|
BIOC Agent 003's course in basic telecommunication
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
BIOC AGENT 003'S COURSE IN [BASIC TELECOMMUNICATIONS] Part I
Revised 18-July-84 Word Processed by Tharrys Ridenow
[PREFACE]:
In this course, I plan to cover as much material as possible relating to
telecommunications. First in the syllabus are the Long-Distance (LD) Ser-
vices, which are the topic of Part I. In future issues, such subjects as the
network, colored boxes, telephone electronics, central office equipment, opera-
tors, special #'s, and much, much more will be covered.
[LONG-DISTANCE SERVICES]:
In an attempt to offer lower prices, alternatives to Bell have been set up.
Services such as SPRINT, Metrofone, ITT, MCI, Travelnet, and many others are
all familiar to us. These services are known as Specialized Common Carriers
(SCC's) or Other Common Carriers (OCC's). <Don't confuse this with Switching
Control Center, also known as SCC.>
The basis of all these services are that they on their own switching equip-
ment. First, we will look at those services which use a local dial-up. The
principle of these are:
1) You dial the local #,
2) When it picks up, you get a second dial tone, then enter a code.
3) You then enter the destination #, and voila!, you're connected! A free
call!
Next we will look at several of the services...
(Note: A/C and NPA are abbreviations for Area Code, pfx=prefix, sfx=suffix)
SPRINT:
Sprint, also known as SPC, was one of the first LD services. Many boards
contain SPC #'s, and I plan to include a list of them as an appendix to this
course so you can find your local #. (Another, more dangerous, way is by cal-
ling 1-800-521-4949, asking the nice lady at the other end of the line for your
local SPRINT access number, complaining that your autodialer had it but just
crashed.)
The codes for SPC are 8 digits long. SPC is not considered safe, since many
people have been busted on it! It is common knowledge that SPRINT has declared
war on phreaks. So, fight back (with care)!
Some dialups: 914-997-1616 415-777-1211 415-832-5016
Format: At tone---> 8 digit code+A/C+pfx+sufx
METROFONE:
Metrofone, run by Western Union, is very popular among phone phreaks due to
the large abundance of codes and it (at the time of this writing) is considered
fairly safe.
Recently (7/84), Metrofone has allegedly been placing "trap codes" on BBS's
which are being traced. I suggest that you hack your own for safety purposes.
The code is 6 digits long. To find out the local dial-up for your area, use
the procedure under SPRINT with 800-325-1403.
Format: At tone---> 6 digit code+A/C+pfx+sufx
ITT:
ITT is a little different in that upon hearing the dial tone after calling
the local access #, you enter the A/C and then the #. You will then hear a
short tone, then immediately enter your 7 digit access code.
Format: At tone---> A/C+pfx+sufx, beep, 7 digit access code
MCI:
MCI has dial-ups in most areas but the codes are not interchangable (i.e., a
code that works for the New York dial-up will not work for the Boston dial-up.)
Format: At tone---> 5 digit code+A/C+pfx+sufx
MCI CREDIT CARD (MCI CC):
This MCI service, also known as MCI Execunet, is for people who travel a
lot (i.e. business pigs) and need a code that works in several places. There-
fore, the codes on THIS system are interchangable throughout the dial-ups un-
like the regular MCI service.
Format: At tone---> 7 digit code+A/C+pfx+sufx
SKYLINE:
SBS Skyline is a new service owned by IBM, Comsat, and Aetna. It has the
same local access # across the country: 950-1088. It is supposed to have 6
(possibly 8) digit codes and is alleged to be very dangerous.
Most of the services in 950 have crystal clear connections.
CALLING CARDS:
Calling Cards are Bell's version of SPRINT, MCI, etc. Calling Cards are used
primarily from pay phones. The format is: NPA+pfx+sufx+CCCC. NPA is usually
the A/C of the billed # that the call is to be billed to. This may be replaced
by a three digit RAO (Revenue Accounting Office) code in some NPA's or a spe-
cial billing number. Pfx-sufx is the number that the call is billed to. CCCC
is a checkcode (or PIN, Personal Identification Number) that adds the security
to calling cards. The codes used to be predictable until 1983. Now CCCC ap-
pears to be sequentially generated so the codes cannot be calculated from a
formula!
The easiest way to find these codes is in a busy airport or college where
they are used a lot. Just get close and copy down someone's code (if you are
that unscrupulous!). Don't rip off poor people-- go for the rich business
pigs!
You usually call the operator to make a CC call but on many fortress fones,
you can dial 0+<the number you want to call> and you will get a recording and
tone where you enter your calling card #. By pressing the # sign (octothorpe)
after each call instead of hanging up, you can make many calls at once without
having to retype the CC # each time. This is good for busy numbers. Also, if
you want to call the # of the card, i.e. the billed #, you just have to enter
the last four digits of the CC # at the tone.
Now, suppose you do get a real operator. Since mostly business people use
calling cards, it is suggested that you act a little like a business person-
i.e. rushed, older, businesslike, and slightly pissed at the operator (keyword:
slightly). All you have to tell her is the CC #. If she asks for the # you
are calling from, tell her, but change the last digit or two. If she asks you
more questions, she is probably suspicious, so hang up. Although you SHOULD
make up some answers to certain questions to satisfy the operator that you are
legit. The most important thing you should know when making a CC call is the
area code and city of the card.
Finally, in case the operator is listening, always talk businesslike for the
first few seconds until the operator clicks off (they have been known to listen
in on calls [understatement!]). Also, always use CC's from pay phones or
charge-a-call fones only!
CAUTION: All the CC codes are now rapidly checked due to CCIS (Common
Channel Inter-office Signaling) and ESS (Electronic Switching
System). If you try to hack CC codes you can be fairly sure that
Bell security (affectionately known in the phreaking world as the
Gestapo) will get a message from the CO (Central Office, i.e.
exchange)!
[800 SERVICES]:
You are probably all familiar with WATS. WATS #'s (Wide Area Telephone Ser-
vice, otherwise known as 800 #'s) are very popular due to the fact that they
are toll-free. They often contain WATS extenders. Extenders were originally
used by salesmen in the field who called up their company's 800 # (INWATS #)
and then used the company's low-priced OUTWATS line to make the call. This is
cheaper to the company than using the Bell calling card which makes a sur-
charge.
On the original extenders there were no codes! Companies soon realized that
their #'s were being used and added the present-day security codes. The sales-
man would then dial the 800 number and enter the code (usually 4 digits), he
would then receive a second dial tone from the company's PBX (Private Branch
Exchange - their own switching equipment, i.e. switchboard). He would then ac-
cess the OUTWATS line by dialing 8 or 9 and then the #. These codes were ori-
ginally hand-hacked, but some pioneer phreak (Captain Crunch) added an inter-
face to Charlie, his Apple ][ computer, which was capable of generating DTMF
tones (Dual Tone Multi Frequency, i.e. generic term for touchtone (TM)) and
trying all the codes. The only problem was that Ma Bell got suspicious when
they saw that someone had called the Joe Blow Rubber Company 800 # in Califor-
nia 4,568 times at 2 am and each call lasted for only 1 second!
TRAVELNET:
Travelnet is a service, owned by GM, that uses WATS as well as local access
#'s. The 800 # is 800-521-8400.
Format: At tone---> 8 digit code, tone, A/C+pfx+sufx.
Travelnet is also unique in that it accepts voice recognition for those times
when touch-tone is not available (how convenient!). If you don't do anything
after the tone, you will hear a voice that says "Authorization #, please." You
then say each digit slowly. It will beep after you say each digit. After each
group of digits, it will repeat what you have said. Say YES if it is right,
otherwise say NO. If the authorization code is correct, it will say thank you
and then ask for the destination #. Follow the same procedure as above. The
voice system is very user friendly and you should have no problems with it.
TEL-TEC:
Tel-Tec is at 800-323-3026. In my experiences, you usually get a very shitty
connection. This I use for last resorts. Format: AT tone---> 6 digit code+
A/C+pfx+sufx. Tel-Tex (for TX only): 800-432-2071.
Caution: Like the 950 exchange, 800 numbers can be easily traced. This
doesn't mean that they trace everything, though.
OTHERS:
There are many other 800 services and PBX's (such as Dimension 2000 at 800-
848-9000). There is just not enough room to discuss them all. As you have
probably noticed I have posted no codes. Check the phreak section of various
BBS's to find the latest codes or hack them yourself. I suggest that you don't
use codes found on BBS's though, since they may be traps! Hand-hack good pos-
sibilities or use a "smart" modem with a hacking program (contact your local
pirate).
[HOW MA BELL CATCHES PHONE HACKERS]:
Besides suspicion and random checks, Ma Bell sets up "trap numbers." Trap
numbers were set up on certain dial-ups such as Sprint, MCI, etc. Whenever the
dialup is called a "trouble card" is dropped at the central office. This means
that a record of the called #, the CALLER'S #, and time are printed out. These
cards (or printouts in an ESS CO) are usually ignored unless SPC or somebody
detects fraud, i.e., unauthorised use of a customer's account. Then they call
Bell and find out the name and number and instantly nail the phreak who made
the call. They will then either demand that you pay some enormous fee and
they'll forget the whole matter; give them info on other phreaks, boards, etc.;
or prosecute you on the federal rap of Theft of Communications Service, which
carries fines of up to 10 years in jail and/or $10,000. They don't usually go
for legal action first, though. If you don't actually use any codes, they can
still nail you for harassing fone calls.
"Trap and Trace" is another favorite of the Gestapo. With this method you
cannot hang up until the trace is completed!
Why does Bell help their competition? Actually, it is rather simple. People
were using SPRINT to break into Bell's ESS computers. Bell could only trace
the calls back to SPRINT. So, SPRINT helps Bell catch the people it wants and
vice-versa. ("You rub my back and I'll rub yours" type of deal.)
By the way, trap numbers are also how Bell catches people who make harassing
phone calls to private residences.
Also, certain TelCo exchanges running ESS (see Part IV) generate reports
called the "800 Exceptional Calling Report" which lists people who have made
extensive or long calls to 800 #'s. Since many people use legit 800's a lot,
they also wind up on the list. If Bell does have a certain problem with an 800
#, though, they just have to check their records.
If Bell has sufficient reason to suspect you of illegal activities, they may
put a pen recorder on your line to record every single digit you dial along
with other pertinent information.
Finally, do not forget that these services have a copy of the number that you
called. So, if a customer says that he didn't call a certain #, they will usu-
ally call up that # and try to find out who did call at that time.
So, to be safer on SPC, MCI, and others, follow the following suggestions:
1) Use a fortress fone (pay phone) whenever possible. Although they have
been known to stake out pay fones... Just don't use the same fone over and
over again. In other words, move around.
2) Only call institutional switchboards, businesses that have no record of
your call, and friends who are instant amnesiacs.
3) Try to keep all calls under 15 minutes when possible.
Note: No system is totally safe! When I classify something as safe or
dangerous, that is my opinion as well as that of several other phreaks. These
opinions are based on how many people have been busted on them, what type of
equipment they are using, and inside information. I cannot possibly guarantee
that you will not be caught. Actually, with CCIS and ESS nothing is really
safe anymore. Besides, what phun whould there be in life without a few risks?
Also, I have known people who used 800 #'s and SCC's for several years daily
with no problems.. I also know people who used a system for a week and were
busted!
At this point, I would like to mention the "official" phreak newsletter, TAP.
TAP contains much information about phone phreaking and other illegal activi-
ties. Send an SASE for their info sheet, "What the hell is TAP?" Their ad-
dress is:
TAP
Room 603
147 West 42nd Street
New York, New York 10036
|
|
