💾 Archived View for spam.works › mirrors › textfiles › 100 › bhbb1.hac captured on 2023-06-14 at 14:35:46.
-=-=-=-=-=-=-
Note to sysops: You are welcome to
download this file and use it on
your system, providing you DO NOT
remove the credits for Mark Tabas
or KAOS. In other words, try to act
like a human being!
--------------------------------------
The Mark Tabas encounter
series presents:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Better Homes and Blue Boxing
Part I
Theory of Operation
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
To quote Karl Marx, blue boxing has
always been the most noble form of
phreaking. As opposed to such things
as using an MCI code to make a free
fone call, which is merely mindless
pseudo-phreaking, blue boxing is
actual interaction with the Bell
System toll network. It is likewise
advisable to be more cautious when
blue boxing, but the careful phreak
will not be caught, regardless of what
type of switching system he is under.
In this part, I will explain how and
why blue boxing works, as well as
where. In later parts, I will give
more practical information for blue
boxing and routing information.
To begin with, blue boxing is simply
communicating with trunks. Trunks must
not be confused with subscriber lines
(or "customer loops") which are
standard telefone lines. Trunks are
those lines that connect central
offices. Now, when trunks are not in
use (i.e., idle or "on-hook" state)
they have 2600Hz applied to them. If
they are two-way trunks, there is
2600Hz in both directions. When a
trunk IS in use (busy or "off-hook"
state"), the 2600Hz is removed from
the side that is off-hook. The 2600Hz
is therefore known as a supervisory
signal, because it indicates the
status of a trunk; on hook (tone) or
off-hook (no tone). Note also that
2600Hz denoted SF (single frequency)
signalling and is "in-band." This is
very important. "In-band" means that
is is within the band of frequencies
that may be transmitted over normal
telefone lines. Other SF signals, such
as 3700Hz are used also. However, they
cannot be carried over the telefone
network normally (they are "out-of-
band") and are therefore not able to
be taken advantage of as 2600Hz is.
Back to trunks. Let's take a
hypothetical phone call. You pick up
your fone and dial 1+806-258-1234
(your good friend in Armarillo,
Texas). For ease, we'll assume that
you are on #5 Crossbar switching and
not in the 806 area. Your central
office (CO) would recognize that
806 is a foreign NPA, so it would
route the call to the toll centre
that serves you. [For the sake of
accuracy here, and for the more
experienced readers, note that the
CO in question is a class 5 with
LAMA that uses out-of-band SF
supervisory signalling]. Depending
on where you are in the country, the
call would leave your toll centre
(on more trunks) to another toll
centre, or office of higher "rank".
Then it would be routed to central
office 806-258 eventually and the
call would be completed. Illustration:
A---CO1-------TC1------TC2----CO2----B
A=you CO1=your central office
TC1=your toll office.
TC2=toll office in Amarillo.
CO2=806-258 central office.
B=your friend (806-258-1234)
In this situation it would be
realistic to say that CO2 uses SF
in-band (2600Hz) signalling, while
all the others use out-of-band
signalling (3700Hz). If you don't
understand this, don't worry too much.
I am pointing this out merely for the
sake of accuracy. The point is that
while you are connected to 806-258-
1234, all those trunks from YOUR
central office (CO1) to the 806-258
central office (CO2) do *NOT* have
2600Hz on them, indicating to the
Bell equipment that a call is in
progress and the trunks are in use.
Now let's say you're tired of
talking to your friend in Amarillo
(806-258-1234) so you send a 2600Hz
down the line. This tone travels down
the line to your friend's central
office (CO2) where it is detected.
However, that CO thinks that the
2600Hz is originating from Bell
equipment, indicating to it that
you've hung up, and thus the trunks
are once again idle (with 2600Hz
present on them). But actually, you
have not hung up, you have fooled the
equipment at your friend's CO into
thinking you have. Thus,it disconnects
him and resets the equipment to
prepare for the next call. All this
happens very quickly (300-800ms for
step-by-step equipment and 150-400ms for other equipment).
When you stop sending 2600Hz (after
about a second), the equipment thinks
that another call is coming towards
it (e.g. it thinks the far end has
come "off-hook" since the tone has
stopped. It could be thought of as a
toggle switch: tone --> on hook, no
tone -->off hook. Now that you've
stopped sending 2600Hz, several things
happen:
1) A trunk is seized.
2) A "wink" is sent to the CALLING end
from the CALLED end indicating that
the CALLED end (trunk) is not ready to
receive digits yet.
3) A register is found and attached
to the CALLED end of the trunk within
about two seconds (max).
4) A start-dial signal is sent to the
CALLING end from the CALLED end
indicating that the CALLED end is
ready to receive digits.
Now, all of this is pretty much
transparent to the blue boxer. All he
really hears when these four things
happen is a <beep><kerchunk>. So,
seizure of a trunk would go something
like this:
1> Send a 2600Hz
2> Terminate 2600Hz after 1-2 secs.
3> [beep][kerchunk]
Once this happens, you are connected
to a tandem that is ready to obey your
every command. The next step is to
send signalling information in order
to place your call. For this you must
simulate the signalling used by
operators and automatic toll-dialing
equipment for use on trunks. There
are mainly two systems, DP and MF.
However, DP went out with the dinosaur
, so I'll only discuss MF signalling.
MF (multi-frequency) signalling is the
signalling used by the majority of the
inter- and intra-lata network. It is
also used in international dialing
known as the CCITT no.5 system.
MF signalling consists of 7 frequen-
cies, beginning with 700Hz and
separated by 200Hz. A different set of
two of the 7 frequencies represent the
digits 0 thru 9, plus an additional 5
special keys. The frequencies and uses
are as follows:
Frequencies (Hz) Domestic Int'l
--------------------------------------
700+900 1 1
700+1100 2 2
900+1100 3 3
700+1300 4 4
900+1300 5 5
1100+1300 6 6
700+1500 7 7
900+1500 8 8
1100+1500 9 9
1300+1500 0 0
700+1700 ST3p Code 11
900+1700 STp Code 12
1100+1700 KP KP1
1300+1700 ST2p KP2
1500+1700 ST ST
The timing of all the MF signals is
a nominal 60ms, except for KP, which
should have a duration of 100ms. There
should also be a 60ms silent period
between digits. This is very flexible,
however, and most Bell equipment will
accept outrageous timings.
In addition to the standard uses
listed above, MF pulsing also has
expanded usages known as "expanded
inband signalling" that include such
things as coin collect, coin return,
ringback, operator attached, and
operator released. KP2, code 11, and
code 12 and the ST_ps (STart "primes")
all have special uses which will be
mentioned only briefly here.
To complete a call using a blue box,
once seizure of a trunk has been
accomplished by sending 2600Hz and
pausing for the <beep><kerchunk>, one
must first send a KP. This readies the
register for the digits that follow.
For a standard domestic call, the KP
would be followed by either 7 digits
(if the call were in the same NPA as
the seized trunk) or 10 digits (if the
call were not in the same NPA as the
seized trunk). [Exactly like dialing a
normal fone call]. Following either
the KP and 7 or 10 digits, a STart is
sent to signify that no more digits
follow. Example of a complete call:
1> Dial 1-806-258-1234
2> wait for a call-progress
indication (such as ring, busy,
recording, etc.)
3> Send 2600Hz for about 1 second.
4> Wait for about 2 seconds while a
trunk is seized.
5> Send KP+305+994+9966+ST
The call will then connect if every-
thing was done properly. Note that if
a call to an 806 number were being
placed in the same situation, the area
code would be omitted and only KP+
seven digits+ST would be sent.
Code 11 and code 12 are used in
international calling to request
certain types of operators. KP2 is
used in international calling to route
a call other than by way of the normal
route, whether for economic or
equipment reasons.
STp, ST2p, and ST3p (prime, two
prime, and three prime) are used in
TSPS signalling to indicate calling
type of call (such as coin-direct
dialed).
This has been Part I of Better
Homes and Blue Boxing. I hope you
enjoyed and learned from it. If you
have any questions, comments, threats
or insults, please fell free to drop
me a line. If you have noticed any
errors in this text (yes, it does
happen), please let me know and
perhaps a correction will be in order.
Part II will deal mainly with more
advanced principles of blue boxing,
as well as routings and operators.
Note 1: other highly trunkable
areas include: 816,305,813,609,205.
I personally have excellent luck
boxing off of 609-953-0000. Try that
if you have any trouble.
......................................
(c) January 7, 1985 Mark Tabas
......................................
$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$
----------------------
: Written for: :
: :
: K.A.O.S. :
: :
: at :
: :
: 215-xxx-xxxx :
: :
----------------------