diff --git a/textfiles.com/100/basicom4.phk b/textfiles.com/100/basicom4.phk new file mode 100644 index 00000000..564bdd36 --- /dev/null +++ b/textfiles.com/100/basicom4.phk @@ -0,0 +1,410 @@ +File: BASIC TELCOM IV + Read 66 times + +******BIOC Agent 003's course in******* +* * +* ========================== * +* =BASIC TELECOMMUNCIATIONS= * +* ========================== * +* PART IV * +*************************************** + +Revised: 15-JUN-84 + +PREFACE: +-------- + +Part IV will deal with the various types of operators, office hierarchy, & +switching equipment. + + +OPERATORS: +---------- + +There are many types of operators in The Network and the more common ones +will be discussed. + +TSPS Operator: + +The TSPS [(Traffic Service Position System) as opposed to This Shitty Phone Service] Operator is probably the bitch (or bastard for the phemale +liberationists) that most of us are use to having to deal with. + +Here are her responsibilities: + +1) Obtaining billing information for Calling Card or 3rd number calls. + +2) Identifying called customer on person-to-person calls. + +3) Obtaining acceptance of charges on collect calls. + +4) Identifying calling numbers. This only happens when the calling # is not + automatically recorded by CAMA (Centralized Automatic Message Accounting) & + forwarded from the local office. This could be caused by equipment failures + (ANIF - Automatic Number Identification Failure) or if the office is not + equipped for CAMA (ONI - Operator Number Identification). + + + +You shouldn't mess with the TSPS operator since she KNOWS where you are calling +from. Your number will show up on a 10-digit LED read-out (ANI board) She also + knows whether or not you are at a fortress fone & she can trace calls quite +readily. Out of all the operators, she is one of the MOST DANGEROUS. + +INWARD Operator: + +This operator assists your local TSPS ("O") operator in connecting calls. She +will never question a call as long as the call is within HER SERVICE AREA. +She can only be reached via other operators or by a Blue Box. From a BB, +you would dial KP+NPA+121+ST for the INWARD operator that will help you connect +any calls within that NPA only. (Blue Boxing will be discussed in a future part +of BASIC TELCOM) + +DIRECTORY ASSISTANCE Operator: + +This is the operator that you are connected to when you dial: 411 or +NPA-555-1212. She does not readily know where you are calling from. She does +not have access to unlisted #'s, but she does know if an unlisted # exists for +a certain listing. + +There is also a directory assistance for deaf people who use Teletypewriters +If your modem can transfer BAUDOT [(45.5 baud)/ (the Apple Cat can)], then you +can call him/her up and have an interesting conversation. The # is: +800-855-1155. They uses the standard Telex abbreviations such as GA for Go +Ahead. They tend to be nicer & will talk longer than your regular operators. +Also, they are more vulnerable into being talked out of information through the +process of "social engineering" as Cheshire Catalyst would put it. + + + +Other operators have access to their own DA by dialing KP+NPA+131+ST (MF). + +In the confusion due to the aftermath of the Bell System break-up, it seems +that it will now cost 50 cents per DA call! Exceptions seem to be Canadian +DA & the TTY DA (for the time being). Thus you might be able to avoid being +charged for DA calls by using your computer [running at 45.5 baud!] and their +800 TOLL-FREE #! If they decide to charge from fortresses also, the method of +making DA calls from the fortress and purposely asking for an unlisted # so you +can have the operator credit you home # will no longer work! + + +CN/A Operators: + +CN/A operators are operators that do exactly the opposite of what directory +assistance operators are for. See part II, for more info on CN/A & #'s. In my +experiences, these operators know more than the DA op's do & they are more +susceptible to "social engineering." It is possible to bullshit a CN/A operator +for the NON-PUB DA # (ie, you give them the name & they give you the unlisted +#). This is due to the fact that they assume your are a phellow company +employee. Unfortunately, the break-up has resulted in the break-up of a few +NON-PUB #'s and policy changes in CN/A. + +INTERCEPT Operator: + +The intercept operator is the one that you are connected to when there are not +enough recordings available to tell you that the # has been disconnected or +changed. She usually says, "What # you callin'?" with a foreign accent. This +is the lowest operator lifeform. Even though they don't know where you are +calling from, it is a waste of your time to try to verbally abuse them since +they usually understand very little English. + +Incidentally, a few areas do have intelligent intercept operators. + +OTHER Operators: + +And then there are the: Mobile,Ship-to-Shore, Conference, Marine Verify, +"Leave Word & Call Back," Rout & Rate (KP+800+141+1212+ST - new # as result of +Bell breakup), & other special operators who have one purpose or another in the + Network. + +Problems with an Operator? Ask to speak to their supervisor...or better yet, +the Group Chief (who is the highest ranking official in any office) who is the +equivalent of the Madame in a whorehouse (if you will excuse the analogy). + +By the way, some CO's that will allow you to dial a 1 or 0 as the 4th digit, +will also allow you to call special operators & other phun Telco #'s without a +blue box. This is very rare though! For example, 212-121-1111 will get you a +NY Inward Operator. + + +================== +=OFFICE HIERARCHY= +================== + +Every switching office in North America (the NPA system), is assigned an office +name & class. There are five classes of offices numbered 1 through 5. Your +CO is most likely a class 5 or end office. All Long-Distance (Toll) calls +are switched by a toll office which can be a class 4, 3, 2, or 1 office. There +is also a 4X office called an intermediate point. The 4X office is a digital +one that can have an unattended exchange attached to it (known as a Remote +Switching Unit-RSU). + +The following chart will list the Office #, name, & how many of those offices +existed in North America in 1981. + +Class Name Abb # Existing +----- ---------------- --- ------------ + 1 Regional Center RC 12 + 2 Sectional Center SC 67 + 3 Primary Center PC 230 + 4 Toll Center TC 1,300 + 4P Toll Point TP + 4X Intermediate Pt IP + 5 End Office EO 19,000 + R RSU RSU + +When connecting a call from one party to another,the switching equipment +usually tries to find the shortest route between the Class 5 end office of +the caller & the Class 5 end office of the called party. If no inter-office +trunks exist between the 2 parties, it will then move upto the next highest +office for servicing (Class 4). If the Class 4 office cannot handle the call +by sending it to another Class 4 or 5 office, it will be sent to the next +office in the hierarchy (3). The switching equipment first uses the high-usage + interoffice trunk groups, if they are busy it then goes to the final trunk +groups on the next highest level. If the call cannot be connected then, you +will probably get a re-order [120 IPM (Interruptions Per Minute) busy signal] +signal. At this time, the guys at Network Operations are probably shitting in +their pants and trying to avoid the dreaded Network Dreadlock (as seen on TV!). + +It is also interesting to note that 9 connections in tandem is called +ring-around-the rosy and it has never occurred in telephone history. This +would cause an endless loop connection. [a neat way to really screw-up the +Network] + +The 10 regional centers in the US & the 2 in Canada are all interconnected. +They form the foundation of the entire telephone network. Since there are +only 12 of them, they are listed below: + +Class 1 Regional Office Location NPA +---------------------------------- --- +Dallas 4 ESS 214 +Wayne, PA 215 +Denver 4T 303 +Regina No.2 SP1-4W [Canada] 306 +St. Louis 4T 314 +Rockdale, GA 404 +Pittsburgh 4E 412 +Montreal No.1 4AETS [Canada] 504 +Norwich, NY 607 +San Bernardino, CA 714 +Norway, IL 815 +White Plains 4T, NY 914 + +The following diagram demonstrates how the various offices may be connected: + + ^----------^----------^ Regional + _!_ _!_ _!_Offices + ~~~~~!1! <----> !1! <----> !1!~~~~~ + --- --- --- + ! Others\/ + -^-------^-------^------^---------^ + _!_ _!_ _!_ _!__ _!_ + !2! !3! !4! !4P! !5! + --- --- --- -^^- --- + ! ! ! ! + ^----^ ! ^----^ ! + _!_ _!_ ! __!_ _!_ ! + !3! !4! ! !4X! !5! ^-----^ + --- -^- ! ---- --- _!__ _!_ + ^ ! !4X! !5! + __!_ ! ---- --- + !5R! !-------------^ + -^^- /--------!---------\ + _!_ _!__ _!_ _!_ + !R! !4P! !4! !5! + --- ---- --- --- + + +===================== +=SWITCHING EQUIPMENT= +===================== + +In the Network, there are 3 major types of switching equipment. They are known +as: Step, Crossbar, & ESS. + + +STEP-BY-STEP (SxS) + +The Step-By-Step, a/k/a the Strowger switch or two-motion switch, was invented +in 1889 by an undertaker named Almon Strowger. He invented this mechanical +switching equipment because he felt that the biased operator was routing all +requests for an 'undertaker' to her husband's business. + +Bell started using this system in 1918 & as of 1978, over 53% of the Bell +exchanges used this method of switching. This figure is probably substantially +less now. + +Step-by-Step switching is controlled directly by the dial pulses which move +a series of switches (called the switch train) in order. When you first pick +up the fone under SxS, a linefinder acknowledges the request (sooner or later) +by sending a dial tone. If you then dialed 1234, the equipment would first +find an idle selector switch. It would then move vertically 1 pulse, it +would then move horizontally to find a free second selector, it would then +move 2 vertical pulses, step horizontally to find the next selector, etc. Thus +the first switch in the train takes no digits, the second switch takes 1 digit, +the third switch takes 1 digit, & the last switch in the train (called the +connector) takes the last 2 digits & connects your calls. A normal (10,000 +line) exchange requires 4 digits (0000-9999) to connect a local call & thus it +takes 4 switches to connect every call (linefinder, 1st & 2nd selectors, & the +connector) . + +While it was the first, SxS sucks for the following reasons: + +[1] The switches often become jammed thus the calls often become blocked. + +[2] You can't use DTMF (Dual-Tone Multi-Frequency a/k/a Touch-Tone) directly. +It is possible that the Telco may have installed a conversion kit but then the +calls will go through just as slow as pulse, anyway! + +[3] They use a lot of electricity & mechanical maintenance. (bad from Telco +point of view) + +[4] Everything is hardwired. + +They can still hook up pen registers & other shit on the line so it is not +exactly a phreak haven. + +You can identify SxS offices by: + +(1) Lack of DTMF or pulsing digits after dialing DTMF. + +(2) If you go near the CO, it will sound like a typewriter testing factory. + +(3) Lack of speed calling, call forwarding, & other custom services. + +(4) Fortress fones that want your money first (as opposed to dial tone first +ones). + +The preceding don't necessarily imply that you have SxS but they surely give +evidence that it might be. Also, if any of the above characteristics exist, +it certainly isn't ESS! Also, SxS have pretty much been eradicated from large +metropolitan areas such as NYC (212). + + +CROSSBAR: + +There are 3 major types of Crossbar systems called: No. 1 Crossbar (1XB), +No. 4 Crossbar (4XB), & No. 5 Crossbar (5XB). 5XB has been the primary end +office switch of Bell since the 60's and thus it is in wide-use. There is +also a Crossbar Tandem (XBT) used for toll-switching. + +Crossbar uses a common control switching method. When there is an incoming +call, a stored program determines its route through the switching matrix. + +In Crossbar, the basic operation principle is that a horizontal & a vertical +line are energized in a matrix known as the crosspoint matrix. The point where +these 2 lines meet in the matrix is the connection. + + ++===+ +=ESS= ++===+ + + Electronic Switching System (ESS) + The Phreak's Nightmare Come True + (or Orwell's Prophecy as 2600 puts it) + + +ESS is Bell's move towards the Airstrip One society depicted in Orwell's 1984. + +With ESS, EVERY single digit that you dial is recorded--even if it is a +mistake. They know who you call, when you call, how long you talked for, & +probably what you talked about (in some cases). ESS can (and is) also +programmed to print out #'s of people who make excessive calls to 800 #'s or +directory assistance. This is called the "800 Exceptional Calling Report." +ESS could also be programmed to print out logs of who calls certain #'s--like +a bookie, a known communist, a BBS, etc The thing to remember with ESS is that +it is a series of programs working together. These programs can be very +easily changed to do whatever they want it to do. This system makes the job of +Bell Security, the FBI, NSA, & other organizations that like to invade privacy +incredibly easy. + +With ESS, tracing is done in microseconds (Eine Augenblick) & the results are +printed at the console of a Bell Gestapo officer. ESS will also pick up any +"foreign" tones on the line such as 2600 Hz! + +Bell predicts that the country will become totally ESS by the 1990's. + +You can identify ESS by the following which are usually ESS functions: + +[1] Dialing 911 for help. +[2] Dial-Tone-First fortresses. +[3] Custom Calling Services such as: Call Forwarding, Speed Dialing, & Call + Waiting. (Ask your business office if you can get these.) +[4] ANI (Automatic Number Identification) on LD calls. + +Phreaking does not come to a complete halt under ESS though--just be very +careful, though!!! + +Due to the fact that ESS has a computer generated "artificial" ring, you are +not directly connected to the called parties line until he picks up. Therefore, +Black Boxes & Infinity Transmitters will not work under ESS! + +NOTE: Another interesting way to find out what type of equipment you are on is + to raid the trash can of you local CO--this art will discussed in a + separate article soon. Asking for a tour of your CO for a "school + report" can also be helpful. + +Coming Soon: + +In the part V, we will start to take a look at telephone electronics. + +Further Reading: + +For more information on the above topics, I suggest the following: + +Notes on the Network, AT&T, 1980. + +Understanding Telephone Electronics,Texas Instruments, 1983. + +And subscriptions to: + +TAP, Room 603, 147 W 42 St, New York,NY 10036. Subscriptions are $10/year. +Back issues are $0.75. The current issues is #90 (Jan/Feb 1984) + +2600, Box 752, Middle Island, NY 11953. Subscriptions are $10/year. Back +issues are $1 each. The current issue is #6 (June 1984). + +They are both excellent sources of all sorts of information (primarily +phreaking/hacking). + +NOTE: For the most part, I have assumed that you have read my previous 3 + courses in the BASIC TELCOM series. + +Excelsior, + +*****BIOC +*=$=*Agent +*****003 + Knights of Shadow + + April 13, 1984 + {The Year of Big Brother} + + <<=-FARGO 4A-=>> + + + [ RACS III - (914) 942-2638 ] +[ Sherwood Forest ][ - (914) 359-1517 ] + +PS Sysops of other BBS's are welcome to use this series on their own boards + providing that you don't change anything. + +PPS Due to the radical changes taking place in the Network due to the break up + this January, I have been forced to make many revisions of certain parts of + my BASIC TELCOM series. If something does not seem right, please keep the + current revision date in mind. I have tried to keep this series as current + as possible. + +Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open + \ No newline at end of file diff --git a/textfiles.com/100/basicom5.phk b/textfiles.com/100/basicom5.phk new file mode 100644 index 00000000..fa7e49d7 --- /dev/null +++ b/textfiles.com/100/basicom5.phk @@ -0,0 +1,385 @@ +File: BASIC TELCOM V + + *******BIOC Agent 003's course in****** + * * + * ========================== * + * =BASIC TELECOMMUNICATIONS= * + * ========================== * + * PART V * + *************************************** + +Revised: 08-AUG-84 + +PREFACE: + +Previous installments of this series here focused on telephony from a Network +point-of-view. Part V will deal with telephone electronics focusing primarily +on the subscriber's telephone. Hereinafter simply referred to as "fone." + +Wiring: +------- + +Assuming a standard one-line fone, there are usually 4 wires that lead out of +the fone set. These are standardly colored red, green, yellow, & black. The +red & green wires are the two that are actually hooked up to your CO. The +yellow wire is sometimes used to ring different fones on a party line (ie, one +#, several families--found primarily in rural areas where they pay less for the +service and they don't use the fone as much); otherwise, the yellow is usually +just ignored. On some two-line fones, the red & green wires are used for the +first fone # and the yellow & black are used for the second line. In this case +there must be an internal or external device that switches between the two +lines and provides a hold function. (Such as Radio Shack's outrageously priced +2 line & hold module). + +In telephony, the green & red wires are often referred to as tip (T) & ring +(R), respectively. The tip is the more positive of the two wires. This naming +goes back to the old operator cord boards where one of the wires was the tip of +the plug and the other was the ring (of the barrel). + +A rotary fone (aka dial or pulse) will work fine regardless of whether the red +(or green) wire is connected the tip(+) or ring(-). A touch-tone (TM) fone is +a different story, though. It will not work except if the tip(+) is the green +wire. [Although, some of the more expensive DTMF fones do have a bridge +rectifier which compensates for polarity reversal.] This is why under certain +(non-digital) switching equipment you can reverse the red & green wires on a +touch-tone fone and receive free DTMF service. Even though it won't break dial +tone, reversing the wires on a rotary line on a digital switch will cause the +tones to be generarted. + +Voltages, Etc. +-------------- + +When your telephone is on-hook (ie, hung up) there is approximately 48 volts of +DC potential across the tip & ring. When the handset of a fone is lifted a few +switches close which cause a loop to be connected (known as the "local loop") +between your fone & the CO. Once this happens DC current is able to flow +through the fone with less resistance. This causes a relay to energize which +causes other CO equipment to realize that you want service. Eventually, you +should end up with a dial tone. This also causes the 48 VDC to drop down into +the vicinity of 12 volts. The resistance of the loop also drops below the 2500 +ohm level, though FCC licensed telephone equipment must have an off-hook +impedance of 600 ohms. As of now, you ahands of our "friends" at D&B. To say +the least, they weren't exactly thrilled about it. In fact, they did not +even believe that they had a security problem! (Well, that just goes +to prove that if you are good, no one knows that you are there!) + + In a big effort to defeat us, they called in an outside service to +spruce up their "security." Well, fortunately for us, we were able to +find out about the new system! (Which wasn't really a problem. First, +they had the new dial-ups when you logged on, and as always they have a +nice little place on Telenet! (Where we do most of our work: C 20188). + + Now, they have set up a new system they like to call DunsNet. +They are trying to pass it off as a ectionately call this mute a black box. + +the following are instructions on how to build a simple black box. Of course, +anything that prevents the voltage from dropping would work. + +You only need two parts: A SPST toggle switch and a 10,000 ohm (10 K), 1/2 +watt resistor. Any electronics store should stock these parts. + +Now, cut 2 pieces of wire (about 6 inches long) and attach one end of each wire +to one of the terminals on the switch. Now turn your K500 (standard desk fone) +upside down and take off the cover. Locate wire (disconnect it from its +terminal). Now bring the switch out the rear of the fone and replace the +cover. + +Put the switch in a position where you receive a dial tone. Mark this position +NORMAL. Mark the other side FREE. + +When your phriends call (at a prearranged time), quickly lift & drop the +receiver as fast a possible. This will stop the ringing (do it again if it +doesn't) with out starting the billing. It is important that you do +it quickly (less than 1 second). Then put the switch in the FREE position and +pick up the fone. Keep all calls short and preferrably under 15 minutes. + +NOTE: If someone picks up an extension in the called parties house and + that fone is not set for FREE then billing will start. + +NOTE: An old way of signalling a phriend that you are about to call is making + a collect call to a non-existant person in the house. Since your friend + will not accept the charges, he will know that you are about to call + and thus prepare the black box (or visa versa). + +WARNING: The Telco can detect black boxes if they suspect one on your line. + This is done due to the presence of AC voice signal at the wrong DC + level! + +Pictoral Diagram: +(Standard Rotary K500 fone) +--------------------------------------- +! ! +***BLUE WIRE**>>F< ! +! * * ! +**WHITE WIRE** * ! +! * ! +! RESISTOR ! +! * ! +! * ! +! >RR<*******SWITCH**** ! +! * ! +****GREEN WIRE********************** ! +! ! +--------------------------------------- + +NOTE: The Black Box will not work under ESS or other similar digital switches + since ESS does not connect the voice circuits until the fone is picked + up (& billing starts). Instead, ESS uses an "artificial" computer + generated ring. + +Ringing: +-------- + +To inform a subscriber of an incoming call, the Telco sends 90 volts (PK) of +pulsing DC down the line (at around 15 to 60 Hz; usually 20 Hz). In most fones +this causes a metal armature to be attracted alternately between two +electro-magnets thus striking 2 bells. of course, the standard bell (patented +in 1878 by Tom A. Watson) can be replaced by a more modern electronic bell or +signaling device. + +Also, you can have lights and other similar devices in lieu of (or in +conjunction with) the bell. A simple neon light (with its corresponding +resistor) can simply be connected between the red & green wires (usually L1 & +L2 on the network box) so that it lights up on incoming calls. + +WARNING: 90 VDC can give quite a shock. Exercise extreme caution if you wish + to further persue these topics. + +Also included in the ringing circuit is a capacitor tbig savings of time since +the hassle of using a a time shared public network does not exist. We're +sure that Mr. J.W.P. of DUNSPRINT had more on his mind when he wrote the +letter (on the system)! DunsNet is accessible from a regular dial-up. We +have not been able to get a number yet for this system, but once on it +allegedly works just like Telenet! Two carriage returns and you will see +"DunsNet" then the familiar "@" symbol. To use the system like we showed +you, type "RPTS" at thiup to drop a trouble card for long periods of ringing +then a "no-no" detection device may be placed on the line. + +Incidentally, the term "ring trip" refers to the CO process involved to stop +the AC ringing signal when the calling fone goes off hook. + +NOTE: It is suggested that you actually dissect fones to help you better + understand them. It will also help you to better understand the concepts + here if you actually prove them to yourself. For example, actually + take the voltage readings on your fone line [any simple + multi-tester (a must) will do.] Phreaking is an interactive + process not a passive one! + +Dialing: +-------- + +On a standard fone, there are two common types of dialing: pulse & DTMF. Of +course, some people insist upon being different and don't use the DT thus +leaving them with MF (Multi Frequncy, aka operator, blue box) tones. This is +another "no-no" and the Telco Security gentelmen have a special knack for +dealing with such "phreaks" on the network. + +When you dial rotary, you are actually rapidly breaking & reconnecting +(breaking & making) the local loop once for each digit dialed. Since the +physical connection must be broken, you cannot dial if another extension (of +that #) is off-hook. Neither of the fones will be able to dial pulse unless +the other hangs up. + +Another term often referred to in telephone electronics is the break ratio. In +the US, the standard is 10 pulses per second. When the circuit is opened it is +called the break interval. When it is closed it is called the make interval. +In the US, there is a 60 millisecond (ms) make period and a 40 ms break period. +(60+40=100 ms = 1/10 second). This is referred to as a 60% make interval. +Some of the more sophisticated electronic fones can switch between a 60% & a +67% make interval. This is due to the fact that many foreign nations use a 67% +break interval. + +Have you ever been in an office or a similar facility and saw a fone waiting +to be used for a free call but some asshole put a lock on it to prevent +outgoing calls? + +Well, don't fret phellow phreaks, you can simulate pulse dialing by rapidly +depressing the switchook. (If you depress it for longer than a second it will +be construed as a disconnect.) By rapidly switchooking you are causing the +local loop to be broken & made similar to rotary dialing! Thus if you can +manage to switchook rapidly 10 times you can reach an operator to place any +call you want! This takes alot of practice, though. You might want to +practice on your own fone dialing a friend's # or something else. Incidentally, +this method will also work with DTMF fones since all DTMF lines can also handle +rotary. + +Another problem with pulse dialing is that it produces high-voltage spikes that +make loud clicks in the earpiece and cause the bell to "tinkle." If you never +noticed this then your fone has a special "anti-tinkle" & earpiece shorting +circuit (most do). If you have ever dissected a rotary fone (a must for any +serious phreak) you would have noticed that there are 2 sets of contact that +open and close during pulsing (on the back of the rotary dial under the plastic +cover). One of these actually opens and closes the loop while the other mutes +the earpiece by shorting it out. The second contacts also activates a special +anti-tinkle circuit that puts a 340 ohm resistor across the ringing circuit +which prevents the high voltage spikes from interferring with the bell. + +Dual Tone Multi Frequency (DTMF) is a modern day improvement on pulse dialing +in several ways. First of all, it is more convenient for the user since it +is faster and can be used for signaling after the call is completed (ie, SCC's, +computers, etc.). Also, it is more up to par with modern day switching +equipment (such as ESS) since pulse dialing was designed to actually move +relays by the number of digits dialed (in SxS offices). + +Each key on a DTMF keypad produces 2 frequencies simultaneously (one from the +high group and another from the low group). + + ------------------------- +Low Group ! Q ! ABC ! DEF ! ! + 697 Hz-! 1 ! 2 ! 3 ! A ! + ! ! ! ! ! + !-----!-----!-----!-----! + ! GHI ! JKL ! MNO ! ! + 770 Hz-! 4 ! 5 ! 6 ! B ! + ! ! ! ! ! + !-----!-----!-----!-----! + ! PRS ! TUV ! WXY ! ! + 852 Hz-! 7 ! 8 ! 9 ! C ! + ! ! ! ! ! + !-----!-----!-----!-----! + ! ! OPER! ! ! + 941 Hz-! * ! 0 ! # ! D ! + ! ! Z ! ! ! + !-----!-----!-----!-----! + 1209 1336 1477 1633 + (High Group--in Hz) + +A portable DTMF keypad is known as a white box. + +The fourth column (1633 Hz) is not normally found on regular fones but it +does have several special uses. For one, it is used to designate the priority +of calls on AUTOVON, the military fone network. These key are called: Flash, +Immediate, Priority, & Routine (with variations) instead of ABCD. Secondly, +these keys are used for testing purposes by the Telco. In some area you can +find loops as well as other neat tests (see Part II) on the 555-1212 directory +assistance exchange. For this, you would call up an DA in certain areas [that +have an Automatic Call Distributor (ACD)] and hold down the "D" key which +should blow the operator off. You will then hear a pulsing dial tone which +indicates that you are in the ACD internal testing mode. You can get on one +side of a loop by dialing a 6. The other side is 7. Some phreaks claim that +if the person on side 6 hangs up, occasionally the equipment will screw up and +start directing directory assistance calls to the other side of the loop. +Another alleged test is called REMOB which allows you to tap into lines by +entering a special code followed by the 7 digit number you want to monitor. +Then there is the possibility of mass conferencing. + +ACD's are become rare though. You will probably have to make several NPA-555- +1212 calls before you find one. + +You can modify regular fones quite readily so that they have a switch to change +between the 3rd and 4th columns. This is called a silver box (aka grey box) and +plans can be found in Tap as well as on many BBS's. + +Transmitter/Receiver: +--------------------- + +When you talk into the transmitter, the sound waves from your voice cause a +diaphragm to vibrate and press against the carbon granules (or another similar +substance). This causes the carbon granules to compress and contract thus +changing the resistance of the DC coupled path through it. Therefore, your AC +voice signal is superimposed over the DC current of the local loop. The +receiver works in a similar fashion where the simple types utilize a +magnet, armature, & diaphragm. + +Hybrid/Induction Coil: +---------------------- + +As you may have noticed, there are two wires for the receiver and two for the +transmitter in the fone, yet the local loop consists of 2 wires instead of 4. +This 4-wire to 2-wire conversion is done inside the fone by a device known as +an induction coil which uses coupling transformers. All of the internal Telco +trunks also use 4 wires. It is only the local loop that uses 2 since it is +cheaper. A device in the CO known as a hybrid converts between 4 and 2 wire +set-ups similar to the induction coil inside the fone. Special data +transmission lines require extremely low signal to noise ratios, they require +the full four wires--two for transmission and two for receiving (even on the +local loop). + +Miscellaneous: +-------------- + +In the telephone, there is also a balancing network consisting of a few +capacitors & resistors which provide sidetone. Sidetone allows the caller to +hear his own volume in the receiver. He can then adjust his voice accordingly. +This prevents people from shouting or speaking too softly without noticing it. + +Hold: + +When a telephone goes off hook, the resistance drops below 2500 ohms. At this +point, the Telco will send a dial tone. To put someone on hold you must put a +1000 ohm resistor (1 watt) across the Tip & Ring before it reaches the +switchook. In this way, when the fone is hung up (for hold) the resistance +remains below 2500 ohms which causes the CO to believe that you are still +off-hook. You can build a simple hold device using the following pictoral +diagram: + / + (RED) O-------------------------/ + [L1] ! ! ! + ! ! ! + 1000 Ohm ! ! + Resistor Ringing ! + ! Circuit ! + ! ! ! + / ! Switch- + / SPST Switch ! Hook + ! ! ! + ! ! ! + ! ! !/ + (GREEN) O------------------------/ + [L2] + --> To Rest of + Fone + +This hold device is only effective if you also hang up the fone. To make a +hold/mute switch, simple connect a wire in place of the 1K resistor to effect a +short circuit (who cares if you damage CO equipment?). + +Conclusion: +----------- + +NOTE: Many of the electronics components of normal fones (K500) are enclosed + in the network box (which shouldn't be opened). + +I have assumed that the reader has a basic knowledge of electronics. Also, +I have assumed that you have read the 4 previous installments of this series +(and hopefully enjoyed them). + +In part VI, we will take a look at fortress fones. + +Suggested Further Reading: +-------------------------- + +Electronics Courses A-D, TAP, @ $.75 each. + +Electronic Telephone Projects, A.J. Caristi, Howard Sams Books. + +Everything you Always Wanted to Know About 1633 Hz Tones but Were Afraid to +Ask, The Magician, TAP, issue #62. + +Free BELL phone calls, TAP, Fact sheet #2, @ $.50. + +Free GTE phone calls, TAP, Fact sheet #3, @ $.50. + +How to modify your Bell Touch Tone Fone to.. + +TAP/Room 603/147 W 42 St./New York, NY 10036. Please specify by backissue +#'s (not article names). All back-issues are $1 each. Subscriptions are +$10/year (10 issues). Say that BIOC Agent 003 sent you. + +Another good phreak publication: + +2600/Box 752/Middle Island, NY 11953. Subscriptions are $10/year. Backissues +are $1 each. + +Excelsior, + +*****BIOC (P) 1984 BIOC +*=$=*Agent International +*****003 + +July 18, 1984 + + <<=-FARGO 4A-=>> + +Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open + \ No newline at end of file