[2.1] =====> PHORTUNE 500 PRESENTS: <===== +-------------------------------------------------+ (==|=--------=- THE PHREAKER'S HANDBOOK -=--------=|==) (==|=-------------=- ISSUE TWO -=-------------=|==) +-------------------------------------------------+ ...A reference guide to phone phreaks... ...for beginners and advanced abuzers... DISCLAIMER: ----------- The intent and production of this text file is only for educational and informational purposes. Neither the author nor PHORTUNE 500 are held as responsible for the reader's actions following examination of this document. Also note that the author and PHORTUNE 500 both do not endorse or encourage any type of illegal activity; remember that we may talk a lot, but when it comes down to doing, our motto is "just say no." The Phreaker's Handbook - Issue #2 - TPH#2 - Volume I - 7/24/1989 Author::Doctor Dissector Special Thanx To Killer Korean for helping me out with a few things here and there... heheh INTRODUCTION: ------------- Well, it hasn't been that long since the last issue of TPH, and I hope you guys didn't miss me too much... hehe... Anyway, down with the busy stuff... I hope you read the disclaimer on that title, if not, read it now, or I will not allow you to read this document any further (yeah right). Down to business... Welcome to yet another issue of TPH, that one newsletter written by one person, lonely at the keyboard... shit! I hope this one isn't so long... anyway, we (I) got a bunch of shit here that should interest all of you fone phreaks out in modem and fone land. Also, I will cover divertors and beige boxing in detail this issue, so if you are interested in those, check this one out. If you aren't interested in this kind of shit, don't bother me anymore! TABLE OF CONTENTS: +------------------------------------------------------------------+ | Phile Subject | +------------------------------------------------------------------+ | | | 2.1 Title Page, Introduction, & Table Of Contents | | | | 2.2 Simple Steps To Beige Boxing & Output Devices | | | | 2.3 Divertors & What To Do With Them | | | | 2.4 More Phreak Terms & Abbreviations | | | | 2.5 NPA 619 Scanning Results Part I | | | | 2.6 Pheds & Phreaks | | | | 2.7 Conclusion & Closing Announcements | | | +------------------------------------------------------------------+ [2.2] SIMPLE STEPS TO BEIGE BOXING & OUTPUT DEVICES --------------------------------------------- First thing you ask is what is a beige box? Yeah I know, well, here's an explanation. A beige box is merely a portable lineman's telephone that has clips on the end of it's cord or clips and a modular plug on the end of the cord to facilitate the use of both modular and unconventional methods of connecting this phone to a free line. If you have guessed right, the clips are for the unconventional connections and the modular plug is the typical plug that fits into the female modular connector in your own home. Then you say, big deal, they have portable telephones, and I don't. Besides, I don't have a portable telephone, the most portable one I have is the one in my car, and that one's no biggie... Well, WRONG, a beige box can be very useful and entertaining as a phone phreak's tool/toy. For instance, have you ever wanted to call the operator and bitch at her and threaten all of your phone phreak attempts to undermine your local telco at her? Or have you ever wanted to phuck someone over real bad with the OWN phone system so that they get into a helluva mess with the telco? Or ever wanted to experiment with a certain kind of box, but you thought it might be too risky or something? Maybe you wanted to tap lines, phuck people over, get free calls, mess with the telco, and do everything without the risk of being traced. Sound impossible? Sound good? Well, now that I have gotten you to listen, calm down! Remember, all this is is a phone, a portable one that can be hooked up unconventionally. This in itself is, I agree, no big deal. However, the uses of such a fone are unlimited. With a beige box, one can enter any output device and easily connect their fone onto another line or an open line and phuck with it! This is the part that I will cover in detail, the connection and the physical aspects of the various telco output devices, and how to use beige boxes properly. Now, if you are interested enuff, follow the STEP BY STEP instructions and you'll be on your way... STEP I::Building Your Own Beige Box ----------------------------------- So you want to build a beige box, eh? Well, all it is is a telephone equipped with some clips to ease hooking this baby onto any wires or terminals that you might run into, instead of the typical modular plug found on most fones. Here's the basics on how to make one. A beige box can be made two ways. The first way is the method where you must take apart a fone for optimum results. The second way can use a regular fone with no taking or breaking involved. I personally prefer the take and break method since you can add as many extra features on the fone as you like. Method 1 - The Take And Break Method Ok, get a real cheap fone at a real cheap store, preferably touch tone if it is offered in your area. Or, get a fone you have that you don't use anymore. The best kind of fone for this box is the kind that has the touch tone pad and the mouthpiece/earpiece in one unit that can be plugged directly into a modular outlet (ie, no base station thing that weighs 10 pounds). Then, if this fone is the kind that has the modular female connector in it then stick a plug and fone cord in it so that you have at least 5' of cord attached to your fone. If your fone has cord built into it, then you don't have to worry about this. Then, you take the fone cord, and strip the outside rubbery layer off and you should see four smaller wires inside, red, green, black, and yellow. Cut off the black and yellow wires, and strip the red and green wires. The red wire is called the "ring" while the green is called the "tip", remember this. Ok, now that you have stripped wire, get some alligator clips or some clips of some sort that will open at least to 1cm across, and attache one to each wire, the red and green. Now, you have yourself a primitive beige box. If you want to make it a bit more "technical," you can open your cheap fone and cut one of the wires going to the microphone (mouthpiece) and connect it to a SPST switch (2 terminal type) which will make a great mute switch when tapping lines. If you happen to have a DPST switch (6 terminal type) handy, you can make the switch-hook into a switch instead of a button, which is helpful (at least I think so). Also, if you are good at electronics, you can mess around with the insides of your fone and make it into a silver box, which will yield more phun things to do with your beige box (hey, two boxes in one then!). Method Two - The Fone Saver Method Ok, you don't wanna mess with the breaking apart and messing with the insides of a phone or cords. Then, get yourself a phone, preferably touch tone, at least five feet of phone cord, and a phone jack (ie, wall outlet jack that you stick fone cord into). Now, get the fone jack and look at it, it should have 4 wires going into the jack. These wires should be colored black, yellow, red, and green. Cut the black and yellow wires off and strip the red and green ones. Put clips on the end of the red and green wires, clips that will open to 1cm across minimum or your beige box will be hard to install quickly. Now remember this, the red wire is called the "ring," and the green wire is called the "tip." Ok, now, take the fone cord, plug it into your fone and then plug the other end into your modified jack. You are set with a primitive beige box. STEP II::Phucking Around With Your Beige Box -------------------------------------------- Now, you either have a beige box or are bored and decided to read this lengthy info anyway. So, you have a beige box, right! Now, you wanna mess with it... Go look around your neighborhood or cruise around in a car if you have access to one and look for the telco's output devices; the ones in southern California are green and are of various shape and size, but all are ugly! By the way, the technical name for these green bases are "Controlled Access Design (CAD) Pedestals". These green bases usually come in a few sizes, I have seen many kinds. There are green bases that are about 4"x6"x36" (approximate dimensions), 6"x6"x36" (approximate dimensions), 8"x8"x36" (approximate dimensions), 12"x8"x36" (approximate dimensions), and larger ones with handles that pop open when you turn the lock bolt. All of these green bases can be opened universally with a 7/16" wrench; however, these devices usually have some sort of guard against typical wrenches but socket wrenches and hex drivers will work fine. To open the regular sized green bases without the silver handles, all you hafta do is loosen the bolts at the sides holding the front cover in place. Then, lift up on the bottom of the front lid and pull out; this should pull the cover out of place, exposing the treasure inside. However, if you chose a real boonie spot in the middle of nowhere, such as unfinished construction sites, there may be nothing on the inside and you will hafta go look for another one. To open the ones with the silver handles, all you hafta do is follow directions (it says turn 1/8 counterclockwise on the handle!), so turn the bolt above the handle 1/8 counterclockwise and the handle should pop up and the green box should pop partially open. Then open the big sucker up and check out the inside. Allright, you have infiltrated a green base, now what? If you have done everything correctly and haven't chosen a bad base, you should see a bunch of bolts or screws connected to a piece of plastic or material in pairs creating a long strip of pairs. This pairing of screws/bolts in a group on a block of material (usually plastic) is called a terminal block. Sometimes there is a thick black wire that enters the terminal block at either end of the block. You might see two or more of these pair blocks if you have picked a big box in a busy area. Either way, if the base has a block and pairs inside, you should see something like this: /-----------------------------\ | |<<-------------[ Green Base | +-----+ | | | 0 |<<----------------------------------[ Terminal Block | | O | | | | 0 | | | | O | | | | 0<<--------------------------------------[ Terminal (tip) | | O<<------------------------------------[ Pair (ring) | | 0 | | | | O | | | | 0 | | | | O | | | | 0 | | | | O | | | | 0 | | | | O | | | | 0 | | | | O | | | +--#--+ | | |#|<<------------------------------------[ Black Thick Wire | | | | \\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\/Ground\//\\//\\ If you see something like the above, you should also see some small wires connecting to a few of the 0's and O's, if so, those wires go to some nearby house, and you are pretty much in business. If you don't see any wires connected to the 0's or O's, read on and hope this one is live... The terminal block shown above is probably the most common type of block used, however, you might see some blocks that look like the following (examples, the actual may have more pairs): o=screw,tip 0=bolt,tip, x=screw,ring, @=bolt,ring Model RPT25A4 Model RPT25A4 Model RPT10PA4 Model RPT10A 25 Pairs Total 25 Pairs Each Side 10 Pairs Each Side 10 Pairs Total +-----+ +------+-----+ +------+-----+ +-----+ | o | | 0 @ | o | | 0 @ | o | | o | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | o x | | 0 @ | o x | | 0 @ | o x | | o x | | x | | 0 @ | x | | 0 @ | x | | x | +-----+ +------+-----+ +------+-----+ +-----+ Now, do you see a pattern evolving here? Yes, there are two types of terminal blocks, the single sided and the dual sided. I really don't know the difference, just that the dual sided has twice as many terminals. Anyway, remember this. Ring Right Red, the Ring always connects to the RIGHT terminal, and is Red. The Tip, figure that one out if you are not stupid! Ok, if you have followed me this far, I am going extremely slow for you slow people, so listen up. If there are wires connected to any screws or bolts on the terminal block, those ones are, for sure, connected, so if worse comes to worse, you can tap or use them (unless you were planning to tap them in the first place). From this point, if you see no wires connected to the bolts or see some, place the tip of your fone on an UNUSED (no wires) tip side of a terminal and the ring side of your fone to the matching ring side of the terminal. Listen to your fone, if you have a dial tone, you have hit the jackpot. Dial whatever or box off that line or ANI if you want to know what number you are calling from. Read further for other possibilities of this great box. If you see no wires on this terminal, the line belongs to the telco, and they can trace it but will have no address listing for it (hehe...). On the other hand, if you don't get anything or just static, try some more unused ones, and if you have no unused terminals on your terminal block, then go for the used terminals; these live terminals will be connected to homes or businesses VERY nearby so you might suddenly break into a conversation or something (if someone picks the fone up, yell at them, etc, phuck with them, etc, they probably won't know what the phuck is going on) that could be really neet, now, understand how the tapping part works? If you are tapping a line and want to know more about the person you are tapping (if you don't know who you are tapping), you always can dial ANI and then inquire your CN/A bureau for more info. You can also locate a certain fone # in a base by using the ANI over and over (tiring, but works). If you have the primitive beige box with the fone jack attached, to reduce static upon connection, remove the fone cord from the jack and place the clips on the tip and ring of the terminal. Then, with the fone on (switch-hook up) put the fone cord in the jack. This may reduce the suspicion of tapping if the person you are monitoring has anything to be suspicious about in the first place. Also, if you have a fone with a mute switch, turn it on if you are tapping, then you can laugh and cry and shit and the tapped person will not hear it. Now, understand the concept of the beige box? You are using someone else's line... hehe... that mean you can dial LD for free, phuck with the operator(s), call Alliance direct, tap the line you are connected to, put recorders and shit on the line directly from the green base, make the line busy forever (stick a wire across the tip and the ring so they short), box directly from your line, phuck people over from your line (like they will see their fone bill or Pheds at their door for boxing or LD calls), and anything you want without the fear of being traced or caught (unless you choose a stupid base in front of a police station or telco!). If you are a bit more quick, all you hafta do is make a beige box, open a green base with the 7/16" socket wrench/hex wrench. Find an open terminal that works or seize/tap one that is connected. Tap it, use it or abuze it. Close the base. Leave the site! To insure safety in beige boxing and phucking with output devices, you should place a piece of transparent tape over some obscure place on the base so that if it is opened in your absence, you will notice the displacement of the tape and you can get the phuck out of there. Also, choose a spot where neighbors and curious policemen will not bother your beige boxing, nightime is a great time to go beige boxing. Use more than one output device, the Gestapo has been known to stake out pay fones, why shouldn't they stake out an over-used green base? SUMMARY OF EVENTS::The Do's And Dont's Of Beige Boxing ------------------------------------------------------ The Do's: 1) DO call Alliance Direct 2) DO call long distance phriends direct 3) DO bitch at the operator and threaten the bring the telco down with a phederation of phreakers 4) DO tap other people and phuck with them if they pick their fone up while you are beige boxing 5) DO phuck with the output device so that you record off the line, make it busy forever, or something 6) DO box directly off of a seized line, who cares if they trace 7) DO phuck people over by unlawfully using their line which gets traced to THEM 8) DO call anything and anywhere 9) DO phuck with the output device, like switching the fone wires around so the lines are crossed, changed, all on one extension, or blow the base up if you are pissed The Dont's 1) DO NOT use only one output device excessively 2) DO NOT beige box where people are apt to see you and get suspicious 3) DO NOT post your accomplishments on public BBS's under your real name 4) DO NOT let your phriends let the Pheds or any inquiring person know that you placed an illegal phone call to them 5) DO NOT forget to place that tape over the box, you want to minimize your chance of getting caught as much as possible 6) DO NOT forget that we are not responsible if you get caught [2.3] DIVERTORS & WHAT TO DO WITH THEM -------------------------------- Yes, at last, an in depth guide to divertors, or at least a pretty good guide on divertors. In this article, I will attempt to cover he major aspects of divertors, from their advantages to disadvantages; not to mention to cover their discovery and use. Well, now that you have come this far, you have tried everything, codes and extenders, fortress phreaking, and hacking with your favorite program (I hope it's Code Thief, my fav). But, the pheds are catching up on us phone phreaks; hear about that guy who got a $1000+ phone bill at the end of the month for all the illegal fone calls he placed through the 950 dial-ups? How about all the busts going down by phreaks who were hacking out codes? Yeah, it is getting rough and tough out there, and I kinda propose a possible solution to all of that through the use of divertors. What is a divertor? A divertor is a type of call forwarding but it is independent from the phone company, it is a mechanical piece of equipment which serves as a forwarding device. For example, in many 24hr services like plumbing and repair, they may have to foreword all calls after a certain time of day (people don't live in their offices you know). Anyway, lets say it's 12am and you want to call the plumber cuz your drains are all blocked up. You look in the fone book, find a 24hr plumber and call him/her. Then, if it is a divertor, you will hear a normal ring or two, and then a click, and then another ring (sometimes this other ring sounds different from the first). What the divertor is doing is it is picking up one side of the fone (your side) and dialing another fone # at the same time so that your call is "forwarded" through the divertor. Get it? This, in itself is no big deal, but, when it comes to using them, they are great. Ok, now that you know what a divertor is, it is time to find and use them. Look in your telephone yellow pages and write down a bunch of fone numbers which could be divertors, look under 24hr plumbers, repairmen, doctors, and dentists. Note that most doctors and dentists often have networks set up so one answering service always answers their calls and forewords them to the actual office, so you cannot phreak off of these networks (I think); you can tell if a doctor or dentist has a network if you find three or more doctors/dentists with the same fone # and it is 24hrs a day. Anyway, find a few fone numbers that might be divertors. Then, at night (probably after 8pm or whenever regular business hours are over), give the number a call and listen for clicks or anything. Then, when the other side answers, get the other side to hang up by asking some stupid question about their business (how much would it cost to un-clog 2 drains in my house?) or ask for someone that you know is not there and say you have the wrong number; however, do not hang up on them, and do not annoy them (they are smarter than you think!) but wait for them to hang up. Then, when they hang up, wait for the dial tone (could take a few seconds) and when you get a dial tone, if it is a divertor, you will have the dial tone of the divertor! But, to make sure it is, dial your local ANI number to find out; if it repeats your fone number, it is not a divertor, if it repeats another fone number, it is a divertor! Now, you have found a divertor, how would you use it? Well, first give the divertor a call and wait for the other side to pick it up. Say something stupid or say nothing at all and wait for them to hang up. Now, wait for the divertor's dial tone. Now, dial any number you want; if you are using it to phreak data calls off and your modem is the kind that clears the line before it dials (touch tone only!), then just get a fone in your house and take it off the switch-hook while your modem is dialing, then hang the fone up when your modem finishes dialing. You are now phreaking off of a divertor... hehe Advantages Of Divertors There are numerous advantages to divertors. First, they aren't used as widely as codes and extenders, so they are much safer. Also, you won't have to worry about getting traced or anything like that cuz if you happen to bitch at someone in the White House from a divertor, they will trace the divertor's number, not yours! So, at the end of the month or whatever, the owner of the divertor has to explain the extra LD charges on his/her fone bill as well as any charges to him/her on phucking with the white house or somewhere. Also, most divertors local to you will have cleaner connections than most 950 or port dialups. Also, you can dial anywhere direct, if you want to call Alliance, just dial it direct; if it won't go through, dial 10288 first and then Alliance, your call will be routed through AT&T. Also, you can do anything you want, since all traces will be to the divertor; box off the divertor, phreak off the divertor, experiment with the divertor, etc... Disadvantages of Divertors Yes, this was too good to be true, wrong. There are only a few disadvantages to these babies. The most common problem is the security divertor which may hang up on you after a set period of time, usually 5-10 minutes. Also, there is the divertor that clicks every minute or so, enuff to kill a computer connection, but annoying with voice phreak calls. One danger of divertors is if you or someone else overuses them. Never use divertors for more than 2 months, maybe 1 month. If the pheds or telco suspect someone using a divertor to phreak calls, then they can place a CLID (Customer Line IDentification) on the line and it is just as bad as an ANI from a dialup. There is one other type of divertors that can be used with payphones. This divertor only works with ESS. All you hafta do is go up to a phortress, dial "0" and ask for the AT&T Credit Operator. If you normal Credit Operator says that they can take all refund information, insist on the AT&T Credit Operator. Then you should hear a real lame recording on you name, address, etc and how much money you lost. Don't say anything and wait for the recording to hang up on you. Now, you should get a dial tone; to dial off of it, hit 9+1+NPA+Nxx-xxxx. Also, dial ANI to make sure you have a divertor; dial 9+ANI if ANI is 3 digits in your area and 9+1+ANI if it is a seven digit number. If it says the payfone's fone number, it isn't a divertor in your area; if it says a different number, write that number down (for phucking up the telco, explained later) and you have a divertor! Now you can dial off if it and shit like that. If you dial that number I told you to write down, you will connect with other people trying to connect with the credit operator! You can act like the credit operator and you know what happens next! That is about it on divertors, use, abuze, and share the wealth if you find one! Remember not to use them too much, since the owner of the divertor will get suspicious quickly if 10 people in a row call and say they got the wrong number! Also, never use them for long periods of time, or they will stick a CLID on the line and you know what happens then. Another thing, don't forget to try the ANI first on a divertor to make sure it is one, otherwise you might have a large fone bill at the end of the month if it isn't! Have phun and hasta! [2.4] MORE PHREAK TERMS & ABBREVIATIONS --------------------------------- A&A Bureau - Abuse and annoyance bureau. The personnel in this line of work spend their time helping customers get rid of nuts, obscene callers, harassing collectors, etc. access - The existence of paths within a network from an input terminal to a set of output terminals in the absence of traffic is indicated by the term ACCESS. Full access permits connecting to all output terminals by unique paths; multiple access indicates that all output terminals can be reached in more than one way; partial access refers to the ability to reach only a fraction of the output terminals. accessibility - availability - The number of trunks of the required route in a switching network which can be reached from an inlet. adaptor - A device designed to switch a number of voice- frequency fone channels coming from a non-time-division switching system to a time-division multiplex highway. alternate routing - A procedure by which several routes involve different switching stages or switching networks. Usually the rout having the fewest switching stages is tested first. asynchronous system - A system in which the transmission of each information character is individually synchronized usually by the use of start and stop elements. average holding time - The average duration of a call expressed in seconds or minutes. BEX - Broadband EXchange - Public switched communications system featuring full duplex connections of various bandwiths. A Western Union facility. blast box - A piece of equipment which replaces the microphone on a regular phone with a small amp and a microphone, which allows the user to "blast" their voice and other audio noises over the line at large volumes. This one was invented by Shadow Hawk 1. blocking - congestion - A condition where the immediate establishment of a new connection is impossible due to the lack of available paths or the inability to interconnect two idle network terminals because some of the applicable links between them are used for other connections. brown box - Allows the use of two separate fone lines which are manipulated to make them a party line, with a slight reduction in volume. This one was developed by The Doc. BSI - Business Services Instructor - A traffice employee who will come out and teach you how to use your fone system. busy hour - An uninterrupted period of 60 minutes in which the total traffic of a sample is at a maximum. CAD Pedestal - Controlled Access Design Pedestal - The technical name for green bases, the type of output device that is tall and skinny that stick from the ground in most modern neighborhoods. There usually is at least one of these between every house. calling rate - Average calls per subscriber per hour. call store - The memory section of a stored program control switching system in which temporary information used in the processing of calls through the exchange is contained. It is also referred to as the Process Store. CCR - Call Congestion Ratio - The ratio of the time during which congestion exists to the total time considered. It is an estimate of the probability that an external observer will find a system in a congested condition. central processor - The main computer element of a stored program control switching system, which under the direction of the stored program establishes switching network connections and also monitors and analyzes the system to insure proper operation. Routine process testing, maintenance and administrative functions are also carried out. Centrex - A PABX system in which the switching equipment is located centrally and away from the location being served. Direct inward dialing and direct outward dialing as well as automatic number identification are provided by such a system. cheese box - (Covered in TPH#1 also) This is a "device" which allows one to make his/her fone into a phortress. You get call forwarding on your line, and then set it up so it forewords all calls to your local intercept operator. Then, you will have a phortress; and you use red-box tones to make calls. You can also make calling card and credit card fone calls this way. chrome box - A non-phone associated box which is a modified strobe light which will allow green lights at most modern busy intersections, this is often used by emergency vehicles in order to gain all green lights. This one was invented by The Outlaw Telecommandos. circuit switching - Telecommunications switching in which the incomming and outgoing lines are connected by a physical path, as through crosspoints or switch contacts. class of service - The services and facilities offered to each individual terminal connected to a system. This information is usually stored with the directory or equipment numbers of the assoicated terminal, and is accessed by the call processors when a connection is required to or from that terminal. clock - Equipment to provide a time base for a switching system. In time-division switching it is used to control sampling rates, duration of signal digits, etc. COAME - Customer Owned And Maintained Equipment. CODEC - The combination of a coder and decoder, as used in time- division switching systems to code the incoming message and decode the message being returned to the caller. It is a contraction of the words, coder and decoder. common control - An exchange control method in which the dialed signals are received and registered separately from the switching elements before they are used to control these switches. Also defined as a control method, which identifies the input and output terminals of the switching network and then causes a connecting path to be established between them. Such systems are also designed as marker systems. concentration stage - A switching stage in which a number of input lines are connected to a smaller number of output lines or trunks, as in the connection of a large number of subscriber lines to a smaller number of trunks based on the grade of service desired. connecting row - All those crosspoints directly accessible from an inlet. only one connection can be established via a connecting row at any instant. coupler - A device used to prevent electrical flashback and maintain normal electrical flow on a telephone line. Used as a buffer between COAME and telephone company equipment. crosspoint - A set of contacts that operates together and extends the speech and signal wires of the desired connection. Each connection in a space-division switching network is established by closing one or more crosspoints. crosstalk - An unwanted transfer of signals from one circuit to another as may occur between switching elements or circuit wiring. day-to-busy hour ratio - The ratio of the 24hr day traffic volume to the busy hour traffic volume. In some countries the reciprocal of this ratio is used. delay system - A switching system in which a call attempt, which occurs when all accessible paths for the required connection are busy, is permitted to wait until a path becomes available. dial pulse - The signaling pulse which is formed by the interruption of the current in the DC loop of a calling telephone. Such interruptions are produced by the breaking of the dial pulse contacts of the calling telephone subset during the dialing process. DID - Direct Inward Dialing. DOD - Direct Outward Dialing. DUV - Data Under Voice - Electromechanical Switching System - An exchange system in which both the speech paths and the control equipment is composed of electronic circuits and components, generally of a solid-state type. EMD Switch - The speech-path switching element used in a Siemens rotary switching system. EMD is an abbreviation of Edelmetall-Motor- Drehwahler, which translates in English to Noble-Metal Motor Switch. Entraide - A switching system in which outlets from a given connecting stage are connected to inlets of the same or previous stage. In such systems calls may traverse a stage more than once. Usually these reentering links are used as last choice paths and the resulting network is heterogeneous. Such an arrangement is used in ITT's Pentaconta Crossbar system. Erlang - The unit of traffic intensity, which is measured in call-seconds per second or call-minutes per minute. Also, one erlang equals 3600 call-seconds per hour. It is named after A.K.Erlang, the Danish engineer and mathematician who first adopted it. FX - Foreign Exchange calls - The term applied to calls made to a central office other than the one located in the calling customer area. GTN - Global Telecommunications Network - Citibank's international data network which allows Citicorp customers and personnel to access Citibank's worldwide computerized services. H.C.Instrument - An ordinary telephone with no extras. KK6 - Six button telephone. The standard telephone found in most offices. The KK6 can can handle 5 lines, the 6th button is used for hold. link - trunk - The connection between the terminals of one switch and the terminals on a switch of the next stage corresponding to a single transmission path. link system - A system in which: (1) there are at least two connecting stages; (2) a connection is made over one or more links; (3) the links are chosen in a single logical operation; and (4) links are seized only when they can be used in making a connection. long distance - Technically, any call that terminates more than seventeen miles from the source. Long Lines - A division of AT&T which is responsible for the day- to-day operation of the long distance network. While the local Telco handles all maintenance, Long Lines directs overall supervision. lunch box - A simple transmitter which could be aired over common AM airwaves. Another component of this box was also the receiver, which could be made out of similar parts. This box was designed and developed by Dr. D-Code. Matrix - A simple switching network in which a specified inlet (matrix row) has access to a specified outlet (matrix column) via a crosspoint placed at the intersection of the row and column in question. A complete matrix is one in which each inlet has access to each outlet, while an incomplete matrix is one in which each inlet may have access to only some of the outlets. mauve box - A strange box which, with the use of magnets, dirt, and batteries, creates a magnetic field with "draws" in the nearest fone conversation. I think this one is great, but dirty! This one was developed by Captain Generic and The Genetic Mishap. message switching - A method of receiving and storing a message for more appropriate time of retransmission. With such a method, no direct connection is established between the incoming and outgoing lines as in the case of circuit switching. OCC - Other Common Carriers - The low price alternatives to Ma Bell's long distance services. These are what we call extenders and LD ports. See SCC. olive box - This box merely serves as a phone ringer. This one was presented by Arnold. packet switching - Basically the same as message switching. PBAX - Private Automatic Branch eXchange - A private automatic telephone exchange which provides for the connection of calls going to and coming from the public telephone network as well as intraexchange calls between the served extensions. PBX - Private Branch eXchange - Commonly known as a switchboard. Mini-central office equipment for business customers with from 10- 2000 telephones. pearl box - A great box which generates any tones from 1-9999Hz. This can be substituted for many other boxes, and it great for experimenting. This one was developed by Dr. D-Code. pink box - This is a relatively simple box which serves as a telefone hold button/hold with music on-line. This one was presented by The Crack Crew. purple box - (Different from Purple Box in TPH#1) This box is another type of telefone hold button. No biggie. Presented by The Flash. rock box - This box allows good quality audio signals to be sent directly through the fone line. A interesting concept! This one was developed by Video Vindicator. RPL - Restricted Private Line. terminal block - A block of plastic or other insulating material which has a grouping of paired terminals (ring/tip pairs) which are the origin of the telephone source for most homes and businesses. These terminal blocks may be found in COD pedestals (aka green bases) in groups from 1+ depending on the area it is installed in. Trans-Union - Another credit service which is like CBI, TRW, and Chilton, but offers more competitive rates. scarlet box - This box will create a very bad connection and lots of line noise. It must be connected to a victim's fone line (output devices can be hooked up too). A good one developed by The Pimp. SCC - Specialized Common Carriers - Companies like MCI, ITT, Travelnet, Metrofone, Sprint, etc. Also see OCC. snow box - A non-phreak related box which is a mini-TV pirate station. It allows the takeover of small areas of TV (non-cable) reception with normal HAM radio equipment. This one was developed by the Outlaw Telecommandos. tan box - This box allows you to make fone recordings only when the fone is picked up. This can be connected at the victim's house or in an output device. It was developed by the Samuri Cat and Tarkin Darklighter. TASI - Time Assignment Speech Interpolation - Allows more than one person to use a trunk at one time by putting them on while the other person isn't talking. This can kill a modem communication; however, you can get an independent trunk with the locking frequency. TASI Locking Frequency - Frequency which allows the caller to use an independent trunk (ie, he/she will not have to share it with some other geek). The frequency is 1850Hz which should be played before the transmission. tron box - A non-phone related box which negates the power use in a household, thus saving money! A very ingenious box! It was developed by Cap'n Crunch. [2.5] NPA 619 SCANNING RESULTS PART I ------------------------------- NPA 619 Is Located In Southern California, San Diego Country Area This is just a partial listing of some fone scanning that was and is being done in the 619 NPA at the moment. This document is dated summer of 1989. Also note the following NOTE so that you don't get pissed off if you find something different. Future parts to this series will be posted on local 619 BBS's as well as future issues of TPH. If you have something to contribute, please call the BBS's at the end of this issue. Thanx. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * PLEASE NOTE: * * ------------ * * This listing was compiled from various sources, the scanner * * assumes no responsibility for the validity of the results * * presented in this listing. Also note that scanning is legal, * * but not late at night. Check with your local telco and find * * out this info. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * All text between 77 character length "."s represent the logon screens of various computer mainframes/systems. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Doctor Dissector 480-0003 I scanned these carriers today, I don't know how high each 480-0037 carrier's baud rate can max at. 480-0038 480-0118 I think the 0003, 0037, 0038, are the fone company's test #'s, 480-0197 but I am not sure... I haven't tried any of the rest yet, so 480-0243 check them out and tell me what they are... 480-0387 480-0457 Otherwise, happy scanning.... 480-0460 480-0479 480-0501 480-0516 480-0520 I later found out a few things... ............................................................................. P login: ............................................................................. => 480-0387 (7,E,1) And there is something weird about 480-0243, I called it a 7,E,1, and then connected at 1200 bps, then I pushed return a few times, and it sent a few bells/beeps. Then it just sat there.... -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Doctor Dissector My results scanning the 679 exchange, the 99xx suffix: 679-9900 to 679-9999 The following consists of two digit numbers, xx counterpart of the 99xx suffix 01 ---+ The remaining 99xx counterparts of the suffix that are 03 ] not listed ALL went to that lame recording that says: 05 ] "Were sorry, blah blah." Otherwise, I scanned the entire 06 ] 679-99xx exchange. I will do some more scanning SOON! 07 ] 08 ] 09 ] [ All of these suffixes in the 679-99xx range led to a 11 ]-----[ re-order busy signal (120 IPM, Interruptions Per Minute). 12 ] [ I don't know if these serve any purpose. Check them out. 13 ] 14 ] NOTE: All of this scanning takes time. Computer time and 15 ] user time. I have to sit by the computer and listen 16 ] to the modem dial, and re-dial. The reason being 17 ] that most modems won't pick up these "goodies". 18 ----+ [ This one is WEIRD. When it rings once, a recording picks the 44 ----------[ fone up and says, "The number you have reached, 321-3342 has [ been changed, the new number...etc." The only thing is that [ I was scanning the 679 exchange! WEIRD! Check it out! Well, again, it seems as if I didn't find anything exciting, such as loops, ANI and all of those other things I have been looking for. Oh well, I won't give up and I will attack the Mira Mesa exchanges next!!! ATTACK! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Doctor Dissector I scanned the 486-99xx and the 592-99xx ranges and found nothing. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Doctor Dissector I was scanning today, and kept my fone busy for about five hours...hehehe These are my results of scanning the 566 exchange, from 566-0000 to 566-0870 566-0017 566-0070 566-0078 566-0117 566-0125 566-0140 566-0154 566-0167 566-0182 566-0211 566-0328 566-0350 566-0353 566-0359 566-0361 566-0367 566-0374 566-0382 566-0397 566-0455 566-0459 566-0477 566-0483 566-0484 566-0487 566-0498 566-0525 566-0579 566-0599 566-0609 566-0647 566-0654 566-0695 566-0707 566-0714 566-0727 566-0749 566-0750 566-0797 566-0815 566-0839 566-0840 566-0845 566-0847 All of these are carriers of some sort, either computers or test services by the fone company. Please test them out and post your results, some of these may lead to mainframes, bbs's, test numbers, and other things all of us might find interesting. Also, please post all findings, thanx 566-0078 was a BBS run by a Commodore, "Papa Smurf's Village" Jaffo helped out and found the following... ............................................................................. [] ADDS Mentor time is 00:55:02 15 JUL 1989 [] Logon Please: ............................................................................. => 566-0382 (8,N,1) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Doctor Dissector Well, it's me again, scanning as usual... This time, I was scanning the 695 exchange and the 99xx prefix range. I didn't find anything too interesting, but the numbers below are some "carriers" that my modem found in the range but I know they aren't computers, I think the telco uses them for test or other purposes. 695-9933 695-9934 695-9935 695-9936 695-9938 695-9944 695-9945 695-9946 695-9947 695-9948 695-9966 695-9967 695-9968 695-9969 695-9981 695-9982 695-9983 695-9984 695-9985 695-9986 695-9989 695-9991 695-9992 695-9993 695-9994 695-9995 695-9996 These are a few others that were busy during my scan: 695-9920 695-9923 695-9973 695-9997 till later.... -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Unknown Notified that the 270-99xx prefix has nothing in interest. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: The Lode Runner Scanned the 484-99xx range, found nothing too exciting, but a few strange numbers. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: The Lode Runner I was scanning the 578-99xx's and found the following: ............................................................................. DYNIX (TM) V3.0.4 (asdev2) login: ............................................................................. => 578-9905 (7,E,1) ............................................................................. ISTAR login: ............................................................................. => 578-9975 578-9976 578-9977 (7,E,1) ............................................................................. ISTAR 1200B login: ............................................................................. => 578-9983 (7,E,1) This one is weird, it is a computer, but it only gives a ":" prompt at logon, the number is 578-9975. Call it a 7,E,1. I was informed that 578-9933 is a computer of some sort. Unknown lines, 3 digit (DTMF) code: 578-9950 578-9951 578-9952 578-9953 578-9954 578-9955 578-9962 578-9963 578-9964 578-9965 578-9966 578-9967 578-9968 578-9969 (lady answers if you enter code, 1 second dial tone before) Another note: 578-9962, if you press "9" (DTMF) at connection, you will get a beeping dial tone. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- * Scanner: Doctor Dissector Okay! Yeah, as usual, here's my latest and greatest scan results. I have not tested any of them yet, as usual, and as usual, you the experimenting fone modemer will hopefully test them for all of us. Anyway, I continued my last carrier scan from 566-0870 all the way to 566-1370. That means, if you can't subtract, that I scanned 500 numbers today. The carriers are listed below, they might be BBS's, computers, test numbers, or something else, but in any case, please test them out and POST all results.... thanx 566-0898 566-0954 566-0970 566-0996 566-0999 566-1008 566-1099 566-1110 566-1126 566-1153 566-1171 566-1194 566-1215 566-1245 566-1265 566-1282 566-1283 566-1299 566-1305 566-1308 566-1351 The Lode Runner helped me check these, the results: The following system was discovered at the numbers below... ............................................................................. NOTICE: This is a private computer system. Any unauthorized access will be investigated and prosecuted to the full extent of the law. VM/370 ONLINE--PACTIMER--PRESS BREAK KEY TO BEGIN SESSION Enter one of the following commands: LOGON userid (Example: LOGON VMUSER1) DIAL userid (Example: DIAL VMUSER2) MSG userid message (Example: MSG VMUSER2 GOOD MORNING) LOGOFF > ............................................................................. => 566-0898 566-0996 566-1099 566-1194 (7,E,1) The following system was found at the number below... (and THEY mispelled PROSECUTED as PROCECUTED... gawd... and they think they are smart!) ............................................................................. THIS IS A PRIVATE COMPUTER SYSTEM ANY UNAUTHORIZED ACCESS WILL BE INVESTIGATED AND PROCECUTED TO THE FULL EXTENT OF THE LAW login: ............................................................................. => 566-0970 (7,E,1) The following VAX/VMS was found at the number below... ............................................................................. Welcome to VAX/VMS V5.0 Username: ............................................................................. => 566-1153 (7,E,1) The following have a carrier, but send garbage at 7,E,1 and 8,N,1. Perhaps baud rates at 110/600 would work, or some other bps. => 566-0954 566-1299 566-1215 This is a strange one, it doesn't ring, but answers with a carrier. => 566-1110 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- [2.6] PHEDS & PHREAKS --------------- Phreak phriends alike are growing less and less daring as the horrific system of ESS and Ma Bell's Gestapo loom warily in our shadows. To this date, I am aware that Ma Bell is getting more and more tuned in to what phreaks and hackers are doing to their system as phreaking used to get easier and easier. Well, things are different now, and it's Ma Bell's turn to taking to toll on phreak and hackers alike. Security in the Bell system get tighter and tighter by the day, and each little company which used to be considered as "safe" is now rigged with the best ANI and alert the telco of every illegal move processed by the phreak. Isn't it a shame, I have heard of so many recent busts and break- ups of elite phreak/hack oriented groups which were caught in the act of phreaking or hacking the telco systems/subsidiaries. Even Phortune 500's own nodes, 1-3 were brought down by the mighty sword of old Ma Bell, who seems to cast a shadow on the activities of the telecommunications community today. Now is a time of change, a time where phreaks find less and less alternatives and experiments which could avoid the prying eyes of the Gestapo or our phriends, the Phbi. But, why look so down? Hey, I know of a few reports where people have been billed $1000+ fone bills for phreaking off of the 950 and 800 access ports? So what? Why not stop using them then? Ok.... then we do stop. And then we hear of 950-0266's announcement through the Wall Street Journal that they will be cracking down on phreakers as time progresses. Now is a time of change. Wait, what is it a time of change for? Is it a time to stop phreaking and start paying for all those long distance fone calls everybody puts through? Or is it a time to look for new and fresh ways to make those free calls and gather that information that is halfway across our grand nation? Of course it's a time of change, but not for the worse, but the better. Now is a time to change the phreak practice for codes to other, perhaps simpler methods of phreaking. Now is a time for experimentation, a time of curiosity, a time of change! And when someone asks if someone is ending his/her phone phreak career, the answer is "no" because they will be looking, searching, for new, brand new ways to free the fone phreak from Ma Bell's uncomfortable grasps! [2.7] CONCLUSION & CLOSING ANNOUNCEMENTS ---------------------------------- Well, it's time to say goodbye to a wealth of readers out there (sniff). Oh well... I hope you enjoyed this issue of TPH, and look foreward to the next, great issue of TPH and maybe I'll cover your favorite subject there or something. Also, I hope you read phile 2.6, because it deals with a lot of technical stuff which might overcome the phreak kingdom today, and it is a time of change where the phreak kingdom must change or get caught. Know what I mean? Anyway, good luck and god bless. Don't get caught, and feel free to give me some mail or messages on the many BBS's I call. Also, any articles and submissions to me may be placed in the next issue of TPH, so send me something that's interesting! Until we meet again................. Doctor Dissector -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- The Andromeda Strain Electric Dreams 1200/2400 1200/2400 (619)PRI-VATE (619)PRI-VATE (...you'll find those BBS's if you're good...) +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ |# # # # # # # # # # # # # # # # # # # # # # # #| | # # # # # # # # # # # # # # # # # # # # # # # | |# # # # # # # # # # # # # # # # # # # # # # # #| +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ | | | ($> THE BEST IN PHREAK/HACK PRODUCTIONS <$) | | | | (*> P H O R T U N E 5 0 0 <*) | | | +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ |# # # # # # # # # # # # # # # # # # # # # # # #| | # # # # # # # # # # # # # # # # # # # # # # # | |# # # # # # # # # # # # # # # # # # # # # # # #| +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ The Phreaker's Handbook #2 - An Official Phortune 500 Production - End