info/mirror-textfiles.com
1
0
Fork 0
mirror of https://github.com/opsxcq/mirror-textfiles.com.git synced 2025-08-09 16:58:37 +02:00
Code Issues Releases Wiki Activity

update

Browse Source
This commit is contained in:
OPSXCQ
2017-11-08 03:42:50 -03:00
parent 39ed8a7aeb
commit 8518df2326
2 changed files with 795 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

410
textfiles.com/100/basicom4.phk Normal file
View File

@@ -0,0 +1,410 @@
File: BASIC TELCOM IV
Read 66 times
******BIOC Agent 003's course in*******
* *
* ========================== *
* =BASIC TELECOMMUNCIATIONS= *
* ========================== *
* PART IV *
***************************************
Revised: 15-JUN-84
PREFACE:
--------
Part IV will deal with the various types of operators, office hierarchy, &
switching equipment.
OPERATORS:
----------
There are many types of operators in The Network and the more common ones
will be discussed.
TSPS Operator:
The TSPS [(Traffic Service Position System) as opposed to This Shitty Phone Service] Operator is probably the bitch (or bastard for the phemale
liberationists) that most of us are use to having to deal with.
Here are her responsibilities:
1) Obtaining billing information for Calling Card or 3rd number calls.
2) Identifying called customer on person-to-person calls.
3) Obtaining acceptance of charges on collect calls.
4) Identifying calling numbers. This only happens when the calling # is not
automatically recorded by CAMA (Centralized Automatic Message Accounting) &
forwarded from the local office. This could be caused by equipment failures
(ANIF - Automatic Number Identification Failure) or if the office is not
equipped for CAMA (ONI - Operator Number Identification).
<I once had an equipment failure happen to me & the TSPS operator came on and
said, "What # are you calling FROM?" Out of curiosity, I gave her the # to my
CO, she thanked me & then I was connected to a conversion that appeared to be
between a frameman & his wife. Then it started ringing the party I originally
wanted to call & everyone phreaked out (excuse the pun). I immediately dropped
this dual line conference!>
You shouldn't mess with the TSPS operator since she KNOWS where you are calling
from. Your number will show up on a 10-digit LED read-out (ANI board) She also
knows whether or not you are at a fortress fone & she can trace calls quite
readily. Out of all the operators, she is one of the MOST DANGEROUS.
INWARD Operator:
This operator assists your local TSPS ("O") operator in connecting calls. She
will never question a call as long as the call is within HER SERVICE AREA.
She can only be reached via other operators or by a Blue Box. From a BB,
you would dial KP+NPA+121+ST for the INWARD operator that will help you connect
any calls within that NPA only. (Blue Boxing will be discussed in a future part
of BASIC TELCOM)
DIRECTORY ASSISTANCE Operator:
This is the operator that you are connected to when you dial: 411 or
NPA-555-1212. She does not readily know where you are calling from. She does
not have access to unlisted #'s, but she does know if an unlisted # exists for
a certain listing.
There is also a directory assistance for deaf people who use Teletypewriters
If your modem can transfer BAUDOT [(45.5 baud)/ (the Apple Cat can)], then you
can call him/her up and have an interesting conversation. The # is:
800-855-1155. They uses the standard Telex abbreviations such as GA for Go
Ahead. They tend to be nicer & will talk longer than your regular operators.
Also, they are more vulnerable into being talked out of information through the
process of "social engineering" as Cheshire Catalyst would put it.
<Unfortunately, they do not have access to much. I once bullshitted with one
of these operators and I found out that there are 2 such DA offices that handle
TTY. One is in Philadelphia and the other is in California. They have
approximately 7 operators each. Most of the TTY operators think their job is
boring (based on an official "BIOC poll"). They also feel they are under-paid.
They actually call up a regular DA # to process your request (Sorry, no fancy
computers!).>
Other operators have access to their own DA by dialing KP+NPA+131+ST (MF).
In the confusion due to the aftermath of the Bell System break-up, it seems
that it will now cost 50 cents per DA call! Exceptions seem to be Canadian
DA & the TTY DA (for the time being). Thus you might be able to avoid being
charged for DA calls by using your computer [running at 45.5 baud!] and their
800 TOLL-FREE #! If they decide to charge from fortresses also, the method of
making DA calls from the fortress and purposely asking for an unlisted # so you
can have the operator credit you home # will no longer work!
CN/A Operators:
CN/A operators are operators that do exactly the opposite of what directory
assistance operators are for. See part II, for more info on CN/A & #'s. In my
experiences, these operators know more than the DA op's do & they are more
susceptible to "social engineering." It is possible to bullshit a CN/A operator
for the NON-PUB DA # (ie, you give them the name & they give you the unlisted
#). This is due to the fact that they assume your are a phellow company
employee. Unfortunately, the break-up has resulted in the break-up of a few
NON-PUB #'s and policy changes in CN/A.
INTERCEPT Operator:
The intercept operator is the one that you are connected to when there are not
enough recordings available to tell you that the # has been disconnected or
changed. She usually says, "What # you callin'?" with a foreign accent. This
is the lowest operator lifeform. Even though they don't know where you are
calling from, it is a waste of your time to try to verbally abuse them since
they usually understand very little English.
Incidentally, a few areas do have intelligent intercept operators.
OTHER Operators:
And then there are the: Mobile,Ship-to-Shore, Conference, Marine Verify,
"Leave Word & Call Back," Rout & Rate (KP+800+141+1212+ST - new # as result of
Bell breakup), & other special operators who have one purpose or another in the
Network.
Problems with an Operator? Ask to speak to their supervisor...or better yet,
the Group Chief (who is the highest ranking official in any office) who is the
equivalent of the Madame in a whorehouse (if you will excuse the analogy).
By the way, some CO's that will allow you to dial a 1 or 0 as the 4th digit,
will also allow you to call special operators & other phun Telco #'s without a
blue box. This is very rare though! For example, 212-121-1111 will get you a
NY Inward Operator.
==================
=OFFICE HIERARCHY=
==================
Every switching office in North America (the NPA system), is assigned an office
name & class. There are five classes of offices numbered 1 through 5. Your
CO is most likely a class 5 or end office. All Long-Distance (Toll) calls
are switched by a toll office which can be a class 4, 3, 2, or 1 office. There
is also a 4X office called an intermediate point. The 4X office is a digital
one that can have an unattended exchange attached to it (known as a Remote
Switching Unit-RSU).
The following chart will list the Office #, name, & how many of those offices
existed in North America in 1981.
Class Name Abb # Existing
----- ---------------- --- ------------
1 Regional Center RC 12
2 Sectional Center SC 67
3 Primary Center PC 230
4 Toll Center TC 1,300
4P Toll Point TP
4X Intermediate Pt IP
5 End Office EO 19,000
R RSU RSU
When connecting a call from one party to another,the switching equipment
usually tries to find the shortest route between the Class 5 end office of
the caller & the Class 5 end office of the called party. If no inter-office
trunks exist between the 2 parties, it will then move upto the next highest
office for servicing (Class 4). If the Class 4 office cannot handle the call
by sending it to another Class 4 or 5 office, it will be sent to the next
office in the hierarchy (3). The switching equipment first uses the high-usage
interoffice trunk groups, if they are busy it then goes to the final trunk
groups on the next highest level. If the call cannot be connected then, you
will probably get a re-order [120 IPM (Interruptions Per Minute) busy signal]
signal. At this time, the guys at Network Operations are probably shitting in
their pants and trying to avoid the dreaded Network Dreadlock (as seen on TV!).
It is also interesting to note that 9 connections in tandem is called
ring-around-the rosy and it has never occurred in telephone history. This
would cause an endless loop connection. [a neat way to really screw-up the
Network]
The 10 regional centers in the US & the 2 in Canada are all interconnected.
They form the foundation of the entire telephone network. Since there are
only 12 of them, they are listed below:
Class 1 Regional Office Location NPA
---------------------------------- ---
Dallas 4 ESS 214
Wayne, PA 215
Denver 4T 303
Regina No.2 SP1-4W [Canada] 306
St. Louis 4T 314
Rockdale, GA 404
Pittsburgh 4E 412
Montreal No.1 4AETS [Canada] 504
Norwich, NY 607
San Bernardino, CA 714
Norway, IL 815
White Plains 4T, NY 914
The following diagram demonstrates how the various offices may be connected:
^----------^----------^ Regional
_!_ _!_ _!_Offices
~~~~~!1! <----> !1! <----> !1!~~~~~
--- --- ---
! Others\/
-^-------^-------^------^---------^
_!_ _!_ _!_ _!__ _!_
!2! !3! !4! !4P! !5!
--- --- --- -^^- ---
! ! ! !
^----^ ! ^----^ !
_!_ _!_ ! __!_ _!_ !
!3! !4! ! !4X! !5! ^-----^
--- -^- ! ---- --- _!__ _!_
^ ! !4X! !5!
__!_ ! ---- ---
!5R! !-------------^
-^^- /--------!---------\
_!_ _!__ _!_ _!_
!R! !4P! !4! !5!
--- ---- --- ---
=====================
=SWITCHING EQUIPMENT=
=====================
In the Network, there are 3 major types of switching equipment. They are known
as: Step, Crossbar, & ESS.
STEP-BY-STEP (SxS)
The Step-By-Step, a/k/a the Strowger switch or two-motion switch, was invented
in 1889 by an undertaker named Almon Strowger. He invented this mechanical
switching equipment because he felt that the biased operator was routing all
requests for an 'undertaker' to her husband's business.
Bell started using this system in 1918 & as of 1978, over 53% of the Bell
exchanges used this method of switching. This figure is probably substantially
less now.
Step-by-Step switching is controlled directly by the dial pulses which move
a series of switches (called the switch train) in order. When you first pick
up the fone under SxS, a linefinder acknowledges the request (sooner or later)
by sending a dial tone. If you then dialed 1234, the equipment would first
find an idle selector switch. It would then move vertically 1 pulse, it
would then move horizontally to find a free second selector, it would then
move 2 vertical pulses, step horizontally to find the next selector, etc. Thus
the first switch in the train takes no digits, the second switch takes 1 digit,
the third switch takes 1 digit, & the last switch in the train (called the
connector) takes the last 2 digits & connects your calls. A normal (10,000
line) exchange requires 4 digits (0000-9999) to connect a local call & thus it
takes 4 switches to connect every call (linefinder, 1st & 2nd selectors, & the
connector) .
While it was the first, SxS sucks for the following reasons:
[1] The switches often become jammed thus the calls often become blocked.
[2] You can't use DTMF (Dual-Tone Multi-Frequency a/k/a Touch-Tone) directly.
It is possible that the Telco may have installed a conversion kit but then the
calls will go through just as slow as pulse, anyway!
[3] They use a lot of electricity & mechanical maintenance. (bad from Telco
point of view)
[4] Everything is hardwired.
They can still hook up pen registers & other shit on the line so it is not
exactly a phreak haven.
You can identify SxS offices by:
(1) Lack of DTMF or pulsing digits after dialing DTMF.
(2) If you go near the CO, it will sound like a typewriter testing factory.
(3) Lack of speed calling, call forwarding, & other custom services.
(4) Fortress fones that want your money first (as opposed to dial tone first
ones).
The preceding don't necessarily imply that you have SxS but they surely give
evidence that it might be. Also, if any of the above characteristics exist,
it certainly isn't ESS! Also, SxS have pretty much been eradicated from large
metropolitan areas such as NYC (212).
CROSSBAR:
There are 3 major types of Crossbar systems called: No. 1 Crossbar (1XB),
No. 4 Crossbar (4XB), & No. 5 Crossbar (5XB). 5XB has been the primary end
office switch of Bell since the 60's and thus it is in wide-use. There is
also a Crossbar Tandem (XBT) used for toll-switching.
Crossbar uses a common control switching method. When there is an incoming
call, a stored program determines its route through the switching matrix.
In Crossbar, the basic operation principle is that a horizontal & a vertical
line are energized in a matrix known as the crosspoint matrix. The point where
these 2 lines meet in the matrix is the connection.
+===+
=ESS=
+===+
Electronic Switching System (ESS)
The Phreak's Nightmare Come True
(or Orwell's Prophecy as 2600 puts it)
ESS is Bell's move towards the Airstrip One society depicted in Orwell's 1984.
With ESS, EVERY single digit that you dial is recorded--even if it is a
mistake. They know who you call, when you call, how long you talked for, &
probably what you talked about (in some cases). ESS can (and is) also
programmed to print out #'s of people who make excessive calls to 800 #'s or
directory assistance. This is called the "800 Exceptional Calling Report."
ESS could also be programmed to print out logs of who calls certain #'s--like
a bookie, a known communist, a BBS, etc The thing to remember with ESS is that
it is a series of programs working together. These programs can be very
easily changed to do whatever they want it to do. This system makes the job of
Bell Security, the FBI, NSA, & other organizations that like to invade privacy
incredibly easy.
With ESS, tracing is done in microseconds (Eine Augenblick) & the results are
printed at the console of a Bell Gestapo officer. ESS will also pick up any
"foreign" tones on the line such as 2600 Hz!
Bell predicts that the country will become totally ESS by the 1990's.
You can identify ESS by the following which are usually ESS functions:
[1] Dialing 911 for help.
[2] Dial-Tone-First fortresses.
[3] Custom Calling Services such as: Call Forwarding, Speed Dialing, & Call
Waiting. (Ask your business office if you can get these.)
[4] ANI (Automatic Number Identification) on LD calls.
Phreaking does not come to a complete halt under ESS though--just be very
careful, though!!!
Due to the fact that ESS has a computer generated "artificial" ring, you are
not directly connected to the called parties line until he picks up. Therefore,
Black Boxes & Infinity Transmitters will not work under ESS!
NOTE: Another interesting way to find out what type of equipment you are on is
to raid the trash can of you local CO--this art will discussed in a
separate article soon. Asking for a tour of your CO for a "school
report" can also be helpful.
Coming Soon:
In the part V, we will start to take a look at telephone electronics.
Further Reading:
For more information on the above topics, I suggest the following:
Notes on the Network, AT&T, 1980.
Understanding Telephone Electronics,Texas Instruments, 1983.
And subscriptions to:
TAP, Room 603, 147 W 42 St, New York,NY 10036. Subscriptions are $10/year.
Back issues are $0.75. The current issues is #90 (Jan/Feb 1984)
2600, Box 752, Middle Island, NY 11953. Subscriptions are $10/year. Back
issues are $1 each. The current issue is #6 (June 1984).
They are both excellent sources of all sorts of information (primarily
phreaking/hacking).
NOTE: For the most part, I have assumed that you have read my previous 3
courses in the BASIC TELCOM series.
Excelsior,
*****BIOC
*=$=*Agent
*****003
Knights of Shadow
April 13, 1984
{The Year of Big Brother}
<<=-FARGO 4A-=>>
[ RACS III - (914) 942-2638 ]
[ Sherwood Forest ][ - (914) 359-1517 ]
PS Sysops of other BBS's are welcome to use this series on their own boards
providing that you don't change anything.
PPS Due to the radical changes taking place in the Network due to the break up
this January, I have been forced to make many revisions of certain parts of
my BASIC TELCOM series. If something does not seem right, please keep the
current revision date in mind. I have tried to keep this series as current
as possible.
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open


385
textfiles.com/100/basicom5.phk Normal file
View File

@@ -0,0 +1,385 @@
File: BASIC TELCOM V
*******BIOC Agent 003's course in******
* *
* ========================== *
* =BASIC TELECOMMUNICATIONS= *
* ========================== *
* PART V *
***************************************
Revised: 08-AUG-84
PREFACE:
Previous installments of this series here focused on telephony from a Network
point-of-view. Part V will deal with telephone electronics focusing primarily
on the subscriber's telephone. Hereinafter simply referred to as "fone."
Wiring:
-------
Assuming a standard one-line fone, there are usually 4 wires that lead out of
the fone set. These are standardly colored red, green, yellow, & black. The
red & green wires are the two that are actually hooked up to your CO. The
yellow wire is sometimes used to ring different fones on a party line (ie, one
#, several families--found primarily in rural areas where they pay less for the
service and they don't use the fone as much); otherwise, the yellow is usually
just ignored. On some two-line fones, the red & green wires are used for the
first fone # and the yellow & black are used for the second line. In this case
there must be an internal or external device that switches between the two
lines and provides a hold function. (Such as Radio Shack's outrageously priced
2 line & hold module).
In telephony, the green & red wires are often referred to as tip (T) & ring
(R), respectively. The tip is the more positive of the two wires. This naming
goes back to the old operator cord boards where one of the wires was the tip of
the plug and the other was the ring (of the barrel).
A rotary fone (aka dial or pulse) will work fine regardless of whether the red
(or green) wire is connected the tip(+) or ring(-). A touch-tone (TM) fone is
a different story, though. It will not work except if the tip(+) is the green
wire. [Although, some of the more expensive DTMF fones do have a bridge
rectifier which compensates for polarity reversal.] This is why under certain
(non-digital) switching equipment you can reverse the red & green wires on a
touch-tone fone and receive free DTMF service. Even though it won't break dial
tone, reversing the wires on a rotary line on a digital switch will cause the
tones to be generarted.
Voltages, Etc.
--------------
When your telephone is on-hook (ie, hung up) there is approximately 48 volts of
DC potential across the tip & ring. When the handset of a fone is lifted a few
switches close which cause a loop to be connected (known as the "local loop")
between your fone & the CO. Once this happens DC current is able to flow
through the fone with less resistance. This causes a relay to energize which
causes other CO equipment to realize that you want service. Eventually, you
should end up with a dial tone. This also causes the 48 VDC to drop down into
the vicinity of 12 volts. The resistance of the loop also drops below the 2500
ohm level, though FCC licensed telephone equipment must have an off-hook
impedance of 600 ohms. As of now, you ahands of our "friends" at D&B. To say
the least, they weren't exactly thrilled about it. In fact, they did not
even believe that they had a security problem! (Well, that just goes
to prove that if you are good, no one knows that you are there!)
In a big effort to defeat us, they called in an outside service to
spruce up their "security." Well, fortunately for us, we were able to
find out about the new system! (Which wasn't really a problem. First,
they had the new dial-ups when you logged on, and as always they have a
nice little place on Telenet! (Where we do most of our work: C 20188).
Now, they have set up a new system they like to call DunsNet.
They are trying to pass it off as a ectionately call this mute a black box.
the following are instructions on how to build a simple black box. Of course,
anything that prevents the voltage from dropping would work.
You only need two parts: A SPST toggle switch and a 10,000 ohm (10 K), 1/2
watt resistor. Any electronics store should stock these parts.
Now, cut 2 pieces of wire (about 6 inches long) and attach one end of each wire
to one of the terminals on the switch. Now turn your K500 (standard desk fone)
upside down and take off the cover. Locate wire (disconnect it from its
terminal). Now bring the switch out the rear of the fone and replace the
cover.
Put the switch in a position where you receive a dial tone. Mark this position
NORMAL. Mark the other side FREE.
When your phriends call (at a prearranged time), quickly lift & drop the
receiver as fast a possible. This will stop the ringing (do it again if it
doesn't) with out starting the billing. It is important that you do
it quickly (less than 1 second). Then put the switch in the FREE position and
pick up the fone. Keep all calls short and preferrably under 15 minutes.
NOTE: If someone picks up an extension in the called parties house and
that fone is not set for FREE then billing will start.
NOTE: An old way of signalling a phriend that you are about to call is making
a collect call to a non-existant person in the house. Since your friend
will not accept the charges, he will know that you are about to call
and thus prepare the black box (or visa versa).
WARNING: The Telco can detect black boxes if they suspect one on your line.
This is done due to the presence of AC voice signal at the wrong DC
level!
Pictoral Diagram:
(Standard Rotary K500 fone)
---------------------------------------
! !
***BLUE WIRE**>>F< !
! * * !
**WHITE WIRE** * !
! * !
! RESISTOR !
! * !
! * !
! >RR<*******SWITCH**** !
! * !
****GREEN WIRE********************** !
! !
---------------------------------------
NOTE: The Black Box will not work under ESS or other similar digital switches
since ESS does not connect the voice circuits until the fone is picked
up (& billing starts). Instead, ESS uses an "artificial" computer
generated ring.
Ringing:
--------
To inform a subscriber of an incoming call, the Telco sends 90 volts (PK) of
pulsing DC down the line (at around 15 to 60 Hz; usually 20 Hz). In most fones
this causes a metal armature to be attracted alternately between two
electro-magnets thus striking 2 bells. of course, the standard bell (patented
in 1878 by Tom A. Watson) can be replaced by a more modern electronic bell or
signaling device.
Also, you can have lights and other similar devices in lieu of (or in
conjunction with) the bell. A simple neon light (with its corresponding
resistor) can simply be connected between the red & green wires (usually L1 &
L2 on the network box) so that it lights up on incoming calls.
WARNING: 90 VDC can give quite a shock. Exercise extreme caution if you wish
to further persue these topics.
Also included in the ringing circuit is a capacitor tbig savings of time since
the hassle of using a a time shared public network does not exist. We're
sure that Mr. J.W.P. of DUNSPRINT had more on his mind when he wrote the
letter (on the system)! DunsNet is accessible from a regular dial-up. We
have not been able to get a number yet for this system, but once on it
allegedly works just like Telenet! Two carriage returns and you will see
"DunsNet" then the familiar "@" symbol. To use the system like we showed
you, type "RPTS" at thiup to drop a trouble card for long periods of ringing
then a "no-no" detection device may be placed on the line.
Incidentally, the term "ring trip" refers to the CO process involved to stop
the AC ringing signal when the calling fone goes off hook.
NOTE: It is suggested that you actually dissect fones to help you better
understand them. It will also help you to better understand the concepts
here if you actually prove them to yourself. For example, actually
take the voltage readings on your fone line [any simple
multi-tester (a must) will do.] Phreaking is an interactive
process not a passive one!
Dialing:
--------
On a standard fone, there are two common types of dialing: pulse & DTMF. Of
course, some people insist upon being different and don't use the DT thus
leaving them with MF (Multi Frequncy, aka operator, blue box) tones. This is
another "no-no" and the Telco Security gentelmen have a special knack for
dealing with such "phreaks" on the network.
When you dial rotary, you are actually rapidly breaking & reconnecting
(breaking & making) the local loop once for each digit dialed. Since the
physical connection must be broken, you cannot dial if another extension (of
that #) is off-hook. Neither of the fones will be able to dial pulse unless
the other hangs up.
Another term often referred to in telephone electronics is the break ratio. In
the US, the standard is 10 pulses per second. When the circuit is opened it is
called the break interval. When it is closed it is called the make interval.
In the US, there is a 60 millisecond (ms) make period and a 40 ms break period.
(60+40=100 ms = 1/10 second). This is referred to as a 60% make interval.
Some of the more sophisticated electronic fones can switch between a 60% & a
67% make interval. This is due to the fact that many foreign nations use a 67%
break interval.
Have you ever been in an office or a similar facility and saw a fone waiting
to be used for a free call but some asshole put a lock on it to prevent
outgoing calls?
Well, don't fret phellow phreaks, you can simulate pulse dialing by rapidly
depressing the switchook. (If you depress it for longer than a second it will
be construed as a disconnect.) By rapidly switchooking you are causing the
local loop to be broken & made similar to rotary dialing! Thus if you can
manage to switchook rapidly 10 times you can reach an operator to place any
call you want! This takes alot of practice, though. You might want to
practice on your own fone dialing a friend's # or something else. Incidentally,
this method will also work with DTMF fones since all DTMF lines can also handle
rotary.
Another problem with pulse dialing is that it produces high-voltage spikes that
make loud clicks in the earpiece and cause the bell to "tinkle." If you never
noticed this then your fone has a special "anti-tinkle" & earpiece shorting
circuit (most do). If you have ever dissected a rotary fone (a must for any
serious phreak) you would have noticed that there are 2 sets of contact that
open and close during pulsing (on the back of the rotary dial under the plastic
cover). One of these actually opens and closes the loop while the other mutes
the earpiece by shorting it out. The second contacts also activates a special
anti-tinkle circuit that puts a 340 ohm resistor across the ringing circuit
which prevents the high voltage spikes from interferring with the bell.
Dual Tone Multi Frequency (DTMF) is a modern day improvement on pulse dialing
in several ways. First of all, it is more convenient for the user since it
is faster and can be used for signaling after the call is completed (ie, SCC's,
computers, etc.). Also, it is more up to par with modern day switching
equipment (such as ESS) since pulse dialing was designed to actually move
relays by the number of digits dialed (in SxS offices).
Each key on a DTMF keypad produces 2 frequencies simultaneously (one from the
high group and another from the low group).
-------------------------
Low Group ! Q ! ABC ! DEF ! !
697 Hz-! 1 ! 2 ! 3 ! A !
! ! ! ! !
!-----!-----!-----!-----!
! GHI ! JKL ! MNO ! !
770 Hz-! 4 ! 5 ! 6 ! B !
! ! ! ! !
!-----!-----!-----!-----!
! PRS ! TUV ! WXY ! !
852 Hz-! 7 ! 8 ! 9 ! C !
! ! ! ! !
!-----!-----!-----!-----!
! ! OPER! ! !
941 Hz-! * ! 0 ! # ! D !
! ! Z ! ! !
!-----!-----!-----!-----!
1209 1336 1477 1633
(High Group--in Hz)
A portable DTMF keypad is known as a white box.
The fourth column (1633 Hz) is not normally found on regular fones but it
does have several special uses. For one, it is used to designate the priority
of calls on AUTOVON, the military fone network. These key are called: Flash,
Immediate, Priority, & Routine (with variations) instead of ABCD. Secondly,
these keys are used for testing purposes by the Telco. In some area you can
find loops as well as other neat tests (see Part II) on the 555-1212 directory
assistance exchange. For this, you would call up an DA in certain areas [that
have an Automatic Call Distributor (ACD)] and hold down the "D" key which
should blow the operator off. You will then hear a pulsing dial tone which
indicates that you are in the ACD internal testing mode. You can get on one
side of a loop by dialing a 6. The other side is 7. Some phreaks claim that
if the person on side 6 hangs up, occasionally the equipment will screw up and
start directing directory assistance calls to the other side of the loop.
Another alleged test is called REMOB which allows you to tap into lines by
entering a special code followed by the 7 digit number you want to monitor.
Then there is the possibility of mass conferencing.
ACD's are become rare though. You will probably have to make several NPA-555-
1212 calls before you find one.
You can modify regular fones quite readily so that they have a switch to change
between the 3rd and 4th columns. This is called a silver box (aka grey box) and
plans can be found in Tap as well as on many BBS's.
Transmitter/Receiver:
---------------------
When you talk into the transmitter, the sound waves from your voice cause a
diaphragm to vibrate and press against the carbon granules (or another similar
substance). This causes the carbon granules to compress and contract thus
changing the resistance of the DC coupled path through it. Therefore, your AC
voice signal is superimposed over the DC current of the local loop. The
receiver works in a similar fashion where the simple types utilize a
magnet, armature, & diaphragm.
Hybrid/Induction Coil:
----------------------
As you may have noticed, there are two wires for the receiver and two for the
transmitter in the fone, yet the local loop consists of 2 wires instead of 4.
This 4-wire to 2-wire conversion is done inside the fone by a device known as
an induction coil which uses coupling transformers. All of the internal Telco
trunks also use 4 wires. It is only the local loop that uses 2 since it is
cheaper. A device in the CO known as a hybrid converts between 4 and 2 wire
set-ups similar to the induction coil inside the fone. Special data
transmission lines require extremely low signal to noise ratios, they require
the full four wires--two for transmission and two for receiving (even on the
local loop).
Miscellaneous:
--------------
In the telephone, there is also a balancing network consisting of a few
capacitors & resistors which provide sidetone. Sidetone allows the caller to
hear his own volume in the receiver. He can then adjust his voice accordingly.
This prevents people from shouting or speaking too softly without noticing it.
Hold:
When a telephone goes off hook, the resistance drops below 2500 ohms. At this
point, the Telco will send a dial tone. To put someone on hold you must put a
1000 ohm resistor (1 watt) across the Tip & Ring before it reaches the
switchook. In this way, when the fone is hung up (for hold) the resistance
remains below 2500 ohms which causes the CO to believe that you are still
off-hook. You can build a simple hold device using the following pictoral
diagram:
/
(RED) O-------------------------/
[L1] ! ! !
! ! !
1000 Ohm ! !
Resistor Ringing !
! Circuit !
! ! !
/ ! Switch-
/ SPST Switch ! Hook
! ! !
! ! !
! ! !/
(GREEN) O------------------------/
[L2]
--> To Rest of
Fone
This hold device is only effective if you also hang up the fone. To make a
hold/mute switch, simple connect a wire in place of the 1K resistor to effect a
short circuit (who cares if you damage CO equipment?).
Conclusion:
-----------
NOTE: Many of the electronics components of normal fones (K500) are enclosed
in the network box (which shouldn't be opened).
I have assumed that the reader has a basic knowledge of electronics. Also,
I have assumed that you have read the 4 previous installments of this series
(and hopefully enjoyed them).
In part VI, we will take a look at fortress fones.
Suggested Further Reading:
--------------------------
Electronics Courses A-D, TAP, @ $.75 each.
Electronic Telephone Projects, A.J. Caristi, Howard Sams Books.
Everything you Always Wanted to Know About 1633 Hz Tones but Were Afraid to
Ask, The Magician, TAP, issue #62.
Free BELL phone calls, TAP, Fact sheet #2, @ $.50.
Free GTE phone calls, TAP, Fact sheet #3, @ $.50.
How to modify your Bell Touch Tone Fone to..
TAP/Room 603/147 W 42 St./New York, NY 10036. Please specify by backissue
#'s (not article names). All back-issues are $1 each. Subscriptions are
$10/year (10 issues). Say that BIOC Agent 003 sent you.
Another good phreak publication:
2600/Box 752/Middle Island, NY 11953. Subscriptions are $10/year. Backissues
are $1 each.
Excelsior,
*****BIOC (P) 1984 BIOC
*=$=*Agent International
*****003
July 18, 1984
<<=-FARGO 4A-=>>
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open