FG D: "equal access." This will allow for 1/0+7 or 10 digit direct
9198long-distance dialing (presubscription carrier) and 10xxx+1/0+7 or 10 digit
9199long-distance dialing (alternate carrier). ANI for billing is provided at the
9200long-distance carrier's option. Billing may also be handled by the individual
9201long distance company or the local Bell Operating Company.
9202
9203 Feature groups C and D are mutually exclusive (i.e. both cannot exist in a
9204particular area at the same time). Areas which have Feature Group C (AT&T
9205long-distance only) are non-Equal Access, and areas which have Feature Group D
9206(multiple long distance carriers) are Equal Access regions.
9207 Feature Group B, the 950 exchange numbers will be used in areas in which it
9208is not feasible to provide with Equal Access, such as step-by-step offices
9209(yes, they CAN have 950 numbers), some crossbar offices, and some independent
9210telcos, which are not bound by the provisions of Equal Access and may provide
9211to their customers any type of long-distance service(s) they wish. The 950
9212exchange is now active in many areas. It is mainly used as a universal
9213"roaming" access port for many long-distance carriers, but when an office is
9214converted to Equal Access, the 950 capability is removed. Thus, in an Equal
9215Access region, one cannot complete a call to a 950 telephone number.
9216 I personally am looking very forward to Equal Access. My area is not
9217scheduled for full implementation of it until late 1985 or early 1986, and by
9218this time many of the alternate long distance carriers' networks will be in
9219place (or well under way). Think about what Equal Access means. Equality for
9220all long distance carriers. Access to common facilities, such as: busy-line
9221verification lines, Bell System information, signalling specifications. etc.
9222After full implementation of Equal Access, one will be able to take advantage
9223of and manipulate the services of more than just one carrier. It will no
9224longer be phreaks vs. AT&T.
9225 When your area is ready to initiate Equal Access, you will receive a notice
9226in the mail informing you of some of the details of Equal Access, and will ask
9227
9228 Page 149
9229
9230
9231
9232
9233 The Official Phreaker's Manual
9234
9235you to specify your choice of "primary carrier." In some cases you will need to
9236specify both inter-LATA carrier (IC), which handles calls out of your LATA
9237(Local Access and Transport Area), and an international carrier (INC), which
9238will handle calls destined for other countries. Recent market studies have
9239shown that between 80 and 90 per cent of residential customers will continue to
9240be served by AT&T for their long-distance service after Equal Access. So much
9241for competition.
9242 You will probably be faced with many long-distance companies to choose from,
9243including but not limited to: AT&T, MCI, Sprint, ITT, Western Union, Dial U.S.,
9244Call America, TMC, and U.S. Telephone. Whichever you choose will become your
9245"primary carrier." Your primary carrier will handle your call each time you
9246pick up you fone and dial 1+7 or 10 digits or 0+7 or 10 digits, inter-LATA
9247only. That is, if you dial a toll call that is within your LATA, it will be
9248handled by your local telephone company (Bell), not by your primary carrier,
9249even though it is a toll call. Let's use an example. The state of Colorado
9250consists of two LATAs. For this example, I will use three cities in Colorado:
9251Denver (in LATA1), Sterling (LATA1 also), and Colorado Springs (in LATA2).
9252Note here that even though Denver ad Sterling are in the same LATA, and Denver
9253and Colorado Springs are not, Sterling is actually much farther away from
9254Denver than Colorado Springs. This is because LATA boundaries were designed
9255giving consideration to high toll-traffic regions, to bring in revenue. Toll
9256traffic between Denver and Colorado Springs is very high, so the two cities
9257were placed in separate LATAs (or, more correctly, they were separated by a
9258LATA boundary). Toll traffic between Denver and Sterling is very low, of the
9259two cities were allowed to remain in the same LATA. Now, if everyone in
9260Colorado Springs were to pack up and move to Sterling (though who knows what
9261the hell for), the LATA boundaries in Colorado would be changed so that Denver
9262and Sterling were in different LATAs. The primary factor in determining LATAs
9263is money.
9264 If I made a call to Sterling from my home in Denver, the call would be routed
9265entirely via Mountain Bell long-distance facilities. No long distance carrier
9266would be involved because Denver and Sterling are in LATA1. If I made a call
9267to Kelley, the blonde babe in Colorado Springs, the call would be handled by a
9268long distance carrier (in this case, AT&T) because Denver is in LATA1 and
9269Colorado Springs is in LATA2. Here is a table to simplify this:
9270
9271Customer dials LATA Carrier
9272-----------------------------------------------------------------
92737 digits same Bell
92741+7 digits same Bell
92751+7 digits diff LD carrier (currently AT&T)
92761+10 digits diff LD carrier (currently AT&T)
9277-----------------------------------------------------------------
9278
9279 Note several things here. First, not all areas need to dial a 1 when dialing
9280any number, local or long distance, but the central offices will still discern
9281whether the call is in the same LATA as the customer or a different one and
9282handle the call appropriately. Secondly, some step-by-step offices require a
92831+NPA to be dialed for calls within the same LATA and, in fact, all numbers
9284outside of the office itself. But, for the most part, the above table is
9285standard for common switching networks.
9286
9287 ==================
9288 Alternate Carriers
9289 ==================
9290
9291 Your normal long distance carrier will handle all your toll calls which cross
9292over LATA boundaries when you dial directly, 1+. If you wish to place your
9293
9294 Page 150
9295
9296
9297
9298
9299 The Official Phreaker's Manual
9300
9301call via another carrier's network, whether for cost, quality, or circuit
9302availability reasons, you may do so in Equal Access regions. To access an
9303alternate long distance carrier after Equal Access, a customer dials
930410xxx+1/0+7 or 10 digit telefone number. Note that xxx is the "carrier access
9305code (CAC)." A few CACs currently in use are listed below.
9306
9307220 ........ Western Union 666 ........ Lexitel
9308222 ........ MCI 777 ........ Sprint
9309333 ........ US Telefone 888 ........ SBS
9310444 ........ Allnet
9311
9312 Thus, in an Equal Access region, to dial Fred in Orlando, a customer would
9313dial 1+305+994+9966 to place his call on his primary carrier, or to place it on
9314another network, he could dial: 10222+1+305+994+9966, and the call would go
9315over MCI facilities (in this case). Eventually, after many more long distance
9316services get into the act, there will be a directory of the various long
9317distance companies and their CACs, and deciding which carrier to use for any
9318particular call to get the bet rate will be beyond the ability of everyone
9319except phone phreaks.
9320
9321 ================
9322 The 950 Exchange
9323 ================
9324
9325 As discussed, the 950 central office exchange is currently a "roaming" access
9326port for various long distance carriers. In areas that have 950, the access to
9327carriers is standardized. Thus, someone travelling to several different areas
9328need only know the 950 number of the carrier he uses to access it from any area
9329(provided that it have 950 active). Originally, the 950 exchange was designed
9330to correspond with the 10xx carrier access code used for Equal Access. For
9331example, 950-1022 would be the same carrier as 1022 (+telephone number).
9332However, it was later found that the 100 codes available for use as 10xx CACs
9333would be insufficient to handle he number of long distance carriers. So, the
9334common carrier access code was increased by one digit, to 10xxx, thus
9335increasing the number of possible CACs to 1000. To keep the 950 exchange
9336consistent with the non CAC, the Bell Operating Companies have opted to change
9337the 950-10xx to 950-0xxx. The xxx in the 950-0xxx remains the same as the xxx
9338in the 10xxx carrier access code. The new modified 950 numbering pan is now
9339active in Philadelphia (Bell Atlantic) among other areas.
9340 After Equal Access is well under way, the 950 exchange will be used in
9341certain areas that cannot be equipped for the standard Equal Access dialing
9342plans. This includes step-by-step, #1 crossbar, #5 crossbar, #2ESS, and #3ESS
9343offices. Customers in areas served by these types of switching equipment will
9344dial 950-0xxx, wait for acknowledgement tone from the carrier, and then dial a
9345"personal identification number" and destination telefone number,and the call
9346will be completed on the selected carrier's facilities. Initially, billing
9347will be handled by the carrier itself, and supervisory information and ANI will
9348not be provided by the local Bell Operating Company.
9349 There are three main advantages to the 950 central office exchange and
9350protocol. They are: a) universal access for all areas, b) 950-exchange numbers
9351are "trunk side access." This means that the long distance carrier has direct
9352trunks going to it from a Bell toll office or local central office. These
9353trunks are interoffice lines, not customer type (POTS) lines, and supposedly
9354insure higher quality of connection. And, c) 950-exchange numbers are toll and
9355message unit free. On metered-usage (i.e., not "flat rate") customer lines,
9356they cost nothing. In most areas they are free from coin stations, with
9357Colorado as one notable exception.
9358
9359
9360 Page 151
9361
9362
9363
9364
9365 The Official Phreaker's Manual
9366
9367 =====
9368 Costs
9369 =====
9370
9371 Each long-distance carrier must choose the type(s) of service it wishes to
9372provide to its customers. These different types of service were outlined
9373earlier as "Feature Groups." The costs of these Feature Groups vary directly
9374with the complexity and quality of the service itself. The following table
9375outlines the cost to the carrier of each available Feature Group. It is based
9376on the monthly rate per line for 9000 minutes of circuit use, and assumes the
9377carrier and Bell switch are 15 miles apart.
9378
9379FG non-Equal Access Equal Access
9380--------------------------------------------------------
9381A $329.94 $709.20
9382B 329.94 721.80
9383C 752.40 ** N/A **
9384D ** N/A ** 752.40
9385--------------------------------------------------------
9386
9387 These figures are a lot more significant than they might appear. They
9388indicate that after Equal Access, in order to compete with the giants such as
9389AT&T, MCI, etc., smaller long distance companies will use Feature Group A or B
9390type service in order to provide significantly lower rates to their customers
9391than companies subscribing to Feature Group D service (like AT&T, MCI, etc).
9392This will cause a unique type of equilibrium to form. Customers willing to
9393dial an access number, authorization code, and destination number and put up
9394with lower quality service will be able to save a lot of money. This seems
9395faintly reminiscent of pre-Equal Access times....
9396
9397 ====================
9398 Directory Assistance
9399 ====================
9400
9401 Each Bell Operating Company will be responsible for providing intra-LATA
9402operator services. When a customer dials (1)+411 or (1)+555+1212 for local
9403directory assistance, he will reach a Bell operator who will service requests
9404for listed numbers within the customer's LATA. Requests for numbers in LATAs
9405other than the calling customer's may be handled at the discretion of the local
9406operating company. Initially, the Bell Operating Companies will meet the
9407responsibility for providing directory assistance services by contracting it to
9408a long distance carrier or carriers (currently AT&T). All inter-LATA directory
9409assistance services will be provided by the inter-LATA carrier (IC). ICs may
9410also provide 800 Enterprise service or other toll free type directory
9411assistance services. See table.
9412
9413=================================================================
9414Intra-LATA:
9415=================================================================
9416 HNPA 411/555-1212 BOC
9417 *FNPA NPA+555-1212 BOC
9418 HNPA 10xxx+555-1212 intra-LATA carrier
9419 *FNPA 10xxx+NPA+555-1212 intra-LATA carrier
9420
9421=================================================================
9422Inter-LATA:
9423=================================================================
9424 HNPA (10xxx)+1+555-1212 IC
9425
9426 Page 152
9427
9428
9429
9430
9431 The Official Phreaker's Manual
9432
9433 FNPA (10xxx)+1+NPA+555-1212 IC
9434=================================================================
9435* When LATA boundaries cross NPA boundaries (rare).
9436FNPA = Foreign Numbering Plan Area (area code).
9437HNPA = Home Numbering Plan Area (area code).
9438
9439 At first glance, the above table appears somewhat complex. But, if you
9440understand the concept of LATAs and carriers, it is easily understood.
9441Essentially, all local Bell Operating Companies will maintain their own
9442directory assistance services. When a customer dials 411 or 555-1212, he will
9443reach a BOC directory assistant. Additionally, each long distance carrier that
9444wishes to provide directory assistance to its customers will also have DA
9445facilities. And, when a customer dials a directory assistant (NPA+555-1212) on
9446a carrier, he will reach an operator of that particular long distance carrier.
9447The key here is LATAs. If a customer wants to find a number that is within his
9448LATA, no long distance carrier is involved. It is handled strictly by the
9449Local Bell Operating Company. If a customer is seeking a number that is not
9450within his LATA, he must use the services of an inter-LATA (long-distance)
9451carrier.
9452
9453 ======================
9454 TSPS Operator Services
9455 ======================
9456
9457 Traffic Service Position System (TSPS) operator services will be handled much
9458in the same fashion as directory assistance services, with a few differences.
9459As with DAs, each Bell Operating Company and each inter-LATA carrier will
9460maintain its own TSPS operator facilities (or cordboard I suppose, if they
9461cannot afford TSPS). When a customer dials simply 0 (operator), he will reach
9462a BOC TSPS operator. The BOC TSPS will be able to handle all types of
9463intra-LATA operator-assisted traffic including (but not limited to): collect,
9464third party billing, Bell credit card, coin, verification and emergency
9465interrupt, and requests for emergency aid. BOC TSPS will be unable to complete
9466calls for customers outside of the customer's LATA. Thus, inter-LATA operator
9467assistance will be handled by an inter-LATA carrier TSPS (IC TSPS). An IC TSPS
9468will handle all previously mentioned types of calls that require inter-LATA
9469transport (i.e., the call originates and terminates in different LATAs). When
9470a customer dials 0+NXX-XXXXX or 0+NPA+NXX-XXXX, the central office will
9471determine if the call is destined for another LATA. If it is not, the call
9472will be sent to the Bell TSPS for appropriate handling. If the call is bound
9473for another LATA (and his determination is made based on the NXX or NPA+NXX),
9474then the call will be sent off to the customer's primary long-distance carrier
9475(since only 0+ was dialed). If the customer wishes to use a different
9476carrier's operator services, he would dial 10xxx+0+number, and the carrier
9477specified by the 10xxx carrier access code would receive the call. Note: if a
9478customer dials 10xxx+0+number, and the call is an intra-LATA call, he will get
9479a recording, "We're sorry, the number you dialed cannot be reached with the
9480carrier access code you dialed. Please check the code and try again or call
9481your carrier for assistance." (Western Electric KS-22550 central office tape
9482list no. 46.) Until the Bell Operating Companies can install their own TSPS
9483facilities and networks, they will (continue to) lease capacity from AT&T TSPS.
9484That is, AT&T will handle the intra-LATA traffic for the BOCs on a contract
9485basis. In the meantime, AT&T will continue to handle its own long-distance
9486operator services while the other inter-LATA carriers will have to implement
9487their own operator networks from scratch. My estimation is that you won't be
9488able to dial 10222+0 for an MCI TSPS operator until sometime around the year
94892590. And even then they will probably be cordboard.
9490 In addition to the changes in TSPS described above, there will be certain
9491
9492 Page 153
9493
9494
9495
9496
9497 The Official Phreaker's Manual
9498
9499modifications to the software and hardware involved in the TSPS operator
9500system. Most critical, and of paramount importance to the telecommunications
9501enthusiast is changes in circuit associated signalling (CAS). This is
9502signalling to and from the TSPS facility. When a customer dials 0 (operator) or
950310xxx+0 (IC operator), a succession of events occurs. First, the end office
9504seizes a trunk to the appropriate operator facility (this assumes that no
9505access tandem is involved). The operator service facility responds with a wink
9506(proceed signal) and the end office outpulses the CALLED number (or KP+ST if 0
9507only dialed). The operator service (OS) facility will then come off-hook to
9508signal that it is ready to receive ANI information. The end office outpulses
9509the ANI information in the format of KP+II+7 digits+ST (or ST'). If there is
9510ANI failure, a KP+02+ST (or ST') will be sent. "ST'" stands for STart "prime",
9511and is indicative of a coin call (i.e., dial 0 from a coin station). A normal
9512ST terminating the ANI sequence means that the call is originating from a
9513noncoin station. See table for ultimate description.
9514
9515Inter-LATA calls MF-pulsed
9516
9517type of call customer dials cld num ANI
9518============================================================
9519noncoin:
9520============================================================
9521 direct dialed 10xxx+1+7/10d KP+7/10d+ST'' KP+II+7d+ST
9522 operator assist 10xxx+0 KP+ST''' KP+II+7d+ST
9523 special toll 10xxx+0+7/10d KP+7/10d+ST''' KP+II+7d+ST
9524
9525============================================================
9526coin:
9527============================================================
9528 direct dialed 10xxx+1+7/10d KP+7/10d+ST KP+II+7d+ST
9529 operator assist 10xxx+0 KP+ST' KP+II+7d+ST
9530 special toll 10xxx+0+7/10d KP+7/10d+ST' KP+II+7d+ST
9531
9532=============================================================================
9533Intra-LATA calls
9534=============================================================================
9535noncoin:
9536=============================================================================
9537 direct dialed 10xxx+1+7/10d KP+7/10d+ST'' KP+II+7d+ST'
9538 operator assist 10xxx+0 KP+ST''' KP+II+7d+ST'
9539 special toll 10xxx+0+7/10d KP+7/10d+ST''' KP+II+7d+ST'
9540
9541=============================================================================
9542coin:
9543=============================================================================
9544 direct dialed 10xxx+1+7/10d KP+7/10d+ST KP+II+7d+ST'
9545 operator assist 10xxx+0 KP+ST' KP+II+7d+ST'
9546 special toll 10xxx+0+7/10d KP+7/10d+ST' KP+II+7d+ST'
9547=============================================================================
9548Note: ST=Start, ST'=STart prime, ST''=Start double prime, ST'''=STart triple
9549prime.
9550
9551 Once again, the above table appears somewhat intimidating in its complexity.
9552All these STs, ST primes, etc. Actually, the only purpose of the starts is to
9553distinguish to the TSPS machine exactly what type of call the customer is
9554placing and from what type of telefone he is calling. "Special toll" calls are
9555collect, credit card, and third-party billing type calls. Here is an example
9556of a complete dialing and outpulsing sequence for an operator service call:
9557
9558 Page 154
9559
9560
9561
9562
9563 The Official Phreaker's Manual
9564
9565from a coin fone, a customer dials 0+ (or 10xxx+) 303+979-9997. The central
9566office would seize a trunk to the operator service facility and outpulse:
9567KP+303+979-9997+ST'. This indicates to the operator service facility that the
9568call is a special toll call originating from a coin telephone. The OS facility
9569comes off-hook and the central office would then outpulse KP+00+232+9969+ST.
9570This is he ANI information, and the ST indicates that the call is inter-LATA
9571(if it were intra-LATA, the sequence would be terminated with ST' instead).
9572 Perhaps now I should explain screening. Certain telefones are "screened"
9573against placing certain types of calls. A screening code is a two digit
9574information carrier. For instance, 00 is "identified line" (no special
9575treatment), 01 is multiparty ONI (operator number identification), 02 is ANI
9576failure, 06 is hotel/motel, 07 is coinless (hospital/inmate fone), 08 is
9577inter-LATA restricted, 68 is hotel inter-LATA restricted, 78 is coinless
9578(hospital inmate) inter-LATA restricted, etc. A 98 is an AT&T Charge-A-Call
9579fone (those blue fuckers). More screening codes are allocated as they are
9580needed. Note that the original TSPS screening design only allowed for single
9581digit information digits. They were later found to be insufficient.
9582 I believe that the operator services have been adequately covered, so I will
9583now move on to other aspects of Equal Access.
9584
9585 =============
9586 Routing Codes
9587 =============
9588
9589 The TTC (terminating toll centre) and special routing codes will continue to
9590be used in inter-LATA networks. These 0xx and 1xx type codes, which sometimes
9591precede operator routing codes, will be assigned to various ICs on an
9592individual basis. When 0xx and 1xx codes serve as pseudo-central office code,
9593they will be coordinated such that it will avoid IC conflicts. The
9594Numbering/Dialing Planning Group of the Central Services Organization (sounds
9595like some sort of Communist governing body) will provide assistance where the
9596assignment of coordinated codes is necessary.
9597
9598 ==================
9599 Special Area Codes
9600 ==================
9601
9602 Special area codes, also called Service Area Codes (SACs) presented the
9603designers of Equal Access with an interesting problem. SACs are N00 type area
9604codes, such as 700, 800, and 900. They are used for special services and
9605unlike normal area codes, are not associated with a particular state or region.
9606Each long distance carrier will be allocated its own exchanges in each service
9607area code. Thus, when a customer places a call to a number in a service area
9608code, the central office will examine the exchange of the telefone number and
9609route the call over the proper carrier's facilities. The customer will be
9610totally oblivious to this process. Current SACs include 700 (teleconferencing),
9611800 (toll free services), and 900 (dial-it services). There are currently
9612plans under way to implement the 600 area code, although its exact uses are not
9613yet clear.
9614
9615 ================
9616 Signalling to IC
9617 ================
9618
9619 Each long distance carrier that wishes to serve a particular LATA must
9620establish a point of presence (POP) in that LATA. A carrier's POP is a toll
9621office that receives toll traffic destined for another LATA. A POP is a centre
9622for inter-LATA transport of toll traffic. This traffic will be directed to it
9623
9624 Page 155
9625
9626
9627
9628
9629 The Official Phreaker's Manual
9630
9631from a Bell central office, either an end office or an access tandem (AT). An
9632access tandem is simply a Bell office which directs long distance traffic from
9633a number of local end offices to a number of different inter-LATA carriers. To
9634pass call details (such as called and calling numbers) from the Bell local
9635office to the inter-LATA carrier, a signalling system was designed that employs
9636current multifrequency (MF) signalling protocol. When a customer dials
963710xxx+(1/0)+(NPA)+NXX+, the end office will seize a trunk to the appropriate IC
9638as determined by the 10xxx CAC (or primary carrier if no CAC is dialed). Note:
9639this happens as soon as the customer finishes dialing the exchange, even though
9640he may still be dialing the last four digits of he telefone number. After the
9641the signal to proceed. Then, the end office will send ANI information, in the
9642format of: KP+II+10 digit ANI+ST. If the carrier is not to receive ANI
9643information from the Bell Operating Company (i.e., they are not paying for it),
9644then only KP+ST is sent. Presumably, by now the customer has completed dialing
9645the last four digits of the destination telefone number, so the end office will
9646send: KP+7 or 10 digit CALLED number+ST. Note several things here: 1) The IC
9647does not send a wink when it is ready to receive CALLED number information. 2)
9648ANI information is ten digits, plus a two-digit screening code, and 3) The
9649central office's outpulsing to the IC overlaps the customer's dialing.
9650 Some ANI screening codes include: 00 (identified POTS), 01 (ONI multiparty),
965102 (ANI failure), 06 (hotel without room identification), 07 (coinless,
9652hospital, inmate, etc.), 08 (inter-LATA restriction), 10 (test call), 20 (AIOD
9653calls, listed DN sent), 27 (coin call), and 95 (test call). These are the same
9654or similar as the screening codes used in operator service signalling.
9655 In addition to the domestic signalling design outlined above, a new
9656international signalling system has been designed for use with Equal Access.
9657It also uses two-stage, overlapping outpulsing. After a customer has completed
9658dialing (10xxx)+011+CC (CC is country code), the Bell end office will seize a
9659trunk to he appropriate IC (or international carrier, if direct routing is
9660available). The IC/INC will respond with a wink, and the end office will
9661outpulse: KP+1NX+YXX+CCC+ST. Each of these three groups of routing information
9662indicate something different abut the international call being placed. The 1NX
9663is the "international system routing code, one for each type of call routing."
9664I have absolutely no idea what that means, and no one I have talked to at Bell,
9665AT&T, MCI, CCITT, ITT, the CSO and FCC have any idea either. Next, the YXX is
9666the carrier routing code. It is actually XXX, Which is the three digits of the
966710xxx CAC for the particular carrier being accessed. Finally, CCC is the
9668country code, padded with a zero if necessary.
9669 One may wonder why the CAC is signalled forward when a trunk is seized
9670directly to the carrier itself. The reason for this is that in some cases a
9671direct trunk to the carrier is not available and the call must be routed
9672through an access tandem, which is responsible for routing calls to a variety
9673of different long distance carriers.
9674
9675 ====================
9676 Switch Compatibility
9677 ====================
9678
9679 Full-feature Equal Access will become available first for Western Electric
9680#1ESS switching systems. It will be available first in generic 1E8 (1AE8 for
9681#1A ESS). Later, generic 5E2 for #5ESS, generic 2B4 for #2B ESS, generic
9682BCS-16 for Northern Telecom DMS-100, and generics 209 and 302 for DMS-10 will
9683provide full-feature Equal Access capabilities in those types of end office
9684switching equipment. The Western Electric #4ESS, #1 and 1A ESS, #5ESS, and the
9685Northern Telecom DMS-200 machines which serve as toll offices or access tandems
9686will be capable of receiving the new Equal Access signalling format, after
9687required generic development. Other switches (such as all crossbar offices)
9688
9689 Page 156
9690
9691
9692
9693
9694 The Official Phreaker's Manual
9695
9696will not be able to handle the new signalling format.
9697
9698 =====
9699 LATAs
9700 =====
9701
9702 LATAs, Local Access and Transport Areas, are the entire key to the
9703administration of Equal Access. They can be thought of as miniature area
9704codes. A telefone call can never cross a LATA boundary except on an inter-LATA
9705carrier. However, there are certain exceptions to this. For example, in the
9706state of Colorado, which consists of two LATAs, the local Bell Operating
9707Company (Mountain Bell), which serves as the intra-LATA (i.e., calls to/from
9708the same LATA) carrier, may also serve as inter-LATA (to/from different LATAs)
9709carrier within Colorado.
9710 There are also exceptions in the corridor region of the New York/New
9711Jersey/Pennsylvania area.
9712 The forty-eight continental United States consist of 161 LATAs. Some states,
9713such as Deleware, consist of only one LATA, while others, such as Illinois, can
9714have up to 14 or more. Each LATA is given a name. For instance, Pennsylvania
9715consists of six LATAs: Philadelphia, Capital, Northeast, Altoona, Pittsburgh,
9716and Erie (independent telco).
9717
9718 ==============
9719 A Few Thoughts
9720 ==============
9721
9722 In 1973, Chrysler, A&P, RCA, Phillips Petroleum, S.S. Kresge, Boeing
9723Aircraft, International Harvester, Woolworth's, Greyhound, Firestone, Litton,
9724and General Foods, among others, each reported annual profits of less than $150
9725million. In that same year, the Telephone Company wrote off, as being
9726uncollectable, debts of $150 million.
9727 In 1974, the Bell System had direct interests in at least 276 organizations,
9728many of them not related to the telefone industry. Bell also had interlocking
9729financial arrangements with such corporations as the Chase Manhattan Bank, IBM,
9730Prudential Insurance, Sears Roebuck, General Motors, U.S. Steel, and Lever
9731Brothers. Should the need have arisen, the Bell System in 1974 could have
9732exercised control of 400 billion dollars, fully one-third of that year's gross
9733national product.
9734
9735From: Hyde, J. Edward, The Phone Book. Henry Regnery Publishing Company,
9736Chicago Illinois, 1976. ISBN 0-8092-8008-6.
9737
9738 There are many viewpoints as to the future course of the telefone industry.
9739The general consensus among most Telco employees is that the children of AT&T
9740(i.e., the seven regional holding companies into which the Bell System was
9741divided) will someday be reassembled into the original Bell System, and all
9742will be well and good in the world of telecommunications again. I tend to
9743disagree with this. I think that within three decades the entire telefone
9744industry will be consolidated and nationalized. It will be owned and operated
9745entirely by the United States Federal Government. This will accomplish several
9746goals of the government. First, the immense revenue from telefone services
9747will provide great financial resources for the federal government. Rates for
9748telefone services will skyrocket far out of the range of affordability, quality
9749of service will deteriorate to a point of unusability, and meanwhile
9750politicians will get rich.
9751 Second, once the government controls the telefone system, monitoring the
9752general public will become infinitely easier. Big Brother will be able to keep
9753and eye, or rather, an ear on the general population, and giant step forward in
9754
9755 Page 157
9756
9757
9758
9759
9760 The Official Phreaker's Manual
9761
9762ultimate government control of peoples' lives will be achieved. Most people
9763won't know anything about this, and even if they do, they won't give a shit
9764because by then the fucking government will have already invaded every
9765remaining private aspect of the individual's life.
9766 To those who find it utterly unthinkable that the federal government would
9767ever assume control of the telefone industry, I would call attention to the
9768situation that existed between 1917 and 1919. During this time the government
9769controlled the phone system of the United States. J. Edward Hyde sums it up
9770beautifully:
9771
9772 Between 1917 and 1919, the Federal Government did control the phone
9773industry. Since then, the most charitable historians have blamed the
9774subsequent mess on the First World War. Others blame it on the democrats. But
9775the fact is that it was a fiasco of the bureaucracy's own making, combined with
9776intracompany sabotage.
9777 Today, in those countries where the phone service is nationally owned, the
9778service runs from poor to nonexistent. Would you want the government that gave
9779you the Russian wheat deals, Defense Department overruns, Amtrak, and the
9780Postal Service handling your phone problems?
9781
9782From: Hyde, J. Edward, The Phone Book. Henry Regnery Publishing Company,
9783Chicago, Illinois, 1976. ISBN 0-8092-8008-6, p. 170.
9784
9785Technical References:
9786
9787Notes on the BOC intra-LATA Networks. American Telephone & Telegraph Company,
97881983.
9789
9790The Phone Book. J. Edward Hyde, 1976.
9791
9792Bell System Technical Journal. Volume 58, Number 5.
9793
9794Engineering and Operations in the Bell System. American Telephone & Telegraph
9795Company, 1983.
9796
9797
9798Acknowledgements: Karl Marx, Telenet Bob, and the scores of Telco employees
9799in Denver, White Plains, Omaha, and North Jersey who were very helpful in
9800patiently answering my many questions about Equal Access.
9801
9802Thanks to Mack the Knife for magnetic transfer of this illustrious file, a
9803tedious task for which I have no time.
9804
9805Thanks to the following printers for their cooperation and professional manner
9806in helping me with final production of this file:
9807
9808Kinko's Print Shop
98097155 West Colfax
9810Lakewood, CO
9811
9812Office Products and Printing
98135035 S. Kipling Suite B4
9814Littleton, CO
9815
9816This has been a Mark Tabas Encounter Series production. Questions, comments,
9817and requests may be addressed to:
9818
9819Tabas
9820
9821 Page 158
9822
9823
9824
9825
9826 The Official Phreaker's Manual
9827
9828P.O. Box 620401
9829Littleton, CO 80162
9830
9831Requests for copies of this or any other Encounter Series file are honored for
9832free, but please enclose a self-addressed medium sized first class mailing
9833envelope with 73 cents postage.
9834
9835Special thanks to Steve Reger, who was kind enough to shoot my neighbor's dog,
9836whose incessant barking constantly distracted me as I labored to complete this
9837file.
9838
9839(for Amy) cl/KIABB!/jd
9840
9841
9842
9843
9844
9845
9846
9847
9848
9849
9850
9851
9852
9853
9854
9855
9856
9857
9858
9859
9860
9861
9862
9863
9864
9865
9866
9867
9868
9869
9870
9871
9872
9873
9874
9875
9876
9877
9878
9879
9880
9881
9882
9883
9884
9885
9886
9887 Page 159
9888
9889
9890
9891
9892 The Official Phreaker's Manual
9893
9894 Equal Access and Modem Autodialers by Shadow 2600
9895
9896 Now that AT&T is being divested of its local telephone companies, phone
9897customers across the nation have to choose their long distance carrier as equal
9898access is phased in. Advertising campaigns emphasize such aspects as low rates
9899and operator assistance, but no one mentions a factor that will affect modem
9900users who use auto dialers for long distance calls. Not all of the alternate
9901long distance carriers provide called party answering supervision on all calls.
9902Called party answering supervision basically has the telephone company start
9903billing only when the called party answers the telephone. However, many of the
9904alternate long distance companies still operate with the "fixed timeout" basis
9905for charging. That is, if a call is held for a fixed length of time (usually
990630 seconds) the charging starts, whether or not the call was answered. This
9907could cause modem owners large bills if they use autodialers to make long
9908distance calls. Modems are usually set up to wait up to one minute when
9909attempting to make a call, and thus have to timeout through busy signals, long
9910call setup sequences, extender waits, and similar problems. This could result
9911in many billed but never answered calls.
9912
9913 Some of the other carriers provide it on calls to some cities, and others
9914not support it at all. Only AT&T Communications provides called party
9915answering supervision on all calls to all points at this time. It is almost
9916impossible to get information on how a long distance company charges its calls
9917as as they don't want to reveal how their billing is handled. The alternate
9918carriers get called party supervision when the destination location goes equal
9919access. However, there has been no quick action on the part of the alternate
9920long distance companies to make use of the supervision data as they would have
9921to get equipment for passing the information back to the billing computer at
9922the originating point. Thus called party answering supervision information
9923often ends up being ignored by these carriers even when available. Another
9924point to remember is that called party answering supervision's availability
9925depends on whether the destination has equal access, not the originating
9926location. The lower long distance rates of alternate long distance rates must
9927be weighed against the time out problem as it affects autodialing modems. One
9928way to circumvent this is merely to set your modem to a shorter
9929waiting-for-connect time, but this may not provide enough time for the call to
9930go through. [For more information on this and other telecommunications topics
9931call the Private Sector BBS at (201) 366- 4431]
9932
9933
9934
9935
9936
9937
9938
9939
9940
9941
9942
9943
9944
9945
9946
9947
9948
9949
9950
9951
9952
9953 Page 160
9954
9955
9956
9957
9958 The Official Phreaker's Manual
9959
9960==Phrack Inc.==
9961Volume One, Issue Two, Phile #6 of 9
9962
9963 Toward Universal Information Services Via ISDN
9964 DDDDDD DDDDDDDDD DDDDDDDDDDD DDDDDDDD DDD DDDD
9965 by Taran King
9966
9967 From PROTO newsletter of AT&T Bell Laboratories
9968 ------------------------------------------------------------
9969Phase one, the Present.
9970DDDDD DDDD DDD DDDDDDDD
9971 The local network of today, although still largely voice-oriented, is already
9972on the path to Universal Information Services. Lightguide fiber is
9973dramatically expanding the capacity of local networks, helping to lower the
9974costs and increase the demand for high-band width, Information Age services.
9975And public networks are increasingly digital and geared for data and special
9976 services. For example:
9977
9978o The AT&T Network Systems 5ESS (TM <riiiight>) switch, designed by Bell
9979Laboratories, can serve as the hub of a local deployment of remote modules at
9980locations up to 100 miles from a host central office.
9981
9982o The Integrated Special Services Network (ISSN) is a channel network that
9983provides special services, customer control options and digital private lines
9984rearrangeable under software control. The ISSN incorporates digital carrier
9985terminating equipment such as the D4 Channel Bank, D5 Digital Terminal System
9986and Digital Access and Cross-connect System (DACS).
9987
9988o The New Centrex is bringing greater levels of customer control, improved
9989services and a broad range of data capabilities to the business customer.
9990
9991 Today's public networks consist of multiple or overlay networks. The public
9992switched network, or circuit network, mainly for voice, is the base network.
9993Two kinds of overlay networks provide special services. Channel networks carry
9994private lines leased by large customers and transmit much of today's data and
9995image traffic; they also handle traffic for network operations support. Packet
9996networks carry data communications, while packet switching is used internally
9997to public networks for common channel signaling to set up, route and take down
9998calls, or to give customers information. "Overlay networks help
9999telecommunications companies efficiently meet growing demand for digital
10000transmission and special services," says Stan Johnston, Market Planning
10001Manager, Network Systems Evolution, in AT&T Network Systems. "Their integration
10002into a single network, however, would be still more effective."
10003
10004Phase two, the Integrated Services Digital Network (ISDN).
10005DDDDD DDDD DDD DDDDDDDDDD DDDDDDDD DDDDDDD DDDDDDD DDDDDDD
10006
10007 The ISDN is a concept to which AT&T is committed - and it's the foundation
10008for Universal Information Services. The central idea of ISDN, as AT&T Network
10009Systems sees it, is to provide an individual user a link to the local central
10010into two 64,000-bit channels, which may carry voice or data or both, and one
1001116,000-bit channel for packetized signaling information or data transport.
10012Such a link provides convenient "integrated" network access by accommodating
10013voice, data and signaling over a single line.
10014 The ISDN will make it easier for a customer to get varied services from
10015public and private networks. More bandwidth for big customers will be
10016available through another ISDN access standard, the extended digital subscriber
10017
10018 Page 161
10019
10020
10021
10022
10023 The Official Phreaker's Manual
10024
10025line, which provides 1.5 billion bits per second as 24 channels of 64,000 bits
10026each.
10027 In 1986, new software from Bell Labs will enable the 5ESS switch to
10028accommodate ISDN-sized 144,000-bit channels that standardize and simplify
10029subscribers' use of local networks. AT&T is committed to future products that
10030will also be ISDN-compatible. Other vendors, too, some of whom already plan to
10031build premises, terminal, and other equipment to ISDN standards, will make ISDN
10032a cooperative effort.
10033 By providing integrated digital access to networks, ISDN will make important
10034progress toward the goal of Universal Information Services. But overlay
10035networks will continue to divvy up the transport job. And messages needing
10036less than 144,000 bits per second will not fill their allotted bandwidth,
10037leaving capacity under utilized.
10038
10039Phase three, Universal Information Services.
10040DDDDD DDDDDD DDDDDDDDD DDDDDDDDDDD DDDDDDDDD
10041 Rooted in the fertile ground of 5ESS switches, ISDN equipment and
10042technologies such as wideband packet transport, Universal Information Services
10043will bear fruit during the 1990s. From a single kind of network will hang
10044services as different as apples, oranges and pears. Just as network access was
10045integrated in ISDN, transport functions will increasingly be integrated by
10046powerful new network equipment evolved from equipment developed for the ISDN.
10047Where customers once got standard-sized ISDN channels, they'll get big
10048bandwidth for large jobs, little bandwidth for small jobs.
10049
10050
10051
10052
10053
10054
10055
10056
10057
10058
10059
10060
10061
10062
10063
10064
10065
10066
10067
10068
10069
10070
10071
10072
10073
10074
10075
10076
10077
10078
10079
10080
10081
10082
10083
10084 Page 162
10085
10086
10087
10088
10089 The Official Phreaker's Manual
10090
10091 TOWARD UNIVERSAL INFORMATION SERVICES VIA ISDN
10092
10093Phase one, the present. The local network of today, although still largely
10094voice oriented, is already on the path to Universal Information Services.
10095Lightguide fiber is dramatically expanding the capacity of local networks,
10096helping to lower the costs and increase the demand for high-bandwidth,
10097Information Age services. And public networks are increasingly digital and
10098geared for data and special services. For example:
10099
10100 * The AT&T Network Systems 5ESS switch, designed by Bell Laboratories, can
10101serve as the hub of a local digital network through deployment of remote
10102modules at locations up to 100 miles from a host central office.
10103
10104 * The Integrated Special Services Network (ISSN) is a channel networks that
10105provides special services, customer control options and digital private lines
10106rearrangeable under software control. The ISSN incorporates digital carrier
10107terminating equipment such as the D4 Channel Bank, D5 Digital Terminal System
10108and Digital Access and Cross-connect Systems (DACS).
10109
10110 * The New Centrex is bringing greater levels of customer control, improved
10111services and a broad range of data capabilities to the business customer.
10112
10113 Todays public networks consist of multiple or overlay networks. The public
10114switched network, or circuit network, is the base network. Two kinds of
10115overlay networks provide special services. Channel networks carry private
10116lines leased by large customers and transmit much of today's data and image
10117traffic; they also handle traffic for network operations support. Packet
10118networks carry data communications, while packet switching is used internal to
10119public networks for common channel signaling to set up, route and take down
10120calls, or to give customers information.
10121 "Overlay networks help telecommunications companies efficiently meet growing
10122demand for digital transmission and special services," says Stan Johnston,
10123Market Planning Manager, Network Systems Evolution, in AT&T Network Systems.
10124"Their integration into a signal network, however, would be still
10125more effective."
10126 Phase two, the Integrated Services Digital Network (ISDN). The ISDN is a
10127concept to which AT&T is commited--and it's the foundation for Universal
10128Information Services. The central idea of ISDN, as AT&T Network Systems sees
10129it, is to provide an individual user a link to the local central office of
10130generous bandwidth--a digital subscriber line that can carry 144,000 bits per
10131second. The bandwidth is subdivided into two 64,000-bit channels, which may
10132carry voice or data or both, and one 16,000-bit channel for packetized
10133signaling information or data transport. Such a link provides convenient
10134"integrated" network access by accommodating voice, data and signaling over a
10135single line.
10136 The ISDN will make it easier for a customer to get varied services from
10137public and private networks. More bandwidth for big customers will be
10138available through another ISDN access standard, the extended digital subscriber
10139line, which provides 1.5 million bit per second as 24 channels of 64,000 bits
10140each.
10141 In 1986, new software from Bell Labs will enable the 5ESS switch to
10142accommodate ISDN-sized 144,000-bit channels that standardize and simplify
10143subscribers' use of local networks. AT&T is committed to future products that
10144will also be ISDN-compatible. Other vendors, too, some of whom already plan to
10145build premises, terminal and other equipment to ISDN standards, will make ISDN
10146a cooperative effort.
10147 By providing integrated digital access to networks, ISDN will make
10148important progress toward the goal of Universal Information Services. But
10149
10150 Page 163
10151
10152
10153
10154
10155 The Official Phreaker's Manual
10156
10157overlay networks will continue to divvy up the transport job. And messages
10158needing less than 144,000 bits per second will not fill their allotted
10159bandwidth, leaving capacity underutilized.
10160 Phase three, Universal Information Services. Rooted in the fertile ground
10161of 5ESS switches, ISDN equipment and technologies such as wideband packet
10162transport, Universal Information Services will bear fruit during the 1990s.
10163>From a single kind of network will hang services as different as apples,
10164oranges and pears. Just as network access was integrated in ISDN, transport
10165functions will increasingly be integrated by powerful new equipment evolved
10166from equipment developed for the ISDN. Where customers once got standard-
10167sized ISDN channels, they'll get big bandwidth for large jobs, little bandwidth
10168for small jobs.
10169
10170*** retyped from PROTO, AT&T Bell Laboratories report to executives on new
10171technologies, without written permission from the editors. (heh, heh.)
10172
10173Subscriptions: $15.00 per year, published bi-monthly. Send check payable to
10174"Bell Laboratories PROTO," to PROTO Circulation Manager, Room 3E-230, 150 John
10175F. Kennedy Parkway, Short Hills, N.J. 07078.
10176
10177:LIQUID:CRYSTAL:
10178wisdom is safety
10179
10180
10181
10182
10183
10184
10185
10186
10187
10188
10189
10190
10191
10192
10193
10194
10195
10196
10197
10198
10199
10200
10201
10202
10203
10204
10205
10206
10207
10208
10209
10210
10211
10212
10213
10214
10215 Page 164
10216
10217
10218
10219
10220 The Official Phreaker's Manual
10221
10222==Phrack Inc.==
10223Volume One, Issue Two, Phile #7 of 9
10224
10225 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
10226 @ @
10227 @ _ _ _______ @
10228 @ | X/ | / _____/ @
10229 @ |_||_|etal / /hop @
10230 @ __________/ / @
10231 @ /___________/ @
10232 @ Headquarters of Phrack Newsletter @
10233 @ (314) 432-0756 @
10234 @ Proudly Presents @
10235 @ MCI Overview @
10236 @ Written on 11/16/85 @
10237 @ by @
10238 @ @
10239 @ Knight Lightning & Taran King @
10240 @ @
10241 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
10242
10243MCI Communications Corporation, headquartered in Washington, D.C., provides a
10244full range of domestic and international telecommunications services, including
10245voice and data, telex and cable, paging and mobile telephone, and time
10246sensitive message delivery.
10247
10248Since its founding in 1968, MCI has grown to more than $1.6 billion in annual
10249sales and serves more than 1.9 million business, residential and government
10250customers through its four major business units:
10251
10252MCI Telecommunications
10253
10254MCI Airsignal
10255
10256MCI International
10257
10258MCI Digital Information Services
10259
10260
10261MCI TELECOMMUNICATIONS
10262
10263 MCI Telecommunications provides domestic interstate long distance service
10264throughout all 50 states, plus Puerto Rico, the U.S. Virgin Islands, and major
10265calling areas of Canada. It is also authorized to provide varying degrees of
10266intrastate long distance service in some states.
10267
10268MCI also is the first long distance carrier other than AT&T to offer direct
10269dial service overseas. International telephone service is available to all
10270residential and commercial customers (with the exception of Private Line
10271customers). In October, 1984 the first international service agreements were
10272announced with the following countries: Argentina, Belgium, Brazil, East
10273Germany, Greece, United Arab Emirates, and the United Kingdom.
10274
10275Total capital investment in MCI's long distance network is approximately $2
10276billion. MCI's network, the second largest in the U.S., employs microwave
10277optical fiber, satellite and various digital transmission technologies.
10278
10279Subscribers - Domestic Long Distance (as of 10/84)
10280
10281 Page 165
10282
10283
10284
10285
10286 The Official Phreaker's Manual
10287
10288----------- ----------------------
10289Residential 1.4 million
10290Commercial .3 million
10291 Total 1.7 million
10292
10293Operations - (as of 10/84)
10294Network Miles...20,543 (microwave, optical fiber, satellite)
10295Circuits.......238,000
10296Employees........9,500 (full-time, approx.)
10297
10298MCI AIRSIGNAL
10299
10300MCI Airsignal provides personal message delivery and car telephone services.
10301MCI Message Service is offered in more than 50 metropolitan areas. In 1984,
10302service will commence in New York City, Baltimore-Washington, Los Angeles, and
10303Chicago. MCI car telephone service is offered in 20 markets.
10304
10305Personal Message Delivery Service
10306
10307ALPHANUMERIC MESSAGE SERVICE
10308
10309Displays up to 40-character message using letters and/or numbers. Memory and
10310recall ability. Alerts subscriber with a silent visual alert or a soft tone.
10311
10312DISPLAY MESSAGE SERVICE
10313
10314Displays up to 24-digit message (e.g., phone number, stock quotes, sales
10315figures, coded messages). Memory and recall capability. Alerts customer to
10316message with a silent visual alert or a soft tone.
10317
10318TONE MESSAGE SERVICE
10319
10320Notifies customer of a message with a soft tone.
10321
10322VOICE MESSAGE SERVICE
10323
10324Receives message in actual voice of caller.
10325
10326EXPRESS MESSAGE SERVICE
10327
10328Receives and stores messages. Instantly alerts subscriber via pager when a
10329message is received.
10330
10331Car Telephone Service
10332
10333Enables customers to place calls to or receive calls from anywhere in the
10334world, 24 hours a day, as they travel in their cars. With the advent of new
10335cellular technology, both the quality and the accessibility of car telephone
10336service will vastly improve.
10337
10338MCI has thus far obtained franchises to operate a new kind of mobile phone
10339service, cellular telephone, in Minneapolis and Pittsburgh, and has received
10340favorable decisions from FCC administration law judges authorizing service in
10341Los Angeles, Denver-Boulder, and Kansas City. MCI has applied for licenses to
10342provide cellular service in 81 metropolitan areas.
10343
10344MCI Airsignal Branch Sales Offices
10345
10346
10347 Page 166
10348
10349
10350
10351
10352 The Official Phreaker's Manual
10353
10354Personal Message Service/Conventional Mobile Phone Service
10355
10356Birmingham (205) 942-2924
10357Sacramento (916) 444-2350
10358Memphis (901) 682-9658
10359Cleveland (216) 464-7311
10360Dallas (214) 788-5111
10361Fresno (209) 486-7410
10362Las Vegas (702) 382-7461
10363Denver (303) 778-7878
10364Portland (503) 227-2556
10365Philadelphia (215) 677-9845
10366Atlanta (404) 252-2114
10367West Florida (813) 875-3404
10368Minneapolis (612) 544-8175
10369Kansas City (913) 648-8090
10370Miami (305) 491-0122
10371Pittsburgh (412) 343-1611
10372Houston (713) 464-2516
10373Bakersfield (805) 832-2346
10374
10375Cellular Telephone Offices
10376
10377 Minneapolis-St. Paul (612) 544-3312
10378 Los Angeles (714) 527-0385
10379 Elsewhere in California (800) 344-3455
10380 Headquarters - Washington, D.C. (202) 429-9660
10381
10382
10383MCI INTERNATIONAL
10384
10385MCI International provides private-line voice service to several overseas
10386countries, and data and message services, including telex, cablegram, leased
10387channel, and packet switching communications, to more than 200 overseas points.
10388MCI has moved into two new areas of service: International direct-dial
10389telephone service and international electronic mail and hard-copy delivery
10390services.
10391
10392International Record Services
10393
10394TELEX SERVICE (domestic and international) permits instantaneous, two-way,
10395written communications with other subscribers worldwide. Customers can send
10396messages at any time, even though the receiving terminal may be unattended. MCI
10397International offers access to its telex service from a variety of terminals
10398and networks; not only subscribers with telex terminals but also those with
10399communicating word processors, data terminals or computers that communicate
10400over telephone lines can take advantage of MCI International telex service. To
10401subscribers connected to its own telex network, MCI International offers World
10402Message Services--a package of communications offerings including telex,
10403cablegram and MCI Mail services. Various service enhancements are available to
10404save time, improve operating efficiency and simplify records keeping for telex
10405users.
10406
10407CABLEGRAM SERVICE, the traditional means of international written
10408communications, offers flexibility in delivery and economical rates for shorter
10409messages. Cablegrams can be delivered to virtually any overseas
10410point.Subscribers with telex terminals or various other types of equipment can
10411access and TELUS cablegram switch and take advantage of such service
10412
10413 Page 167
10414
10415
10416
10417
10418 The Official Phreaker's Manual
10419
10420enhancements as abbreviated addressing and departmental billing.
10421
10422LEASED
10423CHANNEL SERVICE provides an exclusive line between a U.S. firm and it's
10424overseas office for private communications 24 hours a day. Each MCI
10425International leased channel is tailored to meet the needs of a specific
10426customer for teleprinter, facsimile, voice and/or data traffic. For subscribers
10427with several offices requiring private communications with each other, MCI
10428International offers a versatile message-switching service. Voice/data leases
10429can be configured to meet a whole array of communicating needs; for example,
10430one channel might carry data traffic from a computer at night, voice
10431communications during office hours, and simultaneous teleprinter messages at
10432any time. Data channels can handle requirements for traffic at any speed from
104331200 bits per second to 1.544 megabits per second.
10434
10435IMPACS SERVICE uses packet-switching technology to provide international
10436communications service between data terminals and computers. Impacs offers
10437on-line, real-time connections and enables many types of incompatible systems
10438to communicate. Impacs service offers virtually error-free transmission
10439because of the error-detection and retransmission capability of the network.
10440
10441INSTALINK SERVICE allows businesses overseas to use regular telex equipment to
10442access remote computing systems and databases in the U.S. Subscribers can
10443retrieve data from a computer-based information service or use a computing
10444system connecting to a packet-switching network in the U.S.
10445
10446INTERNATIONAL
10447FACSIMILE SERVICE enables subscribers to send duplicates of original documents
10448overseas quickly and efficiently, even when neither the sender or the receiver
10449has facsimile transmission equipment, or when the sender and receiver have
10450incompatible equipment.
10451
10452DATEL SERVICE provides automatic or voice-coordinated data transmission at
10453speeds up to 2400 bits per second. Either digital or analog facsimile traffic
10454can be transmitted via Datel. Datel facilities are conditioned to ensure
10455high-quality transmission. The MCI International switching center allows
10456communications between incompatible terminals.
10457
10458MARITIME SERVICES provide instant, high--quality contact between ships at sea
10459or offshore rigs, and between these vessels and land-based subscribers
10460worldwide.
10461
10462International Voice Services
10463
10464PRIVATE
10465LINE SERVICE provides, fast, easy access to a single overseas location at an
10466economical monthly rate. This technically efficient system maximizes the use
10467of line capacity by recognizing idle time and assigning a speaker to a
10468transmission path only when the path is needed. Users can dial a four-digit
10469extension from a regular business phone to reach a key overseas location.
10470
10471International Mail Services
10472
10473WORLD
10474MESSAGE SERVICE subscribers can access the domestic electronic mail and
10475hard-copy delivery offerings of MCI Mail. In addition, MCI International is
10476developing fast, low-cost services that will deliver electronic messages and
10477high-quality printed documents worldwide.
10478
10479 Page 168
10480
10481
10482
10483
10484 The Official Phreaker's Manual
10485
10486
10487Customer Service
10488
10489THE CUSTOMER TROUBLE REPORTING ASSISTANCE CENTER at MCI International addresses
10490customer concerns such as equipment maintenance and service performance
10491questions. Customer service specialists, on duty 24 hours a day on business
10492days, answer questions and electronically route service requests to technicians
10493nationwide.
10494
10495MCI DIGITAL INFORMATION SERVICES CORP.
10496
10497MCI Digital Information Services, MCI's newest unit, provides high-speed,
10498low-cost, time-sensitive message delivery (MCI Mail), either electronically or
10499via hard copy.
10500
10501MCI Mail provides time-sensitive document delivery to anyone, anywhere vial
10502MCI's long-distance telephone network. MCI Mail can reach a recipient
10503instantly, in four hours or less, or overnight by noon the next day. Prices
10504are as much as 90 percent lower than comparable time-sensitive mail delivery
10505services. MCI Mail can be delivered electronically, terminal to terminal, or
10506laser printed on letterhead stationery with the customer's signature.
10507
10508MCI Mail customers can even order gifts and services direct through MCI Mail,
10509ranging from software and paper for personal computers to investment advisory
10510services to travel specials.
10511
10512There are no sign-up, monthly service charges or "connect time" charges for MCI
10513Mail. MCI Mail can be used by virtually any personal computer, word processor,
10514electronic typewriter, data terminal, telex, or other digital communications
10515device. The service is accessed by a local telephone call or 800 number.
10516
10517MCI Mail
10518
10519INSTANT delivery to an "electronic" mailbox.
10520
10521FOUR-HOUR paper delivery by courier to 17 major metropolitan areas regardless
10522of point of origin.
10523
10524OVERNIGHT paper delivery by courier by noon the next day in 20,000 continental
10525U.S. cities.
10526
10527MCI LETTER transmitted electronically to the MCI digital postal center nearest
10528its destination, then delivered locally by the U.S. Postal Service.
10529
10530TELEX DISPATCH enables MCI Mail subscribers to transmit messages to the more
10531than 1.6 million telex subscribers worldwide.
10532
10533VOLUME MAIL enables customers to send large mailings in a variety of letter
10534formats, at substantial savings in delivery time and expense.
10535
10536 ============================================================
10537 Look for more MCI Files coming to Metal Shop soon!
10538
10539 This has been a Knight Lightning Presentation
10540 ============================================================
10541
10542
10543
10544
10545 Page 169
10546
10547
10548
10549
10550 The Official Phreaker's Manual
10551
10552 Reference Tables
10553
10554 Just some notes that you will always try to find but can never!
10555
10556
10557
10558
10559
10560
10561
10562
10563
10564
10565
10566
10567
10568
10569
10570
10571
10572
10573
10574
10575
10576
10577
10578
10579
10580
10581
10582
10583
10584
10585
10586
10587
10588
10589
10590
10591
10592
10593
10594
10595
10596
10597
10598
10599
10600
10601
10602
10603
10604
10605
10606
10607
10608
10609
10610
10611 Page 170
10612
10613
10614
10615
10616 The Official Phreaker's Manual
10617
10618==Phrack Inc.==
10619Volume One, Issue One, Phile #5 of 8
10620
10621 Using MCI Calling Cards
10622 by
10623 Knight Lightning
10624 of the
10625 2600 Club!
10626
10627How to dial international calls on MCI:
10628
10629 "Its easy to use MCI for international calling."
10630
106311. Dial your MCI access number and authorization code (code = 14 digit number,
10632however the first 10 digits are the card holders NPA+PRE+SUFF).
10633
106342. Dial 011
10635
106363. Dial the country code
10637
106384. Dial the city code and the PRE+SUFF that you want.
10639
10640Countries served by MCI:
10641
10642Country code|Country code
10643-------------------------------------|--------------------------------
10644Algeria..........................213 |New Zealand..................064
10645Argentina........................054 |Northern Ireland.............044
10646Australia........................061 |Oman.........................968
10647Belgium..........................032 |Papua New Guinea.............675
10648Brazil...........................055 |Qatar........................974
10649Canada................Use Area Codes |Saudi Arabia.................966
10650Cyprus...........................357 |Scotland.....................044
10651Denmark..........................045 |Senegal......................221
10652Egypt............................020 |South Africa.................027
10653England..........................044 |Sri Lanka....................094
10654German Democratic Republic |Sweden.......................046
10655(East Germany)...................037 |Taiwan.......................886
10656Greece...........................030 |Tanzania.....................255
10657Jordan...........................962 |Tunisa.......................216
10658Kenya............................254 |United Arab Emirates.........971
10659Kuwait...........................965 |Wales........................044
10660Malawi...........................265 |
10661======================================================================
10662
10663Thats 33 countries in all. To get the extender for these calls dial 950-1022 or
106641-800-624-1022.
10665
10666For local calling:
10667
106681. Dial 950-10222 or 1-800-624-1022
10669
106702. Wait for tone
10671
106723. Dial "0", the area code, the phone number, and the 14 digit authorization
10673code. You will hear 2 more tones that let you know you are connected.
10674
10675 - Knight Lightning --> The 2600 Club!
10676
10677 Page 171
10678
10679
10680
10681
10682 The Official Phreaker's Manual
10683
10684=====================================================================
10685
10686
10687
10688
10689
10690
10691
10692
10693
10694
10695
10696
10697
10698
10699
10700
10701
10702
10703
10704
10705
10706
10707
10708
10709
10710
10711
10712
10713
10714
10715
10716
10717
10718
10719
10720
10721
10722
10723
10724
10725
10726
10727
10728
10729
10730
10731
10732
10733
10734
10735
10736
10737
10738
10739
10740
10741
10742
10743 Page 172
10744
10745
10746
10747
10748 The Official Phreaker's Manual
10749
10750 AT&T INTERNATIONAL DIALING COUNTRY CODES AS OF 2-17-85
10751
10752 FILE BY: Lock Lifter
10753 +=========================+
10754
10755*UNITED KINGDOM/IRELAND
10756------------------------------------
10757IRELAND.........................353
10758UNITED KINGDOM...................44
10759
10760*EUROPE
10761------------------------------------
10762ANDORRA..........................33
10763AUSTRIA..........................43
10764BELGIUM..........................32
10765CYPRUS..........................357
10766CZECHOLSLOVAKIA..................42
10767DENMARK..........................45
10768FINLAND.........................358
10769FRANCE...........................33
10770GERMAN DEMOCRATIC REPUBLIC.......37
10771GERMANY, FEDERAL REPUBLIC OF.....49
10772GIBRALTAR.......................350
10773GREECE...........................30
10774HUNGARY..........................36
10775ICELAND.........................354
10776ITALY............................39
10777LIECHTENSTEIN....................41
10778LUXEMBOURG......................352
10779MONACO...........................33
10780NETHERLANDS......................31
10781NORWAY...........................47
10782POLAND...........................48
10783PORTUGAL........................351
10784ROMANIA..........................40
10785SAN MARINO.......................39
10786SPAIN............................34
10787SWEDEN...........................46
10788SWITZERLAND......................41
10789TURKEY...........................90
10790VATICAN CITY.....................39
10791YUGOSLAVIA.......................38
10792
10793*CENTRAL AMERICA
10794------------------------------------
10795BELIZE..........................501
10796COSTA RICA......................506
10797EL SALVADOR.....................503
10798GUATEMALA.......................502
10799HONDURAS........................504
10800NICARAGUA.......................505
10801PANAMA..........................507
10802
10803*AFRICA
10804------------------------------------
10805ALGERIA.........................213
10806CAMEROON........................237
10807EGYPT............................20
10808
10809 Page 173
10810
10811
10812
10813
10814 The Official Phreaker's Manual
10815
10816ETHIOPIA........................251
10817GABON...........................241
10818IVORY COAST.....................225
10819KENYA...........................254
10820LESOTHO.........................266
10821LIBERIA.........................231
10822LIBYA...........................218
10823MALAWI..........................265
10824MOROCCO.........................212
10825NAMIBIA.........................264
10826NIGERIA.........................234
10827SENEGAL.........................221
10828SOUTH AFRICA.....................27
10829SWAZILAND.......................268
10830TANZANIA........................255
10831TUNISIA.........................216
10832UGANDA..........................256
10833ZAMBIA..........................260
10834ZIMBABWE........................263
10835
10836*PACIFIC
10837------------------------------------
10838AMERICAN SAMOA..................684
10839AUSTRAILIA.......................61
10840BRUNEI..........................673
10841FIJI............................679
10842FRENCH POLYNESIA................689
10843GUAM............................671
10844HONG KONG.......................852
10845INDONESIA........................62
10846JAPAN............................81
10847KOREA, REPUBLIC OF...............82
10848MALAYSIA.........................60
10849NEW CALEDONIA...................687
10850NEW ZEALAND......................64
10851PAPUA NEW GUINEA................675
10852PHILIPPINES......................63
10853SAIPAN..........................670
10854SINGAPORE........................65
10855TAIWAN..........................886
10856THAILAND.........................66
10857
10858*INDIAN OCEAN
10859------------------------------------
10860PAKISTAN.........................92
10861SRI LANKA........................94
10862
10863*SOUTH AMERICA
10864------------------------------------
10865ARGENTINA........................54
10866BOLIVIA.........................591
10867BRAZIL...........................55
10868CHILE............................56
10869COLOMBIA.........................57
10870ECUADOR.........................593
10871GUYANA..........................592
10872PARAGUAY........................595
10873PERU.............................51
10874
10875 Page 174
10876
10877
10878
10879
10880 The Official Phreaker's Manual
10881
10882SURINAME........................597
10883URUGUAY.........................598
10884VENEZUELA........................58
10885
10886*NEAR EAST
10887------------------------------------
10888BAHRAIN.........................973
10889IRAN.............................98
10890IRAQ............................964
10891ISRAEL..........................972
10892JORDAN..........................962
10893KUWAIT..........................965
10894OMAN............................968
10895QATAR...........................974
10896SAUDI ARABIA....................966
10897UNITED ARAB EMIRATES............971
10898YEMEN ARAB REPUBLIC.............967
10899
10900*CARIBBEAN/ATLANTIC
10901------------------------------------
10902FRENCH ANTILLES.................596
10903GUANTANAMO BAY (US NAVY BASE)....53
10904HAITI...........................509
10905NETHERLANDS ANTILLES............599
10906ST. PIERRE AND MIQUELON.........508
10907
10908*INDIA
10909------------------------------------
10910INDIA............................91
10911
10912*CANADA
10913------------------------------------
10914TO CALL CANADA, DIAL 1 + AREA CODE +
10915LOCAL NUMBER.
10916
10917*MEXICO
10918------------------------------------
10919TO CALL MEXICO, DIAL 011 + 52 + CITY CODE+ LOCAL NUMBER.
10920
10921***NOTES :DO NOT FORGET ABOUT THE TIME DIFFERENCE WHEN CALLING OUTSIDE OF YOUR
10922TIME ZONE. CALLING CARDS CAN BE USED OVER SEAS TO CALL BACK INTO THE U.S. FOR
10923FURTHER INFORMATION CALL TOLL-FREE 1-800-874-0000. DIAL '#' AFTER THE COMPLETE
10924NUMBER TO MAKE THE CALL GO THROUGH FASTER.
10925
10926
10927
10928
10929
10930
10931
10932
10933
10934
10935
10936
10937
10938
10939
10940
10941 Page 175
10942
10943
10944
10945
10946 The Official Phreaker's Manual
10947
10948 **************************************
10949 * *
10950 * International Dialing Codes *
10951 * Country + Routing *
10952 * *
10953 * (Typed by The Dagda Mor) *
10954 * (Edited by The Jammer) *
10955 * *
10956 **************************************
10957
10958To dial international calls:
10959
10960International Access Code + Country code + Routing code
10961
10962Example :
10963
10964To call Frankfurt, Germany, you would do the following:
10965
10966011 + 49 + 611 + (# wanted) + # sign(octothrope)
10967
10968The # sign at the end is to tell Bell that you are done entering in all the
10969needed info.
10970
10971Here is the list of Country Codes, listed next to the country, and the routing
10972codes listed next to the city.
10973
10974Andorra- 33 Argentina- 54
10975------- ---------
10976all points- 078 Buenos Aires- 1
10977
10978
10979Australia- 61 Austria- 43
10980--------- -------
10981Melbourne- 3 Innsbruck- 5222
10982Sydney- 2 Vienna- 222
10983
10984
10985Bahrain- 973 Belgium- 32
10986------- -------
10987no routing needed Antwerp- 31
10988 Brussels- 2
10989
10990
10991Belize- 501 Bolivia- 591
10992------ -------
10993no routing needed La Paz- 2
10994
10995
10996Brazil- 591 Chile- 56
10997------ -----
10998Brasilia-61 Santiago- 2
10999Rio de Janeiro- 21 Valparaiso- 31
11000Sao Paulo- 11
11001
11002
11003China- 86 Colombia- 56
11004----- --------
11005Tainan- 62 none needed
11006
11007 Page 176
11008
11009
11010
11011
11012 The Official Phreaker's Manual
11013
11014Taipei- 2
11015
11016
11017Costa Rica- 506 Cyprus- 357
11018----- ---- ------
11019no routing needed Nicosia- 21
11020
11021
11022Denmark- 45 Ecuador- 593
11023------- -------
11024Aalborg- 8 Cuenca- 4
11025Copenhagen 1 or 2 Quito- 2
11026
11027
11028El Salvador- 503 Fiji- 679
11029---------- ----
11030no routing needed none needed
11031
11032
11033France- 33 Germany- 49
11034------ -------
11035Bordeaux- 56 Berlin- 30
11036Marseille- 91 Bonn- 228
11037Nice- 93 Frankfurt- 661
11038Paris- 1 Munich- 89
11039
11040
11041German. Rep- 37 Greece- 30
11042------- --- ------
11043 Rhodes- 241
11044
11045
11046Guam- 671 Guatamala- 502
11047---- ---------
11048no routing needed Guatemala City- 2
11049
11050
11051Guyana- 592 Haiti- 509
11052------ -----
11053Georgetown- 02 Port Au Prince- 1
11054
11055
11056Hoduras- 504 Hong Kong- 852
11057------- ---- ----
11058no routing needed Hong Kong- 5
11059 Kowloon- 3
11060
11061
11062Indonesia- 62 Iran- 98
11063--------- ----
11064Jakarta- 21 Teheran- 21
11065
11066
11067Iraq- 964 Ireland- 353
11068---- -------
11069Baghdad- 1 Dublin- 1
11070 Galway- 91
11071
11072 Page 177
11073
11074
11075
11076
11077 The Official Phreaker's Manual
11078
11079
11080
11081Israel- 978 Italy- 39
11082------ -----
11083Haifa- 4 Florence- 55
11084Jerusalem- 2 Naples- 81
11085Tel Aviv- 3 Rome- 6
11086 Venice- 41
11087
11088
11089Ivory Coast- 225 Japan- 81
11090----- ----- -----
11091no routing needed Hiroshima- 822
11092 Tokyo- 3
11093 Yokohama- 45
11094
11095
11096Kenya- 254 Korea- 82
11097----- -----
11098Nairobi- 2 Pusan- 51
11099 Seoul- 2
11100
11101
11102Kuwait- 965 Liberia- 231
11103------ -------
11104no routing needed none needed
11105
11106
11107Libya- 218 Lechtenstein- 4
11108----- ------------
11109Tripoli- 21 All points- 75
11110
11111
11112Luxembourg- 352 Malaysia- 60
11113---------- --------
11114no routing needed Kuala Lumpur- 3
11115
11116
11117Monaco- 33 Netherlands- 31
11118------ -----------
11119All points- 93 Amsterdam- 20
11120 Rotterdam- 10
11121 The Hague- 70
11122
11123
11124New Caledonia- 687 New Zealand- 64
11125--- --------- --- -------
11126no routing needed Auckland- 9
11127 Wellinton- 4
11128
11129
11130Nicaragua- 505 Nigeria- 234
11131--------- -------
11132Managua- 2 Lagos- 1
11133
11134
11135Norway- 47 Panama- 507
11136------ ------
11137
11138 Page 178
11139
11140
11141
11142
11143 The Official Phreaker's Manual
11144
11145Bergen- 5 none needed
11146Oslo- 2
11147
11148
11149Papua New Guinea-675 Paraguay- 595
11150----- --- ------ --------
11151no routing needed Asuncion- 21
11152
11153
11154Peru- 51 Phillippines- 63
11155---- ------------
11156Arequipa- 542 Manila- 2
11157Lima- 14
11158
11159Portugal- 351 Romania- 40
11160-------- -------
11161Lisbon- 19 Bucuresti- 0
11162
11163
11164San Marino- 39 Saudi Arabia- 966
11165--- ------ ----- ------
11166All points- 541 Riyadh- 1
11167
11168
11169Senegal- 221 South Africa- 27
11170------- ----- ------
11171no routing needed Cape Town- 21
11172 Pretoria- 12
11173
11174
11175Spain- 34 Sri Lanka- 94
11176----- --- -----
11177Barcelona- 3 Colombo- 1
11178Canary Is.- 28
11179Madrid- 1
11180Seville- 54
11181
11182
11183Suriname- 597 Sweden- 46
11184-------- ------
11185no routing needed Goteborg- 31
11186 Stockholm- 8
11187
11188
11189Switzerland- 41 Tahiti- 689
11190----------- ------
11191Berne- 31 none needed
11192Geneva- 22
11193Lucerne- 41
11194Zurich- 1
11195
11196
11197Thailand- 66 Tunisia- 216
11198-------- -------
11199Bangkok- 2 Tunis- 1
11200
11201
11202Turkey- 90 United Arab
11203
11204 Page 179
11205
11206
11207
11208
11209 The Official Phreaker's Manual
11210
11211------ Emirates- 971
11212Istanbul- 11 --------
11213 Abu Dhabi- 2
11214 Ajman- 6
11215 Al Ain- 3
11216 Aweir- 49
11217 Dubai- 4
11218 Fujairah- 91
11219 Jebel Dhana- 5
11220 Sharjah- 6
11221 Umm-Al-Quwain- 6
11222
11223
11224United Kingdom- 44 USSR- 7
11225------ ------- ----
11226Belfast- 232 Kiev- 044
11227Cardiff- 222 Leningrad- 812
11228Edinburgh- 31 Minsk- 017
11229Glasgow- 41 Moscow- 095
11230Liverpool- 51 Tallinn- 0142
11231London- 1
11232
11233Vatican City- 39 Venezuela- 58
11234------- ---- ---------
11235All points- 6 Caracas- 2
11236 Maracaibo- 61
11237
11238Yugoslavia- 38
11239----------
11240Belgrade- 11
11241Zagreb- 41
11242
11243
11244
11245
11246
11247
11248
11249
11250
11251
11252
11253
11254
11255
11256
11257
11258
11259
11260
11261
11262
11263
11264
11265
11266
11267
11268
11269
11270 Page 180
11271
11272
11273
11274
11275 The Official Phreaker's Manual
11276
11277 **************************************
11278 * *
11279 * MAX ACCESS PORTS *
11280 * *
11281 * (LEXITEL CORPORATION) *
11282 * *
11283 * WORD PROCESSED BY THE DAGDA MOR *
11284 * *
11285 **************************************
11286
11287ADRIAN,MI............313-263-0191 LIVONIA, MI..........313-261-6970
11288AKRON,OH.............216-275-9814 LOS ANGELES, CA......213-624-9041
11289ANN ARBOR, MI........313-451-2121 LOUISVILLE, KY.......502-568-6204
11290ATLANTA, GA..........404-525-1769 MARION, OH...........614-387-1011
11291AVON LAKE, OH........216-933-2823 MCKEESPORT, PA.......412-664-4870
11292BADEN, PA............412-869-1360 MENTOR, OH...........216-255-1645
11293BALTIMORE, MD........301-444-7280 MIDDLETOWN, OH.......513-423-1066
11294BEAVER FALLS, PA.....412-847-3640 MILWAUKEE, WI........414-933-1880
11295BIRMINGHAM, MI.......313-649-0730 MINNEAPOLIS, MN......612-375-0280
11296BOSTON, MA...........617-267-9134 MONESSEN, PA.........412-684-8710
11297BUFFALO, NY..........716-854-0802 MORTON GROVE,IL......312-950-1066
11298BUTLER, PA...........412-285-9081 NEWARK, NJ...........201-624-5040
11299CANTON, OH...........216-455-1425 NEWARK, OH...........614-349-8754
11300CHICAGO, IL..........312-950-1066 NEW CASTLE, PA.......412-656-9420
11301CHILLICOTHE, OH......614-772-1066 NEW YORK, NY.........212-950-1066
11302CINCINNATI, OH.......513-421-1880 OAK LAWN, IL.........312-950-1066
11303CLEVELAND, OH........216-771-6614 PHILADELPHIA, PA.....215-751-9711
11304COLUMBUS, OH.........614-950-1066 PITTSBURG, PA........412-391-9532
11305DALLAS, TX...........214-653-1047 PLYMOUTH, MI.........313-451-2121
11306DAYTON, OH...........513-223-0366 PONTIAC, MI..........313-332-0500
11307DETROIT, MI..........313-950-1066 PORT HURON, MI.......313-982-7115
11308ELK GROVE, IL........312-950-1066 PHOENIX, AZ..........602-242-0252
11309ELYRIA, OH...........419-323-4431 QUEENS, NY...........718-204-7330
11310FINDLAY, OH..........419-424-5934 SANDUSKY, OH.........419-625-1289
11311GLEENSHAW, PA........412-486-7394 SHARON, PA...........412-983-0100
11312GRAND RAPIDS, MI.....616-456-7925 SPRINGFIELD, OH......513-950-1066
11313GREENSBURG, PA.......412-836-8110 STEUBENVILLE, OH.....614-283-1756
11314HACKENSACK, NJ.......201-342-2815 ST. LOUIS, MO........314-289-9100
11315HOUSTON, TX..........713-224-0982 ST. PAUL, WI.........612-375-0280
11316INDIANA, PA..........412-349-8760 TOLEDO, OH...........419-255-1316
11317INDIANAPOLIS, IN.....317-638-4442 TROY, OH.............513-335-2303
11318KALAMAZOO, MI........616-342-0266 TURTLE CREEK, PA.....412-823-1500
11319KANSAS CITY, MO......816-474-6193 WASHINGTON, DC.......202-479-4411
11320KOKOMO, IN...........317-453-9932 WASHINGTON, PA.......412-225-1800
11321LA GRANGE, IL........312-950-1066 WARREN, MI...........313-268-9120
11322LANCASTER, OH........614-687-0159 XENIA, OH............513-376-2991
11323LANSING, MI..........517-950-1066 YOUNGSTOWN, OH.......216-746-2021
11324LAFAYETTE, IN........317-423-5492 ZANESVILLE, OH.......614-454-6815
11325
11326
11327
11328
11329
11330
11331
11332
11333
11334
11335
11336 Page 181
11337
11338
11339
11340
11341 The Official Phreaker's Manual
11342
11343 ******************** METROFONE ACCESS NUMBERS ********************
11344
11345ANAHEIM, CA (714)527-7055 LOS ANGELES, CA (213)992-8282
11346ATLANTA, GA (404)223-1000 LOS ANGELES, CA (213)202-6117
11347AUSTIN, TX (512)474-6057 MIAMI, FL (305)326-3300
11348BALTIMORE, MD (301)659-7700 MILWAUKEE, WI (414)277-1805
11349BEAUMONT, TX (713)833-9331 MINNEAPOLIS, MN (612)370-9000
11350BOSTON, MA (617)482-3222 NEW ORLEANS, LA (504)566-8500
11351BUFFALO, NY (716)852-9200 NEW YORK, NY (212)732-7430
11352CHICAGO, IL (312)853-4700 NEWARK, NJ (201)645-9220
11353CINCINNATI, OH (513)241-1747 OAKLAND, CA (415)836-6900
11354CLEVELAND, OH (216)861-5163 OKLAHOMA CITY, OK (405)232-9011
11355COLUMBUS, OH (614)224-0577 OMAHA, NE (402)422-1120
11356CULVER CITY, CA (213)410-0078 PHILADELPHIA, PA (215)351-0100
11357DALLAS, TX (214)742-4500 PITTSBURGH, PA (412)261-5720
11358DAYTON, OH (513)228-1576 RENO, NV (702)329-1025
11359DENVER, CO (303)623-5326 RICHMOND, VA (804)225-1920
11360DETROIT, MI (313)963-4847 ST. LOUIS, MO (314)342-1130
11361EL MONTE, CA (213)350-1028 SACRAMENTO, CA (916)443-6921
11362ELK GROVE, IL (312)981-8870 SAN ANTONIO, TX (512)224-9600
11363FT. LAUDERDALE, FL (305)462-3530 SAN DIEGO, CA (714)233-0327
11364FT. WORTH, TX (817)338-1639 SAN FRANCISCO, CA (415)956-0162
11365HACKENSACK, NJ (201)487-3155 SAN JOSE, CA (408)947-7606
11366HARTFORD, CT (203)522-0003 SAN MATEO, CA (415)579-6001
11367HAWTHORNE, NJ (201)427-1100 SANTA ANA, CA (714)972-9515
11368HINSDALE, IL (312)986-0566 SEATTLE, WA (206)382-0910
11369HOUSTON, TX (713)224-9417 SKOKIE, IL (312)679-8120
11370HUNTINGTON BEACH, CA (714)972-8515 SYRACUSE, NY (315)474-3911
11371INDIANAPOLIS, IN (317)635-6284 TOLEDO, OH (419)243-1046
11372KANSAS CITY, KS (913)621-3186 WASHINGTON, DC (202)737-2051
11373LONG ISLAND, NY (516)443-5402
11374LOS ANGELES, CA (213)629-1026
11375
11376
11377
11378
11379
11380
11381
11382
11383
11384
11385
11386
11387
11388
11389
11390
11391
11392
11393
11394
11395
11396
11397
11398
11399
11400
11401
11402 Page 182
11403
11404
11405
11406
11407 The Official Phreaker's Manual
11408
11409 Area Codes In Numerical Order, by The Jammer
11410______________________________________________________________________
11411
11412201 Newark New Jersey 519 London Ontario
11413202 Washington D.C (all) 601 Mississippi (all)
11414203 Connecticut (all) 602 Arizona (all)
11415205 Alabama (all) 603 New Hampshire (all)
11416206 Seattle Washington 605 South Dakota (all)
11417207 Maine (all) 606 Winchester Kentucky
11418208 Idaho (all) 607 Binghamton New York
11419212 Bronx Nyc, New York 608 Madison Wisconsin
11420212 Manhattan Nyc, New York 609 Trenton New Jersey
11421213 Los Angeles California 612 St. Paul Minnesota
11422214 Dallas Texas 613 Ottawa Ontario
11423215 Philadelphia Pennsylvania 614 Columbus Ohio
11424216 Cleveland Ohio 615 Nashville Tennessee
11425217 Springfield Illinois 616 Grand Rapids Michigan
11426218 Duluth Minnesota 617 Boston Massachusetts
11427219 Gary Indiana 618 Alton Illinois
11428301 Maryland (all) 619 San Diego California
11429303 Colorado (all) 700 Teleconference (all)
11430304 West Virginia (all) 701 North Dakota (all)
11431305 Miami Florida 702 Nevada (all)
11432305 Orlando Florida 703 Alexandria Virginia
11433307 Wyoming (all) 704 Charlotte North Carolina
11434308 Abott Nebraska 705 North Bay Ontario
11435309 Peoria Illinois 712 Councilbluffs Iowa
11436312 Chicago Illinois 713 Houston Texas
11437313 Detroit Michigan 714 Anaheim California
11438314 St. Louis Missouri 715 Bay City Wisconsin
11439315 Syracuse New York 716 Buffalo New York
11440316 Wichita Kansas 716 Rochester New York
11441317 Indinapolis Illinois 717 Harrisburg Pennsylvania
11442318 Lake charles Lousiana 800 Toll Free (all)
11443319 Davenport Iowa 801 Utah (all)
11444401 Rhode Island (all) 802 Vermont (all)
11445402 Omaha Nebraska 803 South Carolina (all)
11446404 Atlanta Georgia 804 Richmond Virgina
11447405 Oklahoma City Oklahoma 805 Bakersfield California
11448406 Montana (all) 806 Amarillo Texas
11449408 San Jose California 807 Thunder Bay Ontario
11450412 Pittsburg Pennsylvania 808 Hawaii (all)
11451413 Springfield Massachusetts 809 Bermuda (all)
11452414 Milwaukee Wisconsin 809 Bahamas (all)
11453415 San Francisco California 809 Puerto Rico (all)
11454416 Toronto Onterio 809 Virgin Islands (all)
11455417 Joplin Missouri 812 Evansville Indiana
11456418 Quebec Quebec 812 Dade park Kentucky
11457419 Toledo Ohio 814 Johnston Pennsylvania
11458501 Arkansas (all) 815 Rockford Illinois
11459502 Frankfort Kentucky 816 Independence Missouri
11460503 Oregon (all) 817 Fort Worth Texas
11461504 New Orleans Louisiana 818 Burbank California
11462504 Baton Rouge Louisiana 819 Trois Riv. Quebec
11463505 New Mexico (all) 900 Dial-it (all)
11464507 Rochester Minnesota 901 Memphis Tennessee
11465509 Pullman Washington 904 Talahassee Florida
11466512 Austin Texas 906 Escanaba Michigan
11467
11468 Page 183
11469
11470
11471
11472
11473 The Official Phreaker's Manual
11474
11475513 Cincinnati Ohio 907 Alaska (all)
11476514 Montreal Quebec 912 Savannah Georgia
11477515 Des Moines Iowa 913 Kansas City Kansas
11478516 Hempstead New York 915 El Paso Texas
11479517 Lansing Michigan 916 Sacramento California
11480518 Albany New York 918 Tulsa Oklahoma
11481 919 Raleigh North Carolina
11482
11483
11484
11485
11486
11487
11488
11489
11490
11491
11492
11493
11494
11495
11496
11497
11498
11499
11500
11501
11502
11503
11504
11505
11506
11507
11508
11509
11510
11511
11512
11513
11514
11515
11516
11517
11518
11519
11520
11521
11522
11523
11524
11525
11526
11527
11528
11529
11530
11531
11532
11533
11534 Page 184
11535
11536
11537
11538
11539 The Official Phreaker's Manual
11540
11541==Phrack Inc.==
11542Volume One, Issue Two, Phile #5 of 9
11543
11544Updated from November 26, 1985
11545Tac Dialups taken from Arpanet
11546by Phantom Phreaker
11547
11548 TAC DIALUPS SORTED BY LOCATION 26-NOV-85
11549
11550State/Country 300 Baud 1200 Baud 1200 Type
11551------------- --------------- ----------------- ---------
11552
11553 ALABAMA
11554 Anniston Army Depot [M]
11555 (ANNIS-MIL-TAC) (205) 235-6285 (R4) (205) 235-7650 B/V
11556 (205) 237-5731 (R8) (205) 237-5731 (R8) B/V
11557 (205) 237-5770 (R8) (205) 237-5779 (R8) B/V
11558 (205) 237-5805 (R8) (205) 237-5805 (R8) B/V
11559
11560 *Please note: When accessing the Anniston TAC you must first enter a
11561 <RETURN>, then enter DDN <RETURN>. After you receive CLASS DDN START,
11562 proceed as normal.
11563
11564 Gunter AFS [M]
11565
11566 (GUNTER-TAC) (205) 279-3576
11567 (205) 279-4682
11568
11569 Redstone Arsenal [M]
11570 (MICOM-TAC) [none known]
11571
11572 ARIZONA
11573 Ft. Huachuca [M]
11574 (HUAC-MIL-TAC) [none known]
11575
11576 Yuma [M]
11577 (YUMA-TAC) (602) 328-2186 (602) 328-2186 B/V
11578 (602) 328-2187 (602) 328-2187 B/V
11579 (602) 328-2188 (602) 328-2188 B/V
11580
11581 CALIFORNIA (NORTHERN)
11582 Alameda [M]
11583 (ALAMEDA-MIL-TAC) [none known]
11584
11585 Menlo Park [M]
11586 (SRI-MIL-TAC) (415) 327-5440 (R3) (415) 327-5440 (R3) B
11587
11588 (USGS3-TAC) [M] [no dialups]
11589
11590 Moffett Field [M]
11591 (AMES-TAC) [no dialups; contact NSC for access]
11592 William Jones - (415) 694-6482
11593 (FTS) 494-6482
11594 (AV) 359-6482
11595
11596 Monterey [M]
11597 (NPS-TAC) [none known]
11598
11599
11600 Page 185
11601
11602
11603
11604
11605 The Official Phreaker's Manual
11606
11607 Sacsamento [M]
11608 (MCCLELLAN1-MIL-TAC) [none known]
11609 (MCCLELLAN2-MIL-TAC) [none known]
11610
11611 Stanford [A]
11612 (SU-TAC) (415) 327-5220
11613
11614 CALIFORNIA (SOUTHERN)
11615 China Lake [M]
11616 (NWC-TAC) [none known]
11617
11618
11619 Edwards AFB [M]
11620 (EDWARD-MIL-TAC) [none known]
11621
11622 El Segundo [M]
11623 (AFSC-SD-TAC) (213) 643-9204 (213) 643-9204 B/V
11624
11625 Los Angeles [A]
11626 (USC-TAC) (213) 749-5436
11627
11628 Los Angeles [A]
11629 (USC-ARPA-TAC) [none known]
11630
11631 San Diego [M]
11632 (ACCAT-TAC) (619) 225-1641 (R4) (619) 225-6903 V
11633 (619) 225-6946 (R3)
11634 (619) 223-2148 V
11635 (619) 226-7884 (R2)
11636
11637 Santa Monica
11638 (RAND-ARPA-TAC) [A]
11639 (213) 393-9230
11640 (213) 393-9237
11641 (213) 393-9238
11642 (213) 393-9239
11643
11644 (RAND2-MIL-TAC) [M] [none known]
11645
11646 COLORADO
11647 Denver Fed Ctr [M]
11648 (USGS2-TAC) (303) 232-0206 (303) 232-0206 B/V
11649
11650 Lowry Air Force Base [M]
11651 (LOWRY-MIL-TAC) [none known]
11652
11653 D.C.
11654 Washington
11655 [Andrews AFB] [M]
11656 (AFSC-HQ-TAC) (301) 967-7930 (R16) (301) 967-7930 (R16) B
11657 (301) 736-2990 (R4) (301) 736-2990 (R4) B
11658 (301) 736-2998 (R2) (301) 736-2998 (R2) B
11659
11660 (PENTAGON-TAC) (202) 553-0229 (R14) (202) 553-0229 (R14) B
11661
11662 FLORIDA
11663 Eglin AFB [M]
11664 (AFSC-AD-TAC) (904) 882-8202 (904) 882-8202 B/V
11665
11666 Page 186
11667
11668
11669
11670
11671 The Official Phreaker's Manual
11672
11673 (904) 882-8201 (904) 882-8201 V
11674
11675 MacDill AFB [M]
11676 (MACDILL-MIL-TAC) [none known]
11677
11678 Naval Air Station - Jacksonville [M]
11679 (JAX1-MIL-TAC) [none known]
11680
11681 Naval Air Station - Orlando [M]
11682 (ORLANDO-MIL-TAC) [none known]
11683
11684 GEORGIA
11685 Robins AFB [M]
11686 (ROBINS-TAC) (912) 926-2725 (912) 926-2725 B/V
11687 (912) 926-2726
11688 (912) 926-3231
11689 (912) 926-3232
11690 (912) 926-2204 (912) 926-2204 B/V
11691 HAWAII
11692 Camp H.M. Smith [M]
11693 (HAWAII2-TAC) (808) 487-5545 (808) 487-5545 B
11694
11695 ILLINOIS
11696 Scott AFB [M]
11697 (SCOTT-TAC) [none known]
11698
11699 (SCOTT2-MIL-TAC) [none known]
11700
11701 KANSAS
11702 Ft. Leavenworth [M]
11703 (LVN-MIL-TAC) (913) 651-7041 (R8) (913) 651-7041 (R8) B
11704
11705 LOUISIANA
11706 Navy Regional Data Automation Center [M]
11707 (NORL-MIL-TAC) (504) 944-7940 (504) 944-7940 B
11708 (504) 944-7948 (R2) (504) 944-7948 (R2) B
11709 (504) 944-7951 (R5) (504) 944-7951 (R5) B
11710 (504) 944-8702 (R8) (504) 944-8702 (R8) B
11711
11712 MARYLAND
11713 Aberdeen Proving Ground [M]
11714 (BRL-TAC) (301) 278-6916 (R4) (301) 278-6916 (R4) B/V
11715
11716 Bethesda [M]
11717 (DAVID-TAC) (202) 227-3526 (R16) (202) 227-3526 (R16) B/V
11718
11719 Patuxent River [M]
11720 (PAX-RV-TAC) (301) 863-4815 (301) 863-4815 B/V
11721 (301) 863-4816 (301) 863-4816 B/V
11722 (301) 863-5750 (R6) (301) 863-5750 (R6) B/V
11723
11724 Silver Spring [M]
11725 (WHITEOAK-MIL-TAC) (301) 572-5960 (R10) (301) 572-5960 (R10) B
11726 (301) 572-5970 (R10) (301) 572-5970 (R10) B
11727
11728 MASSACHUSETTS
11729 Hanscom AFB [M]
11730 (AFGL-TAC) (617) 861-3000 (R8) (617) 861-3000 (R8) B
11731
11732 Page 187
11733
11734
11735
11736
11737 The Official Phreaker's Manual
11738
11739 (617) 861-4965 (R8) (617) 861-4965 (R8)
11740
11741 Cambridge
11742 (BBN-MIL-TAC) [M] [none known]
11743
11744 (BBN-ARPA-TAC) [A] [no dialup capability]
11745
11746 (CCA-ARP-TAC) [A] [none known]
11747
11748 (MIT-TAC) [A]
11749 (617) 491-5669 (617) 258-6224 V
11750 (617) 491-5708 (617) 258-6225 V
11751 (617) 491-5734 (617) 258-6227 V
11752 (617) 491-5819 (617) 258-6248 V
11753 (617) 491-5826
11754 (617) 491-5841
11755 (617) 491-5849
11756 (617) 491-6769
11757 (617) 491-6772
11758 (617) 491-6937
11759 (617) 258-6241
11760 (617) 258-6242
11761 (617) 258-6243
11762
11763 MICHIGAN
11764 U.S. Army Tank Automotive Command (TACOM) - Warren [M]
11765 (TACOM-TAC) [none known]
11766
11767 MISSOURI
11768 St. Louis [M]
11769 (STLA-TAC) [none known]
11770
11771 NEBRASKA
11772 Offutt AFB [M]
11773 (SAC1-MIL-TAC) [none known]
11774
11775 (SAC2-MIL-TAC) (402) 292-4638 (R10) (402) 292-4638 (R10) B
11776
11777 (SAC-ARPA-TAC) [A]
11778 (402) 294-2398 (402) 294-2398 B
11779 (402) 291-2018 (402) 291-2018 B
11780 (402) 292-7054 (402) 292-7054 B
11781
11782 NEW JERSEY
11783 Dover [M]
11784 (ARDC-TAC) (201) 724-6731 (201) 724-6731 B/V
11785 (201) 724-6732 (201) 724-6732 B/V
11786 (201) 724-6733 (201) 724-6733 B/V
11787 (201) 724-6734 (201) 724-6734 B/V
11788
11789 Fort Monmouth [M]
11790 (FTMONMOUTH1-MIL-TAC) (201) 544-2052 (201) 544-2052 B/V
11791 (201) 544-2062 (201) 544-2062 B/V
11792 (201) 544-2072 (201) 544-2072 B/V
11793 (201) 544-2396 (201) 544-2396 B/V
11794 (201) 544-2430 (201) 544-2430 B/V
11795
11796 (FTMONMOUTH2-MIL-TAC) (201) 544-4254 (R3) (201) 544-2430 B
11797
11798 Page 188
11799
11800
11801
11802
11803 The Official Phreaker's Manual
11804
11805 (201) 544-2636 B
11806 (201) 544-2638 B
11807 (201) 544-2777 B
11808
11809 NEW MEXICO
11810 Albuquerque [M]
11811 (AFWL-TAC) [none known]
11812
11813 White Sands [M]
11814 (WSMR-TAC) [no dialups; contact NSC for access]
11815 Claude (Skeet) Steffey - (505) 678-1271
11816 (FTS) 898-1271
11817 (AV) 258-1271
11818
11819 NEW YORK
11820 Griffiss AFB
11821 (RADC-ARPA-TAC) [A] [no dialup capability]
11822
11823 (RADC-TAC) [M]
11824 (315) 339-4913 (R5)
11825 (315) 337-2004 (315) 337-2004 B/V
11826 (315) 337-2005 (315) 337-2005 B/V
11827
11828 (315) 330-2294 (315) 330-2294 (FTS) 952 B/V
11829
11830 (315) 330-3587 (315) 330-3587 (FTS) 952 B/V
11831
11832 NORTH CAROLINA
11833 Ft. Bragg [A]
11834 (BRAGG-ARPA-TAC) (919) 396-1131 (R10) (919) 396-1426 (R5) B/V
11835 (919) 396-1491 (R8) B/V
11836 Ft. Bragg [M]
11837 (BRAGG-MIL-TAC) [none known]
11838
11839 OHIO
11840 Wright-Patterson AFB [M]
11841 (WPAFB-TAC) (513) 258-4218
11842 (513) 258-4219
11843 (513) 258-4987
11844 (513) 258-4988
11845 (513) 258-4989
11846 (513) 258-4990
11847
11848 (WPAFB2-MIL-TAC) (513) 257-2172 (R8) (513) 257-2172 (R8) B
11849 (513) 257-2690 (R8) (513) 257-2690 (R8) B
11850 (513) 257-3625 (R8) (513) 257-3625 (R8) B
11851
11852 OKLAHOMA
11853 Tinker AFB [M]
11854 (TINKER-MIL-TAC) [none known]
11855
11856
11857 PENNSYLVANIA
11858 New Cumberland Army Depot [M]
11859 (NCAD-MIL-TAC) [none known]
11860
11861 (NCAD2-MIL-TAC) [none known]
11862
11863
11864 Page 189
11865
11866
11867
11868
11869 The Official Phreaker's Manual
11870
11871 TEXAS
11872 Brooks AFB [M]
11873 (BROOKS-AFB-TAC) (512) 536-3081 (R6) (512) 536-3081 (R6) B/V
11874
11875 Richardson [A]
11876 (COLLINS-TAC) (214) 235-2131 (214) 235-2131 B
11877 (214) 235-2143 (214) 235-2143 B
11878 (214) 235-2178 (214) 235-2178 B
11879 (214) 235-2204 (214) 235-2204 B
11880 (214) 235-2251 (214) 235-2251 B
11881 (214) 235-2278 (214) 235-2278 B
11882
11883 UTAH
11884 Dugway Proving Ground [M]
11885 (DUGWAY-MIL-TAC) [none known]
11886
11887 Salt Lake City (University of Utah) [A]
11888 (UTAH-TAC) (801) 581-3486 (801) 581-3486 B/V
11889
11890 VIRGINIA
11891 Alexandria [M]
11892 (DARCOM-TAC) (202) 274-5300 (202) 274-5300 B
11893 (202) 274-5320 (R6) (202) 274-5320 (R6) B
11894
11895 Arlington
11896 (ARPA1-MIL-TAC) [M] [none known]
11897
11898 (ARPA2-MIL-TAC) [M] [none known]
11899
11900 (ARPA3-TAC) [A] [no dialup capability]
11901
11902 Dahlgren [M]
11903 (NSWC-TAC) (703) 663-2162 (R8) (703) 663-2162 (R8) B
11904
11905 Langley Air Force Base [M]
11906 (LANGLEY-MIL-TAC) [none known]
11907
11908 McLean [M]
11909 (DDN-PMO-MIL-TAC) [none known]
11910
11911
11912 (MITRE-TAC) [M]
11913 (703) 442-8020 (R15)
11914 (703) 893-0330 (R10) (703) 893-0330 (R10) B/V
11915
11916 Norfolk [M]
11917 (NORFOLK-MILTAC) (804) 423-0241 (R2) (804) 423-0241 (R2) B
11918 (804) 423-0247 (R2) (804) 423-0247 (R2) B
11919 (804) 423-0346 (R4) (804) 423-0346 (R4) B
11920 (804) 423-0480 (804) 423-0480 B
11921 (804) 423-0486 (R2) (804) 423-0486 (R2) B
11922 (804) 423-0489 (804) 423-0489 B
11923 (804) 423-0570 (804) 423-0570 B
11924 (804) 423-0572 (R2) (804) 423-0572 (R2) B
11925 (804) 423-0577 (R2) (804) 423-0577 (R2) B
11926 (804) 423-0651 (804) 423-0651 B
11927 (804) 423-0654 (R3) (804) 423-0654 (R3) B
11928 (804) 423-0841 (R2) (804) 423-0841 (R2) B
11929
11930 Page 190
11931
11932
11933
11934
11935 The Official Phreaker's Manual
11936
11937 (804) 423-0845 (804) 423-0845 B
11938 (804) 423-0849 (804) 423-0849 B
11939 (804) 423-0858 (804) 423-0858 B
11940 (804) 423-0950 (804) 423-0950 B
11941 (804) 423-0952 (804) 423-0952 B
11942 (804) 423-0955 (R3) (804) 423-0955 (R3) B
11943 (804) 423-0959 (804) 423-0959 B
11944
11945 Reston
11946 (DCEC-ARPA-TAC) [A] [no dialups available]
11947
11948 (DCEC-MIL-TAC) [M]
11949 (703) 437-2892 (R5) (703) 437-2928 B
11950 (703) 437-2925 (703) 437-2929 B
11951 (703) 437-2926
11952 (703) 437-2927
11953
11954 WASHINGTON
11955 Seattle [A]
11956 (WASHINGTON-TAC) [no dialup capability]
11957
11958 ENGLAND [M]
11959 (CROUGHTON-MIL-TAC) [none known]
11960
11961 GERMANY [M]
11962 (FRANKFURT-MIL-TAC)
11963 (M) 2311-5641 (R8) B
11964
11965 (RAMSTEIN2-MIL-TAC) [none known]
11966
11967 ITALY [M]
11968 (AGNANO-MIL-TAC)
11969
11970 JAPAN [M]
11971 (BUCKNER-MIL-TAC)
11972
11973 (ZAMA-MIL-TAC)
11974
11975 KOREA [M]
11976 (KOREA-TAC) (M) 264-4951 (R8) B
11977
11978 PHILIPPINES [M]
11979 (CLARK-MIL-TAC)
11980
11981 SPAIN [M]
11982 (MILNET-TJN-TAC) [none known]
11983
11984 (ROTA-MIL-TAC) [none known]
11985
11986 Notes:
11987
11988 1. "(R10)" following phone number indicates a rotary with 10 lines.
11989
11990 2. For alternate phone numbers, FTS=Federal Telephone System.
11991 3. (M)=Military DoD Telephone System.
11992
11993 4. [M] denotes a MILNET TAC and [A] denotes an ARPANET TAC.
11994
11995
11996 Page 191
11997
11998
11999
12000
12001 The Official Phreaker's Manual
12002
12003 5. "1200 Type" refers to the modem compatibility for 1200 baud only:
12004 B/V = Bell and Vadic
12005 B = Bell 212A only
12006 V = Vadic 3400 only
12007
12008 6. This list is contained in the file NETINFO:TAC-PHONES.LIST at
12009 SRI-NIC.
12010
12011
12012
12013
12014
12015
12016
12017
12018
12019
12020
12021
12022
12023
12024
12025
12026
12027
12028
12029
12030
12031
12032
12033
12034
12035
12036
12037
12038
12039
12040
12041
12042
12043
12044
12045
12046
12047
12048
12049
12050
12051
12052
12053
12054
12055
12056
12057
12058
12059
12060
12061
12062 Page 192
12063
12064
12065
12066
12067 The Official Phreaker's Manual
12068
12069 >>==========================<<
12070 >>==> TELCO TEST NUMBERS <==<<
12071 >>====> as of 5/16/85 <=====<<
12072 >>=> compiled and updated <=<<
12073 >>====> by Shadow 2600 <====<<
12074 >>==========================<<
12075
12076011-44-61-2468011 : US dial tone then "When this system changes, this is the
12077new dial tone you hear" (UK is changing dialtone)
12078
12079201-226-0709 : alternating tones, then "warble"
12080201-267-9922 : sweep tone
12081201-267-9966 : 600 ohm termination
12082201-232-9924 : (tone 1,2,5-beep, bleep; 9,#- 1200 baud static, beep, bleep;
120836-tone, higher tone, bleep)
12084201-232-9959 : tone 11 sec. silence, repeats...
12085201-233-9972 : multitude of clicks
12086201-233-9974 : busy 15 sec. then tone w/ clicks
12087201-241-9916 : hissing with clicks
12088201-328-9971 : 1000 hrtz tone
12089201-376-9907 : "is being checked for trouble. Please try again later"
12090201-464-9915 : low tone 15 sec, silence
12091201-464-9916 : low tone 2 sec, silence
12092201-464-9963 : buzz
12093201-464-9974 : busy 15 sec, low tone
12094201-543-9902 : "If you'd like to make a call, hang up and try it again."
12095201-543-9903 : "We're sorry, your call did not go through."
12096201-543-9904 : "the number you have dialed requires a .20 cents deposit."
12097201-655-9900 : "cannot be completed as dialed from the phone you are using"
12098201-769-0205 : People's Express Reservation system
12099203-771-4920 : telephone company employee newsline
12100207-866-4411 : 1000 hrtz tone
12101212-233-9980 : (tone 1,2,3,*-tone, higher tone, bloop; 5-tone, bloop; 9,#-
12102static,beep,bloop)
12103212-369-7003 : "you have reached 212-369-7003 in zone 3" (?)
12104212-799-5017 : ABC New York feed line
12105213-621-4141 : telephone employee newsline
12106213-935-1111 : sweep tone with echo at top of range (?)
12107215-489-0036 : tone, bloop (1,2,5-tone bloop, 3,6,9-tone, higher tone,tone)
12108215-489-0040 : "please check your instruction manual or call repair service for
12109assistance"
12110215-489-0042 : "if you like to make a call please hang up and try again"
12111215-489-0043 : "We're sorry, your call did not go through."
12112215-489-0044 : "The call you have made requires a 25 cent deposit"
12113215-489-0045 : "You must first dial a 1 when dialing this number."
12114215-489-0074 : LOUD tone, stops, repeats
12115215-489-0075 : 600 ohm termination (silence)
12116215-489-0078 : tone, silence
12117215-489-0080 : 600 ohm termination
12118215-489-0097 : tone, (lower pitched than -0078) silence (also at -0098)
12119215-489-0104 : 1000 hrtz tone
12120216-861-8300 : tone, then higher tone
12121301-256-9987 : 1000 hertz
12122301-546-7777 : "Due to Telephone Company facility trouble your call cannot be
12123completed at this time"
12124301-725-9904 : "deposit .20"
12125305-263-0000 : repeating bloop (keypress 2 : slow reorder w/ bloops, clicks)
12126305-994-9963 : pay fone instructions
12127
12128 Page 193
12129
12130
12131
12132
12133 The Official Phreaker's Manual
12134
12135305-994-9966 : "telephone you are calling from is not in service"
12136312-222-9948 : tone (keypress 1,2,3,6,7,*-tone, high tone, bleep,
121374-tone,bloop,9, #-static,beep,bloop)
12138312-222-9954 : "Test Center"
12139312-222-9990 : clicks, ticking like
12140312-222-9996 : LOUD tone, repeats
12141312-368-8000 : Illinois Bell Communicator (employee newsline)
12142312-592-0000 : tone (keypress 2222, then other digits, at re-order type * to
12143restart) (?)
12144313-223-7223 : telephone employee newsline
12145313-333-9981 : LOUD tone, silence
12146313-333-9989 : high tone (enter touchtones for a while, eventually get
12147"metallic" echo, then 5-high pitched tone, random re-orders)
12148313-333-9990 : beep, click repeats, with "winks"
12149313-333-9994 : tone bloop (keypress in 2-tone,bloop, 3-tone, higher tone,tone,
121509-static, beep,bloop)
12151313-333-9995 : 600 ohm termination (silence)
12152313-333-9996 : weird siren/sweep tone, multi-frequency
12153313-430-4300 : beep, beep, beep, then reorder
12154313-698-9998 : sweep tone
12155314-247-5511 : Southwestern Bell Telenews (employee newsline)
12156315-471-9934 : "deposit 5 cents for next five minutes"
12157408-255-0081 : (any two 2,4,8,0-tone)
12158408-294-6969 : beep, click, computer voice repeats number
12159408-395-1110 : (tone 2-bleep,glitch; 3-beep,higher beep;#then number-loud
12160tone,bleep)
12161408-738-8190 : (tone 1,3,6,7,*-tone, high tone, tone;2-beep,cluck;9,#-
12162static,tone,beep)
12163408-745-6060 : high pitched tone, low tone then repeats
12164408-994-0044 : tone end of loop
12165412-633-3333 : telephone company employee newsline
12166414-628-0001 : continuous tone
12167414-628-0002 : continuous tone (higher pitched, sounds like muted dial)
12168414-628-0004 : high pitched tone, bloop, silence
12169414-628-0006 : brief very high tone (also -0007) (multiple keypresses of
121702,5,8,0 tone repeats)
12171414-628-0010 : loud tone, stops, repeats...
12172414-628-0011 : loud tone, stops
12173414-628-0013 : 600 ohm termination (silence) (also -0017, two in an exchange?)
12174414-628-0014 : continuous tone (sounds like weird dial), eventually stops
12175414-628-0015 : LOUD tone, repeats
12176414-628-0028 : "Your call cannot be completed as dialed
12177414-678-3511 : Wisconsin Bell Newsline
12178414-781-0004 : high tone, silence (keypress 2,5-beep,bleep, 3,6-beep,longbeep,
12179bloop, 9-static,bloop)
12180415-284-1111 : one sweep, then silence
12181415-327-0046 : sweep tone
12182415-388-0037 : tone,bloop (keypress 2-tone,bloop, 3-tone,high tone,tone,
121839-static,beep,bloop)
12184415-472-0046 : sweep w/ glitch at top
12185415-545-8800 : Pacific Bell Newsline
12186415-467-0097 : fast DTMF tones, keypress to repeat
12187415-777-0020 : 1000 hrtz tone
12188415-777-0037 : tone, bloop (keypress 2-beep,bloop, 3,6-tone,higher tone,
121899-static,beep,bloop)
12190415-777-0046 : sweep tone with echo
12191415-777-0105 : tone,bloop (keypress 2-beep,bleep, 3,6-tone, higher tone,
12192tone,9-static,beep,bloop
12193
12194 Page 194
12195
12196
12197
12198
12199 The Official Phreaker's Manual
12200
12201415-826-0022 : tone, click, tone (sounds like a busy)
12202415-994-0710 : multitude of clicks
12203512-472-2181 : "if you would like to make a call, please hang up and try
12204again"
12205512-472-4263 : garbled recording (?)
12206512-472-9833 : "you must first dial a 1 or 0 before calling this number"
12207512-472-9936 : "please check your instructions or call your business office for
12208assistance"
12209512-472-9941 : "insert 25 cents"
12210516-222-3825 : LOUD tone
12211516-234-9914 : New York Telephone Newsline
12212518-471-2272 : New York Telephone Newsline
12213518-789-3299 : weird busy, multitude of clicks
12214609-267-9966 : busy with clicks in background
12215609-267-9967 : 600 ohm termination (silence)
12216609-267-9968 : 1000 hrtz tone
12217609-267-9971 : LOUD tone, stops, repeats
12218609-267-9972 : rings with clicks in background (also -9973 and -9974)
12219609-877-9924 : high tone (tone in 1,2,5-tone, bloop; 3,6,*-tone, higher tone,
12220bleep; #-static, beep, bleep)
12221609-877-9929 : 1000 hrz tone
12222617-553-9953 : tone end of loop
12223617-890-9900 : sweep tone
12224617-955-1111 : telephone company employee newsline
12225619-748-0002 : tone increases in pitch, silence, repeats in monotone
12226619-748-0003 : sweep, repeat, hangs up
12227702-789-6711 : Nevada Bell Newsline
12228713-354-0000 : touch tone in #, then new #, then 5 - listed, 9 - unlisted)
12229713-482-3199 : "We're sorry, all circuit are busy now."
12230713-652-5111 : touch tones echo back "metallic", something about "drivers
12231licence number" replys in a female recorded voice
12232717-255-5555 : Bell of Pennsylvania "Inside Line" (employee newsline)
12233718-429-9900 : "Please slide a valid credit card through the slot now"
12234800-221-5959 : tone (# makes it ring)
12235800-228-8466 : Sensaphone (tm) demo (time etc. (EST) (wait 7+ rings))
12236800-321-3048 : non-connecting loop with 800-321-3049
12237800-321-3052 : loop (don't know where other end is)
12238800-321-6366 : Centagram's Voice Memo System (extension 100 for demo)
12239800-323-6321 : tone, stops, bloop repeats
12240800-327-0000 : "Announcement three, Dallas" (changes sometimes)
12241800-344-4001 : non-connecting loop with 800-344-4002
12242800-524-0000 : "Announcement 1 Atlanta"
12243800-554-5924 : Cable News Network audio feed
12244800-824-8274 : "Enter your password service code"
12245802-955-1111 : telephone company newsline
12246808-533-4426 : Hawaiian Telephone Newsline
12247816-391-1122 : recorder (keypress 1-toggle on/off, 3-rewind, 4-stop, 7-play)
12248907-269-0955 : tone (sounds like extender, doesn't take touch tone (?))
12249914-232-9901 : "Daytona, New York DMS-100 verification"
12250914-268-9901 : "Congers DMS 100 Verification"
12251914-268-9903 : "your call cannot be completed as dialed"
12252914-268-9968 : (keypress 2-high tone, 3-high, higher tone, 6,0-click, 7- hangs
12253up, sometimes 0,#,*-harmony)
12254914-359-9901 : repeats the number dialed ("914-359-9901")
12255914-359-9960 : weird tone, stops, clicks, repeats
12256914-623-9968 : (keypress 2,5-beep glitch, 3,6-tone highertone)
12257916-480-8000 : Pacific Bell Newsline
12258
12259
12260 Page 195
12261
12262
12263
12264
12265 The Official Phreaker's Manual
12266
12267 WHAT A TSPS CONSOLE LOOKS LIKE
12268
12269--- NON/COIN ---- ------------- COIN ------------- --------- HOTEL ---------
12270
12271 ---- ---- ---- ---- ---- ---- ----- --- --- ----
12272!VFY ! !OVER! !SCRN! !INWD! !EMER! !STA ! ! 0+ ! !DIAL! !STA ! ! 0+ !
12273!DIAL! !POST! !TONE! !STA ! ! 0+ ! !DIAL! !QST ! ! ! ! ! ! !
12274 ---- ---- ---- ---- ---- ---- ---- ---- ---- ----
12275
12276----- OUTGOING TRUNKS ----- RING RELEASE
12277
12278 ---- ---- ---- ---- ---- ----- ---- ---- ---- ----
12279! DA ! !R&R ! !SWB ! !OGT ! !BACK! ! FWD ! !CALL! !T&C ! !NFY ! !CHG !
12280 ---- ---- ---- ---- ---- ----- ---- ---- ---- ! DUE!
12281 ----
12282 --- ---- ---- ---- ---- ---- ---- ---- ---- ----
12283!KEY ! !BACK! !FWD ! ! SR ! !MAKE! !MTCE! !POS ! !BACK! ! ! ! !
12284!CLG ! ! ! ! ! ! ! !BUSY! !TRFR! ---- ---- ---- ----
12285 ---- ---- ---- ---- ---- ----
12286
12287 ----------------- AMA -----------------
12288 ---- ---- ---- ---- ---- ----
12289STATION -----!PAID! !COL ! !SPL ! !SPL ! !AUTO! !DDD !
12290 ! ! ! ! !CLG ! !CLD ! !COL ! ! !
12291 ---- ---- ---- ---- ---- ----
12292
12293 ---- ---- ---- ---- ----
12294PERSON ----- !PAID! !COL ! !SPL ! !SPL ! ! NO !
12295 ! ! ! ! !CLG ! !CLD ! !AMA !
12296 ---- ---- ---- ---- ----
12297
12298 ---- ---- ----
12299 !CLG ! !CLG ! !CLG !
12300 ! ! ! ! ! !
12301 ---- ---- ----
12302
12303
12304
12305
12306
12307
12308
12309
12310
12311
12312
12313
12314
12315
12316
12317
12318
12319
12320
12321
12322
12323
12324
12325
12326 Page 196
12327
12328
12329
12330
12331 The Official Phreaker's Manual
12332
12333 Box Plans
12334
12335 Hmm... I wonder! This is still under construction (Ha Ha).
12336
12337
12338
12339
12340
12341
12342
12343
12344
12345
12346
12347
12348
12349
12350
12351
12352
12353
12354
12355
12356
12357
12358
12359
12360
12361
12362
12363
12364
12365
12366
12367
12368
12369
12370
12371
12372
12373
12374
12375
12376
12377
12378
12379
12380
12381
12382
12383
12384
12385
12386
12387
12388
12389
12390
12391
12392 Page 197
12393
12394
12395
12396
12397 The Official Phreaker's Manual
12398
12399 THE INFINITY TRANSMITTER
12400
12401 TYPED BY THE GHOST WIND
12402
12403 FROM THE BOOK BUILD YOUR OWN
12404 LASER, PHASER, ION RAY GUN & OTHER WORKING SPACE-AGE PROJECTS
12405 BY ROBERT IANNINI (TAB BOOKS INC)
12406
12407Description: Briefly, the Infinity Transmitter is a device which activates a
12408microphone via a phone call. It is plugged into the phone line, and when the
12409phone rings, it will immediately intercept the ring and broadcast into the
12410phone any sound that is in the room. This device was originally made by
12411Information Unlimited, and had a touch tone decoder to prevent all who did not
12412know the code from being able to use the phone in its normal way. This
12413version, however, will activate the microphone for anyone who calls while it is
12414in operation.
12415NOTE: It is illegal to use this device to try to bug someone. It is also
12416pretty stupid because they are fairly noticeable.
12417Parts List:
12418Pretend that uF means micro Farad, cap= capacitor
12419
12420Part # Description
12421---- - -----------
12422R1,4,8 3 390 k 1/4 watt resistor
12423R2 1 5.6 M 1/4 watt resistor
12424R3,5,6 3 6.8 k 1/4 watt resistor
12425R9,16 2 100 k 1/4 watt resistor
12426R10 1 2.2 k 1/4 watt resistor
12427R13,18 2 1 k 1/4 watt resistor
12428R14 1 470 ohm 1/4 watt resistor
12429R15 1 10 k 1/4 watt resistor
12430R17 1 1 M 1/4 watt resistor
12431C1 1 .05 uF/25 V disc cap
12432C2,3,5,6,7 5 1 uF 50 V electrolytic cap or tant
12433 (preferably non-polarized)
12434C4,11,12 3 .01 uF/50 V disc cap
12435C8,10 2 100 uF @ 25 V electrolytic cap
12436C9 1 5 uF @ 150 V electrolytic cap
12437C13 1 10 uF @ 25 V electrolytic cap
12438TM1 1 555 timer dip
12439A1 1 CA3018 amp array in can
12440Q1,2 2 PN2222 npn sil transistor
12441Q3 1 D4OD5 npn pwr tab transistor
12442D1,2 2 50 V 1 amp react. 1N4002
12443T1 1 1.5 k/500 matching transformer
12444M1 1 lar