💾 Archived View for gemini.spam.works › mirrors › textfiles › phreak › PHREAKING › phbook.txt captured on 2022-06-12 at 17:45:28.
-=-=-=-=-=-=-
WRITTEN BY::DOCTOR DISSECTOR
HTML & GRAPHICS BY: THE DIGITAL SNIPER
**** An Official Phortune 500 Product ****
----------------------------------------------
a useful source for the phreaker covering both
the basics and advances of phreaking
----------------------------------------------
GENERAL NOTE
------------
The purpose of this newsletter is purely educational. It has been released in order to teach
and advance the knowledge of today's declining phreaks. However, the author does not
take any responsibility over the misuse of the herein contained information, and the
newsletter itself does not encourage or support the above type of activity. Also, any wrong
or old information in this document is not to the responsibility of the author, and the reader
accepts any consequences due to information that may be mistaken in this manner.
NOTE TO ABUSERS
---------------
All information contained within this document was intended towards educational purposes.
Any misuse or illegal use of the information contained in this document is strictly at the
misuser's risk. The author assumes NO responsibility of the reader's actions following the
release this document (in otherwords, you're on your own if you get nailed!)
TPH #1 Table Of Contents:
=========================
Title Page & Disclaimer Notes
Table Of Contents & Introduction
The Phreak's Vitals
True Definition Of The Phreaker
The Phone Phreak's Ten Commandments
The Phreaker's Glossary
Other Fone Information
Voltages & Technical Stuff
Scanning Phun Fone Stuff
References & Suggested Reading
Introduction To TPH #1
======================
This phile was written for beginning as well as those uninformed
"advanced" phreaks who need something as a reference when reading
or writing philes concerning phreaking or fone phraud. Of course, you
could be a beginning phreak and use this phile to B.S. your way into a
big group by acting like you know a lot, or something, but that is up
to you. Anyway, I compiled this listing phrom various sources, the
majority is listed as references at the end of this phile.
This phile's only goal is to educate and inform. Any illegal or
fraudulent activity is neither encouraged nor supported by the author
of this phile, not by the majority of the >TRUE< phreaking community.
The author assumes NO responsibility for the actions of the reader.
Also, I know that some of the stuff covered in this release of TPH
will be old and outdated; however, I will try to clean that up by the
next release of TPH, and will notify you, the reader, of the changes
due to these revisions.
The Phreak's Vitals:
====================
True Definition Of The Phreaker
-------------------------------
"Many people think of phone phreaks as slime, out to rip off Bell for
all she is worth. Nothing could be further from the truth! Granted,
there are some who get their kicks by making free calls; however,
they are not true phone phreaks. Real phone phreaks are
'telecommunications hobbyists' who experiment, play with, and learn
from the phone system. Occasionally, this experimenting and a need
to communicate with other phreaks, without going broke, leads to free
calls. The free calls are but a small subset of a >TRUE< phone phreak's
activities."
- Wise Words Of The Magician
The Phone Phreak's Ten Commandments
-----------------------------------
I. Box thou not over thine home telephone wires, for those who doest
will surely bring the wrath of the Chief Special Agent down upon
thy head.
II. Speakest thou not of important matters over thine home telephone
wires, for to do so is to risk thine right of freedom.
III. Use not thine own name when speaking to other phreaks, for that
every third phreak is an FBI agent is well known.
IV. Let not overly many people know that thy be a phreak, as to do so
is to use thine own self as a sacrificial lamb.
V. If thou be in school, strive to get thine self good grades, for the
authorities well know that scholars never break the law.
VI. If thou workest, try to be an employee and impressest thine boss
with thine enthusiasm, for important employees are often saved by
their own bosses.
VII. Storest thou not thine stolen goodes in thine own home, for those
who do are surely non-believers in the Bell System Security Forces,
and are not long for this world.
VIII. Attractest thou not the attention of the authorities, as the
less noticeable thou art, the better.
IX. Makest sure thine friends are instant amnesiacs and willst not
remember thou hast called illegally, for their cooperation with the
authorities willst surely lessen thine time for freedom on this
earth.
X. Supportest thou TAP, as it is thine newsletter, and without it, thy
work would be far more limited.
The Phreaker's Glossary
=======================
1XB - No.1 Crossbar system. See XBAR for more information.
2600 - A hack/phreak oriented newsletter that periodically was
released and still is being released. See Phile 1.6 for more
information on the magazine and ordering.
4XB - No.4 Crossbar system. See XBAR for more information.
5XB - No.5 Crossbar system. The primary end office switch of Bell
since the 60's and still in wide use. See XBAR for more detail.
700 Services - These services are reserved as an advanced forwarding
system, where the forwarding is advanced to a user-programed
location which could be changed by the user.
800 Exceptional Calling Report - System set up by ESS that will log
any caller that excessively dials 800 numbers or directory
assistance. See ESS for more information.
800 Services - Also known as WATS. These services often contain WATS
extenders which, when used with a code, may be used to call
LD. Many LD companies use these services because they are
toll-free to customers. Most 800 extenders are considered dangerous
because most have the ability to trace.
900 Services - Numbers in the 900 SAC usually are used as special
services, such as TV polls and such. These usually are $.50 for the
first minute and $.35 for each additional minute. Dial (900)555-1212
to find out what the 900 services currently have to offer.
950 - A nationwide access exchange in most areas. Many LD companies
have extenders located somewhere on this exchange; however, all
services on this exchange are considered dangerous due to the fact
that they ALL have the ability to trace. Most 950 services have
crystal clear connections.
ACCS - Automated Calling Card Service. The typical 0+NPA+Nxx+xxxx
method of inputting calling cards and then you input the calling
card via touch tones. This would not be possible without ACTS.
ACD - Automatic Call Distributor.
ACD Testing Mode - Automatic Call Distributor Test Mode. This level of
phreaking can be obtained by pressing the "D" key down after
calling DA. This can only be done in areas that have the ACD. The
ACD Testing Mode is characterized by a pulsing dial tone. From here,
you can get one side of a loop by dialing 6, the other side is 7.
You may also be able to REMOB a line. All possibilities of the ACD
Test have not been experimented with. See silver box for more details.
ACTS - Automated Coin Toll Service. This is a computer system that
automates phortress fone service by listening for red box tones and
takes appropriate action. It is this service that is commonly heard
saying, "Two dollars please. Please deposit two dollars for the next
three minutes." Also, if you talk for more than three minutes and
then hang up, ACTS will call back and demand your money. ACTS is
also responsible for ACCS.
Alliance - A teleconferencing system that is apart from AT&T which
allows the general public to access and use its conferencing
equipment. The equipment allows group conversations with members
participating from throughout the United States. The fone number to
Alliance generally follows the format of 0-700-456-x00x depending on
the location the call originates from and is not accessible direct
by all cities/states.
AMA - Automated Message Accounting. Similar to the CAMA system; see
CAMA for more info.
analog - As used for a word or data transmission, a continuously
varying electrical signal in the shape of a wave.
ANI - Automatic Number Identification - This is the system you can
call, usually a three digit number or one in the 99xx's of
your exchange, and have the originating number you are calling
from read to you by a computer. This is useful if you don't know
the number you are calling from, for finding diverters, and when
you are playing around with other fone equipment like cans or beige
boxes. The ANI system is often incorporated into other fone companies
such as Sprint and MCI in order to trace those big bad phreaks that
abuze codez.
ANIF - Automatic Number Identification Failure. When the ANI system of
a particular office fails.
APF - All PINs Fail. This is a security measure which is designed to
frustrate attempts at discovering valid PINs by a hacking method.
aqua box - A box designed to drain the voltage of the FBI lock-in-
trace/trap-trace so you can hang up your fone in an emergency and
phrustrate the Pheds some more. The apparatus is simple, just
connect the two middle wires of a phone wire and plug, which would
be the red and green wires if in the jack, to the cord of some
electrical appliance; ie, light bulb or radio. KEEP THE APPLIANCE
OFF. Then, get one of those line splitters that will let you hook
two phone plugs into one jack. Plug the end of the modified cord
into one jack and your fone into the other. THE APPLIANCE MUST BE
OFF! Then, when the Pheds turn their lame tracer on and you find
that you can't hang up, remove your fone from the jack and turn
the appliance ON and keep it ON until you feel safe; it may be
awhile. Then turn it off, plug your fone back in, and start
phreaking again.
Invented by: Captain Xerox and The Traveler.
BAUDOT - 45.5 baud. Also known as the Apple Cat Can.
BEF - Band Elimination Filter. A muting system that will mute the 2600
Hz tone which signals hang-up when you hang up.
beige box - An apparatus that is a home-made lineman's handset. It is
a regular fone that has clips where the red and green wires normally
connect to in a fone jack. These clips will attach to the rings
and tips found in many of MA's output devices. These are highly
portable and VERY useful when messing around with cans and other
output devices the fone company has around.
Invented by: The Exterminator and The Terminal Man.
BITNET - Nationwide system for colleges and schools which accesses a
large base of education-oriented information. Access ports are
always via mainframe.
bit stream - Refers to a continuous series of bits, binary digits,
being transmitted on a transmission line.
black box - The infamous box that allows the calling party to not be
billed for the call placed. We won't go in depth right now, most
plans can be found on many phreak oriented BBS's. The telco can
detect black boxes if they suspect one on the line. Also, these
will not work under ESS.
bleeper boxes - The United Kingdom's own version of the blue box,
modified to work with the UK's fone system. Based on the same
principles. However, they use two sets of frequencies, foreword
and backwards.
Blotto box - This box supposedly shorts every fone out in the immediate
area, and I don't doubt it. It should kill every fone in the
immediate area, until the voltage reaches the fone company, and the
fone company filters it. I won't cover this one in this issue, cuz
it is dangerous, and phreaks shouldn't destroy MA's equipment, just
phuck it up. Look for this on your phavorite BBS or ask your
phavorite phreak for info if you really are serious about seriously
phucking some fones in some area.
blue box - An old piece of equipment that emulated a true operator
placing calls, and operators get calls for free. The blue box seizes
an open trunk by blasting a 2600 Hz tone through the line after
dialing a party that is local or in the 800 NPA so calls will be
local or free for the blue boxer. Then, when the blue boxer has
seized a trunk, the boxer may then, within the next 10-15 seconds,
dial another fone number via MF tones. These MF tones must be
preceded by a KP tone and followed with a ST tone. All of these
tones are standardized by Bell. The tones as well as the inter-digit
intervals are around 75ms. It may vary with the equipment used since
ESS can handle higher speeds and doesn't need inter-digit intervals.
There are many uses to a blue box, and we will not cover any more
here. See your local phreak or phreak oriented BBS for in depth info
concerning blue boxes and blue boxing. Incidentally, blue boxes are
not considered safe anymore because ESS detects "foreign" tones, such
as the 2600 Hz tone, but this detection may be delayed by mixing pink
noise of above 3000 Hz with the 2600 Hz tone. To hang up, the 2600 Hz
tone is played again. Also, all blue boxes are green boxes because MF
"2" corresponds to the Coin Collect tone on the green box, and the
"KP" tone corresponds to the Coin Return tone on the green box. See
green box for more information. Blue boxing is IMPOSSIBLE under the
new CCIS system slowly being integrated into the Bell system.
blue box tones - The MF tones generated by the blue box in order to
place calls, emulating a true operator. These dual tones must be
entered during the 10-15 second period after you have seized a
trunk with the 2600 Hz tone.
700: 1 : 2 : 4 : 7 : 11 : KP= Key Pulse
Parallel Frequencies 900: ** : 3 : 5 : 8 : 12 : ST= STop
2= Coin Collect 1100: ** : ** : 6 : 9 : KP : KP2= Key Pulse 2
KP= Coin Return 1300: ** : ** : ** : 10 :KP2 : **= None
(green box tones) 1500: ** : ** : ** : ** : ST :
: 900:1100:1300:1500:1700: 75ms pulse/pause
BLV - Busy Line Verification. Allows a TSPS operator to process a
customer's request for a confirmation of a repeatedly busy line.
This service is used in conjunction with emergency break-ins.
BNS - Billed Number Screening.
break period - Time when the circuit during pulse dialing is left
open. In the US, this period is 40ms; foreign nations may use 33ms
break periods.
break ratio - The interval pulse dialing breaks and makes the loop
when dialing. The US standard is 10 pulses per second. When the
circuit is opened, it is called the break interval. When the circuit
is closed, it is called the make interval. In the US, there is a
60ms make period and a 40ms break period. This is often referred to
as a 60% make interval. Many foreign nations have a 67% make interval.
bridge - I don't really understand this one, but these are important
phreak toys. I'll cover them more in the next issue of TPH.
British Post Office - The United Kingdom's equivalent to Ma Bell.
busy box - Box that will cause the fone to be busy, without taking it
OFF-HOOK. Just get a piece of fone wire with a plug on the end,
cut it off so there is a plug and about two inches of fone line.
Then, strip the wire so the two middle wires, the tip and the ring,
are exposed. Then, wrap the ring and the tip together, tape with
electrical tape, and plug into the fone jack. The fone will be busy
until the box is removed.
cans - Cans are those big silver boxes on top of or around the telephone
poles. When opened, the lines can be manipulated with a beige box
or whatever phun you have in mind.
calling card - Another form of the LD service used by many major LD
companies that composes of the customers fone number and a PIN
number. The most important thing to know when questioned about
calling cards are the area code and the city where the calling card
customer originated from.
CAMA - Centralized Automatic Message Accounting. System that records
the numbers called by fones and other LD systems. The recording can
be used as evidence in court.
CC - Calling Card.
CC - Credit Card.
CCIS - Common Channel Inter-office Signaling. New method being incorporated
under Bell that will send all the signaling information over separate
data lines. Blue boxing is IMPOSSIBLE under this system.
CCITT - The initials of the name in French of the International Telegraph
and Telephone Consultative Committee. At CCITT representatives of
telecommunications authorities, operators of public networks and
other interested bodies meet to agree on standards needed for
international intermarrying of telecommunications services.
CCS - Calling Card Service.
CCSS - Common Channel Signalling System. A system whereby all signalling
for a number of voice paths are carried over one common channel,
instead of within each individual channel.
CDA - Coin Detection and Announcement.
CF - Coin First. A type of fortress fone that wants your money before
you receive a dial tone.
Channel - A means of one-way transmission or a UCA path for electrical
transmission between two or more points without common carrier,
provided terminal equipment. Also called a circuit, line, link,
path, or facility.
cheese box - Another type of box which, when coupled with call forwarding
services, will allow one to place free fone calls. The safety of
this box is unknown. See references for information concerning text
philes on this box.
clear box - Piece of equipment that compromises of a telephone pickup
coil and a small amp. This works on the principal that all receivers
are also weak transmitters. So, you amplify your signal on PP
fortress fones and spare yourself some change.
CN/A - Customer Name And Address. Systems where authorized Bell employees
can find out the name and address of any customer in the Bell
System. All fone numbers are listed on file, including unlisted
numbers. Some CN/A services ask for ID#'s when you make a request.
To use, call the CN/A office during normal business hours, and say
that you are so and so from a certain business or office, related to
customers or something like that, and you need the customer's name
and address at (NPA)Nxx-xxxx. That should work. The operators to
these services usually know more than DA operators do and are also
susceptible to "social engineering." It is possible to bullshit a
CN/A operator for the NON PUB DA number and policy changes in the
CN/A system.
CO Code - Central Office code which is also the Nxx code. See Nxx for
more details. Sometimes known as the local end office.
conference calls - To have multiple lines inter-connected in order to
have many people talking in the same conversation on the fone at
once. See Alliance and switch crashing for more information.
credit operator - Same as TSPS operator. The operator you get when you
dial "0" on your fone and phortress fones. See TSPS for more
information.
CSDC - Circuit Switched Digital Capability. Another USDN service that
has no ISDN counterpart.
DA - Directory Assistance. See directory assistance.
DAO - Directory Assistance Operator. See directory assistance.
data communications - In telefone company terminology, data communications
refers to an end-to-end transmission of any kind of information
other than sound, including voice, or video. Data sources may be
either digital or analog.
data rate - The rate at which a channel carries data, measured in bits
per second, bit/s, also known as "data signalling rate."
data signalling rate - Same as "data rate." See data rate.
DCO-CS - Digital Central Office-Carrier Switch.
DDD - Direct Distance Dialed.
Dial-It Services - See 900 Services.
digital - A method to represent information to be discrete or individually
distinct signals, such as bits, as opposed to a continuously
variable analog signal.
digital transmission - A mode of transmission in which all information
to be transmitted is first converted to digital form and then
transmitted as a serial stream of pulses. Any signal, voice, data,
television, can be converted to digital form.
Dimension 2000 - Another LD service located at (800)848-9000.
directory assistance - Operator that you get when you call 411 or
NPA-555-1212. This call will cost $.50 per call. These won't know
where you are calling from, unless you annoy them, and do not have
access to unlisted numbers. There are also directory assistance
operators for the deaf that transfer BAUDOT. You can call these and
have interesting conversations. The fone number is 800-855-1155, are
free, and use standard Telex abbreviations such as GA for Go Ahead.
These are nicer than normal operators, and are often subject to
"social engineering" skills (bullshitting). Other operators also
have access to their own directory assistance at KP+NPA+131+ST.
diverter - This is a nice phreak tool. What a diverter is is a type of
call forwarding system done externally, apart from the fone company,
which is a piece of hardware that will foreword the call to
somewhere else. These can be found on many 24 hour plumbers, doctors,
etc. When you call, you will often hear a click and then ringing, or
a ring, then a click, then another ring, the second ring often sounds
different from the first. Then, the other side picks the fone up and
you ask about their company or something stupid, but DO NOT ANNOY
them. Then eventually, let them hang up, DO NOT HANG UP YOURSELF.
Wait for the dial tone, then dial ANI. If the number ANI reads is
different from the one you are calling from, then you have a
diverter. Call anywhere you want, for all calls will be billed to
the diverter. Also, if someone uses a tracer on you, then they trace
the diverter and you are safe. Diverters can, however, hang up on you
after a period of time; some companies make diverters that can be
set to clear the line after a set period of time, or click every once
in a while, which is super annoying, but it will still work.
Diverters are usually safer than LD extenders, but there are no
guarantees. Diverters can also be accessed via phortress fones. Dial
the credit operator and ask for the AT&T CREDIT OPERATOR. They will
put on some lame recording that is pretty long. Don't say anything
and the recording will hang up. LET IT HANG UP, DO NOT HANG UP. Then
the line will clear and you will get a dial tone. Place any call you
want with the following format: 9+1+NPA+Nxx+xxxx, or for local calls,
just 9+Nxx+xxxx. I'd advise that you call ANI first as a local call
to make sure you have a diverter.
DLS - Dial Line Service.
DNR - Also known as pen register. See pen register.
DOV - Data-Over-Voice.
DSI - Data Subscriber Interface. Unit in the LADT system that will
concentrate data from 123 subscribers to a 56k or a 9.6k
bit-per-second trunk to a packet network.
DT - Dial tone.
DTF - Dial Tone First. This is a type of fortress fone that gives you
a dial tone first.
DTI - Digital Trunk Interface.
DTMF - Dual-Tone-Multi-Frequency, the generic term for the touch tone.
These include 0,1,2,3,4,5,6,7,8,9 as well as A,B,C,D. See silver
box for more details.
DVM - Data Voice Multiplexor. A system that squeezes more out of a
transmission medium and allows a customer to transmit voice and data
simultaneously to more than one receiver over the existing telefone
line.
emergency break-in - Name given to the art of "breaking" into a busy
number which will usually result in becoming a third party in the
call taking place.
end office - Any class 5 switching office in North America.
end-to-end signalling - A mode of network operation in which the
originating central office, or station, retains control and signals
directly to each successive central office, or PBX, as trunks are
added to the connection.
ESS - Electronic Switching System. "The phreak's nightmare come true."
With ESS, EVERY SINGLE digit you dial is recorded, even mistakes.
The system records who you call, when you call, how long you
talked, and, in some cases, what you talked about. ESS is programed
to make a list of people who make excessive 800 calls or directory
assistance. This is called the "800 Exceptional Calling Report." ESS
can be programed to print out logs of who called certain numbers,
such as a bookie, a known communist, a BBS, etc. ESS is a series of
programs working together; these programs can be very easily changed
to do whatever the fone company wants ESS to do. With ESS, tracing
is done in MILLISECONDS and will pick up any "foreign" tones on the
line, such as 2600 Hz. Bell predicts the whole country will be on
ESS by 1990! You can identify an ESS office by the functions, such
as dialing 911 for help, fortress fones with DT first, special
services such as call forwarding, speed dialing, call waiting, etc.,
and ANI on LD calls. Also, black boxes and Infinity transmitters
will NOT work under ESS.
extender - A fone line that serves as a middleman for a fone call, such
as the 800 or 950 extenders. These systems usually require a multi-
digit code and have some sort of ANI to trace suspicious calls with.
facsimile - A system for the transmission of images. The image is scanned
at the transmitter, reconstructed at the receiving station, and
duplicated on some form of paper. Also known as a FAX.
FAX - See facsimile for details.
FiRM - A large cracking group who is slowly taking the place of PTL and
the endangered cracking groups at the time of this writing.
fortress phone - Today's modern, armor plated, pay fone. These may be
the older, 3 coin/coin first fones or the newer, 1 coin/DT first
fones. There are also others, see CF, DTF, and PP. Most phortresses
can be found in the 9xxx or 98xx series of your local Nxx.
gateway city - See ISC.
Gestapo - The telefone company's security force. These nasties are the
ones that stake out misused phortresses as well as go after those
bad phreaks that might be phucking with the fone system.
green base - A type of output device used by the fone company. Usually
light green in color and stick up a few feet from the ground. See
output device for more information.
green box - Equipment that will emulate the Coin Collect, Coin Return,
and Ringback tones. This means that if you call someone with a
fortress fone and they have a green box, by activating it, your
money will be returned. The tones are, in hertz, Coin Collect=700+
1100, Coin Return=1100+1700, and Ringback=700+1700. However, before
these tones are sent, the MF detectors at the CO must be alerted,
this can be done by sending a 900+1500 Hz or single 2600 Hz wink
of 90ms followed by a 60ms gap, and then the appropriate signal for
at least 900ms.
gold box - This box will trace calls, tell if the call is being traced,
and can change a trace.
grey box - Also known as a silver box. See silver box.
group chief - The name of the highest ranking official in any fone
office. Ask to speak to these if an operator is giving you trouble.
high-speed data - A rate of data transfer ranging upward from 10,000
bits per second.
H/M - Hotel/Motel.
ICH - International Call Handling. Used for overseas calls.
ICVT - InComing Verification Trunk.
IDA - Integrated Digital Access. The United Kingdom's equivalent of
ISDN.
IDDD - International Direct Distance Dialing - The ability to place
international calls direct without processing through a station.
Usually, one would have to place the call through a 011, station, or
a 01, operator assisted, type of setup.
IDN - Integrated Digital Networks. Networks which provide digital
access and transmission, in both circuit switched and packet modes.
in-band - The method of sending signaling information along with the
conversion using tones to represent digits.
INS - Information Network System. Japan's equivalent of ISDN.
Intercept - The intercept operator is the one you get connected to when
there are not enough recordings available to tell you that the
number has been disconnected or changed. These usually ask what
number you are calling and are the lowest form of the operator.
intermediate point - Any class 4X switching office in North America.
Also known as an RSU.
international dialing - In order to call across country borders, one must
use the format PREFIX + COUNTRY CODE + NATION #. The prefix in
North America is usually 011 for station-to-station calls or 01 for
operator-assisted calls. If you have IDDD, you don't need to place
this prefix in.
INTT - Incoming No Test Trunks.
INWARD - An operator that assists your local TSPS '0' operator in
connecting calls. These won't question you as long as the call is
within their service area. The operator can ONLY be reached by other
operators or a blue box. The blue box number is KP+NPA+121+ST for
the INWARD operator that will help you connect to any calls in that
area ONLY.
INWATS - Inward Wide Area Telecommunications Service. These are the 800