|
|
 |
|
|
|
register |
bbs |
search |
rss |
faq |
about
|
|
|
meet up |
add to del.icio.us |
digg it
|
|
|
|
BIOC #3's guide to phreaking
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
*******BIOC AGENT 003'S COURSE IN*******
* *
* ========================== *
* =BASIC TELECOMMUNICATIONS= *
* ========================== *
*PART I *
****************************************
PREFACE
IN THIS COURSE, I PLAN TO COVER AS MUCH MATERIAL AS POSSIBLE RELATING TO
TELECOMMUNICATIONS. FIRST, IN THE SYLLABUS ARE THE LONG-DISTANCE SERVICES,
WHICH IS THE TOPIC OF PART I. IN FUTURE ISSUES, SUCH SUBJECTS AS THE BELL
NETWORK, COLORED BOXES, TELEPHONE ELECTRONICS, CENTRAL OFFICE EQUIPMENT,
COMPUTER HACKING, AND MUCH, MUCH MORE WILL BE COVERED.
LONG-DISTANCE SERVICES
IN AN ATTEMP TO OFFER LOW PRICES, ALTERNATIVES TO BELL HAVE BEEN SET UP.
SERVICES SUCH AS SPRINT, METROFONE, ITT, MCI, TRAVELNET, AND MANY OTHERS
ARE ALL FAMILIAR TO US.
THE BASIS OF ALL THESE SERVICES ARE THAT THEY OWN THEIR OWN SWITCHING
EQUIPMENT. FIRST, WE WILL LOOK AT THOSE SERVICES THAT USE LOCAL DIAL-UP.
THE PRINCIPAL OF THESE ARE:
1) YOU DIAL THE LOCAL #
2) WHEN IT PICKS UP YOU GET A 2ND DIAL TONE, YOU THEN ENTER THE CODE
3) YOU THEN ENTER THE # AND WHALLA, YOU'RE CONNECTED, A FREE CALL!
NEXT, WE WILL LOOK AT SEVERAL OF THESE SERVICES
SPRINT
SPRINT, ALSO KNOWN AS SPC, WAS ONE OF THE FIRST LD SERVICES.
MANY BOARDS CONTAIN SPC #'S AND I PLAN TO INCLUDE A LIST OF THEM AS AN
APPENDIX TO THIS COURSE SO YOU CAN FIND YOUR LOCAL #
THE CODES FOR SPC ARE 8 DIGITS LONG, SPC IS NOT CONSIDERED SAFE, SINCE
MANY PEOPLE HAVE BEEN BUSTED ON IT! IT IS COMMON KNOWLEDGE THAT SPRINT
HAS DECLARED WAR ON PHONE PHREAKS SO, FIGHT BACK.(WITH CARE)
914 DIAL-UP-->(914)997-1616
METROFONE
METROFONE, OWNED BY WESTERN UNION, IS VERY POPULAR AMONG PHONE PHREAKS
DUE TO THE LARGE ABUNDANCE OF CODES AND IT(AT THE TIME OF THIS WRITING)
IS CONSIDERED FAIRLY SAFE.
THE CODE IS 6 DIGITS LONG
TO FIND THE LOCAL DIAL-UP FOR YOUR AREA, JUST CALL (800)325-1403 AND ASK
THE "NICE LADY" FOR THE # FOR YOUR AREA
FORMAT: AT TONE-->CODE+AREA CODE
(NPA)+DESTINATION #
NOTE: NPA & ACC ARE ABBREVIATIONS FOR AREA CODE
ITT
ITT IS A LITTLE DIFFERENT IN THAT UPON HEARING THE DIAL TONE AFTER CALLING
THE LOCAL ACCESS #, YOU ENTER THE ACC AND THEN THE #. YOU WILL THEN HEAR A
SHORT TONE, YOU THEN IMMEDIATELY ENTER YOUR 7 DIGIT ACCESS CODE
DIAL-UPS: (212)248-0151, (914)997-8576
FORMAT: AT TONE, DESTINATION # + 7 DIGIT ACCESS CODE
==============
=950 EXCHANGE=
==============
THE 950 EXCHANGE IS A NATIONWIDE ACCESS EXCHANGE, IN MOST AREAS, THAT
INCLUDES SUCH SERVICES AS SKYLINE, LEXITEL, ALLNET AND OTHERS. ALL
SERVICES ON THIS EXCHANGE ARE CONSIDERED DANGEROUS DUE TO THE FACT THAT
THEY HAVE THE TRACED!
SKYLINE
SBS SKYLINE IS A NEW SERVICE OWNED BY IBM, COMSAT AND AETNA IT HAS THE
SAME LOCAL ACCESS # ACROSS THE COUNTRY: 950-1088. IT IS SUPPOSED TO HAVE
6(POSSIBLY 8) DIGIT CODES AND IS ALLEGED TO BE VERY DANGEROUS.
ALLNET
ALLNET IS AT 950-1044. IT HAS 6 DIGIT CODES.
===============
=CALLING CARDS=
===============
CALLING CARDS ARE BELL'S VERSION OF SPRINT, MCI, ETC. CALLING CARDS ARE
USED PRIMARILY FROM PAY FONES THE FORMAT IS:
NPA-NXX-XXXX-CCCC
NPA IS USUALLY THE AREA CODE OF THE BILLED # THAT THE CALL IS TO BE BILLED
TO, THIS MAY BE REPLACED BY A 3 DIGIT RAO CODE IN SOME AREAS.
NXX-XXXX IS THE NUMBER THAT THE CALL IS BILLED TO.
CCCC IS A CHECKCODE<OR PIN--PERSONAL IDENTIFICATION NUMBER> THAT ADDS THE
SECURITY TO CALLING CARDS. THE CODES USED TO BE PREDICTABLE UNTIL 1983.
NOW CCCC APPEARS TO BE SEQUENTIALLY GENERATED SO THE CODES CANNOT BE
CALCULATED FROM A FORMULA!
THE EASIEST WAY TO FIND THESE CODES ARE IN BUSY AIRPORTS OR COLLEGE WHERE
THEY ARE USED ALOT. JUST GET CLOSE AND COPY DOWN SOMEONES CODE (IF YOU
ARE THAT UNSCRUPULOUS!) DON'T RIP OFF POOR PEOPLE; GO FOR THE RICH PIGS!
YOU USUALLY CALL THE OPERATOR TO MAKE A CC CALL BUT ON SOME FORTRESS FONES,
YOU CAN DIAL 0+THE NUMBER YOU WANT TO CALL AND YOU WILL GET A RECORDING
& TONE WHERE YOU ENTER YOUR CALLING CARD # BY PRESSING THE # SIGN<OCTOTHORPE>
AFTER EACH CALL INSTEAD OF HANGING UP, YOU CAN MAKE MANY CALLS AT ONCE
WITHOUT HAVING TO RETYPE THE CC # EACH TIME THIS IS GOOD FOR BUSY NUMBERS.
ALSO, IF YOU WANT TO CALL THE # OF THE CARD, IE THE BILLED #, YOU JUST
HAVE TO ENTER THE LAST 4 DIGITS OF THE CC # AT THE TONE.
NOW, SUPPOSE YOU GET A REAL OPERATOR. SINCE MOSTLY BUSINESS PEOPLE USE
CALLING CARDS, IT IS SUGGESTED THAT YOU ACT A LITTLE LIKE A BUSINESS
PERSON, IE, RUSHED, OLDER, BUSINESSLIKE, AND SLIGHTLY PISSED AT THE
OPERATOR (KEYWORD: SLIGHTLY). ALL YOU HAVE TO DO IS TELL HER THE CC #.
IF SHE ASKS YOU FOR THE NUMBER YOU ARE CALLING FROM TELL HER BUT CHANGE
THE LAST 2 DIGITS. IF SHE ASKS YOU MORE QUESTIONS, SHE IS PROBABLY
SUSPICIOUS, HANG UP. ALTHOUGH, YOU SHOULD MAKE SOME ANSWERS TO CERTAIN
QUESTIONS TO SATISFY THE OPERATOR THAT YOU ARE LEGIT. THE MOST IMPORTANT
THING YOU SHOULD KNOW WHEN MAKING A CC CALL IS THE AREA CODE AND THE
CITY OF THE CARD.
FINALLY, IN CASE THE OPERATOR IS LISTENING, ALWAYS TALK BUSINESSLIKE
FOR THE FIRST FEW SECONDS UNTIL THE OPERATOR CLICKS OFF (THEY HAVE BEEN
KNOWN TO LISTEN IN ON CALLS (UNDERSTATEMENT)). ALSO, ALWAYS USE CC'S
FROM PAY FONES OR CHARGE-A-CALL FONES ONLY!
CAUTION: ALL THE CC CODES ARE NOW RAPIDLY CHECKED DUE TO CCIS (COMMON
CHANNEL INTER-OFFICE SIGNALLING) AND ESS (ELECTRONIC SWITCHING SYSTEM)
IF YOU TRY TO HACK CC CODES YOU CAN BE FAIRLY SURE THAT BELL SECURITY
(AFFECTIONALLY KNOWN AS THE GESTAPO IN THE PHREAKING WORLD) WILL GET
A MESSAGE FROM THE CO (CENTRAL OFFICE, IE, EXCHANGE)!
==============
=800 SERVICES=
==============
YOU ARE ALL PROBABLY FAMILIAR WITH WATS. WATS #'S (WIDE AREA TELEPHONE SERVICE,
OTHERWISE KNOWN AS 800 #'S) ARE VERY POPULAR DUE TO THE FACT THAT THEY ARE
TOLL-FREE. THEY OFTEN CONTAIN WATS EXTENDERS. EXTENDERS WERE ORIGINALLY USED
BY SALESMEN IN THE FIELD WHO CALLED UP THEIR COMPANY'S 800 # (INWATS #) AND
THEN USED THE COMPANY'S LOW PRICED OUTWATS LINE TO MAKE THE CALL. THIS IS
CHEAPER TO THE COMPANY THAN USING BELL CALLING CARD WHICH HAS A SURCHARGE.
ON THE ORIGINAL EXTENDERS THERE WERE NO CODES! COMPANIES SOON REALIZED THAT
THEIR #'S WERE BEING USED AND ADDED THE PRESENT DAY SECURITY CODES. THE
SALESMAN WOULD THEN DIAL THE 800 NUMBER AND ENTER THE CODE (USUALLY 4 DIGITS),
HE WOULD THEN RECEIVE A SECOND DIAL TONE FROM THE COMPANIES PBX (PRIVATE
BRANCH EXCHANGE - THEIR OWN SWITCHING EQUIPMENT - IE, SWITCHBOARD). HE
WOULD THEN ACCESS THE OUTWATS LINE BY DIALING AN 8 OR 9 AND THEN THE #.
THESE CODES WERE ORIGINALLY HAND-HACKED, BUT SOME PIONEER PHREAK ADDED AN
INTERFACE TO CHARLIE, HIS APPLE II COMPUTER, WHICH WAS CAPABLE OF GENERATING
DTMF TONES (DUAL-TONE-MULTI-FREQUENCY - IE, GENERIC NAME FOR TOUCH-TONE (TM))
AND TRYING ALL THE CODES. THE ONLY PROBLEM WAS THAT MA BELL GOT SUSPICIOUS
WHEN THEY SAW THAT SOMEONE CALLED THE JOE BLOW RUBBER COMPANY 800 # IN
CALIFORNIA 4,568 TIMES AT 2 AM AND EACH CALL LASTED FOR ONLY 1 SECOND!
TRAVELNET
TRAVELNET IS A SERVICE THAT USES WATS AS WELL AS LOCAL ACCESS #'S.
THE 800 # IS (800)521-8400.
AFTER THE TONE ENTER THE 8 DIGIT CODE, IF THE CODE WAS RIGHT YOU'LL GET AN
AUTHORIZATION #, PLEASE." YOU THEN SAY EACH DIGIT SLOWLY. IT WILL BEEP AFTER
YOU EACH DIGIT. AFTER EACH GROUP OF DIGITS, IT WILL REPEAT WHAT YOU HAVE SAID.
SAY YES IF IT IS RIGHT, OTHERWISE, SAY NO. IF THE AUTHORIZATION CODE IS
CORRECT, IT WILL SAY THANK YOU AND IT'LL THEN ASK FOR THE DESTINATION #.
FOLLOW THE SAME PROCEDURE AS ABOVE. THE VOICE SYSTEM IS VERY USER FRIENDLY
AND YOU SHOULD HAVE NO PROBLEMS WITH IT.
TEL-TEC
TEL-TEC IS AT (800)323-3026. IN MY EXPERIENCES, YOU USUALLY GET A VERY
SHITTY CONNECTION. THIS I USE FOR LAST RESORTS.
FORMAT: 6 DIGIT CODE + DEST. #
CAUTION: LIKE THE 950 EXCHANGE, 800 NUMBERS CAN BE EASILY TRACED. THIS
DOESN'T MEAN THAT THEY TRACE EVERYTHING, THOUGH.
OTHERS
THERE ARE MANY OTHER 800 SERVICES AND PBX'S (SUCH AS THE DIMENSION 2000 AT
800-848-9000). THER IS JUST NOT ENOUGH ROOM TO DISCUSS THEM ALL. AS YOU
HAVE PROBABLY NOTICED, I HAVE POSTED NO CODES. CHECH THE PHREAK SECTION
OF VARIOUS BBS'S TO FIND THE LATEST CODES OR HACK THEM YOURSELF. HAND-HACK
GOOD POSSIBILITIES OR USE A "SMART" MODEM WITH A HACKING PROGRAM (CONTACT
YOUR LOCAL PIRATE).
HOW MA BELL CATCHES PHONE HACKERS
BESIDES SUSPICION AND RANDOM CHECKS, MA BELL SETS UP "TRAP NUMBERS". TRAP
NUMBERS WERE SET UP ON CERTAIN DIAL-UPS SUCH AS SPRINT, MCI, ETC. WHENEVER,
THE DIAL-UP IS CALLED A "TROUBLE CARD" IS DROPPED AT THE CENTRAL OFFICE.
THIS MEANS THAT A RECORD OF THE CALLED #, THE CALLERS # AND THE TIME ARE
PRINTED OUT. THESE CARDS (OR PRINTOUTS IN AN ESS CO) ARE USUALLY IGNORED
UNLESS SPC OR SOMEBODY DETECTS FRAUD, IE, UNAUTHORIZED USE OF A CUSTOMERS
ACCT., THEN THEY CALL BELL AND FIND OUT THE NAME AND THE NUMBER AND INSTANTLY
NAIL THE PHREAK WHO MADE THE CALL. THEY THEN EITHER DEMAND THAT YOU PAY
SOME ENORMOUS FEE AND THEY'LL FORGET THE WHOLE MATTER; GIVE THEM INFO ON
OTHER PHREAKS, BOARDS, ETC.; OR PERSECUTE YOU ON THE FEDERAL RAP OF THEFT
OF COMMUNICATIONS SERVICES, WHICH CARRIES FINES OF UP TO 10 YEARS IN JAIL
ANDOOR $10,000. THEY USUALLY DON'T GO FOR LEGAL ACTION FIRST, THOUGH.
WHY DOES BELL HELP THEIR COMPETITION?
ACTUALLY, IT IS RATHER SIMPLE. PEOPLE WERE USING SPRINT TO BREAK INTO BELL'S
ESS COMPUTERS. BELL COULD ONLY TRACE THE CALL BACK TO SPRINT. SO, SPRINT
HELPS BELL CATCH THE PEOLPE IT WANTS AND VICE-VERSA. ("YOU RUB MY BACK
AND I'LL RUB YOURS" TYPE OF DEAL)
BY THE WAY TRAP NUMBERS ARE ALSO HOW BELL CATCHES PEOPLE WHO MAKE HARRASING
PHONE CALLS TO PRIVATE RESIDENCES.
FINALLY, DO NOT FORGET THAT THESE SERVICES HAVE A COPY OF THE NUMBER THAT
YOU CALLED. SO, IF A CUSTOMER SAYS HE DIDN'T CALL A CERTAIN #, THEY WILL
USUALLY CALL UP THAT # AND TRY TO FIND OUT WHO DID CALL AT THAT TIME.
SO, TO BE SAFER ON SPC, MCI, AND OTHERS, FOLLOW THE FOLLOWING SUGGESTIONS:
1) USE A FORTRESS FONE (PAY FONE) WHENEVER POSSIBLE. ALTHOUGH, THEY HAVE
BEEN KNOWN TO STAKE OUT PAY FONES. JUST DON'T USE THE SAME FONE OVER
AND OVER AGAIN. IN OTHER WORDS, MOVE AROUND.
2) ONLY CALL INSTITUTIONAL SWITCHBOARDS, BUSINESS THAT HAVE NO RECORD OF
YOUR CALL, AND FRIENDS WHO ARE INSTANT AMNESIACS.
3) TRY TO KEEP ALL CALLS UNDER 15 MINUTES WHEN POSSIBLE.
NOTE: NO SYSTEM IS TOTALLY SAFE! WHEN I CLASSIFY SOMETHING AS SAFE OR
DANGEROUS, THAT IS JUST WITH RESPECT TO MY OPINION AS WELL AS THAT OF
SEVERAL OTHER PHREAKS. THESE OPINIONS ARE BASED ON HOW MANY PEOPLE HAVE
BEEN BUSTED ON THEM, WHAT TYPE OF EQUIPMENT THEY ARE USING, AND INSIDE
INFORMATION. I CANNOT POSSIBLY GUARANTEE THAT YOU WILL OR WILL NOT GET
CAUGHT. ACTUALLY, WITH CCIS AND ESS NOTHING IS REALLY SAFE ANYMORE.
BESIDES, WHAT PHUN WOULD THERE BE IN LIFE WITHOUT RISKS!
AT THIS POINT I WOULD LIKE TO MENTION THE "OFFICIAL" PHREAK NEWSLETTER,
TAP. TAP CONTAINS MUCH INFO ABOUT PHONE PHREAKING AND OTHER ILLEGAL
ACTIVITIES. SEND A SASE FOR THEIR INFO SHEET, "WHAT THE HELL IS TAP?"
THEIR ADDRESS IS:
TAP
ROOM 603
147 WEST 42 STREET
NEW YORK, NY 10036
COMING SOON
IN PART II, WE WILL LOOK AT SPECIAL BELL NUMBERS SUCH AS CNAA, ATT NEWSLINES,
LOOPS, ANI, RINGBACK, AND 99XX SCANNING.
UNTIL NEXT TIME, I WOULD LIKE TO LEAVE YOU WITH A QUOTE FROM THE MAGICIAN:
"MANY PEOPLE OF PHONE PHREAKS AS SLIME, OUT TO RIP OF BELL FOR ALL SHE IS
WORTH. NOTHING COULD BE FARTHER FROM THE TRUTH! GRANTED, THERE ARE SOME WHO
GET THERE KICKS JUST BY MAKING FREE CALLS, HOWEVER THEY ARE NOT TRUE PHONE
PHREAKS. REAL PHONE PHREAKS ARE "TELECOMMUNICATIONS HOBBYISTS" WHO EXPERIMENT,
PLAY WITH AND LEARN FROM THE PHONE SYSTEM. OCCASIONALLY THIS EXPERIMENTING,
AND A NEED TO COMMUNICATE WITH OTHER PHREAKS (WITHOUT GOING BROKE), LEADS
TO FREE CALLS. THE FREE CALLS ARE BUT A SMALL SUBSET OF A TRUE PHONE PHREAKS
ACTIVITIES."
HAVE PHUN,
*****BIOC
*=$=*AGENT
*****003
NOVEMBER 15, 1983
NOTE: THIS ARTICLE WAS WRITTEN IN UPPER + LOWER CASE.
PS. PLEASE FEEL FREE TO LEAVE ANY CORRECTIONS, ADDITIONS, COMMENTS, ANDOOR
THREATS.
PPS. OTHER BBS SYSOPS ARE WELCOME TO POST THIS MATERIAL ON THEIR BOARDS
PROVIDING THAT THEY DON'T CHANGE ANYTHING.
2
[USE CTRL-S TO STOP & START]
- SPACEBAR QUITS LISTING -
BROUGHT TO YOU BY:
=> THE PENTAGON <= <203-972-1685>
*******BIOC AGENT 003'S COURSE IN******
* *
* ========================== *
* =BASIC TELECOMMUNICATIONS= *
* ========================== *
* PART II *
***************************************
PREFACE:
IN PART II, WE WILL EXPLORE THE VARIOUS
SPECIAL BELL #'S, SUCH AS: CNAA, AT&T
NEWSLINES, LOOPS, 99XX #'S, ANI,
RINGBACK, AND A FEW OTHERS.
CNAA:
-----
CNAA, WHICH STANDS FOR CUSTOMER NAME
AND ADDRESS, ARE BUREAUS THAT EXIST SO
THAT AUTHORIZED BELL EMPLOYEES CAN FIND
OUT THE NAME AND ADDRESS OF ANY
CUSTOMER IN THE BELL SYSTEM. ALL #'S
ARE MAINTAINED ON FILE INCLUDING
UNLISTED #'S.
HERE'S HOW IT WORKS:
1) YOU HAVE A # AND YOU WANT TO FIND
OUT WHO OWNS IT, E.G. (914) 555-1234.
2) YOU LOOK UP THE CNAA # FOR THAT NPA
IN THE LIST BELOW. IN THE EXAMPLE, THE
NPA IS 914 AND THE CNAA # IS
518-471-8111.
3) YOU THEN CALL UP THE CNAA # (DURING
BUSINESS HOURS) AND SAY SOMETHING LIKE,
"HI, THIS IS JOHN JONES FROM THE
RESIDENTIAL SERVICE CENTER IN MIAMI.
CAN I HAVE THE CUSTOMER'S NAME AT
914-555-1234. THAT # IS 914-555-1234."
MAKE UP YOUR OWN REAL SOUNDING NAME,
THOUGH.
4) IF YOU SOUND NATURAL & CHEERY, THE
OPERATOR WILL ASK NO QUESTIONS.
HERE'S THE LIST:
NPACNAA # NPA CNAA #
--- ------------ --- ------------
201 201-676-7070 517 313-232-8690
202 202-384-9620 518 518-471-8111
203 203-789-6800 519 416-487-3641
204 ****NAA***** 601 601-961-0877
205 205-988-7000 602 303-232-2300
206 206-382-8000 603 617-787-2750
207 617-787-2750 604 604-432-2996
208 303-232-2300 605 402-345-0600
209 415-546-1341 606 502-583-2861
212 518-471-8111 607 518-471-8111
213 213-501-4144 608 414-424-5690
214 214-948-5731 609 201-676-7070
215 412-633-5600 612 402-345-0600
216 614-464-2345 613 416-487-3641
217 217-525-7000 614 614-464-2345
218 402-345-0600 615 615-373-5791
219 317-265-7027 616 313-223-8690
301 301-534-1168 617 617-787-2750
302 412-633-5600 618 217-525-7000
303 303-232-2300 701 402-345-0600
304 304-344-8041 702 415-546-1341
305 912-784-9111 703 804-747-1411
306 ****NAA***** 704 912-784-9111
307 303-232-2300 705 416-487-3641
308 402-345-0600 707 415-546-1341
309 217-525-7000 709 ****NAA*****
312 312-769-9600 712 402-345-0600
313 313-223-8690 713 713-658-1793
314 314-436-3321 714 213-995-0221
315 518-471-8111 715 414-424-5690
316 816-275-2782 716 518-471-8111
317 317-265-7027 717 412-633-5600
318 318-227-1551 801 303-232-2300
319 402-345-0600 802 617-787-2750
401 617-787-2750 803 912-784-9111
402 402-345-0600 804 804-747-1411
403 403-425-2652 805 415-546-1341
404 912-784-9111 806 512-828-2502
405 405-236-6121 807 416-487-3641
406 303-232-2300 808 212-226-5487
408 415-546-1341 BERMUDA ONLY
412 412-633-5600 809 212-334-4336
413 617-787-2750 812 317-265-7027
414 414-424-5690 813 813-228-7871
415 415-546-1132 814 412-633-5600
416 416-487-3641 815 217-525-7000
417 314-436-3321 816 816-275-2782
418 514-861-6391 817 214-948-5731
419 614-464-2345 819 514-861-6391
501 405-236-6121 901 615-373-5791
502 502-583-2861 902 902-421-4110
503 503-241-3440 903 ****NAA*****
504 504-245-5330 904 912-784-9111
505 303-232-2300 906 313-223-8690
506 506-657-3855 907 ****NAA*****
507 402-345-0600 912 912-784-9111
509 206-382-8000 913 816-275-2782
512 512-828-2501 914 518-471-8111
513 614-464-2345 915 512-828-2501
514 514-861-6391 916 415-546-1341
515 402-345-0600 918 405-236-6121
516 518-471-8111 919 912-784-9111
BELL USES THESE #'S MAINLY TO FIND OUT
WHO OWNS A # THAT A CUSTOMER CLAIMS HE
NEVER CALLED.
NOTE: THIS IS THE MOST COMPLETE LIST
OF CNAA #'S IN MY POSSESSION
(WITH ONLY 5 #'S NOT AVAILABLE)
--SELECT FILE--
[1-7GG=DBS MENU??=FILES MENU] : *******BIOC AGENT 003'S COURSE IN******
* *
* ========================== *
* =BASIC TELECOMMUNICATIONS= *
* ========================== *
* PART III *
***************************************
PREFACE:
IN PART III, WE WILL DISCUSS THE
DIALING PROCEDURES FOR DOMESTIC AS WELL
AS INTERNATIONAL DIALING. WE WILL ALSO
TAKE A LOOK AT THE TELEPHONE NUMBERING
PLAN.
===============================
=NORTH AMERICAN NUMBERING PLAN=
===============================
IN NORTH AMERICA, THE TELEPHONE
NUMBERING PLAN IS AS FOLLOWS:
A) A 3 DIGIT NUMBERING PLAN AREA
(NPA) CODE, [IE, AREA CODE]
B) A 7 DIGIT TELEPHONE #
CONSISTING OF A 3 DIGIT CENTRAL
OFFICE (CO) CODE PLUS A 4 DIGIT
STATION #.
THESE 10 DIGITS ARE CALLED THE NETWORK
ADDRESS OR DESTINATION CODE. IT IS IN
THE FORMAT OF:
AREA CODE TELEPHONE #
--------- -----------
N*X NXX-XXXX
WHERE: N = A DIGIT FROM 2-9
* = THE DIGIT 0 OR 1
X = A DIGIT 0-9
AREA CODES:
-----------
CHECK YOUR TELEPHONE BOOK OR THE
SEPARATE LISTING OF AREA CODES FOUND ON
MANY BBS'S. HERE ARE THE SPECIAL AREA
CODES (SAC'S):
510 - TWX (USA)
610 - TWX (CANADA)
700 - NEW SERVICE
710 - TWX (USA)
800 - WATS
810 - TWX (USA)
900 - DIAL-IT SERVICES
910 - TWX (USA)
THE OTHER AREA CODES NEVER CROSS STATE
LINES, THEREFORE EACH STATE MUST HAVE
ATLEAST ONE EXCLUSIVE NPA CODE. WHEN
A COMMUNITY IS SPLIT BY A STATE LINE,
THE CO #'S ARE OFTEN INTERCHANGABLE
(IE, YOU CAN DIAL THE SAME # FROM 2
DIFFERENT AREA CODES)
TWX:
TWX (TELEX II) CONSISTS OF 5 TELETYPE-
WRITER AREA CODES. THEY ARE OWNED BY
WESTERN UNION.THESE SAC'S MAY ONLY BE
REACHED VIA OTHER TWX MACHINES. THESE
RUN AT 110 BAUD. BESIDES THE TWX #'S,
THESE MACHINES ARE ROUTED TO NORMAL
TELEPHONE #'S. TWX MACHINES ALWAYS
RESPOND WITH AN ANSWERBACK. FOR
EXAMPLE, WU'S FYI TWX # IS (910) 988-
5956, THE CORRESPONDING REAL NUMBER TO
THIS IS (201) 279-5956. THE ANSWERBACK
FOR THIS SERVICE IS "WU FYI MAWA."
IF YOU DON'T WANT TO BUY A TWX MACHINE,
YOU CAN STILL SEND TWX MESSAGES USING
EASYLINK [8003325-4112 - SEE TUC'S AND
MY ARTICLE ENTITLED "HACKING WESTERN
UNION'S EASYLINK]
700:
AT THE TIME OF THIS WRITING, THE 700
EXCHANGE DOES NOT YET EXIST. AT&T
PLANS TO USE IT SOON THOUGH. THEY PLAN
TO MAKE IT A TYPE OF FANCY CALL
FORWARDING SERVICE. IT WILL BE
TARGETED TOWARDS SALESMEN ON THE RUN.
TO UNDERSTAND HOW IT WORKS, I'LL
EXPLAIN IT WITH AN EXAMPLE. LET'S SAY
JOE Q. SALESPIG WORKS FOR AT&T SECURITY
AND HE IS ON THE RUN CHASING A PHREAK
AROUND THE COUNTRY WHO ROYALLY SCREWED
A COSMOS SYSTEM.LET'S SAY THAT JOE'S 700 # IS (700) 382-5968.
EVERYTIME JOE GOES TO A NEW HOTEL, HE DIALS A SPECIAL 700 #,
ENTERS A CODE, AND THE # WHERE HE IS STAYING.NOW, IF HIS BOSS
RECEIVED SOME IMPORTANT INFO, ALL HE WOULD DO IS DIAL (700)
382-5968 AND IT WOULD RING WHEREVER JOE LAST PROGRAMMED IT TO.
NEAT, HUH?
800:
THIS SAC IS ONE OF MY FAVORITES SINCE
IT ALLOWS FOR TOLL-FREE CALLS.
INWARD WATS (INWATS): INWARD WIDE AREA
TELECOMMUNICATIONS SERVICE IS THE 800
#'S THAT WE ARE ALL FAMILIAR WITH. 800
#'S ARE SET UP IN SERVICE AREAS OR
BANDS.THERE ARE 6 OF THESE. BAND 6
IS THE LARGEST AND YOU CAN CALL A BAND
6 # FROM ANYWHERE IN THE US EXCEPT THE
STATE WHERE THE CALL IS TERMINATED
(THIS IS WHY MOST COMPANIES HAVE ONE
800 # FOR THE COUNTRY AND THEN ANOTHER
FOR JUST ONE STATE). BAND 5 INCLUDES
THE 48 CONTIGUOUS STATES. ALL THE WAY
DOWN TO BAND 1 WHICH INCLUDES ONLY THE
STATES CONTIGUOUS TO THAT ONE.
THEREFORE, LESS PEOPLE CAN REACH A BAND
1 INWATS # THAT A BAND 6 #.
INTRASTATE INWATS #'S (IE, YOU CAN CALL
IT FROM ONLY 1 STATE) ALWAYS HAVE A 2
AS THE LAST DIGIT IN THE EXCHANGE (IE,
800-NX2-XXXX).THE NXX ON 800 #'S
REPRESENT THE AREA WHERE THE BUSINESS
IS LOCATED. FOR EXAMPLE, A # BEGINNING
WITH 800-431 WOULD TERMINATE AT A NY CO
800 #'S ALWAYS END UP IN A HUNT SERIES
IN A CO. THIS MEANS THAT IT TRIES THE
FIRST # ALLOCATED TO THE COMPANY FOR
THEIR 800 LINES; IF THIS IS BUSY IT
WILL THEN TRY THE NEXT #, ETC). YOU
MUST HAVE A MINIMUM OF TWO LINES PER
EACH 800 #. FOR EXAMPLE, TRAVELNET
USES A HUNT SERIES. IF YOU DIAL (800)
521-8400, IT WILL FIRST TRY THE #
ASSOCIATED WITH 8400; IF IT IS BUSY IT
WILL GO TO THE NEXT AVAILABLE PORT,
ETC. INWATS CUSTOMERS ARE BILLED BY
THE # OF HOURS OF CALLS THAT ARE MADE
TO THEIR #.
OUTWATS (OUTWARD WATS): OUTWATS ARE
FOR MAKING OUTGOING CALLS ONLY. LARGE
COMPANIES USE OUTWATS SINCE THEY
RECEIVE BULK-RATE DISCOUNTS. SINCE
OUTWATS # CANNOT HAVE INCOMING CALLS,
THEY ARE IN THE FORMAT OF:
(800) *XX-XXXX
WHERE * IS THE DIGIT 0 OR 1 WHICH
CANNOT BE DIALED UNLESS YOU BOX THE
CALL. THE *XX IDENTIFIES THE TYPE OF
SERVICE AND THE AREAS THAT THE COMPANY
CAN CALL.
REMEMBER:
INWATS + OUTWATS = WATS EXTENDER
(SEE PART I)
900:
THIS DIAL-IT SAC IS A NATIONWIDE
DIAL-IT SERVICE. IT IS USED FOR TAKING
TELEVISION POLLS AND OTHER STUFF. THE
FIRST MINUTE CURRENTLY COSTS AN
OUTRAGEOUS 50 CENTS AND EACH ADDITIONAL
MINUTE COSTS 35 CENTS.BELL TAKES IN
ALOT OF REVENUE IN THIS WAY.
DIAL (900) 555-1212 TO FIND OUT WHAT IS
CURRENTLY ON THE SERVICE.
CO CODES:
---------
THESE IDENTIFY THE SWITCHING OFFICE
WHERE THE CALL IS TO BE ROUTED.
THE FOLLOWING CO CODES ARE RESERVED
NATIONWIDE:
555 - DIRECTORY ASSISTANCE
844 - TIME ] THESE ARE NOW IN
936 - WEATHER ] THE 976 EXCHANGE
950 - FUTURE SERVICES
958 - PLANT TEST
959 - PLANT TEST
970 - PLANT TEST (TEMPORARY)
976 - DIAL-IT SERVICES
ALSO, THE 3 DIGIT ANI & RINGBACK #'S
ARE REGARDED AS PLANT TEST AND ARE THUS
RESERVED. THESE NUMBERS VARY FROM AREA
TO AREA.
950:
[ALSO SEE PART I]
HERE ARE THE SERVICES THAT ARE
CURRENTLY ON THE 950 EXCHANGE:
1000 - SPC
1022 - MCI EXECUNET
1033 - US TELEPHONE
1044 - ALLNET
1066 - LEXITEL
1088 - SBS SKYLINE
THESE SCC'S (SPECIALIZED COMMON
CARRIERS) ARE FREE FROM FORTRESSES!
PLANT TESTS:
THESE INCLUDE ANI, RINGBACK, AND OTHER
VARIOUS TESTS.
976:
DIAL 976-1000 TO SEE WHAT IS CURRENTLY
ON THE SERVICE. ALSO, MANY BBS'S HAVE
A LISTING OF THESE #'S.
N11 CODES:
----------
BELL IS TRYING TO PHASE SOME OF THESE
OUT, BUT THEY STILL EXIST IN MANY
AREAS.
011 - INTERNATIONAL DIALING PREFIX
211 - COIN REFUND OPERATOR
411 - DIRECTORY ASSISTANCE
611 - REPAIR SERVICE
811 - BUSINESS OFFICE
911 - EMERGENCY
=======================
=INTERNATIONAL DIALING=
=======================
WITH INTERNATIONAL DIALING, THE WORLD
HAS BEEN DIVIDED INTO 9 NUMBERING
ZONES.
TO MAKE AN INTERNATION CALL, YOU MUST
DIAL:
INT. PREFIX + COUNTRY CODE + NAT. #
IN NORTH AMERICA, THE INTERNATIONAL
DIALING PREFIX IS 011 FOR STATION-TO-
STATION CALLS AND 01 FOR OPERATOR-
SERVICED CALLS. IDDD STANDS FOR
INTERNATIONAL DIRECT DISTANCE DIALING.
THE COUNTRY CODE, WHICH VARIES FROM 1
TO 3 DIGITS, ALWAYS HAS THE WORLD
NUMBERING ZONE AS THE FIRST DIGIT. FOR
EXAMPLE, THE COUNTRY CODE FOR THE
UNITED KINGDOM IS 44, THUS IT IS IN
WORLD NUMBERING ZONE 4.
SOME BOARDS MAY CONTAIN A COMPLETE
LISTING OF OTHER COUNTRY CODES, BUT
HERE ARE A FEW:
1 - NORTH AMERICA (US, CANADA,ETC)
20 - EGYPT
258 - MOZAMBIQUE
34 - SPAIN
49 - GERMANY
52 - MEXICO (SOUTHERN PORTION)
61 - AUSTRALIA
7 - USSR
81 - JAPAN
98 - IRAN
IF YOU CALL FROM AN AREA OTHER THAN
NORTH AMERICA, THE FORMAT IS GENERALLY
THE SAME. FOR EXAMPLE, LET'S SAY YOU
WANTED TO CALL THE WHITE HOUSE FROM
SWITZERLAND. FIRST YOU WOULD DIAL 00
(THE SWISS INTERNATIONAL DIALING
PREFIX), THEN 1 (THE US COUNTRY CODE),
FOLLOWED BY 202-456-1414 (THE NATIONAL
# FOR THE WHITE HOUSE).
ALSO, COUNTRY CODE 87 IS RESERVED FOR
MARITIME MOBILE SERVICE, IE CALLING
SHIPS:
871 - MARISAT (ATLANTIC)
872 - MARISAT (PACIFIC)
873 - MARISAT (INDIAN )
INTERNATIONAL SWITCHING:
IN NORTH AMERICA, THERE ARE CURRENTLY 7
NO. 4 ESS'S THAT PERFORM THE DUTY OF
ISC (INTERNATION SWITCHING CENTERS).
ALL INTERNATIONAL CALLS DIALED FROM
NUMBERING ZONE 1 WILL BE ROUTED THROUGH
ONE OF THESE "GATEWAY CITIES." THEY
ARE:
182 - WHITE PLAINS, NY
183 - NEW YORK, NY
184 - PITTSBURGH, PA
185 - ORLANDO, FL
186 - OAKLAND, CA
187 - DENVER, CO
188 - NEW YORK, NY
THE 18X SERIES ARE OPERATOR ROUTING
CODES FOR OVERSEAS ACCESS (TO BE
FURTHER DISCUSSED WITH BLUE BOXES).
ALL INTERNATIONAL CALLS USE A SIGNALING
SYSTEM CALLED CCITT. IT IS AN
INTERNATIONAL STANDARD FOR SIGNALING.
COMING SOON:
------------
IN PART IV, WE WILL DISCUSS SWITCHING
EQUIPMENT, VARIOUS OPERATORS, CO TYPES,
ETC.
PHREAKING LIVES IN '84,
*****BIOC
*=$=*AGENT
*****003
<<=-FARGO 4A-=>>
23-FEB-84
REFERENCESAACKNOWLEDGEMENTS: NOTES ON
THE NETWORK (AT&T), TAP (ROOM 603, 147
W 42 ST, NEW YORK, NY 10036),
UNDERSTANDING TELEPHONE ELECTRONICS,
AND MANY OTHERSTTUC, MULCHER ][,
CHESHIRE CATALYST, AND MANY OTHERS WHO
HAVE CONTRIBUTED IN ONE WAY OR THE
OTHER TO THIS ARTICLE.
<***>PHREAKING VOLUME V<***>
==================
O-------------------------
[L1] ! ! !
! ! !
1000 OHM ! !
! ! !
RESISTOR RINGING !
! CIRCUIT !
! ! !
! SWITCH-
SPST SWITCH ! HOOK
! ! 1
! ! !
! ! !
(GREEN)
NOTE: MANY OF THE ELECTRONICS
COMPONENTS OF NORMAL FONES
(K500) ARE ENCLOSED IN THE
NETWORK BOX (WHICH SHOULDN'T
BE OPENED).
I HAVE ASSUMED THAT THE READER HAS A
BASIC KNOWLEDGE OF ELECTRONICS. ALSO,
I HAVE ASSUMED THAT YOU HAVE READ THE 4
PREVIOUS INSTALLMENTS OF THIS SERIES
(AND HOPEFULLY ENJOYED THEM).
IN PART VI, WE WILL TAKE A LOOK AT
FORTRESS FONES.
SUGGESTED FURTHER READING:
--------------------------
ELECTRONICS COURSES A-D, TAP, @ $.75
EACH.
ELECTRONIC TELEPHONE PROJECTS, A.J.
CARISTI, HOWARD SAMS BOOKS.
EVERYTHING YOU ALWAYS WANTED TO KNOW
ABOUT 1633 HZ TONES BUT WERE AFRAID TO
ASK, THE MAGICIAN, TAP, ISSUE #62.
FREE BELL PHONE CALLS, TAP, FACT SHEET
#2, @ $.50.
FREE GTE PHONE CALLS, TAP, FACT SHEET
#3, @ $.50.
HOW TO MODIFY YOUR BELL TOCH TONE FONE
TO HAVE 1633 CYCLE TONES, TAP, ISSUE
#63.
MODIFYING YOUR PHONE FOR 1633 HZ (NEW
ELECTRONIC KEYPADS), FRED STEINBECK,
TAP, ISSUE #84.
NOTES ON THE NETWORK, AT&T.
THE PHONE BOOK, J. EDGAR HYDE.
REGULATING THE TELEPHONE COMPANY IN
YOUR HOME, RAMAPART MAGAZINE, JUNE
1972.
REMOBS, TAP #91 (NOT YET PUBLISHED AS
OF THIS WRITING).
UNDERSTANDING TELEPHONE ELECTRONICS,
TEXAS INSTRUMENTS.
& OTHER ASSORTED SOURCES...
TAPRROOM 6031147 W 42 ST.NNEW YORK, NY
10036. PLEASE SPECIFY BY BACKISSUE
#'S (NOT ARTICLE NAMES). ALL BACK-
ISSUES ARE $1 EACH. SUBSCRIPTIONS ARE
$10YYEAR (10 ISSUES). SAY THAT BIOC
AGENT 003 SENT YO
*******BIOC AGENT 003 COURSE IN********
* *
* ========================== *
* =BASIC TELECOMMUNICATIONS= *
* ========================== *
* PART V *
***************************************
PREFACE:
PREVIOUS INSTALLMENTS OF THIS SERIES
WERE FOCUSED ON TELEPHONY FROM A
NETWORK POINT-OF-VIEW. PART V WILL
DEAL WITH TELEPHONE ELECTRONICS
FOCUSING PRIMARILY ON THE SUBSCRIBER'S
TELEPHONE. HEREINAFTER SIMPLY REFERRED
TO AS "FONE."
WIRING:
-------
ASSUMING A STANDARD ONE-LINE FONE,
THERE ARE USUALLY 4 WIRES THAT LEAD
OUT OF THE FONE SET. THESE ARE
STANDARDLY COLORED RED, CREEN, YELLOW,
& BLACK. THE RED & GREEN SIRES ARE THE
TWO THAT ARE ACTUALLY HOOKED UP TO YOUR
CO. THE YELLOW WIRE IS SOMETIMES USED
TO RING DIFFERENT FONES ON A PARTY LINE
(IE, ONE #, SEVERAL FAMILIES--FOUND
PRIMARILY IN RURAL AREAS WHERE THEY PAY
LESS FOR THE SERVICE AND THEY DON'T USE
THE FONE AS MUCH); OTHERWISE, THE
YELLOW IS USUALLY JUST IGNORED. ON SOME
TWO-LINE FONES, THE RED & GREEN WIRES
ARE USED FOR THE FIRST FONE # AND THE
YELLOW & BLACK ARE USED FOR THE SECOND
LINE. IN THIS CASE THERE MUST BE AN
INTERNAL OR EXTERNAL DEVICE THAT
SWITCHES BETWEEN THE TWO LINES AND
PROVIDES A HOLD FUNCTION. (SUCH AS
RADIO SHACK'S OUTRAGEOUSLY PRICED 2
LINE & HOLD MODULE9.
IN TELEPHONY, THE RED & GREEN WIRES ARE
OFTEN REFERRED TO AS TIP (T) & RING
(R). THE TIP IS USUALLY THE MORE
POSITIVE OF THE TWO WIRES. THIS NAMING
GOES BACK TO THE OLD OPERATOR CORD
BOARDS WHERE ONE OF THE WIRES WAS THE
TIP OF THE PLUG AND THE OTHER WAS THE
RING (OF THE BARREL).
A ROTARY FONE (AKA DIAL OR PULSE) WILL
WORK FINE REGARDLESS WHETHER THE RED
(OR GREEN) WIRE IS CONNECTED THE TIP(+)
OR RING(-). A TOUCH-TONE (TM) FONE IS
A DIFFERENT STORY, THOUGH. IT WILL NOT
WORK EXCEPT IF THE TIP(+) IS THE GREEN
WIRE. [ALTHOUGH, SOME OF THE MORE
EXPENSIVE DTMF FONES DO HAVE A
RECTIFIER BRIDGE WHICH COMPENSATES FOR
POLARITY REVERSAL.] THIS I WHY UNDER
CERTAIN (NON-DIGITAL) SWITCHILG
EQUIPMENT YOU CAN REVERSE THE RED &
GREEN WIRES ON A TOUCH-TONE FONE AND
RECEIVE FREE DTMF SERVICE. EVEN THOUGH
IT WON'T BREAK DIAL TONE, REVERSING THE
WIRES ON A ROTARY LINE ON A DIGITAL
SWITCH WILL CAUSE THE TONES TO BE
GENERARTED.
VOLTAGES, ETC.
--------------
WHEN YOUR TELEPHONE IS ON-HOOK (IE,
HUNG UP) THERE IS APPROXIMATELY 48
VOLTS OF DC CURRENT (VDC) FLOWING
THROUGH THE TIP & RING. WHEN THE
HANDSET OF A FONE IS LIFTED A FEW
SWITCHES CLOSE WHICH CAUSE A LOOP TO BE
CONNECTED (KNOWN AS THE "LOCAL LOOP")
BETWEEN YOUR FONE & THE CO. ONCE THIS
HAPPENS DC CURRENT IS ABLE TO FLOW
THROUGH THE FONE WITH LESS RESISTANCE.
THIS CAUSES A RELAY TO ENERGIZE WHICH
CAUSES OTHER CO EQUIPMENT TO REALIZE
THAT YOU WANT SERVICE. EVENTUALLY, YOU
SHOULD END UP WITH A DIAL TONE. THIS
ALSO CAUSES THE 48 VDC TO DROP DOWN
INTO THE VICINITY OF 13 VOLTS. THE
RESISTANCE OF THE LOOP ALSO DROPS BELOW
THE 2500 OHM LEVEL.
AS OF NOW, YOU ARE PROBABLY SAYING TO
YOURSELF THAT THIS IS ALL NICE AND
TECHNICAL BUT WHAT THE HELL GOOD IS THE
INFORMATION. WELL, ALSO CONSIDER THAT
THIS VOLTAGE (& RESISTANCE) DROP IS HOW
THE CO DETECTS THAT A FONE WAS TAKEN
OFF HOOK (PICKED UP). IN THIS WAY,
THEY KNOW WHEN TO START BILLING THE
CALLING NUMBER. NOW WHAT DO YOU
SUPPOSE WOULD HAPPEN IF A DEVICE SUCH
AS A RESISTOR OR A ZENER DIODE WAS
PLACED ON THE CALLED PARTIES LINE SO
THAT THE VOLTAGE WOULD DROP JUST ENOUGH
TO ALLOW TALKING BUT NOT ENOUGH TO
START BILLING? FIRST OFF, THE CALLING
PARTY WOULD NOT BE BILLED FOR THE
CALL BUT CONVERSATION COULD BE PERSUED.
SECONDLY, THE CO EQUIPMENT WOULD THINK
THAT THE FONE JUST KEPT ON RINGING.
THE TELCO CALLS THIS A "NO-NO" (TOLL
FRAUD TO BE MORE SPECIFIC) WHILE PHONE
PHREAKS AFFECTIONATELY CALL THIS MUTE A
BLACK BOX.
THE FOLLOWING ARE INSTRUCTIONS ON HOW
TO BUILD A SIMPLE BLACK BOX. OF
COURSE, ANYTHING THAT PREVENTS THE
VOLTAE FROM DROPPING WOULD WORK.
YOU ONE OR TWO PARTS: A SPST TOGGLE
SWITCH AND A 10,000 OHM (10 K), 122
WATT RESISTOR. ANY ELECTRONICS STORE
SHOULD STOCK THESE PARTS.
NOW, CUT 2 PIECES OF WIRE (ABOUT 6
INCHES LONG) AND ATTACH ONE END OF EACH
WIRE TO ONE OF THE TERMINALS ON THE
SWITCH. NOW TURN YOUR K500 (STANDARD
DESK FONE) UPSIDE DOWN AND TAKE OFF THE
COVER. LOCATE THE 2 SCREWS ON THE
ETWORK BOX LABELED >F< AND >RR<. WRAP
THE RESISTOR BETWEEN THE 2 SCREWS
MAKING SURE THAT IT DOESN'T TOUCH ANY
OTHER TERMINALS!. NOW CONNECT ONE WIRE
FROM THE SWITCH TO THE RR TERMINAL.
FINALLY, ATTACH THE REMAINING WIRE TO
THE GREEN WIRE (DISCONNECT IT FROM ITS
TERMINAL). NOW BRING THE SWITCH OUT
THE REAR OF THE FONE AND REPLACE THE
COVER.
PUT THE SWITCH IN A POSITION WHERE YOU
RECEIVE A DIAL TONE. MARK THIS
POSITION NORMAL. MARK THE OTHER SIDE
FREE.
WHEN YOUR PHRIENDS CALL (AT A
PREARRANGED TIME), QUICKLY LIFT & DROP
THE RECEIVER AS FAST A POSSIBLE. THIS
WILL STOP THE RINING (DO IT AGAIN IF
IT DOESN'T) WITH OUT STARTING THE
BILLING. IT IS IMPORTANT THAT YOU DO
IT QUICKLY (LESS THAN ONE SECOND THEN
PUT THE SWITCH IN THE FREE POSITION AND
PICK UP THE FONE. KEEP ALL CALL SHORT
AND PREFERRABLY UNDER 15 MINUTES.
NOTE: IF ANYONE PICKS UP AN EXTENSION
IN THE CALLED PARTIES HOUSE AND
THAT FONE IS NOT SET FOR FREE
THEN BILLING WILL START.
NOTE: AN OLD WAY OF SIGNADLING A
PHRIEND THAT YOU ARE ABOUT TO
CALL IS MAKING A COLLECT CALL TO
A NON-EXISTANT PERSON IN THE
HOUSE. SINCE YOUR FRIEND WILL
NOT ACCEPT THE CHARGES, HE WILL
KNOW THAT YOU ARE ABOUT TO CALL
AND THUS PREPARE THE BLACK BOX
(OR VISA VERSA).
WARNING: THE TELCO CAN DETECT BLACK
BOXES IF THEY SUSPECT ONE ON
YOUR LINE. THIS IS DONE DUE
TO THE PRESENCE OF AC VOICE
SIGNAL AT THE WRONG DC LEVEL!
PICTORAL DIAGRAM:
(STANDARD ROTARY K500 FONE)
---------------------------------------
! !
***BLUE WIRE**>>F< !
! * * !
**WHITE WIRE** * !
! * !
! REISTOR !
! * !
! * !
! >RR<*******SWITCH**** !
! * !
****GREEN WIRE********************** !
! !
---------------------------------------
NOTE: THE BLACK BOX WILL NOT WORK
UNDER ESS OR OTHER SIMILAR
DIGITAL SWITCHES SINCE ESS DOE
NOT CONNECT THE VOICE CIRCUITS
UNTIL THE FONE IS PICKED UP
(& BILLING STARTS). INSTEAD,
ESS USES AN "ARTIFICIAL"
COMPUTER GENERATED RING.
RINGING:
--------
TO INFORM A SUBSCRIBER OF AN INCOMING
CALL, THE TELCO SENDS 90 VOLTS (RMS) OF
AC CURRENT DOWN THE LINE (AT AROUND 15
TO 60 HZ) IN STANDARD FONES, THIS
CAUES A METAL ARMATURE TO BE ATTRACTED
ALTERNATELY BETWEEN TWO ELECTRO-MAGNETS
THUS STRIKING 2 BELLS. OF COURSE, THE
STANDARD BELL (PATENTED IN 1878 BY TOM
A. WATSON) CAN BE REPLACED BY A MORE
MODERN ELECTRONIC BELL OR SIGNALING
DEVICE.
ALSO, YOU CAN HAVE LIGHTS AND OTHER
SIMILAR DEVICES IN LIEU OF (OR IN
CONJUNCTION WITH) THE BELL. A SIMPLE
NEON LIGHT (WITH ITS CORRESPONDING
RESISTOR) CAN SIMPLY BE CONNECTED
BETWEEN THE RED & GREEN WIRES (USUALLY
L1 & L2 ON THE NETWORK BOX) SO THAT IT
LIGHTS UP ON INCOMING CALLS. A REGULAR
60 WATT LIGHT BULB CAN ALSO BE HOOKED
UP USING A SIMPLE (120 VAC) RELAY.
WARNING: 90 & 120 VAC CAN GIVE QUITE
A SHOCK. EXERCISE EXTREME
CAUTION IF YOU WISH TO
FURTHER PERSUE THESE TOPICS.
ALSO INCLUDED IN THE RINGING CIRCUIT IS
A CAPACITOR TO PREVENT THE DC CURRENT
FROM INTERFERRING WITH THE BELL [A
CAPACITOR WILL PASS AC CURRENT WHILE IT
WILL PREVENT DC CURRENT FROM FLOWING
(BY STORING IT)].
ANOTHER REASON THAT THE TELCO HATES
BLACK BOXES IS BECUASE RINGING USES
ALOT OF COMMON-CONTROL EQUIPEMET, IN
THE CO, WHICH USE ALOT OF ELECTRICITY.
THUS THE RINGING GENERATORS ARE BEING
TIED UP WHILE A FREE CALL IS BEING
MADE. USUALLY CALLS THAT ARE ALLOWED
TO RING FOR A LONG PERIOD OF TIME MAY
BE CONSTRUED AS SUSPICIOUS. SOME
OFFICES MAY BE SET UP TO DROP A TROUBLE
CARD FOR LONG PERIODS OF RINGING THEN A
"NO-NO" DETECTION DEVICE MAY BE PLACED
ON THE LINE.
INCIDENTALLY, THE TERM "RING TRIP"
REFERS TO THE CO PROCESS INVOLVED TO
STOP THE AC RINGING SIGNAL WHEN THE
CALLING FONE GOES OFF HOOK.
NOTE: IT IS SUGGESTED THAT YOU
ACTUALLY DISSECT FONES TO HELP
YOU BETTER UNDERSTAND THEM.
IT WILL ALSO HELP YOU TO BETTER
UNDERSTAND THE CONCEPTS HERE IF
YOU ACTUALLY PROVE THEM TO
YOURSELF. FOR EXAMPLE, ACTUALLY
TAKE THE VOLTAGE READINGS ON
YOUR FONE LINE [ANY SIMPLE
MULTI-TESTER (A MUST) WILL DO.]
PHREAKING IS AN INTERACTIVE
PROCESS NOT A PASSIVE ONE!
DIALING:
--------
ON A TANDARD FONE, THERE ARE TWO
COMMON TYPES OF DIALING: PULSE &
DTMF. OF COURSE, SOME PEOPLE INSIST
UPON BEING DIFFERENT AND DON'T USE THE
DT THUS LEAVING THEM WITH MF (MULTI
FREQUNCY, AKA OPERATOR, BLUE BOX)
TONES. THIS IS ANOTHER "NO-NO" AND THE
TELCO SECURITY GENTELMEN HAVE A SPECIAL
KNACK FOR DEALING WITH SUCH "PHREAKS"
ON THE NETWORK.
WHEN YOU DIAL ROTARY, YOU ARE ACTUALLY
RAPIDLY BREAKING & RECONNECTING
(MAKING) THE LOCAL LOOP ONCE FOR EVERY
DIGIT DIALED. SINCE THE PHYSICAL
CONNECTION MUQT BE BROKEN, YOU CANNOT
DIAL IF ANOTHER EXTENSION (OF THAT #)
IS OFF-HOOK. NEITHER OF THE FONES WILL
BE ABLE TO DIAL PULSE UNLESS THE OTHER
HANGS UP.
ANOTHER TERM OFTEN REFERRED TO IN
TELEPHONE ELECTRONICS IS THE BREAK
RATIO. IN THE US, THERE ARE 10 PULES
PER SECOND (MAX). WHEN THE CIRCUIT IS
OPENED IT IS CALLED THE BREAK INTERVAL.
WHEN IT IS CLOSED IT IS CALLED THE MAKE
INTERVAL. IN THE US, THERE IS A 60
MILLISECOND (MS) BREAK PERIOD AND A 40
MS MAKE PERIOD. (60+40=100 MS = 1110
MINUTE). THIS IS REFERRED TO AS A 60%
BREAK INTERVAL. SOME OF THE MORE
SOPHISTICATED ELECTRONIC FONES CAN
SWITCH BETWEEN A 60% & A 67% BREAK
INTERVAL. THIS IS DUE TO THE FACT THAT
MANY FOREIGN NATIOS USE A 67% BREAK
INTERVAL.
HAVE YOU EVER BEEN IN AN OFFICE OR A
SIMILAR FACILITY AND SAW A FONE WAITING
TO BE USED FOR A FREE CALL BUT SOME
ASSHOLE PUT A LOCK ON IT TO PREVENT
OUTGOING CALLS?
WELL, DON'T FRET PHELLOW PHREAKS, YOU
CAN SIMULATE PULSE DIALING BY RAPIDLY
DEPRESSING THE SWITCHOOK. (IF YOU
DEPRESS IT FOR LONGER THAN A SECOND IT
WILL BE CONSTRUED AS A DISCONNECT.) BY
RAPIDLY SWITCHOOKING YOU ARE CAUSING
THE LOCAL LOOP TO BE BROKEN & MADE
SIMILAR TO ROTARY DIALING! THUS IF YOU
CAN MANAGE TO SWITCHOOK RAPIDLY 10
TIMES YOU CAN REACH AN OPERATOR TO
PLACE ANY CALL YOU WANT! THIS TAKES
ALOT OF PRACTICE, THOUGH. YOU MIGHT
WANT TO PRACTICE ON YOUR OWN FONE
DIALIN A FRIEND'S # OR SOMETHING ELSE.
INCIDENTALLY, THIS METHOD WILL ALSO
WORK WITH DTMF FONES SINCE ALL DTMF
LINES CAN ALSO HANDLE ROTARY.
ANOTHER PROBLEM WITH PULSE DIALING IS
THAT IT PRODUCES HIGH-VOLTAGE SPIKES
THAT MAKE LOUD NOISES IN THE EARPIECE
AND CAUSE THE BELL TO "TINKLE." IF YOU
NEVER NOTICED THIS THEN YOUR FONE HAS A
SPECIAL "ANTI-TINKLE" & EARPIECE
SHORTING CIRCUIT (MOST DO). IF YOU
HAVE EVER DISSECTED A ROTARY FONE (A
MUST FOR ANY SERIOUS PHREAK) YO WOULD
HAVE NOTICED THAT THERE ARE 2 SETS OF
CONTACT THAT OPEN AND CLOSE DURING
PULSING (ON THE BACK OF THE ROTARY DIAL
UNDER THE PLASTIC COVER). ONE OF THESE
ACTUALLY OPENS AND CLOES THE LOOP
WHILE THE OTHER MUTES THE EARPIECE BY
SHORTING IT OUT. THE SECOND CONTACTS
ALSO ACTIVATES A SPECIAL ANTI-TINKLE
CIRCUIT THAT PUTS A 340 OHM RESISTOR
ACROSS THE RINGING CIRCUIT WHICH
PREVENTS THE HIGH VOLTAGE SPIKES FROM
INTERFERRING WITH THE BELL.
DUAL TONE MULTI FREQUENCY (DTMF) IS A
MODERN DAY IMPROVEMENT ON PULSE DIALING
IN SEVERAL WAYS. FIRST OF ALL, IT IS
MORE CONVENIENT FOR THE USER SINCE IT
IS FASTER AND CAN BE USED FOR SIGNALING
AFTER THE CALL IS COMPLETED (IE, SCC'S,
COMPUTERS, ETC.). ALSO, IT IS MORE
UPTO PAR WITH MODERN DAY SWITCHING
EQUIPMENT (SUCH AS ESS) SINCE PULSE
DIALING WAS DESIGNED TO ACTUALLY MOVE
RELAYS BY THE NUMBER OF DIGITS DIALED
(IN SXS OFFICES).
EACH KEY ON A DTMF KEYPAD PRODUCES 2
FREQUENCIES SIMULTANEOUSLY (ONE FROM
THE HIGH GROUP AND ANOTHGR FROM THE LOW
GROUP).
-------------------------
LOW GROUP ! Q ! ABC ! DEF ! !
697 HZ-! 1 ! 2 ! 3 ! A !
! ! ! ! !
!-----!-----!-----!-----!
! GHI ! JKL ! MNO ! !
770 HZ-! 4 ! 5 ! 6 ! B !
! ! ! ! !
!-----!-----!-----!-----!
! PRS ! TUV ! WXY ! !
852 HZ-! 7 ! 8 ! 9 ! C !
! ! ! 1 !
!-----!-----!-----!-----1
! ! OPER! ! !
941 HZ-! * ! 0 ! # ! D !
! ! Z ! ! !
!-----!-----!-----!-----!
1209 1336 1477 1633
8HIGH GROUP--IN HZ)
A PORTABLE DTMF KEYPAD IS KNOWN AS A
WHITE BOX.
THE FOURTH COLUMN (1633 HZ) IS NOT
NORMALLY FOUND O REGULAR FONES BUT IT
DOES HAVE SEVERAL SPECIAL USES. FOR
ONE, IT IS USED TO DESIGNATE THE
PRIORITY OF CALLS ON AUTOVON, THE
MILITARY FONE NETWORK. THESE KEY ARE
CALLED: FLASH, IMMEDIATE, PRIORITY, &
ROUTINE (WITH VARIATIONS) INSTEAD OF
ABCD. SECONDLY, THESE KEYS ARE USED
FOR TESTING PURPOSES BY THE TELCO. IN
SOME AREA YOU CAN FIND LOOPS AS WELL AS
OTHER NEAT TESTS (SEE PART II) ON THE
555-1212 DIRECTORY ASSISTANCE EXCHANGE.
FOR THIS, YOU WOULD CALL UP AN DA IN
CERTAIN AREAS [THAT HAVE AN AUTOMATIC
CALL DISTRIBUTOR (ACD)] AND HOLD DOWN
THE "D" KEY WHICH SHOULD BLOW THE
OPERATOR OFF. YOU WILL THEN HEAR A
PULSING DIAL TONE WHICH INDICATES THAT
YOU ARE IN THE ACD INTERNAL TESTING
MODE. YOU CAN GET ON ONE SIDE OF A
LOOP BY DIALING A 6. THE OTHER SIDE IS
7. SOME PHREAKS CLAIM THAT IF THE
PERSON ON SIDE 6 HANGS UP, OCCASIONALLY
THE EQUIPMENT WILL SCREW UP AD START
DIRECTING DIRECTORY ASSISTANCE CALLS TO
THE OTHER SIDE OF THE LOOP. ANOTHER
ALLEGED TEST IS CALLED REMOB WHICH
ALLOWS YOU TO TAP INTO LINES BY
ENTERING A SPECIAL CODE FOLLOWED BY THE
7 DIGIT NUMBER YOU WANT TO MONITOR.
THEN THERE IS THE POSSIBILITY OF MASS
CONFERENCING.
ACD'S ARE BECOME RARE THOUGH. YOU WILL
PROBABLY HAVE TO MAKE SEVERAL NPA-555-
1212 CALLS BEFORE YOU FIND ONE.
YOU CAN MODIFY REGULAR FONES QUITE
READILY SO THAT THEY HAVE A SWITCH TO
CHANGE BETWEEN THE 3RD AND 4TH COLUMNS.
THIS IS CALLED A SILVER BOX (AKA GREY
BOX) AD PLANS CAN BE FOUND IN TAP AS
WELL AS ON MANY BBS'S.
TRANSMITTERRRECEIVER:
---------------------
WHEN YOU TALK INTO THE TRANSMITTER, THE
SOUND WAVES FROM YOUR VOICE CAUSE A
DIAPHRAGM TO VIBRATE AND PRESS AGAINST
THE CARBON GRANULES (OR ANOTHER SIMILAR
SUBSTANCE). THIS CAUSES THE CARBON
GRANULES TO COMPRESS AND CONTRACT THUS
CHANGING THE RESISTANCE OF THE DC
CURRENT FLOWING THROUGH IT. THEREFORE,
YOUR AC VOICE SIGNAL IS SUPERIMPOSED
OVER THE DC CURRENT OF THE LOCAL LOOP.
THE RECEIVER WORKS IN A SIMILAR FASHION
WHERE THE SIMPLE TYPES UTILIZE A
MAGNET, ARMATURE, & DIAPHRAGM.
HYBRIDIINDUCTION COIL:
----------------------
AS YOU MAY HAVE NOTICED, THERE ARE TWO
WIRES FOR THE RECEIVER AND TWO FOR THE
TRANSMITTER IN THE FONE, YET THE LOCAL
LOOP CONSISTS OF 2 WIRES INSTEAD OF 4.
THIS 4-WIRE TO 2-WIRE CONVERSION IS
DONE INSIDE THE FONE BY A DEVICE KNOWN
AS AN INDUCTION COIL WHICH USES
COUPLING TRANSFORMERS.
THE REASON 2 SIRES ARE USED ON THE
LOCAL LOOPS ARE BECAUSE IT IS ALOT
CHEAPER FOR THE TELCO. ALTHOUGH, ALL
OF THE INTER-OFFICE TRUNKS UTILIZE 4
WIRES. THIS IS NECESSARY FOR FULL
DUPLEX (IE, SIMULTANEOUS CONVERSATION
ON BOTH SIDES) AND FOR AMPLIFICATION
DEVICES. THERE ARE SIMILAR DEVICES IN
THE CO'S, KNOWN AS A HYBRID, THAT
COUPLE THE 4-WIRE TRUNKS TO THE 2-WIRE
LOCAL LOOPS AND VISA-VERSA.
MISCELLANEOUS:--------------
IN THE TELEPHONE, THERE IS ALSO A
BALANCING NETWORK CONSISTING OF A FEW
CAPACITORS & RESISTORS WHICH PROVIDE
SIDETONE. SIDETONE ALLOWS THE CALLER
TO HEAR HIS OWN VOLUME IN THE RECEIVER.
HE CAN THEN ADJUST HIS VOICE
ACCORDINGLY. THIS PREVENTS PEOPLE FROM
SHOUTING OR SPEAKING TOO SOFTLY WITHOUT
NOTICING IT.
HOLD:
WHEN A TELEPHONE GOES OFF HOOK, THE
RESISTANCE DROPS BELOW 2500 OHMS. AT
THIS POINT, THE TELCO WILL SEND A DIAL
TONE. TO PUT SOMEONE ON HOLD YOU MST
PUT A 1000 OHM RESISTOR (1 WATT) ACROS
THE TIP & RING BEFORE IT REACHES THE
SWITCHOOK. IN THIS WAY, WHEN THE FONE
IS HUNG UP (FOR HOLD) THE RESISTANCE
REMAINS BELOW 2500 OHMS WHICH CAUSES
THE CO TO BELIEVE THAT YOU ARE STILL
OFF-HOOK. YOU CAN BUILD A SIMPLE HOLD
DEVICE USING THE FOLLOWING PICTORAL
DIAGRAM:
(RED) O-------------------------
[L1] ! ! !
! ! !
1000 OHM ! !
! ! !
RESISTOR RINGING !
! CIRCUIT !
******BIOC Agent 003's course in*******
* *
* ========================== *
* =BASIC TELECOMMUNICATIONS= *
* ========================== *
* Part VI *
***************************************
REVISED: 27-OCT-84
Preface:
This article will focus primarily on the standard Western Electric single- slot
coin telephone (aka fortress fone) which can be divided into 3 types:
- Dial-Tone First (DTF)
- Coin-First (CF): (ie, it wants your $ before you receive a dial tone)
- Dial Post-Pay Service (PP): you pay after the party answers
Depositing Coins (Slugs):
-------------------------
Once you have deposited your slug into a fortress, it is subjected to a gamut of
tests.
The first obstacal for a slug is the magnetic trap. This will stop any
light-weight magnetic slugs and coins. If it passes this, the slug is then
classified as a nickel, dime, or quarter. Each slug is then checked for
appropriate size and weight. If these tests are passed, it will then travel
through a nickel, dime, or quarter magnet as appropriate. These magnets set up
an eddy current effect which causes coins of the appropriate characteristics to
slow down so they will follow the correct trajectory. If all goes well, the
coin will follow the correct path (such as bouncing off of the nickel anvil)
where it will hopefully fall into the narrow accepted coin channel.
The rather elaborate tests that are performed as the coin travels down the coin
chute will stop most slugs and other undesirable coins, such as pennies, which
must then be retrieved using the coin release lever.
If the slug miraculously survives the gamut, it will then strike the appropriate
totalizer arm causing a ratchet wheel to rotate once for every 5-cent increment
(eg, a quarter will cause it to rotate 5 times).
The totalizer then causes the coin signal oscillator to readout a dual-
frequency signal indicating the value deposited to ACTS (a computer) or the TSPS
operator. These are the same tones used by phreaks in the infamous red boxes.
For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second (PPS). A
dime causes 2 beep tones at 5 - 8.5 PPS while a nickel causes one beep tone at 5
- 8.5 PPS. A beep consists of 2 tones: 2200 + 1700 Hz.
A relay in the fortress called the "B relay" (yes, there is also an 'A relay')
places a capacitor across the speech circuit during totalizer readout to prevent
the "customer" from hearing the red box tones.
In older 3 slot phones: one bell (1050 -1100 Hz) for a nickel, two bells for a
dime, and one gong (800 Hz) for a quarter are used instead of the modern
dual-frequency tones.
=============
=TSPS & ACTS=
=============
While fortresses are connected to the CO of the area, all transactions are
handled via the Traffic Service Position System (TSPS). In areas that do not
have ACTS, all calls that require operator assistance, such as calling card and
collect, are automatically routed to a TSPS operator position.
In an effort to automate fortress service, a computer system known as Automated
Coin Toll Service (ACTS) has been implemented in many areas. ACTS listens to
the red box signals from the fones and takes appropriate action. It is ACTS
which says, "Two dollars please (pause) Please deposit two dollars for the next
ten seconds" (and other variations). Also, if you talk for more than three
minutes and then hang-up, ACTS will call back and demand your money. ACTS is
also responsible for Automated Calling Card Service.
ACTS also provide trouble diagnosis for craftspeople (repairmen specializing in
fortresses). For example, there is a coin test which is great for tuning up red
boxes. In many areas this test can be activated by dialing 09591230 at a
fortress (thanks to Karl Marx for this information). Once activated it will
request that you deposit various coins. It will then identify the coin and
outpulse the appropriate red box signal. The coins are usually returned when
you hang up.
To make sure that there is actually money in the fone, the CO initiates a
"ground test" at various times to determine if a coin is actually in the fone.
This is why you must deposit at least a nickel in order to use a red box!
Green Boxes:
------------
Paying the initial rate in order to use a red box (on certain fortresses) left a
sour taste in many red boxer's mouths thus the GREEN BOX was invented. The green
box generates useful tones such as COIN COLLECT, COIN RETURN, and RINGBACK.
These are the tones that ACTS or the TSPS operator would send to the CO when
appropriate. Unfortunately, the green box cannot be used at a fortress station
but it must be used by the CALLED party.
Here are the tones:
COIN COLLECT 700 + 1100 Hz
COIN RETURN 1100 + 1700 Hz
RINGBACK 700 + 1700 Hz
Before the called party sends any of the3e tones, an operator released signal
should be sent to alert the MF detectors at the CO. This can be accomplished by
sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a 60 ms gap
and then the appropriate signal for at least 900 ms.
Also, do not forget that the initial rate is collected shortly before the 3
minute period is up.
Incidentally, once the above MF tones for collecting and returning coins reach
the CO, they are converted into an appropriate DC pulse (-130 volts for return &
+130 volts for collect). This pulse is then sent down the tip to the fortress.
This causes the coin relay to either return or collect the coins.
The alleged "T-Network" takes advantage of this information. When a pulse for
COIN COLLECT (+130 VDC) is sent down the line, it must be grounded somewhere.
This is usually either the yellow or black wire. Thus, if the wires are
exposed, these wires can be cut to prevent the pulse from being grounded. When
the three minute initial period is almost up, make sure that the black & yellow
wires are severed; then hang up, wait about 15 seconds in case of a second
pulse, reconnect the wires, pick up the fone, hang up again, and if all goes
well it should be "JACKPOT" time.
Physical Attack:
----------------
A typical fortress weighs roughly 50 lbs. with an empty coin box. Most of this
is accounted for in the armor plating. Why all the security? Well, Bell
contributes it to the following:
"Social changes during the 1960's made the multislot coin station a prime
target for: vandalism, strong arm robbery, fraud, and theft of service. This
brought about the introduction of the more rugged single slot coin station and a
new environment for coin service."
As for picking the lock, I will quote Mr. Phelps: "We often fantasize about
'picking the lock' or 'getting a master key.' Well, you can forget about it. I
don't like to discourage people, but it will save you from wasting alot of your
time--time which can be put to better use (heh, heh)."
As for physical attack, the coin plate is secured on all four side by hardened
steel bolts which pass through two slots each. These bolts are in turn
interlocked by the main lock.
One phreak I know did manage to take one of the 'mothers' home (which was
attached to a piece of plywood at a construction site; otherwise, the permanent
ones are a bitch to detach from the wall!). It took him almost ten hours to
open the coin box using a power drill, sledge hammers, and crow bars (which was
empty -- perhaps next time, he will deposit a coin first to hear if it slushes
down nicely or hits the empty bottom with a clunk.)
Taking the fone offers a higher margin of success. Although this may be
difficult often requiring brute force and there has been several cases of back
axles being lost trying to take down a fone! A quick and dirty way to open the
coin box is by using a shotgun. In Detroit, after ecologists cleaned out a
municipal pond, they found 168 coin phone rifled.
In colder areas, such as Canada, some shrewd people tape up the fones using duct
tape, pour in water, and come back the next day when the water will have froze
thus expanding and cracking the fone open.
In one case, "unauthorized coin collectors" where caught when they brought
$6,000 in change to a bank and the bank became suspicious...
At any rate, the main lock is an eight level tumbler located on the right side
of the coin box. This lock has 390,625 possible positions (5 ^ 8, since there
are 8 tumblers each with 5 possible positions) thus it is highly pick resistant!
The lock is held in place by 4 screws. If there is sufficient clearance to the
right of the fone, it is conceivable to punch out the screws using the drilling
pattern below (provided by Alexander Mundy in TAP #32):
====================================
!! ^
!! !
! 1- 3116 " !! !
!<--- --->!! 1-122"
-------------------- !
! ! !! ! !
! (+) (+)-! -----------
---! !! ! ^
! ! !! ! !
! ! (Z) !! ! !
! ! !! ! 2-3116"
---! !! ! !
! (+) (+) ! !
! !! ! !
-------------------- -----------
!!
!!
(Z) Keyhole (+) Screws
!!
===================================
After this is accomplished, the lock can be pushed backwards disengaging the
lock from the cover plate. The four bolts of the cover plate can then be
retracted by turning the boltworks with a simple key in the shape of the hole on
the coin plate (see diagram below). Of course, there are other methods and
drilling patterns.
:-------------------------------------:
_
! !
( )
!_!
[roughly]
Diagram of cover plate keyhole
:-------------------------------------:
The top cover uses a similar (but not as strong) locking method with the keyhole
depicted above on the top left side and a regular lock (probably tumbler also)
on the top right-hand side. It is interesting to experiment with the coin shute
and the fortresses own "red box" (which Bell didn't have the 'balls' to color
red).
Miscellaneous:
--------------
In a few areas (rural & Canada), post-pay service exists. With this type of
service, the mouthpiece is cut off until the caller deposits money when the
called party answers. This also allows for free calls to weather and other
DIAL-IT services! Recently, 2600 magazine announced the CLEAR BOX which
consists of a telephone pickup coil and a small amp. It is based on the
principal that the receiver is also a weak transmitter and that by amplifying
your signal you can talk via the transmitter thus avoiding costly telephone
charges!
Most fortresses are found in the 9xxx area. Under former Bell areas, they
usually start at 98xx (right below the 99xx official series) and move downward.
Since the line, not the fone, determines whether or not a deposit must be made,
DTF & Charge-A-Call fones make great extensions!
Finally, fortress fones allow for a new hobby--instruction plate collecting. All
that is required is a flat-head screwdriver and a pair of needle-nose pliers.
Simply use the screwdriver to lift underneath the plate so that you can grab it
with the pliers and yank downwards. I would suggest covering the tips of the
pliers with electrical tape to prevent scratching. Ten cent plates are
definitely becoming a "rarity!"
Fortress Security:
------------------
While a lonely fortress may seem the perfect target, beware! The Gestapo has
been known to stake out fortresses for as long as 6 years according to the Grass
Roots Quarterly. To avoid any problems, do not use the same fones repeatedly
for boxing, calling cards, & other experiments. The telco knows how much money
should be in the coin box and when its not there they tend to get perturbed
(read: pissed off).
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edited for 80 column viewing by: The Rogue
Call: The Circus ---------- (817) 825-4538
The Trading Post ---- (703) 486-4015 (20 Megs!)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-ee
|
|
|
To the best of our knowledge, the text on this page may be freely reproduced and distributed.
If you have any questions about this, please check out our Copyright Policy.
totse.com certificate signatures
|
|
|
About | Advertise | Bad Ideas | Community | Contact Us | Copyright Policy | Drugs | Ego | Erotica
FAQ | Fringe | Link to totse.com | Search | Society | Submissions | Technology
|
|
|
|
|
|
