info/mirror-textfiles.com
1
0
Fork 0
mirror of https://github.com/opsxcq/mirror-textfiles.com.git synced 2025-08-06 19:46:42 +02:00
Code Issues Releases Wiki Activity

update

Browse Source
This commit is contained in:
OPSXCQ
2018-02-09 15:42:34 -03:00
parent 16283a6f78
commit 98c23e7f09
226 changed files with 90771 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
textfiles.com/phreak/antmodem.txt Normal file
View File

@@ -0,0 +1,75 @@
Uploaded by: The Stinger
**************************************
* Anti-Modem Weapon *
*****************By*******************
Enemy Within
An effective modem weapon, especially on crossbar phone system. (Will still
operate on Ess but you will kill phone service to your prefix for a few hours,
and everyone talking will be cut off on your prefix and the one yu called)
What is this device? Its a Tesla Coil. The Tesla coil when proprly used will
generate literally thousands or volts at very low amperage. (Just the right
current to bake silicon chip cookies.)
---> Set up
1. Disconnect all phones from your line. Disconnect answering dvices and
any data-transmission devices.
2. Run a preliminary test on the coil and disconnect nearby grounded objects.
(Lamps Stereos, TV's etc...)
3. Connect one phone that you see fit to subject.(It usually des not
destroy phones, (But I have seen them melt off walls.)
4. Connect iron or steel balls to the green and red wires of yor connected
phone (these are the line wires that go into the wall.) l1 ad l2
terminals of your phone.
5. Put on a pair of thick rubber gloves (EXTREMELY IMPORTANT!)
6. Charge coil to at least 10,000 volts. An ideal setting is arund 18 to
19 thousand, but 10 will jump Bells line surge protectors.
7. Hold metal balls in your left hand. (Make sure they don't toch each
other) When the coil is fully charged, clip the steel ball cnnected to
the red wire to the base of the tesla coil and hold the other metal ball
as far away from the coil as you can.
8. Dial the offending modems number.
9. When connected, move the metal object connected to the gree wire within
2 feet of the coils top.
-> Don't be afraid of the little bolts at the top of the coil...
10. Within 3 seconds a huge bolt of lightning will shoot forth t the phone
from the hand that you are holding the balls in.
(Hold on tight cause it'll feel like loads of ants!)
You will immediatly hear many strange oscilations to the carrier on the
phone. The last noise you will hear is a pop! from the phone. (hat is the
last cry of agony as it shuts down.)
Crossbar just disconnects.
Guaranteed to fry the modem, the
computer and any peripherals.
or anyone who answers the phone!
ALL DAMAGE IS UN-REPAIRABLE.
including lives!!!
In Association with:
++++++++++++++++++++
+ DAMAGE Inc. +
++++++++++++++++++++

48
textfiles.com/phreak/anyfone.phk Normal file
View File

@@ -0,0 +1,48 @@
()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()
| How to get anything on anyone | Part 1 |
()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()
|-->By Toxic Tunic<--|
| -------------- |
|=-|-=---PHP----=-|-=|
|__/ \__|
| |
| |
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
| PHREE WORLD ELITE BBS |
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Every city has one or more offices dedicated to assigning numbers to the
telephone wire pairs. These offices are called DPAC offices and are available
to service Reps who are installing or repairing phones.
To get the DPAC number, a service rep would call the old stand-by,
customer service number for billing information in the town the number the
phone is located in that he is trying to get the unlisted number of.. Okay?
The conversation would go like this, 'Hi, San Fran this is Joe from San
Mateo Business office. I need your DPAC number for the south end of town.'
The information is usually passed out with no hassle, if the first person
does not have it or is not helpful, try one from a different prefix in the same
city.
The 'rep' would then call DPAC (note; he would have the listing info from
his own district; again he is calling from a nearby town).
''Hi, Dee-Pac this is Joe from San Mateo Phone Store, I need the listing
for 812 First Street.''
The San Francisco will then give the number at the address requested.
There is no notation at DPAC if the number is listed or unlisted.
The DPAC number for S.F. is, last time it was checked, (415) 774-8924....
Call Collect...
This file typed by TOXIC TUNIC from the book ''How to Get Anything on
Anybody,'' by Lee Lapin. Buy it.

<EFBFBD> File transmission complete.
Temp archive menu (?=help) : ny different
colors {I don'tknow ALL

53
textfiles.com/phreak/anyone.txt Normal file
View File

@@ -0,0 +1,53 @@
()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()
| How to get anything on anyone | Part 1 |
()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()
|-->By Toxic Tunic<--|
| -------------- |
|=-|-=---PHP----=-|-=|
|__/ \__|
| |
| |
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
| PHREE WORLD ELITE BBS |
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Every city has one or more offices dedicated to assigning numbers to the
telephone wire pairs. These offices are called DPAC offices and are available
to service Reps who are installing or repairing phones.
To get the DPAC number, a service rep would call the old stand-by,
customer service number for billing information in the town the number the
phone is located in that he is trying to get the unlisted number of.. Okay?
The conversation would go like this, 'Hi, San Fran this is Joe from San
Mateo Business office. I need your DPAC number for the south end of town.'
The information is usually passed out with no hassle, if the first person
does not have it or is not helpful, try one from a different prefix in the same
city.
The 'rep' would then call DPAC (note; he would have the listing info from
his own district; again he is calling from a nearby town).
''Hi, Dee-Pac this is Joe from San Mateo Phone Store, I need the listing
for 812 First Street.''
The San Francisco will then give the number at the address requested.
There is no notation at DPAC if the number is listed or unlisted.
The DPAC number for S.F. is, last time it was checked, (415) 774-8924....
Call Collect...
This file typed by TOXIC TUNIC from the book ''How to Get Anything on
Anybody,'' by Lee Lapin. Buy it.

103
textfiles.com/phreak/aod.txt Normal file
View File

@@ -0,0 +1,103 @@
AOD '93
****************************************
As of 12/18/93-----
Membership:
CyberChrist*
Makilki*
Proteus*
Black Acid
The Great Cuthulu
Necrovore
Azmodeus
Isack
Mr. Clean
Akira
Morbid Angel
YOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCK
A OOOOO DDDDD Agents Of the Deicide
A A O O D D
A A O O D D
A A O O D D Death of Religion,
AAAAAAAAA O O D D Birth of Technology
A A O O D D
A A OOOOO DDDDD
YOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCK
You are all probably wonering who this goddamn AOD is right?
Let me tell You. The AOD is one of the most elyte Hack/Phreak orginizations
in the USA!!
YOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCK
What does it take to be elyte? This question was asked to one of AOD's prime
movers and shakers, Akira.
AK: Elyte is a state of mind ya'all. It is not for everyone.
Definitly not for buisness pigs or piece of shit cops.
To be elyte you must belive in yourselve and have an elder god
adopt your cause. Oh ya, one more thing. You gotta wear socks.
So Akira, what is you views on life, the universe, and everything?
AK: It is all gone bad. I beileve in total restucturing of the
government. It should be built up so it can worship me.
All taxes to me. All cute girls to me. All to me and
nothin to you. Life sucks. The universe sucks. Everything
sucks. Everything but me that is. AnArcHY RuLEz!@!1!
What do you feel has been the most benificial invention this century?
AK: The A-bomb. It is truly Amerikan. Even if we stole all the
ideas. It was built in Amerika and tested in Japan!! It,
beyond everything else, has furthered my cause.
What vices do you have?
AK: My biggest vice is my uncontrolablr urge to sacrifice small
animals and children tho BoB. He is my cyber-god. I also
am mundanely addicted to oxygen and gyrliez. Other than that, I would
say that I am a normal all Amerikan kid.
Where are your roots in the computer underground?
AK: They are under my trees. HAHAHAAHAHAHAHAHA. Sorry.
Seriously, They started in the winter of '92. I
started to read bout hackers and such and I started
to play around with the personal computers at my
school. I also learned about the old 286 in my basement.
I got my first modem, a cheepie 1200 baud that was at
least 10 years old, in the spring of 93. I charged up
almost $300 calling boards in california. I was a
stupid kid. What can I say? I learned about some
neet WWIV boards in a nearby city and I and some of
the AOD crashed every WWIV board in town. Now, I am into
Writing Virii and Unix.
In reverence to the eternal Phrack Pro-philes, Are most of the
phreaks and hackers you know geeks?
AK: Only Necrovore. And it doesn't matter if he is because
he is elyte AND AOD And maybye alot of the lamer sysops
that want to be elyte. THey try too hard. Not that it
does them any good. They shall all be the first to hit
the fan When the Revolution Hits. AOD FOREVER!!!!!
YOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCK
Call these boards!!! OR ELSE!!!!!
Dunwhich Horror.........NODE 1 WC (206)-433-PRVT
Corrosion BBS...........NODE 2 C (507)-634-USUC
MACHINE DREAMS..........Elyteness Personified!!!!!
(HA!)-YOU-WISH
Rekcah Inc. !((#
YOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCKYOUSUCK

141
textfiles.com/phreak/aqua.txt Normal file
View File

@@ -0,0 +1,141 @@
A LONG TIME, IT WAS IMPOSSIBLE TO ESCAPE FROM THE LOCK IN TRACE. THIS BOX DOES
OFFER AND ESCAPE ROUTE WITH SIMPLE DIRECTIONS TO IT. THIS BOX IS QUITE A
SIMPLE CONCEPT, AND ALMOST ANY PHREAKER WITH BASIC ELECTRONICS KNOWLEDGE CAN
CONSTRUCT AND USE IT.
/-/-/-/-/-/-/-/-/-/-/-/
/-/ THE LOCK/-/
/-/ IN TRACE/-/
/-/-/-/-/-/-/-/-/-/-/-/
A LOCK IN TRACE IS A DEVICE USED BY THE F.B.I. TO LOCK INTO THE PHONE USERS
LOCATION SO THAT HE CAN NOT HANG UP WHILE A TRACE IS IN PROGRESS. FOR THOSE OF
YOU WHO ARE NOT FAMILIAR WITH THE CONCEPT OF 'LOCKING IN', THEN HERE'S A BRIEF
DESCRIPTION.
THE F.B.I. CAN TAP INTO A CONVERSATION, SORT OF LIKE A THREE-WAY CALL
CONNECTION. THEN, WHEN THEY GET THERE, THEY CAN PLUG ELECTRICITY INTO THE
PHONE LINE. ALL PHONE CONNECTIONS ARE HELD OPEN BY A CERTAIN VOLTAGE OF
ELECTRICITY, THAT IS WHY YOU SOMETIMES GET STATIC AND FAINT CONNECTIONS WHEN
YOU ARE CALLING FAR AWAY, BECAUSE THE ELECTRICITY HAS TROUBLE KEEPING THE LINE
UP. WHAT THE LOCK IN TRACE DOES IS CUT INTO THE LINE AND GENERATE THAT SAME
VOLTAGE STRAIGHT INTO THE LINES. THAT WAY, WHEN YOU TRY AND HANG UP, VOLTAGE
IS RETAINED. YOUR PHONE WILL RING JUST LIKE SOMEONE WAS CALLING YOU EVEN AFTER
YOU HANG UP. (IF YOU HAVE CALL WAITING, YOU SHOULD UNDERSTAND BETTER ABOUT
THAT, FOR CX:CQ%INTERCEPTS THE ELECTRICITY AND MAKES A TONE THAT MEANS
SOMEONE IS GOING THROUGH YOUR LINE. THEN, IT IS A MATTER OF WHICH VOLTAGE IS
HIGHER. WHEN YOU PUSH DOWN THE RECEIVER, THEN IT SEE-SAWS THE ELECTRICITY TO
THE OTHER SIDE. WHEN YOU HAVE A PERSON ON EACH LINE IT IS IMPOSSIBLE TO HANG
UP UNLESS ONE OR BOTH OF THEM WILL HANG UP. IF YOU TRY TO HANG UP, VOLTAGE IS
RETAINED, AND YOUR PHONE WILL RING. THAT SHOULD GIVE YOU AN UNDERSTANDING OF
HOW ,BLING UOR-.1M=. WHEN ELECTRICITY PASSES."CI=Q?A CERTAIN POINT ON
YOUR PHONE, THE ELECTRICITY CAUSES A BELL TO RING OR ON SOME NEWER PHONES AN
ELECTRONIC RING TO SOUND.)
SO, IN ORDER T? ELIMINATE THE TRACMR=UOMEHOW MUST LOWER THE VOLTAGE ON YOUR
PHONE LINE. YOU SHOULD KNOW THAT EVERY TIME(SOMEONE ELSE PICKS UP THE
PHONE LINE, THEN THE VOLTAGE DOES DECREASE A LITTLE. IN THE FIRST STEPS OF
PLANNING THIS OUT, K.K. SUGGESTED GETTING ABOUT A HUNDRED PHONES ALL HOOKED
INTO THE SAME LINE THAT COULD ALL BE TAKEN OFF THE HOOK AT THE SAME TIME.
THAT WOULD GREATLY DECREASE THE VOLTAGE LEVEL. THAT IS ALSO WHY MOST THREE-
WAY CONNECTIONS THAT ARE USING THE BELL SERVICE THREE WAY CALLING (WHICH IS
ONLY $3 A MONTH) BECOME QUITE FAINT AFTER A WHILE.
BY NOW, YOU SHOULD UNDERSTAND THE BASIC IDEA. YOU HAVE TO DRAIN ALL OF THE
POWER OUT OF THE LINE SO THE VOLTAGE CAN NOT BE KEPT UP. I RATHER SUDDEN
DRAINING OF POWER COULD QUICKLY SHORT OUT THE F.B.I. VOLTAGE MACHINE, BECAUSE
IT WAS ONLY BUILT TO SUSTAIN THE EXACT VOLTAGE NECESSARY TO KEEP THE VOLTAGE
OUT.
FOR NOW, IMAGE THIS. ONE OF THE NORMAL RADIO SHACK GENERATORS THAT YOU CAN GO
PICK UP THAT ONE END OF THE CORD THAT HOOKS INTO THE CENTRAL BOX HAS A PHONE
JACK ON IT AND THE OTHER HAS AN ELECTRICAL PLUG. THIS WAY, YOU CAN "FLASH"
VOLTAGE THROUGH THE LINE, BUT CANNOT DRAIN IT. SO, SOME MODIFICATIONS HAVE
TO BE DONE.
/-/-/-/-/-/-/-/-/-/-/-/
/-/ THE AQUA BOX /-/
/-/-/-/-/-/-/-/-/-/-/-/
MATERIALS NEEDED- A BEOC (BASIC ELECTRICAL OUTPUT SOCKET), LIKE A SMALL LAMP
TYPE CONNECTION, WHERE YOU JUST HAVE A SIMPLE PLUG AND WIRE
THAT WOULD PLUG INTO A LIGHT BULB.
- ONE OF CORDS MENTIONED ABOVE, IF YOU CAN'T FIND ONE THEN
CONSTRUCT YOUR OWN... SAME VOLTAGE CONNECTION, BUT THE
RESTRAINER MUST BE BUILT IN (I.E. THE CENTRAL BOX)
- TWO PHONE JACKS (ONE FOR THE MODEM, ONE FOR IF YOU ARE
BEING TRACED TO PLUG THE AQUA BOX INTO)
- SOME CREATIVITY AND EASY WORK.
NOTICE: NO PHONES HAVE TO BE DESTROYED/MODIFIED TO MAKE THIS BOX, SO DON'T GO
OUT AND BUY A NEW PHONE FOR IT!
ALL RIGHT, THIS IS A VERY SIMPLE PROCEDURE. IF YOU HAVE THE BEOC, IT COULD
DRAIN INTO ANYTHING, A RADIO, OR WHATEVER. THE PURPOSE OF HAVING THAT IS
YOU ARE GOING TO SUCK THE VOLTAGE OUT FROM THE PHONE LINE INTO THE ELECTRICAL
APPLIANCE SO THERE WOULD BE NO VOLTAGE LEFT TO LOCK YOU IN WITH.
1)TAKE THE CONNECTION CORD. EXAMINE THE PLUG AT THE END. IT SHOULD HAVE ONLY
TWO PRONGS, IF IT HAS THREE, STILL, DO NOT FEAR. MAKE SURE THE ELECTRICAL
APPLIANCE IS TURNED OFF UNLESS YOU WANNA BECOME A CRISPY CRITTER WHILE MAKING
THIS THING. MOST PLUG WILL HAVE A HARD PLASTIC DESIGN ON THE TOP OF THEM TO
PREVENT YOU FROM GETTING IN AT THE ELECTRICAL WIRES INSIDE. WELL, GET A NICE
AND REMOVE IT. IF YOU WANT TO KEEP THE PLUG (I DON'T SEE WHY[...) THEN JUST CUT
THE TOP OFF.
WHEN YOU LOOK INSIDE, LOW AND BEHOLD, YOU WILL SEE THAT AT THE BASE OF THE
PRONGS THERE ARE A FEW WIRES CONNECTING IN. THOSE WIRES CONDUCT THE POWER INTO
THE APPLIANCE. SO, YOU CAREFULLY UNWRAP THOSE FROM THE SIDES AND PULL THEM OUT
UNTIL THEY ARE ABOUT AND INCH AHEAD OF THE PRONGS. IF YOU DON'T WANNA KEEP
THE JACK, THEN JUST RIP THE PRONGS OUT. IF YOU ARE, COVER THE PRONGS WITH
INSULATION TAPE SO THEY WILL NOT CONNECT WITH THE WIRES WHEN THE POWER IS
BEING DRAINED FROM THE LINE.
2)DO THE SAME THING WITH THE PRONGS ON THE OTHER PLUG, SO YOU HAVE THE WIRES
EVENLY CONNECTED. NOW, WRAP THE END OF THE WIRES AROUND EACH OTHER. IF YOU
HAPPEN TO HAVE THE OTHER END OF THE VOLTAGE CORD HOOKED INTO THE PHONE, STOP
READING NOW, YOUR TOO FUCKING STUPID TO CONTINUE.
AFTER YOU'VE WRAPPED THE WIRES AROUND EACH OTHER, THEN COVER THE WHOLE THING
WITH THE PLUGS WITH INSULATING TAPE. THEN, IF YOU BUILT YOUR OWN CONTROL BOX
OR IF YOU BOUGHT ONE, THEN CRAM ALL THE WIRES INTO THE AND RECLOSE IT. THAT
BOX IS YOUR TICKET OUT OF THIS.
3)RE-CHECK EVERYTHING TO MAKE SURE IT'S ALL IN PLACE. THIS IS A PRETTY FLIMSY
CONNECTION, BUT ON LATER MODELS WHEN YOU GET MORE EXPERIENCED AT IT THEN YOU
CAN SOLDER AWAY AT IT AND FORM THE WHOLE DEVICE INTO ONE BIG BOX, WITH SOME
KIND OF CHEAP MATTEL HAND-HELD GAME INSIDE TO BE THE POWER CONNECTOR.
IN ORDER TO USE IT, JUST KEEP THIS BOX HANDY. PLUG IT INTO THE JACK IF YOU
WANT, BUT IT WILL SLIGHTLY LOWER THE VOLTAGE SO IT ISN'T CONNECTED. WHEN YOU
PLUG IT IN, IF YOU SEE SPARKS, UNPLUG IT AND RESTART THE WHOLE THING. BUT IF
IT JUST SEEMS FINE THEN LEAVE IT.
/-/-/-/-/-/-/-/-/-/
/-/ USING IT !! /-/
/-/-/-/-/-/-/-/-/-/
NOW, SO YOU HAVE THE WHOLE THING PLUGGED IN AND ALL... DO NOT USE THIS UNLESS
THE SITUATION IS DESPERATE! WHEN THE TRACE HAS GONE ON, DON'T PANIC, UNPLUG
YOUR PHONE, AND TURN ON THE APPLIANCE THAT IT WAS HOOKED TO. IT WILL NEED
ENERGY TO TURN ITSELF ON, AND HERE'S A GREAT SOURCE... THE VOLTAGE TO KEEP
A PHONE LINE OPEN IS PRETTY SMALL AND A SIMPLE LIGHT BULB SHOULD DRAIN IT ALL
IN AND PROBABLY SHORT THE F.B.I. COMPUTER AT THE SAME TIME.
-=>KOPY KAT<=-
///////////////////////////////////////////////////////
//The PIRATES' HOLLOW//
//xxx-xxx-xxxx//
//over 12 Megs of Elite Text Files//
//ROR-ALUCARD//
//Sysop: Doctor Murdock//
// C0-Sysops: That One, Sir Death, Sid Gnarly & Finn //
////
// "The Gates of Hell are open night and day;//
//Smooth is the Descent, and Easy is the way.." //
///////////////////////////////////////////////////////


131
textfiles.com/phreak/aquabx.txt Normal file
View File

@@ -0,0 +1,131 @@
/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/
/-/ /-/
/-/ The Aqua Box /-/
/-/ /-/
/-/ Concept by: Captain Xerox /-/
/-/ /-/
/-/ Plans by: The Traveler /-/
/-/ /-/
/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/
Every true phreaker lives in fear of the dreaded F.B.I. 'Lock in Trace.'
For a long time, it was impossible to escape from the lock in trace. This box
does offer and escape route with simple directions to it. This box is quite a
simple concept, and almost any phreaker with basic electronics knowledge can
construct and use it.
__/\/\/\/\/\/\/\/\/\/\/\/\/\__
____/\/__ __\/\____
______/\/ |__ The Lock __| \/\______
____\/\__| In Trace |__/\/____
__\/\ /\/__
\/\/\/\/\/\/\/\/\/\/\/\/\/
A Lock-in Trace is a device used by the F.B.I. to lock into the phone users
location so that he can not hang up while a trace is in progress. For those
of you who are not familiar with the concept of 'locking in', then here's a
brief description.
The F.B.I. can tap into a conversation, sort of like a three-way call
connection. Then, when they get there, they can plug electricity into the
phone line. All phone connections are held open by a certain voltage of elec-
tricity, that is why you sometimes get static and faint connections when you
are calling far away, because the electricity has trouble keeping the line up.
What the lock in trace does is cut into the line and generate that same
voltage straight into the lines. That way, when you try and hang up, voltage
is retained. Your phone will ring just like someone was calling you even
after you hang up. (If you have call waiting, you should understand better
about that, for call waiting intercepts the electricity and makes a tone that
means someone is going through your line. Then, it is a matter of which
voltage is higher. When you push down the receiver, then it see-saws the
electricity to the other side. When you have a person on each line it is im-
possible to hang up unless one or both of them will hang up. If you try to
hang up, voltage is retained, and your phone will ring. That should give you
an understanding of how calling works. Also, when electricity passes through
a certain point on your phone, the electricity causes a bell to ring or on
some newer phones an electronic ring to sound.
So, in order to eliminate the trace, you somehow must lower the voltage
level on your phone line. You should know that every time someone else picks
up the phone line, then the voltage does decrease a little. In the first
steps of planning this out, Xerox suggested getting about a hundred phones all
hooked into the same line that could all be taken off the hook at the same
time. That would greatly decrease the voltage level. That is also why most
three-way connections that are using the bell service three way calling (which
is only $3 a month) become quite faint after a while.
By now, you should understand the basic idea. You have to drain all of
the power out of the line so the voltage can not be kept up. A rather sudden
draining of power could quickly short out the F.B.I. voltage machine, because
it was only built to sustain the exact voltage necessary to keep the voltage
out.
For now, imagine this. One of the normal Radio Shack generators that you
can go pick up that one end of the cord that hooks into the central box has a
phone jack on it and the other has an electrical plug. This way, you can
"flash" voltage THROUGH the line, but can't drain it. So, some modifications
have to be done.
MATERIALS NEEDED- a BEOC (Basic Electrical Output Socket), like a small lamp
type connection, where you just have a simple plug and wire
that would plug into a light bulb.
- One of the cords mentioned above, if you can't find one
then construct your own; same voltage connection, but the
restrainer must be built in (i.e. the central box)
- TWO phone jacks (one for the modem, one for if you are
being traced to plug the aqua box into)
- Some creativity and easy work.
NOTICE: No phones have to be destroyed/modified to make this box, so don't go
out and buy a new phone for it!
All right, this is a very simple procedure. If you have the BEOC, it
could drain into anything, a radio, or whatever. The purpose of having that
is you are going to suck the voltage out from the phone line into the electri-
cal appliance so there would be no voltage left to lock you in with.
1) Take the connection cord. Examine the plug at the end. It should have
only two prongs, if it has three, still, do not fear. MAKE SURE THE ELEC-
TRICAL APPLIANCE IS TURNED OFF unless you wanna become a crispy critter
while making this thing. Most plugs will have a hard plastic design on the
top of them to prevent you from getting in at the electrical wires inside.
Well, get a knife and remove it. If you want to keep the plug (I don't see
why...) then just cut the top off. When you look inside, low and behold,
you will see that at the base of the prongs there are a few wires connect-
ing in. Those wires conduct the power into the appliance. So, you care-
fully unwrap those from the sides and pull them out until they are about an
inch ahead of the prongs. If you don't wanna keep the jack, then just rip
the prongs out. If you are, cover the prongs with insulation tape so they
will not connect with the wires when the power is being drained from the
line.
2) Do the same thing with the prongs on the other plug, so you have the wires
evenly connected. Now, wrap the end of the wires around each other. If
you happen to have the other end of the voltage cord hooked into the phone,
stop reading now, you're too fucking stupid to continue. After you've
wrapped the wires around each other, then cover the whole thing with the
plugs with insulating tape. Then, if you built your own control box or if
you bought one, then cram all the wires into the box and re-close it.
3) Re-check everything to make sure it's all in place. This is a pretty
flimsy connection, but on later models when you get more experienced at it
then you can solder away at it and form the whole device into one big box,
with some kind of cheap Mattel hand-held game inside to be the power con-
nector.
In order to use it, just keep this box handy. Plug it into the jack if
you want, but it will slightly lower the voltage so it isn't connected. When
you plug it in, if you see sparks, unplug it and restart the WHOLE thing. But
if it just seems fine then leave it.
USING IT !!
Now, so you have the whole thing plugged in and all... DO NOT USE THIS UN-
LESS THE SITUATION IS DESPERATE! When the trace has gone on, don't panic, un-
plug your phone, and turn on the appliance that it was hooked to. It will
need energy to turn itself on, and here's a great source... the voltage to
keep a phone line open is pretty small and a simple light bulb should drain it
all in and probably short the F.B.I. computer at the same time.
Happy boxing and stay free!
Later, The Traveler
Zer0-g
Council of Minds.

BIN
textfiles.com/phreak/area.codes Normal file
View File

Binary file not shown.

111
textfiles.com/phreak/areacode.txt Normal file
View File

@@ -0,0 +1,111 @@
r6
..nETWORK 23..(201) 286 1124
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _
_ _ _ _ _ _
_ ((___)) uNDERGROUND iNTELLIGENCE ((___)) _
_ [ X X ] PRESENTS... [ X X ] _
_ \ / \ / _
_ ( ') area code and time zone listing ( ') _
_ (u) (u) _
_ _
_ BY bUD wEISER AND vIDIOT: _
_ _
_ U.I.I.I.I.U.U.U.UI.I _
_ _
_ nETWORK 23 (300/1200/2400) [201] 286-1124 _
_ Drag0nfirE PrivatE (1200 ONLY) [609] 424-2606 _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
oK THIS IS NOTHING BIG, IT'S MY THIRD TEXT FILE FOR 1988 FROM u.i.
COMMUNICATIONS. hERE GOES.
tIME zONES
----------
aTLANTIC
--------
nEWFOUNDLAND nOVA sCOTIA nEW bRUNSWICK
eASTERN
-------
mAINE nEW hAMPSHIRE vERMONT mASSACHUSSETS nEW yORK rHODE iSLAND
cONNECTICUT pENNSYLVANIA nEW jERSEY dELAWARE mARYLAND oHIO iNDIANA
mICHIGAN wEST vIRGINIA vIRGINIA kENTUCKY nORTH cAROLINA tENNESSEE
sOUTH cAROLINA gEORGIA fLORIDA qUEBEC oNTARIO
cENTRAL
-------
mANITOBA nORTH dAKOTA sOUTH dAKOTA mINNESOTA wISCONSIN mICHIGAN iOWA
nEBRASKA iLLINOIS kANSAS mISSOURI kENTUCKY tENNESSEE aRKANSAS oKLAHOMA
tEXAS lOUISIANA aLABAMA mISSISSIPPI iNDIANA
mOUNTAIN
--------
aLBERTA sASKATCHEWAN mONTANA iDAHO wYOMING sOUTH dAKOTA nEBRASKA
uTAH cOLORADO kANSAS oKLAHOMA aRIZONA nEW mEXICO
pACIFIC
-------
bRITISH cOLUMBIA wASHINGTON mONTANA oREGON nEVADA cALIFORNIA uTAH
aREA cODE lISTING
-----------------
205 - aLABAMA 907 - aLASKA 602 - aRIZONA
501 - aRKANSAS 714 - cALIFORNIA (oRANGE) 818 - cALIFORNIA
213 - cALIFORNIA (la) 916 - cALIFORNIA 619 - cALIFORNIA
415 - cALIFORNIA (sf) 408 - cALIFORNIA (sAN jOSE) 303 - cOLORADO
203 - cONNECTICUT 302 - dELAWARE 904 - fLORIDA
305 - fLORIDA (mIAMI) 404 - gEORGIA (aTLANTA) 808 - hAWAII
208 - iDAHO 312 - iLLINOIS (cHICAGO) 317 - iNDIANA
219 - iNDIANA (sOUEND) 515 - iOWA (dES mOINES) 316 - kANSAS
502 - kENTUCKY 504 - lOUSIANA (n. oRLEANS) 207 - mAINE
301 - mARYLAND 617 - mASSACHUSETTS 313 - mICHIGAN
616 - mICHIGAN 612 - mINNESOTA 601 - mISSISSIPPI
816 - mISSOURI (kANSAS c) 314 - kANSAS (sT. lOUIS) 406 - mONTANA
402 - nEBRASKA 702 - nEVADA 603 - nEW hAMPSHIRE
201 - nEW jERSEY (nEWARK) 609 - nEW jERSEY (i'M HERE) 505 - nEW mEXICO
718 - nyc (bROOKLYN, s.i.) 212 - nyc (bRONX, mHATTAN) 518 - ny (aLBANY)
716 - ny (bUFFALO) 516 - ny (lONG iSLAND) 315 - ny (sYRACUSE)
914 - ny (wHITE pLAINS) 704 - nORTH cAROLINA 919 - nORTH cAROLINA
701 - nORTH dAKOTA 513 - oHIO (cINCINNATI) 216 - oHIO
614 - oHIO (cOLUMBUS) 419 - oHIO (tOLEDO) 405 - oKLAHOMA
918 - oKLAHOMA (tULSA) 503 - oREGON 215 - pHILADELPHIA pa
401 - rHODE iSLAND (COUGH) 803 - sOUTH cAROLINA 605 - sOUTH dAKOTA
901 - tENNESSEE (mEMPHIS) 615 - tENNESSEE (nASHVILLE) 806 - tEXAS(cOW hELL)
214 - tEXAS (dALLAS) 817 - tEXAS (fORTH wORTH) 713 - tEXAS (hOUSTON)
512 - tEXAS (sAN aNTONIO) 801 - uTAH 802 - vERMONT
703 - vIRGINIA (aRLINGTON) 804 - vIRGINIA (rICHMOND) 202 - wASHINGTON dc
206 - wASHINGTON (sEATTLE) 304 - wEST vIRGINIA 608 - wISCONSIN
307 - wYOMING 666 - wHERE DO YOU THINK
wELL THAT WILL MAKE A NICE PRINTOUT FOR YOUR WALL, WON'T IT. nOW
YOU KNOW WHERE YOU'RE CALLING...
tHANKS TO : fDADKDNDgDBD (CAUSE HE MADE ME HAPPY HAHA) AND DWDMPDrDT
===============================================================================
(C) 1987, 1988 u.i. COMMUNICATIONS E.O.F. 10:01 est jERSEY 1/13/88-38
BY bLANK rEG XXXXXXXXX [XXXX]
8: Text Philez A-O
[UD:Punter][51 Min.][40]:

BIN
textfiles.com/phreak/art.of.telesear Normal file
View File

Binary file not shown.

76
textfiles.com/phreak/article.009 Normal file
View File

@@ -0,0 +1,76 @@
=======================================================================
British Phreaking in 1993
=======================================================================
In Britain we cant really phreak, we used to be able to on the old analouge
exchange but now in the era of the digital networks our tones no longer
bring us the much needed free calls.
Recently though we have learned how to box to different countries, using
various tones, the main one is America.
This is how a phreak from Britain would call back into Britain.
---------------------------------------------------------------
He would first call a toll free operator to a country that uses the MCI
satelite using the DTMF (dual-tone multi-frequency) tones, then he would wait
until he heard a slight change in the background noise and fire 2 tones made
of two different frequencies, normally 2400hz and 2600hz tones mixed together
and played for 150ms and then 2400hz and another 2400hz tone played for 100ms.
He would now be in control of the line now he would call his PBX in the US, he
would dial, using CCITT-5 this time, KP2-10-xxx-xxx-xxxx-ST. KP2 is Key Pulse
2 and is used for International calls, the 10 is for USA you can try other
numbers but it wont get you very far, the xxx's are the number you are dialing
including area code and ST is to start the connection although it isnt really
required these days its better to use it "just in case" you would now be
connected to the number you wanted, unless it was engaged or it was faulty. To
dial back into Britain he would call his PBX and when the number was connected
he would switch back into DTMF mode and dial his barrier code and the number
he wanted in the Uk. So as example :
+------+---------------+----------------------------------------+
| Type | Number/Tones | Action |
+------+---------------+----------------------------------------+
| DTMF | 0800-890-1234 | Dials toll-free operator |
| | | Pause 3 Seconds |
| | 2400/2600 | Break Tone |
| | 2400/2400 | Seize Tone |
| | KP2-10 | International call to America |
|CCITT5| 818-123-4567 | Number of the PBX in America |
| | ST | Start connection |
| | | It would dial and give the dialtone |
| DTMF | 1234 | Barrier Code |
| | 9 011 44 | External line/International call to UK |
| | 081-123-4567 | The number in the UK you want to call |
+------+---------------+----------------------------------------+
The way I do it is to log onto my COMMS program (ProComm Plus) and type
in "ATX3D" which means go on-line and wait for the other modem to connect.
I dont press enter, and I shell to DOS (ALT-F4) and run a BATCH file called
DIAL.BAT
(DIAL.BAT)
(CD\BLUEBEEP)
(BLUEBEEP /A)
(CD\PCPLUS)
(EXIT)
This loads up BlueBEEP, my box program for the SoundBlaster. I go to the top
of the action mode list of numbers and choose a random 0800 toll free number.
I pick up my phone which is connected along with the modem to an extention
cable, the phone has a in-ear-phone stuck on the mouthpiece. I dial the 0800
using BlueBEEP (I never use the keypad on the phone) and wait for the change
in background noise, I seize the line with the [+] key and go to a BBS number
and press ENTER, it dials for me the number including all the KP2 and ST
stuff, if the dial was ok it will ring and I quickly press F10 to exit from
BlueBEEP (that finishes my BAT file that drops me back in ProComm +) and I
hit ENTER, the modem goes on-line and everything is Ok. I nearly always get
a 14.4k line (99.9%) and no line noise, I also get a good CPS rate of about
1550/1600cps in ZMODEM.
I hope this text helps you budding phreakers in Britain !
-/- Z-N0TE -\-
-/- OTAKU SC0TLAND -\-
-\- MiDNiTE LEGi0N -/-
-/- DnA -\-
-\- NuP -/-

108
textfiles.com/phreak/at&t-cmr.txt Normal file
View File

@@ -0,0 +1,108 @@
AT&T TAKES NEW STEPS TO STOP CALLING CARD FRAUD
[ Internal AT&T Document, provided to the masses by
George Bush/TGH. I will upload a scanned Gif of this letter during the
next few days, what is in '[]' is my own writing ]
----------------
[AT&T Logo]
July 9, 1993
Document number 427
Classified information, for AT&T business executives rank
senior or higher [underlined] only.
Everything below is copyright (c) American Telegraph &
Telephone company. It may not be reprinted or reproduced in any
way. Neither is anyone allowed to mention or discuss the contents
of this document with anyone apart from the people
mentioned in the first line. Anyone violating this concept
will be charged for breaking copyrights, fired
(if an employee of AT&T) and sued for potential damages.
The remedies set forth in this statement are in lieu of any
others, oral or written, expressed or implied.
As previous information sheets have told, (# 177,253,287)
AT&T calculates with an measurable loss caused by
abuse of the AT&T calling cards.
The loss has so far been 70% less than at the same
time last year, but it still shows. In order to further
reduce the cost of calling card abuse AT&T plans to
introduce C M R (Computerlinked Matching and Reporting).
CMR is software, hardware and humans working together to
detect and act upon calling card abuse.
As mentioned in previous information sheets
(# 112, 177, 253, 287), calling card accounts are being
transferred by BBS' (Bulletin Board Systems) to all over the
world, leading several identical calling card accounts to
being abused at the same time.
This will not be possible any longer with the introduction
of CMR.
CMR will automatically match all calling cards in operation
continuously and when two matching calling cards are found
to be in operation at the same time, an AT&T operator will
be notified. The computer will then automatically try to
locate the calling card users (working on the presumption
that only one calling card is usually being used at a time),
and detect the kind of conversation. The computer will
[Bold Underlined] not tape any voice conversations, it will
merely register the kind of conversation, being it voice,
data or other.
This information will be stored in a record and the original
owner of the calling card will be contacted and asked if
permission has been given, if that is not the case AT&T will
take legal actions towards the abusers.
AT&T Hopes this will reduce the abuse of the AT&T calling
cards, and benefit our customers.
CMR is planned to be introduced in February 1994.
Detailed information concerning the CMR is available upon
request to executives with proper authority.
AT&T Technical director, Jonathan Biss
[signature]
---------
[ Bush: Well, fellow CC users, this is not good, assuming this
will go in order it seems AT&T will be able to match, and
then trace any call and its contents, as we all know, there
are few CC's and a LOTS of users, and if anybody are using
the same CC at one time..BANG. But if we handle this with
care, it wont mean to much. As we all know, Ripco is the
leading BBS (Nice to see you're in business again),
thus TGH has decided that Ripco shall be the place were we
discuss this. As we know, Ripco has one of the tightest
validations schemes, yet over 400 users, with regular
number bulletins, we are currently working on a system which
will make you, the users of Ripco safe from CMR, provided
everybody follows the rules. Further information concerning
this will start appearing at Ripco during the next few
months, so if you are not registered at Ripco we cant help
you. Because of this new CMR the sysop at Ripco has agreed
to extend the user roof to 750 users. Validation will
continue until August, then it will become a permanently (?)
closed system. We feel that with 700-800 users Ripco will be
able to provide and be provided with enough necessary
information so that its users will not have to fear CMR.
REMEMBER!: If you have any new information, dont be a lamer
and sit on it, we must exchange all information with each
other. ]

630
textfiles.com/phreak/at&t.nws Normal file
View File

@@ -0,0 +1,630 @@
-----------------------------------
%>> Ctrl-S Pauses/Space Quits <<%
Uploaded By: EL PIRATA'
%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$
$% $%
%$ laymens telephone directory ii %$
$% =-=-=-=-=-=-=-=-=-=-=-=-=-= == $%
%$ covering: the at&t corporation %$
$% and $%
%$ 7 regional bell co's %$
$%..................................$%
%$..........date: 01/01/86..........%$
$%..................................$%
%$ written by: %$
$% $%
%$ -=> <el pirata'> <=- %$
$% united states pirates guild $%
%$ ++ 509 regional forces ++ %$
$% $%
%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$
preface
///////
"laymens telephone directory i"
was a listing of 20 occ's and
resellers. included in the phile was
information regarding 'how to become a
subscriber' to each company, and if
there are any monthly minumim and
set-up charges. the phile is a great
aid for those who wish to learn more
about a lds in question, (subscribing
to a service in most cases yeilds:
listing of access ports, code format,
and any special calling features which
are availible).
introduction
////////////
as we all know, on january 1st,
1984, the world's largest corporation
was split up. in this text i will
cover the milestones leading up to
at&t's divestiture, at&t's
corporations <current> structure.
also included in this text is a
depiction of ma bells regional
companies, which were lost by at&t as
a result of its breakup.
events prior to the breakup
///////////////////////////
1968....fcc rules that customers may
attach technically compatible non-bell
equipment to bells telephone network.
1974....charges claiming that at&t was
using its bell companies to freeze out
competion in long distance & equipment
markets are brought by the justice
department.
1978....court ruling won which forced
at&t to allow long distance
competitors to connect with its system
at both ends.
1980....fcc decides that that at&t may
compete without regulation in
telephones, switchs, and computer
related markets, yet can not use
profits from these markets to
subsidize other sales.
1981....fcc makes it legal to buy wats
(wide-area telephone service) in large
units and resell the service through
switching systems at a profit. this
was the decsion that has brought about
the hundreds of resellers which now
infest the long distance market.
after the government ceased presenting
evidence in the antitrust case against
at&t, judge harold greene declines
at&t's gesture to throw out the case.
january 8th
1982....at&t agrees with attorney
general william baxter to give up its
local operating companies. in return,
they would be granted permission to
compete in regulated markets, exempt
from political restraint.
august 24th
1982....after over eight months, judge
harold green finally signs a modified
settlement agreement.
december 16th
1982....reorganization plan filed by >a
at&t which sets out the division of
~assets, personnel, etc. between the 22
bell operating companies (boc's).
january 1st
1983....at&t sets up a subsidiary. at
first it was named american bell,
later, the name was changed to at&t
information systems.
august 5th
1983....judge harold green approves
the december 16th, 1982
reorganizational plan.
+january 1st
+1984....this is the date that at&t
officially signs over ownership of
their 22 operating companies, its name
and logo, the yellow pages service,
revenue from both local service and
some intra state calls, and some
rights on licensed patents.
todays at&t
///////////
at&t currently is made up of two
main divisions. at&t communications
and at&t technologies. at&t
communications handles long distance
telephone services, overseas cable,
and satellite transmission. at&t
technologies consists of at&t
information systems, at&t bell
laboratories, at&t network systems,
at&t international, at&t consumer
products, and at&t technology systems.
broken down further, here is a
depiction for each of at&t
technologies sub-divisions.
=>at&t bell labratories
>research and development (r&d).
=>at&t consumer products
>manufacturing home telephones,
>home/office systems, terminals
>and printers.
=>at&t information systems
>marketing business and residential
>phone systems, office products, and
leasing phones.
=>at&t international
>manufacturing and selling products
>overseas.
=>at&t network systems
>manufacturing switches, cable and
>microwave equipment.
=>at&t technology systems
>manufacturing computer chips,
>computers, electronic components, and
>communication systems.
when dealing with at&t, you now
know exactly which division to go
question, regarding your needs.
at&t is the nations fourth
largest corporation and is twice as
large as its closest telecom
competitor, gte.
bell regional companys
//////////////////////
the twenty two operating companys
which were lost by at&t are now
subsidiaries of seven regional
companys. these are ameritech, bell
atlantic, bellsouth, nynex, pacific
telesis, southwestern bell, and us
west. within the seven regional
companies other than the 22 operating
companies (who provide local service,
market equipment, and publish
directories) there are cellular
services subsidiaries (who market
mobile telephone equipment and
services), and bell communications
research (they provide technical and
support services. listed are the
seven regional companys with their
subsidiaries.
ameritech
:::::::::
illinois bell
indiana bell
ohio bell
wisconsin telephone
bell atlantic
:::::::::::::
bell of pennsylvania
diamond state telephone
four chesapeake & potomac companies
new jersey bell
bellsouth
:::::::::
south central bell
southern bell
nynex
:::::
new england telephone
new york telephone
pacific telesis
:::::::::::::::
nevada bell
pacific bell
southwestern bell
:::::::::::::::::
no subsidiaries
us west
:::::::
mountain bell
northwestern bell
pacific northwest bell
the listing above should bring
the boc's into a much more
understandable perspective.
each of the companys listed are
authorized to use the yellow pages
service, bell name and logo, receive
local service and intrastate toll call
service revenue, enter telephone
rental and sales, cellular phone
service, data transmission and many
other fields.
closing
///////
"i hope that you have learned
something thru the reading this text,
and other tutorials which i've
written, as the sharing of knowledge
was the primary reason for their
creation."
i would like to extend a special
thanks to each of the regional
companys 'share owner services' for
useful information they provided.
telecom boards to call:
the rat-trap bbs /509-928-7120/
the trading post /703-486-4015/
\\\\\\\\509 regional forces////////
\\\\\\\\\tog elite/////////
\\\\\\v//////
-----------------

36
textfiles.com/phreak/at&t25.hac Normal file
View File

@@ -0,0 +1,36 @@
--------------------------------------------
Here is the official AT&T 25-pair color key.
For use for trunk cables.
Retrieved and Typed by: Kingpin
--------------------------------------------
1. White/Blue
2. White/Orange
3. White/Green
4. White/Brown
5. White/Grey (Slate)
6. Red/Blue
7. Red/Orange
8. Red/Green
9. Red/Brown
10. Red/Grey (Slate)
11. Black/Blue
12. Black/Orange
13. Black/Green
14. Black/Brown
15. Black/Grey (Slate)
16. Yellow/Blue
17. Yellow/Orange
18. Yellow/Green
19. Yellow/Brown
20. Yellow/Grey (Slate)
21. Violet/Blue
22. Violet/Orange
23. Violet/Green
24. Violet/Brown
25. Violet/Grey (Slate)


714
textfiles.com/phreak/at&tnews Normal file
View File

@@ -0,0 +1,714 @@
AT&T USER'S GROUP SAN FRANCISCO, CA NEWSLETTER FEB88
User Group member Bill Todd of Todd PC3 gave a demonstration of his
AT&T PC6300 conversions. Bill has been an AT&T owner/user since
September, 1985. He uses the computer for business, engineering and
scientific applications. Through his business, Bill does computer
conversions and sells accelerator boards. He has been working on
several upgrades to the PC6300, which he has designated the
Mark 8, Mark 10, and Mark 11.5. They were developed as inexpensive
alternatives for increasing the performance of the 6300, using an
integrated approach, combining both software and hardware changes.
These include the installation of an NEC V-30 microprocessor; new DMA,
bus controller and timer chips as necessary; and software that moves
the ROM BIOS and hard disk BIOS into RAM, and also changes the memory
refresh rate.
Bill explained that the AT&T 6300 is assembled with parts that meet
specification, but they are not "dynamically optimized". Some
motherboards may have the same revision letter but still use different
The systems are tested before conversion to check relative
performance. The soldered-in chips are professionally removed, and
sockets are installed. Then high speed componentry is installed. If
it all meets spec, the software is added. The system is then tested
for final benchmarks. As part of the conversion process, any
deficiencies in hard disk setup are found and corrected, and several of
the modifications are specifically designed to increase hard disk
throughput.
The Mark 8 conversion is available now at $225.00, and Bill claims a
typical benchmark speed increase of about 20% with actual throughput
approximately doubled (depending on application and hard disk). Both
the Mark 10 and the Mark 11.5 conversions are under development,
probably due in mid-March.
The Mark 10 conversion, which is planned to increase throughput by a
factor of approximately 7 times, will go for an estimated $500.00.
The systems have a 1 year parts and labor warranty. The conversion can
be done on site, but it normally takes 7-10 working days to do a
conversion when you ship the unit to his shop. Contact Bill Todd for
shipping details. In the near future the data can be downloaded from a
the mailing list or for more information.
Bruce MacKenzie from SOTA spoke about the SOTA Mothercard 5.0A. He
briefly explained EMS, EEMS, and protected mode operation with an
80286 system, and how these hardware features will affect a user's
ability to run new software and operating systems. The main features
of the SOTA card are:
1) full compatibility with the AT&T 6300, standard DOS applications,
and networks; 2) the ability to run OS/2 and other protected mode
systems, such as ORACLE; 3) the ability to access up to 16 Mbytes of
extended memory (non-paged) 16-bit RAM; and 4) a significant speed
increase due to the 80286 microprocessor. The "A" version of the
Mothercard 5.0 was designed specifically for the PC6300 to meet the
requirements of several large government agencies. Installation
involves the running of a specially designed 2.2 ft. impedance matched
shielded cable from the SOTA card to the 8086 socket on the bottom of
the 6300 motherboard, and transferring the 8086 to the new card.
Bruce demonstrated the operation of IBM OS/2 on a 6300 with the SOTA
card installed. One of the neat tricks that SOTA has come up with
is a programmable AT ROM BIOS to keep up with whatever tricks
machines. The card runs at 10 Mhz, with a 12.5 MHz version
in the works. With a 10 Mhz SOTA card installed, a PC6300 runs
about 20% faster than an 8 MHz IBM AT. At the moment, switching
between 80286 and 8086 mode requires a re-boot.
In 80286 mode, original PC6300 memory is used only by utility software
-- normal program operation takes place in the SOTA card's own RAM.
There is a spare connector on the card that SOTA intends to use for
connection to a 16-bit hard disk controller card they will manufacture.
List price: $895 for the 10 MHz card, $995 for the 12.5 MHz version
(a 10% discount is available to User Group members through Todd PC3).
SOTA Technology, Inc. 657 N. Pastoria Avenue, Sunnyvale, Ca 94086
(408) 245-3366
PRESIDENT'S BITS
Joe Mahoney
****************
We are looking for programs for meetings in June, July, August.
Please call with your ideas. Your President is taking a close look at
have a new subscription plan ($12/year) for out-of-state readers who
are not members. Individuals will be contacted by letter before they
are dropped from the mailing. The 13th West Coast Computer Faire is
coming up April 7-10. We will participate in the event with a booth,
and badges to see the Faire for members who help at the booth, as last
year. Call the Joe, or Kevin Newman for details.
We will have election of officers in June, with nominations starting
at the May meeting. Consider taking a spot on the Executive
(steering) Committee. Anyone interested in attending an Executive
Committee meeting or having an item discussed at the meeting should
contact me quickly. I hope to get the EC together before the March
meeting.
Scanning other user group's publications can be interesting and
entertaining. The Sacramento PC Users is one of the largest in the
West (2000+) and has an impressive publication, Sacra Blue. The Editor
recently happened across an old, unopened, dust-covered box of Dysan
DD/DD floppies at a Davis office supply store. The price? Only
$85.00. This sort of believe-it-or-not is just the opposite of the
kind of consumer action report I'd like to see shared here in the
newsletter: if you find a good buy or exceptional service in an area
shop, pass the word along to the readers!
I can't resist a magazine subscription or the rack at Crown Books.
Have you discovered PC RESOURCE yet? Not only have they plugged our
group and reviewed the 6300 (Clone Report, Feb 88), they always have
great do-it-yourself tips on hardware -- disk drive maintenance (Sep),
drive alignment (Nov), installing a 3.5" drive (Jan), memory chip
additions and the Mothercard from SOTA (Feb). This magazine has
articles on software, new products, programming, applications, industry
news -- written so that even a novice can get into the subject.
There's DOS handbook reference cards bound into most issues. The
photography is sharp and the overall layout quite appealing. Take a
look!
USER GROUP TECH-TIPS #6
L.J.(Larry)Risner
AT&T Tech Staff
***********************
A major concern of computer owners today is how to upgrade their
current CPU and retain as much of their investment as is possible. In
this article I will attempt to describe some of the benefits of
"adding a system to a system" as well as some of the trade-offs one
should consider. The boards being discussed here are the i80286 &
i80386 processor boards that can be inserted into the bus in the CPU
housing.
First consider the starting point, your existing CPU. If it is an
AT&T PC (I am assuming for this discussion that it is an AT&T PC), the
basic CPU meets the first test with flying colors - an adequate power
supply. The power supply in the PC6300 is rated at 170 watts, which
will support even the most demanding peripheral.
What board fits the bus? The PC6300 as well as the PC6300+ will
accept PC/XT compatible boards, but not AT style boards. The 6310,
6312 and 6386 will accept PC/XT boards, and also AT style boards.
Refer to your user's manual to determine your bus configuration.
What will the board do for me? Perhaps the best way to think of an
"add-on" board is to consider your original system as an input/output
device for another computer. That is, all activity to and from the
added CPU, regardless of how fast it is, will be to and from your
existing system and peripherals (by the way, the biggest bottleneck for
a CPU is it's storage media).
So there you are. Adding a board will give you a much more powerful
CPU that is "wrapped" by your existing hardware. This may not be
at all bad depending on your reasons for adding the CPU. If all you
want is more horsepower and you are using applications that don't
utilize a lot of disk access then this may be for you. However, if you
are into something that moves a lot of information around and through
the bus, then you may want to consider a unit that is totally faster, a
new machine - the decision is yours. Here is a small list of
comparisons:
ADD-ON BOARD
Memory - Limited to on-board space (4-16M max - typical)
Power Supply - Original PC unit
Speed - Accelerator board increase only (not entire system)
Peripherals - Limited by bus design
NEW MACHINE
Memory - Limited by bus slots (16-48M max - typical)
Power Supply - Large capacity to support added memory
and peripheral requirements
Speed - Higher performance bus and peripherals are in support of CPU.
Peripherals - Total adaptability (except 32 bit slots, which differ by
manufacturer)
FILE MANAGERS
Kevin Newman
*************
(editors note: At the time Kevin was writing this, things looked
pretty sad for newsletter contributions from members. However, in the
last several weeks, articles have started to come in, and we hope this
is a trend. Otherwise, I heartily endorse what Kevin is saying here.)
It's been 7 month since my last "monthly" article. The reason I have
started this article in this manner (which is supposed to be
about file managers), is that I am trying to show that I understand
why so few of YOU have never sent in an article, come up with a
program for the meeting, or offered to help with any of the many things
which need to be done to keep the User Group going. It is a pain to
try and write these things when you aren't a writer (7 months between
articles indicates how difficult this is for me, and when compounded
by inherent laziness -- poof! -- 7 months).
- But try and think of what Ed has to go through to get the newsletter
out by himself, and my laziness (and maybe yours) is rather a weak
excuse. What I am trying to say is that I have been rather surprised
at the lack of enthusiasm that people show when asked to volunteer for
any type of position in the group (such as the "enthusiasm" we all
showed when Joe asked for volunteers for group Secretary).
Now, I am not the one to criticize. I volunteered all right, but have
produced less than nothing when compared to the fact that just a few
individuals are shouldering most of the work (we all know who they
are). What I am trying to say is, we as a group will only survive if
we work as a group. Now that I've said my piece, I'll get down off my
soapbox and cover file managers.
Have you ever looked at the multitude of files on your hard disk and
thought to yourself "What a mess?". Well, if so, you are in need of a
file manager. A file manager is a utility that allows you to do the
basic and not so basic manipulations that we all have to do to keep our
hard disks organized and have some space left over.
One quick side note: so far I have only talked about using file
managers on your hard disk, the reason being that with the current low
price of hard disks I don't know of anyone other than laptop users
- without a hard disk in their computer (and the 720k floppies in
laptops could use a file manager).
It is true that DOS gives us ways to keep everything organized, but
what happens when you have a directory with 240 files in it and you
only want to delete certain ones (and you have to decide which ones to
delete)? This is where the file manager comes in. There are a large
number of different file managers that are available, but all do
basically the same things with some doing a bit more than others. In
the next few paragraphs I will discuss the basic functions of most
file managers.
One of the most powerful feature included in almost all file managers
is a concept known as "tagging". The idea behind tagging is to mark
specific files within a group allowing you to manipulate all of these
"tagged" files as you require (i.e. delete, copy, move). Since most
file managers display all files in a directory in two, three, or more
columns, "tagging" files as you move the cursor across the file
listing is quite an easy task.
Another powerful feature of file managers is the ability to sort files
so that you may look at them in different ways, such as sorted by
date, extension, attribute and other sort keys.
-
One feature that I use quite often is the "move" command. This
command performs a pseudo file copy, but instead of actually copying
the file to the destination (i.e. different directory), simply
performs a rename in the File Allocation Table, effectively
"moving" the file to the new location by assigning a new pathname
to the file (the actual physical location of the data on the
disk is unchanged). There is one limitation to this command:
it can only move files on the same physical device (i.e. files
can be "moved" to a different directory on one hard disk, or on a
floppy, but not from a hard disk to a floppy).
I realize that this has been a rather brief article but you can't
imagine the agony of just getting this out. Hopefully as I continue
to write, this will become easier.
(Kevin Newman is our Public Domain software librarian, and a
knowledgeable source on available programs that make life easier for
computer users. I would like to add two of my favorite file manager
functions to his list. The "look" function (or "browse", or "scan")
allows you to make a quick check of the contents of a file without
having to call up the application that created the file. Also, most
file managers give you the ability to "rename" a file simply and
easily from the file listing. -ed)
COMPATIBLE HARDWARE
Thomas Herzfeld
*******************
KEYTRONICS KB5151 KEYBOARD. This keyboard is available as an
alternative to the AT&T standard keyboard, which does not provide a
separate numerical keypad and arrow keys. It is cabled to use the
standard AT&T keyboard input port, and behaves exactly like the AT&T
keyboard. The touch is excellent. Drawbacks include lack of a mouse
port and a small carriage return key. The former makes it necessary
to use the serial port for mice (see below) and the latter problem has
generated more typos than any intoxicant. The function keys are
placed across the top of the keyboard, which means that the standard
templates provided with most programs will not fit. Special templates
for the KB5151 are readily available for WordPerfect, and no doubt for
other programs.
LOGITECH C7 MOUSE. I just obtained the latest version of this best of
all mice. Logitech has eliminated the external power supply, so all
you have to do is plug it in to the serial port and load the software.
The touch is excellent, and the editor provided continues to improve.
The mouse can be configured to run on COM1 or COM2, which is more than
can be said for the 6300's serial port.
AST RAMPAGE BOARD (STANDARD VERSION). I was unable to obtain the AT&T
version of this board, because no one would acknowledge its existence
in 1986, so I bought the 8-bit bus version. It works perfectly, and I
don't know how I got along without it. It may be slower than the 16
bit version, but I have not been bothered by any sluggishness using it
as a virtual hard disk.
A NOTE REGARDING THE 6300 SERIAL PORT. It is hard-wired as COM1.
This becomes a major flaw when you have an internal modem which you
want configured as COM1. As a result of this glitch, I now own both an
internal modem and an external modem. The external modem is connected
to the serial port via an A-B switch, so that I can use either the
external modem or the mouse. Fortunately, I have not needed both at
the same time.
VIRUS EPIDEMIC?
Joe Mahoney
***************
A microbiologist, I read with interest the reports on virus problems
with PC's. You've heard of these nasty items -- known also as Trojan
Horses, worms, logic bombs -- tiny (a few hundred bytes) programs or
segments that invade your diskettes or disks (!) and secretly
replicate, eventually wrecking or erasing your data, interrupting
entire systems, or perhaps only flashing a surprise message ("Peace or
Earth" or the like, or worse) on the monitor.
The San Francisco Chronicle (2-12-88) covered a MacIntosh virus that
was spread through "infected" files on CompuServe and GEnie (hypercard
application files, system files). The virus creator bragged that this
group had worked on the virus for over a year! John Dvorak (PC
Magazine) describes virus concerns and mentions the celebrated Lehigh
University virus -- computing center students at that college found
viruses widely spread throughout their public domain diskette library
in December 87. Earlier, AMIGA users got an infection through altered
boot or system files on application software diskettes.
Publications and industry spokespersons have been reluctant to cover
this area, fearing that publicity will invite problems and ever more
diabolical and creative sabotage. Software developers and university
researchers are scrambling to find ways to detect viruses and write
utility programs, but the wicked hackers will always strive to outsmart
'em. Security and protection of data -- personal or corporate or
government -- is at stake... part of our right to privacy, no?
What do we do to protect ourselves?
The choices now are few. First, wear your protect tabs ("safe-
computing" as Dvorak calls it) to prevent unexpected program segments
being written to your floppies. Viruses spread from machine to
machine within a file on a floppy or perhaps through E-mail or BBS
systems. Once programmed into a COMMAND.COM or other executable file,
you may unknowingly replicate them -- a write protect precaution will
alert you when a harmless copy, dir, or type command gives a write
protect error.
Back-up your files frequently. If you discover an infection you may
still have "safe" files in reserve. (We do this routinely anyway,
right?)
Dvorak and others tell us to keep an eye on the date/time labels on
files. COMMAND.COM, and other .COM or .EXE files do NOT get updated
frequently...you could print-screen and save to refer back to this data
periodically. Some writers say to keep an eye on file size (bytes) --
system files should not change size unexpectedly. Dvorak says size is
not a good check as most viruses are small.
Be a little reluctant to take personal diskettes into the workplace and
chose your software carefully. Trading programs and diskettes is a
popular but risky business. One peninsula computer store claims they
got a virus when a customer brought a game disk in to try on some of
their computers!
Yes, "safe-computing": use prophylaxis, and know your files and
friends!
- Joe Mahoney
APRIL MEETING (S.F.)
Barry Newman
********************
There will be a presentation at the April meeting by D.R.I. (Digital
Research Inc). They will be showing GEM, a mouse manipulated, icon
based operating system quite similar to the Mac. In addition, they
will be showcasing GEM Desktop Publisher and GEM Draw, both excellent
graphics products plus other products in the GEM line. They have
offered to supply some copies of a few of the products as door prizes.
Be sure to attend as you'll have an opportunity to see some excellent,
reasonably priced graphics presentation software.
EQUIPMENT REVIEW
Ed Ely
****************
RAMSACK 16-bit Memory Board
Computer Peripherals, Inc.
I have been looking onto various upgrades for my PC6300 for some time,
and I have found that while not all PC/XT compatible hardware will work
with the AT&T machines, some of the best pieces of equipment work just
fine, and many specifically support installation in AT&T computers.
The Plus HardCard and Intel AboveBoard are two examples that come to
mind.
However, the fact that we sometimes have fewer choices in a given
hardware category can mean that it is sometimes difficult to find an
effective solution that is also inexpensive. For example, try to get
two floppy drives and a hard disk operating on a 6300. Not an
inconvenient arrangement for other machines, it is for the 6300. We
must install a hard disk on a card, or an external unit, typically at
greater cost than would be the case for a standard-mount hard disk of
similar performance.
If AT&T had decided to provide the PC6300 and PC6300+ with industry
standard 16-bit peripheral slots, instead of the AT&T proprietary
design, there would be a lot more 16-bit peripherals that would
support the AT&T machines. As it is, there are very few products
designed to take advantage of the wider data channels available on
these computers.
With AT&T's recent decision to discontinue the 6300, we can probably
expect even fewer new products that will specifically support it.
However, there are products out there that do utilize the special
features of the AT&T machines, and we will continue to report them as
they come to our attention.
Memory cards are an interesting case study. AT&T sells an "Enhanced
Memory Board", manufactured by AST, that uses the special AT&T 16-bit
bus on the 6300 and 6300+, and has excellent performance. It is a good
product, but it is relatively expensive, and it can only be used on an
6300 or the 6300+ (not even the 6310/6312 can use it). Memory boards
that utilize AT compatible 16-bit slots are not compatible due to the
bus design.
Many PC/XT memory boards that use the standard 8-bit slot are
compatible with the AT&T machines, but you are limited in performance
due to the narrower data path and lower clock speed on the 8-bit
peripheral bus (4MHz). Of course, many of us have opted for the AT&T
board, or for one of the many 8-bit memory boards, and have been very
happy with the results (big RAM-disks, print spoolers, disk caches,
swapping programs in and out of EMS memory or even multi-tasking on a
PC6300 with DESKview).
Along comes Computer Peripherals, Inc. (CPI) and produces a memory
board called RAMSACK. This is a hybrid product that has the standard
8-bit PC bus connector, the 16-bit AT bus connector, and the 16-bit
AT&T bus connector. Therefore, it works in 8-bit mode on a PC/XT
compatible machine, in 16-bit mode on an AT compatible machine, and in
16-bit mode on a PC6300. It was originally designed to work also on a
6300+, but that did not work out (CPI claims AT&T changed technical
specifications on the 6300+ after it was too late for them to re-
engineer their board).
There are a minimal number of jumpers and DIP switches to check on the
board, mostly of concern if you are going to install more than one
RAMSACK board, but for the installation of one board, the entire
installation setup is done through software that is run from a floppy
disk. The setup information is then stored in non-volatile RAM.
One unusual and necessary trick to the installation, that is not made
clear anywhere in the manual, is that to install the RAMSACK for the
16-bit bus on an AT&T machine, you must run the installation program
while the board is plugged into an 8-bit slot. When the installation
program is complete, you then shut down the computer and transfer the
board to a 16-bit slot. This information had to be obtained from a
phone call to CPI technical support. They were very helpful, but such
a major omission in the manual was not an encouraging omen.
There were two main reasons that I wanted additional memory beyond the
640K already on the main board. The first was to be able to run a
large disk cache without eating into DOS memory. With the RAMSACK
memory board, this has worked out wonderfully. I use the cache
program from MACE utilities (a licensed version of Golden Bow VCACHE),
and it has resulted in a very substantial decrease in effective disk
access times, as the cache program typically finds approximately 85% of
requested data in the cache, and therefore only about 15% of disk reads
actually go to the hard disk. There is also a smaller saving in disk
writes, by ignoring duplicate data.
The cache operates slightly slower using EMS memory, as compared to the
same size cache in standard DOS memory. The "paging" requirements of
EMS memory exact a slight penalty here. One important note: the
newest version of MACE utilities uses a different cache program that
does not recognize the EMS memory on RAMSACK (so far, neither MACE nor
CPI has come up with a satisfactory explanation).
The second reason for the extra memory was to be able to swap programs
in and out of expanded memory -- allowing an entire application (and
all its data) to stay resident in expanded memory while another
application runs in DOS memory -- and then be able to switch back and
forth between applications. There are several programs available that
accomplish this -- the one I use is the shell program from WordPerfect
Library. So far, the program recognizes the extra memory and utilizes
it correctly when I manually "exit to shell" from an application --
that application is then swapped to expanded memory, and I am able to
utilize the full 640K of DOS memory for another application (less any
TSR programs, and the resident portion of the shell program and the
disk cache). The actual swapping takes place in less than a second,
which is tremendously quicker than saving your data, exiting one
application and then starting up a new one.
However, I have run into problems when I attempt to use a "hot-key" to
switch applications, which is supposed to work, and works on other
identical systems. When I contacted WordPerfect about the "hot-key"
problem, they said they would obtain a RAMSACK board, put it in an
PC6300 and try to find a fix. A plug for WordPerfect product support -
- they are the best I have ever encountered -- they don't just mutter
something about hardware incompatibility, they actually seem to have an
interest in getting things to work right, and they are well acquainted
with AT&T machines.
The RAMSACK board with 2 MBytes sells for $450 to $600 retail (I don't
have the actual list price), but I have seen it priced as low as $175
with 0K installed ($165 in quantity). The board comes with software
for a print spooler, RAM-disk, and disk cache (for diskettes only).
They do not provide a hard disk cache. CPI also includes a SIDEKICK-
like collection of desktop utilities which I haven't tried because it
duplicates many of the functions I am already using with WordPerfect
Library.
The RAM-disk can be varied in size, but I ran up against a 64 file
limit, regardless of the amount of memory allocated for the RAM-disk.
Fortunately, the DOS RAMDRIVE.SYS recognizes and uses the RAMSACK EMS
memory, and can be set for a maximum of 1,024 root directory entries
(DOS 3.2). The RAMSACK board come in various standard configurations
with up to 4 Mbytes of memory (with a plug-in daughterboard).
There are DIP switch settings to allow unique memory addresses
for up to four boards (if you have the slots).
The RAMSACK memory can be used to "back-fill" conventional memory up
to 640K, or as LIM compatible expanded memory (paged), or as extended
memory (non-paged) on an AT compatible system. CPI plans to have LIM
4.0 software emulation available sometime in the second quarter. The
board comes with a two year warranty.
Computer Peripherals, Inc. 2635 Lavery Court #5, Newbury Park, Ca
(800) 854-7600 (outside Calif.) (818) 710-1717 (inside Calif.)
SERVICE/PARTS EXCHANGE
**********************
Last month, we reported some rather remarkable exchange parts prices
available through the AT&T Service Center in San Leandro. Some members
called, and received substantially different (and higher) price quotes
over the phone. The problem was not that the prices were wrong -- the
telephone number was wrong. We inadvertently published the number
for the Data Services Organization (AT&T DSO) in Oakland, not the San
Leandro Service Center.
All the DSO service depots (there are several in the Bay Area) look up
their prices on a common data base, and whatever price is shown is what
they have to charge. The Service Center in San Leandro is a separate
organization within AT&T and has a totally different pricing structure,
and since the last newsletter, they have reduced their prices. The
AT&T Parts Hotline will also arrange parts exchanges, and they have yet
another pricing structure.
As an example, to replace a PC6300 motherboard through the Parts
Hotline, you will end up paying something like $1,100, depending on
the model of the motherboard and amount of RAM installed (that price
includes a small exchange value for your old board). If you were to
make the exact same exchange through a DSO location, the cost would be
in the neighborhood of $500, again depending on model and amount of
RAM. If you take your old board to the counter at the San Leandro
Service Center, the cost will be $101.00 plus a $10 handling charge,
for any PC6300 model.
Now this price does not apply if you bring in the whole computer and
have them look for the problem, remove the board, make the repairs,
and put everything back together again. That process could very well
cost you around $500. Also, they do not just give you a new board in
exchange. You need to leave your board there, and they will attempt to
repair it.
If it can't be repaired, you will be given an exchange board. Either
way, it's the same price. And the board you get back will have all
the latest revisions (including ROM BIOS updates). You won't get a
640K board back if you give them 256K, and you won't get a CPU-3 if
you give them a CPU1-A, but otherwise it will be completely updated
(unless you request that it not be).
The Service Center is located at 2200 William Street, at the corner of
Doolittle, in San Leandro. Their telephone number is (415) 678-1300
(that's the correct number this time). Business hours are
8 AM to 4:30 PM, Monday through Friday.
They will also accept UPS shipment, but you must contact them
by telephone prior to shipping.
So far, they are set up only for repairs on the PC6300 (and PC6300+).
Here are some more examples of their exchange prices: Keyboard
($35.11 + $2.00 handling); ANY supported hard disk, 10 or 20 Mbytes
($95.56 + $10.00 handling); power supply ($42.11 + $2.00); video card
($89.38 + $2.00); HD controller card ($44.24 + $2.00). Thanks again to
Dave Ralston, who is the supervisor for the computer repair group at
the service center.
In upcoming issues, we will look into the services provided by the DSO
depots, and the various AT&T Hotlines. If you can pinpoint your
computer problems down to the board level, and feel comfortable with
removing and reinstalling components in your machine, the San Leandro
Service Center prices can't be beat. If you need someone else to
handle more of the job for you, the DSO depots may be more convenient
and may be somewhat closer in price for the same work performed at the
main service center. However, Dave Ralston and his group may be hard
to beat. For more information, use your phone -- that's why God
created AT&T.
DEPARTMENT OF CORRECTIONS
*************************
Some of you may have noticed that we managed to have two NEWSLETTER #11
issues (October/November, and December/January). That's just my way of
pretending to be overworked. I sure could use a proof-reader, or
other help on the newsletter. It would be nice if someone could take
alternate issues. Give me a call, or come and talk at one of the
meetings. I ain't gonna keep this up forever. -ed
EDITORIAL & ADVERTISING POLICY
******************************
Display ads and classifieds, maximum 9 text lines (as above): $5.00 per
issue, free to members.
We will print articles, reviews and letters as they are submitted and
as space and time permits. Modem or diskette preferred. First
choice: Wordperfect. Or WordStar, MultiMate or ASCII text. (Please
indicate which in the file name or on the diskette label, and include
a printout for reference). Advice, help, comments and criticism are
welcome. For now, we will combine articles on meetings in all
locations in this newsletter.
Copy deadline for the next issue of the Newsletter is March 21. Many
thanks to those who have contributed to the newsletter. Please keep
the information coming.
BAY AREA AT&T PC USERS GROUP
P.O. Box 410321 S.F. Ca 94141-0321
**********************************
PRESIDENT Joe Mahoney
W:(415) 540-2219/540-3256
H:(415) 586-8376 371 Joost Avenue, San Francisco, Ca 94131
VICE-PRESIDENT Maurice Aranda
(415) 972-0669
SECRETARY (position vacant)
TREASURER Frank Davidoff
(415) 237-3865
MEMBER-AT-LARGE Mark Almeida
"The Wiz" Data:(707) 429-1035
W:(415) 823-9553 H:(707) 429-9122
LIBRARIAN Kevin Newman
(415) 933-7391 504 Waterbery Dr. Pleasant Hill Ca 94523
DATABASE KEEPER Bill Goebner
(415) 823-6931
NEWSLETTER EDITOR Edward Ely W:(415) 836-0910 H:(415) 641-1556 379 Day
St. San Francisco Ca 94131
SOUTH BAY/SILICON VALLEY
Bob Larsen (408) 224-4422
Joe Lipsig (408) 733-6522
EASY ACCESS BBS, WITH AT&T SIG (300/1200/2400 8/N/1)
(415) 829-6027 Tony Waddell, Sysop
RICK'S HIDEAWAY BBS, WITH AT&T USERS CONFERENCE (1200/2400 8/N/1)
(916) 961-1042
AT&T USERS GROUP LIAISON
Jim Keeton (415) 442-2692
AT&T PUBLIC RELATIONS
Mark Dill (408) 995-3966
AT&T TECHNICAL CONSULTANT
Hal Shields (415) 442-2740
AT&T TECHNICAL CONSULTANT
Larry Risner (415) 464-4687
AT&T TECHNICAL CONSULTANT
Syd Reid (408) 522-4802
AT&T TECHNICAL HOTLINE
(800) 922-0354
AT&T PARTS ORDERING
(800) 922-PART
AT&T CUSTOMER INFORMATION CENTER (800) 432-6600.
This following list of AT&T support boards and boards with an AT&T
sub-board or conference was compiled by Ken Camp, who can be contacted
via one of the boards shown in 415 area or via FIDO NetMail at 161/42
(The Records Department 415-426-0470)
Flea Market 201-446-1665 (Merged with The Right Choice BBS)
( Please use 201-974-8317 )
AT&T Dev 201-658-5345
ITM Database 201-943-5419
The Right Choice 201-974-8317
AT&T Info. Exchange 201-980-2012
ASCII Neighborhood 203-934-9852
Deathstar 301-839-0705
Black Hole 305-260-6397
Florida Death Star 305-660-6300
INDY Net One 317-846-8675
CBM Computer Center 402-391-3102
THE SOQUEL BBS 408-462-6329
Easy Access 415-829-6027
The Unknown 516-486-4705
Ed Hopper's Board 713-782-5454
Software Safari 717-226-1943
So. Cal. AT&T BBS 818-954-0530
***************************************************************


1390
textfiles.com/phreak/at&tnews.16 Normal file
View File

File diff suppressed because it is too large Load Diff

49
textfiles.com/phreak/at_tcard.txt Normal file
View File

@@ -0,0 +1,49 @@
Phreaking AT&T Cards
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
My topic will deal with using an AT&T calling card for automated calls. Ok
to place a call with an AT&T card, lift the handset (PAY PHONE) hit (0) and the
desired area code and the number to call. Also when calling the same number
that the card is being billed to you enter the phone number and at the tone
only enter the last four digits on the card. But we don't want to do that now,
do we. If additional calls are wanted all you do is hit the (#) and you will
get a new dial tone! After you hit (#) you do not have to re-enter the calling
card number simply enter your desired number and it will connect you.
If the number you called is busy just keep hitting (#) and the number to be
called until you connect! Ok to calL the U.S. of a from another country, you
use the exact same format as described above!
Ok now I will describe the procedure for placing calls to a foreign
country, such as CANADA,RUSSIA,SOUTH AMERICA, etc.. Ok first lift the handset
then enter (01) + the country code + the city code + the local telephone
number. Ok after you get the tone enter the AT&T calling card number. Ok if you
can not dial operator assisted calls from your area don't worry just jingle the
operator and she will handle your call, don't worry she can't see you!
The international number on the AT&T calling card is used for calling the
US of A from places like RUSSIA, CHINA you never know when you might get stuck
in a country like those and you have no money to make a call! The international
operator will be able to tell you if they honor the AT&T calling card.
Well I hope that this has straightened out some of your problems on the use
of an AT&T calling card! All you have to remember is that weather you are
placing the call or the operator, be careful and never use the calling card
from your home phone!! That is a BIG NO NO..
Also AT&T has came out with a new thing called (NEW CARD CALLER SERVICE)
they say that it was designed to meet the public's needs! These phones will be
popping up in many place such as airport terminals, hotels, etc... What the new
card caller service is, is a new type of phone that has a (CRT) screen that
will talk to you in a language of your choice. The service works something
like this, when you find a (NEW CARD CALLER PHONE), all you do is follow the
instructions on the (CRT) screen, then you insert the (NEW CARD CALLER CARD)
and there is a strip of magnetic tape on the card which reads the number, thus
no one can hear you saying your number or if there were a bug in the phone,no
touch tones will be heard!! You can also bill the call to a third party. that
is one that I am not totally clear on yet! The phone is supposed to tell you
how it can be done. That is after you have inserted your card and lifted the
receiver!

93
textfiles.com/phreak/at_tcode.txt Normal file
View File

@@ -0,0 +1,93 @@
===================================================
[ Hacker Supreme's - Hackers Directory Volume #25 ]
[ Compiled By: Ninja Squirrel and Logan - 5 ]
===================================================
=======================================
[ Hack Copyright: Hacker Supreme 1986 ]
=======================================
INTRODUCTION:
IN THIS SESSION, I WILL BRING FOURTH BELL'S IDENTIFICATION LETTER
CODES AND THE MEANING A LONG WITH EACH LETTER CODE. THESE CODES ARE USED
IN ADDRESSING, BASIC LETTERS, FORMS, ORDER SHEETS, AND A LOT OF OTHER
ASSORTED DOCUMENTS. THE CODES ARE USUALLY NO MORE THAN '4' LETTERS LONG,
THIS IS THE REASON THAT IF THEY WERE MUCH LONGER, A PERSON COULD'NT REALLY
CALL THEM CODES.
ASSORTED INFORMATION:
BELL'S LETTER CODES WILL BE USEFUL IN MANY WAYS. FOR ONE, IF A PERSON
WOULD HAPPEN TO GET YOU HANDS OF SOME GOOD INFORMATION, WITH THE SOME PARTS
ENCODED WITH BELL'S IDENTIFICATION CODES, IT WOULD BE EASILY INDENTIFIED.
BUT MOST OF ALL AS I STATED BEFORE, THE CODES ARE USED IN LETTERS, FORMS,
AND ORDER SHEETS, FOR USE OF MAINLY BELL EMPLOYEES. THIS IS REALLY FOR FASTER
READING, AND PROCESSING. ALSO SAVES TIME, SPACE, AND MONEY, AND WE ALL KNOW
THESE FACTORS COME FIRST IN ANY BUSINESS. FINALLY HERE ARE THE CODES...
CODE MEANING OF CODE(S) CODE MEANING OF CODE
==== ============================== ==== ==============================
ACR AUXILIARY LINE CUTOFF RELAY NI STATIONS INSTALL NEW
ACT ACTION NL NON LISTED NAME
ADD ADDRESS NMC NOT MET CODE
AL ADDITONAL LISTING NP NON PUBLISHED NAME
APP APPLICATION DATE NT NIGHT TERMINAL LISTING
AR ADVANCE RELAY O OUT (ACTION CODE)
BIF BRIDGE IN FIELD OAB ORDER ASSIGNED BY
BL BRIDGE LIFTER OCB ORDER COMPLETED BY
BMF BRIDGE MAIN FRAME OE ORIGIAL ORDER
BRG BRIDGED TELEPHONE NUMBER OIO ORIGINAL INCORRECT ORDER
BUB BUNCH BLOCK ORD ORDER NUMBER
C CHANGE (ACTION CODE) POS POSITION
CBE COMMON BATTERY EQUIPMENT PR PROTECTION REQUIRED N-(NO)
CD COMPLETE DATE PS PLANT SCALE
COC CENTRAL OFFICE COMPLETED PTY PARTY
COF CENTRAL OFFICE FRAME WORK PXJ PLACE CROSS CONNECT JUMPER
CON CONCENTRATOR IDENTIFIER R RECAP (ACTION CODE)
CS CLASS OF SERVICE RAX RATE AREA EXCEPTION
DCR DISCONNECT REASON RCO RECONNECT BY CENTRAL OFFICE
DD DUE DATE RDR RECONNECT DUE TO REGRADE
DDR DISCONNECT DUE TO REGRADE REQ REQUISITION NUMBER
DES DESCRIPTION RF RECONNECT-FIELD
DEX DIVERSIFICATION XCHANGE FACILITY RGN REGISTER NUMBER
DOP DEDICATED OUTSIDE PLANT RI REINSTALL
DPA DIFFERENT PREMISE ADDRESS RM NUMBER OF SETS TO BE REMOVED
DPN DROPS NEW RMK REMARK-UNRETAINED
DXJ DO NOT REMOVE X-CONNECT JUMPER RMKR REMARK-RETAINED
DZ DISTANCE ZONE RNG RINGING COMBINATION
EL EXTRA LINE RO RELATED ORDER
ESL ESSENTIAL SERVICE LINE RXJ REMOVE CROSS CONNECT JUMPER
F1 FACILITY #1 SA SERVICE ADDRESS
F2 FACILITY #2 SC SLEEVE CONNECTION RELAY
FR FROM SCO SPECIAL CENTRAL OFFICE EQUIPMENT
HTG HUNTING SSA SERV STA ABAN
I IN (ACTION CODE) SSE SERV STA AQUIS-SETS EXCL
IB INSTALLMENT BILLING SSI SERV STA AQUIS-SETS INCL
LA LISTED ADDRESS SSM SPECIAL SAFEGUARDING MEASURES
LDC LOAD COIL SSP SPECIAL SERVICE PROTECTION
LFD LEFT-IN FIELD DISCONNECTED SSS SERV STA SALE
LI NUMBER OF SETS TO BE LEFT-IN STA STATION
LIC LEFT-IN BY CENTRAL OFFICE FORCES SWO STATIONS WORKED ON
LID LEFT-IN DATA T TO (ACTION CODE)
LIE LEFT-IN EQUIPMENT TBA TENS BLOCK RELAY
LIF LEFT-IN BY FIELD FORCES TIE TIE CABLE
LIM LEFT-IN MISSING TN TELEPHONE NUMBER
LIR LEFT-IN STATIONS REMOVED TRK TRUNK CABLE & PAIR
LLE LONG LINE EQUIPMENT TSR TOTAL STATIONS REMOVED
LLII LOCAL LOOPS-INWARD INTERSTATE TZ TRANSMISSION ZONE
LLOI LOCAL LOOPS-OUTWARD INTERSTATE VER VERIFICATION
LN LISTED NAME VR VOICE REPEATER
LNC LISTED NAME CODE WOL WIRED OUT-OF-LIMITS
LNRC LEFT-IN NOT ON RECORD CONNECTED WT WIRED THROUGH
LNRR LEFT-IN NOT ON RECORD REMOVED X TO AND MOVE (ACTION CODE)
LOC LOCATION
LS LEFT-IN SEASONAL BASIS
LST LINE OR STATION TRANSFER
M MOVE (ACTION CODE)
MFV MAIN FRAME VERTICAL (ESS)
------------------------------------------------------------------------------

153
textfiles.com/phreak/atics.txt Normal file
View File

@@ -0,0 +1,153 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~ S C A N T R O N I C S P U B L I C A T I O N S ~
~ ~
~ Presents ~
~ ~
~ ATICS ~
~ ~
~ Automated Toll Integrity Checking System ~
~ ~
~ Date: ~
~ ~~~~~~ Written By, ~
~ 2-1-91 /<LUDGE ~
~ ~
~ ~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ATICS is a computer used to test line integrity. I am unaware as to
how widely the system is used. I have not been able to find anyone who
was familiar with the system, so I presume it is not everwhere. The
system can be given lists of phones to call, you can run a test on a
specific line.
MENU OF PRIMARY COMMANDS:
L - Load numbers to dial
D - Dial
S - Set parameters
I - Inquire
M - Maintenance mode
To go online currently and manually enter the phone # you would want
to use the Maintenance section. Here you can dial, ring, susupend phone
service, and watch anything comming over the lines (such as digits).
While the test it running the phone # is temporarily diconnected until
you release it.
There is no login prompts for this system. This system was set up
when you connect you get just a blank carrier. You then type in 4
characters and you are logged in.
>m
MAINTENANCE FUNCTIONS:
V - SELECT VIDEO MAINT MODE
P - SELECT PRINTER MODE
L - SELECT A LINE
N - SELECT THE NEXT LINE IN SEQUENCE
S - SEIZE THE SELECTED LINE
R - RELEASE THE SEIZED LINE
X - RELEASE THE GROUP CARD
Z - DESELECT THE LINE
0-9 - TEST NUMBER ENTRY (15 DIGITS MAX)
D - DIAL TEST NUMBER ON SELECTED LINE
C - CLEAR THE TEST NUMBER
^C - RESET MAINT PARAMETERS TO DEFAULTS
H - HANG UP THE MAINTENANCE LINE
E - EXIT TO MAIN MENU
22:48:37 LINE: 001 _ _ 00 TEST NUMBER:
22:48:38 LINE: 001 _ T 20 TEST NUMBER: (TONE)
22:48:39 LINE: 001 _ _ 40 TEST NUMBER:
22:48:39 LINE: 001 _ _ 00 TEST NUMBER:
22:48:40 LINE: 001 _ T 20 TEST NUMBER: (TONE)
22:48:40 LINE: 001 _ _ 00 TEST NUMBER:
22:48:45 LINE: 001 _ D 15 TEST NUMBER: 5551212 (DIAL)
22:48:45 LINE: 001 _ _ 00 TEST NUMBER: 5551212
22:48:46 LINE: 001 _ _ 00 TEST NUMBER: 5551212
22:48:48 LINE: 001 _ R 1C TEST NUMBER: 5551212 (RING)
22:49:41 LINE: 001 _ D 15 TEST NUMBER: 5551212 (REDIAL)
22:50:22 LINE: 001 _ D 15 TEST NUMBER: 5551212 (REDIAL)
22:50:28 LINE: 001 _ R 1C TEST NUMBER: 5551212 (RING)
22:50:28 LINE: 001 _ R 1C TEST NUMBER: 5551212 (RING)
22:51:03 LINE: 001 _ _ 00 TEST NUMBER: 5551212
22:51:04 LINE: 001 _ _ 00 TEST NUMBER: 5551212
22:51:04 LINE: 001 _ _ 00 TEST NUMBER:
You can Sieze the selected line (thus making the line inoperable),
without ringing the phone. A phone # may be entered with
1+areacode+Phone number as well. I am certain it works within the
United States. It has not been tested to call anywhere overseas.
>s
SET FUNCTIONS:
C - Set the clock
A - ATICS expanded output
X - Set the call lengths
F - Set Field separator
T - Set the [TERM] character
H - Human mode
N - Credit card number
M - Machine mode
P - PULSE dial mode
I am unsure what this expanded Output consists of. I have not
noticed a difference in the output.
S>a
EXPANDED OUTPUT ENABLED
S>x
Up to 8 call lengths may be entered with times in seconds.
Enter the times separated by ";".
EXAMPLE 1: 300;300;60;300[TERM] sets groups 1,2, & 4 to
to 300 seconds, and group 3 to 60 seconds.
Groups 5,6,7 & 8 remain unchanged.
EXAMPLE 2: 300;;;;60[TERM] sets group 1 to 300 seconds
and group 5 to 60 seconds. All other groups
remain unchanged.
[TERM] typed at the prompt leaves all group time-outs unchanged
>100;100;100;100;100;100;100;100
0100 0100 0100 0100 0100 0100 0100 0100
Well, I hope this phile was insightful. I didn't think it would
ever be noticed if I didn't write a phile, so here it is in the raw!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
S C A N T R O N I C S P U B L I C A T I O N
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
Another file downloaded from: NIRVANAnet(tm)
& the Temple of the Screaming Electron Jeff Hunter 510-935-5845
Salted Slug Systems Strange 408-454-9368
Burn This Flag Zardoz 408-363-9766
realitycheck Poindexter Fortran 415-567-7043
Lies Unlimited Mick Freen 415-583-4102
Tomorrow's 0rder of Magnitude Finger_Man 415-961-9315
My Dog Bit Jesus Suzanne D'Fault 510-658-8078
Specializing in conversations, obscure information, high explosives,
arcane knowledge, political extremism, diversive sexuality,
insane speculation, and wild rumours. ALL-TEXT BBS SYSTEMS.
Full access for first-time callers. We don't want to know who you are,
where you live, or what your phone number is. We are not Big Brother.
"Raw Data for Raw Nerves"
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X

379
textfiles.com/phreak/atm's.phk Normal file
View File

@@ -0,0 +1,379 @@
Subject: Re: ATM secret codes
Summary: ATM stuff
> The transactions done by ATM sometimes (not always) are kept by the
> machine until remove by human hands and fed to the bank's computer at
> its headquarters. Hence not much communication between ATM and the
> outside world.
*************** Track Layouts ************************
This is off the top of my head, but is 99% there. Also I'll ignore some
obsolete stuff.
The physical layout of the cards are standard. The LOGICAL makeup varies
from institution to institution. There are some generally followed layouts,
but not mandatory.
There are actually up to three tracks on a card.
Track 1 was designed for airline use. It contains your name and usually your
account number. This is the track that is used when the ATM greets you by
name. There are some glitches in how things are ordered so occasionally you do
get "Greetings Bill Smith Dr." but such is life. This track is also used with
the new airline auto check in (PSA, American, etc)
Track 3 is the "OFF-LINE" ATM track. It contains such nifty information as
your daily limit, limit left, last access, account number, and expiration date.
(And usually anything I describe in track 2). The ATM itself could have the
ability to rewrite this track to update information.
Track 2 is the main operational track for online use. The first thing on
track to is the PRIMARY ACCOUNT NUMBER (PAN). This is pretty standard for all
cards, though no guarantee. Some additional info might be on the card such as
expiration date. One interesting item is the PIN offset. When an ATM verifies
a PIN locally, it usually uses an encryption scheme involving the PAN and a
secret KEY. This gives you a "NATURAL PIN" (i.e. when they mail you your pin,
this is how it got generated.) If you want to select your own PIN, they would
put the PIN OFFSET in the clear on the card. Just do modulo 10 arithmetic on
the Natural PIN plus the offset, and you have the selected PIN. YOUR PIN IS
NEVER IN THE CLEAR ON YOUR CARD. Knowing the PIN OFFSET will not give you the
PIN. This will required the SECRET KEY.
Hope that answers your question....
************ Deposits at ATMs ************************
Deposits on ATM:
Various banks have various systems. As an example, at CITIbank a deposit was
made to a specific account. Your account was updated with a MEMO update, i.e.
it would show up on your balance. However it did not become AVAILABLE funds
until it was verified by a teller. On the envelope was Customer ID number, the
envelope number and the Entered dollar amount, the branch # and the Machine #.
There was also a selection for OTHER PAYMENTS. This allowed you to dump any
deposit into the ATM.
What are you assured then when you deposit to an ATM ?
1) You have a banking RECORD (not a reciept at Citibank). If you
have this record, there is a VERY high percentage that you
deposited something at that ATM.
2) Some banks have ways of crediting your deposit RIGHT NOW.
This could be done by a balance in another account (i.e. a long
term C.D. or a line of credit.) That way they can get you if
you lied.
************** ATM Splitting a Card in half ***************
I've worked with about 75% of the types of machines on the market and NONE of
them split a card in half upon swallow. However, some NETWORKS have a policy
of slicing a card to avoid security problems.
Trusting an ATM. Intresting you should bring this up, I'm just brusing up a
paper describing a REAL situation where your card and PIN are in the clear.
This involves a customer using a bank that is part of a network. All the
information was available to folks in DP, if they put in some efforts to get
it.
Mis-Implementation of an ATM PIN security system
1. Synopsis
In an EFT (Electronic Funds Transfer) network, a single node which does not
implement the proper security can have effects throughout the network. In this
paper, the author describes an example of how security features were ignored,
never-implemented, and/or incorrectly designed. The human factors involved in
the final implementation are explored by showing several major vulnerabilites
caused by a Savings and Loan and a regional EFT network's lack of vigilance in
installing an EFT network node. While using an EFT system as an example, the
concepts can be extrapolated into the implementation of other secured systems.
2. Background
A small Savings and Loan was setting up a small (10 to 16 ATMs) proprietary
Automatic Teller Machine (ATM) network. This network was then intended to link
up to a regional network. The manufacturer of the institution's online banking
processor sent an on-site programmer to develop the required interfaces.
An ATM network consists of three main parts. The first is the ATM itself.
An ATM can have a range of intelligence. In this case the ATM was able to
decode a PIN (Personal Identification Number) using an institution supplied DES
(Data Encryption Standard) key. It was then required to send a request for
funds to the host where it would receive authorization.
The second portion of the network is the ATM controller. The controller
monitors the transaction, and routes the message to the authorization
processor. The controller would also generally monitor the physical devices
and statuses of the ATM.
The third portion of the network is the authorization system. In this case
customers of the local institution would have the transaction authorized on the
same processor. Customers from foreign (i.e. one that does not belong to the
institution that runs the ATM) institutions would be authorized by the regional
network. Authorization could be from a run-up file which maintains establishes
a limit on withdrawals for a given account during a given period. A better
method is authorization direct from the institution which issued the card.
3. Security
The system has a two component key system to allow access to the network by
the customer. The first is the physical ATM card which has a magnetic stripe.
The magnetic stripe contains account information. The second component is the
Personal Identification Number (PIN). The PIN is hand entered by the customer
into the ATM at transaction time. Given these two parts, the network will
assume that the user is the appropriate customer and allow the transaction to
proceed.
The Magnetic stripe is in the clear and may be assume to be reproducible
using various methods, thus the PIN is crucial security.
Security
PIN security
3.1. PIN security
3.1.1. PIN key validation method
PINs can be linked up to a particular card in a number of ways. One method
puts the PIN into a central data base in a one-way encrypted format. When a
PIN is presented, it would be encrypted against the format in the data base.
This method requires a method of encrypting the PIN given at the ATM, until it
can be verified at the central site. Problems can also occur if the
institution wants to move the PIN data base to another processor, especially
from a different computer vendor.
Another method is to take information on the card, combine it with an
institution PIN encryption key (PIN key) and use that to generate the PIN. The
institution in question used the PIN key method. This allows the customer to
be verified at the ATM itself and no transmission of the PIN is required. The
risk of the system is the PIN key must be maintained under the tightest of
security.
The PIN key is used to generate the natural PIN. This is derived by taking
the account number and using DES upon it with the PIN key. The resulting
number then is decimialized by doing a lookup on a 16 digit decimalization
table to convert the resulting hexadecimal digits to decimal digits. An ATM
loaded with the appropriate PIN key can then validate a customer locally with
no need to send PIN information to the network, thereby reducing the risk of
compromise.
The PIN key requires the utmost security. Once the PIN key is known, any
customer's ATM card, with corresponding PIN can be created given a customer
account number. The ATM allows for the PIN to be entered at the ATM in two
parts, thus allowing each of two bank officers to know only one half of the
key. If desired, a terminal master key can be loaded and then the encrypted
PIN key loaded from the network.
The decimalization table usually consists of 0 to 9 and 0 to 5, ("0" to "F"
in hexadecimal where "F" = 15). The decimalization table can be put into any
order, scrambling the digits and slowing down an attacker. (As a side note, it
could be noted that using the "standard" table, the PIN digits are weighted to
0 through 5, each having a 1/8 chance of being the digit, while 6 through 9 has
only a 1/16 chance.)
When handling a foreign card, (i.e. one that does not belong to the
institution that runs the ATM), the PIN must be passed on to the network in
encrypted form. First, however, it must be passed from the ATM to the ATM
controller. This is accomplished by encrypting the PIN entered at the ATM
using a communication key (communication key), The communication key is entered
at the ATM much like the PIN key. In addition, it can be downloaded from the
network. The PIN is decrypted at the controller and then reencrypted with the
network's communication key.
Maintaining the the security of the foreign PIN is of critical importance.
Given the foreign PIN along with the ATM card's magnetic image, the perpetrator
has access to an account from any ATM on the network. This would make tracking
of potential attackers quite difficult, since the ATM and the institution they
extract funds from can be completely different from the institution where the
information was gleaned.
Given that the encrypted PIN goes through normal communication processes, it
could be logged on the normal I/O logs. Since it is subject to such logging,
the PIN in any form should be denied from the logging function.
3.2. Security Violations
While the EFT network has potential to run in a secured mode given some of
the precautions outlined above, the potential for abuse of security is quite
easy. In the case of this system, security was compromised in a number of
ways, each leading to the potential loss of funds, and to a loss of confidence
in the EFT system itself.
3.2.1. Violations of the PIN key method
The two custodian system simply wasn't practical when ATMs were being
installed all over the state. Two examples show this: When asked by the
developer for the PIN key to be entered into a test ATM, there was first a
massive search for the key, and then it was read to him over the phone. The
PIN key was written on a scrap of paper which was not secured. This is the PIN
key that all the customer PINs are based on, and which compromise should
require the reissue of all PINs.)
The importance of a system to enter the PIN key by appropriate officers of
the bank should not be overlooked. In practice the ATM installer might be the
one asked to enter the keys into the machine. This indeed was demonstrated in
this case where the ATM installer not only had the keys for the Savings and
Loan, but also for other institutions in the area. This was kept in the high
security area of the notebook in the installer's front pocket.
Having a Master key entered into the ATM by officers of the bank might add an
additional layer of security to the system. The actual PIN key would then be
loaded in encrypted form from the network. In the example above, if the
installer was aware of the terminal master key, he would have to monitor the
line to derive the actual PIN key.
The use of a downline encrypted key was never implemented, due to the
potential complications and added cost of such a system. Even if it was, once
violated, security can only be regained by a complete reissue of customer PINs
with the resulting confusion ensuing.
3.2.2. Network validated PIN Security violations
Given the potential for untraced transactions, the maintenance of the foreign
PINs security was extremely important. In the PIN key example above, any
violation would directly affect the institution of the violators. This would
limit the scope of an investigation, and enhance the chance of detection and
apprehension. The violation of foreign PIN information has a much wider sphere
of attack, with the corresponding lower chance of apprehension.
The communication key itself was never secured. In this case, the developer
handed the key to the bank officers, to ensure the communication key didn't get
misplaced as the PIN key did (This way he could recall it in case it got lost).
Given the communication key, the security violation potential is simple enough.
The programmer could simply tap the line between the ATM and the controller.
This information could then generate a set of PIN and card image pairs. He
would even have account balances.
Tapping the line would have been an effort, and worse yet he could get
caught. However, having the I/O logs could serve the same purpose. While
originally designed to obscure PIN information in the I/O logs, the feature was
disabled due to problems caused by the regional network during testing. The
I/O logs would be sent to the developer any time there was a problem with the
ATM controller or the network interface.
The generation of PIN and card image pairs has a potential for even the most
secured system on the network to be attacked by the lapse in security of a
weaker node. Neither the communication key, nor the PIN should ever be
available in the clear. This requires special hardware at the controller to
store this information. In this case, the institution had no desire to install
a secured box for storing key information. The communication key was available
in software, and the PIN was in the clear during the process of decrypting from
the ATM and re-encrypting with the network key. Any programmer on the system
with access to the controller could put in a log file to tap off the PINs at
that point.
The largest failure of the system, though, was not a result of the items
described above. The largest failure in the system was in the method of
encrypting the PIN before going to the network. This is due to the failure of
the network to have a secured key between sites. The PIN was to be encrypted
with a network key. The network key was sez4E<34><45>5R<35><52><EFBFBD>k<EFBFBD>^<5E>ted form from thee
ettwork to the ATM controller. However, the key to decrypt the network key was
sent almost in the clear as part of the start-of-day sequence.
Any infiltrator monitoring the line would be able to get all key information
by monitoring the start-of-day sequence, doing the trivial decryption of the
communication key, and proceeding to gather card image and PIN pairs. The
infiltrator could then generate cards and attack the system at his leisure.
The network-ATM controller security failure is the most critical feature
since it was defined by a regional network supporting many institutions. The
network was supposedly in a better position to understand the security
requirements.
4. The Human Factors in Security Violation
It is important the users of a system be appraised of the procedures for
securing the system. They should understand the risks, and know what they are
protecting. The bank officers in charge of the program had little experience
with ATM systems. They were never fully indoctrinated in the consequences of a
PIN key or communication key compromise. The officers showed great surprise
when the developer was able to generate PINs for supplied test cards. Given
the potential risk, nothing more was done to try to change the PIN key, even
though, they were quite aware that the PIN key was in the developer's
possession. They once even called the developer for the PIN key when they
weren't able to find it.
The developer had a desire to maintain a smooth running system and cut down
on the development time of an already over-budget project. Too much security,
for example modifying I/O logs, could delay the isolation or repair of a
problem.
The regional network was actually a marketing company who subcontracted out
the data processing tasks. They failed to recognized the security problem of
sending key information with extremely weak encryption. The keys were all but
sent in the clear. There seemed to be a belief that the use of encryption in
and of itself caused a network to be secured. The use of DES with an unsecured
communication key gave the appearance of a secured link.
The lack of audits of the system, both in design and implementation was the
final security defect which allowed the system to be compromised in so many
ways. An example of the Savings and Loan's internal auditors failure to
understand the problems or technology is when the auditors insisted that no
contract developers would be allowed physically into the computer room. The
fact was, access to the computer room was never required to perform any of the
described violations.
5. Security Corrections
As in any system where security was required, the time to implement it is at
the beginning. This requires the review of both implementation and operational
plans for the network. Audits should be performed to verify that the
procedures are followed as described in the plan. Financing, scheduling and
man power for such audits must be allocated so security issues can be
addressed.
For this institution, the first step would have been to indoctrinate the
banking officers of the risks in the ATM network, the vulnerabilites, and the
security measures required.
Custodians of all keys should be well aware of their responsibilities for
those keys. A fall back system of key recovery must be in place in case an
officer is not available for key entry.
The cost of installing hardware encryption units at the host should be
included in the cost of putting in the system. The host unit could generate
down-line keys for both the PIN key and the communication key thus making it
more difficult to derive these keys without collusion from at least three
people.
A secured communications key should be established between the Network and
the institution. This would allow for the exchange of working communication
keys. This key should be changed with a reasonable frequency.
All these areas should be audited in both the system specification and
implementation to make sure they are not being abridged in the name of
expediency.
6. Summary
In this view of a single institution, a number of failures in the security
system were shown. There was shown a definite failure to appreciate what was
required in the way of security for PINs and keys used to derive PIN
information. An avoidance of up front costs for security lead to potentially
higher cost in the future. The key area was the lack of audits of the EFT
system by both the institution and the network, causing potential loss to all
institutions on the network.


115
textfiles.com/phreak/atmfone.phk Normal file
View File

@@ -0,0 +1,115 @@
12/25/90
-------------------============< SANCTUARY >============-------------------
| |
| -----------==> Town Criers Posting Board <==----------- |
| |
| Just another EXCRETION from the bowels of Sanctuary... |
|_____ City of _____|
| |_____ Beggars, _____| |
| The |_____ Criminals, _____| The |
| Home |_____ and Thieves _____| Hellfire |
| Board of |_____ _____| Bulletin Board |
| Sanctuary |_____________| 1-908-495-3926 |
|_________________________________________________________________________|
CALL IT!!!
Originally Printed in:
CYBERTEK
The Cyberpunk Technical Journal Issue #4, November/December 1990
P.O. Box 64, Brewster, NY
10509
Send $2.50 for sample or ask for details.
Call The Manta's Lair
206/361-5742 Sysop: The Black Manta
This Phile Typed by: Havok Halcyon, Chief Magistrate of the City
of Sanctuary
I've added in an occasional hint or two in parenthesis to help some of the
more uneducated phreaks understand some of the terms and whatever.
Those help phones in ATM Machine lobbies can be very useful if you
have to make an emergency phone call. They work on one of two different
ways. The first (and best for us) type is the kind that you pick up the
phone and press a button; which activates an autodialer that calls customer
service. This one generally looks like a regular traditional style wall
phone without a dial and a push button somewhere near the phone instructing
you to press it to get customer service. The second type can either be a
phone, or is sometimes just a handset set into a mounting on the counter
which tells you to pick it up for assistance. There are variations in
appearance with the two types, but the button is the giveaway.
What you can do with the first type is pick up the phone and not push
the button. You should just get a dialtone like in most regular phone
lines, and you can dial out to anywhere by flashing the switchhook, or if
the line has touchtone service, by using a portable touchtone dialer
available at RADIO SHIT (er..I mean Radio Shack. Also, if you do not know
how to "flash" a switchhook, consult BIOC Agent 003's Tutorials or your
local phreak or phreak oriented BBS.) for $19.95. Some of these phones are
hooked up to the bank's PBX (Private Branch Exchange), in which case you'll
have to dial the extension for an outside line, in most places this is
usually a "9", "99" or something similar. You can sometimes find out if
it's on a PBX by listening to the tones coming out of the autodialer. If
it puts out more than 10 digits (tones), or puts out a couple digits and
pauses before dialing the rest, then it's on a PBX. Of course some
autodialers mute the touch tones so you can't hear them.
With the second type you can call customer service, and either ask
some stupid question, or say "Sorry, wrong number". When the nice lady
hangs up in MOST cases you will get a dialtone and then you can dial out.
(A lot like when you use a diverter). However if the phone line does not
have touch tone, you are outta luck; as the autodialer is activated by
picking up the phone, the flashing of the switchhook will false start the
autodialer. So, if you can't use your TT(touch tone) pad, your outta luck.
Getting into ATM lobbies is pretty easy. They use magnetic strip card
access. An ATM card obviously works, as well as credit cards, calling
cards, and anything else with a magnetic strip on the back. The bolts on
the door are often exposed and can be jimmied open. Some of the locking
mechanisms don't even work.
There are a few things that you have to worry about. The first is
that someone might notice you staying on the phone for an extended period
of time, and get suspicious (This is not a BIG risk because most people
could really care less what you are doing, EXCEPT for those fucking goodie-
two-shoe bitches which want to make a Citizen's Arrest so that they can get
in good with your local PTA). The second is that you run the risk of being
recorded when you are in the lobby. Most ATM lobbies have cameras in them.
Usually the camera is located in the ATM, and only goes on when a
transaction in being made, but some places have 24 hour surveillance
systems. These are usually externally mounted, and quite visible. If you
see a camera in the lobby, don't mess around in there. The other
possibility is that the phone itself could be BUGGED by the bank.
According to law they are supposed to inform you with a beep every ten
seconds, but no one does that anyway (NOTE: The Gestapo [Ma Bell] is
supposed to notify you in the same way if they were bugging you at your
home phone, but they will usually say something like "I was checking the
line to see if everything was ok, and OVERHEARD some criminal dealings".
This is a common way to catch people on the phone, so be careful what you
say on public telephone lines.) You could do a quick look around to see if
you can find anything on the line. If you don't see anything "funny", and
can trace all the wiring, then you are probably safe. All in all, your
best and safest bet is to use an ATM located away from a bank, and one
where you can see the wiring coming from the outside to the phone. Even
then, call only people who'll forget you called right after you hang up.
___________________________________________________________________________
-=> !!!!! STUPID AND RETARDED DISCLAIMER GOES HERE !!!!! <=-
-=> <=-
-=> Dear Government type people, I'm just a plain ol' <=-
-=> irresponsible person. But, you can't prove who wrote <=-
-=> this so up yours. It could be anyone just using my <=-
-=> name. Why, I could even by your boss, or the President <=-
-=> of The United States. ACTUALLY, I AM The President of <=-
-=> The United States. Arrest me PLEASE, before I corrupt <=-
-=> any more young minds!! My name is truthfully GEORGE <=-
-=> BUSH!!! Really, I SWEAR TO GOD!!!!! (heheheh) <=-
-=>_____________________________________________________________________<=-
Call the boards and get Cybertek. They're all cool.
Peace and Reggae Music to all. Later muchachos...
Downloaded From P-80 Systems 304-744-2253

109
textfiles.com/phreak/atmosph.txt Normal file
View File

@@ -0,0 +1,109 @@
The Atmospheric Test Site
Well, after calling 617/536-1180, I have figured out what the hell this
thing is, as well as the commands you can use to run it. Basically, it's
an atmospheric pollutant monitoring device, and we are 99% sure it is
operated out of that trailer in Kenmore Sq. Basically, this system is
hooked up to a variety of monitoring devices, which measure the
concentration (in parts per million; PPM) of various pollutants. Current
temperature is also recorded (in Kelvin). The computer takes a
measurement every minute and by using different commands, you can even go
back in to stored records of measurements (as far back as 5 days ago)
tests are made every minute of every day.
Commands consist of single letters and numbers. Commands function as
hotkeys, and echoed as they are typed, and illegal commands are echoed as
well with an accompanying question mark.
In this file I provide some captures of data when I played with the
system, and a command summary to top things off.
I wonder if this is a proprietary system, or if there are others like it
out there anyway, if anyone finds another, please let me know!
Here's an example of what you can do when you first call the system
(8N1), it immediately responds to you by printing out the last minute's
recorded data:
-------------------------------------------------------------
CONNECT 2400/NONE
17:10:00 0018 01 KENMORE SQ 01/18/92
=================================================
CHAN NO NO2 NOX TEMP CO SO2
UNITS PPM PPM PPM DEG K PPM PPM
=================================================
17:00 0.044 0.029 0.073 269 1.2 0.013
-------------------------------------------------------------
I typed nothing in as soon as connection was made, the system spits out
the time of the last measurement, and the readings in PPM...the
pollutants measured are common NO, NO2 (nitrogen dioxide, NOT nitrous
oxide), NOX (meaning all NO groups combined, like NO, NO2, NO3, etc.),
the temperature in degrees Kelvin, CO (carbon monoxide) and SO2 (nasty
sulfur pollutant...makes acid rain in the clouds).
Type "t" to get the current time and date.
-------------------------------------------------------------
TIME IS 17:14:07 0018 KENMORE SQ 01/18/92 07B2
-------------------------------------------------------------
Neat, eh? Now type "1" to get the yesterday's readings in 1 hour
intervals.
-------------------------------------------------------------
Other numbers will get you previous day's test results. Hitting "a" will
get you a raw HEX dump of the data for the current day. No nice tables
with headings! Note the number "0018" which is the date of the test.
These dumps cover the entire day at 1 hour intervals. Probably intended
for use with some environmental data interpreting program as opposed to a
dumb terminal.
-------------------------------------------------------------
Hitting "o" will get you the past hour's worth of data in 1 minute
intervals. Note the use of a 24hr clock. No am/pm stuff.
And hitting "Z" will output the current test recorded.
-------------------------------------------------------------
17:10:00 0018 01 KENMORE SQ 01/18/92
=================================================
CHAN NO NO2 NOX TEMP CO SO2
UNITS PPM PPM PPM DEG K PPM PPM
=================================================
17:00 0.044 0.029 0.073 269 1.2 0.013
-------------------------------------------------------------
The "U" command is the coolest. It gives you updates of what's going on
as it happens. Notice how the concentration values change.
------------------------------------------------------------
Enuough examples. Here's a command summary:
Remember, commands are case sensitive!
---------------------------------------------------------
t,T Current time and date.
1 Yesterday's readings and calibration data in 1 hour
intervals.
2 Summary of yesterday.
3 Data from 2 days ago.
4 Data from 3 days ago.
5 Summary from 3 days ago.
6 Data from 4 days ago.
7 Summary from 4 days ago.
8 Data from 5 days ago.
a HEX-dump data, current day, 1 hour intervals.
d HEX-dump data, 2 days ago, 1 hour intervals.
g HEX-dump data, 4 days ago, 1 hour intervals.
j HEX-dump data, current hour, 5 min intervals.
k HEX-dump data, past hour, 5 min intervals.
o HEX-dump data, current hour, 1 min intervals.
x HEX-dump data, latest reading.
Z Data, latest reading.
U Gives IMMEDIATE data...changes every second!
S Funky binary output.
P Data, past hour, 5 min. intervals.
L Funky setup info.
F Funky playback info.
G Data, current hour, 5 min intervals.
Anyway, enjoy this great resource. Please don't try to crash it, or fuck
with it. This is a great thing to have access to, and if I find anyone
fucking things up on it, I'm gonna get pissed off.
"Hey, I wonder what the PPM concentration of carbon monoxide is in
Kenmore tonite? Oooooo, too high for me. Better stay inside."

304
textfiles.com/phreak/atntbust.txt Normal file
View File

@@ -0,0 +1,304 @@
._______________________________________.
______|___ ________ ______/\____ ______ |_____
\_______ \/ _____\/\/ ___/ / /__\___ \/ ___/\ :
. \__/ / _/. ___/ / /__ / / _/ / / /__ /\/ .
/ // / / / / / / / / / / |
. / / / / / / / // / / / // / :
: /__/ /___ /___ /___ /__/ ./_ /__/ /___ ./ / .
| \_/__/\___\/\___\/\___\/\_/__/\_\/\_/__/\___\/ /[Sk!n]
: \__\/ \/ \/ \/ \__\/ \/ \__\/ \/
. |_______________________________________|
-- -[+---!R.E.D.S.K.|.N.S!--S.H.A.D.E.S--H.Q.-+]- --
UplOadER : Malcom oN SuPeR NoDE 1
-O-----------:---[ SySoP: ]--[ VaNgUarD ]---:-----------O-
Call: +49-216-332-226
Brings you: Death to The AT&T
Ever since the begining there has been roumers going around about
the so called risk by using (abusing) credit cards and bellcards
from your home phone. The roumers about ANI (automatic number
identification) made the phreak society trumble of fear. Fear no
evil. ANI is a good weapon against dumb fuckers but if you know
what the fuck you're doin'. There will be no problems, what-so-
ever.
"scare the motherfuckers alittle and they'll leave our system
alone" is a common pharse and we belive that it kinda includes
our thoughts of the AT&T security department. If they really
wanna stop the phreakers from abusing the system. They can do
that. But i guess they are to dumb to figure out a really smart
way. The best way would be to generate a small beep about ten
secunds after that the call has been connected. The beep would
not anoy the normal voice calls but you can be sure that it
would anoy the 14 teen years old trader who'll get a lost
carrier.
How can i be secure when i abuse a bellcard?
Well, the first thing to keep in mind is that smaller LD companys
like DIAL and TELEDATA can not offord to get ANI. So it's pretty
safe to abuse them until they grow bigger. AT&T, SPRINT and MCI
are big companys and they can offord to spend alot of money on
bounty hunters and ANI. My advice would be to leave them alone.
The old collect-call method to a loop is still pretty safe thou.
What about those guys who got busted for abusing CC's and Bell's?
"Fame went to his head" or "Greed will kill you" are old pharses
that kinda explain why they get busted. If one phreak is pissed
at another phreak, he'll call up the cops and tell'em that his
so called friend is abusing CC's or (and) Bell's. When this
phreak get busted he spell out everthing he knows to the FEDS.
He'll not go down himself. A serie of phreaks will go down,
thanx to a little fight betwin two phreaks. The secret service
knows how to make you spell out everything. But if you keep
your friends clean, they'll remember you like Robin Hood.
What happens if the secret service calls me?
The secret service are very good pretenders. They will say things
like "your friends are allready busted and they have told us all
about you" or "we have proofs that indicates that you are a
criminal, and we will bring you down". If they really had proofs
or your friends looked up. They would not be calling you first.
They would be knocking at your door.
What happens if the secret service knocks on your door?
If they ever knocks at your door. Let me tell you one thing.
YOU'RE IN DEEP SHIT. If you got the time. Destory or hide any
proofs that the SS will find when they get in. Make sure that you
don't keep records of any friends and make sure that you behave
good when they get in. Make no attemps to kill them (even if this
probbly would help you alot). They will ask you things like "Do
you have any black friends", "Tell us about your friends" and
"Have you ever transfered any founds?". What ever you do, answer
polite to all their qustions and make them belive that you know
nothing what-so-ever about computer. This might work for you.
Pretend to be dumb.
Will my mom and dad kill me if the secret service knocks on your
door?
YES, they probbly will. Or at least make you feel really bad.
"You're grounded for 99 years, son."
Will your girlfrind leave you when you goto jail?
She will probbly not leave you. Girls love bad boys like you.
She will probbly love you more than she used to do before.
Will your boyfriend leave you when you goto jail?
Yes, he will probbly do that. he knows that there are alot of
bad boys in jail. And he also knows that you like badboys.
Can I make money while i'am locked in?
Yes, you could sell your ass or become a advisor to the biggest
criminal boss.
What will happen with my unpayed phonebill while i'am in jail?
This is the best thing about jail. You don't need to pay any
bills!
Thats all folks!!
MR.X
-O-----[ THiS FiLe WaS DoWNLoaDeD FrOm ]-----o-
._______________________________________.
______|___ ________ ______/\____ ______ |_____
\_______ \/ _____\/\/ ___/ / /__\___ \/ ___/\ :
. \__/ / _/. ___/ / /__ / / _/ / / /__ /\/ .
/ // / / / / / / / / / / |
. / / / / / / / // / / / // / :
: /__/ /___ /___ /___ /__/ ./_ /__/ /___ ./ / .
| \_/__/\___\/\___\/\___\/\_/__/\_\/\_/__/\___\/ /[Sk!n]
: \__\/ \/ \/ \/ \__\/ \/ \__\/ \/
. |_______________________________________|
-- -[+---!R.E.D.S.K.|.N.S!--S.H.A.D.E.S--H.Q.-+]- --
-O-----------:---[ SySoP: ]--[ VaNgUarD ]---:-----------O-
___________________________ ___ _ ._______ |\__. |\__.
/+-- - \ .\ \ .X \ / \ |/ \ \|+-`| |+-`|
//| -\\ \\ \\ \\ \X \\ __ / \\ \\! | |! |
\ : ___________/ // \// _ // \ \\ \\ / \ / //_ //: | |: |
\ \|| \_/ / \_/ \_/ |\ \\ // \\ // \_/|. | __|. | __
_\___ \|! .____/ _/__ _/_| | \ .\_ ./ _/__| \/ \ \/ \
/. /|: | | -+\ -T\ |_/ ./ /\ // --\\ \\ \\
\\ |. l_| // // //\ / \\// / \\ \\
\______/| /\_______/_____/______/ \/ \/\_______/\_________/_______/
|___/
|\_______ __. ___.___ .__ __
OPERATOR: |+-_ \`\\/__|/ `\ `\\| `\ | SYSTEM:
SPEED-MAN || .__//\\\__ \ \/ /\\\ \!| 68030-40MHz
| |_| \| | .\/\ \ \| | \ .| 520 MB ONLINE
CoOp |___/|____|__|\___/____|__\__| WHQ REGISTRED /X 3.xx
JANX 0-2 DAY WAREZ
LOBSTER AND PC - AMIGA
ROCKETEER ____ ____ ___________/\__________________ CONSOLE
\__/ / \/ __ .__/ \___/ \ .__/
/ \/ _ \ \/ l / \/ _ \/ lWHQ
/ \ l /\ \ l/ \ l / l
\____/__l /_____/__l_______/__l /_____l
\/ \/
16.8DST NODE0 +49-221-599-5932 - 14.4DST NODE1 +49-221-599-3735
Lots of Stuff in Hack-Phreak Conference and Free D/l for /X Tools
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Ok guyz, this is a translation of an article that a guy wrote
who got busted by AT&T. I can't say if this informations are 100%
true, it's possible that someone who is payed by AT&T wrote this
but if it is true then we are in the shit! SKINHEAD/ICS
Hi freaks!
Short time ago I got a call from an AT&T Operator! First, I
didn't understand what this guy wanted, but I got a terrible
shock.
I thought this was maybe a joke from some of my friends, but the
Operator connected me further to some blabla security (didn't
understand what he said).
This guy then told me that they had traced me and that I'll be
prosecuted. I said: "Touch my ass!" and hung up. I wanted to call
my friend and tell him all that, but the security guy was still
in the line and gave me a number in the USA that I should call
immadately! As I was in panic, I called there.
The guy at the other side of the line was very friendly and could
even speak a little bit german. He said I should give him the
adress of my card supplier (that's what he said to me!!!),
otherwise they would prosecute me for all the fraud that was done
with the card that I used. This is now easier since the Telecom
(Skinhead quote: German Telecom,don't know about other countries)
now works very close together with AT&T. But the Telecom wouldn't
prosecute me for anything, because it was AT&T who lost the
money. This was what the security guy said to me!
A few days later I got a call from a german lawyer that works for
AT&T. He said that he already started my prosecution! Now I got
real frightend because a few weeks later I got a letter from the
judgement in which I was accused for the following things:
*Credit Card fraud
*heavy intervention into the Telecom
*obtain service by trickery
I told them my card supplier, and can await a very low
punishment. I tell you: DON'T USE CARDS! (Skinhead quote: What an
asshole!!!).
The Telecom has,after the installing of digital lines in nearly
whole germany, started a new system, that makes it very easy to
trace. This can even work (but not perfect) on analog (!!) lines.
Till the last OVS it is no problem, after that guys from a
private company will be payed by AT&T to trace back your call. In
100% digital lines (digital till your room) it is too late
anyway. AT&T has a new controlsystem at which they can read YOUR
number, so not only the country you're calling from, even YOUR
number! This number will be with begin of this month (June)
printed onto the bill of the cardowner. So if the cardowner can
prove that he wasn't, and nobody else who is allowed to use was,
in germany at that time, than he can prosecute the owner of this
number (YOU!). Nobody knows yet if this is possible with the
judgement laws, but it seems that already a few persons were
busted that way.
To really destroy these phreakers, AT&T will give cards a much
bigger limit so they will work for longer, even if you already
used them very much (Many days of european calls etc...) they
will still work. Trash these cards, this is a trap!
Ok, I hope I could help some of you with this article!
Cheers!
Dual/Independent
Ok, here's Skinhead again, down here follows the original article
for the guys who won't believe the translation. So get a german
dictionary and translate it yourself!
Hallo Leute!
Vor kurzem bekam ich einen Anruf von einem AT&T-Operator !
Ich hatte erst garnichts verstanden, was los war bekam aber einen
tierischen Schock.
Ich hielt dies erst f<>r einen Scherz von meinen Freunden, aber
der Operator verband mich weiter zu irgendwas mit blabla-Security
(hab ich nicht genau verstanden!).
Dieser kl<6B>rte mich auf, dass ich getraced wurde und eine Anzeige
zu erwarten h<>tte! Ich sagte ihm, "leck mich doch" und legte auf.
Ich wollte bei meinem Freund anrufen, und ihm das erz<72>hlen, aber
der Typ war noch in der Line (kennt man ja). Dann gab er mir
eine Nummer in der USA, und sagte, ich solle dort sofort anrufen.
Da ich die absolute Panik hatte, tat ich dies auch!
Der Herr an dem anderen Ende der Line war recht freundlich, und
sprach auch etwas Deutsch. Er meinte, ich solle meine Card-
Supplier (wortw<74>rtlich) preisgeben, ansonsten wolle man mich
f<EFBFBD>r den enstandenen Schaden verantwortlich machen. Dies sei
jetzt einfacher, seitdem die Telekom mit AT&T enger zusammen-
arbeitet. Die Telekom w<>rde allerdings keine gerichtlichen
Schritte einleiten, da Sie sowieso kein Geld bek<65>me, und ihr
das so ziemlich egal w<>r. Dies war eine private Meinung,
so sagte er mir!
Nach einigen Tagen bekam ich einen Anruf von dem deutschen Anwalt
von AT&T. Dieser sagte, er h<>tte gerichtliche Schritte
eingeleitet!! Nun bekam ich es mit der Angst, denn einige Wochen
sp<EFBFBD>ter kam wirklich ein Schreiben vom Gericht, in dem wurde ich
angeklagt:
Kreditkartenbetrug, schwerer Eingriff in das Fernmeldewesen sowie
Erschleichung einer Dienstleistung.
Ich habe meinen Card-Supplier preisgegeben, und bekomme nun eine
geringere Strafe! Ich rate euch: LASST DIE FINGER VON CARDS!!!
Die Telekom hat mit Hilfe der digitalisierung der deutschen Netze
ein neues System in Betrieb genommen, das es sehr einfach macht,
zu tracen! Dies ist auch bedingt (!) in Analogen Systemen
m<EFBFBD>glich! Bis zur letzten OVS ist es kein problem mehr, danach
werden dann Leute eines Privat-Unternehmens eingesetzt, die im
Auftrag von AT&T den Anrufer zur<75>ckverfolgen.
Dies geschieht dann in der alt bew<65>hrten Weise!
In 100% digitalen Netzen (bis zur Dose hin mein ich) ist es eh zu
sp<EFBFBD>t. AT&T hat nun ein neues Kontrollpult, auf dem ist die Nummer
ablesbar, also nicht mehr nur das Land, sondern auch die Nummer.
Diese Nummer erscheint mit beginn dieses Monats (Juni) auch auf
den Rechnungen der Kartenbesitzer!! Ihnen ist somit die
M<EFBFBD>glichkeit gegeben, wenn sie nachweisen k<>nnen das sie die
Person nicht kennen, an einem anderen Ort waren etc. die Person
die bei der Telekom f<>r diesen Anschluss angegeben ist,
anzuzeigen. Ob dies Gerichtlich durchsetzbar ist, wei<65> noch
keiner, aber es scheint als ob schon einige Personen auf diese
Art dran glauben mussten!
Um diese "Phreaker" auch wirklich dingfest zu machen, lockt AT&T
die Leute damit, das die Cards nicht so schnell kaputt gehen,
also sie halten unwahrscheinlich lange, obwohl man die Karte
schon zu stark belastet hat (Tagelange Europa-Calls).
WERFT DIESE KARTEN WEG!! DIES IST EINE FALLE!!
Ok, ich hoffe ich konnte einigen Leuten damit helfen!
Cheers!
Dual / Independent

92
textfiles.com/phreak/attwwiii.txt Normal file
View File

@@ -0,0 +1,92 @@
(c)1989
!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?
? !
! When the World Comes Crumbling Down... ?
? !
! AT&T AND WORLD WAR III ?
? !
! by ?
? --]> Professor Falken <[-- !
! ?
?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!?!
What will Phreaks and Hacks do without a telephone system ? Phreaks will
not have a network to experiment with nor will Hacks have such a direct method
of infiltrating computer systems. The communication system for the " CORRUPT "
computer generation will be destroyed. No matter what we do, almost everything
is directly linked to the phone system. Thats why it will be the first thing
to go if a limitied nuclear strike is initiated.
Laying 40 feet below the surface of Netcog New Jersey is AT&T's
National Emergency Control Center. All that is visible from the surface is a
Yellow brick building the size of a large garage. Visitors are buzzed in
through two ground level doors and must walk down four flights of stairs.
Once at the bottom they must pass through two heavy vault doors that open one
at a time. The two-story subterranean complex was constructed during the late
1960's. Blasting through solid granite was required to build the building,
then concrete was poured and reinforced for the walls, and the roof and four
feet of Earth was laid atop of that. Then entire structure is wrapped in steel
to shield the inside from the electromagnetic pulses sent out by a nuclear
explosion.
During peacetime, the Netcog center is a switching relay station on the
Boston-Miami cable. In a pre-nuclear war crisis, the center's normal staff
will be joined by workers from the AT&T Communications operations center at
Bedminster, New Jersey, fifteen miles away. The workers at Bedminster
oversee the nation's AT&T long distance network. Following a nuclear attack,
they will reroute calls around cities that have ceased to exist.
The AT&T Communications staff will work under fluorescent lights in a
large open room in the Netcog center. Their phones, desks, and terminals
all waiting for them. Bell System files are stored nearby and updated
monthly, and a phone list of sixty people to be called to the center in a
crisis is pinned to a bulletin board.
In another area of the complex, lined wall to wall are ESS running units
which are attached to the ceiling by heavy steel springs and anchored to the
floor by think elastic bands. If the building is struck by a massive shock
wave, the elastic bands will snap and the switching units will swing, cushioned
by the springs. All other mechanical equipment in the center is similarly
shock mounted. The storerooms are stocked with tanks of drinking water, and
kerosene for generators. The ventilation system is equipped with fallout
filters and blast valves that will close if a blast wave hits. Sometimes the
blast valves are activated by thunder, which jolts the peacetime Netcog crew.
The desks for AT&T executives are in a large open area next to the
operations center. The AT&T Communications crew will run what is left of the
long distance network, with help from backup centers in Kansas and Georgia and
seven other underground centers.
AT&T is a nuclear prepared corporation, across the country AT&T routed
long distance cables around target cities and buried the cables inside steel
and concrete conduits to protect them from nuclear blast. The 4,000 miles
transcontinental cable was built by the Bell system to withstand national
crisises, including a nuclear blast short of a direct hit. It can take
pressure of over 100 pounds per square inch; an overall pressure of one half-
pound per square inch would crush the average home. All communications
equipment associated with the cable is shockmounted in underground concrete
buildings. The cable runs from New York to California, skirting all major
cities and potential target areas.
If an attack were to strike the nation and the telephone system was still
in operable condition special FCC regulations would be put in effect to
direct telephone usage. These regulations outline a telephone call priority.
Sorta of like the Autovon priority system ( Priority, Immediate, Flash, and
Flash Override ) The highest priority category is designated " FLASH
EMERGENCY. " All other calls in progress will be interrupted to put through
FLASH EMERGENCY calls, which will include those involving command and control
of military forces and " conduct of diplomatic negotiations critical to the
arresting or limiting of hostilities. " From what I can understand the normal
telephone service will become in effect an Autovon, primarily for military
usage.
In any case, the phone system would probably be trashed. So lets enjoy
it and experiment with it while we have it. It is probably the best telephone
network in the world, and we all have AT&T to thank for it.
Article written 12/27/88 by Professor Falken, Released 5/8/89.

210
textfiles.com/phreak/australi.txt Normal file
View File

@@ -0,0 +1,210 @@
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The Following was Taken From The 2600 Magazine of Spring 1992
Text typed by OMEGA / MEGA - Ind.
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The Australian Phone System (By Midnight Caller)
In Australia there is one company which controls the nation's public
switched telephone network: The Autralian and Overseas Telecommunications
Corporation, which trades as Telecom Australia.
Telecom Australia is a federal government-owned statutory corporation
responsible for providing telephone, data, and other communications services
to the public. Put simply, Telecom have a monopoly on first home-phone in-
stallation and the core network (eg: the copper wires, the optical fibre,
the cellular network, etc.)
This all changed in late 1991 when Telecom was stripped of its monopoly and
forced to compete in a duopoly arrangement with a second carrier until 1997
when the duopoly arrangement expires and it becomes free for all. The federal
government will be issuing a second-carrier license which will allow full
de-regulated competition for the first time in the provision of core network
services. While the telecommunications industry has been de-regulated for
quite some time (if you didn't like your Telecom phone, you could buy a
cellular phone or pager from anyone), there has never been any competition on
the initial connection service, or in the on-going provision of service.
When first offered, 31 different companies, mostly foreign, registered
interest in applying for the license which carries a $3 billion (US$ 2.5
billion) license fee and includes three operational satellites (which no one
wants), and three others being built (which no one wants either) by Hughes
Aircraft Corporation.
There are now three consortiums left in the race: the Bellsouth/Cable and
Wireless consortium (C&W run the Mercury phone company in the United King-
dom), the Bell Atlantic/Ameritech consortium who recently bought the run-
down hovel phone system in that rather odd country next to us, New Zealand,
and a third party which has remained anonymous, though rumour has it that the
third consortium is led by Com Systems.
It is widely believed that Bellsouth will get the license and Bell Atlantic
will have to be content nursing sheep in New Zealand. As mentioned before,
until 1997 there will be a duopoly, with the exception of a third nationwide
cellular network to be licensed sometime next year or so.
The Network
The Telecom network consists largely of ARE-11 and Ericsson AXE-10 switching
systems though older ARF and step-by-step exchanges still exist in some rural
areas. The Ericsson AXE-10 exchanges are currently the most advanced exchanges
available for use by the general public. At present some 70 percent of the
Australian telephone network is fully computerised and this is expected to
reach a full 100 percent by around 1994/95.
The AXE-10 offers all the facilities of what the more advanced Western
Electric ESS systems offer such as Centrex facilities. One notable feature not
offered by Telecom, though it can be made available on the AXE-10 exchanges,
is ANI. Considering the problems US phone companies have encountered in of-
fering ANI services, Telecom has never made any comment on the facility,
though Bellsouth has said that it would be one of the new features it would
introduce should it be successful in bidding for the second carrier license.
DTMF dialling is available as standard on the AXE-10 exchanges while those
decrepit individuals unlucky enough to be on ARE-11 exchanges (like me) must
apply for a DTMF service. It doesn't cost any extra, but it keeps a few
failed bureaucrats in a job if you have to apply for it. The ARE-11 exchanges
are far less advanced than the AXE-10's. They do not offer any of the Centrex
or Easycall facilities (such as call waiting, three-way call, call diversion,
ANI, etc.) that the AXE-10 offers.
The telecom network command center is located in Exhibition Street in the
center of Melbourne with a fallback command center located in the Melbourne
suburb of Windsor. Smaller network command centers are located in each state
capital.
These two locations control all network management functions nationwide for
all exchanges with the exception of the old step-by-step exchanges. They also
control the nationwide data services and other special services such as
Austpac (X.25), Iterra (Satellite), ISDN, DDN Flexnet (Digital data Network),
MobileNet (Cellular), as well as a host of other services.
Being Telecom's home city, the central area of Melbourne is also the only
city to be fully linked up with optical fibre at this time. Telecom is
gradually overhauling its inter-city trunk lines with optical fibre (with the
microwave network acting as a backup). Melbourne, Canberra, and Sydney are
linked together by a 1000 km long stretch of fibre optic cable, with other
links currently under way.
Payphones
There are five types of payphones in use around Australia. These are: The
PhoneCard payphone (the new standard payphone), CardPhone (for credit and
debit cards), Bluephone, Goldphone (being replaced by Bluephone), and the
older rotary dial payphones which are progressively being phased out.
PhoneCard Payphone: the new standard payphone in Australia is the new
Telecom Phonecard Payphone. This phone uses either coins or pre-paid
telephone cards similar to the cards that NTT (Japan) used to use in their
payphones until the introduction of smartcard telephone cards. These pay-
phones are usually located in places such as airports, hotels, and on the
street.
Cardphone Payphone: these payphones only accepts credit or debit cards
such as Amex, Visa, Mastercard, and debit cards issued by most of the banks.
To place a call, a customer swipes their card through the card reader, then
enters their PIN number. After this is verified, the caller dials the number
they want and the call is charged back to their card. These phones are lo-
cated in airports, tourist areas, hotels and some central city locations.
They are generally not located in the street.
BluePhone Payphone: The BluePhone was so-called because it is blue - pretty
imaginative. These accept coins only and are only located indoors. Most may
be found in bars, groceries, supermarkets, restaurants, 7-11's, stores and
hotels. These are never located on the street.
GoldPhone Payphone: Prior to the world's greatest marketing coup, the Blue-
Phone, Telecom's crack advertising team christened the GoldPhone - it was
gold. The GoldPhones are unimpressive indoor phones such as the BluePhones
(See 2600 Spring 1990 for Photo) and are gradually replaced by the BluePhones.
CrapPhone Payphone: So named because that is what it is. This has been the
Telecom standard payphone for more than 10 years. While some have had push-
button dialers installed, most still use rotary dial mechanisms. These pay-
phones are easily distinguishable from their robust, but dull, metallic green
appearance. The unit itself is made of two inch thick steel. These phones may
be found in streets but are being progressively replaced bu the PhoneCard
payphone. By replacing coin-only payphones with card-accepting phones, Telecom
hopes to reduce the level of vandalism affecting payphones.
Operator Numbers
000 : Emergency Operator (Ask operator for emergency service. Or dial direct
on the following three numbers.)
11440 : Ambulance / Paramedic
11441 : Fire
11444 : Police
013 : Directory Assistance (Local)
0175 : Directory Assistance (Intra and Interstate)
0103 : Directory Assistance (International)
1100 : Service Faults
1104 : Cellular network faults
0173 : Wake up calls
011 : Operator Connect (Within Australia)
0101 : Operator Connect (International)
0108 : Calls to ships at sea
1139 : Changed number directory
Long Distance Operators
001-488-1150 : Canada
001-488-1459 : Denmark
001-488-1358 : Finland
001-488-1330 : France
001-488-1180 : Hawaii
001-488-1852 : Hong Kong
001-488-1620 : Indonesia
001-488-1390 : Italy
001-488-1810 : Japan
001-488-1820 : South Korea
001-488-1310 : Netherlands
001-488-1640 : New Zealand (TCNZ)
001-488-1650 : Singapore
001-488-1440 : U.K. (British Telecom)
001-488-1011 : U.S. (AT&T - USA Direct)
001-488-1100 : U.S. (MCI - Call USA)
Other/Special Numbers
199 : Ringback
552-4111 : Telecom Line Identifier (gives you the number you are calling
from if on ARE-11 or AXE-10 exchange)
01921 : Austpac (X.25) 300 Bps
01922 : Austpac (X.25) 1200 Bps
01923 : Austpac (X.25) 1200/75 Bps
01924 : Austpac (X.25) 2400 Bps
01925 : Austpac (X.25) 4800 Bps
01928 : Austpac (X.25) 9600 Bps
0193111 : Discovery 2400 Bps
01955 : Discovery 1200/75 Bps
01956 : Discovery 2400 Bps
Australian Capital City Area Codes
02 : Sydney, NSW
03 : Melbourne, VIC
06 : Canberra, ACT
07 : Brisbane, QLD
08 : Adelaide, SA
09 : Perth, WA
002 : Hobart, TAS
089 : Darwin, NT
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
This was Taken From The 2600 Magazine of Spring 1992
Text typed by OMEGA / MEGA - Ind.
If you wanna subscribe to 2600 Magazine Fill out the form below
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Individual Subscription
o 1 Year/$21 o 2 Years/$38 o 3 Years/$54
Corporate Subscription
o 1 Year/$50 o 2 Years/$90 o 3 Years/$125
Overseas Subscription
o 1 Year, individual/$30 o 1 Year, corporate/$65
Lifetime Subscription
o $260
Back Issues
o 1984/$25 o 1985/$25 o 1986/$25 o 1987/$25
o 1988/$25 o 1989/$25 o 1990/$25 o 1991/$25
(Overseas: Add $5 per Year of Back Issues)
Total amount enclosed :____
And send this to :
2600 Subscription Department
P.O. Box 752
Middle Island, NY 11953-0752
U.S.A
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

269
textfiles.com/phreak/ax10arch.txt Normal file
View File

@@ -0,0 +1,269 @@
/////////////////////////////////////////////////////////////////////////////
// //
// Keltic Phr0st / Fit-Of-Boredom Productions Inc. Presents: //
// AXE 10 : Architecture //
// //
// An Overview of the AXE 10 System Architecture and functional Structure //
// //
/////////////////////////////////////////////////////////////////////////////
INTRODUCTION
============
In march 1985, after a detailed evaluation of digital switching systems, BT
placed a contract with Ericsson Limited for the development of AXE10 for the
BT Network and for the supply of a quantity of exchanges.
AXE10 is a duplicated-processor stored-program controlled digital
switching system developed by Telefon AB LM Ericsson of Sweden. The system
is structured for local, tandem, transit and combined exchange applications.
It can also be configured as a cewllular mobile or as an international
switching centre.
SWITCHING ARCHITECTURE
======================
The system architecture is logically divided into two main parts, the
switching system (APT) and the control system (APZ). See Figure 1.
The switching system (APT) performs traffic and operation/
maintennance functions. It comprises four main hardware subsystems:
Subscriber Switching SubSystem (SSS)
Group Switching SubSystem (GSS)
Trunk and Signalling SubSystem (TSS)
Common-Channel Signalling SubSystem (CCS)
and the following software subsystems :
Traffic Control SubSystems (TCS)
Charging SubSystem (CHS)
Operation and Maintennance SubSystem (OMS)
Subscriber Services SubSystem (SUS)
Network Management SubSystem (NMS)
All Hardware subsystems have a hardware component.
The control system (APZ) is made up of centralised and distributed
logic achieved through the following subsystems:
Central Processor SubSystem (CPS)
Regional Processor SubSystem (RPS)
Maintennance SubSystem (MAS)
Support Processor SubSystem (SPS)
Data Communication SubSystem (DCS)
File Management SubSystem (FMS)
Man-Machine Communication Subsystem (MCS)
In Earlier Exchanges the input/output subsystem was used instead of SPS, FMS,
MCS and DCS. See Figure 2 for the Subsystem structure.
FUNCTIONAL STRUCTURE
====================
The division of the systems (APT and APZ) into subsystems is determined by
conditions and requirements that arise from features, traffic handling and
operations and maintennance functions. See Figure 3.
The subsystems, including their interfaces, are designed such that
they can be used for different applications with the minimum of adaptation.
Each subsystem is built from a number of function blocks which in themselves
comprise hardware, central software, regional sofware and data components,
or just central software and data components. Each function block is designed
to execute a specific set of functions or sub-functions. A library of
several hundred functional blocks exists to satisfy all applications and
individual exchange requirements. Standardised interface signalling is
extensively used between blocks not only to achieve the neccesary flexibility
to satisfy customer's requirements, but to also enable new technology to be
introduced within the system in an efficient manner. See Figure 4.
To meet the twin needs of high capacity and low cost, the complex
executove tasks neccesary to operate the system are executed by the
duplicated central processor (CP) working in a paralell synchronous mode.
The routine, high volume tasks, such as scanning operations and for the
direct control of hardware, are distributed across a dimensionable number
of small regional processors (RPs). Regional Processors controlling several
hardware units are configured in a load sharing mode. The software driving
the APT functions, therefore, has both APT and APZ elements.
THE APT SUBSYSTEMS
==================
Subscriber Switching SubSystem (SSS)
------------------------------------
The subscriber switching subsystem contains the digital subscriber switch
and is built up of 16 line switch modules (LSMs). An LSM serves 128 analogue
subscribers or can support four 30-Channel systems for ISDN Customers.
Its principal function is to supervise the state of connected subscriber
lines, and to set up release connections by sending and receiving signals
to and from subscribers. The SSS comprises both hardware and Software. To
allow for the possibility of reducing line-plant costs, the local exchange
may be engineered with distributed switching in the form of a remote
subscribers switch (RSS).
Trunk and Signalling SubSystem (TSS)
------------------------------------
The trunk and signalling subsystem includes the equipment for connecting
trunks to the group switch. It supervises the state of trunks to other
exchanges by measn of the signals it receives and sends. The TSS consists
of both hardware and software.
Group Switching SubSystem (GSS)
-------------------------------
The group switching subsystem houses a time-space-time digital switch built
up of duplicated time switch modules (TSMs) and duplicated space switch
modules (SPMs). Its primary purpose is to set yp a 64Kbit/s path between
SSS and TSS devices through the group switching network. It is also
responsible for network synchronisation functions. The GSS comprises
hardware and software.
Traffic Control SubSystem (TCS)
-------------------------------
The Traffic Control SubSystem is wholly software, and controls and supervises
the set-up and release of connections. The TCS stores and analyses digit
information received from the SSS and TSS, and then, after checking against
previously recorded information, for example, subscriber categories, routing
and tariff classes, decides how the call should be handled.
Charging SubSystem (CHS)
------------------------
The Charging SubSystem consists of central software blocks and is responsible
for the task of charging calls by means of very accurate pulse metering
techniques. In addition to normal charging, special subscribers charging
facilities are available such as itemisation and advice duration and charge
(AD&C) information. The CHS also provides the administration with charging
statistics and per-event charging information. It functions by monitoring and
then analysing call information from the TCS or SUS (for service information).
Output to the FMS follows execution of the charging function.
Operation and Maintennance SubSystem (OMS)
------------------------------------------
The Operation and maintennance SubSystem mainly comprises software blocks.
Its function is one of system supervision, fault location, collection of
statistics and for dealing with the administration's operation and
maintennance functions. It can be operated either in the local or in remote
mode, say from a remote operation and maintennance centre.
Subscriber Services SubSystem (SUS)
-----------------------------------
The subscriber services system consists entirely of central software. Its
function blocks provide a variety of subscriber services. Typical SUS
services include:
Abbreviated Dialling
Three-Party Services (Enquiry, hold and transfer)
Diverion (Immediate, On Busy and and on no-reply)
Malicious Call Trace
Call Barring
Automatic Alarm Call
Common Channel Signalling SubSystem (CCS)
-----------------------------------------
The Common-channel signalling subsystem implements the message transfer part
(MTP) of CCITT Signalling Systems No. 6 and No. 7. The subsystem consists
of hardware and software blocks, the hardware devices (signalling terminals)
being connected to the external signalling links via a semi-permanent
connection through the group switch.
Network Management Subsystem (NMS)
----------------------------------
The functions of the network management subsystem are implemented in
software. The role of NMS is to provide access via the normal input/output
devices for the administration to monitor continuously the state of the
network.
THE APZ SUBSYSTEMS
==================
Central Processor SubSystem (CPS)
---------------------------------
The Central Processor subsystem is realised in both hardware and software.
The CPS executes the complex software tasks which are stored in the various
APT blocks. The main hardware parts of the central processor, which is
duplicated and runs in the synchronous mode, are the central processing unit
(CPU) and the memory stores. These stores comprise the main store (MS) or
program store (PS), reference store (RS) and the data store (DS).
The purpose of the CPS is to execute the following functions:
o Program Control including supervision of functions and for measuring
processor load.
o Loading and storage of tasks
o Output and updating reloading information
o Controlling fault tracing programs resident in the MAS or RPs.
Regional Processor SubSystem (RPS)
----------------------------------
The regional processor subsystem consists of both hardware and software
blocks. The purpose of the RPS is to run the simple, routine and very
frequent tasks to drive the RP part of the APT software and hardware. The
number of functions performed by an RP pair depends upon the complexity
of these functions. The number of RP pairs required for a given exchange
depends upon its size and the complexity of its signalling systems.
Maintennance SubSystem (MAS)
----------------------------
The maintennance subsystem consists of both hardware and software. The major
role is to supervise the operation of the APZ control system and takes the
appropriate action should a malfunction occur.
Support Processor SubSystem (SPS)
---------------------------------
The support processor subsystem consists of one or more independent
processors which drive input/output equipment such as personal computers,
visual display units and disc drives which are connected to the subsystem.
Data Communications System (DCS)
--------------------------------
The software for the data communications system resides in the SPS. It also
has a hardware element to support protocols such as X.25. Its function is to
support remote operation and maintennance, and transfer of itemised call
accounting data.
File Management SubSystem (FMS)
-------------------------------
The file management subsystem consists wholly of software. It provides
storage in the event that a data link failure occurs.
Man-Machine Communications SubSystem (MCS)
------------------------------------------
The man-machine communications subsystem consists of software. It provides
security checking and authorises I/O devices and the operator for a
particular function. It routes data output from the exchange to the presel-
-ected terminal(s). In addition, the MCS controls the generation of alarm
printouts or displays.
RELIABILITY
===========
System Performance is determined by both hardware and software reliability.
Hardware reliability is achieved by choice of components and by duplication
of units which perform a task affecting a proportion of the exchange
function.
Software reliability exists through system recovery functions which
rely on three restart levels namely:
o Small Restart - The APZ clears all jobs in process of being established.
The status of all existing calls is maintained.
o Large Restart - If the smll restart is rapidly followed by a new software
error then a more extensive restart involving a reset of all dynamic data
will take place. All existing calls are cleared.
o Restart with reload - The highest level of restart is enacted when the
restart fails to lead to a succesful program execution. The system then
automatically reloads programs and data from an external store. All
existing calls are cleared.

142
textfiles.com/phreak/baiq.txt Normal file
View File

@@ -0,0 +1,142 @@
----------------------------------------------------------------------
Date: Fri, 14 Feb 92 13:02:52 -0500
From: krfiny!listen@uunet.uu.net
Subject: Revised Listing of Class Codes; Other Recent Notes
Here's my update to John Gilbert's list (posted/distributed as Volume
12, Issue 124, Message 1 of 11).
My main "value added" is adding the non-technical terms next to
the technical terms, and sources for the information.
The following list was compiled from comp.dcom.telecom postings and
the Bell Atlantic "IQ services" information line at (800) 365-5810.
CLASS and Custom Calling Feature Control Codes:
(These appear to be standard, but may be changed locally)
*57 Customer Orignated Trace (COT) Activation "call trace"
The number of the last call you received is logged at the CO.
You get an acknowledging recording. Then hang up.
Write down the date and time.
Write down the date and time.
You don't get the number - you must contact the
business office or police.
Costs $1.50 - $3 depending on your area.
*60 Selective Call Rejection (SCR) Activation
(start "call block" list management)
*61 Selective Distinctive Alerting (SDA) Activation
(start "priority call" list management)
*62 Selective Call Acceptance (SCA) Activation
*63 Selective Call Forwarding (SCF) Activation
(start "select forwarding list" management)
*65 ICLID Activation (caller ID)
(turn on caller ID delivery to me, the subscriber)
*66 Automatic Recall (AR) Activation
(activate "repeat call" - retry last number for 30 minutes)
*67 Call Privacy Toggle (block caller ID delivery for next call only)
*68 Computer Access Restriction Toggle
*69 AC Activation "return call" (call last person who called you)
*70 Call waiting disable
"tone block" (prevent call waiting tone, useful for data calls)
*70 // dial tone // the number you're dialing
*71 Ring, no-answer forward activation
*72 Call forwarding immediate Activation (72# on some systems)
*73 Call forwarding Deactivation (73# on some systems)
*74 Speed call 8 program (74# on some systems)
*80 SCR Deactivation "call block"
*81 SDA Deactivation "priority call"
*82 SCA Deactivation
*83 SCF Deactivation "select forwarding"
*85 ICLID Deactivation (turn off caller ID delivery to me, the subscriber)
*86 AR Deactivation "repeat call"
*89 AC Deactivation "return call"
n# speed dial (n=2 to 9)
nn# speed dial (nn=20-49)
72# activate call forwarding
73# deactivate call forwarding
74# set speed dialing (8 numbers)
75# set speed dialing (30 numbers)
Rotary/pulse phones: use 11 for the * (ex: *57 => 1157) (is there a
pulse code for #? I doubt it becuase it's not a prefix)
You do not need to subscribe to call trace to use it. Some areas
allow return call and repeat call on a per use basis. The cost is
higher per use than with a subscription, but you pay nothing for
months where you don't use it.
*65 and *85 are used when you subscribe to Caller-ID if you want to
reduce the number of calls logged because there's a surcharge after
400 calls per month.
New York Telephone has a recorded message system describing their
services. Here's what I gathered from (800) EASY-NYT (327-9698) (this
mostly jives with information from the Bell Atlantic IQ services
information line at (800) 365-5810)
Menu choice:
45 -> A person relays voice/TDD at no additional charge.
This is WITHIN New York State only.
What about calls in/out of New York State?
What about calls in/out of New York State?
The operator said the originator should call information for
the relay service. This is a service of AT&T, and is currently
not allowed to call across states.
(800) 421-1220 voice
(800) 662-1220 TDD
The AT&T newsline (908) 221-6397 (221-NEWS)
for Friday June 8, 1991 mentioned that the (Chicago) Illinois
relay center opened June 10.
It is the fourth, others being in New York, Alabama and California.
[and Sprint's in Texas as mentioned in TELECOM Feb 1992]
46 -> restrict outgoing calls to pay services
exchanges 540, 550, 970, 970
area codes 700, 900
This service is free of charge.
14 -> "Ring Mate" allows you to add one or two additional numbers,
each with a unique ring pattern (and call waiting beep).
AT&T has language translation centers. I believe these are the numbers:
(408) 648-5871 AT&T Language Line (outside the USA)
(800) 628-8486 AT&T Language Line (USA only)
(800) 752-6096 AT&T Language Line information
You can get translators (English/Japanese, ...) as needed, but the
cost is rather high. I'm not sure if reservations/appointments are
necessary. It would be interesting to see the setup and costs for a
conference call from the US to Japan, using the translation center and
a TDD relay for the deaf (particularly if the deaf were non-english).
Or better yet -- a video conference from the US to Russia with
translators.
CCITT rules:
How to write a number:
+1 212 555 1212
international
(spaces, NO dashes)
(212) 555 1212
within the country (parentheses around the optional city code)
Jeffrey Jonas jeffj@synsys.uucp
------------------------------

BIN
textfiles.com/phreak/basic.of.phreak Normal file
View File

Binary file not shown.

567
textfiles.com/phreak/basics.rmb Normal file
View File

@@ -0,0 +1,567 @@
anytime...
Y
OKAY, HERE COMES....
---===---===---===---===---===---===---
= =
- RAMBUG'S HACKING VOLUME #1 -
= =------------------------= =
- -
= -CALL THESE GENODICAL SYSTEMS- =
- =--------------------------= -
= =
- THE NEUTRAL ZONE ][ (604) 478-1363 -
= TCL (604) 384-3085 =
- /\/\ETALLAND 1 (503) 538-0761
= /\/\ETALLAND ][ (503) 253-5300 =
- THE METAL AE (201) 879-6668 -
= =
---===---===---===---===---===---===---
IN THIS VOLUME, WE WILL TALK ABOUT THE
OPERATORS OF MA BELL AND LOOK INTO AREA
CODES. ONE MORE THING, I WOULD LIKE TO
GIVE SPECIAL THANXS TO THE FOLLOWING
PEOPLE FOR THERE SUPPORT:
JUDGE DREDD
THE WOLF
MYSTIC WARRIOR
---------------------------------------
NOW ON WITH IT. THERE ARE BASICALLY 7
TYPES OF OPERATORS. SOME CAN BE VERY
USEFUL FOR INFORMATION, LIKE LITTLE
HINTS FOR SPRINT AND MCI CODES! ANY
WAYS, I WILL EXPLAIN IN DETAIL THE7
OPERATORS THAT ARE REALLY IMPORTANT.
TRAFFIC SERVICE POSISTION OPERATORS
=---------------------------------=
THIS OPERATOR IS THE OPERATOR YOU
USUALLY HEAR WHEN YOU CALL FROM A PAY
PHONE. SHE IS IN CHARGE OF GETTING ALL
BILLING INFO FOR CALLING CARDS AND
THIRD NUMBER CALLS. MAKING SURE YOU GET
THE RIGHT PERSON ON 1 TO 1 CALLS.
MAKING SURE THE PERSON ON THE OTHER
WILL PAY FOR THE COLLECT CALL. AND
LAST BUT NOT LEAST VERIFYING CALLING
CARDS, AND MAKING SURE YOU AREN'T
USING A CALLING CARD YOU AREN'T SUPP-
OSED TO BE USING. DON'T FUCK WITH THESE
OPERATORS, FOR THEY ARE DANGEROUS. THEY
ARE KNOWN TO HAVE THE CAPABILITIES OF
KNOWING IF YOU ARE CALLING FROM A
FORTRESS PHONE.
INWARD OPERATORS
=--------------=
THIS OPERATOR IS BASICALLY THE "0"
OPERATOR. SHE ISN'T MUCH OF USE. SHE
CAN JUST TELL YOU THINGS LIKE L.D.
INFORMATION. SHE CAN BE QUITE HELPFUL
FOR SPRINT NUMBERS. I KNOW ONE GUY WHO
SAID HE WANTED TO KNOW THE LOCAL SPRINT
NUMBERS TO CALL HIS GRANDMA, AND SHE
WAS RETARDED ENOUGH TO BELIEVE HIM.
DON'T UNDERESTIMATE THESE RETARDS
THOUGH, IT IS PERFECTLY LEGAL FOR THEM
TO LISTEN IN ON YOUR PHONE CALLS IF
THEY THINK AN ILLEGAL ACT IS GOING ON.
ALSO, THEY HAVE THE POWER TO MONITOR
YOUR PHONE AT ALL TIMES (MODEM OR NO
MODEM!).
DIRECTORY ASSISTANCE OPERATORS
=----------------------------=
THIS OPERATOR IS NOT MUCH OF A HELP IN
THE WAY OF HACKING, BUT SHE CAN BE
HELPFUL FOR PREFIXES. I ASKED HERE ONCE
FOR THE OTHER SURROUNDING PREFIXES OF
SEATTLE, AND SHE GAME THEM TO ME. IT
CAME IN VERY HELPFUL FOR GETTING MCI
NUMBERS. BASICALLY, YOU PHONE THIS
OPERATOR AND YOU GET PHONE NUMBERS OF
HER. NO BIG DEAL!
DIRECTORY ASSISTANCE FOR THE DEAF
=-------------------------------=
THESE OPERATORS ARE VERY, VERY HELPFUL,
FOR HACKING THAT IS. MOST DEAF PEOPLE
HAVE TELETYPEWRITER TERMINALS. SHE
TALKS TO THEM LIKE I WOULD TALK TO YOU
VIA A MODEM. IN FACT, THAT IS BASICALLY
WHAT A TELETYPEWRITER IS, A MODEM. HERE
IS A HELPFUL HINT FOR USING THIS
OPERATOR. PLAY DUMB, AND YOU WILL GET
ANYTHING OUT OF HER. ONE MORE THING,
ALOT OF MODEMS CAN'T COMMUNICATE WITH
TELETYPEWRITER BECAUSE THEY THEY DON'T
SUPPORT BAUDOUT. THE MODEMS I KNOW THAT
SUPPORT BAUDOUT, ARE AWESOME APPLE CATS
AND COOL PROMODEMS!
CN/A OPERATORS
=------------=
THESE OPERATORS ARE PROBABLY THE BEST
OPERATORS FOR HACKING! THEY CAN GIVE
YOU ANYTHING YOU WANT. THE TROUBLE IS,
HOW DO YOU GET IT. ANYWAYS, THESE
OPERATORS WILL GIVE YOU UNLISTED
NUMBERS IF YOU HAVE A CALLING CARD.
THEY ARE VERY SECRETIVE, AND DON'T
LET PEOPLE GET AWAY WITH ANYTHING.
BUT IF YOU HAVE ONE OF THESE BEUTIES
AS FRIENDS, YOU'VE GOT IT MADE!
INTERCEPT OPERATORS
=-----------------=
THESE OPERATORS ARE IN CHARGE OF
SECURITY. IF YOU ARE REPORTED TO THE
COPS, FOR USING DIALERS OR HACKERS,
CHANCES ARE, IT WAS THESE BITCHES WHO
NARKED ON YOU. THEY FLIRT THEIR TRASERS
AND ARE QUICK WITH ONE. GET CAUGHT BY
ONE OF THESE OPERATORS AND YOU'LL
BE WAISTED!
OUTER OPERATORS
=-------------=
THESE OPERATORS ARE IN CHARGE OF
CONNECTION YOU TO ELECTRONIC SWITCH-
BOARDS. THEY CAN BE VERY USEFUL
OPERATORS IF YOU KNOW WHAT YOU ARE
DOING. MORE ON THESE OPERATORS IN
RAMBUG'S HACKING VOLUME #2.
WELL, THAT BASICALLY COVERS THE
OPERATORS. AS YOU CAN SEE, THESE
BITCHES CAN BE USEFUL.
NOW TO SHOW YOU HOW AREA CODES WORK.
THE FIRST NUMBER OF THE AREA CODE IS
A NUMBER FROM 2 - 9. THE SECOND NUMBER
IS 0 - 9. THE THIRD NUMBER IS FROM
0 - 1. USUALLY AN AREA CODE CAN'T ROSS
OVER A PROVINCES/STATES LINE. THI
MEANS, YOU CAN'T HAVE THE SAME AREA
CODE FOR VICTORIA AND TORONTO. BUT,
I REPEAT BUT, HERE ARE SOME EXCEPTIONS:
510 - TWX (USA)
610 - TWX (CANANDA)
700 - RESERVED FOR LATER USAGE
710 - TWX (USA)
800 - WATTS LINES
810 - DIAL-IT SERVICES
910 - TWX (USA & CANADA)
EXPLANATIONS ON THESE SERVICES ON
WILL BE MORE EXPLAINED IN RAMBUG'S
HACKING VOLUME #2. WELL, THIS WRAPPES
UP THIS VOLUME. I HOPE THIS FILE HELPS
YOU MORE ON THE WORLD OF HACKING.
ANY QUESTIONS YOU MIGHT HAVE, YOU CAN
REACH ME ON ANY OF THE BOARDS I
MENTIONED IN THE TITLE. WELL, BY FOR
NOW, AND REMEMBER, KEEP HACKING!
THIS FILE RELEASED ON: 05/21/86
-RB-
TURN
---===---===---===---===---===---===---
= =
- RAMBUG'S HACKING VOLUME #2 -
= =------------------------= =
- -CALL THESE GENODICAL SYSTEMS- -
= =--------------------------= =
- =
- THE NEUTRAL ZONE ][ (604) 478-1363 -
= TCL (604) 384-3085 =
- /\/\ETALLAND 1 (503) 538-0761 -
= /\/\ETALLAND ][ (503) 253-5300 =
- THE METAL AE (201) 879-6668 -
= =
---===---===---===---===---===---===---
IN THIS VOLUME, WE WILL TALK ABOUT THE
OUTER OPERATORS, THE MOST IMPORTANT
OPERATORS, AND MOST INFORMITIVE BY
FAR. ALSO, LIKE I PROMISED IN THE LAST
VOLUME, WE WOULD TALK MORE ABOUT THOSE
AREA CODE EXCEPTIONS. JUST BEFORE I GO
ON, I WOULD LIKE TO EXPRESS MY THANXS
ONCE AGAIN TO THE FOLLOWING FOR THERE
SUPPORT:
JUDGE DREDD
THE WOLF
MYSTIC WARRIOR
---------------------------------------
NOW LET'S GET STRAIGHT TO THE ISSUE.
AS I WAS SAYING IN VOLUME #1, OUTER
OPERATORS ARE IN CHARGE OF CONNECTING
YOU TO ELECTRONIC SWITCHBOARDS. YOU
KNOW, LIKE SAY YOU WANT TO CALL THROUGH
*SPRINT* OR *MCI*, YOU HAVE TO TYPE IN
YOUR 6-8 DIGIT CODE, AND IF YOU JUST
CALLED ANY OLD NUMBER AND PUNCHED IN
YOUR A CODE, THEY OPERATOR WOULD THINK
YOU BELONGED TO A MENTAL INSTITUTE!
NOW, WHEN YOU CALL A SPRINT NUMBER OR
MCI NUMBER, YOU ARE GOING THROUGH AN
OUTER OPERATOR, EVEN THOUGH YOU MAY NOT
KNOW IT. WHEN YOU DIAL THE SPRINT/MCI
NUMBER, YOU ARE REALLY CALLING THE
OUTER OPERATOR, WHO IN TURN CONNECTS
YOU TO THE SWITCHBOARD. YOU SAY, HOLY
SHIT, SHE CAN SEE WHAT I AM DOING, AND
WILL KNOW I AM PHREAKING VIA THE
SPRINT/MCI SWITCHBOARDS THAT A COMPANY
IS RENTING! MY ANSWER: NOPE, SHE CAN'T
SEE NOTHING YOU TYPE OR DO, IN FACT,
SHE DOEN'T EVEN KNOW THE NUMBER YOU
ARE CALLING FROM. THEY YOU SAY, I HAVE
NOTHING TO WORRY ABOUT. WRONG! THE
OUTER OPERATOR CAN'T TRACE YOU, BUT
THE SWITCHBOARD CAN! THAT IS WHY THERE
IS A RISK CALLING AND HACKING AT
SPRINT/MCI CODES. HERE ARE A FEW HINTS
SO YOU DON'T GET CAUGHT USING
SPRINT/MCI WHEN YOU FINALLY (SIGH) GET
A CODE.
[1] TRY AND FIND OUT WHAT COMPANY'S
CODE YOU HAVE. THAT WAY, YOU KNOW
WHAT TO CALL. FOR INSTANCE, IF YOU
HAVE THE CODE FOR SHOPPERS DRUG
MART, YOU WOULDN'T CALL SAFEHOUSE
BBS IN NEW YORK! BUT IF YOU HAD
THE CODE FOR NATIONAL TELEWORKS
CORPORATION, IT WOULD MAKE SENSE
CALLING A BBS.
[2] CALL AT ONLY THE BUSINESS'S HOURS
OF OPERATION, IT WOULD LOOK STUPID
AND SUSPICIOUS CALLING AT 3:00 AM
WHEN THE COMPANY'S OFFICE BUILDING
IS CLOSED.
[3] NEVER CALL SOMETHING THAT IS
CONNECTED TO A PHONE COMPANY.
THAT COULD PROVE TO BE DARING
AND VERY DANGEROUS.
[4] NEVER CALL FROM A FORTRESS PHONE,
BECAUSE IF YOU DO, THE VERY TIME
YOU CONNECT, IT WILL COME UP ON
AN INTERCEPT OPERATORS COMPUTER
(READ ABOUT THESE IN VOLUME #1.)
WELL, THAT IS BASICALLY IT ON HINTS,
AND ALWAYS REMEMBER, NEVER DO STUPID
THINGS WHEN CALLING THROUGH SPRINT OR
MCI. YOU WOULD BE PUTTING YOUR

273
textfiles.com/phreak/basnet.sk8 Normal file
View File

@@ -0,0 +1,273 @@
11/20/89 -----------------------------
7:30 EST-10:46Est - A File By Sk8 The SkinHead-
-----------------------------
BASIC NETWORKING
Well, many people have asked me "how do i use Telenet".."how do i use an outdial". Well i have decided to write a very basic file on telenet and how to get around on the networks.
Well Telenet and others are PSN's or (Packet Switching Networks) these nets are connected to many other networks around the world. You can do alot with just basic knowledge that i have (most of you will know this and way beyond what i know but some will benefit from it) i will start with some of the terms that are often used with these services.
Access Number- The direct number that you dial to access a network (duh).
Nua (Network Users Address) - An Nua is basicly a number you type in to access that particular service think of an Nua as a phone number sorta its not an actually phone number with an Acn country code or whatever because the service is connected to the network world wide. I hope that was fairly clear let me show this think of the planet earth as an network and to reach the services on the planet you call the phone number like the service is a persons residence or business phone or payphone whatever just like on a network an Nua is the Address to a system or outdial whatever on the particular network. I hope this is clear or atleast somewhat understood.
Nui (Network User Identification) - An Nui is like a Account and Password to the network like an account and password is to a bbs that lets you access the system. Some people use Nui for like anything like an Vax system Unix systems they are referring to an Nui as basicly a account on the particular system that lets you use the system.
DNIC (Data Network Identification Code) - The DNIC is like a 4 digit code that represents what Psn it is think of an DNIC like an AreaCode and the Nua the individual phone number.
Outdial - Is basicly what it says an modem port connected somewhere on the network that will allow you to dial out from and connect data only to a actually phone number not an Nua.
Pad (Packet Assemble Disassembler) - an x.25 pad is very useful an pad using x.25. protocal transmits at 9600 bps to an Nua. This may sound funny but i call them "Launch Pads" heh like with an x.25 you can usally access any Nua on the planet by usally typing the Dnic+Nua.
Now i will explain various things and give helpful ideas.
Let me start off with some helpful things for you to try and do.
TeleNet
The first thing your going to have to have is your Access number it is very easy to get your local access number. Simply call telenet at 1-800-TELENET that is thier customer service number and ask for your dialup the operator will ask for your area code and prefix of your phone number he/she will also ask your baud rate. There are many telenet ports across the country and internationly with varying baud rates from 110 bps (yuck) to 9600 (i wish i had) so you will want your maximum baud port most locations have atleast 1200 many have 2400 and not alot have 9600 ports like for big cities like Detroit and Los Angeles at the end of the file i will list some useful numbers.
Some things to do while online with Telenet and Tymnet. While at the @ on the Telenet system type "mail" or "C mail" or "telemail" or even "c telemail" this access's telenets mail system simple entitled "Telemail" from there it will ask "user name" or something like that type "phones" next it will prompt you "password" enter "phones". The phones service has alot of worthy information it will give you a menu to choose from the rest should be self explanatory. Along with the other information on the phones service there is a complete updated list of all Telenet access numbers which is conveinent. Once you have tried the phones service also on telemail enter "Intl/Associates" as the user name and "Intl" for the international access numbers. If you are calling from overseas somewhere connect with an telenet access number then type this Nua at the telenet @ prompt "311020200142" and enter the username and password.
You might want to pick up a sort of a reference booklet on Telenet simply again call the customer service number and ask them for "How to use Telenet's Asychronus Dial Service" and give them your address which is self explanatory.
Another tidbit of info you would like to know if you already didnt know that Telenet is owned by Us Sprint long distance service.
Tymnet
The same goes for Tymnet service you will first need an Access Number. Simply call Tymnet customer service at 1-800-872-7654 and ask them. Again you might like to get Tymnets reference booklet on how to use there system simply again ask them to send it to you. Once online with a Tymnet access number type "Information" at the user name prompt and you will be connected to another nice thing on tymnet which you have access to all thier Access Numbers also just like the "phones" service on Telenet. Tymnet is owned by "Mcdowell Douglas" corporation. Unlike Telenet where a long distance company owns the network. On Tymnet in the "Information" service there is a very cool option that will provide you with all the Dnic's (Networks) available from Tymnet. You may also want to get that on buffer but for your conveinience i will include a copy of that. The file "Basic.NetworksII" is the complete listing and i would like the Basic.NetworksII file to be accompanied by this file for the most part.
Outdials
Now i will discuss Outdials and tell how to use them. An Outdial on Telenet is an Pcp Port usally. It will enable you to connect data with a carrier. An Outdial is a modem connected up to the network to access the outdial spimply type the outdials Nua. Usally you will need a Nui or Pad to use an Outdial on Telenet just to let you know. Once connected to an Outdial on Telenet type "Ctrl-e" to get into the command mode of the Outdial or if your sharp on your Hayes modem AT command set just issue the commands thru the Outdial besure to type "Atz" when logged in to reset the modem parameters to default values. Outdials range from different baud rates just like what kind of modem is hooked into the Outdial port. This is the basic Telenet Outdial but there are many types a Tymnet Asychronus is a very good Outdial to use like i said there are many different types the above is for Telenet Pcp Outdials which are used most widely.
Scanning Telenet
Well now i will explain how to scan telenet and how to find Pcp outdials etc. When scanning telenet call your Access Number and at the prompt enter the Nua. Plan to scan a certain amount of Nua's in a session wether the number is up to you, usally when i scan i scan in blocks of 100 you can find alot of things while scanning. I will tell how to find pcp outdials, first if your looking for a particular area code for the outdial take the 313 area code for example usally an outdial is in the first 150 numbers scanned so i would suggest if scanning for outdials scan like this..the area code for which you want the outdial two 0's then a three digit number so the scan would look like this...31300001,31300002,31300003 etc.. im sure you get it...along the way you will probably find other neat things. Some things to know when scanning telenet is when you enter an Nua and it freezes like wont do anything send a break signal, for me i use Proterm for the Apple the break signal is open-apple b once the break signal is sent it should go back to a @ prompt again. If you try scanning another nua directly after you broke out from the frozen portion Telenet will give you an error message "Connection Pending" which means it is still looking for the Nua system from which you requested previously. To remedy this situation after the break signal is sent type "d" for disconnect it will then tell you the connection has been terminated. Proceed scanning the Nua continuing where you left off. (Note. you will get the freeze and have to repeat the sequence over and over again as of there are A LOT of Nuas that freeze) Well i bet your asking "how do i know when ive found an outdial?" usally Telenet will respond with a connect message and then nothing try to type "Atz" if it responds "ok" then you have a Outdial port where as Atz is the hayes modem command for reseting the modems paramaters to default settings. Ok now i will explain some things to look for and some wise things to do while scanning and also supply an response key explanations.
Whenever you "Connected" to an Nua write it down no matter what it is make notes of what you find and label them for instance if you encounter any of these messages.
User Name = a Vax System
Login = a Unix system
Primenet = a prime system
Password = something worth noting
Basicly anything that connects take note of this is very useful for finding systems to hack on even though most or all of Telenet has been scanned at one time or another there are always somethings to do! that is a FACT! Be sure to write down all "Refused Collect Connection" also because we must not forget that when we request an Nua that we are asking for a collect call all Nuas inputed on Telenet without an Nui are being paid for by the particlar system requested that is why when an Outdials Nua is requested without any sort of Pad,Nui etc. it will not excecpt the call in all cases i have encountered
Here is a list of Network Messages that Telenet will respond with remember these are for any type of Telenet access the following may appear and a completed explanation.
@ is the network command prompt
? the last entry was invalid
Access Bared - Your connection request does not allow you to connect to this system
Access to This Address not permitted - Your Nui is not authorized to access the address you typed
Attempt Aborted - You enterd the disconnect command (as we said before when it freezes when scanning)
Busy - All the ports,destinations are in use try again later
Collect Wats Call Not Permitted - Collect Wats calls not permitted by your host or authorized by your Nui
Connected - Your terminal has been connected to the Nua system you requested
Connection From - Your terminal has been called by another computer or terminal
Connection Pending - The Network is try to establish a connection with the Nua you requested (enter the d command or "bye" to disconnect the attempt)
Disconnected - Your terminal has been disconnected from the terminal you called
Enhanced Network Services System Error - Your call couldnt be validated contact customer service
Enhanced Network services unavailable at this time - Serivce is temporarily unavailable try again later
Illegal Address - enter the Connect sequence again whether it be an Nua or a system name
Invalid Charge Request - your payment selection is not valid
Invalid User Id or Password - The Nui you entered is not valid
Local Congestion - Your local Access number is busy try again in a couple minutes
Local Disconnect - Your Terminal has been disconnected
Local Network Outage - A temporary problem is preventing you from using the network
Local Procedure Error - Communication problems by the network caused the network to clear your call
Not Available,Not Operating,Not Responding - Your Computer cannot accept your request for connection try later
Not Connected - You have entered a command thai s only valid when connected to a system type "cont" to be brought back into the connection
Not Reachable - A temporary conditon prevents you from using the network
Password - This is the prompt which apprears after youve entered an Nui
*** Possible Data Loss - connecton has been reset
Refused Collect Connection - Your payment selection must be prepaid
Rejecting - Host copmputer refuses to accept the call
Remote Procedure Error - Communication problems forced the network to clear our call
Still Connected - You requested another service while your online to another
Telenet XXX XXX - Network Port you are using
Terminal - This is the terminal type prompt
Unable to validate call - Your Nui has been temporarily disbaled
Unable to validate call contact admin - The Nui has been permently disabled
Unknown Adress - Your Nua may be invalid
Wats Call not permitted - Telenet In-wats calls are not permitted by your host or your Nui
Well that is the end of the Telenet messages and this is the end of our file only left is the numbers i have and some other usual stuff
Telenet Customer service 1-800-TELENET
Tymnet Customer service 1-800-872-7654
Telenet Access # 313/964-2988 1200 bps 313/963-2274 2400 313/964-3133 9600 bps
Tymnet Access# 313/962-2870
Global Outdial at 20200123
Well that is about it id like to greet some people here SoldierOfFortune,Frodo,TheBit,Hellraiser,Icecube,Slaytanic,Corrupt,Lorax,Deadman#The Disk Master,The Hunter,DPAK,MOD,Rat,The Traxster,The Apple Bandit,El Cid,Shadow,Blue Adept,Blacknight,LOD,HALE,DungeonMaster,Blackbeard,Kilroy,The Whole Interchat scene,All my buddys from the alliances,Gambler,Sabers Edge,Misfit,The Flash,Qsd friends,All the people who called my Vmb'z for "Rad Infoz" and helped to keep it going and all the whole people you make a difference "All you Kids out There keep the Faith!"
I can be reached on Funtime Gs at 305-989-0181 d215*guest is the new user pass
I can be reached at this Vmb 313-980-5632
and soon im going to be running a bbs with a friend of mine so be sure to look for that like i said im outta here Slaytze!!!!
Well This is the part with the complete list of Networks World Wide also some intresting data about them.
This is the 2nd part to my Basic.Network text file
--Sk8 The SkinHead
T I T T H A I
C S A A C S U
E N V S . U N
R A 5 N I N 8 5 V M M
I R 2 7 D R O 2 2 E Y Y
COUNTRY/DNIC/NETWORK D T T X M P C X X R T T
--------------------------I-------I-------I-------I-----------I-----------I
Alaska/3135/Alascom I X ? I X ? X I ? X I X ? ? X I X ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Antigua/3443/Aganet I X ? I X ? I X ? I X ? ? I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Argentina/7220/ARPAC I X ? I X ? I X ? I X ? ? I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Argentina/7222/ARPAC I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Austria/2322/DATEX-P I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Austria/2329/RA I X ? I X ? X I X ? I S ? X ? X I S ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Australia/5052/AUSPAC I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Australia/5053/Data AccessI X ? I ? X I ? I ? X ? X I ? ? X I
--------------------------I-------I-------I-------I-----------I-----------I
Bahamas/3640/BaTelCo I X ? I X ? I X ? I X ? ? X I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Bahrain/4263/BAHNET I X ? I X ? I X ? I X ? ? X I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Barbados/3423 I X ? I X ? I X ? I X ? ? X I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Belgium/2062/DCS I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Bermuda/3503/Bermudanet I X ? I X ? I X ? I X ? ? X I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Brazil/7240/Interdata I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Brazil/7241/Renpac I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Canada/3020/Datapac I X ? I ? X I ? I ? X ? X I X ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Canada/3025/Globedat I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Canada/3028/CNCP I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Canada/3106/Tymnet Canada I X ? I X ? I X ? I X ? ? X I X ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Cayman Islands/3463/IDAS I X ? I X ? I X ? I X ? ? I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Chile/3104/Entel I X ? I X ? I X ? I X ? ? I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Chile/7302/Entel I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Chile/7303/Chile-PAC I X ? I ? X I ? I ? X ? I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Chile/7305/VTR I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
T E G
T I T T H A I
C S A A C S U
E N V S . U N
R A 5 N I N 8 5 V M M
I R 2 7 D R O 2 2 E Y Y
COUNTRY/DNIC/NETWORK D T T X M P C X X R T T
--------------------------I-------I-------I-------I-----------?-----------I
China/4600/PTELCOM I ? X I ? X I ? I ? X ? I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Columbia/3107/DAPAQ I X ? I X ? I X ? I X ? ? I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Costa Rica/7122/RACSAPAC I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Denmark/2382/Datapak I X ? I ? X I ? I ? X ? X I ? ? S I
--------------------------I-------I-------I-------I-----------I-----------I
Dominican Rep/3700/UDTS-I I X ? I X ? I X ? I X ? ? I X ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Egypt/6020/ARENTO I X ? I X ? I X ? I X ? ? X I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Finland/2442/Datapak I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
France/2080/Transpac I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
France/2081/NTI I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Fr Antillies/3400/Dompac I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Fr Guiana/7420/Dompac I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Gabon/6282/Gabonpac I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Germany F.R/2624/DATEX-P I X ? I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Greece/2022/Helpak I X ? I X ? X I X ? I X ? X ? X I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Greenland/2901/KANUPAX I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Guam/5351/PCINET I X ? I X ? I X ? I X ? ? X I X ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Guatemala/7043/GAUTEL I X ? I X ? I X ? I X ? ? I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Honduras/7080/HONDUTEL I X ? I X ? I X ? I X ? ? I ? X ? I
--------------------------I-------I-------I-------I-----------I-----------I
Hong Kong/4542/INTELPAK I X ? I ? X I ? X I ? X ? X I ? X ? X I
--------------------------I-------I-------I-------I-----------I-----------I
Hong Kong/4545/DATAPAK I ? X I ? X I ? I ? X ? X I ? ? I
--------------------------I-------I-------I-------I-----------I-----------I
Hungary/2621/DATEXL I X ? I G

353
textfiles.com/phreak/bb_germ.txt Normal file
View File

@@ -0,0 +1,353 @@
January 1996
BB in Germany
written by Dr. Fraud
Hi Phreaks !
In this article, I wanna write a little bit about BB in Germany. This phile
is NOT a `how 2 do it' essay.... It`s 4 phreaks to show what has done and
what is still possible. I also won`t describe any signalling systems like
C5/R2/C7, cause everyone who reads this phile should know how they work. I
have put the TXT into several groups like the following:
- Overview: breakable countries
- Why are other countrys not breakable ?
- The story `bout C4
- You don`t get a busy flash....ahahaha!
- How the TELECOM filters work
- About Hardware
- Problems with Transit/Routings
- How 2 get Routing Codes
1.) Overview: the breakable countries
At the 1st point, I wanna give you a short list of the easy breakable
countrys. As u can see, there are many ones u can break, but most of them
are not very interesting (seen in the aspect of getting out of those
fucking desert-countries....). The only exception are the C5/R2 countries.
but at the moment, there are only very few people who can phreak them...
congratulations !
Okay, here are the breakable ones (alphabetical order)
> Argentinia (+54)
> Brasilia (+55)
> Chile (+56)
> China (+86)
> Columbia (+57)
> Emmirates of Arabia (+971)
> Guatemala (+502)
> Hawaii (+1-808)
> Indonesia (+62) [not available from everywhere]
> Iceland (+354)
> Japan (+81) !! hard 2 seize !!
> Jordania (+962) !! still offline !!
> Macau (+853)
> Malaysia (+60) [not any more !]
> Nicaragua (+505)
> Paraguay (+595)
> Phillipines (+63)
> Singapore (+65)
> South Africa (+27)
> Uruguay (+589)
> Venezuela (+58)
At 1st, I wanted to add the frequs for each country....no, not exactly, but
at least a description like: Cl.Fwd/EOf/Seize. But I decided that its not
very useful because you should be able to find them out by yourself. Besi-
des, all these ones are C5 and quite simple 2 break (more or less.... arghh
I hate the Phillipines !!!!!!). U can reach them via HCD (standard) with
the exception of HawaII.
NOTE: These are not all the existing countrys you can reach by a toll free
number... but these ones are the easiest to call. If you wan`t to
call other countries by direct (=local) breaking, start scanning !
* Concerning the Thailand HCD (+66), I`m not sure what is is, but I think it
should be C7. If not and if you can break it, please contact me !
* At MCI and AT&T, I already had sume argues with other phreaks, but I know
that at least AT&T _IS_ breakable ! [note: or WAS breakable until 12/95]
The problem with R2 is that it`s mostly PCM (in Germany). This means that
there`s used a multiplex system to mix information and signalling signals.
So you use 1 channel each, but it seems as if you are just on one channel.
At the moment, I still don`t cope with those systems... Sumetimes, I get a
Hgup, but I don`t know whether it`s caused from my BB or from that fuCkiNg
switch.
Another problem is: theres no absolute standard on R2. It depends on the area
you live in and the country u wanna break 2 get a success. Just start scan-
ning... Some hints: Of course, u should only scan the effective signalling
band....it would be quite senseless to scan from 500 up to 1500 Hz. And al-
ways remember: R2 is not an international system. It`s always combined with
at least one signalling frequency of another system (like C5) !
2.) Why are other countries not breakable ?
aaaahahahhah!!! stupid question. Cause they changed to C7.
Anyway, there is a possible exception: The "Fiiieep" linez. If you are not
from Germany, you can`t imagine what this means to the phreaker: You know,
some switches (e.g. the Siemens-Alcatel) require an exact timing. The Cl.
Fwd. must be sent on exact the time when you can hear the 2nd "click" (or
some milliseconds after). There is one problem now: The Telco has changed
that click to a noisy "fiiieek" now on some nuMbAs. That noise is inter-
modulating the break you send. The result is: No result.
The only thing you can do: (except when you live in area 03....ggrrr...I
hate everyone in there...) increase the volume of your break to a maximum
and try to find a guard tone that fixes that interference...this should be
not too easy.... after some minutes of experimenting, you may be able to
achieve a HgUp, but seizing will be quite complicated !
3.) Phunny story bout C4
Just a few words 2 the phreaks who wanna start scanning C4 lines,
inspired by the Scavenger dialer: Yes, u can call via C4 lines, if u
a) break an oversea line (e.g. Germany => Paraguay...aaeh..no...Paraguay uses
R2 at the country itself...)
b) call a C4 based numba in that country, break it and have phun...
But there are 2 major problems:
a) linez are shit
b) there are nearly (I said nearly, in fact, I don`t know _ANY_) no C4 linez
left... perhaps, u will find someones in South America or Africa.
So, forget the C4 shit and concentrate to the future... and future is defini-
tively NOT C4 !
3.) U don`t get a Busy Flash.... ahahhahahahaha!!
If you are unable to recieve a Busy Flash, then you`ve got a problem: the
TELEKOM filters. These phunny devices are sitting in the toll-free oversea
trunk groups just for one purpose: Killing the Clear Forward and the Seize
signal to avoid line manipulation. In my area, there were 2 different kinds
of filters:
The first ones were just inverters, which lowered or highered the specific
signals sent in the line. This means, that a 2400/2600 tone will be recogni-
zed from the switch as, e.g., a 2350/2650 signal... This means that you can
easily pass those filters when sending e.g. a 2450/2550 tone. This is, of
course, not a very effective protection !
At the next step, a more complicated system was installed: a Schmitt-Trigger
system, combined with a selective switch. I will explain later how it works
exactly.
At this time, just remember: It`s IMPOSSIBLE 2 install any protection that
will avoid inband line manipulation 100% . There`s always a way to pass it !
4.) How the telecom filters work:
The function of those devices is quite simple: the filters are put in the
line subscriber ----> german switch. This (should) avoid a line manipulation
from the side of the subscriber`s line.
The filter consists of a simple notch filter that blocks the 2400 signal if
the installed frequency counter counts the critical frequs.
The bandwidth is all over the tolerance of the frequency used for inter-
national trunks. This is achived by a strong damping of the circuit. Just
find an international exchange and let it give you a nice echo. Then, start
scanning and draw a function of the filtered tones. U should draw that func-
tion in dependence of the frequency and the volume.
The tricky thing is the following: the filters are "normally" not enabled.
They are only activated when recieving a signal that is in tolerance of their
setting. The control of "enabled"-"not enabled" is taken by a simple Schmitt-
Trigger circuit. Just watch sume electronic-book for further information.
To activate the Trigger, a tone of a certain frequency _and_ a certain length
must be recieved (Trigger-Level).
So: when u add a third tone to your Cl.Fwd., there is obtained an inter-
modulation: the volume increases and decreases in the same frequency as the
guard tone. So, u just need to find the correct guard tone(s), and u will be
able to pass the filter.
Sometimes, its a little bit more tricky: If this method doesnt work, just use
some fuzzy tones (mix the tones with colored noise). This changes the wave-
form from sinus to something un-definable. That sort of signal is much harder
to trigger (if you`ve got an oscillograph, u can see it quite good). So, the
chances of "confusing" the trigger are much better....
Finally, there`s a third method: Just create a trunk that you play _before_
the "real" trunk....the more tones, the better ! I use the nice TLO444 and
wrote a tiny script that will do this job quite good...it has `bout 20 tones,
played with 3 or 4 frequencys each. If you set the right frequs (TIP: use the
frequs near the signalling area, add a DHLS sumetimes, play a 2000 Hz and so
on). If you have done it right, that filter will be "confused" (you can com-
pare it with drinking 10 beers and going to bed immediately) and it can get
passed much easier.
5.) About Hardware
It`s always useful to have some hardware that can support you while whistling
around....the good old walkman-headphones are fine for checking out a line
you can break not yet, but it`s not possible to get a 100% great result. Just
call your favourite HPA board and leech the schematic of a standard BlueBox.
I use a more comfortable method. This has two reasons:
1.) When using a transformator that is connected to the phone line directly,
your ears will be bloody after a hole night of scanning
2.) Connecting the soundcard in another way will offer you much more comfort.
If you`ve got some idea about electronics, connect the output of your computer
to the microphone in the telefone. The ECM-Micros work best. Normally, it`s
necessary to limit the signal with a resistor of about 50K. And if you want to
record the line, connect the mic. input to the speaker of your phone. Depen-
ding on your circuit, it may be useful to add a small capacitator (.1uF). This
offers a much better quality and the tones sent out of the speaker while brea-
king are much more calm. This allows you to listen better to any reaction of
the line. And if you`ve already done that piece of work, then you can make a
device that allows you to hang up the line and release it again automatically.
I built a switch that is controlled by the tones sent out of my dialer. I just
reserved a frequency (ca. 3900 Hz) and adjusted that phunny device to exactly
that value. So, if I send a 3900 Hz tone, my line hangs up automatically and
releases again after a free-definable time. If you are interested in that
device, just contact me !
Also phunny is a circuit that can decode the special-info sequence (you know,
that tuuu-tuuuu-tuuuuu you recieve when calling a not-existing number). I
don`t know whether this is also possible by a powerful realtime-software; but
when connecting that circuit to the parallel port, you may increase the rate
of success while scanning to the maximum. When using that device, you needn`t
sitting in front of your screen anymore... you just wait for a "success-beep"
from the computer when getting a number that does not result in the special-
info-tone. The only condition for this is a well-programmed software.
Another phunny toy is an oscilloscope, because:
- You look so cool when sitting in front of it, dialing, phreaking, pushing
all the buttons at the scope (and only you know what they are good for) and
watching the great waves appearing on the screen when getting a connect ...
- Hmmm..and, besides, an oscilloscope is EXTREMLY useful to find out every-
thing that has to do with waveform, amplitude and delay of the signal sent
in the line, and, more important, coming out of it. E.g., you can search a
number, kill the exchange, sending a signal which will give you an echo and
start analysing the behavior of the switch.
The last point about hardware: A device that can send a variable (coloured)
noise into the line. A very simple noise generator is an old radio. Just put
it on AM and search an area with a good, strong noise. By turning the knob in
any direction, the sound of the noise should change a little bit. To find the
best position, set your dialer to a 60s Cl.Fwd. and mix it with the noise ob-
tained by the reciever. Believe it or not, it works !
BTW : Yes, I know, the Scavenger dialer has this feature, too. But the noise
routine seems to be a little buggy...besides, it`s much easier to use
a little hardware, because you can find out the correct setting very
fast just by turning a knob is any direction. The only thing you`ve got
to do is to connect the speaker of the radio (or, in other words, the
two wires leading to the speaker) with the phone line using direct
connection or transformator. A 50K resistor prevents the noise from get-
ting too loud. Just play a little bit for optimal results.
6.) Problems with Transit/Routings
some years ago, finding out a routing or using transit was no problem (I say
this not out of my own experience; I`m not doing BB as long that I can con-
firm this....but I was told so).
Now, things have changed a little bit. The old standard of using <KP2>-CC-DD
is working only to some boring countries with boring lines. The "good" coun-
tries (like HK/USA etc.) are extremely well protected now. But in spite of
that, you can still get a success if you have a free afternoon and some luck.
For exemple, the toll free lines of some countries can sometimes be called
from an international exchange. To give you an exemple:
a) you call the HCD of a country that has <KP2> disabled
b) you break it
c) after breaking, you call the Op. of another country (e.g.: A02-800-XXX)
d) you wait for the "chick" and break the line country --> next country
e) perhaps this country you are in now has <KP2> open ....
The disadvantage of this is that you MUST set your trunk very exactly. If your
break for the 2nd country is in tolerance of the switch of the 1st country,
your line kicks off...hahaha....try it again.
Perhaps, you find a country that is breakable with 2400 and 2600 Hz, sent
seperately. On HawaII, you will remark that you can send the tones seperately.
If you`ve found a Transit or a Route, you can try to find a gate in the
following way [just for exemple !!!]:
a) You can do transit via XXXXXX to russia
b) You want to call YYYYYY
c) Just dial <KP2>7-00-YYY-nuMbA<ST>
The success of this method depends on the "transit power" of the country you
can do transit to. Perhaps you can try it out by calling directly.
Another way of calling is to change the exchange you are in by sending a
loooong signalling tone....the more experienced phreaks will know what I mean
when talking about this..... This method only works on quite old switches.
7.) How 2 get Routing Codes
At the beginnig of this article, I wanted to tell you how to find out which
country offers which routes to kall out. With this method it`s not often
possible to get the routes directly, but you will know whether it`s senseful
to start scanning around.
But now I decided not to tell you that possibility, because it wont work any-
more if too many people use it. BTW, forget the old trick with <KP2>-2F-<ST>
The operators are still incredibly stupid, but they won`t give out their
Operator routes to someone who says: "....Hi, lines are busy,...please gimme
your routing for calling Canada...".
Okay, thats it....I think that you knowed most of the things I told, but per-
haps you found a little hint that may be useful for you. Have a nice life !
Greetz,
Dr. Fraud
P.S.: This article didn`t grow out of my free volunteer....
I was forced to write it....hahaa... ...and remember: J.F.K. is dead !
<yeah and i'll do it again for the next mag hehehehe! [vH]>
.

383
textfiles.com/phreak/beatcid.txt Normal file
View File

@@ -0,0 +1,383 @@
Beating Caller ID
by The Fixer
v.1.03 98/08/30
(C) 1998 The Fixer's Tech Room
For free distribution - you may freely repost & distribute this but not
for profit without permission of the author. See further restrictions
at the end of this file.
To start off with - 12 Ways to beat Caller ID
(0) This doesn't count as a way to beat CID, but there's a general
principle to consider when contemplating ways to beat CID.
Generally, the CID signal your target sees corresponds to the owner
of the dial tone you call him from. If you call direct, you dial
from your own dial tone and your line is identified. If you call a
third party, and by whatever means manage to acquire his dial tone,
and from there dial out, it is the number associated with that
second dial tone that your target sees. Some of the ideas following
this were developed with this basic idea in mind.
(0.5) This also doesn't count, but remember that beating Caller ID as
such is only the first layer of your protection. If your calling is
sufficiently annoying or criminal, there is *always* a paper trail
(ANI data, billing data, trouble reports, *57 traces, etc) leading
back to the phone you first called from. That trail is not always
easy or worthwhile to track you down with. Whether or not the trail
is followed depends entirely upon how pissed off your target is and
how much co-operation he can get from the phone company, law
enforcement, etc.
(1) Use *67. It will cause the called party's Caller ID unit to
display "Private" or "Blocked" or "Unavailable" depending on the
manufacturer. It is probably already available on your line, and if
it isn't, your local phone company will (most likely - please ask
them) set it up for free. This is the simplest method, it's 100
percent legal, and it works.
(2) Use a pay phone. Not very convenient, costs 25 or 35 cents
depending, but it cannot be traced back to your house in any way,
not even by *57. Not even if the person who you call has Mulder and
Scully hanging over your shoulder trying to get an FBI trace (sic).
Janet Reno himself couldn't subpoena your identity. It's not your
phone, not your problem, AND it will get past "block the blocker"
services. So it's not a totally useless suggestion, even if you
have already thought of it.
(3) Go through an operator. This is a more expensive way of doing it
($1.25-$2.00 per call), you can still be traced, and the person
you're calling WILL be suspicious when the operator first asks for
them, if you have already tried other Caller ID suppression methods
on them.
(4) Use a prepaid calling card. This costs whatever the per-minute
charge on the card is, as they don't recognize local calls. A lot
of private investigators use these. A *57 trace will fail but you
could still be tracked down with an intensive investigation (read:
subpoena the card company). The Caller ID will show the outdial
number of the Card issuer.
(5) Go through a PBX or WATS extender. Getting a dial tone on a PBX is
fairly easy to social engineer, but beyond the scope of this file.
This is a well-known and well-loved way of charging phone calls to
someone else but it can also be used to hide your identity from a
Caller ID box, since the PBX's number is what appears. You can even
appear to be in a different city if the PBX you are using is! This
isn't very legal at all. But, if you have the talent, use it!
(6) I don't have proof of this, but I *think* that a teleconference
(Alliance teleconferencing, etc.) that lets you call out to the
participants will not send your number in Caller ID. In other
words, I am pretty sure the dial tone is not your own.
(7) Speaking of dial tones which aren't yours, if you are lucky enough
to live in an area with the GTD5 diverter bug, you can use that to
get someone else's dial tone and from thence their identity.
(8) Still on the subject of dial tones which aren't your own, you can
get the same protection as with a payphone, but at greater risk,
if you use someone else's line - either by just asking to use the
phone (if they'll co-operate after they hear what you're calling
about) or by the use of a Beige Box, a hardware diverter or bridge
such as a Gold Box, or some other technical marvel.
(9) This won't work with an intelligent human on the other end, it
leaves you exposed if the called party has a regular Caller ID box
with memory, and has many other technical problems which make it
tricky at best and unworkable for all but experts. A second Caller
ID data stream, transmitted from your line after the audio circuit
is complete, will overwrite the true data stream sent by the telco
during the ringing. If the line you are calling is a BBS, a VMB, or
some other automated system using a serial port Caller ID and
software, then you can place your call using *67 first, and then
immediately after the other end picks up, send the fake stream. The
second stream is what the Caller ID software processes, and you are
allowed in. See the technical FAQs below for an idea of the
problems behind this method; many can be solved.
(10) Someone in alt.2600 (using a stolen AOL account, so I can't credit
him or her properly) suggested going through 10321 (now 10-10-321)
or 10288. Apparently using a 10xxx even for a local call causes
"Out of Area" to show up on the Caller ID display. I live in Canada
where we don't have 10xxx dialing so I can't verify nor disprove
this.
(11) There are 1-900 lines you can call that are designed to circumvent
Caller ID, ANI, traces, everything. These services are *very*
expensive, some as high as $5.00 a minute, but they include long
distance charges. This was first published in 1990 in 2600
magazine, and in 1993 the IIRG reported that 1-900-STOPPER still
works. Beware - even if you get a busy signal or no answer, you
will get charged at 1-900 rates! Another one published in 2600 in
1990: 1-900-RUN-WELL. That one supposedly allows international
calls. I'm not about to call either one to find out. Note that you
could still be caught if the operators of these services were to be
subpoenaed.
(12) Use an analog cellular phone. Most providers of plain old analog
service show up on Caller ID as "Private" or "Out of Area" or a main
switchboard number for the cell network. This is becoming less and
less true as cellular providers move to digital cellular and PCS,
which pass the phone's number on Caller ID. Corollary: Rent a
cellphone by the day. This might even be cheaper than using a
prepaid phone card.
How Caller ID Works
Caller ID is a data stream sent by the phone company to your line
between the first and second ring. The data stream conforms to Bell
202, which is a 1200 baud half-duplex FSK modulation. That is why
serial Caller ID boxes run at 1200 baud.
The data stream itself is pretty straightforward. Here's an example:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU<EFBFBD>'^D032415122503806467x
The first thing of note is the 30 U's. Those are actually sync pulses.
A "U" is 55 hex, or 01010101 binary. This is called the "Channel
Siezure Signal."
After that comes 130 milliseconds of 1200 Hz (the Bell 202 "mark"
frequency) which usually shows up in the datastream as a character or
two of garbage.
That is followed by the "message type word", which is 04 hex for
standard Caller ID, 07 hex for Name & Number. A word, by the way, is 8
bits for our purposes.
That is followed by the "message length word" which tells us how many
bytes follow.
The next four bytes are the date, in ASCII. In the example above, the
date is 0324, or March 24th.
The next four bytes after the date are the time, also in ASCII. In the
example, the time is 1512, or 3:12pm.
The next 10 digits are the phone number that is calling. In the
example, the phone number is 250-380-6467. The number is also in ASCII
and doesn't contain the hyphens. Some phone companies will leave out
the area code and only transmit 7 digits for a local call, others will
always send the area code as well.
If this were a name-and-number Caller ID data stream, the number would
be followed by a delimiter (01h) and another message length byte to
indicate the number of bytes in the name. This would be followed by the
name itself, in ASCII.
If this call originated from an area that doesn't support Caller ID,
then instead of the phone number, a capital "O" is transmitted (4F hex).
If the call was marked "private" as a result of the caller using *67 or
having a permanent call blocking service, then instead of the phone
number, a capital "P" (50 hex) would be sent.
The very last byte of the data stream is a checksum. This is calculated
by adding the value of all the other bytes in the data message (the
message type, length, number and name data, and any delimiters) and
taking the two's complement of the low byte of the result (in other
words, the two's complement of the modulo-256 simple checksum of the CID
data).
Some Technical FAQ's
Q: When I block Caller ID with *67, does it send my number anyway and
just set a "private bit" so that the other person's Caller ID Display
unit won't display it?
A: No. The person you're calling doesn't get your phone number anywhere
in his data stream if you block your call that way. All he/she gets
is "P" and the date/time of the call.
I would like to refer to an experiment I performed in March, 1998
with a Serial Port Caller ID, which delivers the raw data stream to a
PC for software interpretation. The following Usenet message (edited
for this file) is the report I published on that experiment:
Newsgroups: alt.2600
From: The Fixer <fixer@bc1.com>
Date: Tue, 24 Mar 98 16:12:58 -0800
Subject: Caller ID and *67 - The Facts
OK, it's time to shovel the bullshit which is piling up in this
newsgroup about Caller ID.
A few people are saying that when you block your Caller ID with
*67, the switch sends your number anyway along with a so-called
"private bit" that tells the Caller ID display unit to suppress
display of the number.
In order to squelch those who'd rather flame back with "show me
proof" than just read a FAQ, here is the proof. These are
actual raw data captures from a Bell 202 demodulator (better
known as a serial port Caller ID) which I captured myself today.
They prove conclusively that the "Private Bit" is a myth.
Here is what I got in my raw data stream when I called my voice
line from one of my BBS lines (which is unlisted, hence the
PRIVATE string in the name field):
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU<55>'^A^H03241512^A2503806467^G^OPRIVATE x
This is what I got when I did the same thing with *67:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU<55>^P^A^H03241512^D^AO^H^AP(<28>
The number I was calling from was 250-380-6467. That string is
clearly displayed in the first (non *67) call. In the number
field of the second call, only the letter "O" is transmitted.
In the name field, only the letter "P" is transmitted.
In both calls, the date and time (03/24, 15:12) is transmitted,
but transmission of the calling telephone number is suppressed
in the second call. There is no "private flag" suppressing
display of the number by the display unit; the calling number is
not transmitted at all!
For those of you unfamiliar with the CID raw data stream, the
U's are actually sync pulses (an ASCII "U" is 01010101 binary).
The control characters are field delimiters. The first 8-digit
number is the date and time in MMDDHHSS format. The second
number in the first call is the phone number, in NPANXXXXXX
format. That is followed by the name (for those of us with name
& number CID). The ^O (0Fh) just before the name indicates how
many characters are in the name - in this case "PRIVATE" is
padded out with 8 spaces (20h) to make 15 characters. At the
very end is an 8-bit checksum.
Believe me, if I were wrong about this, there would be a huge
marketing frenzy to sell "*67 proof Caller ID boxes" and I would be
making a fortune selling my Serial Caller ID software, which works
directly with the data streams illustrated above!
Q: Can't I just send noise down the line to scramble the Caller ID
signal between the rings?
A: No. Your phone line doesn't generate the Caller ID signal. It is
made by the switch on your calling party's line, and the audio
circuit between your line and his is not completed until after he
picks up the phone.
Q: Do 1-800 numbers have Caller ID? Can I hide my identity from them?
A: Some do have Caller ID, and the *67 block will work, but many more
have realtime ANI - Automatic Number Identification. This is an
older technology which uses a separate line to deliver your number,
and cannot be blocked. And all 800 subscribers get a list of
everyone who called them on their monthly bill, blocked or not.
Q: Can I hide my identity by sending a fake Caller ID signal down the
line before they answer?
A: *Generally*, no. The audio circuit between your phone line and their
line is not completed until the other party picks up. Once they do,
they would hear your fake signal and know what you were doing...
unless the person you're calling is very poorly informed or
untrained. Even so, most Caller ID devices have memory and so the
person you're calling could just as easily scroll back through the
box's memory and find your true number.
Once upon a time, the phone system worked differently, and the audio
circuit WAS connected even before the called party picked up. A
device called a "mute" or a "black box" was used to take advantage of
this fact and allow anyone calling a line with a black box to do so
toll-free. If the system still worked that way (and there's no
technical reason why it couldn't in these days of digital switching)
then yes, it would be very feasible to send a fake Bell 202 data
stream down the line; in fact you'd hear the real one every time you
called someone with Caller ID and you'd get a really good feel for
the timing involved. But if it worked that way, then black boxes
would also still work, and they don't.
Q: How about *69? If I protect my call using *67, can they still call
me back?
A: Not in 604/250 anyway, and probably not most places.
Some interesting notes about this: When *69 was first introduced
here in 250, if you tried to *69 a blocked call, you would get a
recording telling you that the number could not be announced. And it
would then offer to connect you anyway! I guess it was business who
asked for the change because that meant a telemarketer using *67
would have people call back and their switchboard answer "Sleazebag
Marketing, how can I help you?". At that point the number was a
white pages lookup away. So BC Tel, and I would venture to guess its
parent company GTE and many others, changed it so that *69 won't even
call back.
If you find in your area that you CAN call back with *69 to a *67
protected number, you're a lucky sonofabitch! Why is that? Well,
with the "old" working of *69, you may still be able to get the
number of a blocked caller if you are (a) lucky and (b) patient. Take
your phone off the hook until midnight (if it's a business) or early
afternoon (if it's a person). THEN activate *69. No incoming calls
will have come into your line since it was off-hook, so your line's
*69 last-call register will still have their phone number in it, and
at those times you are far more likely to get an answering machine
which may spill the beans as to who called you... clever huh?
Final Word
Caller ID can be worked around in so many ways that it really offers no
value to its subscribers. I am not against the existence of Caller ID,
as I have been on the receiving end of harassing phone calls and slimy
telemarketers, all of whom I've been able to put in their place thanks
to this technology. There's no doubt that Caller ID can help bring
those who deserve it to justice. But at the same time, we all have the
right to privacy, and the option to not share your identity with someone
you're calling is, and always should be, available.
For this reason, I think that Caller ID should be available free on
every line as part of the basic service. It's worth nothing anyway!
---------------------------------------------------------------------------
That's it. This file may be updated as I receive more information.
Look for updates on my web site at
http://ranchonevada.home.ml.org
or
http://ranchonevada.ml.org
or if that doesn't work,
http://A3A18294.sympatico.bconnected.net
---------------------------------------------------------------------------
This file is a freely-distributable copyrighted work. You may repost
this file free of charge without modifications, but no for-profit
distribution is allowed without prior arrangement with the author.
Two individuals who have stolen my work in the past are hereby
prohibited and enjoined from possessing or distributing this file:
Pinhead the Cenobite and Jolly Roger. If you are either of these
individuals, you must delete this file from your system now. If you are
not, you may not knowingly allow either of these individuals to receive
this file if it is in your power to prevent such reception. Retention
of this file on your system or on any backup constitutes acceptance of
this term.
(C) Copyright 1998 The Fixer's Tech Room, a division of Whirlwind
Software (British Columbia). All rights reserved.

148
textfiles.com/phreak/beattrac Normal file
View File

@@ -0,0 +1,148 @@
*******************************************************************************
* *
* How to beat tracing mechanisms *
* *
*******************************************************************************
Written by: Billy Heif 80 columns
Date : 12/02/88------------------------------------------------Date : 12/02/88
Introduction
Since the beginning of the telephone revolution, there have been
ways to trace a line. When there used to be operators with plugs and
huge switchboards, they could manually trace the line. Then came the
crossbar switching, in which they could trac e the line three ways:
Lock-In tracing, manual tracing (Never done, anymore), or time
syncronization. The ESS (Electronic Switching System) brought an
"Impossible" to beat tracing mechanism, ANI.
Chapter One : Lock-In tracing
Lock-In tracing is exactly what the name says. It is a type of
tracing most often used by the FBI. The method of which Lock-In works is
quite simple. When a conversation is going on, there is voltage going
through the line to keep it open for thos e people talking. When lock-in
is used, after the caller-to-be-traced hangs up, a special FBI machine
sends voltage down the line to make the Phone Co's machines think that
the line is still being used. Then that gives the FBI time to trace
manually.
The DIFT Box
There is only one way that I have heard of beating Lock-In. If
you keep picking up the phone and hanging up, and the line doesn't go to
a dialtone, there is a chance that you are being traced. The way to stop
this is to send a current down the lin e, too. First you have to find a
corner in your house where the phone wire is running along. Then you can
install 'Billy Heif's Peachy Tracer Breaker', or simply, "The DIFT box".
Here's the simple schmatics for it:
-----> RED -----> |-----/-----| >---------- RED TO LINE -------->
From phone----->Green-----> |-----\-----| >----------Green to line ------->
----->Black-----> |-----/-----| >----------Black to line ------->
| \ |
| / \ |
| + - |
Tracer Breaker
Where you see the plus and minus, you hook up a big 6 or 12 volt
battery. Make sure you put a switch in there somewhere, so you can
switch it on fast. Hook the + and - to all the lines going out. I think
that will work, I am pretty sure. Try testi ng it out first. While you
are talking to one of your buds, click it on.
Chapter Two : Manual Tracing
Manual tracing is just following a line back to its source. I am
not talking literally, just following it from circuits. This takes a
HELL of a long time, like 10-20 mins or more. The only way to prevent
this is to make your calls short and sweet, so they don't have time. Of
course, if you get Locked-In, you should click on your DIFT box for
about 30 seconds.
Chapter Three : Time Syncro Tracing
Time Syncro Tracing is very simple. Let's say Bob Retard is
getting 100 prank calls a night (From those guys who wrote "Anarchy
Phone Pranks I,II,III,IV"). Now Bob calls up the phone company, who
sends out a techie with a clock syncronized to the phone co.'s clock.
When Bob gets his prank call that night, he just hits the button that
stops the clock. Then he calls the company and tells them the time that
he got the call. They run it through their computers and come up with a
call made at that exac t time, and where it came from. This tracing is
instoppable, so just don't crank someone all the time. But if you do it
on some night like Friday, when there are a million calls going on at
once, then it is pretty safe.
Chapter Four : Automatic Number Identification (ANI)
Automatic Number Identification (ANI) is a tracing mechanism
available ONLY in ESS areas. ANI works because the YOUR phone co.'s
computer sends a few digital-encoded numbers to the DESTINATION'S phone
co's computer. Then the other computer, and yo ur co.'s computer knows
INSTANTLY where it is coming from.
Ways to tell if you have ESS: (Stolen from some G-File)
1) 911 service
2) dialtone first at payphones
3) call waiting and that shit
Well, ANI is not absolutely foolproof. I guess you could make a
cheesebox to get around it or something. It would not be hard to
do that.
There was an incident back in March, 1988, concerning ANI. Some
idiot introduced the idea of the "Sprint Back Door", which gave you
access to call anywhere in the world for "Free". Little did they know
that Sprint's ANI machine was working hard, a nd everyone was sent a
bill at the end of the month. So, watch it with this thing. I think
there used to be a number you could call, and the thing would call you
back, using ANI. Pretty sure it's gone now.
Conclusion
Well, that does it for most tracing techniques. I hope you guys
kinda understood my DIFT box. If you don't, contact me through E-Mail
at any of the boards at the end of this file. I have my computer answer
sometimes, with an Answering Machine type program, where you can leave
mail and crap. Ask me for the #.
-> Disclaimer <-
Like every piece of great literature, comes this. I don't take
responsiblity for any of YOUR fuck ups. If you get busted with your DIFT
box, it IS a federal offense. This file was meant as INFORMATIONAL
purposes only, and the author does not accep t any responsiblity for
anyone's use of this file. Thanks.
******************************************************************************
Call these boards to contact me:
Ripco International - (312)-528-5020
Challenger - (312)-827-3097
Blue Knight - (312)-249-4385
Leave E-Mail telling me what's up. Tell me what's new, and ask questions.
*****************************************************************************
EOF

170
textfiles.com/phreak/beige1.txt Normal file
View File

@@ -0,0 +1,170 @@
Beige box plans
------------
INTRODUCTION
------------
Have you ever wanted a lineman's handset? Surely every phreak
has at least once considered the phun that he could have with one.
After searching unlocked phone company trucks for one for months, we
had an idea. We could build one. We did, and named it the "Beige Box,"
simply because that is the color of ours. In the following file we
will give complete instructions for the construction and use of a
Beige Box.
------------
CONSTRUCTION
------------
The construction is very simple. First, you must understand
the concept of the device. In a modular jack, there are four wires.
These are red, green, yellow, and black. For a single line telephone,
however, only two matter: the red (ring) and green (tip). The yellow
and black are not necessary for this project. A lineman's handset
only has two clips on it: the ring and the tip.
You will need a phone (we reccommend a touch-tone) with a
modular plug, a modular jack, and two large alligator clips
(preferably red and green, respectively). Take the modular jack and
look at the bottom of its casing. There should be a grey jack with
four wires (red, green, yellow, and black) leading out of it. To the
end of the red wire attach a red alligator clip. To the end of the
green wire attach a green alligator clip. The yellow and black wires
can be removed, although I would only set them aside so that you can
use the modular jack in future projects. Now insert your telephone's
modular plug into the modular jack. That's it.
This particular model is nice because it can be easily made,
is inexpensive, uses common parts that are readily available, is
small, is lightweight, and does not require the destruction of a
phone.
----- --- ----
BEIGE BOX USES
----- --- ----
There are many uses for the Beige Box. However, before you
can use it, you must know how to attach it to its output device. This
device can be any of several Bell switching apparatus that include
terminal sets (i.e., remote switching centers, bridging heads, cans,
etc.). To open most Bell Telephone switching apparatus, you must
have a 7/16 inch hex driver. This piece of equipment can be picked
up at your local hardware store. With your 7/16 hex driver, turn the
security bolt(s) approximately 1/8 of an inch counter-clockwise and
open. If your output device is locked, then you must have some
knowledge of destroying and/or picking locks. However, we have never
encountered a locked output device. Once you have opened your output
device, you should see a mass of wires connected to terminals. On
most of your output devices, the terminals should be labeled "T" (Tip
-- if not labeled, it is usually on the left) and "R" (Ring -- if not
labeled, it is usually on the right). Remember: Ring - red - right.
The "Three R's" -- a simple way to remember which is which.
Now you must attach the red alligator clip (ring) to the
"R" (ring) terminal. Attach the green alliagtor clip (tip) to the
"T" (tip) terminal. NOTE: If instead of a dial tone you hear nothing,
re-adjust the alligator clips so that they are not touching each other
or other terminals. Also make sure that they are firmly attached.
By this time you should hear a dial tone. Dial ANI and find out the
number that you are using (you wouldn't want to use your own).
Here are some practical applications:
o Eavesdropping
o Long distance, static-free phone calls to phriends
o Dialing direct to Alliance Conferencing (also static-
free)
o Phucking people over
o Bothering the operator at little risk to yourself
o Blue Boxing with a greatly reduced chance of getting
caught
o Anything at all that you want, since you are an
extension on that line
Eavesdropping:
-------------
To be most effective, first attach the Beige Box and then your
phone. This eliminates static caused by connecting the box, therefore
reducing the potential suspicion of your victim. When eavesdropping,
it is always best to be neither seen nor heard. If you hear someone
dialing out, do not panic; but rather hang up, wait, and pick up the
receiver again. The person will either have hung up or tried to
complete their call again. If the latter is true, then listen in, and
perhaps you will find information worthy of blackmail! If you would
like to know who you are listening to, after dialing ANI, pull a CN/A
on the number.
Dialing Long Distance:
------- ---- --------
This section is self-explanatory, but don't forget to dial a
"1" before the NPA.
Dialing Direct to Alliance Conferencing:
------- ------ -- -------- ------------
Simply dial 0-700-456-1000 and you will get instructions from
there. I prefer this method over PBXs, since PBXs often have poor
reception and are more difficult to come by.
Phucking People Over:
-------- ------ ----
This is a very large topic for discussion. Just by using the
other functions described, you can create a large phone bill for the
person (they will not have to pay it, but it is a hassle for them).
In addition, since you are an extension of the person's line, leave
your phone off hook, and they will not be able to make or recieve
calls. This can be extremely nasty because no one would suspect the
cause of the problem.
Bothering the Operator:
--------- --- --------
This is also self-explanatory and can provide hours of
entertainment. Simply ask or say things to her that are offensive and
you would not like traced to your line. This also corresponds with the
previous described section, Phucking People Over. After all, guess
who's line it gets traced to? He he he...
Blue Boxing:
---- ------
See a file on Blue Boxing for more details. This is an
especially nice feature if you live in an ESS-equipped prefix, since
the calls are, once again, not traced to your line.
--------- ----- -- ----- ------
POTENTIAL RISKS OF BEIGE BOXING
--------- ----- -- ----- ------
Overuse of the Beige Box may cause suspicions within the Gestapo,
and result in legal problems. Therefore, I would recommend that you:
o Use more than one output device
o Choose a secluded spot to do your Beige Boxing
o Keep a low profile (i.e., do not post under your real name
on a public BBS concerning your accomplishments)
o In order to make sure that the enemy has not been inside your
ouput device, I reccomend that you place a piece of
transparent tape over the opening of your output device.
Therefore, if it is opened in your absence, the tape will be
displaced and you will be aware of the fact that someone has
been intruding upon your territory.
DOWNLOADED FROM P-80 SYSTEMS 304-744-2253

269
textfiles.com/phreak/belhell1.txt Normal file
View File

@@ -0,0 +1,269 @@
////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**////////////////////////////////////////
///// ** M \\\\\\
\\\\\ ** Bell Hell Volume #1 E //////
///// ** T \\\\\\
\\\\\ ************ By: The Dutchman A C //////
///// Neon**Knights -Wired L O \\\\\\
\\\\\ ** M //////
///// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\ ** U //////
///// ** Call These Genocidal Systems... N \\\\\\
\\\\\ ** 0 I //////
///// ** /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]538-0761 C \\\\\\
\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]253-5300 A //////
///// METAL! The /\/\etal AE PW: KILL./..........[201]879-6668 T \\\\\\
\\\\\ KICKS! The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]696-7983 I //////
///// Milliways 10mgs BBS...........[609]921-1994 O \\\\\\
\\\\\ 7 Gates of Hell BBS.................[415]697-1320 N //////
///// The Mordor AE 1200bps/Cat-Fur/10mg[201]528-6467 S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////////
/////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
PREFACE: In this issue will discuss the different types of operators, area
codes and special numbers. This edition is made to give you a basic
understanding of the wicked ways of MA. I hope it'll give you a good enough
back ground to do well. Look for Bell Hell vol. 2 for more info on hacking.
=-=-=-=-=
OPERATORS:
=-=-=-=-=
Here we'll go over in detail some of the most common operators.
TSPS OPERATOR:
Trafic (us) Service Position System Operator is the bitch you commonly here
whenever you use a pay phone etc. To say the least she's a meat head. Her
responsibilities are as follows:
[1] Getting all billing information for Calling Cards and 3rd number calls.
[2] Making sure you get the right person on person-to-person calls.
[3] Making sure the fool on the other end will pay for your collect call (why
call collect?)
[4] Identifying calling numbers, or basically asking you,
'what number are you calling, please.' when the system fucks up.
Even though these operators are commonly ding-bats, you shouldn't screw with
them, for they are known to be quick with the tracer. She can even tell if you
are calling from a fortress phone. She has a portable all time ready tracer.
Beware of these deadly bitches.
INWARD OPERATORS:
This wench is basically an apprentice to the bitch above (TSPS) or commonly
the '0' operator. She will never question you as long as you are within her
dimension (service) area. She can only be reached by a mighty Blue Box
(discussed in up and coming tutorial) or another operator.
DIRECTORY ASSISTANCE OPERATORS:
(DOA?DAO?)
This is the operator you get when you call directory assistance (555-1212).
All she can do is either tell you a listed number or tell you if a number is
unlisted. Waste of time.
DEAF D.A.O.'S
This neat little operator is set up to help with directory assistance for deaf
people (who would they want to talk to?). She's reachable by dialing
800-855-1155. She talks to the deaf via Teletypewriters (terminals). If your
modem can transfer baudot (Oh those sweet Apple Cats can) then you can talk to
her. You might find her alot more friendly, more talkitive, and alot easier to
manipulate a number out of. However, she does use abbreviations like GA for go
ahead (pretty tricky huh).
CN/A OPERATORS
Oh the sweet CN/A, god bless its soul. These operators instead of giving you
information on a persons phone number, they give you information on a phone
numbers person (the person at 503-229-7600). However, if manipulated these
beauties can give you the number for an unlisted phone number (the number),
they have all kinds of access. This topic is discussed later in this tutorial.
INTERCEPT OPERATOR:
All places have their share of low lifes, well this is the scum, bottom of the
barrel of operators. She's the one you get when all the recordings are busy
(lower than a recording). Infact these dames can cause you more pains then a
recording. They only know a handful of english (around two sentences) and can
barely even say those. Even though they have no clue to what a trace is,
unless you know their native tongue, and then doubtfully, their just a pain in
the butt to deal with.
OTHER OPERATORS:
Well we have - marine verify, mobile, route and rate, ship to shore,
conference and a few other specific ones. No real help to us now.
*NOTES: Most operators have their own little Directory Assistance. If any
operator is giving you probs ask to speak with his/her/its supervisor. This
will freak them out. In rare loveable cases you might find a nice operator
with a number like (503-123-4567). Whenever you find a 0 or 1 in the 4th
number slot then you know need a Blue Box. It'll give you special access to
those hard to get wenches.
=-=-=-=-=-=-=-=
AREA CODES ETC.
=-=-=-=-=-=-=-=
HOW PHONE NUMBERS WORK:
Basiclly MA made our phone numbers quite simple. Here's how they work:
[A] The area code is what the call a three digit number plan area or NPA. This
means that an area code is just that, the code for an area.
[B] The rest of our number (ie. 666-7209) is divided into two segments. The
first being the Central Office number (666 would be N. Portland) and the
ending (7209) is the station number, or basically your assigned home number.
This complete combination (503-666-7209) is known as the destination code.
Here's how MA has developed the combo's:
[NPA] [TELEPHONE NUMBER]
X*Y XYY-YYYY
X = a number from 2-9
y = a number from 0-9
* = either 0 or 1
Normally an area code may never cross a states boundry, thus an area code
(NPA) may not be used for both New York and for Pennsylvania. However, as for
all other rules there is an exception. Here they are.
SPECIAL AREA CODES:
(SACS)
510 - TWX (USA)
610 - TWX (CANADA)
700 - NEW SERVICE
710 - TWX (USA)
800 - WATTS LINES
810 - TWX (USA)
900 - DIAL-IT SERVICES
910 - TWX (USA)
The explanations of these are as follows:
TWX:
Telex II, as you can see above there are 5 TWX machines. They are all owned by
Western Union. Normally these babes may only be accessed by other TWX
machines, however, if you do not wish to go and purchase one you can access
them by use of the Easylink, by Western Union. For more on this I would
suggest reading The Bioc Agents, and Tucs article on 'Hacking Western Union's
Easylink.'
700:
This is a new service for employees of AT&T in which someone (one of the
special employees) can call his own 700 number (say 700-292-9876), enters
his/her code, and where he is staying and then hangs up. If there is any new
info on the case he is working on, the computer will call him back and tell
him all the latest updates.
800:
There are basically two types of Watts Lines, Inward Watts and Outward watts.
These are probably some of the nicest of the special area codes since they
allow you to call for free. Here's an explanation of the two:
INWARD WATTS:
Inward Wide Area Telecommunications Service is probably the one your most
familiar with. MA has developed it so there are 6 different levels of Inwatts.
Level 6 being the whole U.S. (all 50 states) level 5 being all 48 contienental
states etc. all the way down to 1, only one state. Usually a company will get
a level 6 and then a level 1 because all though level 6 allows you to call
from anywhere in the U.S. it excludes the state where the call is terminated
at, so the company usually buys a level 1 for that state.
Interstate Inwatts are less common but still exist. These are the ones you can
only call from say one state. You can tell one quite easily for they all have
a 2 for the last central office number, or the 6th number (ie. 800-XY2-XXXX).
All companies that have an 800# must have at least two lines. This is because
if you call the first number (ie. 800-666-0190) and it rings busy the 800#
number will always go to another port to see if its busy. Inwatts customers
are billed by the hour instead of month like us.
OUTWARD WATTS:
Outwatts are just that, there for making outward calls only. Large companies
commonly use Outwatts since they recieve bulk discounts. Outwatt 800's are in
the form of:
800-*XX-XXXX
* may only be a 0 or 1 and can only be reached by way of box. The whole set,
*XX is the areas that are accessable by that comany.
900:
This is a nation number used for taking polls and the like (How do you think
they know what shows on the tube are k00l). The number for this service is,
900-555-1212. This will tell whats up on the system. Beware, this MA trick
will cost you 50 cents a minute, and 35 cents there after (ever heard of MA
being cheap?).
=-=-=-=-=
CO CODES
=-=-=-=-=
These are the way the switching office knows where to route the call. The
following codes are reserved nationwide:
555 - directory assistance
950 - future use
958 - plant test
959 - plant test
976 - dial-it services (weather etc.)
950:
This includes all special service. Heres a list of a few:
1000 - SPC
1022 - MCI Execunet
1033 - US Telephone
1044 - Allnet
1088 - SBS Skyline
*NOTE: These beauts are free from fortresses.
958,959:
These consist of ANI, Ringback and some other MA tests.
976:
Check this one out. Simply dial 976-1000. Alot of BBSs around will probably
have a more complete listing of these services.
=-=-=-=-=
N11 CODES:
=-=-=-=-=
I'm not sure which one of these are still in service. Basically MA wants to
dump these services, but alot are still in use, it'll vary with your area.
011 - international dialing prefix
211 - coin refund operator
411 - directory assistance
611 - repair service
811 - business office
911 - EMERGENCY
Downloaded From P-80 Systems 304-744-2253

376
textfiles.com/phreak/belhell2.txt Normal file
View File

@@ -0,0 +1,376 @@
///////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////
///// ** M \\\\\\
\\\\\ ** Bell Hell Volume #2 METAL! E //////
///// ** KICKS! T \\\\\\
\\\\\ ************ By: The Dutchman A C //////
///// Neon**Knights -Wired L O \\\\\\
\\\\\ ** M //////
///// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\ ** U //////
///// ** Call These Genocidal Systems... N \\\\\\
\\\\\ ** I //////
///// /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]538-0761 C \\\\\\
\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]253-5300 A //////
///// The /\/\etal AE PW: KILL............[201]879-6668 T \\\\\\
\\\\\ The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]696-7983 I //////
///// Milliways 10mgs BBS...........[609]921-1994 O \\\\\\
\\\\\ 7 Gates of Hell BBS.................[415]697-1320 N //////
///// The Mordor AE 1200bps/Cat-Fur/10mg[201]528-6467 S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////
///////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
/CONTENTS/
In vol. I we discussed some of the minor aspects of bell hell. Now we shall
enter the realm of serious bell hell, including how to crush AT&T's firm grip
on the wired industry and Ma's underground passages.
/MA'S CODES ETC./
In order to make things easier for her employees, Ma has given us not only
free access to almost all her treasures but guides next to them to help us
along the way. One of the more common boxes found are the ones located either
at the end of your street, in an adjacent field or on telephone poles. Any of
these boxes contains all the lines for the surrounding neighbourhood. Ma
usually supplys a code for the wires inside on the side of the door to one of
these boxes, if not the code usually goes like this:
Red (ring-) = Ring line, allows others to call you
Green (tip+) = Calling out line, for you to call others
Ma has conveniently located these, the red on the right and the green on the
left. If you run into one of these boxes and it's locked then you'll need to
purchase is either a 1/2" crowbar or an 7/16" hex driver, prefferably the
latter. In order to use the 7/16, simply give a 1/8" turn counter clockwise,
presto you are in. The crowbar is self explanatory I believe.
The other, and less likely to be found of the bell underground network is just
that, the underground network. To find one of these simply look for a manhole
cover with a bell in the middle instead of an S or what-ever you sanitary
dept. might use. The aspects and entry of these will be discussed later in
this article, now to the boxes.
Now that you are in one of these boxes there is a rather interesting list of
prospects you can do, connect a linesmans handset, connect a box, or eavesdrop
to name a few, here's some of the ways to do the following.
Hell #1:
/LINESMANS HANDSET/
In order to make a linesmans handset (if not included within the newly found
box) you'll need a few things:
1 a phone (prefferably a GTE flip fone or a slimline)
2 a spliceing knife (any knife will do, the sharper the better)
3 a set of alligator clamps (if not already within the box)
Now take your knife and cut off all the wires and the modular jack (if one)
saving the red (ring-) and green (tip+) wires. Now attach the alligator clips,
one to the red and one to the green, and your set. All you need do is attach
the alligator clips to the designated colors on the box (red - red/green -
green) and you have essentially become an extension of that line.
Hell #2:
/THE BLACK/BLUE BOX/
Finally a place where you can use that box of yours with minimal worries of
being caught (the only way would be to get caught red-handed). Ah yes, bell
hell at one of its finer points. Commonly it takes Ma about a month or so to
figure out the trip on this one.
If you are unfamilar with boxes, the black box allows others to call you free
where-as the blue box allows you to use operator lines and even become one of
the bitches (become an operator). For more info I would suggest consulting
black/blue box plans.
Use the normal plans for a black/blue box and make the following
modifications:
Equipment:
(1) SPST SWITCH (found at your local Trash Shack)
(1) 10K OHM 1/2 WATT 10% RESISTOR (same as above)
SOME EXTRA WIRE (same as above above)
Now disconnect the green wire in the box and connect it to one of the two
poles on the SPST switch. Take a piece of your extra wire connect one end to
the other pole on your SPST switch and the other end to the <RR> terminal. Now
place the 10k ohm resistor between the <RR> terminal and the <FF> terminal.
Connect it (the 10k ohm resistor) via wire to the two. The <RR> terminal
should have a green wire going to it and the <FF> terminal should have a white
and blue wire connected to it. Your finished product should look something
like this:
--/-/--
:S P S T:
-------
:: ::
-----GREEN WIRE--:: ::----<RR>
!
10K OHM
!
!
-----WHITE WIRE-----------\\
------BLUE WIRE-----------------<FF>
This is simply the basic wiring, if you decide to become one with advancement
you might try hooking up lights to go on when your online or perhaps a
recorder, what-ever you wish.
Hell #3
/EAVES-DROPPING/
There are many various ways to accomplish this, seeing how I like to stick to
basics I will describe what I feel is the easiest by far. First you need to
make a linesmans handset as mentioned above if you already haven't. Now simply
disconnect the sending end (the end you talk through) and listen in. From here
you can accomplish several various tasks. If you are into blackmail you can
hook up a tape recorder (if you want to do this you can leave me a msg. or
wait for another file later, its rather a long task) or you may simply hold
the recorder to the listening end of the phone. To find out about the line
etc. You can do a couple of things, first you can dial your ANI (automatic
number identification) and find out the line you are on, after this call, you
are a local CN/A (described below) and run a check on who's line it is etc.
This can bring all kinds of hell for those not-so-trustworthy wifes/husbands.
More Hell:
/OTHER TRICKS/
You can set up a conference call simply by dialing your conference operator
(0-700-456-1000) and setting it up, just do what she says. I suggest this
operator for her lines are superior to those of the bitchy PBX ones. Oh,
you'll also need to know that lines person, address etc. Just pull an ANI and
then an CN/A on it.
If you have an urge to get back at someone simply attach your linesmans
handset to the persons line (fine their line as mentioned many times before)
and leave it off the hook. You can imagine just how long it could take Ma's
loyal employees to discover the problem. Possibly weeks if not a month.
Using the persons line to call computer systems that trace. This also goes
under the heading 'getting back at people' for the hassles you'll cause them
when the line is traced to them is numerous, bitchy Ma employees tend to be
irrational, spoiled children when it comes to busting people.
Bugging the operator - self explanatory.
RAISE HELL
/Insider/ - The rest of this doc is mainly explanations, a little hell and a
few other things I decided to throw in instead of making another Vol.. It's
true purpose is to coincide with Vol. I, as well as take up space, the rest is
unknown.
-----------
800 EXTENDERS
-----------
Basically, 800 extenders are much like Save-Net or Am-Net going 800 instead of
local access numbers. With this one you can call anywhere in the U.S. for
free, of course you need the X digit code, but this is easily found. You use
these just like you would if you were using Save-Net, i.e. you would dial
1-800-XXX-XXXX, then enter in your X digit code and then the area code + the
number you wish to reach, i.e. 1800521167429125036358443, as you can see there
is an 800 number followed by a 4 digit code followed by a number wished to be
reached. Here's a few 800 extenders, theres many many more:
1-800- 1-800-
------- -------
245-4890 4 DIGITS 327-6713 4 DIGITS
243-7650 6 DIGITS 328-7112 4 DIGITS
654-8494 6 DIGITS 327-9895 7 DIGITS
327-9136 4 DIGITS 227-3414 4 DIGITS
682-4000 6 DIGITS 343-1844 4 DIGITS
858-9000 3 DIGITS 521-1674 4 DIGITS
537-3511 8 DIGITS 843-0698 9 dIGITS
=-=-=-=-=-=-=------------------------->
LOOP NUMBERS EXPLORED
Loop numbers simply connect two people together using two different numbers.
Thus these numbers always come in pairs, one being the higher one while the
other being the lower one. So if you were to use one, you would call one of
the pair and the other one would call the other one (you take the high road
I'll take the low road). Loop numbers are equal in quality as calling direct,
thus it would be the same quality as you would get calling your neighbour. If
you would happen to call a loop number and no one was on the other end one of
two things would happen, if you called the higher of the two you would here
silence, if you dialed the lower you would get a 1000 hertz tone. Heres a list
of some loop numbers:
Area Code 212
XXX-9979 (HIGH)
XXX-9977 (LOW)
XXX= 690,534,569,432,868,255,228,677,982,466,926,220,586,524,283
XXX-9906 (HIGH)
XXX-9900 (LOW)
XXX= 529,352,439,388
Where you see XXX you enter the prefix desired, thus if you wanted area code
212, you could choose a prefix say 690, so one person would dial 690-9906 and
the other 690-9900.
In order to scan for loop numbers you'll need a friend to help. Loop numbers
run in pairs, the combination is 00XX and XX99. So what you need is for one
person to scan one end while the other scans the upper (using the same
prefix). The hang side has no tone while the other gives off a 1000hz tone.
To use a loop number in order to start a conference call simply have one
person get on the hangside while another calls the conferenceing operator (PBX
operator will do). The person calling the operator (hopefully from a fortress
phone) should charge the call to the upper loop number (the one the other
person isn't on), when the operator calls to verify she'll get your freind,
who of course will accept all charges gladly.
=-=-=-=-=-=-=------------------------->
Customer name and address
(CN/A)
A CN/A operator is disagnated for the use of AT&T employees who need some
information on a certain person. Ex- A Bell cop got a persons name from a nark
or whatever, he needs more info about the person so he calls up the CN/A
operator and asks her for the persons where abouts. Ma has been nice enough to
grant these operators the knowledge of a few more things (Ma's slip up), such
as their phone number. Thus we can call up one of these operators, say,'Hi, my
names Joe Rodrequiz and I'm from the Lake Oswego Bell customer service
department, I need the following info on a 'Jack Suchos'.' Then you become
really nice and ask if you can have that persons phone number so you don't
have to go over there. Since these operators are human, and are easily conned
and are very informed they'll give you just about whatever you need to know.
However you must be polite and business like. Following is a list of CN/A's,
to use it, find your area code and the CN/A operators number will follow:
DUTCHMAN DIRECTORY
AREA CODE PHONE NUMBER
---------- ---------------
201 201-676-7070
202 301-384-9820
203 203-789-6815
204 204-949-0900
205 205-988-7000
206 206-382-8000
207 617-787-2750
208 303-399-4200
209 415-546-1341
212 518-471-8111
213 213-501-4144
214 214-948-5731
215 412-633-5600
216 614-464-2345
217 217-525-7000
218 402-345-0600
219 317-265-4834
301 301-534-1168
302 412-633-5600
303 303-399-4200
304 304-344-8041
305 912-784-9111
306 NONE....NONE
307 303-399-4200
308 402-345-0600
309 217-525-7000
312 312-796-9600
313 313-223-8690
314 314-726-7142
315 518-471-8111
316 816-275-2782
317 317-265-4834
318 318-227-1551
319 402-345-0600
401 617-787-2760
402 402-345-0600
403 403-425-2652
404 912-784-9111
405 405-236-6121
406 303-399-4200
408 415-546-1132
412 412-633-5600
413 617=787-2760
414 608-252-6932
415 415-546-1132
416 416-922-6686
417 314-726-7142
418 514-861-2635
419 614-464-2345
501 405-236-6121
502 502-583-2861
503 203-784-6815
504 504-245-5330
505 303-399-4200
506 506-657-3855
507 402-345-0600
509 206=382-8000
512 512-828-2501
513 714-464-2345
514 514-861-2635
515 402-345-0600
516 518-471-8111
517 313-223-8690
518 518-471-8000
519 416-922-6686
601 601-961-0877
602 303-399-4200
603 617-787-2750
604 604-432-2996
605 402-345-0600
606 502-583-2681
607 518-471-8111
608 608-252-6932
609 201-676-7070
612 402-345-0600
613 416-922-6686
614 614-464-2345
615 615-373-5791
616 313-223-8690
617 617-787-2750
618 217-525-7000
701 402-345-0600
702 415-546-1341
703 804-747-1411
704 912-784-9111
705 416-922-6686
707 415-546-1132
709 NONE....NONE
712 402-345-0600
713 713-820-4112
714 213-501-4144
715 608-252-6932
716 518-471-8111
717 412-633-5600
801 303-399-4200
802 617-787-2750
803 912-784-9111
804 804-747-1411
805 415-546-1341
806 512-828-2501
807 416-922-6686
808 212-334-4336
809 LIST BELOW
812 317-265-4834
813 813-223-9678
814 412-633-5600
815 217-525-7000
816 816-275-2782
817 214-948-5731
819 514-861-2635
901 615-373-5791
902 902-421-4110
903 NONE....NONE
904 912-784-9111
906 313-223-8690
907 NONE....NONE
912 912-784-9111
913 816-275-2782
914 518-471-8111
915 512-828-2501
916 415-546-1341
918 405-236-6121
919 912-784-9111
900+(DIAL-IT) NUMBERS: 212-334-3611
FOR BAHAMAS, BERMUDA, DOMINICAN REP, JAMAICA AND PUERTO RICO: 212-334-4336
Downloaded From P-80 Systems 304-744-2253

200
textfiles.com/phreak/bell-h Normal file
View File

@@ -0,0 +1,200 @@

/////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**////////////////////////////////////////
////// ** M \\\\\\
\\\\\\ ** Bell Hell Volume #1 E //////
////// ** T \\\\\\
\\\\\\ ************ By: The Dutchman A C //////
////// Neon**Knights -Wired L O \\\\\\
\\\\\\ ** M //////
////// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\\ ** U //////
////// ** Call These Genocidal Systems... N \\\\\\
\\\\\\ ** I //////
////// ** /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]538-0761 C \\\\\\
\\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]253-5300 A //////
////// METAL! The /\/\etal AE PW: KILL............[201]879-6668 T \\\\\\
\\\\\\ KICKS! The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]696-7983 I //////
////// Milliways 10mgs BBS...........[609]921-1994 O \\\\\\
\\\\\\ 7 Gates of Hell BBS.................[415]697-1320 N //////
////// The Mordor AE 1200bps/Cat-Fur/10mg[201]528-6467 S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////////
//////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
______________________________________________________________________________
PREFACE: In this issue will discuss the different types of operators, area codes and special numbers. This edition is made to give you a basic understanding of the wicked ways of MA. I hope it'll give you a good enough back ground to do well. Look for Bell Hell vol. 2 for more info on hacking.
_______________________________________________________________________________
=-=-=-=-=
OPERATORS:
=-=-=-=-=
Here we'll go over in detail some of the most common operators.
TSPS OPERATOR:
Trafic (us) Service Position System Operator is the bitch you commonly here whenever you use a pay fone etc.. To say the leats she's a meat head. Her respnsibilities are as follows:
[1] Getting all billing information for Calling Cards and 3rd number calls.
[2] Making sure you get the right person on person-to-person calls.
[3] Making sure the fool on the other end will pay for your collect call (why call collect?)
[4] Identifying calling numbers, or basically asking you, 'what number are you calling, pleaz.' when the system fucks up.
Even though these operators are commonly ding-bats you shouldn't screw with them, for they are known to be quick with the traser. She can even tell if your calling from a fortress fone, she has like a portable all time ready tracer. Beware of these deadly bitches.
INWARD OPERATORS:
This winch is basically an apprentice to the bitch above (TSPS) or commonly the '0' operator. She will never question you as long as your within her dimension (service) area. She can only be reached by a mighty Blue Box (discussed in up and cumming tutorial) or another operator.
DIRECTORY ASSISTANCE OPERATORS:
(DOA?DAO?)
This is the operator ou get when you call directory assistance (555-1212). All she can do is either tell you a listed number or tell you if a number is unlisted. Waste of time.
DEAF D.A.O.'S
This is neat little operator set up to help directory assistance for deaf people (who would they want to talk to?). She's reachable by dialing 800-855-1155. She talks to the deaf via Teletypewritters (terminals). If your modem can transfer baudot (Oh those sweet Apple Cats can) then you can talk to her. You might find her alot more friendly, more talkitive and alot easier to manipulate a number out of. However, she does use abbreviations like GA for go ahead (pretty tricky huh).
CN/A OPERATORS
Oh the sweet CN/A, god bless its soul. These operators instead of giveing you information on a persons phone number they give you information on a fone numbers person (the person at 503-229-7600). However, if manipulated these beauties can give you the number for an unlisted fone number (the number), they have all kinds of access. This topic is discussed later in this tutorial.
INTERCEPT OPERATOR:
All places have their share of low lifes, well this is the scum, bottom of the barrol of operators. She's the one you get when all the recordings are busy (lower than a recording). Infact these dames can cause you more pains then a recording. They only know a handful of english (around two sentences) and can barely even say those. Even though they have no clue to what a trace is, unless you know their native tongue, and then doubtfully, their just a pain in the bu** to deal with.
OTHER OPERATORS:
Well we have- marine verify, we have mobile,rout and rate,ship to shore,conference and a few other specific ones. No ral help to us now.
*NOTES: Most operators have their own little Directory Assistance. If any operator is giving you probs ask to speek with his/her/its supervisor. This will phreak them out. In rare loveable cases you might find a nice operator with a number like (503-123-4567). Whenever you find a 0 or 1 in the 4th number slot ^ then you no need a Blue Box. It'll give you special access to those hard to get winches.
________________________________________________________________________________
=-=-=-=-=-=-=-=
AREA CODES ETC.
=-=-=-=-=-=-=-=
HOW FONE NUMBERS WORK:
Basiclly MA made our fone numbers quite simple. Here's how they work:
[A] The area code is what the call a three digit number plan area or NPA. This means that an area code is just that, the code for an area.
[B] The rest of our number (ie. 666-7209) is divided into two segments. The first being the Central Office number (666 would be N. Portland) and the ending (7209) is the station number, or basically your assigned home number.
This complete combination (503-666-7209) is known as the destination code. Here's how MA has developed the combo's:
[NPA] [TELEFONE NUMBER]
X*Y XYY-YYYY
X = a number from 2-9
y = a number from 0-9
* = either 0 or 1
Normally an area code may never cross a states boundrie, thus an area code (NPA) may not be used for both New York and for Pennsylvania. However, as for all other rules there is an exception. Here they are.
SPECIAL AREA CODES:
(SACS)
510 - TWX (USA)
610 - TWX (CANADA)
700 - NEW SERVICE
710 - TWX (USA)
800 - WATTS LINES
810 - TWX (USA)
900 - DIAL-IT SERVICES
910 - TWX (USA)
The explanations of these are as follows:
TWX:
Telex II, as you can see above there are 5 TWX machines. There all owned by Western Union. Normally these babes may only be accessed by other TWX machines, however, if you do not wish to go and purchase on you can access 'em by use of the Easylink, by Western Union. For more on this I would suggest reading The Bioc Agents, and Tucs article on 'Hacking Western Union's Easylink.'
700:
This is a new service for employees of AT&T in which someone (one of the special employees) can call his own 700 number (say 700-292-9876), enters his/her code, and where he is staying and then hangs up. If there is any new info on the case he is working on the computer will call him back and tell him all the latest updates.
800:
There a basically two types of Watts Lines, Inward Watts and Outward watts. These are probably some of the nicest of the special area codes since they allow you to call for free. Here's an explanation of the two:
INWARD WATTS:
Inward Wide Area Telecomunications Service is probably the one your most familiar with. MA has developed it so there are 6 different levels of Inwatts. Level 6 being the whole U.S. (all 50 states) level 5 being all 48 contienental states etc. all the way down to 1 only one state. Usually companies get a levle 6 and then a level 1 beacuse all though level 6 allows you to call from anywhere in the U.S. it excludes the state where the call is terminated at, so the company usually buys a level 1 for that state.
Intrestate Inwatts are less common but still exist. These are the ones you can only call from say one state. You can tell one quite easily for they all have a 2 for the last central office number, or the 6th number (ie. 800-XY2-XXXX).
All companies that have a 800# must have at leats two lines. This is because if you call the first number (ie. 800-666-0190) and it rings busy the 800# number will always go to another port to see if its busy. Inwatts customers are billed by the hour instead of month like us.
OUTWARD WATTS:
Outwatts are just that, there for making outward calls only. Large companies commonly use Outwatts since they recieve bulk discounts. Outwatt 800's are in the form of:
800-*XX-XXXX
* may only be a 0 or 1 and can only be reached by way of box. The whole set, *XX is the areas that are accessable by that comany.
900:
This is a nation number used for taking polls and the like (how do you think they know what shows on the tube are c00l). The number for this service is, 900-555-1212. This will tell whats up o the system. Beware, this MA trick will cost you 50 cents a minute, and 35 cents there after (ever heard of MA being cheap?).
=-=-=-=-=
CO CODES
=-=-=-=-=
These are the way the switching office knows where to route the call. The following codes are reserved nationwide:
555 - directory assistance
950 - future services
958 - plant test
959 - plant test
976 - dial-it services (weather etc.)
950:
This includes all special service. Heres a list of a few:
1000 - SPC
1022 - MCI Execunet
1033 - US Telefone
1044 - Allnet
1088 - SBS Skyline
*NOTE: These beauts are free from fortresses.
958,959:
These consist of ANI, Ringback and some other MA tests.
976:
Check this one out. Simply dial 976-1000. Alot of BBS around will probably have a more complete listing of these services.
=-=-=-=-=
N11 CODES:
=-=-=-=-=
I'm not sure what one of these are still in service. Basically MA wants to dump these services, but alot are still in use, it'll vary with your area.
011 - international dialing prefix
211 - coin refund operator
411 - directory assistance
611 - repair service
811 - business office
911 - EMERGENCY
* I WOULD LIKE TO GIVE UNMENTIONABLE THANKS TO THE FOLLWING, FOR WITHOUT THEM THIS TUTORIAL WOULD NOT EXIST: BIOC AGENT 003 FOR HIS INCREDIBLE TUTORIALS, 503 ALLIANCE FOR ITS HELP IN GETTING ME STARTED, OSUNNY BBS FOR WITHOUT I WOULDN'T OF HAD ACCESS TO THE INFO I'VE LEARNED, AND LASTLY AND MOST IMPORTANTLY FOR TAP FOR WITH OUT IT PHREAKS WOULD HAVE ONE HELL OF A TIME. THANK YOU.
* TAP,ROOM 603,147 W 42nd ST., N.Y.,N.Y./$10/YEAR/SEND SASE FOR MORE INFO.

Downloaded from The Land Of Fa II [716]/773-7526
Press a key...


116
textfiles.com/phreak/bell.hum Normal file
View File

@@ -0,0 +1,116 @@
"The Day Bell System Died"
Lyrics Copyright (C) 1983 by Lauren Weinstein
(To the tune of "American Pie")
(With apologies to Don McLean)
Long, long, time ago,
I can still remember,
When the local calls were "free".
And I knew if I paid my bill,
And never wished them any ill,
That the phone company would let me be...
But Uncle Sam said he knew better,
Split 'em up, for all and ever!
We'll foster competition:
It's good capital-ism!
I can't remember if I cried,
When my phone bill first tripled in size.
But something touched me deep inside,
The day... Bell System... died.
And we were singing...
Bye, bye, Ma Bell, why did you die?
We get static from Sprint and echo from MCI,
"Our local calls have us in hock!" we all cry.
Oh Ma Bell why did you have to die?
Ma Bell why did you have to die?
Is your office Step by Step,
Or have you gotten some Crossbar yet?
Everybody used to ask...
Oh, is TSPS coming soon?
IDDD will be a boon!
And, I hope to get a Touch-Tone phone, real soon...
The color phones are really neat,
And direct dialing can't be beat!
My area code is "low":
The prestige way to go!
Oh, they just raised phone booths to a dime!
Well, I suppose it's about time.
I remember how the payphones chimed,
The day... Bell System... died.
And we were singing...
Bye, bye, Ma Bell, why did you die?
We get static from Sprint and echo from MCI,
"Our local calls have us in hock!" we all cry.
Oh Ma Bell why did you have to die?
Ma Bell why did you have to die?
Back then we were all at one rate,
Phone installs didn't cause debate,
About who'd put which wire where...
Installers came right out to you,
No "phone stores" with their ballyhoo,
And 411 was free, seemed very fair!
But FCC wanted it seems,
To let others skim long-distance creams,
No matter 'bout the locals,
They're mostly all just yokels!
And so one day it came to pass,
That the great Bell System did collapse,
In rubble now, we all do mass,
The day... Bell System... died.
So bye, bye, Ma Bell, why did you die?
We get static from Sprint and echo from MCI,
"Our local calls have us in hock!" we all cry.
Oh Ma Bell why did you have to die?
Ma Bell why did you have to die?
I drove on out to Murray Hill,
To see Bell Labs, some time to kill,
But the sign there said the Labs were gone.
I went back to my old CO,
Where I'd had my phone lines, years ago,
But it was empty, dark, and ever so forlorn...
No relays pulsed,
No data crooned,
No MF tones did play their tunes,
There wasn't a word spoken,
All carrier paths were broken...
And so that's how it all occurred,
Microwave horns just nests for birds,
Everything became so absurd,
The day... Bell System... died.
So bye, bye, Ma Bell, why did you die?
We get static from Sprint and echo from MCI,
"Our local calls have us in hock!" we all cry.
Oh Ma Bell why did you have to die?
Ma Bell why did you have to die?
We were singing:
Bye, bye, Ma Bell, why did you die?
We get static from Sprint and echo from MCI,
"Our local calls have us in hock!" we all cry.
Oh Ma Bell why did you have to die?
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open


89
textfiles.com/phreak/bell.sec Normal file
View File

@@ -0,0 +1,89 @@
o Exit
----[=BELL SPECIAL INTELLIGENCE=]----
--------------[=FORCE=]--------------
-------------------------------------
Around 1970 Bell formed a special
type of security agency known only
as 'SIF' (Special Intelligence Force)
This organization will usually pay
the suspected victim a visit if
Bell can't (by any legal means) get
any info. on you about your suspected
fone fraud.
They have been known in one case
to have seriously injured one person
when he refused to let them in his
to search it. After they had beaten
him up a bit, they proceded to
Press [RETURN]  confiscate all electronic equipment
on the premises.
Although it was later discovered
that he had nothing to do with
phreaking, his reputation was
permanently ruined, and he could
never get a job in his field again.
After the trial was over and he
was found innocent, he noticed an
extra wire from running from his
house to the fone line. When he
called the company and asked them
about it, all they said was that it
was not to be tampered with, and
that any tampering detected would
result in a fine and possible
prison sentence.
Press [RETURN]   This person,who's name I cannot
mention, had a permanent record
about this incident on his file,
and wherever he went this record
followed him. He was so harrassed by
all of these matters that on
October 12, 1973 this man committed
suicide by asphyxiating himself
in his 1970 Oldsmobile by leaving
the engine running while still
in the garage.
Pinned to his shirt was a suicide
note that explained about some
of the incidents of embezzlement by
high ranking company officials,
embezzlement of company funds, and
political slush funding.
Bell was never tried for any of
these offenses because almost all
Press [RETURN]  of the people who knew about the
incident were "ENCOURAGED" not
to discuss the matter with anyone.
The only person ever known to
speal about the matter publicly was
J. Edward Hyde. He wrote an entire
book on alot of things about the
Bell system.
------------[=NOTE=]-----------
I'm not saying that you will ever
have a visit from any of these
people, but if you do,
*********BE CAREFUL!!!!!!!!!********
These people mean business and they
can ruin you for life.
-------------------------------
The information found in this
article is not necessarily express
Press [RETURN]  the opinion of the author mentioned
herein and the this writer takes
no responsiblilty for any use/misuse
of this material...
-----------[=========]-------------
[Phreak][1-37][?=Menu,<CR>=quit]:

214
textfiles.com/phreak/bellatl1.phk Normal file
View File

@@ -0,0 +1,214 @@
::::::::::::::::::::::::::::::::::::::
: :
: I S D N Volume i :
: ------- :
:Integrated Services Digital Network :
: :
: :
: From: :
: :
: Bell Atlantic - vol 2,number 3 :
: :
: :
: Typed in by: :
: :
: Zandar Zan :
: :
::::::::::::::::::::::::::::::::::::::
Part 1:
-------
ISDN Glossary
---- --------
Analog - As used for a word or data transmission,a continuously varying
electrical signal in the shape of a wave.
Bit Stream - Refers to a continuous series of bits(binary digits) being
transmitted on a transmission line.
CCITT - The initials of the name in French of the International Telegraph and
Telephone Con- sultative Committee.At CCITT representatives of tele-
communications authorities, operators of public networks and other interested
bodies meet to agree on standards needed for international in- terworking of
telecommunica- tion services.
Channel - (1) CCITT and ASA standard :A means of one-way transmis- sion.(2)
Tariff and common usage:UCA path for electrical transmission between two or more
points without common carrier-provided treminal equipment.Also called circuit,
line,link,path or facility.
CCSS - Common Channel Signalling System.A system whereby all sig- nalling for
a number of voice paths is carried over one common channel,instead of within
each individual channel.
Data Communications - In telephone company terminology,data communi- cations
refers to an end-to-end transmission of any kind of in- formation other than
sound (including voice),or video.Data sources may be either digital (i.e., a
computer) or analog (i.e., an elctrocardiogram transmitter).
Data Rate - The rate at which a chan- nel carries data,measured in bits per
second (bit/s),also know as "data signalling rate."
Digital - A method to represent information be discrete or indi- vidually
distinct signals,such as bits,as opposed to a continuously variable analog
signal.
Digital Transmission - A mode of transmission in which all infor- mation to be
transmitted is first converted to digital form and then transmitted as a serial
stream of pulses.Any signal - voice,data,television,can be converted to digital
form.
End-To-End Signalling - A mode of network operation in which the originating
central office(or station) retains control and sig- nals directly to each
successive central office(or PBX)as trunks are added to the connection.
Facsimile - A system for the trans- mission of images.The image is scanned at
the transmitter, reconstructed at the receiving station,and duplicated on some
form of paper.
High-Speed Data - A rate of data transfer ranging upward from 10,000 bits per
second.
ISDN - Integrated Services Digital Network.ISDN is a planned hierarchy of
digital switching and transmission systems.Synch- ronized so that all digital
elements speak the same "language" at the same speed,the ISDN would provide
voice,data and video in a unified manner.
LADT - Local Area Data Transport. LADT is a method by which customers will
send and receive digital data over existing customer loop wiring.Dial-up LADT
will let customers use their lines for occasional data services;direct access
LADT will transmit simultaneous voice and data traffic on the same lines.
Signalling - The process by which a caller or equipment on the transmitting
end of a line in- forms a particular party or equipment at the receiving end
that a message is to be communicated.Signalling is also the supervisory
information which lets the caller know the called party is ready to talk, the
line is busy,or the called party has hung up.
Terminal - (1) A point at whcih information can enter or leave a communication
network.(2) Any device capable of sending and/or receiving information over a
communication channel.The means by which data are entered into a computer system
and by which the decisions of the system are communicated to the environment it
affects.
Videotext - Generic term for a class of two-way,interactive data distribution
systems with output typically handled as in teletext systems and input typically
accepted through the telephone or public data network.
=======================================
Note: I have ommitted some of the text originally in this glossary because it
was quite common knowledge and needed no repition in this file. the text was:
Architecture
Data
Facility
Switch
Transmission
Get the point?
This glossary is for the ISDN network and is a list of terms used within the
explantion and function of this system.
That's about all for this one....look for volumes ii and iii...
Some text was rearranged slightly to faclitate the writing of this file.
=======================================
The Neon Knights
=======================================
201-879-6668 pw:kill 300/1200
503-538-0761 300/10 megs
201-528-6467 pw:zandar
=======================================
::::::::::::::::::::::::::::::::::::::
: :
: :
: I S D N Volume ii :
: ------- :
: :
: Integrated Services Digital Network:
: :
: From: :
: :
: Bell Atlantic - vol. 2,number 3 :
: :
: Typed in by: :
: :
: Zandar Zan :
: :
::::::::::::::::::::::::::::::::::::::
Part 2:
-------
Bell Atlantic helps light the fuse to an explosive new technology
I have merely sumarised this article into the basic facts about ISDN.
In addition to instant facsimile transmission and video-conferencing, ISDN
features include:
-- centralized coordination and administration of Centrex phones within large
companies;
-- city-wide Centrex,allowing inter- building dialing of four-digit numbers
without a prefix;
-- reproduction by printer of onscreen images.
Besides implementing an aggressive digital modernization program in key
central offices throughout the region (221 COs will be digital by the end of the
year,compared to 459 in 1986),the company has introduced two product lines that
position ISDN in the mid-At lantic region: LADT(local area data transport) and
CO-LANs(central office- based local area network).
(LADT provides a LATA-wide public packet switching service,while CO-LAN
provides a switched terminal-to termi- nal or terminal-to-host data
communications service.Both services use a "data voice multiplexer"(DVM), which
squeezes more out of the transmission medium and allows a customer to trasmit
voice and data simultaneously to more than one re- ceiver over the existing
telephone wire.)
ISDN will help customers transmit high-speed facsimile and voice signals
and,at the same time,receive calls and data.
ISDN advances are confined to the U.S. shores,however.
Trials are scheduled to get underway in Japan,Great Britain,France,West
Germany,Italy and Sweden.(In Japan, ISDN is known as INS,or Information Network
System,and in Great Britain, it's called IDA,or Integrated Digital Access.)
get this line guys,true american bureaucratic bullshit and redtape that
regulates fucking everything....
"The movement to migrate to an ISDN network overseas is - for a variety of
regulatory and political reasons - outpacing efforts in the u.s."
In otherwords,cause of the fucking bureaucrats in office,the fucking japs and
shit are moving faster than we are even in the phone systems now cause we have
to many 'regulatory and political' bullshit laws...
that's all dudes
Zandar Zan
=======================================
The Neon Knights
=======================================
201-879-6668 pw:kill 300/1200
=======================================
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open


318
textfiles.com/phreak/bellcore.txt Normal file
View File

@@ -0,0 +1,318 @@
--------------------------------------------------------------------
BELLCORE Information by The Mad Phone-man
--------------------------------------------------------------------
So, You've broken into the big phone box on the wall, and are looking at
a bunch of tags with numbers and letters on them. Which one is the modem
line? Which one is the 1-800 WATTS line? Which one is the Alarm Line?
Bell has a specific set of codes that enable you to identify what you're
looking at. These are the same codes the installer gets from the wire
center to enable him to setup the line, test it, and make sure it matches
the customers order. Here are some extracts from the Bellcore book.
First lets take a Hypothetical Line number I'm familiar with:
64FDDV 123456
-------------------------------------------------------------
The serial number format:
Prefix + service code + modifier + serial number +
digits: 1,2 3,4 5,6 7,8,9,10,11,12 continued
-------------------------------------------------------------------------
Suffix + CO assigning circut number + segmet
digits: 13,14,15 16,17,18,19 20,21,22
-------------------------------------------------------------------------
The Important shit is in the 3d thru 6th digit.
SERVICE CODES Intra or Inter LATA Block 1-26
-----------------
AA- Packet Analog Access line
AB- Packet switch trunk
AD- Attendant
AF- Commercial audio fulltime
AI- Automatic Identified outward dialing
AL- Alternate services
AM- Packet, off-network access line
AN- Announcement service
AO- International/overseas audio (full time)
AP- Commercial audio (part time)
AT- International/overseas audio (part time)
AU- Autoscript
BA- Protective alarm (CD)
BL- Bell & Lights
BS- Siren control
CA- SSN Access
CB- OCC Audio facilitys
CC- OCC Digital facility-medium speed
CE- SSN Station Line
CF- OCC Special facility
CG- OCC Telegraph facility
CH- OCC Digital facility High-speed
CI- Concentrator Identifier trunk
CJ- OCC Control facility
CK- OCC Overseas connecting facility wide-band
CL- Centrex CO line
CM- OCC Video facility
CN- SSN Network trunk
CO- OCC Overseas connecting facility
CP- Concentrator identifier signaling link
CR- OCC Backup facility
CS- Channel service
CT- SSN Tie trunk
CV- OCC Voice grade facility
CW- OCC Wire pair facility
CZ- OCC Access facility
DA- Digital data off-net extention
DB- HSSDS 1.5 mb/s access line
DF- HSSDS 1.5 mb/s hub to hub
DG- HSSDS 1.5 mb/s hub to earth station
DH- Digital service
DI- Direct-in dial
DJ- Digit trunk
DK- Data Link
DL- Dictation line
DO- Direct-out dial
DP- Digital data-2 4 kb/s
DQ- Digital data-4 8 kb/s
DR- Digital data-9.6 kb/s
DW- Digital data-56 kb/s
DY- Digital service (under 1 mb/s)
EA- Switched acess
EB- ENFIA II end office trunk
EC- ENFIA II tandem trunk
EE- Combined access
EF- Entrance facility-voice grade
EG- Type #2 Telegraph
EL- Emergency reporting line
EM- Emergency reporting center trunk
EN- Exchange network acess facility
EP- Entrance facility-program grade
EQ- Equipment only-(network only) assignment
ES- Extension service-voice grade
ET- Entrance facility-telegraph grade
EU- Extension service-telegrasph grade
EV- Enhanced Emergency reporting trunk
EW- Off network MTS/WATS equivalent service
FD- Private line-data
FG- Group-supergroup spectrum
FR- Fire dispatch
FT- Foreign exchange trunk
FW- Wideband channel
FV- Voice grade facility
FX- Foreign exchange
HP- Non-DDS Digital data 2.4 kb/s
HQ- Non-DDS Digital data 4.8 kb/s
HR- Non-DDs Digital data 9.6 kb/s
HW- Non-DDS Digital data 56 kb/s
IT- Intertandem tie trunk
LA- Local area data channel
LL- Long distance terminal line
LS- Local service
LT- Long distance terminal trunk
MA- Cellular access trunk 2-way
MT- Wired music
NA- CSACC Link (EPSCS)
NC- CNCC link (EPSCS)
ND- Network data line
OI- Off premises intercommunication station line
ON- Off network access line
OP- Off premises extension
OS- Off premises PBX station line
PA- Protective alarm (AC)
PC- Switched digital-access line
PG- paging
PL- Private line-voice
PM- Protective monitoring
PR- Protective relaying-voice grade
PS- MSC constructed spare facility
PV- Protective relaying-telegraph grade
PW- Protective relaying-signal grade
PX- PBX station line
PZ- MSC constructed circut
QU- Packet asyncronous access line
QS- Packet synchronous access line
RA- Remote attendant
RT- Radio landline
SA- sattelite trunk
SG- control/remote metering signal grade
SL- secretarial line
SM- sampling
SN- Special access termination
SQ- equipment only-customer premises
SS- dataphone select-a-station
TA- Tandem tie-trunk
TC- Control/remote metering-telegraph grade
TF- Telephoto/facsimile
TK- Local PBX trunk
TL- Non-tandem tie trunk
TR- turret or automatic call distributor (ACD) trunk
TT- Teletypewriter channel
TU- Turret or automatic call distributor (ACD) line
TX- Dedicated facility
VF- Commercial television (full time)
VH- Commercial television (part time)
VM- Control/remote metering-voice grade
VO- International overseas television
VR- Non-commercial Television (7003,7004)
WC- Special 800 surface trunk
WD- Special WATS trunk (OUT)
WI- 800 surface trunk
WO- WATS line (OUT)
WS- WATS trunk (OUT)
WX- 800 service line
WY- WATS trunk (2-way)
WZ- WATS line (2-way)
ZA- Alarm circuts
ZC- Call and talk circuts
ZE- Emergency patching circuts
ZF- Order circuts, facility
ZM- Measurement and recording circuts
ZP- Test circut, Plant service center
ZQ- Quality and management circuts
ZS- Switching, control and transfer circuts
ZT- Test circuts, central office
ZV- Order circuts, service
SERVICE CODES FOR LATA ACCESS
---------------------------------------------------
HC- High capacity 1.544 mb/ps
HD- High capacity 3.152 mb/ps
HE- High capacity 6.312 mb/ps
HF- High capacity 6.312
HG- High capacity 274.176 mb/s
HS- High capacity subrate
LB- Voice-non switched line
LC- Voice-switched line
LD- Voice Switched trunk
LE- Voice and tone-radio landline
LF- Data low-speed
LG- Basic data
LH- Voice and data-PSN access trunk
LJ- Voice and data SSN access
LK- Voice and data-SSN-intermachine trunk
LN- Data extension, voice grade data facility
LP- Telephoto/facsimile
LQ- Voice grade customized
LR- Protection relay-voice grade
LZ- dedicated facility
MQ- Metalic customized
NQ- Telegraph customized
NT- Protection alarm-metalic
NU- Protection alarm
NV- Protective relaying/telegraph grade
NW- Telegraph grade facility-75 baud
NY- Telegraph grade facility- 150 baud
PE- Program audio, 200-3500 hz
PF- Program audio, 100-5000 hz
PJ- Program audio, 50-8000 hz
PK- Program audio, 50-15000 hz
PQ- Program grade customized
SB- Switched access-standard
SD- Switched access-improved
SE- Special access WATS-access-std
SF- Special access- WATS access line improved
SJ- Limited switched access line
TQ- Television grade customized
TV- TV Channel one way 15khz audio
TW- TV Channel one way 5khz audio
WB- Wideband digital, 19.2 kb/s
WE- Wideband digital, 50 kb/s
WF- Wideband digital, 230.4 kb/s
WH- Wideband digital, 56 kb/s
WJ- Wideband analog, 60-108 khz
WL- Wideband analog 312-552 khz
WN- Wideband analog 10hz-20 khz
WP- Wideband analog, 29-44 khz
WR- Wideband analog 564-3064 khz
XA- Dedicated digital, 2.4 kb/s
XB- Dedicated digital, 4.8 kb/s
XG- Dedicated digital, 9.6 kb/s
XH- Dedecated digital 56. kb/s
Now the last two positions of real importance, 5 & 6 translate thusly:
Modifier Character Position 5
------------------------------
INTRASTARE INTERSTATE
-------------------------------------
A B Alternate data & non data
-------------------------------------
C Customer controlled Service
-------------------------------------
D E Data
-------------------------------------
N L Non-data operation
-------------------------------------
P Only offered under intra Restructured
private line (RPL) tariff
-------------------------------------
S T Simultanious data & non-data
-------------------------------------
F Interexchange Carriers is less than 50%
-------------------------------------
G Interstate carrier is more than 50% usage
===============================================================================
MODIFIER CHARACTER POSITION 6
--------------------------------------------------------------
TYPE OF SERVICE Intra LATA
--------------------------------------
ALL EXCEPT US GOVT US GOVERNMT
--------------------------------------
T M Circut is BOC customer to BOC customer
all facilitys are TELCO provided
--------------------------------------
C P Circut is BOC/BOC and part of facilitys
or equipment is telco provided
--------------------------------------
A J Circut is BOC/BOC all electricaly
connected equip is customer provided
--------------------------------------
L F Circut terminates at Interexchange
carrier customers location
--------------------------------------
Z Offical company service
--------------------------------------
Interlata
S S Circut terminates at Interexchange
carriers point of term (POT)
--------------------------------------
V V Circut terminates at an interface of a
Radio common carrier (RCC)
--------------------------------------
Z Official company service
--------------------------------------
Corridor
Y X Corridor circut
--------------------------------------
International
K H Circut has at least 2 terminations in
different countries
--------------------------------------
interexchange carrier
Y X Transport circut between Interexchange
carrier terminals.
----------------------------------------
So 64FDDV would be a private line data circut terminating at a radio common
carrier. Other examples can be decoded likewise.
Enjoy this information as much as I've had finding it.
-= The Mad Phone-man =-
trunk
LE- Voice and tone-ra

317
textfiles.com/phreak/bellcoreinf.phk Normal file
View File

@@ -0,0 +1,317 @@
--------------------------------------------------------------------
BELLCORE Information by The Mad Phone-man
--------------------------------------------------------------------
So, You've broken into the big phone box on the wall, and are looking at
a bunch of tags with numbers and letters on them. Which one is the modem
line? Which one is the 1-800 WATTS line? Which one is the Alarm Line?
Bell has a specific set of codes that enable you to identify what you're
looking at. These are the same codes the installer gets from the wire
center to enable him to setup the line, test it, and make sure it matches
the customers order. Here are some extracts from the Bellcore book.
First lets take a Hypothetical Line number I'm familiar with:
64FDDV 123456
-------------------------------------------------------------
The serial number format:
Prefix + service code + modifier + serial number +
digits: 1,2 3,4 5,6 7,8,9,10,11,12 continued
-------------------------------------------------------------------------
Suffix + CO assigning circut number + segmet
digits: 13,14,15 16,17,18,19 20,21,22
-------------------------------------------------------------------------
The Important shit is in the 3d thru 6th digit.
SERVICE CODES Intra or Inter LATA Block 1-26
-----------------
AA- Packet Analog Access line
AB- Packet switch trunk
AD- Attendant
AF- Commercial audio fulltime
AI- Automatic Identified outward dialing
AL- Alternate services
AM- Packet, off-network access line
AN- Announcement service
AO- International/overseas audio (full time)
AP- Commercial audio (part time)
AT- International/overseas audio (part time)
AU- Autoscript
BA- Protective alarm (CD)
BL- Bell & Lights
BS- Siren control
CA- SSN Access
CB- OCC Audio facilitys
CC- OCC Digital facility-medium speed
CE- SSN Station Line
CF- OCC Special facility
CG- OCC Telegraph facility
CH- OCC Digital facility High-speed
CI- Concentrator Identifier trunk
CJ- OCC Control facility
CK- OCC Overseas connecting facility wide-band
CL- Centrex CO line
CM- OCC Video facility
CN- SSN Network trunk
CO- OCC Overseas connecting facility
CP- Concentrator identifier signaling link
CR- OCC Backup facility
CS- Channel service
CT- SSN Tie trunk
CV- OCC Voice grade facility
CW- OCC Wire pair facility
CZ- OCC Access facility
DA- Digital data off-net extention
DB- HSSDS 1.5 mb/s access line
DF- HSSDS 1.5 mb/s hub to hub
DG- HSSDS 1.5 mb/s hub to earth station
DH- Digital service
DI- Direct-in dial
DJ- Digit trunk
DK- Data Link
DL- Dictation line
DO- Direct-out dial
DP- Digital data-2 4 kb/s
DQ- Digital data-4 8 kb/s
DR- Digital data-9.6 kb/s
DW- Digital data-56 kb/s
DY- Digital service (under 1 mb/s)
EA- Switched access
EB- ENFIA II end office trunk
EC- ENFIA II tandem trunk
EE- Combined access
EF- Entrance facility-voice grade
EG- Type #2 Telegraph
EL- Emergency reporting line
EM- Emergency reporting center trunk
EN- Exchange network acess facility
EP- Entrance facility-program grade
EQ- Equipment only-(network only) assignment
ES- Extension service-voice grade
ET- Entrance facility-telegraph grade
EU- Extension service-telegraph grade
EV- Enhanced Emergency reporting trunk
EW- Off network MTS/WATS equivalent service
FD- Private line-data
FG- Group-supergroup spectrum
FR- Fire dispatch
FT- Foreign exchange trunk
FW- Wideband channel
FV- Voice grade facility
FX- Foreign exchange
HP- Non-DDS Digital data 2.4 kb/s
HQ- Non-DDS Digital data 4.8 kb/s
HR- Non-DDS Digital data 9.6 kb/s
HW- Non-DDS Digital data 56 kb/s
IT- Inter-tandem tie trunk
LA- Local area data channel
LL- Long distance terminal line
LS- Local service
LT- Long distance terminal trunk
MA- Cellular access trunk 2-way
MT- Wired music
NA- CSACC Link (EPSCS)
NC- CNCC link (EPSCS)
ND- Network data line
OI- Off premises intercommunication station line
ON- Off network access line
OP- Off premises extension
OS- Off premises PBX station line
PA- Protective alarm (AC)
PC- Switched digital-access line
PG- paging
PL- Private line-voice
PM- Protective monitoring
PR- Protective relaying-voice grade
PS- MSC constructed spare facility
PV- Protective relaying-telegraph grade
PW- Protective relaying-signal grade
PX- PBX station line
PZ- MSC constructed circut
QU- Packet asyncronous access line
QS- Packet synchronous access line
RA- Remote attendant
RT- Radio landline
SA- satellite trunk
SG- control/remote metering signal grade
SL- secretarial line
SM- sampling
SN- Special access termination
SQ- equipment only-customer premises
SS- dataphone select-a-station
TA- Tandem tie-trunk
TC- Control/remote metering-telegraph grade
TF- Telephoto/facsimile
TK- Local PBX trunk
TL- Non-tandem tie trunk
TR- turret or automatic call distributor (ACD) trunk
TT- Teletypewriter channel
TU- Turret or automatic call distributor (ACD) line
TX- Dedicated facility
VF- Commercial television (full time)
VH- Commercial television (part time)
VM- Control/remote metering-voice grade
VO- International overseas television
VR- Non-commercial Television (7003,7004)
WC- Special 800 surface trunk
WD- Special WATS trunk (OUT)
WI- 800 surface trunk
WO- WATS line (OUT)
WS- WATS trunk (OUT)
WX- 800 service line
WY- WATS trunk (2-way)
WZ- WATS line (2-way)
ZA- Alarm circuts
ZC- Call and talk circuts
ZE- Emergency patching circuts
ZF- Order circuts, facility
ZM- Measurement and recording circuts
ZP- Test circut, Plant service center
ZQ- Quality and management circuts
ZS- Switching, control and transfer circuts
ZT- Test circuts, central office
ZV- Order circuts, service
SERVICE CODES FOR LATA ACCESS
---------------------------------------------------
HC- High capacity 1.544 mb/ps
HD- High capacity 3.152 mb/ps
HE- High capacity 6.312 mb/ps
HF- High capacity 6.312
HG- High capacity 274.176 mb/s
HS- High capacity subrate
LB- Voice-non switched line
LC- Voice-switched line
LD- Voice Switched trunk
LE- Voice and tone-radio landline
LF- Data low-speed
LG- Basic data
LH- Voice and data-PSN access trunk
LJ- Voice and data SSN access
LK- Voice and data-SSN-intermachine trunk
LN- Data extension, voice grade data facility
LP- Telephoto/facsimile
LQ- Voice grade customized
LR- Protection relay-voice grade
LZ- dedicated facility
MQ- Metalic customized
NQ- Telegraph customized
NT- Protection alarm-metalic
NU- Protection alarm
NV- Protective relaying/telegraph grade
NW- Telegraph grade facility-75 baud
NY- Telegraph grade facility- 150 baud
PE- Program audio, 200-3500 hz
PF- Program audio, 100-5000 hz
PJ- Program audio, 50-8000 hz
PK- Program audio, 50-15000 hz
PQ- Program grade customized
SB- Switched access-standard
SD- Switched access-improved
SE- Special access WATS-access-std
SF- Special access- WATS access line improved
SJ- Limited switched access line
TQ- Television grade customized
TV- TV Channel one way 15khz audio
TW- TV Channel one way 5khz audio
WB- Wideband digital, 19.2 kb/s
WE- Wideband digital, 50 kb/s
WF- Wideband digital, 230.4 kb/s
WH- Wideband digital, 56 kb/s
WJ- Wideband analog, 60-108 khz
WL- Wideband analog 312-552 khz
WN- Wideband analog 10hz-20 khz
WP- Wideband analog, 29-44 khz
WR- Wideband analog 564-3064 khz
XA- Dedicated digital, 2.4 kb/s
XB- Dedicated digital, 4.8 kb/s
XG- Dedicated digital, 9.6 kb/s
XH- Dedecated digital 56. kb/s
Now the last two positions of real importance, 5 & 6 translate thusly:
Modifier Character Position 5
------------------------------
INTRASTATE INTERSTATE
-------------------------------------
A B Alternate data & non data
-------------------------------------
C Customer controlled Service
-------------------------------------
D E Data
-------------------------------------
N L Non-data operation
-------------------------------------
P Only offered under intra Restructured
private line (RPL) tariff (Payphones)
-------------------------------------
S T Simultanious data & non-data
-------------------------------------
F Interexchange Carriers is less than 50%
-------------------------------------
G Interstate carrier is more than 50% usage
===============================================================================
MODIFIER CHARACTER POSITION 6
--------------------------------------------------------------
TYPE OF SERVICE Intra LATA
--------------------------------------
ALL EXCEPT US GOVT US GOVERNMT
--------------------------------------
T M Circut is BOC customer to BOC customer
all facilitys are TELCO provided
--------------------------------------
C P Circut is BOC/BOC and part of facilitys
or equipment is telco provided
--------------------------------------
A J Circut is BOC/BOC all electricaly
connected equip is customer provided
--------------------------------------
L F Circut terminates at Interexchange
carrier customers location
--------------------------------------
Z Offical company service
--------------------------------------
Interlata
S S Circut terminates at Interexchange
carriers point of term (POT)
--------------------------------------
V V Circut terminates at an interface of a
Radio common carrier (RCC)
--------------------------------------
Z Official company service
--------------------------------------
Corridor
Y X Corridor circut
--------------------------------------
International
K H Circut has at least 2 terminations in
different countries
--------------------------------------
interexchange carrier
Y X Transport circut between Interexchange
carrier terminals.
----------------------------------------
So 64FDDV would be a private line data circut terminating at a radio common
carrier. Other examples can be decoded likewise.
Enjoy this information as much as I've had finding it, and bringing it to you!
-= The Mad Phone-man =-
Leeched from The Knight Society (716)745-3231
Downloaded From P-80 Systems 304-744-2253

278
textfiles.com/phreak/bellfax.txt Normal file
View File

@@ -0,0 +1,278 @@
PacBell FAX on several BUSTS !
August 3, 1987
MR. SPILLER
Frank:
I've attached a summary of some recent events that are alarming.
I believe this information should be shared with Mr. Kaplan? I've sent
a copy to Roland.
(signature)
W. M. Kern
COPY FOR: ROLAND DONALDSON
UNAUTHORIZED REMOTE COMPUTER ACCESS
San Francisco, July 29, 1987
Case Nos.: 86-883, 87-497
T. M. CASSANI, Director-Electronic Operations:
Electronic Operations recently investigated two cases involving a
number of sophisticated hackers who were adept at illegally
compromising public and private sector computers. Included among
the victims of these hackers was Pacific Bell, as well as other
local exchange carriers and long distance providers.
Below is a synopsis of the two cases (87-497 and 86-883), each
of which demonstrate weaknesses in Pacific Bell's remote access
dial-up systems.
Case No. 87-497
On May 14, 1987, Electronic Operations received a court order
directing Pacific Bell to place traps on the telephone numbers
assigned to a company known as "Santa Cruz Operations". The
court order was issued in order to identify the telephone number
being used by an individual who was illegally entering Santa
Cruz Operations' computer and stealing information.
On May 28, 1987, a telephone number was identified five separate
times making illegal entry into Santa Cruz Operations' computer.
The originating telephone number was 805-495-6191, which is
listed to Bonnie Vitello, 1378 E. Hillcrest Drive, Apt. 404,
Thousand Oaks, California.
On June 3, 1987, a search warrant was served at 1378 E. Hillcrest
Drive, Apt 404, Thousand Oaks, California. The residents of the
apartment, who were not at home, were identified as Bonnie
Vitello, a programmer for General Telephone, and Kevin Mitnick, a
known computer hacker. Found inside the apartment were three
computers, numerous floppy disks and a number of General
Telephone computer manuals.
Kevin Mitnick was arrested several years ago for hacking Pacific
Bell, UCLA and Hughes Aircraft Company computers. Mitnick was a
minor at the time of his arrest. Kevin Mitnick was recently
arrested for compromising the data base of Santa Cruz Operations.
The floppy disks that were seized pursuant to the search
warrant revealed Mitnick's involvment in compromising the
Pacific Bell UNIX operation systems and other data bases. The
disks documented the following:
o Mitnick's compromise of all Southern California SCC/ESAC
computers. On file were the names, log-ins, passwords, and
home telephone numbers for Northern and Southern ESAC
employees.
o The dial-up numbers and circuit identification documents
for SCC computers and Data Kits.
o The commands for testing and seizing trunk testing lines
and channels.
o The commands and log-ins for COSMOS wire centers for
Northern and Southern California.
o The commands for line monitoring and the seizure of dial
tone.
o References to the impersonation of Southern California
Security Agents and ESAC employees to obtain information.
o The commands for placing terminating and originating
traps.
o The addresses of Pacific Bell locations and the
Electronic Door Lock access codes for the following
Southern California central offices ELSG12, LSAN06, LSAN12,
LSAN15, LSAN23, LSAN56, AVLN11, HLWD01, HWTH01, IGWD01,
LOMT11, AND SNPD01.
o Inter-company Electronic Mail detailing new
login/password procedures and safeguards.
o The work sheet of an UNIX encryption reader hacker file.
If successful, this program could break into any UNIX system
at will.
Case No. 86-883
On November 14, 1986, Electronic Operations received a search
warrant directing Pacific Bell to trap calls being made to the
Stanford University computer. The Stanford Computer was being
illegally accessed and was then being used to access other large
computer systems throughout the country.
The calls to the Stanford Computer were routed through several
different common carriers and through numerous states. Through a
combination of traps, traces and sifting through information
posted on the Stanford computer, several suspects were identified
throughout the United States.
The group of computer hackers who illegally accessedd the Stanford
computer system were known as "The Legion of Doom". Subsequent
investigation indicated that the Legion of Doom was responsible
for:
o The use of Stanford University high-speed mainframes to
attack and hack ESAC/SCC mini compuuters with an UNIX
password hacker file. Password files were then stored on
the Stanford systems for other members of the Legion of Doom
to use. Login and passwords for every local exchange
carrier as well as AT&T SCC/ESAC mini computers were on file.
o The Legion of Doom used the Stanford computers to enter
and attack other institutions and private contractors'
computers. Some of the contractors' computers were used for
national defense research.
On July 21, 1987, eight search warrants were served in three
states at homes where members of the Legion of Doom reside.
Three of the searches were conducted in California. Steve
Dougherty, Senior Investigator-Electronic Operations, accompanied
Secret Service agents at the service of a search warrant at 2605
Trousdale Drive, Burlingame, California, which was the residence
of Stan Cisnero, a sixteen-year-old member of the Legion of Doom.
Dougherty interviewed Cisnero, who had used the pseudonym
"O'Ryan Quest", when accessing computers. During the interview,
Cisnero admitted the following:
o The entering of central offices, (Burlingame, San Mateo,
San Bruno, Millbrae) disguised as a Federal Express
deliveryman. The entries were done to case out the CO's
for the purpose of finding computer terminals with
telephones, the locations of switches and bays, the names of
Comtechs, and materials related to the operations of the
central office. Cisnero also claimed to have been in the
AT&T Administration office on Folsom Street, San Francisco.
o Cisnero's telephone service had been disconnected twice
for nonpayment, and twice he had his service restored by
impersonating a service representative.
o Learning to test circuits and trunks with his computer by
using ROTL and CAROT test procedures.
o Members of the Legion of Doom often accessed test trunks
to monitor each other's liness for fun.
o On several occasions Cisnero would post the telephone
number of a public coin phone for access to his BBS, Digital
IDS. He would then access teh Millbrae COSMOS wire center
and add call forwarding to the coin phone. He would
activate the call forwarding to his home telephone number,
securing the identity of his location.
o Cisnero would impersonate an employee who had
authorization to use a Data Kit and have it turned on for
him. When he was done, he would call back and have the Data
Kit turned off.
o Cisnero also would use his knowledge to disconnect and
busyout the telephone services of individuals he did not
like. Further, he would add several custom calling features
to their lines to create larger bills.
o It was very easy to use the test trunks with his computer
to seize another person's dial tone and make calls appear
on their bills. Cisnero did not admit charging 976 calls
to anyone, but he knew of others who did.
o When the Legion of Doom attacked a computer system, they
gave themselves five minutes to complete the hacking. If
they were not successful in five minutes, they would attempt
another system. The Legion of Doom was able to crack a
computer in under five minutes approximately 90% of the
time.
o Cisnero would impersonate employees to get non-published
telephone listings. Cisnero received the non-published
listing for Apple Computer Founder, Steve Wozniak, and
members of The Beastie Boys rock group.
o Cisnero told Dougherty of one New York member of the Legion
of Doom, "Bill from Arnoc", who has been placing his own traps
in New York. Bill from Arnoc helped Cisnero place traps in
Pacific Bell.
The review of the evidence seized at Cisnero's residence tends to
corroborate all Cisnero's statements.
CONCLUSIONS
There are some important conclusions that can be drawn from the
above two cases regarding future computer system concerns.
o The number of individuals capable of entering Pacific Bell
operating systems is growing.
o Computer Hackers are becoming more sophisticated in their
attacks.
o Dial-up ports will always be a target for computer entry by a
hacker.
o Even dial-up ports with remote callbacks and manually controlled
modems can be compromised.
o A hacker can place a central office off-line by overloading
a SCC mini computer by improperly placing traps or by putting
traps on several DID multi-trunk groups such as MCI or
Sprint groups.
o Terrorist or Organized Crime organizations could use this
underground computer technology against Pacific Bell or to
their own advantage.
o Pacific Bell proprietary data bases such as PTT ESAC or
PB2 ESAC could be compromised.
o The integrity of accurate customer billing statements have
been compromised through access to the CEBS (Computerized
Electronic Billing System) and will remain questionable. A
customer can dispute large direct-dialed calls and claim his
telephone was accessed by a computer hacker.
RECOMMENDATIONS
The information gained as a result of the above investigations
should be shared with those individuals responsible for the
integrity of our computer systems. Further, an ongoing business
partnership between security and the individuals responsible for
the integrity of our computer systems should be initiated and
maintained to ensure prompt, effective resolution of future
computer related security issues.
(signature)
JOHN E. VENN
Manager-Electronic Operations

270
textfiles.com/phreak/bellhell.1 Normal file
View File

@@ -0,0 +1,270 @@
////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**////////////////////////////////////////
///// ** M \\\\\\
\\\\\ ** Bell Hell Volume #1 E //////
///// ** T \\\\\\
\\\\\ ************ By: The Dutchman A C //////
///// Neon**Knights -Wired L O \\\\\\
\\\\\ ** M //////
///// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\ ** U //////
///// ** Call These Genocidal Systems... N \\\\\\
\\\\\ ** 0 I //////
///// ** /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]538-0761 C \\\\\\
\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]253-5300 A //////
///// METAL! The /\/\etal AE PW: KILL./..........[201]879-6668 T \\\\\\
\\\\\ KICKS! The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]696-7983 I //////
///// Milliways 10mgs BBS...........[609]921-1994 O \\\\\\
\\\\\ 7 Gates of Hell BBS.................[415]697-1320 N //////
///// The Mordor AE 1200bps/Cat-Fur/10mg[201]528-6467 S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////////
/////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
PREFACE: In this issue will discuss the different types of operators, area
codes and special numbers. This edition is made to give you a basic
understanding of the wicked ways of MA. I hope it'll give you a good enough
back ground to do well. Look for Bell Hell vol. 2 for more info on hacking.
=-=-=-=-=
OPERATORS:
=-=-=-=-=
Here we'll go over in detail some of the most common operators.
TSPS OPERATOR:
Trafic (us) Service Position System Operator is the bitch you commonly here
whenever you use a pay phone etc. To say the least she's a meat head. Her
responsibilities are as follows:
[1] Getting all billing information for Calling Cards and 3rd number calls.
[2] Making sure you get the right person on person-to-person calls.
[3] Making sure the fool on the other end will pay for your collect call (why
call collect?)
[4] Identifying calling numbers, or basically asking you,
'what number are you calling, please.' when the system fucks up.
Even though these operators are commonly ding-bats, you shouldn't screw with
them, for they are known to be quick with the tracer. She can even tell if you
are calling from a fortress phone. She has a portable all time ready tracer.
Beware of these deadly bitches.
INWARD OPERATORS:
This wench is basically an apprentice to the bitch above (TSPS) or commonly
the '0' operator. She will never question you as long as you are within her
dimension (service) area. She can only be reached by a mighty Blue Box
(discussed in up and coming tutorial) or another operator.
DIRECTORY ASSISTANCE OPERATORS:
(DOA?DAO?)
This is the operator you get when you call directory assistance (555-1212).
All she can do is either tell you a listed number or tell you if a number is
unlisted. Waste of time.
DEAF D.A.O.'S
This neat little operator is set up to help with directory assistance for deaf
people (who would they want to talk to?). She's reachable by dialing
800-855-1155. She talks to the deaf via Teletypewriters (terminals). If your
modem can transfer baudot (Oh those sweet Apple Cats can) then you can talk to
her. You might find her alot more friendly, more talkitive, and alot easier to
manipulate a number out of. However, she does use abbreviations like GA for go
ahead (pretty tricky huh).
CN/A OPERATORS
Oh the sweet CN/A, god bless its soul. These operators instead of giving you
information on a persons phone number, they give you information on a phone
numbers person (the person at 503-229-7600). However, if manipulated these
beauties can give you the number for an unlisted phone number (the number),
they have all kinds of access. This topic is discussed later in this tutorial.
INTERCEPT OPERATOR:
All places have their share of low lifes, well this is the scum, bottom of the
barrel of operators. She's the one you get when all the recordings are busy
(lower than a recording). Infact these dames can cause you more pains then a
recording. They only know a handful of english (around two sentences) and can
barely even say those. Even though they have no clue to what a trace is,
unless you know their native tongue, and then doubtfully, their just a pain in
the butt to deal with.
OTHER OPERATORS:
Well we have - marine verify, mobile, route and rate, ship to shore,
conference and a few other specific ones. No real help to us now.
*NOTES: Most operators have their own little Directory Assistance. If any
operator is giving you probs ask to speak with his/her/its supervisor. This
will freak them out. In rare loveable cases you might find a nice operator
with a number like (503-123-4567). Whenever you find a 0 or 1 in the 4th
number slot then you know need a Blue Box. It'll give you special access to
those hard to get wenches.
=-=-=-=-=-=-=-=
AREA CODES ETC.
=-=-=-=-=-=-=-=
HOW PHONE NUMBERS WORK:
Basiclly MA made our phone numbers quite simple. Here's how they work:
[A] The area code is what the call a three digit number plan area or NPA. This
means that an area code is just that, the code for an area.
[B] The rest of our number (ie. 666-7209) is divided into two segments. The
first being the Central Office number (666 would be N. Portland) and the
ending (7209) is the station number, or basically your assigned home number.
This complete combination (503-666-7209) is known as the destination code.
Here's how MA has developed the combo's:
[NPA] [TELEPHONE NUMBER]
X*Y XYY-YYYY
X = a number from 2-9
y = a number from 0-9
* = either 0 or 1
Normally an area code may never cross a states boundry, thus an area code
(NPA) may not be used for both New York and for Pennsylvania. However, as for
all other rules there is an exception. Here they are.
SPECIAL AREA CODES:
(SACS)
510 - TWX (USA)
610 - TWX (CANADA)
700 - NEW SERVICE
710 - TWX (USA)
800 - WATTS LINES
810 - TWX (USA)
900 - DIAL-IT SERVICES
910 - TWX (USA)
The explanations of these are as follows:
TWX:
Telex II, as you can see above there are 5 TWX machines. They are all owned by
Western Union. Normally these babes may only be accessed by other TWX
machines, however, if you do not wish to go and purchase one you can access
them by use of the Easylink, by Western Union. For more on this I would
suggest reading The Bioc Agents, and Tucs article on 'Hacking Western Union's
Easylink.'
700:
This is a new service for employees of AT&T in which someone (one of the
special employees) can call his own 700 number (say 700-292-9876), enters
his/her code, and where he is staying and then hangs up. If there is any new
info on the case he is working on, the computer will call him back and tell
him all the latest updates.
800:
There are basically two types of Watts Lines, Inward Watts and Outward watts.
These are probably some of the nicest of the special area codes since they
allow you to call for free. Here's an explanation of the two:
INWARD WATTS:
Inward Wide Area Telecommunications Service is probably the one your most
familiar with. MA has developed it so there are 6 different levels of Inwatts.
Level 6 being the whole U.S. (all 50 states) level 5 being all 48 contienental
states etc. all the way down to 1, only one state. Usually a company will get
a level 6 and then a level 1 because all though level 6 allows you to call
from anywhere in the U.S. it excludes the state where the call is terminated
at, so the company usually buys a level 1 for that state.
Interstate Inwatts are less common but still exist. These are the ones you can
only call from say one state. You can tell one quite easily for they all have
a 2 for the last central office number, or the 6th number (ie. 800-XY2-XXXX).
All companies that have an 800# must have at least two lines. This is because
if you call the first number (ie. 800-666-0190) and it rings busy the 800#
number will always go to another port to see if its busy. Inwatts customers
are billed by the hour instead of month like us.
OUTWARD WATTS:
Outwatts are just that, there for making outward calls only. Large companies
commonly use Outwatts since they recieve bulk discounts. Outwatt 800's are in
the form of:
800-*XX-XXXX
* may only be a 0 or 1 and can only be reached by way of box. The whole set,
*XX is the areas that are accessable by that comany.
900:
This is a nation number used for taking polls and the like (How do you think
they know what shows on the tube are k00l). The number for this service is,
900-555-1212. This will tell whats up on the system. Beware, this MA trick
will cost you 50 cents a minute, and 35 cents there after (ever heard of MA
being cheap?).
=-=-=-=-=
CO CODES
=-=-=-=-=
These are the way the switching office knows where to route the call. The
following codes are reserved nationwide:
555 - directory assistance
950 - future use
958 - plant test
959 - plant test
976 - dial-it services (weather etc.)
950:
This includes all special service. Heres a list of a few:
1000 - SPC
1022 - MCI Execunet
1033 - US Telephone
1044 - Allnet
1088 - SBS Skyline
*NOTE: These beauts are free from fortresses.
958,959:
These consist of ANI, Ringback and some other MA tests.
976:
Check this one out. Simply dial 976-1000. Alot of BBSs around will probably
have a more complete listing of these services.
=-=-=-=-=
N11 CODES:
=-=-=-=-=
I'm not sure which one of these are still in service. Basically MA wants to
dump these services, but alot are still in use, it'll vary with your area.
011 - international dialing prefix
211 - coin refund operator
411 - directory assistance
611 - repair service
811 - business office
911 - EMERGENCY
Downloaded From P-80 Systems 304-744-2253

377
textfiles.com/phreak/bellhell.2 Normal file
View File

@@ -0,0 +1,377 @@
///////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////
///// ** M \\\\\\
\\\\\ ** Bell Hell Volume #2 METAL! E //////
///// ** KICKS! T \\\\\\
\\\\\ ************ By: The Dutchman A C //////
///// Neon**Knights -Wired L O \\\\\\
\\\\\ ** M //////
///// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\ ** U //////
///// ** Call These Genocidal Systems... N \\\\\\
\\\\\ ** I //////
///// /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]538-0761 C \\\\\\
\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]253-5300 A //////
///// The /\/\etal AE PW: KILL............[201]879-6668 T \\\\\\
\\\\\ The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]696-7983 I //////
///// Milliways 10mgs BBS...........[609]921-1994 O \\\\\\
\\\\\ 7 Gates of Hell BBS.................[415]697-1320 N //////
///// The Mordor AE 1200bps/Cat-Fur/10mg[201]528-6467 S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////
///////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
/CONTENTS/
In vol. I we discussed some of the minor aspects of bell hell. Now we shall
enter the realm of serious bell hell, including how to crush AT&T's firm grip
on the wired industry and Ma's underground passages.
/MA'S CODES ETC./
In order to make things easier for her employees, Ma has given us not only
free access to almost all her treasures but guides next to them to help us
along the way. One of the more common boxes found are the ones located either
at the end of your street, in an adjacent field or on telephone poles. Any of
these boxes contains all the lines for the surrounding neighbourhood. Ma
usually supplys a code for the wires inside on the side of the door to one of
these boxes, if not the code usually goes like this:
Red (ring-) = Ring line, allows others to call you
Green (tip+) = Calling out line, for you to call others
Ma has conveniently located these, the red on the right and the green on the
left. If you run into one of these boxes and it's locked then you'll need to
purchase is either a 1/2" crowbar or an 7/16" hex driver, prefferably the
latter. In order to use the 7/16, simply give a 1/8" turn counter clockwise,
presto you are in. The crowbar is self explanatory I believe.
The other, and less likely to be found of the bell underground network is just
that, the underground network. To find one of these simply look for a manhole
cover with a bell in the middle instead of an S or what-ever you sanitary
dept. might use. The aspects and entry of these will be discussed later in
this article, now to the boxes.
Now that you are in one of these boxes there is a rather interesting list of
prospects you can do, connect a linesmans handset, connect a box, or eavesdrop
to name a few, here's some of the ways to do the following.
Hell #1:
/LINESMANS HANDSET/
In order to make a linesmans handset (if not included within the newly found
box) you'll need a few things:
1 a phone (prefferably a GTE flip fone or a slimline)
2 a spliceing knife (any knife will do, the sharper the better)
3 a set of alligator clamps (if not already within the box)
Now take your knife and cut off all the wires and the modular jack (if one)
saving the red (ring-) and green (tip+) wires. Now attach the alligator clips,
one to the red and one to the green, and your set. All you need do is attach
the alligator clips to the designated colors on the box (red - red/green -
green) and you have essentially become an extension of that line.
Hell #2:
/THE BLACK/BLUE BOX/
Finally a place where you can use that box of yours with minimal worries of
being caught (the only way would be to get caught red-handed). Ah yes, bell
hell at one of its finer points. Commonly it takes Ma about a month or so to
figure out the trip on this one.
If you are unfamilar with boxes, the black box allows others to call you free
where-as the blue box allows you to use operator lines and even become one of
the bitches (become an operator). For more info I would suggest consulting
black/blue box plans.
Use the normal plans for a black/blue box and make the following
modifications:
Equipment:
(1) SPST SWITCH (found at your local Trash Shack)
(1) 10K OHM 1/2 WATT 10% RESISTOR (same as above)
SOME EXTRA WIRE (same as above above)
Now disconnect the green wire in the box and connect it to one of the two
poles on the SPST switch. Take a piece of your extra wire connect one end to
the other pole on your SPST switch and the other end to the <RR> terminal. Now
place the 10k ohm resistor between the <RR> terminal and the <FF> terminal.
Connect it (the 10k ohm resistor) via wire to the two. The <RR> terminal
should have a green wire going to it and the <FF> terminal should have a white
and blue wire connected to it. Your finished product should look something
like this:
--/-/--
:S P S T:
-------
:: ::
-----GREEN WIRE--:: ::----<RR>
!
10K OHM
!
!
-----WHITE WIRE-----------\\
------BLUE WIRE-----------------<FF>
This is simply the basic wiring, if you decide to become one with advancement
you might try hooking up lights to go on when your online or perhaps a
recorder, what-ever you wish.
Hell #3
/EAVES-DROPPING/
There are many various ways to accomplish this, seeing how I like to stick to
basics I will describe what I feel is the easiest by far. First you need to
make a linesmans handset as mentioned above if you already haven't. Now simply
disconnect the sending end (the end you talk through) and listen in. From here
you can accomplish several various tasks. If you are into blackmail you can
hook up a tape recorder (if you want to do this you can leave me a msg. or
wait for another file later, its rather a long task) or you may simply hold
the recorder to the listening end of the phone. To find out about the line
etc. You can do a couple of things, first you can dial your ANI (automatic
number identification) and find out the line you are on, after this call, you
are a local CN/A (described below) and run a check on who's line it is etc.
This can bring all kinds of hell for those not-so-trustworthy wifes/husbands.
More Hell:
/OTHER TRICKS/
You can set up a conference call simply by dialing your conference operator
(0-700-456-1000) and setting it up, just do what she says. I suggest this
operator for her lines are superior to those of the bitchy PBX ones. Oh,
you'll also need to know that lines person, address etc. Just pull an ANI and
then an CN/A on it.
If you have an urge to get back at someone simply attach your linesmans
handset to the persons line (fine their line as mentioned many times before)
and leave it off the hook. You can imagine just how long it could take Ma's
loyal employees to discover the problem. Possibly weeks if not a month.
Using the persons line to call computer systems that trace. This also goes
under the heading 'getting back at people' for the hassles you'll cause them
when the line is traced to them is numerous, bitchy Ma employees tend to be
irrational, spoiled children when it comes to busting people.
Bugging the operator - self explanatory.
RAISE HELL
/Insider/ - The rest of this doc is mainly explanations, a little hell and a
few other things I decided to throw in instead of making another Vol.. It's
true purpose is to coincide with Vol. I, as well as take up space, the rest is
unknown.
-----------
800 EXTENDERS
-----------
Basically, 800 extenders are much like Save-Net or Am-Net going 800 instead of
local access numbers. With this one you can call anywhere in the U.S. for
free, of course you need the X digit code, but this is easily found. You use
these just like you would if you were using Save-Net, i.e. you would dial
1-800-XXX-XXXX, then enter in your X digit code and then the area code + the
number you wish to reach, i.e. 1800521167429125036358443, as you can see there
is an 800 number followed by a 4 digit code followed by a number wished to be
reached. Here's a few 800 extenders, theres many many more:
1-800- 1-800-
------- -------
245-4890 4 DIGITS 327-6713 4 DIGITS
243-7650 6 DIGITS 328-7112 4 DIGITS
654-8494 6 DIGITS 327-9895 7 DIGITS
327-9136 4 DIGITS 227-3414 4 DIGITS
682-4000 6 DIGITS 343-1844 4 DIGITS
858-9000 3 DIGITS 521-1674 4 DIGITS
537-3511 8 DIGITS 843-0698 9 dIGITS
=-=-=-=-=-=-=------------------------->
LOOP NUMBERS EXPLORED
Loop numbers simply connect two people together using two different numbers.
Thus these numbers always come in pairs, one being the higher one while the
other being the lower one. So if you were to use one, you would call one of
the pair and the other one would call the other one (you take the high road
I'll take the low road). Loop numbers are equal in quality as calling direct,
thus it would be the same quality as you would get calling your neighbour. If
you would happen to call a loop number and no one was on the other end one of
two things would happen, if you called the higher of the two you would here
silence, if you dialed the lower you would get a 1000 hertz tone. Heres a list
of some loop numbers:
Area Code 212
XXX-9979 (HIGH)
XXX-9977 (LOW)
XXX= 690,534,569,432,868,255,228,677,982,466,926,220,586,524,283
XXX-9906 (HIGH)
XXX-9900 (LOW)
XXX= 529,352,439,388
Where you see XXX you enter the prefix desired, thus if you wanted area code
212, you could choose a prefix say 690, so one person would dial 690-9906 and
the other 690-9900.
In order to scan for loop numbers you'll need a friend to help. Loop numbers
run in pairs, the combination is 00XX and XX99. So what you need is for one
person to scan one end while the other scans the upper (using the same
prefix). The hang side has no tone while the other gives off a 1000hz tone.
To use a loop number in order to start a conference call simply have one
person get on the hangside while another calls the conferenceing operator (PBX
operator will do). The person calling the operator (hopefully from a fortress
phone) should charge the call to the upper loop number (the one the other
person isn't on), when the operator calls to verify she'll get your freind,
who of course will accept all charges gladly.
=-=-=-=-=-=-=------------------------->
Customer name and address
(CN/A)
A CN/A operator is disagnated for the use of AT&T employees who need some
information on a certain person. Ex- A Bell cop got a persons name from a nark
or whatever, he needs more info about the person so he calls up the CN/A
operator and asks her for the persons where abouts. Ma has been nice enough to
grant these operators the knowledge of a few more things (Ma's slip up), such
as their phone number. Thus we can call up one of these operators, say,'Hi, my
names Joe Rodrequiz and I'm from the Lake Oswego Bell customer service
department, I need the following info on a 'Jack Suchos'.' Then you become
really nice and ask if you can have that persons phone number so you don't
have to go over there. Since these operators are human, and are easily conned
and are very informed they'll give you just about whatever you need to know.
However you must be polite and business like. Following is a list of CN/A's,
to use it, find your area code and the CN/A operators number will follow:
DUTCHMAN DIRECTORY
AREA CODE PHONE NUMBER
---------- ---------------
201 201-676-7070
202 301-384-9820
203 203-789-6815
204 204-949-0900
205 205-988-7000
206 206-382-8000
207 617-787-2750
208 303-399-4200
209 415-546-1341
212 518-471-8111
213 213-501-4144
214 214-948-5731
215 412-633-5600
216 614-464-2345
217 217-525-7000
218 402-345-0600
219 317-265-4834
301 301-534-1168
302 412-633-5600
303 303-399-4200
304 304-344-8041
305 912-784-9111
306 NONE....NONE
307 303-399-4200
308 402-345-0600
309 217-525-7000
312 312-796-9600
313 313-223-8690
314 314-726-7142
315 518-471-8111
316 816-275-2782
317 317-265-4834
318 318-227-1551
319 402-345-0600
401 617-787-2760
402 402-345-0600
403 403-425-2652
404 912-784-9111
405 405-236-6121
406 303-399-4200
408 415-546-1132
412 412-633-5600
413 617=787-2760
414 608-252-6932
415 415-546-1132
416 416-922-6686
417 314-726-7142
418 514-861-2635
419 614-464-2345
501 405-236-6121
502 502-583-2861
503 203-784-6815
504 504-245-5330
505 303-399-4200
506 506-657-3855
507 402-345-0600
509 206=382-8000
512 512-828-2501
513 714-464-2345
514 514-861-2635
515 402-345-0600
516 518-471-8111
517 313-223-8690
518 518-471-8000
519 416-922-6686
601 601-961-0877
602 303-399-4200
603 617-787-2750
604 604-432-2996
605 402-345-0600
606 502-583-2681
607 518-471-8111
608 608-252-6932
609 201-676-7070
612 402-345-0600
613 416-922-6686
614 614-464-2345
615 615-373-5791
616 313-223-8690
617 617-787-2750
618 217-525-7000
701 402-345-0600
702 415-546-1341
703 804-747-1411
704 912-784-9111
705 416-922-6686
707 415-546-1132
709 NONE....NONE
712 402-345-0600
713 713-820-4112
714 213-501-4144
715 608-252-6932
716 518-471-8111
717 412-633-5600
801 303-399-4200
802 617-787-2750
803 912-784-9111
804 804-747-1411
805 415-546-1341
806 512-828-2501
807 416-922-6686
808 212-334-4336
809 LIST BELOW
812 317-265-4834
813 813-223-9678
814 412-633-5600
815 217-525-7000
816 816-275-2782
817 214-948-5731
819 514-861-2635
901 615-373-5791
902 902-421-4110
903 NONE....NONE
904 912-784-9111
906 313-223-8690
907 NONE....NONE
912 912-784-9111
913 816-275-2782
914 518-471-8111
915 512-828-2501
916 415-546-1341
918 405-236-6121
919 912-784-9111
900+(DIAL-IT) NUMBERS: 212-334-3611
FOR BAHAMAS, BERMUDA, DOMINICAN REP, JAMAICA AND PUERTO RICO: 212-334-4336
Downloaded From P-80 Systems 304-744-2253

269
textfiles.com/phreak/bellhell1.hac Normal file
View File

@@ -0,0 +1,269 @@
////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**////////////////////////////////////////
///// ** M \\\\\\
\\\\\ ** Bell Hell Volume #1 E //////
///// ** T \\\\\\
\\\\\ ************ By: The Dutchman A C //////
///// Neon**Knights -Wired L O \\\\\\
\\\\\ ** M //////
///// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\ ** U //////
///// ** Call These Genocidal Systems... N \\\\\\
\\\\\ ** 0 I //////
///// ** /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]xxx-xxxx C \\\\\\
\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]xxx-xxxx A //////
///// METAL! The /\/\etal AE PW: KILL./..........[201]xxx-xxxx T \\\\\\
\\\\\ KICKS! The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]xxx-xxxx I //////
///// Milliways 10mgs BBS...........[609]xxx-xxxx O \\\\\\
\\\\\ 7 Gates of Hell BBS.................[415]xxx-xxxx N //////
///// The Mordor AE 1200bps/Cat-Fur/10mg[201]xxx-xxxx S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////////
/////////////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
PREFACE: In this issue will discuss the different types of operators, area
codes and special numbers. This edition is made to give you a basic
understanding of the wicked ways of MA. I hope it'll give you a good enough
back ground to do well. Look for Bell Hell vol. 2 for more info on hacking.
=-=-=-=-=
OPERATORS:
=-=-=-=-=
Here we'll go over in detail some of the most common operators.
TSPS OPERATOR:
Trafic (us) Service Position System Operator is the bitch you commonly here
whenever you use a pay phone etc. To say the least she's a meat head. Her
responsibilities are as follows:
[1] Getting all billing information for Calling Cards and 3rd number calls.
[2] Making sure you get the right person on person-to-person calls.
[3] Making sure the fool on the other end will pay for your collect call (why
call collect?)
[4] Identifying calling numbers, or basically asking you,
'what number are you calling, please.' when the system fucks up.
Even though these operators are commonly ding-bats, you shouldn't screw with
them, for they are known to be quick with the tracer. She can even tell if you
are calling from a fortress phone. She has a portable all time ready tracer.
Beware of these deadly bitches.
INWARD OPERATORS:
This wench is basically an apprentice to the bitch above (TSPS) or commonly
the '0' operator. She will never question you as long as you are within her
dimension (service) area. She can only be reached by a mighty Blue Box
(discussed in up and coming tutorial) or another operator.
DIRECTORY ASSISTANCE OPERATORS:
(DOA?DAO?)
This is the operator you get when you call directory assistance (555-1212).
All she can do is either tell you a listed number or tell you if a number is
unlisted. Waste of time.
DEAF D.A.O.'S
This neat little operator is set up to help with directory assistance for deaf
people (who would they want to talk to?). She's reachable by dialing
800-855-1155. She talks to the deaf via Teletypewriters (terminals). If your
modem can transfer baudot (Oh those sweet Apple Cats can) then you can talk to
her. You might find her alot more friendly, more talkitive, and alot easier to
manipulate a number out of. However, she does use abbreviations like GA for go
ahead (pretty tricky huh).
CN/A OPERATORS
Oh the sweet CN/A, god bless its soul. These operators instead of giving you
information on a persons phone number, they give you information on a phone
numbers person (the person at 503-229-7600). However, if manipulated these
beauties can give you the number for an unlisted phone number (the number),
they have all kinds of access. This topic is discussed later in this tutorial.
INTERCEPT OPERATOR:
All places have their share of low lifes, well this is the scum, bottom of the
barrel of operators. She's the one you get when all the recordings are busy
(lower than a recording). Infact these dames can cause you more pains then a
recording. They only know a handful of english (around two sentences) and can
barely even say those. Even though they have no clue to what a trace is,
unless you know their native tongue, and then doubtfully, their just a pain in
the butt to deal with.
OTHER OPERATORS:
Well we have - marine verify, mobile, route and rate, ship to shore,
conference and a few other specific ones. No real help to us now.
*NOTES: Most operators have their own little Directory Assistance. If any
operator is giving you probs ask to speak with his/her/its supervisor. This
will freak them out. In rare loveable cases you might find a nice operator
with a number like (503-123-4567). Whenever you find a 0 or 1 in the 4th
number slot then you know need a Blue Box. It'll give you special access to
those hard to get wenches.
=-=-=-=-=-=-=-=
AREA CODES ETC.
=-=-=-=-=-=-=-=
HOW PHONE NUMBERS WORK:
Basiclly MA made our phone numbers quite simple. Here's how they work:
[A] The area code is what the call a three digit number plan area or NPA. This
means that an area code is just that, the code for an area.
[B] The rest of our number (ie. 666-7209) is divided into two segments. The
first being the Central Office number (666 would be N. Portland) and the
ending (7209) is the station number, or basically your assigned home number.
This complete combination (503-666-7209) is known as the destination code.
Here's how MA has developed the combo's:
[NPA] [TELEPHONE NUMBER]
X*Y XYY-YYYY
X = a number from 2-9
y = a number from 0-9
* = either 0 or 1
Normally an area code may never cross a states boundry, thus an area code
(NPA) may not be used for both New York and for Pennsylvania. However, as for
all other rules there is an exception. Here they are.
SPECIAL AREA CODES:
(SACS)
510 - TWX (USA)
610 - TWX (CANADA)
700 - NEW SERVICE
710 - TWX (USA)
800 - WATTS LINES
810 - TWX (USA)
900 - DIAL-IT SERVICES
910 - TWX (USA)
The explanations of these are as follows:
TWX:
Telex II, as you can see above there are 5 TWX machines. They are all owned by
Western Union. Normally these babes may only be accessed by other TWX
machines, however, if you do not wish to go and purchase one you can access
them by use of the Easylink, by Western Union. For more on this I would
suggest reading The Bioc Agents, and Tucs article on 'Hacking Western Union's
Easylink.'
700:
This is a new service for employees of AT&T in which someone (one of the
special employees) can call his own 700 number (say 700-292-9876), enters
his/her code, and where he is staying and then hangs up. If there is any new
info on the case he is working on, the computer will call him back and tell
him all the latest updates.
800:
There are basically two types of Watts Lines, Inward Watts and Outward watts.
These are probably some of the nicest of the special area codes since they
allow you to call for free. Here's an explanation of the two:
INWARD WATTS:
Inward Wide Area Telecommunications Service is probably the one your most
familiar with. MA has developed it so there are 6 different levels of Inwatts.
Level 6 being the whole U.S. (all 50 states) level 5 being all 48 contienental
states etc. all the way down to 1, only one state. Usually a company will get
a level 6 and then a level 1 because all though level 6 allows you to call
from anywhere in the U.S. it excludes the state where the call is terminated
at, so the company usually buys a level 1 for that state.
Interstate Inwatts are less common but still exist. These are the ones you can
only call from say one state. You can tell one quite easily for they all have
a 2 for the last central office number, or the 6th number (ie. 800-XY2-XXXX).
All companies that have an 800# must have at least two lines. This is because
if you call the first number (ie. 800-666-0190) and it rings busy the 800#
number will always go to another port to see if its busy. Inwatts customers
are billed by the hour instead of month like us.
OUTWARD WATTS:
Outwatts are just that, there for making outward calls only. Large companies
commonly use Outwatts since they recieve bulk discounts. Outwatt 800's are in
the form of:
800-*XX-XXXX
* may only be a 0 or 1 and can only be reached by way of box. The whole set,
*XX is the areas that are accessable by that comany.
900:
This is a nation number used for taking polls and the like (How do you think
they know what shows on the tube are k00l). The number for this service is,
900-555-1212. This will tell whats up on the system. Beware, this MA trick
will cost you 50 cents a minute, and 35 cents there after (ever heard of MA
being cheap?).
=-=-=-=-=
CO CODES
=-=-=-=-=
These are the way the switching office knows where to route the call. The
following codes are reserved nationwide:
555 - directory assistance
950 - future use
958 - plant test
959 - plant test
976 - dial-it services (weather etc.)
950:
This includes all special service. Heres a list of a few:
1000 - SPC
1022 - MCI Execunet
1033 - US Telephone
1044 - Allnet
1088 - SBS Skyline
*NOTE: These beauts are free from fortresses.
958,959:
These consist of ANI, Ringback and some other MA tests.
976:
Check this one out. Simply dial 976-1000. Alot of BBSs around will probably
have a more complete listing of these services.
=-=-=-=-=
N11 CODES:
=-=-=-=-=
I'm not sure which one of these are still in service. Basically MA wants to
dump these services, but alot are still in use, it'll vary with your area.
011 - international dialing prefix
211 - coin refund operator
411 - directory assistance
611 - repair service
811 - business office
911 - EMERGENCY


376
textfiles.com/phreak/bellhell2.hac Normal file
View File

@@ -0,0 +1,376 @@
///////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////
///// ** M \\\\\\
\\\\\ ** Bell Hell Volume #2 METAL! E //////
///// ** KICKS! T \\\\\\
\\\\\ ************ By: The Dutchman A C //////
///// Neon**Knights -Wired L O \\\\\\
\\\\\ ** M //////
///// ** Thanx to: Baby Demon & The Metallian M \\\\\\
\\\\\ ** U //////
///// ** Call These Genocidal Systems... N \\\\\\
\\\\\ ** I //////
///// /\/\etalland 1 10mgs/AE/BBS/Cat-Fur[503]xxx-xxxx C \\\\\\
\\\\\ /\/\etalland ][ AE/Cat-Fur Line.....[503]xxx-xxxx A //////
///// The /\/\etal AE PW: KILL............[201]xxx-xxxx T \\\\\\
\\\\\ The Cheese ][ 10mgs/AE/BBS/Cat-Fur[409]xxx-xxxx I //////
///// Milliways 10mgs BBS...........[609]xxx-xxxx O \\\\\\
\\\\\ 7 Gates of Hell BBS.................[415]xxx-xxxx N //////
///// The Mordor AE 1200bps/Cat-Fur/10mg[201]xxx-xxxx S \\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\**///////////////////////////////////
///////////////////////////////**\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
/CONTENTS/
In vol. I we discussed some of the minor aspects of bell hell. Now we shall
enter the realm of serious bell hell, including how to crush AT&T's firm grip
on the wired industry and Ma's underground passages.
/MA'S CODES ETC./
In order to make things easier for her employees, Ma has given us not only
free access to almost all her treasures but guides next to them to help us
along the way. One of the more common boxes found are the ones located either
at the end of your street, in an adjacent field or on telephone poles. Any of
these boxes contains all the lines for the surrounding neighbourhood. Ma
usually supplys a code for the wires inside on the side of the door to one of
these boxes, if not the code usually goes like this:
Red (ring-) = Ring line, allows others to call you
Green (tip+) = Calling out line, for you to call others
Ma has conveniently located these, the red on the right and the green on the
left. If you run into one of these boxes and it's locked then you'll need to
purchase is either a 1/2" crowbar or an 7/16" hex driver, prefferably the
latter. In order to use the 7/16, simply give a 1/8" turn counter clockwise,
presto you are in. The crowbar is self explanatory I believe.
The other, and less likely to be found of the bell underground network is just
that, the underground network. To find one of these simply look for a manhole
cover with a bell in the middle instead of an S or what-ever you sanitary
dept. might use. The aspects and entry of these will be discussed later in
this article, now to the boxes.
Now that you are in one of these boxes there is a rather interesting list of
prospects you can do, connect a linesmans handset, connect a box, or eavesdrop
to name a few, here's some of the ways to do the following.
Hell #1:
/LINESMANS HANDSET/
In order to make a linesmans handset (if not included within the newly found
box) you'll need a few things:
1 a phone (prefferably a GTE flip fone or a slimline)
2 a spliceing knife (any knife will do, the sharper the better)
3 a set of alligator clamps (if not already within the box)
Now take your knife and cut off all the wires and the modular jack (if one)
saving the red (ring-) and green (tip+) wires. Now attach the alligator clips,
one to the red and one to the green, and your set. All you need do is attach
the alligator clips to the designated colors on the box (red - red/green -
green) and you have essentially become an extension of that line.
Hell #2:
/THE BLACK/BLUE BOX/
Finally a place where you can use that box of yours with minimal worries of
being caught (the only way would be to get caught red-handed). Ah yes, bell
hell at one of its finer points. Commonly it takes Ma about a month or so to
figure out the trip on this one.
If you are unfamilar with boxes, the black box allows others to call you free
where-as the blue box allows you to use operator lines and even become one of
the bitches (become an operator). For more info I would suggest consulting
black/blue box plans.
Use the normal plans for a black/blue box and make the following
modifications:
Equipment:
(1) SPST SWITCH (found at your local Trash Shack)
(1) 10K OHM 1/2 WATT 10% RESISTOR (same as above)
SOME EXTRA WIRE (same as above above)
Now disconnect the green wire in the box and connect it to one of the two
poles on the SPST switch. Take a piece of your extra wire connect one end to
the other pole on your SPST switch and the other end to the <RR> terminal. Now
place the 10k ohm resistor between the <RR> terminal and the <FF> terminal.
Connect it (the 10k ohm resistor) via wire to the two. The <RR> terminal
should have a green wire going to it and the <FF> terminal should have a white
and blue wire connected to it. Your finished product should look something
like this:
--/-/--
:S P S T:
-------
:: ::
-----GREEN WIRE--:: ::----<RR>
!
10K OHM
!
!
-----WHITE WIRE-----------\\
------BLUE WIRE-----------------<FF>
This is simply the basic wiring, if you decide to become one with advancement
you might try hooking up lights to go on when your online or perhaps a
recorder, what-ever you wish.
Hell #3
/EAVES-DROPPING/
There are many various ways to accomplish this, seeing how I like to stick to
basics I will describe what I feel is the easiest by far. First you need to
make a linesmans handset as mentioned above if you already haven't. Now simply
disconnect the sending end (the end you talk through) and listen in. From here
you can accomplish several various tasks. If you are into blackmail you can
hook up a tape recorder (if you want to do this you can leave me a msg. or
wait for another file later, its rather a long task) or you may simply hold
the recorder to the listening end of the phone. To find out about the line
etc. You can do a couple of things, first you can dial your ANI (automatic
number identification) and find out the line you are on, after this call, you
are a local CN/A (described below) and run a check on who's line it is etc.
This can bring all kinds of hell for those not-so-trustworthy wifes/husbands.
More Hell:
/OTHER TRICKS/
You can set up a conference call simply by dialing your conference operator
(0-700-456-1000) and setting it up, just do what she says. I suggest this
operator for her lines are superior to those of the bitchy PBX ones. Oh,
you'll also need to know that lines person, address etc. Just pull an ANI and
then an CN/A on it.
If you have an urge to get back at someone simply attach your linesmans
handset to the persons line (fine their line as mentioned many times before)
and leave it off the hook. You can imagine just how long it could take Ma's
loyal employees to discover the problem. Possibly weeks if not a month.
Using the persons line to call computer systems that trace. This also goes
under the heading 'getting back at people' for the hassles you'll cause them
when the line is traced to them is numerous, bitchy Ma employees tend to be
irrational, spoiled children when it comes to busting people.
Bugging the operator - self explanatory.
RAISE HELL
/Insider/ - The rest of this doc is mainly explanations, a little hell and a
few other things I decided to throw in instead of making another Vol.. It's
true purpose is to coincide with Vol. I, as well as take up space, the rest is
unknown.
-----------
800 EXTENDERS
-----------
Basically, 800 extenders are much like Save-Net or Am-Net going 800 instead of
local access numbers. With this one you can call anywhere in the U.S. for
free, of course you need the X digit code, but this is easily found. You use
these just like you would if you were using Save-Net, i.e. you would dial
1-800-XXX-XXXX, then enter in your X digit code and then the area code + the
number you wish to reach, i.e. 1800521167429125036358443, as you can see there
is an 800 number followed by a 4 digit code followed by a number wished to be
reached. Here's a few 800 extenders, theres many many more:
1-800- 1-800-
------- -------
245-4890 4 DIGITS 327-6713 4 DIGITS
243-7650 6 DIGITS 328-7112 4 DIGITS
654-8494 6 DIGITS 327-9895 7 DIGITS
327-9136 4 DIGITS 227-3414 4 DIGITS
682-4000 6 DIGITS 343-1844 4 DIGITS
858-9000 3 DIGITS 521-1674 4 DIGITS
537-3511 8 DIGITS 843-0698 9 dIGITS
=-=-=-=-=-=-=------------------------->
LOOP NUMBERS EXPLORED
Loop numbers simply connect two people together using two different numbers.
Thus these numbers always come in pairs, one being the higher one while the
other being the lower one. So if you were to use one, you would call one of
the pair and the other one would call the other one (you take the high road
I'll take the low road). Loop numbers are equal in quality as calling direct,
thus it would be the same quality as you would get calling your neighbour. If
you would happen to call a loop number and no one was on the other end one of
two things would happen, if you called the higher of the two you would here
silence, if you dialed the lower you would get a 1000 hertz tone. Heres a list
of some loop numbers:
Area Code 212
XXX-9979 (HIGH)
XXX-9977 (LOW)
XXX= 690,534,569,432,868,255,228,677,982,466,926,220,586,524,283
XXX-9906 (HIGH)
XXX-9900 (LOW)
XXX= 529,352,439,388
Where you see XXX you enter the prefix desired, thus if you wanted area code
212, you could choose a prefix say 690, so one person would dial 690-9906 and
the other 690-9900.
In order to scan for loop numbers you'll need a friend to help. Loop numbers
run in pairs, the combination is 00XX and XX99. So what you need is for one
person to scan one end while the other scans the upper (using the same
prefix). The hang side has no tone while the other gives off a 1000hz tone.
To use a loop number in order to start a conference call simply have one
person get on the hangside while another calls the conferenceing operator (PBX
operator will do). The person calling the operator (hopefully from a fortress
phone) should charge the call to the upper loop number (the one the other
person isn't on), when the operator calls to verify she'll get your freind,
who of course will accept all charges gladly.
=-=-=-=-=-=-=------------------------->
Customer name and address
(CN/A)
A CN/A operator is disagnated for the use of AT&T employees who need some
information on a certain person. Ex- A Bell cop got a persons name from a nark
or whatever, he needs more info about the person so he calls up the CN/A
operator and asks her for the persons where abouts. Ma has been nice enough to
grant these operators the knowledge of a few more things (Ma's slip up), such
as their phone number. Thus we can call up one of these operators, say,'Hi, my
names Joe Rodrequiz and I'm from the Lake Oswego Bell customer service
department, I need the following info on a 'Jack Suchos'.' Then you become
really nice and ask if you can have that persons phone number so you don't
have to go over there. Since these operators are human, and are easily conned
and are very informed they'll give you just about whatever you need to know.
However you must be polite and business like. Following is a list of CN/A's,
to use it, find your area code and the CN/A operators number will follow:
DUTCHMAN DIRECTORY
AREA CODE PHONE NUMBER
---------- ---------------
201 201-676-7070
202 301-384-9820
203 203-789-6815
204 204-949-0900
205 205-988-7000
206 206-382-8000
207 617-787-2750
208 303-399-4200
209 415-546-1341
212 518-471-8111
213 213-501-4144
214 214-948-5731
215 412-633-5600
216 614-464-2345
217 217-525-7000
218 402-345-0600
219 317-265-4834
301 301-534-1168
302 412-633-5600
303 303-399-4200
304 304-344-8041
305 912-784-9111
306 NONE....NONE
307 303-399-4200
308 402-345-0600
309 217-525-7000
312 312-796-9600
313 313-223-8690
314 314-726-7142
315 518-471-8111
316 816-275-2782
317 317-265-4834
318 318-227-1551
319 402-345-0600
401 617-787-2760
402 402-345-0600
403 403-425-2652
404 912-784-9111
405 405-236-6121
406 303-399-4200
408 415-546-1132
412 412-633-5600
413 617=787-2760
414 608-252-6932
415 415-546-1132
416 416-922-6686
417 314-726-7142
418 514-861-2635
419 614-464-2345
501 405-236-6121
502 502-583-2861
503 203-784-6815
504 504-245-5330
505 303-399-4200
506 506-657-3855
507 402-345-0600
509 206=382-8000
512 512-828-2501
513 714-464-2345
514 514-861-2635
515 402-345-0600
516 518-471-8111
517 313-223-8690
518 518-471-8000
519 416-922-6686
601 601-961-0877
602 303-399-4200
603 617-787-2750
604 604-432-2996
605 402-345-0600
606 502-583-2681
607 518-471-8111
608 608-252-6932
609 201-676-7070
612 402-345-0600
613 416-922-6686
614 614-464-2345
615 615-373-5791
616 313-223-8690
617 617-787-2750
618 217-525-7000
701 402-345-0600
702 415-546-1341
703 804-747-1411
704 912-784-9111
705 416-922-6686
707 415-546-1132
709 NONE....NONE
712 402-345-0600
713 713-820-4112
714 213-501-4144
715 608-252-6932
716 518-471-8111
717 412-633-5600
801 303-399-4200
802 617-787-2750
803 912-784-9111
804 804-747-1411
805 415-546-1341
806 512-828-2501
807 416-922-6686
808 212-334-4336
809 LIST BELOW
812 317-265-4834
813 813-223-9678
814 412-633-5600
815 217-525-7000
816 816-275-2782
817 214-948-5731
819 514-861-2635
901 615-373-5791
902 902-421-4110
903 NONE....NONE
904 912-784-9111
906 313-223-8690
907 NONE....NONE
912 912-784-9111
913 816-275-2782
914 518-471-8111
915 512-828-2501
916 415-546-1341
918 405-236-6121
919 912-784-9111
900+(DIAL-IT) NUMBERS: 212-334-3611
FOR BAHAMAS, BERMUDA, DOMINICAN REP, JAMAICA AND PUERTO RICO: 212-334-4336


362
textfiles.com/phreak/bellinfo.phk Normal file
View File

@@ -0,0 +1,362 @@
==)--- P TO PAUSE S TO STOP ---(==

/-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\
! Bell Telephone Info !
! !
! Courtesy of: !
! !
! The Lost City of Atlantis !
! !
! <215>-<844>-<8836> !
! !
! !
\-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/
***************************************
BRIDGING HEADS, RESIDENTIAL AND
BUSINESS MULTILINE DISTRIBUTION BOXES,
LINE AND TRUNK SPLITTERS, AND
OTHER BELL SYSTEM WIRE TERMINATIONS.
- HOW TO USE, AND/OR ABUSE THEM -
(INCLUDING A TUTORIAL ON BASIC TELE-
PHONE EAVESDROPPING TECHNIQUES.)
***************************************
WRITTEN BY : PHUCKED
AGENT 07/29/84
04
REVISED FOR LOD! 10/84
CURRENTLY REVISION II
***************************************
IN THIS ARTICLE, I WILL FIRST
BESCRIBE THE TERMINATION, WIRING, AND
TERMINAL HARDWARE MOST COMMONLY USED
IN THE BELL SYSTEM, AND I WILL INCLUDE
A SECTION ON METHODS OF USING THEM.
***************************************
-------------
LOCAL NETWORK
-------------
THE LOCAL TELEPHONE NETWORK
BETWEEN THE CENTRAL OFFICE/EXCHANGE AND
THE TELEPHONE SUBSCRIBERS CAN BE
BREIFLY DESCRIBED AS FOLLOWS:
FROM THE CENTRAL OFFICE (OR
LOCAL EXCHANGE) OF A CERTAIN PREFIX
(ES), UNDERGROUND AREA FEEDER TRUNKS
GO TO EACH AREA THAT HAS THAT PREFIX.
(USUALLY MORE THAN ONE PREFIX PER AREA)
AT EVERY FEW STREETS OR TRACT AREAS,
THE UNDERGROUND CABLES SURFACE. THEY
THEN GO TO THE SECONDARY TERMINATION,
(THE AERIAL TELEPHONE FEEDER CABLE)
(OR BACK UNDERGROUND, DEPENDING ON THE
AREA) AND THEN TO THE SUBSRIBERS HOUSE
(OR IN THE CASE OF AN APARTMENT
BUILDING OR MUTLILINE BUSINESS, TO
A SPLITTER OR DISTRIBUTION BOX/PANEL).
****************************************
NOW THAT WE HAVE THE BASICS, I'LL TRY
AND GO IN-DEPTH ON THE SUBJECT.
------------------
UNDERGROUND CABLES
------------------
THESE ARE SOMETIMES INTER-
OFFICE TRUNKS, BUT USUALLY IN A RESID-
ENTIAL AREA THEY ARE FEEDER GROUPS THAT
GO OTO BRIDGING HEADS OR DISTRIBUTION
CASES. THE CABLES ARE ABOUT 2-3 INCHES
THICK (VARIES), AND ARE EITHER IN A
METAL OR PVC-TYPE PIPE (OR SIMILAR).
RARELY (MAYBE NOT IN SOME REMOTE RURAL
AREAS) ARE THE CABLES JUST 'ALONE' IN
THE GROUND. INSTEAD, THEY ARE USUALLY
IN AN UNDERGROUND CEMENT TUNNEL
(RESEMBLES A SMALL SEWER OR STORMDRAIN)
. THE MANHOLES ARE >HEAVY< AND WILL SAY
'BELL SYSTEM' ON THEM. THEY CAN BE OPEN
ED WITH A 1/2 INCH WIDE CROWBAR (HOOK
SIDE) INSERTED IN THE TOP RECTANGULAR
HOLE. IF YOU GET IT OPEN, GO INSIDE!!
THERE ARE LADDER RUNGS TO HELP YOU
CLIMB DOWN. YOU WILL SEE THE CABLE
PIPES ON THE WALL, WITH THE BLUE AND
WHITE STRIPED ONE BEING THE INTER-
OFFICE TRUNK GRP (AT LEAST IN MY AREA).
THE OTHERS ARE LOCAL LINES, AND ARE
USUALLY MARKED OR COLOR CODED. THERE
IS ALMOST ALWAYS A POSTED COLOR CODE
CHART ON THE WALL, NOT TO MENTION
TELCO MANUALS DESCRIBING THE CABLES
AND TERMINALS, SO I NEED NOT GET INTO
DETAIL. AGAIN: >IF YOU CAN GET INTO A
BELL MANHOLE, DO IT!, IT WILL PAY OFF
<. ALSO, THERE IS USUALLY SOME KIND
OF TEST EQUIPMENT, AND OFTEN BELL
TEST SETS ARE LEFT IN THERE.
SO GET YOUR CROWBARS!
****************************************
--------------
BRIDGING HEADS - (WE MS2'S)
--------------
THE INNOCENT-LOOKING GRAYISH-
GREEN BOXES.
WHEN IN GROUPS OF TWO OR THREE, THEY
ARE FOR SECONDAY/TERTIARY TERMINATION
AND ACCESS POINTS (BRIDGED ACCESS).
THESE ARE THE WESTERN ELECTRIC SAI
55 OR 22/E TERMINAL CASES. THEY HOLD
ON THE ORDER OF 900-1200 CABLE PAIRS.
THIS IS USUALLY THE SECOND TERM. POSI
TION ON THE LOCAL LOOP (AFTER THE MTF
FRAME AT THE CO/ OR THE UNDERGROUND
'FTP' POSITION).
THESE CAN BE EITHER
TRUNK BRIDGES OR BRIDGING FOR RESIDEN
CES. THE AREA FEEDER BRIDGING HEADS
ARE USUALLY LARGER, AND THEY HAVE THE
'WESTERN ELECTRIC' LOGO AT THE BOTTOM,
WHEREAS THE NORMAL BRIDGING HEADS
(WHICH MAY BE DIFFERENT IN SOME AREAS-
DEPENDING ON THE COMPANY YOU ARE
SERVED BY. GTE B.H'S LOOK SLIGHTLY
DIFFERENT. ALSO, DO NOT BE FOOLED
BY SPRINKLER BOXES!)
CAN BE FOUND IN JUST ABOUT EVERY CITY.
TO OPEN A BRIDGING HEAD:
IF IT IS LOCKED (AND YOU'RE FEELING
DESTRUCTIVE), PUT A HAMMER OR CROWBAR
(THE SAME ONE YOU USED ON THE MANHOLE
) IN THE SLOT ABOVE THE TOP HINGE OF
THE RIGHT DOOR. PULL HARD, AND THE
DORR WILL RIP OFF. VERY EFFECTIVE!
IF IT ISN'T LOCKED (AS USUAL),
TAKE A 7/16 INCH HEX SOCKET AND
WITH IT, TURN THE BOLT ABOUT 1/8 OF A
TURN TO THE LEFT (YOU SHOULD HEAR
A SPRING RELEASE INSIDE). HOLDING THE
BOLT, TURN THE HANDLE ALL THE WAY TO
THE RIGHT AND PULL OUT.
NOW INSIDE, FIRST CHECK FOR
A TEST-SET (WHICH ARE OFTEN LEFT BY
BELL EMPLOYEES). THERE SHOULD BE A
PANEL OF CABLE PAIRS + SCREW TERMINALS
(TYPE 45/47IB REGULAR BINDERS) . PUSH
THE PANEL BACK ABOUT AN INCH OR SO,
AND ROTATE THE TOP LATCH (ROUND WITH
A FLAT SECTION) DOWNWARD. RELEASE THE
PANEL AND IT WILL FALL ALL THE WAY
FORWARD. THERE IS USUALLY A LARGE AMO-
UNT OF WIRE AND EXTRA TERMINALS.
THE TEST-SETS ARE OFTEN HIDDEN HERE,
SO DONT OVERLOOK IT (400 FOOT ROLLS OF
#22 SOLID WIRE ARE OFTEN NEAR THE TOP
IN THE BACK OF THE BOX. 'BORROW THEM')
. ON THE RIGHT DOOR IS A METAL BOX OF
INSULATORS, BINDERS, CLIPS, ETC. TAKE
A FEW (COMPLIMENTS OF BELL...). ON EACH DOOR IS A USEFUL ROUND METAL DEVICE.
(SAYS 'INSERT GENTLY' OR 'CLAMP GENTLY
- DO NOT OVERTIGHTEN' ETC..) ON THE
FRONT OF THE DISC, YOU SHOULD FIND TWO
TERMINALS. THESE ARE FOR YOUR TEST SET.
(IF YOU DONT HAVE ONE, DONT DEPAIR -
I'LL SHOW YOU WAYS TO MAKE BASIC TEST
SETS LATER IN THIS ARTICLE).
HOOKING THE RING (-) WIRE TO THE
'R' TERMINAL; AND THE TIP (+) WIRE
TO THE OTHER. (BY THE WAY, AN EASY WAY
TO DETERMINE THE CORRECT POLARITY IS
WITH A 1.5V LED. TAP IT TO THE TERM.
PAIR, IF I DOESNT LIGHT, SWITCH THE
POLES UNTIL IT DOES. WHEN IT LIGHTS,
FIND THE LONGER OF THE TWO LED POLES.
THIS ONE WILL BE ON THE TIP WIRE (+))
BEHIND THE DISC IS A COILED UP CORD.
THIS SHOULD HAVE A SPECIALIZED CONNECT-
OR. ITS VERY USEFUL, BECAUSE YOU
DONT HAVE TO KEEP CONNECTING AND
DISCONNECTING THE FONE (TEST SET)
ITSELF, AND THE CLIP IS DESIGNED TO AID
IN LOCATING THE PAIR AND ASSURING THE
CORRECT POLARITY.
ON THE TERMINAL BOARD, THERE
SHOULD BE ABOUT 20 PAIRS (RED/WHITE)
PER ROW PER SIDE.
HOOK THE CLIP TO ANY TERMINAL PAIR
, AND YOU'RE SET! DIAL OUT IF YOU WANT,
OR JUST LISTEN (IF SOMEONE'S ON THE
LINE). LATER, I'LL SHOW YOU A WAY TO
SET UP A TRUE 'TAP' THAT YOU CAN SET
UP, AND WILL LET THE PERSON DIAL OUT
ON HIS LINE AND RECEIVE CALLS AS
NORMAL, AND YOU CAN LISTEN IN THE
WHOLE TIME. MORE ABOUT THIS LATER...
ON MAJOR PREFIX-AREA BRIDGING
HEADS ('SAI' FOR AREA C.O. FEEDER CABLE
) YOU CAN SEE TEMPORARY 'LOCAL LOOPS',
WHICH ARE TWO CABLE PAIRS (CABLE
PAIR = RING+TIP, A FONE LINE) THAT
ARE DIRECTLY CONNECTED TO EACH OTHER
ON THE TERMINAL BOARD. THESE 'CHEAP
LOOPS' AS THEY ARE CALLED, DO NOT
WORK NEARLY AS WELL AS THE EXISTING
ONES SET UP IN THE SWITCHING HARDWARE
AT THE EXCHANGE OFFICE. (TRY SCANNING
YOUR PREFIXES' 00XX OR 99XX #'S.
THE TONE SIDES WILL ANNOUNCE THEMSELVES
WITH THE 1000 HZ LOOP TONE, AND THE
HANG SIDE WILL GIVE NO RESPONSE. THE
FIRST PERSON SHOULD DIAL THE 'HANG'
SIDE, AND THE OTHER PERSON DIAL THE,
TONE SIDE, AND THE TONE SHOULD STOP
IF YOU HAVE GOT THE RIGHT LOOP).
THE LOOPS ARE USED IN FRAME TERMINATI
ON AND IN SONIC/600 OHM TERM. TESTING
AND LINE/CABLE/FEEDER LOCATION.
IF YOU WANT TO FIND THE NUMBER
OF THE LINE THAT YOU'RE ON, YOU CAN
EITHER TRY TO DECIPHER THE 'BRIDGING
LOG' (OR WHATEVER), WHICH IS ON THE
LEFT DOOR. IF THAT DOESNT WORK, YOU
CAN USE THE FOLLWING:
---
ANI # (AUTOMATIC NUMBER INDENTICATION)
---
THIS IS A TELCO TEST NUMBER
THAT REPORTS TO YOU THE NUMBER THAT
YOURE CALLING FROM (IT'S THE SAME,
CHOPPY 'BELL BITCH' VOICE THAT YOU
GET WHEN YOU REACH A DISCONNECTED #)
(PIP OR ONE OF THE 11X SERIES ANNOUNCE
MENT FRAME MACHINES.)
FOR THE 213 NPA - DIAL 1223
213 NPA - (GTE AREAS) DIAL 114
408 NPA - DIAL 760
914 NPA - DIAL 990
THESE ARE EXTREMELY USEFUL WHEN MESSING
WITH ANY KIND OF LINE TERMINALS,
FEEDER BOXES, ETC.
----------
WHEN FINISHED, BE SURE TO CUT
OFF THE CONNECTOR AND TAKE IT WITH YOU
(THEY ARE VERY HANDY), AND CLOSE/LATCH
THE BOX TO AVOID SUSPICION.
***************************************
------
"CANS" - AERIAL-MOUNTED (TELEPHONE POLE
------ TERMINAL) BRANCH FEEDER CABLE
SPLITTER.
BASICALLY, TWO TYPES:
1> MS3A SERVICE AREA INTERFACE.
(LARGE, RECTANGULAR SILVER BOX AT
THE END OF EACH STREET.)
2> SERIES 600 LOADING COIL, INCLUDES
THE MSX AERIAL DROP SPLITTER.
(BLACK, ROUND OR RECTANGULAR THING
AT EVERY TELEPHONE POLE.)
--------
TYPE 1 - THIS IS THE CASE THAT TAKES
THE UNDERGROUND CABLE FROM THE BRIDGER
AND RUNS IT TO THE AERIAL BRANCH FEEDER
CABLE (THE LOWEST, LARGEST WIRE ON THE
TELEPHONE POLE). THE BOX IS ALWAYS ON
THE POLE NEAREST THE BRIGING HEAD,
WHERE THE LINE COMES UP. LOOK FOR THE
'CALL BEFORE YOU DIG - UNDERGROUND
CABLE' STICKERS..
THE CASE BOX IS HINGED, SO IF
YOU WANT TO CLIMB THE POLE, YOU CAN
OPEN IT WITH NO PROBLEMS. THESE USUALLY
HAVE 2 ROWS OF TERMINAL SETS.
(TOTAL APPROX. 200-600 PAIRS, DEPENDING
ON THE AREA.) THESE ARE ALL THE CABLE
PAIRS FOR YOUR STREET.
. (ITS SIMILAR TO A MINIATURE BRIDGING
HEAD). USE/ABUSE IT IN THE SAME MANNER
AS WE DID BEFORE. (NOTE: ALL THE ACTIVE
LINES CARRY FROM 15 TO 48 VDC, AND
EVEN 90VAC (WHEN RINGING), SO BE
CAREFUL - IT'S NOT GOING TO HURT YOU,
BUT IT CAN SURPRISE YOU (AND IF
YOU'RE HANGING BY ONE HAND FROM A TEL.
POLE, IT >CAN< BE HARMFUL!))
OH, BY THE WAY, IF YOU USE
ANI ON EVERY PAIR AND YOU FIND ONE
THAT ISNT IN USE ON YOUR STREET, YOU
CAN HOOK IT UP FOR YOURSELF (ALMOST).
ALSO, YOU HAVE TO BE ABLE TO IMPER-
SONATE A TELCO TECHNICIAN AND REPORT
THE NUMBER AS 'NEW ACTIVE' (GIVING
A FAKE NAME AND FAKE REPORT, ETC)
I DONT RECOMMEND THIS AND IT PROBABLY
WONT (ALMOST POSITIVELY WONT) WORK,
BUT THIS IS BASICALLY WHAT TELCO
LINEMEN DO).*
* THE USE OF THE 'TEST BOARD'
(A 7D# FOR LINEMEN TESTS, OFTEN FOUND
NXX-0003 OR NXX-0004) IS BEYOND THE
SCOPE OF THIS ARTICLE, BUT WILL BE
COVERED IN A FUTURE ARTICLE.
----
TYPE 2 - THIS IS THE SPLITTER BOX FOR
THE AERIAL DROP WIRES FOR THE GROUP OF
HOUSES AROUND THE POLE.
(USUALLY 4 OR 5 HOUSES). USE IT
LIKE I MENTIONED BEFORE. THE TERMINALS
(20 OR SO) WILL BE IN 2 HORIZONTAL
ROWS OF SETS. THE EXTRA WIRES THAT ARE
JUST 'HANGING THERE' ARE PROVISIONS
FOR EXTRA LINES TO RESIDENCES (1 EXTRA
LINE PER HOUSE, THATS WHY THE INSANE
CHARGE FOR LINE #3). IF ITS THE BOX FOR
YOUR HOUSE ALSO, HAVE FUN AND SWAP
LINES WITH YOUR NEIGHBOR! 'PIGGYBACK'
THEM OR USE A CHEESEBOX FOR A LOOP-ARO
UND, ETC.
AGAIN, I DONT RECOMMEND THIS, AND ITS
DIFFICULT TO DO IT CORRECTLY. (ALTHOUGH
USEFUL)
***************************************
---------------------------------------
DOWNLOADED FROM P-80 SYSTEMS.

26
textfiles.com/phreak/bellraid.phk Normal file
View File

@@ -0,0 +1,26 @@
THE FOLLLOWING MATERIAL WAS DOWNLOADED FROM THE NJIT EIES CONFERENCES C866 -
Microcomputer Communications and C685 - The Future of Telecommunications I think that you may find this disturbing as I and most of my fellow Sysops do.
Please feel free to download it and pass it around. Subject: BBS Confiscation
I think the following message retrieved from Compuserve deserves widespread
circulation; no further explanation needed:On May 16 I was served with a search warrant and my system seized because of a message that allegedly had been left, unknown to me, on one of the public boards. This was done by the L.A.P.D. under direction of a complaint by Pacific telephone. All Sysop's should be warned that under present law (or at least the present interpetation) they are now responsible for ALL information that is left or exchanged on their system and that ANY illegal or even questionable activities, messages or even public outpourings are their direct legal responsibility and that they will be held directly accountable regardless of whether or not they knew of it, used it, and regardless of any other circumstances! Yes, it is unjust. Yes, it is legally questionable. But it, for the moment, seems to be enforcable and is being "actively pursued" as a felony. I would appreciate it if this message was spread to as many systems as possible so that the word may be spread to the greatest number of Sysops. 1984 may, indeed, be here... Jack, I'm interested in more details of this one. Do you have any? It sounds like a crack=down on pirate boards more than anything else. Id be interested to know whether the alleged message is supposed to have information in it allowing others to break into someone's computer system, like phone numbers and passwords. Or if not that, what the nature of the complaint was. I agree that all sysops should be aware of what their interpreted liabilities are, nontheless. And that bulletin boards, including those not in the grey market, will be monitored closely by industry groups in a counterattack; and that legislation pending in several states will provide pretty scary penalties for what used to be considered a lark. I'm not sure about the civil liberties issues here; but as I've said before, when the game goes hardball everyone loses out... I dunno where the BBS is (was), but Mission Hills is in area code 818. Scary story, huh? But I'm not too surprised... I stumbled across a long list of credit card numbers on a BBS about a month ago. I meant to turn it over to the telco but never got around to it, now I am glad I didn't. The losses are starting to get really big, and the pirate BBSs spread information faster than the telcos can keep up. It's interesting that a pirate publication called TAP has been published on
paper for years, giving away tricks to beat Ma Bell and her children out of
bucks with credit card checksum algorithms (which used to be trivial), coin
phone control tone sequences, etc. Now that similar information is published
electronically, free speech (free bauds?) no longer applies, it would seem.
This promises to become a very interesting legal situation. The very worst scenario I can think of unreels from the complainant, the phone company. The report sounds like the company is monitoring all the BBS's in L.A. County (or is it Orange County?) Conceivably, just conceivably, as the ultimate carrier the company exercised what someone felt was a "public responsibility" not to carry certain text. The company doesn't want to dirty its lines with ethnic slurs (from racial epithets to Polish jokes), possible obscenity, or libel. By analogy, an independent print shop can be sued for libel in most states for
a book that it sends through its presses, though I've never heard of that
happening. Usually both author and publisher are targets in a libel action.
That is, the phone company might be liable by the letter of the law, but only
the author and sysop would be "conventional" defendants. Since the telephone
company is not poor, however, it probably considers itself fair game every time
a new lawyer graduates from USC. And that's not all. The phone company doesn't want to be a party to distributing a copyrighted program over its lines in hex. Doesn't want to help distribute information on how to break a copy-protect scheme. Principally, it doesn't want to aid hackers in combining their prowess to raid mainframes, which is "theft of services" or worse. (That happened.) Doesn't even want to be the vehicle by which dozens of teenagers pile up a $150,000 long-distance tab on an unwitting customer's monthly bill, which the company or AT&T will have to eat. (That happened.) It doesn't want to be a party to a cocaine deal or a prostitution ring. The least fanciful scenario is either that the FBI is putting pressure on local phone companies to police the BBS's against hackers raiding mainframes, or that AT&T is demanding scourge work against hackers raiding the long-distance system (presumably to get free connect time while raiding mainframes). And so the motives are laudable, the officials all honorable men. But monitoring the BBS's automatically delids a can of worms. If in the course of searching the boards a phone company finds a popular copyrighted program in hex, which it wasn't looking for, it becomes a witting carrier of copyright infringement unless it takes action to terminate the infringement. What if it finds a message explaining how to break a copy-protection scheme? What if...? Hire more lawyers to decide what the BBS's can get away with, whether the message "RR IS A PAINTED WHORE" is non-libelous under the Sullivan decision, whether the content of that board endangers the morals of the minors who flock to it. FREEZE! The strategy (or experiment) in southern California is to beat on the heads of the sysops to do their own policing, which is a "fair-minded" approach. It will shut down a lot of boards. Self-policing will take off some of the heat, but phone-company monitoring of
the BBS's is a goose-step inside the door and won't go away just because it
gets results. The local companies that do it should be dragged before the
public by their heels, and it wouldn't hurt if BBS users and their sympathizers
waited until the disconnect warning before paying their bills. A lot of high-handed, reckless stuff that occurs on the BBS's needs to be stopped, but the lid has to be kept on the can of worms that has been hign-mindedly, recklessly opened in southern California. A local news story some months ago told of a woman whose monthly phone bill weighed in at $150,000, up from $45. She got it straightened out. At dinner tonight my guest Mike, who works for that phone company, filled in some details. Seems the victim's heavy usage started after using her ten-digit account number and four-digit personal number at an airport. LOOSE LIPS SINK SHIPS, as they said in World War II. At this airport one of that infamous band of conspirators known as "hackers" was at prey. Anyway, her numbers then popped up on certain BBS's and the ensuing flood of calls from California and New York, some concurrent, weren't flagged by the
program that checks credit calls because different family members are allowed
to use the same numbers and therefore so are "hackers." Apparently the billing office should have checked with some other office on a $150,000 monthly toll, but didn't because (as I understand it) of some provision for accelerated usage in the computer program. The woman had made a spate of calls the previous month that disrupted her $45 norm, allowing the whopper to get into the mail.
Don't know whether this was a malicious trick on the woman or on the phone
company. Reminds me of the time in Ghana when the electric company cut my lights off onthe assumption that I couldn't pay the bill they hadn't yet sent me (it was my first, covering four months use at a rate equal to my salary.) The "hacker" victim got away with a funny dinner-party anecdote. I had to negotiate for three weeks to get my lights turned on again and my account switched from business to domestic rates. I wound up having to pay half my four-month industrial billing, which was actually a flat rate. What's to stop the phone hackers from running up big MCI bills, (under an account under an assumed name, perhaps...), then just not paying the bills and switching to SBS or CCSI? Eventually you might exhaust all the various long-distance services, but it would take quite a while. I bet they all start to have a large problem with non-bill-payers, particularly because they don't have the threat of cutting off your phone service. Sysop Charlie Strom 76703,602 To: All The following message was retrieved from another system: On Saturday, June 2, there was a meeting of Los Angeles area sysops to find out the truth behind the confiscation of the Mog-Ur BBS. The Sysop of the Mog-Ur BBS was there along with his lawyer. Here is a report on what I learned at the meeting: The messages (there were two of them) containing the AT&T calling card numbers were left on his board using an option to leave an anonymous message. The Sysop can tell who leaves such messages, but the general public can't. Another feature of his BBS software is that you can specify the length of time (in days) that a message should stay up. The messages in question were left with a very small number of days and Tom (the sysop) never got to see them before the system automatically killed them. During the time the messages were on, a Pacific Bell agent called in and saw them. PacBell asked the police to get a search warrant for Tom's computer. This is standard procedure when PacTel finds a BBS handing out phone phreak information. No effort was made to ask Tom to delete the messages or find out who left them. Either somehow Tom found out that PacBell was going to show up or they allowed him t3,602 To: All Tom has retained a lawyer who thinks the whole thing will be thrown out and is going to try to make PacBell look bad. If it ever goes to court he says all he has to do is get a jury of normal people (i.e. no PacBell employees) and present it as a case of John Doe vs. the phone company. Nobody likes the phone company. The lawyer has documented cases where this kind of information was left for weeks on UCLA computers and on CompuServe (I assume in BULLET), and the police did nothing (its easy to pick on a small computer sysop, but trying to confiscate UCLA or CompuServe is harder). InfoWorld reporter Peggy Watt was on the scene and a story will run on the front page of the next issue about it. If there is any difference between my story and the one in InfoWorld, believe InfoWorld. I have tried to get this correct, but Peggy talked with Tom and his lawyer a lot longer than I did, and she took written notes (this is from memory). PacBell has refused to talk to Peggy, and the LAPD person who conducted the raid is on vacation. When the superior of the detective was asked about it, the reply was like "You mean we confiscated $10,000 worth of computers? I didn't know that!". It was reported earlier that Tom had a section on his BBS called "Underground" where these kinds of messages were posted before. I have found out it was his policy to delete any such messages when he saw them. The idea behind the section was not to rip off the phone company, but to discuss "things you wouldn't want just anybody to read" (Tom's system didn't require validation to use, except for the underground section which you had to ask for access to). Another idea was to provide a place to leave unpopular opinions since it had the ability to leave anonymous messages. I hope this clears up what this section was meant for. Thats all for now. The lawyer is pressing for something to be decided during the next week. (Note from C.S. - see Infoworld of 6/18/84, page 11.) Would you take Safeway to court for having a phone number on their bulletin board in the store? I sort of suspect that Pacific Telesis (sounds like a California cult) will get the case thrown out of court, but NOT without a lot of heartburn for Tom! It may not be a matter of whether or not they win the case. These days it's an unfortunate fact of life that anyone with the money to pay a battery of lawyers can keep you in court long enough that it doesn't matter if you're in the right or not - either way you lose...
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open


86
textfiles.com/phreak/bellsec.hac Normal file
View File

@@ -0,0 +1,86 @@
----[=BELL SPECIAL INTELLIGENCE=]----
--------------[=FORCE=]--------------
-------------------------------------
Around 1970 Bell formed a special
type of security agency known only
as 'SIF' (Special Intelligence Force)
This organization will usually pay
the suspected victim a visit if
Bell can't (by any legal means) get
any info. on you about your suspected
fone fraud.
They have been known in one case
to have seriously injured one person
when he refused to let them in his house
to search it. After they had beaten
him up a bit, they proceded to
confiscate all electronic equipment
on the premises.
Although it was later discovered
that he had nothing to do with
phreaking, his reputation was
permanently ruined, and he could
never get a job in his field again.
After the trial was over and he
was found innocent, he noticed an
extra wire from running from his
house to the fone line. When he
called the company and asked them
about it, all they said was that it
was not to be tampered with, and
that any tampering detected would
result in a fine and possible
prison sentence.
This person, who's name I cannot
mention, had a permanent record
about this incident on his file,
and wherever he went this record
followed him. He was so harrassed by
all of these matters that on
October 12, 1973 this man committed
suicide by asphyxiating himself
in his 1970 Oldsmobile by leaving
the engine running while still
in the garage.
Pinned to his shirt was a suicide
note that explained about some
of the incidents of embezzlement by
high ranking company officials,
embezzlement of company funds, and
political slush funding.
Bell was never tried for any of
these offenses because almost all
of the people who knew about the
incident were "ENCOURAGED" not
to discuss the matter with anyone.
The only person ever known to
speal about the matter publicly was
J. Edward Hyde. He wrote an entire
book on alot of things about the
Bell system.
------------[=NOTE=]-----------
I'm not saying that you will ever
have a visit from any of these
people, but if you do,
*********BE CAREFUL!!!!!!!!!********
These people mean business and they
can ruin you for life.
-------------------------------
The information found in this
article is not necessarily express
the opinion of the author mentioned
herein and the this writer takes
no responsiblilty for any use/misuse
of this material...
-----------[=========]-------------
[Phreak][1-37][?=Menu,<CR>=quit]:

842
textfiles.com/phreak/bgm_pns.hac Normal file
View File

@@ -0,0 +1,842 @@
Ctrl-S to Stop/Start Ctrl-C to Cancel
D.K.K. Labs present....
=<How To Make A Genuine Phone Tap>=
By: Jello Biafra
I know all you major phone tappers are probably all sitting there going
"Oooooo! Ahhhhh!" and I know what you're saying... but this is for the
guys/girls who have some electrical knowledge, but not enough to put some-
thing together by themselves...(like this, anyway.)
Here we go.
I: THE BEIGE BOX
Also commonly referred to as the "Bud Box". This is extremely simple to
construct, and doesn't take much time.
First, get about a 12 foot phone cord. Regular. They cost about uh...$2.50
at K-Mart or something. Second, cut off one of the ends of it. (ie, cut the
little plastic thingy off). Third, cut some of the plastic stuff off; like
get a razor blade and cut it, but don't cut the wires inside. (Very tricky).
Fourth, when you see the wires inside, there should be a red, a green, a
yellow, and a black. Ignore the yellow and black. In fact, cut them off. Now
strip some of the little red and green plastic off. (Yes, with your razor
blade). Now get out your soldering gun! (Oh, did i forget to mention that?)
Now, get some solder and some alligator clips. (Available at Radio Shack for
about $1.10 for 10 of them). Now solder the green wire to one clip, and the
red to another.
Simple? You've finished your first phone 'tap'. Now, grab your fone, (ie,
the receiver), and head outside.
In your backyard, there should be a silver box with "BELL" written on it.
They're not that hard to find, usually, you can just look up at the telephone
poll and there are wires leading down. Anyway--pop off the little box. If it
doesn't budge, go grab a screwdriver. Now unscrew the big screw at the bottom
of the box. NOW pop it off. There should be screws and wires that look some-
thing like this:
*(red wire) *(green wire)
*(screw)
*(yellow) *(black)
Or something along those lines. The little asteriks are screws. Usually,
(at least around my neighborhood), the green alligator clip goes to the green
screw, and the red to the red. It could be different, however, so switch them
around if needed. I don't think the bottom screws are ever needed, unless the
house has another separate fone line. And be careful! I got shocked once, and
it wasn't very phun..
Alright, so that's basic, and it's very easy to get caught with, so don't
try it unless your neighbors aren't going to be home for a long time, or are
on vacation. A neato nifty thing to do is to stick an automatic recorder in
their little box. (When i say 'their', I am referring to your victim's).
They're available at Radio Shack for $19. Pretty steep unless you're a rich
kid, which i'm not, but that's another story. So, you rip one off. (Haha,
joke... I do NOT condone stealing things). Ok, so anyway, you buy one from
Radio Shack for $19, use it until you don't need it anymore (up to 30 days,
usually), and then take it back... if it's in good condition. Anyway (for
the 4th time), you get a microcassette recorder (you can buy mine!) and
stick your little contraption in the silver Bell box. Then the recording
will start when they pick up the fone, and stop automatically when they're
done. Just make sure your neighbors don't check their Bell box often.
(And *REMEMBER*, the fine for evesdropping is 5 years and $10,000.. the
CHOICE is YOURS... hehehehe).
II: WIRELESS TRANSMITTER PLANS
This is a transmitter that consists on a one colpitts oscillator that
takes its power from the fone line. Since the resistance it puts on the
line is less that 100 ohms, it has no effect on the telephone performance,
and can't be detected by your neighbors or Ma Bell. Since it's a low-powered
device that doesn't use an antenna for radiation, it is legal to the FCC...
BUT--Not legal for what we're going to do with it!
What it does, is use four diodes to form a bridge rectifier. It produces
a varying DC voltage varying with the auto-signals on the line. That voltage
is used to supply the voltage for the oscillator transistor. Which is
connected to a radio circuit. From there, you can tune it to any channel you
want. The rest will be explained inn text.
PARTS LIST
Item Description
===========================================================================
C1 47-PF CERAMIC DISK CAPACITOR
C2,C3 27-PF MICA CAPACITOR
CR1, CR2, CR3, CR4 GERMANIUM DIODE 1N90 OR EQUIVALENT
R1 100 OHM, 1/4 WATT 10% COMPOSITION RESISTOR
R2 10K, 1/4 WATT 10% COMPOSITION RESISTOR
R3 .7K, 1/4 WATT "" ""
L1 2 UH RADIO FREQUENCY CHOKE (SEE TEXT)
L2 5 TURNS NO. 20 WIRE (SEE TEXT)
Q1 NPN RF TRANSISTOR 2N5179 OR EQUIVALENT
==========================================================================
L1 may be constructed by winding approx. 40 turns of No. 36 enamel wire
on a mega-ohm, 1/2 watt resistor. The value of L1 is not critical. L2 can be
made by wrapping 5 turns of No. 20 wire around a 1/4 inch form. After the wire
is wrapped, the form can be removed. Just solder it into place on the circuit
board. It should hold quite nicely. Also be sure to position Q1 so that the
emitter, base, and collector are in the proper hols. The schematic should be
pretty easy to follw. Although it has an unusual number of grounds, it still
works.
-----------------L1--------------------
--
CR1/ \CR2 -------------------
A-----------------/ \ -- ----
\ / C2 L2
CR3\ /CR4 C1 R2 ----
R1 -- GND C3
---- ----
GND ---------BASE COLLECTOR
R3 \ /
B---------------------------- \/\ <-Q1
GND \/
EMITTER (GND)
Ok, now go to the box, remove the red wire that was already on Screw 1,
and attach it to wire "A" of the bug. Then attach wire "B" to the screw
itself. You can adjust the frequency which it comes out on the FM channel
by either smashing, or widening thec coils of L2. It takes a few minutes to
get to work right, but it is also very versatile. You can change the frequen-
cy at will, and you can easily record off your radio.
------------------------------------------
Ok, that's about it for now. My fingers hurt.
I would just like to admit that I did steal
most everything of the "Wireless Transmitter
Plans" from The Overlord, from Phrack Vol. 1,
Issue 3, Phile #5, of 10. (Hey, put it this
way, I wouldn't have borrowed it if it wasn't
any good, now would I?) That's it. Have phun, don't
abuse, and you'll be alright.
------------------------------------------
Call the Dark Side of The Moon AE/BBS
(408) 245-7726
Chow.
7:51 pm PST
11/02/86
Cmd:
Ctrl-S to Stop/Start Ctrl-C to Cancel
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
- -
- -
- The Pirates' Den 1200 AE List -
- [December 23, 1986] -
- Created by: Masked Marauder of The Legion -
- -
- The Yacht Club |1200/2400|Ind. PW...[HOME OF THE LEGION!]...717-273-6704 -
- The Retreat AE |1200 only|Ind. PW...........................305-288-4869 -
- -
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
Sorry about the long delay between lists but I've been busy lately.
Hopefully it'll be a matter of days (not weeks) until the next list. If
you have any corrections/additions/deletions drop me a note The Yacht Club.
Codes:
C-Carrier Detected
B-Busy when I called
W-Weak Handshake - Couldn't Connect
R-Rang Forever - Will be rechecked later.
AE-Ascii Express Supported
MT-Mousetalk Supported
CF-Car-Fur Supported
AET-AE:Tac Used
AEP-AE Prodos Used
BBS-BBS Used
Number Password Code/Type Comments
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
- -
- 201-221-9006 Ind. C AE/BBS The Electronic Basement-10mg-3/1200 -
- 201-255-2132 TAZ B AE ????-10mg -
- 201-256-4202 Ind. C AE/CF/BBS Trade Center-20mg -
- 201-330-9104 Ind. C AET The Falcon's Lair-20mg-1200/2400 -
- 201-398-2953 Ind. C AE/BBS Upside Down-20mg (No New Users) -
- 201-460-3470 No P/W C AE Fly by Night AE-2dr -
- 201-697-4825 Ind. C AE/CF/BBS Byte Bastard BBS-10mg-300/1200 -
- 201-838-5138 Ind. C AE/CF/BBS Heart of Gold-10mg-300/1200 -
- 201-867-5031 No P/W C AE Da Cave AE-1mg -
- 201-879-6668 KILL C AE Metal AE-4dr -
- 203-236-1777 T/P/ Ind. C AE The Assembly Line-20mg -
- 203-746-2570 Ind. C AE/BBS Abode ][ Elite-40mg-300/1200 -
- 206-838-7686 Ind. C AE/BBS Shooting Star-20mg-300/1200 -
- 206-943-3229 No P/W C AE Hyboria-4 dr -
- 208-384-5569 Ind. C AET Altered States AE-20mg-300/1200 -
- 209-474-0868 Ind. C AET Warehouse-40mg -
- 209-957-7372 Ind. C AE/BBS The Mystic-20mg-300/1200 -
- 213-493-2011 Ind. C AE/CF/BBS The Citadel-20mg -
- 215-488-6019 Ind. C AE/CF/BBS Exchange Password-10mg-300/1200 -
- 215-647-5384 Ind. C AET The Pirate Zone-1.2mg -
- 215-843-9193 CASHIT C AEP The Wall Street AE-20mg -
- 215-886-6105 MAGIC W AE The Magical Tavern-?-300/1200 -
- 216-235-6613 Ind. C AE/BBS S.O.B-10mg-3/12/2400 (No New Users) -
- 216-267-2938 Ind. C AE/BBS The Dock-20mg-300/1200/2400 -
- 218-724-4210 Ind. W AE/BBS The Vault-4 dr-300/1200 -
- 219-422-6305 Ind. B Secret Service-3 dr-300/1200 -
- 301-661-9355 Ind. C AE/BBS The Weather Station-?-300/1200 -
- 305-229-9508 No P/W C AET Humidity Plus-1mg -
- 305-288-4869 APL/Ind. C MT The Retreat-3dr (Cool Sysop) -
- 305-395-6906 Ind. C AE/CF/BBS Digital Logic Data Service-10mg-3/12 -
- 305-556-6858 Ind. C AE/BBS Apple Tree //-10mg -
- 305-777-8365 No P/W/Ind. C AET The Connection-10mg-300/1200 -
- 305-898-5649 Ind. C AE/BBS S.E. Connection-20mg -
- 309-662-0779 Ind. C AET The Pretzel Board-10mg -
- 312-234-6237 Ind. C AE/BBS Hotel California-?mg-300/1200 -
- 312-395-9456 Ind. C AE/BBS The Infocomatium-30mg-300/1200/2400 -
- 312-432-6964 Ind. C AE/BBS Wizard's Guild-300/1200 -
- 312-528-5020 Ind. C AE/BBS Ripco-40mg-300/1200/2400 -
- 312-654-2918 Ind. B AET The Quarterdeck-8 dr-300/1200 -
- 312-699-7482 Ind. C AET The Challenger-5 dr-300/1200 -
- 312-724-0807 Ind. C AE/BBS Bullwinkle's Bar-1.3mg-300/1200 -
- 312-759-1916 Ind. C AET Silver Tongue-5 dr -
- 312-848-3394 Ind. B The Cemetary-300/1200 -
- 312-870-7875 Ind. C AET Metal Shop-2 dr-300/1200 -
- 312-934-4637 Ind. B Shady Vale Inn-10mg -
- 313-295-4397 Ind. B AET The Trivial AE-20mg-300/1200 -
- 313-591-1024 Ind. C AE/CF/BBS Red-A-Sector-20mg-300/1200 -
- 314-427-0983 Ind. C AET Escort-10mg -
- 314-527-5551 Ind. R AE/CF/BBS Kleptic Palace-10mg -
- 402-464-7952 Ind. C AE/BBS Solomon's Mine-5mg-1200/2400 -
- 403-456-0974 Ind. C AET/BBS Canadien Conn.-10mg-4 pm:8 am -
- 403-466-6187 Ind. C AET The Northern Link-4 dr-3/1200-4pm:8am-
- 404-284-4859 Ind. B AE/BBS The Leeches Palace-10mg -
- 404-299-0302 Ind. B AE/BBS Video Castle-20mg-1200/2400 -
- 404-327-2327 Ind. B AE/BBS Metalland South-20mg -
- 404-394-8265 Ind. C AE/BBS Ground Zero-20mg-1200/2400 -
- 404-449-5986 Ind. C AE/BBS Atlanta Crackers-40mg-1200/2400 -
- 404-487-4059 Ind. R AE/BBS Peachtree Syndicate-60mg-1200/2400 -
- 404-932-2233 Ind. R AE/BBS Forbidden Zone-20mg-300/1200 -
- 408-245-7726 No P/W B AE Dark Side-10mg-300/1200 (All T-Files)-
- 408-257-3174 Ind. C AE/CF/BBS Gold Mine-80mg -
- 408-429-8562 TURKEY B AE The Arena AE-20mg-1200/2400 -
- 414-449-5010 Ind. C AET The Ghetto-6 dr -
- 415-873-3840 RATT/Ind. C AET Rattpak AE-11mg-300/1200 -
- 415-961-9337 No P/W B Rogue's Gallery-5mg-300/1200 -
- 415-969-5673 Ind. B AE/CF/BBS Lord's Domain-10mg-300/1200 -
- 502-245-8270 Ind. C AE/BBS Fifth Precinct-20mg-300/1200 -
- 503-657-1759 Ind. B AET Ware Brigade-?-300/1200 -
- 503-684-0548 Ind. B Phreak House-10mg-300/1200 -
- 504-291-5690 Ind. B AE/CF/BBS Light House-10mg-300/1200 -
- 504-774-7126 Ind. C AE/CF/BBS Pitstop-10mg-300/1200 -
- 504-831-4348 SANITY B Insane Asylum-3 dr-300/1200 -
- 505-275-0110 SIXX/Ind. C AET Binary Sixx-20mg-300/1200 -
- 505-434-0381 Ind. C AE/CF/BBS The Foundation-10mg -
- 505-865-0883 CICADA/Ind. C AET Terrapin Station-3 dr-300/1200 -
- 512-229-1080 Ind. B Cygnus-10mg-300/1200 -
- 513-832-1938 Ind. R AET Shawdow Keep AE-3 dr -
- 515-294-3977 Ind. C AET M.A.D.-40mg -
- 516-221-4450 Ind. B Motherboard Elite-30mg -
- 516-579-6380 Ind. C AET The Realm-20mg-300/1200/2400 -
- 518-563-2383 Ind. C AET The Molder's Lair-3dr -
- 602-577-1051 Ind. B AE/BBS Underground-10mg -
- 606-271-2156 Ind. B AET Power Source AE-11mg-300/1200 -
- 606-272-2241 Ind. B Dead Body Outline-20mg-300/1200 -
- 606-291-6502 Ind. C AE/BBS Blue Chip Exchange-20mg -
- 609-921-1994 Ind. B AE/BBS Milliway's-10mg-1200/2400 -
- 615-983-8232 Ind. C AE/BBS The Disk Fix-20mg-3/12-6 am:6 pm -
- 617-849-0975 Ind. C AE/BBS The Universe Elite-10mg (Cool Sysop) -
- 703-639-4937 GUEST/Ind. C AET Chaos Valley-10mg-3/12 -
- 703-922-6123 SPIRAL C AE The Reflex Tower AE-20mg-1200/2400 -
- 703-938-4174 WIRE C AE The Hotwire AE Line-3dr -
- 713-690-3918 Ind. B AE/CF/BBS Hobbit's Hideaway-20mg -
- 713-729-5100 No P/W B AE Big Boobs #1-10mg-1200/2400 -
- 713-896-0472 No P/W C AE/CF Big Boobs #2-40mg-1200/2400 -
- 714-472-8241 Ind. B Asylum ][-20mg -
- 714-877-3044 Ind. B AE/BBS The Dungeon-10mg -
- 717-273-6704 Ind. C AE/BBS The Yacht Club-20mg-1200/2400 -
- 804-737-2432 Ind. C AE/CF/BBS Fishing Hole-10mg -
- 805-984-3547 Ind. C AE/BBS Down the Rabbit Hole-10mg -
- 815-838-5464 Ind. B AET Mainflow AE-10mg-1200/2400 -
- 818-447-2548 Ind. R AE/CF/BBS Contact Point-20mg -
- 818-957-0347 NEW C AE Glendale Private Library-20mg -
- 818-981-4230 Ind. B AE/BBS Golden Disk-20mg-300/2400 -
- 913-262-5155 Ind. C AET Ray's AE-20mg-1200/2400 -
- 914-591-9285 EXEC C AE The Conference Center-20mg -
- 914-623-1471 Ind. B AE/CF/BBS Apple Pit I-10mg-300/1200 -
- 914-698-5965 Ind. C AE/CF/BBS Circus Maximus-20mg -
- 915-694-0004 Ind. B AE/BBS Crowley Manor-10mg-300/1200 -
- 915-694-9379 Ind. B AE/BBS Crowley Manor (Line #2) -
- 919-489-6890 Ind. C AE/CF/BBS Panopticon Center-10mg -
- -
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
(>ttop/start text >]
Uploaded by Temporal Demon to
Digital Logic's Data Service
[305-395-6906]
**************************************
* *
* GOLD BOX PLANS *
* BB *
* DR. REVENGE *
* ___________ *
* *
* COSYSOP OF MODEM MADNESS *
* 516-569-0589 *
* *
* MR. SPOCK *
* *
* THE SYSOP *
* *
**************************************
WARNING: THESE ARE PRELIMINARY PLANS, AND ONLY WORK IN SOME AREAS.
I WILL SOON POST THE NEW PLANS THAT WORK ANYWHERE IN THE
UNITED STATES. LOOK FOR IT ON MODEM MADNESS (516)-569-0589
WHAT IT DOES
____________
WHEN YOU PUT A GOLD BOX ON TWO PHONE LINES IT LETS ANYONE WHO CALLS ONE OF
THE LINES CALL OUT ON THE OTHER. SO WHEN MCI OR SPRINT TRACES THE LINE IT WILL
TELL THEM THAT YOU ARE CALLING FROM THE LINE YOU HOOKED THE GOLD BOX UP TO.
THIS IS GREAT FOR HOOKING UP TO PAY PHONES. JUST THINK PHREAKING WITHOUT
THE HEART ATTACKS WHEN YOU HEAR A CLICK AND THE PHUN YOU CAN HAVE WITH A RED
BOX AND AT&T CALLING CARDS. JUST DON'T USE A BLUE BOX, CALL THE PRESIDENT AND
SAY YOU WANT TO KILL HIM, GOVERMENT COMPUTERS, OR ANYTHING THAT THEY TRACE BY
DECTING A TONE IN THE LINE. BUT YOU CAN STILL CALL THE OPERATOR AND ASK FOR
HER BRA SIZE OR IF SHE KNOWS WHAT A TRUNK TONE IS !!
HOW TO BUILD IT
_______________
YOU WILL NEED THE FOLLOWING:
TWO 10K OHM AND THREE 1.4K OHM RESISTOR
ES, TWO 2N3904 TRANSISTORS, TWO PHOTOCE
LLS, TWO RED LED'S (THE MORE LIGHT PROD
UCED THE BETTER), A BOX THAT WILL NOT L
ET LIGHT IN, AND RED AND GREEN WIRE.
LIGHT FROM THE #1 LED MUST SHING DIREC
TLY ON THE PHOTOCELL #1. THE GOLD BOX I
MAID NEEDED THE TOP OF THE LED'S TO TOU
CH THE PHOTOCELL FOR IT TO WORK.
THE SAME APPLIES TO THE #2 PHOTOCELL AN
D LED
1
:-PHOTOCELL--:
: :
: :BASE
: 1 TTTTT
: +LED- TRANSISTOR
: TTTTT
: : :
: -I(-- : :COLLECTOR
RED1--< >:--: :-------:-----GREEN2
-I(-- : ----------:
: :
2 :-/+/+/-/+/+/-/+/+/-/+/+/
LED 10K 10K 1.4K 1.4K
RESISTORES
2
-PHOTOCELL-----------------
: :
:BASE :
TTTTT :
TRANSISTOR :
TTTTT :
: :EMITTER :
GREEN1- --------------------------RED2
: :
/+/+/
1.4K
THE 1.4K RESISTOR IS VERIABLE AND IF TH
E SECCOND PART OF THE GOLD BOX IS SKIPPE
D IT WILL STILL WORK BUT WHEN SOMEONE P
ICKS THE PHONE UP THEY WILL HEAR A FAIN
T DIAL TONE IN THE BACKGROUND AND MIGHT
REPORT IT TO THE GESTOPO ER...(AT&T).
1.4K WILL GIVE YOU GOOD RECEPTION WITH
LITTLE RISK OF A GESTOPO AGENT AT YOUR
DOOR.
NOW THAT YOU HAVE BUILT IT TAKE TWO
GREEN WIRES OF THE SAME LENTH STRIP THE
ENDS, TWIST TWO ENDS TOGETHER AND CONN
ECT THEM TO GREEN1 AND PLACE A PEICE OF
TAPE ON IT WITH LINE #1 WRITING ON IT.
CONTINUE THE PROCESS WITH RED1 ONLY US
E RED WIRE. REPEAT WITH RED2 AND GREEN2
BUT CHANGE TO LINE #2.
HOW TO INSTALL
______________
YOU WILL NEED TO FIND TWO PHONE LINE
S THAT ARE CLOSE TOGETHER. LABEL ONE OF
THE PHONES LINES LINE #1.CUT THE PHONE
LINES AND TAKE THE OUTER COUTING OFF I
T. THERE SHOULD BE 4 WIRES CUT THE YELL
OW AND BLACK WIRES OFF AND STRIP THE RE
D AND GREEN WIRES FOR BOTH LINES.
LINE #1 SHOULD BE IN TWO PEICES TAKE
THE GREEN WIRE OF ONE END AND CONNECT
IT TO THE ONE OF THE GREEN WIRES ON THE
GOLD BOX. TAKE THE OTHER HALF OF LINE #
1 AND HOOK THE FREE GREEN WIRE TO THE G
REEN WIRE ON THE PHONE LINE. REPEAT THE
PROCESS WITH RED1 AND THE OTHER LINE.
ALL YOU NEED TO DO NOW IS TO RIGHT D
OWN THE PHONE NUMBERS OF THE PLACE YOU
HOOKED IT UP AT AND GO HOME AND CALL IT
. YOU SHOULD GET A DIAL TONE!!!
IF NOT LEAVE ME A MESSAGE ON THE MODEM
MADNESS BBS 516-569-0589 OR TRY CHANGIN
G THE EMITTER WITH COLLECTOR.
OH AND HOOKING IT UP TO A PAYPHONE IS A
FEDERAL OFFENCE AND IS ILLEAGAL TO PUT
ON ANY PHONE. I RECOMMEND YOU SEE YOU
R LOCAL POLICE DEPARTMENT BEFORE DOING
ANYTHING SAID IN THIS ARTICLE. (HAHAHAH
A!!!!!!)
Cmd:
Ctrl-S to Stop/Start Ctrl-C to Cancel
--------------------------------------
Construction Project:
Atomic Bomb
-------------------------------------
The following paper is
taken from the Journal of
Irreproducible Results,
voluhe 25/number 4/1979-P.O.
Box 234 Chicago Heights,
Illinois 60411.
Dubscription's are 1 year for
$3.70
1. Introduction
Worldwide controversy has
been generated recently from
several court decisions in the
united states which have
restricted popular magazines
from printing articles which
describe how to make an atomic
bomb. The reason usually given
by the courts isthat national
security would be compromised
if such information were
generally available. But,
since it is commonly known that
all of the information is
publicly available in most
major metropolitan libraries,
obviously the court's
officially stated position is
covering up a more important
factor; namely, that such
atomic devices would prove too
difficult for the average
citizen to construct. The
United States courts cannot
afford to insult the vast
majorities by insinuating that
they do not have the
intelligence of a cabbage, and
thus the "official" press
releases claim national
security as a blanket
restriction.
The rumors that have
unfortunately occurred as a
result of widespread
misinformation can (and must)
be cleared up now, for the
construction project this month
is the construction of a
thermonuclear device, which
will hopefully clear up any
misconceptions you might have
about such a project. We will
see how easy it is to make a
device of your very own in ten
easy steps, to have and hold as
you see fit, without annoying
interference from the
government or the courts.
The project will cost
between $5,000 and $30,000
dollars, depending on how
fancy you want the final product
to be. Since last week's
column, "Let's make a
time machine", was received so
well in the new step-by-step
format, this month's column
will follow the same format.
2. Construction method
1. First, obtain about 50
pounds (110 kg) of weapons
grade plutonium at your local
supplier (see note 1). A
nuclear power plant is not
recommended, as large
quantities of missing plutonium
tends to make plant engineers
unhappy. We suggest that you
contact your local terrorist
organization, or perhaps the
junior achievement in your
neighborhood.
2. Please remember that
plutonium, especially pure,
refined plutonium, is somewhat
dangarous. Wash your hands
with soap and warm water after
handling the material, and
don't allow your children or
pets to play in it or eat it.
any left over plutonium dust is
excellent as an insect
repellant. You may wish to
keep the substance in a lead
box if you can find one in your
local junk yard, but an old
coffee can will do nicely.
3. Fashion together a metal
enclosure to house the device.
Most common varieties of sheet
metal can be bent to disguise
this enclosure as, for example,
a briefcase, a lunch pail, or a
buick. Do not use tinfoil.
4. Arrange the plutonium into
two hemispheral shapes,
separated by about 4 cm.
userubber cement to hold the
plutonium dust together.
gelignite is much better,
bit messier to work with. Your
helpful hardware man will be
happy to provide you with this
item.
6. Pack the TNT around the
hemisphere arrangement
constructed in step 4. If
you cannot find gelignite, feel
free to use tnt packed in with
playdo or any modeling clay.
colored clay is acceptable, but
there is no need to get fancy
at this point.
7. Enclose the structure from
step 6 into the enclosure made
in step 3. use a strong glue
such as "crazy glue" to bind
the hemisphere arrangement
against the enclosure to
prevent accidental detonation
which might result from
vibration or mishandling.
8. To detonate the device,
obtain a radio controlled (rc)
servo mechanism, as found in
RC model airplanes and cars.
with a minimum of effort, a
remote plunger can be made that
will strike a detonator cap to
effect a small explosion.
These detonator caps can be
found in the electrical supply
section of your local
supermarket. We recommend the
"Blast-O-Mactic" brand because
they are no deposit-no return.
9. Now hide the completed
device from the neighbors and
children. The garage is not
recommended because of high
humidity and the extreme range
of temperatures experienced
there. Nuclear devices have
been known to spontaneously
detonate in these unstable
conditions. The hall closet or
under the kitchen sink will be
perfectly suitable.
10. Now you are the proud
owner of a working
thermonuclear device! it is a
great ice-breaker at parties,
and in a pinch, can be used for
national defense.
3. Theory of Operation
The device basically works
when the detonated tnt
compresses the plutonium into a
critical mass. the critical
mass then produces a nuclear
chain reaction similar to the
domino chain reaction
(discussed in this column,
"Dominos on the March" march,
1968). the chain reaction then
promptly produces a big
thermonuclear reaction.
And there you have it, a 10
megaton explosion!
4. Next month's column
In next month's column, we
will learn how to clone your
neighbor's wife in six easy
steps. This project promises
to be an exciting weekend full
of fun and profit. Common
kitchen utensils will be all
you need. See you next month!
5. Notes
1. Plutonium (Pu), atomic
number 94, is a radioactive
metallic element formed by the
decay of neptunium and is
similar in chemical structure
to uranium, saturium,
jupiternium, and marsium.
6. Previous month's columns
1. Let's make test tube
babies! may, 1979
2. Let's make a solar system!
june, 1979
3. Let's make an economic
recession! july, 1979
4. Let's make an anti-gravity
machine! august, 1979
5. Let's make contact with an
alien race! september, 1979
=======================================


52
textfiles.com/phreak/billdist.phk Normal file
View File

@@ -0,0 +1,52 @@
From: Dave Esan <moscom!de@cs.rochester.edu>
Subject: Re: Coordinate Tape Info Request
Organization: Moscom Corp., E. Rochester, NY
This followup to an article bounced back here. I'll try again.
In article <telecom-v09i0445m03@vector.dallas.tx.us> you write:
>Well, it is my understanding that the units in the V&H master database
>are miles. This allows the milage based costing of the phone company
>services to be calculated using the simple distance formula:
>sqrt( (x1- x2)^2 + (y1 - y2)^2 )
>although the phone companies really use the following formula:
>sqrt( ( (v1 - v2)^2 + (h1 -h2)^2 )/10 ).
V and H coordinates are points on a grid spread over North America. Being
points they will be dimensionless. One can calculate the distance between
any two points using the V and the H coordinates and simple geometry -
eg the distance is sqrt( (x1- x2)^2 + (y1 - y2)^2 ), as noted above. But
this will be wrong. The Earth is round, and this distance will not be correct.
There is a distance method given in FCC #10, page 13. Basically it is
as follows:
1. Calculate the difference in V coordinates, and H coordinates.
2. Divide each by three.
3. Square the numbers and add them.
4. If the sum of the square is > 1777 go to step #2. (Forgive me for using
a goto statement.)
5. If the sum of the square is < 1777 multiply it by a fudge factor based on
the number of divisions done.
6. Take the square root of the product, and round up.
Of course, if it is zoned city you have to worry if the distance is < 40
miles, in which case you have to recalculate using the zones coordinates
rather than the master coordinates. Unless of course, this distance is
greater than 40 miles, in which case you use the regular calculation.
The distance between coordinates is supposed to be about 180 yards. (Maybe
173 yards = 1/10 mile?). The point (0,0) is someplace in the Atlantic.
Unlike ATT which calculates that cost of a call to Puerto Rico based on
3 costing bands, Sprint calculates the mileage using a fake coordinate that
has a negative H component.
--> David Esan rochester!moscom!de
------------------------------
Downloaded From P-80 Systems 304-744-2253

445
textfiles.com/phreak/bioc.1 Normal file
View File

@@ -0,0 +1,445 @@
5
[ Cntl-S Start/Stop ][ Cntl-X Abort ]
--------------------------------------
! !
! PIRATE TREK SYSTEMS PRESENTS !
! !
! THE BOOK OF BIOC !
! !
! A COMPILED PHREAKING TUTORIAL !
!____________________________________!
HOW TO BE A REAL PHREAK
IN THE PHONE PHREAK SOCIETY THERE ARE
CERTAIN VALUES THAT EXIST IN ORDER TO
BE A TRUE PHREAK, THESE ARE BEST
SUMMED UP BY THE MAGICIAN:
"MANY PEOPLE THINK OF PHONE PHREAKS AS
SLIME, OUT TO RIP OFF BELL FOR ALL SHE
IS WORTH. NOTHING COULD BE FURTHER
FROM THE TRUTH! GRANTED, THERE ARE
SOME WHO GET THEIR KICKS BY MAKING
FREE CALLS; HOWEVER, THEY ARE NOT TRUE
PHONE PHREAKS. REAL PHONE PHREAKS ARE
'TELECOMMUNICATIONS HOBBYISTS' WHO
EXPERIMENT, PLAY WITH AND LEARN FROM
THE PHONE SYSTEM. OCCASIONALY THIS
EXPERIMENTING, AND A NEED TO
COMMUNICATE WITH OTHER PHREAKS ( WITH-
OUT GOING BROKE), LEADS TO FREE CALLS.
THE FREE CALLS ARE BUT A SMALL SUBSET
OF A >TRUE< PHONE PHREAKS ACTIVITIES.
THE TEN COMMANDMENTS
REPRINTED FROM TAP ISSUE #86. (TAP,
ROOM 603, 147 W 42 STREET, NEW YORK, NY
10036. SEND A SASE FOR THEIR INFO
SHEET "WHAT THE HELL IS TAP?" AND
TELL THEM THAT BIOC AGENT 003 TOLD YOU
ABOUT IT.)
THE PHONE PHREAK'S TEN COMMANDMENTS
I. BOX THOU NOT OVER THINE HOME
TELEPHONE WIRES, FOR THOSE WHO
DOEST MUST SURELY BRING THE
WRATH OF THE CHIEF SPECIAL
AGENT DOWN UPON THY HEADS.
II. SPEAKEST THOU NOT OF IMPORTANT
MATTERS OVER THINE HOME TEL-
EPHONE WIRES, FOR TO DO SO IS TO
RISK THINE RIGHT OF FREEDOM.
III. USE NOT THINE OWN NAME WHEN
SPEAKING TO OTHER PHREAKS, FOR
THAT EVERY THIRD PHREAK IS AN
FBI AGENT IS WELL KNOWN.
IV. LET NOT OVERLY MANY PEOPLE KNOW
THAT THY BE A PHREAK, AS TO DO
SO IS TO USE THINE OWN SELF AS
A SACRIFICIAL LAMB.
V. IF THOU BE IN SCHOOL, STRIVE TO
GET THIN SELF GOOD GRADES, FOR
THE AUTHORITIES WELL KNOW THAT
SCHOLARS NEVER BREAK THE LAW.
VI. IF THOU WORKEST, TRY TO BE A
0 EMPLOYEE, AND IMPRESSEST THINE
BOSS WITH THINE ENTHUSIASM, FOR
IMPORTANT EMPLOYEES ARE OFTEN
SAVED BY THEIR OWN BOSSES.
VII. STOREST THOU NOT THINE STOLEN
GOODES IN THINE OWN HOME, FOR
THOSE WHO DO ARE SURELY NON-
BELIEVERS IN THE BELL SYSTEM
SECURITY FORCES, AND ARE NOT
LONG FOR THIS WORLD.
VIII. ATTRACTEST THOU NOT THE ATT-
ENTION OF THE AUTHORITIES, AS
THE LESS NOTICABLE THOU ART, THE
BETTER.
IX. MAKEST SURE THINE FRIENDS ARE
INSTANT AMNESIACS AND WILL NOT
REMEMBER THAT THOU HAVE CALLED
ILLEGALLY, FOR THEIR COOPERATION
WITH THE AUTHORITIES WILL SURELY
LESSEN THINE TIME FOR FREEDOM ON
THIS EARTH.
X. SUPPORTEST THOU TAP, AS IT IS
THINE NEWSLETTER, AND WITHOUT
IT, THY WORK WILL BE FAR MORE
LIMITED.
CN/A NU
HERE IS HOW AN EMPLOYEE MIGHT GO ABOUT
CALLING CN/A:
"HI, THIS IS JOHN DOE FROM THE MIAMI
RESIDENTAL SERVICE CENTER, CAN I HAVE
THE CUSTOMERS NAME AT (123) 555-1212."
THE EMPLOYEES USUALLY USE THESE FOR
CHECKING WHO BELONGS TO A # THAT
SOMEONE CLAIMED THEY DIDN'T CALL.
IF YOU SOUND CHEERY AND NATURAL THE
OPERATOR WILL NEVER ASK ANY QUESTIONS.
IF YOU DON'T SOUND LIKE A MATURE ADULT,
DON'T USE IT! ALWAYS PRACTICE FIRST &
SO YOU DON'T SCREW UP
AND MAKE THE OPERATOR SUSPICIOUS. USE
NAME THAT SOUNDS REAL, NOT YOUR PIRATE
NAME EITHER! ALSO SAY THAT YOU ARE FRO
A CITY THAT IS FAR AWAY FROM THE ONE
THAT YOU ARE CALLING.
THE CN/A NUMBER FOR THE NY AREA &
VICINITY (212, 315, 516, 518, 607, 716,
& 914) IS>>>>>>>>>(518) 471-8111<<<<<<
AND IS OPEN DURING BUSINESS HOURS.
DON'T ABUSE IT!
AT&T NEWSLINES
AT&T NEWSLINES ARE NUMBERS AT AREA
PHONE OFFICES THAT TELCO EMPLOYEES CALL
TO FIND OUT THE LATEST INFO ON NEW
TECHNOLOGY, STOCKS, ETC. THE RECORDED
REPORTS RANGE FROM VERY BORING TO VERY
INTERESTING.
HERE ARE A FEW OF THE NUMBERS:
*(201) 483-3800 NJ (518) 471-2272 NY
(203) 771-4920 CN (717) 255-5555 PA
(212) 393-2151 NY (717) 787-1031 PA
(516) 234-9941 NY *(914) 948-8100 NY
SOME OF THESE NUMBERS ARE TOLL-FREE,
BUT YOU CAN'T ALWAYS COUNT ON IT.
* THESE NUMBERS ARE NOT ALWAYS UP!
NUMBERS FROM OTHER AREAS ARE AVAILABLE
BY REQUEST FROM F)BIOC L)AGENT 003.
ANI NUMBERS
ANI NUMBERS IDENTIFY THE PHONE NUMBER
THAT YOU ARE CALLING FROM. IT IS
USEFUL WHEN PLAYING IN CANS (THOSE
BIG SILVER BOXES ON TELEPHONE POLES)
TO FIND OUT THE # OF THE LINE. IT IS
ALSO GOOD TO FIND OUT THE # OF A PHONE
THAT DOESN'T HAVE IT PRINTED ON IT. IN
THE 914 AREA CODE THE ANI # IS 990. IF
YOU JUST HAVE TO DIAL THE LAST 4 DIGITS
FOR A LOCAL #, IE CONGERS (268), DIAL
1-990-1111, WHERE 1111 ARE DUMMY DIGITS
THERE IS ALSO A LESS USEFUL TYPE OF ANI
# WHICH WILL IDENTIFY THE AREA CODE &
EXCHANGE. IT IS NXX-9901, WHERE NXX IS
THE EXCHANGE. IN THE 212 & 516 AREA
CODES THE ANI # IS 958.
PHREAK NEWSLETTER
TAP IS THE "OFFICIAL" PHONE PHREAK
NEWSLETTER, AND HAS EXISTED SINCE 1971.
EACH 4 PAGE ISSUE IS CRAMMED FULL OF
INFORMATION ON PHONE PHREAKING,
COMPUTER PHREAKING, FREE GAS, FREE
ELECTRICITY, FREE POSTAGE, BREAKING &
ENTERING INFO, ETC. IT IS LARGELY
PHONE PHREAK ORIENTED, HOWEVER.
A 10 ISSUE SUBSCRIPTION COSTS $8.00, IF
YOU GET A BULK RATE SEALED ENVELOPE
SUBSCRIPTION. I WOULD RECOMMEND THE
FIRST CLASS SUBSCRIPTION, WHICH IS $10.
AS OF THIS WRITING (7-16-83), THE
CURRENT ISSUE IS #86, AND ISSUE #50 IS
8 PAGES INSTEAD OF THE USUAL 4. BACK
ISSUES ARE $0.75 EACH, AND ISSUE #50
IS $1.50. A BRIEF INDEX TO THE FIRST
80 ISSUES IS AVAILABLE FOR A SASE, OR
FREE WITH A SUBSCRIPTION ORDER. TAP
IS NON-PROFIT, AND IN DESPERATE NEED OF
MATERIAL (ARTICLES), MONEY, AND
VOLUNTEERS.
TAP
ROOM 603
147 WEST 42ND STREET
NEW YORK, NY 10036
BELIEVE ME: IT WILL BE THE BEST $10
YOU WILL EVER SPEND...
BLATT, 10% RESISTOR. ANY ELECTRONICS
PLACE SHOULD HAVE THESE.
NOW, CUT TWO PIECES OF WIRE, ABOUT 6
INCHES, AND ATTACH THESE TO THE TWO
SCREWS ON THE SWITCH. TURN YOUR NORMAL
DDSIDE DOWN AND UNSCREW THE
2 SCREWS. LOCATE THE "F" AND "RR"
SCREWS ON THE NETWORK BOX. WRAP THE
RESISTOR BETWEEN THESE 2 SCREWS AND
MAKE SURE THAT THE WIRES TOUCH ONLY THE
PROPER TERMINALS! NOW CONNECT ONE WIRE
FROM THE SWITCH TO THE RR TERMINAL.
FINALLY, ATTACH THE REMAINING WIRE TO
THE GREEN WIRE (DISCONNECT IT FROM ITS
TERMINAL). NOW BRING THE SWITCH OUT
THE REAR OF THE PHONE AND CLOSE IT UP.
PUT THE SWITCH IN A POSITION WHERE YOU
GET A DIAL TONE, MARK THIS NORMAL.
MARK THE OTHER SIDE FREE.
WHEN YOUR FRIENDS CALL (AT A
PREARRANGED TIME), QUICKLY LIFT & DROP
THE RECEIVER AS FAST AS POSSIBLE. THIS
WILL STOP THE RINGING, IF NOT TRY
AGAIN. IT IS VERY IMPORTANT THAT YOU
DO IT FAST! NOW PUT THE SWITCH IN THE
FREE POSITION AND PICK UP THE PHONE.
KEEP ALL CALLS SHORT & UNDER 15
MINUTES.
WHEN SOMEONE CALLS YOU LONG-DISTANCE,
THEY ARE BILLED FROM THE MOMENT YOU
ANSWER. THE TELCO KNOWS WHEN YOU
ANSWER DUE TO A CERTAIN AMOUNT OF
VOLTAGE THAT FLOWS WHEN YOU PICK UP THE
PHONE. HOWEVER, THE RESISToR CUTS DOWN
ON THE VOLTAGE SO IT IS BELOW THE
BILLING RANGE BUT SUFFICIENT ENOUGH TO
OPERATE THE MOUTHPIECE. ANSWERING THE
PHONE FOR A FRACTION OF A SECOND STOPS
THE RING BUT IT IS NOT ENOUGH FOR
BILLING TO START. IF THE PHONE IS
ANSWERED FOR EVEN ONE FULL SECOND,
BILLING WILL START AND YOU WILL BE CUT
OFF WHEN YOU HANG UP AND SWITCH TO
FREE.
WARNING: BELL CAN RANDOMLY LOOK FOR
BLACK BOXES SO BE CAREFUL!
---------------------------------------
: :
***BLUE WIRE**>>F< :
: * * :
**WHITE WIRE**** * :
: * :
: RESISTOR :
: * :
: * :
: >RR<*******SWITCH*** :
: * :
****GREEN WIRE********************* :
: :
---------------------------------------
DIAL LOCKS
HAVE YOU EVER BEEN IN AN OFFICE OR
SOMEWHERE AND WANTED TO MAKE A FREE
FONE CALL BUT SOME ASSHOLE PUT A LOCK
ON THE FONE TO PREVENT OUT-GOING CALLS?
FRET NO MORE PHELLOW PHREAKS, FOR EVERY
SYSTEM CAN BE BEATEN WITH A LITTLE
KNOWLEDGE!
THERE ARE TWO WAYS TO BEAT THIS
OBSTACLE, FIRST PICK THE LOCK, I DON'T
HAVE THE TIME TO TEACH LOCKSMITHING SO
WE GO TO THE SECOND METHOD WHICH TAKES
ADVANTAGE OF TELEPHONE ELECTRONICS.
TO BE AS SIMPLE AS POSSIBLE, WHEN YOU
PICK UP THE FONE YOU COMPLETE A CIRCUIT
KNOW AS A LOCAL LOOP. WHEN YOU HANG-UP
YOU BREAK THE CIRCUIT. WHEN YOU DIAL
(PULSE) IT ALSO BREAKS THE CIRCUT BUT
NOT LONG ENOUGH TO HANG UP! SO YOU CAN
"PUSH-DIAL." TO DO THIS YOU >RAPIDLY<
DEPRESS THE SWITCHHOOK. FOR EXAMPLE,
TO DIAL AN OPERATO WITH YOUR OWN # SO YOU'LL
GET A BUSY TONE WHEN RIGHT. IT'LL ALSO
WORK ON TOUCH-TONE(TM) SINCE A DTMF
LINE WILL ALSO ACCEPT PULSE. ALSO,
NEVER DEPRESS THE SWITCHHOOK FOR MORE
THAN A SECOND OR IT'LL HANG-UP!
FINALLY, REMEMBER THAT YOU HAVE JUST AS
MUCH RIGHT TO THAT FONE AS THE ASSHOLE
WHO PUT THE LOCK ON IT!
EXCHANGE SCANNING
ALMOST EVERY EXCHANGE IN THE BELL
SYSTEM HAS TEST #'S AND OTHER "GOODIES"
SUCH AS LOOPS WITH DIAL-UPS.
THESE "GOODIES" NNCOME LUCKY!
HERE ARE MY FINDINGS IN THE 914-268
EXCHANGE:
9900 - ANI (SEE SEPARATE BULLETIN)
9901 - ANI (SEE SEPARATE BULLETIN)
9927 - OSC. TONE (POSSIBLE TONE SIDE OF
A LOOP)
9936 - VOICE # TO THE TELCO CENTRAL
OFFICE
9937 - VOICE # TO THE TELCO CENTRAL
OFFICE
9941 - COMPUTER (DIGITAL VOICE
TRANSMISSION?)
9960 -0OSC. TONE (TONE SIDE LOOP) --
MAY ALSO BE A COMPUTER IN SOME
EXCHANGES
9961 - NO RESPONSE (OTHER END OF LOOP?)
9962 - NO RESPONSE (OTHER END OF LOOP?)
9963 - NO RESPONSE (OTHER END OF LOOP?)
9966 - COMPUTER (SEE 9941)
9968 - TONE THAT DISAPPEARS--RESPONDS
TO CERTAIN TOUCH-TONE KEYS
MOST OF THE NUMBERS BETWEEN 9900 & 9999
WILL RING OR GO TO A "WHAT #, PLEASE?"
OPERATOR.
HAVE PHUN AND REMEMBER IT'S ONLY A
LOCAL CALL!
TOUCH-TONE & FREE CALLS
THERE ARE SEVERAL WAYS TO MAKE FREE
CALLS (SPRINT, MCI, ETC.) USING A
ROTARY PHONE. THEY ARE:
1. USE A NUMBER THAT ACCEPTS VOICE AS
WELL AS DTMF. SUCH A # IS (800)
521-8400. AS OF WRITING THIS, A
CODE WAS 00717865.
A) IF USING VOICE, WAIT FOR THE
COMPUTER TO SAY, "AUTHORIZATION
#, PLEASE." THEN SAY EACH
DIGIT SLOWLY, IT WILL BEEP
AFTER EACH DIGIT IS SAID.
AFTER EVERY GROUP OF DIGITS, IT
WILL REPEAT WHAT YOU HAVE SAID,
THEN SAY YES IF IT IS CORRECT,
OTHERWISE SAY NO. IF THE
ACCESS CODE IS CORRECT, IT WILL
THANK YOU AND ASK FOR THE
DESTINATION #, THEN SAY THE
AREA CODE + NUMBER AS ABOVE.
ANOTHER SUCH # IS (800) 245-
8173, WHICH HAS A 6 DIGIT
ACCESS CODE. (NOTE: IF USING
TOUCH-TONE ON THIS #, ENTER THE
CODE IMMEDIATELY AFTER THE TONE
STOPS.)
2. HOOK UP A TOUCH-TONE FONE INTO
YOUR ROTARY FONE. ATTACH THE RED
WIRE FROM THE TOUCH-TONE FONE TO
THE "R" TERMINAL INSIDE THE FONE
ON THE NETWORK BOX. THEN HOOK THE
GREEN WIRE TO THE0"B" TERMINAL.
TO USE THIS DIAL THE # USING
ROTARY & THEN USE THE TOUCH-TONE
FOR THE CODES. (DON'T HANG UP THE
ROTARY FONE WHILE DOING THIS
THOUGH!) IF THIS DOESN'T WORK
THEN REVERSE THE 2 WIRES. (NOTE:
IF YOUR LINE CAN ACCEPT TOUCH-TONE
BUT YOU HAVE A ROTARY FONE THEN
YOU CAN HOOK UP A TONE FONE
DIRECTLY FOR ALL CALLS BUT THIS
USUALLY ISN'T THE CASE.)
SUCH AS RADIO SHACK'S 43-138.
OTHER ALTERNATIVES
4. USE A CHARGE-A-CALL FONE. (THESE
ALSO MAKE GREAT EXTENTIONS IF YOU
REMOVE IT USING A HEX WRENCH WITH
A HOLE IN THE MIDDLE ON THE CENTER
SCREW!)--YOUR DIME WILL COME
BACK, IMMEDIATELY PUT A DIME BACK
IN (IT'LL COME BACK WHEN YOU HANG
UP!) IF IT IS A TONE FIRST FONE
AND IT DISCONNECTS THE KEYPAD
(SOME DON'T) THEN FIND ANOTHER
FONE.
TELCO TRACING
THE GOOD 'OL DAYS:
------------------
WAY BACK BEFORE I WAS A PHREAK, MA BELL
WOULD HAVE TO MANUALLY TRACE A CALL IF
THEY THOUGH SOMETHING WAS FUCKED UP.
FIRST THEY WOULD SEND A 2000 HZ
TRACING TONE, THE WOULD BE FOLLOWED B
ALOT OF NOISE AND CLICKS. IT TOOK
ABOUT 2-3 MINUTES TO TRACE A CALL AND
ALOT OF PEOPLE WERE INVOLVED IN THE
PROCESS. SO AT 1 IN THE MORNING THEY
WOULD HAVE TO WAKE UP PEOPLE FOT THE
TRACEES (PHREAK
JARGON FOR A PAY FONE). BUT NEVER USE
THE SAME ONE MORE THAN ONCE OR TWICE
BECAUSE THE GESTAPO(ER..EXCUSE ME
MEAN BELL SECURITY) HAS BEEN KNOW FOR
STAKING OUT TROUBLED FORTRESSES. IT'S
ALSO POSSIBLE FOR TRAVELNET OR SP
TO ASK FOR A TROUBLE # BUT THE TELCO
IS SLOW IN PROCESSING STUFF--ESPECIALLY
FOR THE COMPETITION--SO DON'T FRET
PHELLOW PHREAKS.
MODERN TECHNOLOGY:
------------------
THIS CAN BE ATTRIBUTED TO ESS + CCIS
WHICH CAN BE TRACED IN 1 SECOND.
[Ripco] Which 1-42 ?=menu,<CR>=abort:

41
textfiles.com/phreak/black2.txt Normal file
View File

@@ -0,0 +1,41 @@
The following info comes from a leaflet entitled 'FREEFONE':
"British Telecoms recent record profits and continuing appalling
service have prompted the circulation of this information. It
comprises a method of making telephone calls free of charge."
DIAGRAM: PARTS REQUIRED:
O----o-------o/ o------o----O S1 = SPST Switch
L ! S1 ! T
I o--------|<--------o O D1 = 1N4004
N ! D1 !
E o--XXXX------>|----o T D2 = L.E.D. (TIL209 etc)
! R1 D2 ! E
I o--------||--------o L C1 = 1uF, 250vac non elec
N C1 E
O----------------------------O R1 = 2K8 resistor
OPERATION:
This circuit inhibits charging for incoming calls only. When a
phone is answered, there is normally approximately 100ma DC loop
current, but only 8ma or so is nessecary to polarise the mic in
the handset. Drawing only this small amount of current is
sufficient to fool BT's ancient 'Electronic Meccano'.
Its extremely simple. When ringing, the polarity of the line
reverses so D1 effectively answers the call when the handset is
lifted. When the call is established, the line polarity reverts
and R1 limits the loop current while D2 acts as an indicator to
show when the circuit is in use. C1 ensures that speech is
unaffected. S1 returns the telephone to normal when closed.
With the phone on the hook this circuit is undetectable at the
exchange and/or on the line. The switch should be closed to make
outgoing calls and when receiving calls from the operator.
The method illustrated here uses the same technology that BT use
on their 0800 exchange to obtain free incoming calls. (Try this
number as a demo: 0800 800 800.)
*****DO NOT DIVULGE YOUR SOURCE OF THIS INFORMATION*****

62
textfiles.com/phreak/black3.txt Normal file
View File

@@ -0,0 +1,62 @@
***********************************************************
*
MEMBER NAME: BLACK *
*
***********************************************************
BLACK BOX PLANS
HERE IS HOW YOU CONSTRUCT A BLACK BOX.
WHEN YOUR PHONE IS JUST SITTING THERE DOING NOTHING THE
VOLTAGE THROUGH THE PHONE LINE IS ZERO. THEN IF SOMEONE CALLS
YOU (FOR SOME STRANGE REASON) AND THE PHONE IS RINGING. THE
VOLTAGE JUMPS TO 48 VOLTS WHICH TELLS MA BELL TO STAND BY IF YOU
SHOULD PICK UP SO SHE CAN BILL YOU. WHEN YOU EVENTUALLY PICK UP
THE PHONE, THE VOLTAGE DROPS TO 10 VOLTS AND THE BILLING STARTS.
WHAT A BLACK BOX DOES IS KEEPS THE THE VOLTAGE AS 36 VOLTS,
THEREFORE THE INCOMING CALLER NEVER GETS BILLED (INGEINIOUS)
THE ORIGINAL BLACK BOX WAS CREATED BY AN EX-BELL EMPLOYEE WHO
WENT BY THE NAME "CAPTAIN CRUNCH". HE GOT HIS NAME FROM THOSE
LITTLE WHISLES YOU GOT IN BOXES OF CAPTAIN CRUNCH BECAUSE THEY
EMITED A TONE THAT WAS EQUAL TO A COIN.CAPTAIN CRUNCH JUST
ANNOUNCED HIS RETIREMENT FROM PHREAKING WHEN HE WAS RELEASED
FROM A CALIFORNIA JAIL. HE WAS CAUGHT WITH A BLUE BOX.
CONSTRUCTION OF A
BLACK BOX
1] A 36 VOLT ZENER DIODE.
2] A CERAMIC OR MYLAR CAPACITOR OF 0.1 MICROFARAD.
3] A ELECTROLYTIC CAPACITOR OF 1.0 MICROFARAD.
YOU CAN GET THESE AT YOUR LOCAL RADIO SHACK DEALER.
FIRST YOU HAVE TO OPEN UP YOUR PHONE.YOU SHOULD NOTICE THREE
WIRES COMING IN FROM THE BACK OF THE PHONE, A GREEN, RED, AND
YELLOW. MOST OF THE TIME THEY CAN DIFFER.DON'T WORRY ABOUT THE
YELLOW WIRE, WE WILL NOT BE USING THIS.YOU WILL NEED TO FIND THE
MOST POSITIVE OF THE REMAINING TWO WIRES.(ALMOST ALWAYS THE
GREEN WIRE). NOW CONNECT THE BANDED END OF THE ZENER DIODE TO
THE MORE POSITIVE OF THESE TWO WIRES. "IN SERIES". YOU HAVE JUST
COMPLETED THE FIRST STEP. FOR THE SECOND STEP YOU NEED A
CERAMIC OR MYLAR CAPACITOR OF 0.1 MICROFARAD. YOU CONNECT THIS
"IN PARRALLEL" ACROSS THE DIODE. THIS IS NEEDED TO ALLOW THE
DIODE TO PASS VOICE SIGNALS. NOW FOR THE FINAL STEP TAKE YOUR
ELECTROLYTIC CAPACITOR OF UP TO ONE MICROFARAD WITH ITS '+' END
CONNECTED TO THE BANDED END OF THE DIODE AND THE OTHER END
SHOULD BE CONNECTED TO THE ANODE END OF THE DIODE. MA BELL IS
NOT TOTALLY OBLIVIOUS TO THIS.IF THE PHONE RINGS FOR ABOUT A
HALF-HOUR THEY WILL THINK SOMETHING IS WRONG AND BILL YOU
ANYWAY. WHEN USING A BLACK BOX,YOUR PHONE WILL CONTINUE RING
EVEN THOUGH YOU PICKED IT UP. YOU HAVE TO MAKE A SWITCH TO
CONNECT ONE OF THE RINGER WIRES.THAT WILL SHUT IT OFF. THAT'S
IT! HAVE PHUN!!!!!!!!!!!!!!!!
<><><><><><><><><><><><><><><><><><><><><><><><><><<><>

Downloaded From P-80 International Information Systems 304-744-2253

85
textfiles.com/phreak/blackfg1.2 Normal file
View File

@@ -0,0 +1,85 @@
@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?
? Presenting a Phile @
@ By Shadow Lord of 203 ?
? and @
@ Black Flagg ?
? about @
@ Allience Teleconfrencing ?
? and @
@ Methods of Contacting it ?
? @
@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?
Black Flagg is a group composed of Phreaks, hacks, pirates, crackers
and many other types involed in various talents of computers. If you
wish to join, contact Heavy Metal or I, on Playdo Land ][ or Danger
Zone Private, contact my voice mailbox at 312-856-0263 Box 118.
Allience Teleconfrencing
------------------------
Allience Teleconfrencing recently had a merger with AT&T, that means
that it will get thougher to access it, but these set backs shall not
stop a true phreak.
At&t's access to Allience is 0-700-456-x00y, x=1-3, y=1 Los Angelos,
2 Chicago, 3 White Plains, and 4 Houston. But, 0-700, is just a dummy
number, when you dial 0-700-456-1001 for instance, it dials, KP+
+ST. There for you can box to Allience, but there are easier
ways, which will be discussed in the latter part of this file.
When you dial Allience, no matter what method you use, the commands
are the same. After contacting Allience you will hear a tone, then a
voice will say, How Many locations do you wish ??, enter a number
from around 1-15, it says in literature that you may have up to 51
conferees, but I have never gotten past 25. It will then say, you
have 12 locations (Or whatever you entered), if there isn't enough
space, it will hang up, it there is, it will say, enter # to keep
this and go on, or * to change this setting. Then enter # or *,
it will say, dial the Area code, and number you wish to reach. That
means NPA+PRE+SUFF, or international, CNTRY+NPA+PRE+SUFF. Then dial
* to cancel the call, or # to add them to the confrence. You must
say something to them, or it will hang them up. Then Dial # to add
them to the confrence.
To spice up a confrence, try adding some Directory Assistence ops,
freak out when you add more then one, they argue who should be on
the line. I will also provide a list of good payphone numbers at
Disney Land.. One instance, I and Master Scorpio called one with 3
way calling, and a mexican women answered, MS Replied "Do you have
a green card?", the lady hung up, pretty funny. I also got numbers
to malls. Well, that's all I got to say about it. The next file
will explain how to access Allience for free, see if you call it
direct without a divertor or PBX, it cost $.10 a minute per line,
plus long distance charges. According to allience it is illeagle,
tS but not your number, so, they can call the poble you
dial, and check with them, but I have@1j5> just say, sorz- but I can't
helpyou, I got a crank call, so I
took my phone off the hook, and I guess they didn't hang up.
There are many other ways to have confrences, such as the old
reliable 3 way calling, bridges, or, even 3 line loops. Well,
I have never found anything as good allience yet.
Methods of Contacting Allience
------------------------------
There are many ways to call allience for free, see, you can't
call allience through MCI or Sprint for ovious reasons. But you
can take and Call a Divertor, and just like say, I got a
wrong number, and just wait, when she hangs up, you will get their
dial tone, it routes you back to the main switchboard, and you
get their dial tone, then you can dial where ever, sometimes the
people don't hang up, cause they know it's a divertor, and they
don't want a big bill. To find a divertor, look through the
yellow pages, and look for 24 Hr doctors, vets, etc.. And to tell
if it's one, the ring will usually change tones.
Private Branch Exchange (PBX) are a company's number that you
and get a dial tone, most of the time you need a code, and then
you usually dial 9 for an outside line then 0-700, if it's a
sprint line, dial 10288, then 0-700-456-x00y.
Look for more phreaking Philes from Shadow Lord of 203 ...
Don't Call Gateway/Globe Quest. Grow up Riger Mortis.
/d
.

42
textfiles.com/phreak/blacklis.txt Normal file
View File

@@ -0,0 +1,42 @@
Heres how to find out whether the phone companies know that ya been using
cards. An example with MCI
Call 0800-890-222 (or local mci dialup)
Ask to be transfered to customer services
When connected to customer services, ask to be transfered to the
WorldPhone department for international subscribers.
Now you need a credit card (your own is best), tell them that you
recently visited the states and that you are interested in receiving an
MCI international phone card. They will ask you for your name address and
credit card details. Give this to them.
Now wait 4-6 weeks and see if any mci cards arrive (they are free incidently)
If no cards arrive then you are blacklisted. You can call customer
services and they will tell you that the cards have been issued. But they
have not. MCI have a database of all defrauders and they wont deal with
them, but customer services are not aware that the cards have been
blocked. You can keep asking them to send new cards out, but none will
ever arrive.
I've tried this myself and discovered that I'm blacklisted from
MCI/SPRINT/AT&T, but if I order the cards to my girlfriends house with
her credit card, bingo all the cards arrive within a month.
Good luck dudes.
(and you thought they didn't know you were out there)
GrEeTs Go OuT tO:-
Violator, Mic Flair, Dr.Fonk, Gremlin, Big J, Jimbo, Stinger, Loony Toon,
Mr Dalvin, No Carrier, Smurf, Phantasm, Pulse, DaveX, Cybernetik, Ken D,
Scribla, Meeko, Potsan & The rest of the Uk h/p Crew....
SiGnEd....
TaS & TuRbO bRaIn
_____________________________________________________________________________

106
textfiles.com/phreak/blackpag.phk Normal file
View File

@@ -0,0 +1,106 @@
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
J*=*=* FEDERAL BLACK PAGES *=*=*
J*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
J*=*=*=*=*=*=* WRITTEN BY: THE LINE BREAKER *=*=*=*=*=*=*
J*=*=*=* PRESENTED ON: THE UNDERWORLD: 216-356-9464 *=*=*=*=
J*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
JLISTED BELOW YOU WILL FIND TELEPHONE NUMBERS OF THOSE WHO HOLD
JOFFICE IN OUR GREAT COUNTRY. THIS FILE WAS FIRST STARTED BACK IN
J1982 ON NYSHII ELITE AND HAS BEEN UPDATED EVERY 6 MONTHS. SO HERE
JIS THE LATEST PHONE LISTING OF THOSE GREAT PEOPLE.
J*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
JTHE WHITE HOUSE -> SWITCHBOARD 202-456-1414
J*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
JPRESIDENTIAL SENIOR STAFF ->
J----------------------------
JASST TO PRES DONALD T REGAN 456-6797
JASST TO PRES FOR NSA ROBERT M#FARLANE 456-2255
JPRESS SECRETARY 456-2100
JLEGISLATIVE AFFAIRS M.B.OGLEBY JR 456-2230
JCOUNSEL TO THE PRES FRED F FIELDING 456-2632
J------------------------------------------------------------------
JIMMEDIATE OFFICE OF THE PRESIDENT ->
J------------------------------------
JSPECIAL ASST TO THE PRES JAMES F KUHN 456-2168
JPERSONAL SEC TO THE PRES KATHLEEN OSBORNE 456-2858
J------------------------------------------------------------------
JWHITE HOUSE OPERATIONS ->
J-------------------------
JFINANCIAL OFCR RICHARD WHITE 456-7052
JPERSONNEL OFCR JAMES R ROGERS 456-2500
JTELEGRAPH & TRAVEL SVC BILLY DALE 456-2250
JWH TELEPHONE SVC MGR ALEX G NAGY 456-2524
JEXECTIVE CLERK RONALD GEISLER 456-2226
JRECORDS MGMT DIR BIFF HENLY 456-2240
JVISTORS OFFICE DIR CAROL S M#CAIN 456-2322
J------------------------------------------------------------------
JVICE PRESIDENT'S OFFICE ->
J--------------------------
JIMMEDIATE OFFICE OF V.P. PATTY PRESOCK 456-7123
JSPEC ASST TO V.P. JANE KENNY 456-7662
JSTAFF ASST LISA BELL 224-2424
JOFFICE MANAGER JEANNETTE SMITH 224-8391
JBARBARA BUSH (VP'S WIFE DUMMY) 456-7022
J------------------------------------------------------------------
JNATIONAL AERONAUTICS & SPACE ADMINISTRSTION ->
J----------------------------------------------
JPERSONNEL LOCATOR 453-1000
JPUBLIC ONFORMATION 453-8364
JFREEDOM OF INFORMATION 453-8335
JINSPECTOR GENERALS HOTLINE (DC AREA) 755-3402
JSPACE FLIGHT JESSE W MOORE 453-1132
JSPACE SCIENCE & APPLICATIONS 453-1409
JSPACE STATION PHILIP CULBERTSON 453-2015
JSPACE TRACKING & DATA SYSTEMS 453-2019
JGROUND OPERATIONS WAYNE FRAZIER 453-2392
JSPACE TRANSPORTION SYSTEMS 453-2230
JTRAINING OFFICER VALERIE STUCKY 453-1242
JNASA LANGLEY RESEARCH CENTER (804) 865-2761
JAMES RESEARCH CENTER (415) 965-5000
JLEWIS RESEARCH CENTER (216) 433-4000
J-----------------------------------------------------------------
JSHUTTLE OPERATIONS DIVISION ->
J------------------------------
JDOD OPERATIONS EDGAR HARKLEROAD 453-1895
JFLIGHT OPERATIONS RICHARD SNYDER 453-1886
JLAUNCH & LANDING OPERATIONS 453-1896
JOPERATIONS INTRGRATIONS 453-1985
J-----------------------------------------------------------------
JSHUTTLE ORBITER DIVISION ->
J---------------------------
JDIRECTOR MICHEAL WEEKS 453-1900
JPRODUCTION & INTEGRATIONS 453-1915
JVEHICLE SYSTEMS 453-1924
J-----------------------------------------------------------------
JSHUTTLE PROPULSION DIVISIONS ->
J-------------------------------
JENGINE PROGRAMS 453-1868
JEXTERNAL TANK PROGRAMS 453-1871
JPRODUCTIVITY OPERATIONS SUPPORT 453-1933
JSOLID ROCKET BOOSTER PGM 453-1872
J-----------------------------------------------------------------
JL.B. JOHNSON SPACE CENTER (713) 483-4588
JJ.F. KENNEDY SPACE CENTER (305) 867-3333
JG.C. MARSHALL SPACE CENTER (205) 453-1910
JNATIONAL SPACE TECHNOLOGY LAB'S (601) 688-2121
JGODDARD SPACE FLIGHT CENTER (301) 344-5121
JJET PROPULSION LABORATORY (818) 354-3405
J*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
JWHEN CALLING ANY WHITE HOUSE NUMBER BE SURE THAT YOU PROTECT
JYOURSELF. ALL PHONES ARE CAPABLE OF TRACING. MOST OF THE NUMBERS
JTHAT NASA USE ARE PRETTY SAFE. THERE ARE TWO MORE PARTS TO THIS
JFILE BUT THE NUMBERS LISTED ABOVE ARE SOME OF THE BEST TO FOOL
JAROUND WITH.
J*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
JANOTHER G-PHILE BROUGHT TO YOU BY THE NEW YORK SAFEHOUSE II ELITE
JBBS. FOR MORE INFORMATION ABOUT THESE NUMBERS OR SOME THAT ARE
JNOT LISTED CONTACT THE LINE BREAKER AT A PHREAK/HACK BOARD NEAR
JYOU. UNTIL THE NEXT G-PHILE -- HAPPY PHREAKING!!!!!!
J
J THE LINE BREAKERT
J STRIKES BACKT
FILE FROM THE SCARLET BROTHERHOOD 713/729-6840
Press a key...

119
textfiles.com/phreak/blkbx.txt Normal file
View File

@@ -0,0 +1,119 @@
___________________________________
/ \
/ \
| How to build a BLACK BOX |
| |
| (Also known as a mute box) |
\ /
\___________________________________/
To all who dare --
What is a BLACK BOX? A BLACK BOX is a device that is hooked up to your
fone that fixes your fone so that when you get a call, the caller doesn't get
charged for the call. This is good for calls up to 1/2 hour, after 1/2 hour
the Fone Co. gets suspicious, and then you can guess what happens.
The way it works:
What this little beauty does is keep the line voltage from dropping to 10v
when you answer your fone. The line is instead kept at 36v and it will make
the fone think that it is still ringing while your talking. The reason for
the 1/2 hour time limit is that the Fone CO. thinks that something is wrong
after 1/2 an hour of ringing.
All parts are available at Radio Shack. Using the least possible parts
and arrangement, the cost is $.98. And that is parts for two of them! Talk
about a deal! If you want to splurge then you can get a small PC board, and
a switch. There are two schematics for this box, one is for most normal
fones. The second one is for fones that don't work with the first. It was
made for use with a Bell Trimline touch tone fone.
** Schematic 1 for most fones **
** LED ON = BOX ON **
FROM >--------------------GREEN-> TO
LINE >--! 1.8k LED !---RED--> FONE
!--/\/\/\--!>--!
! !
------>/<-------
SPST
Parts: 1 1.8k 1/2 watt resistor
1 1.5v LED
1 SPST switch
You may just have two wires which you connect together for the switch.
** Schematic 2 for all fones **
** LED ON = BOX OFF **
FROM >---------------GREEN-> TO
LINE >------- ---RED--> FONE
! LED !
-->/<--!>--
! !
---/\/\/---
1.8k
Parts: 1 1.8k 1/2 watt resistor
1 1.5v LED
1 DPST switch
Here is the PC board layout that I recommend using. It is neat and is very
easy to hook up.
Schematic #1 Schematic #2
************** ****************
* * * ------- *
* --<LED>--- * * ! ! *
* ! ! * * ! <SWITCH> *
* RESISTOR ! * * ! ! ! *
* ! ! * * ! ! / *
* -------- ! * * ! ! \ *
* ! ! * * ! <LED>! / *
* --SWITCH-- * * ! ! \ *
* ! ! * * ! ! / *
* ! ! * * ! ! ! *
* ! ! * * ! !-! *
***!******!*** ***!********!***
*** These last few lines were inserted by hypothesis! --- The Director ***
Once you have hooked up all the parts, you must figure out what set of
wires go to the line and which go to the fone. This is because of the fact
that LED's must be put in, in a certain direction. Depending on which way
you put the LED is what controls what wires are for the line & fone.
How to find out:
Hook up the box in one direction using one set of wires for line and the
other for fone.
*NOTE* For Model I switch should be OFF.
*NOTE* For Model ][ switch should be set to side connecting the LED.
Once you have hooked it up, then pick up the fone and see if the LED is
on. If it is, the LED will be lit. If is doesn't light then switch the wires
and try again. Once you know which are which then label them.
*NOTE* - If neither directions worked then your switch was in the wrong
position. Now label the switch in its current position as BOX ON.
How to use it:
The purpose of this box is not to people who call you so it would make
since that it can only be used to receive calls. When the box is *ON* then
you may only receive calls. Your fone will ring like normal and the LED on
the box will flash. If you answer the fone now, then the LED will light and
the caller will not be charged. Hang up the fone after you are done talking
like normal. You will not be able to get a dial-tone or call when the box is
on, so turn the box *OFF* for normal calls. I don't recommend that you
leave it on all the time, as you don't want it to answer when Ma Bell calls!

70
textfiles.com/phreak/blocker.txt Normal file
View File

@@ -0,0 +1,70 @@
We've got this nice file from "Hawk".
Calling from chile Tnx man! cool text.
To bad you've a lot of linenoise.
-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
Hi Phreakers & Hackers out there,
I want to explain sum most important things to make BB for ya
easier..
At the moment most Telephone Companies around the globe are trying
more or less together to solve the C5 Problem..
Germany
-------
The German Telekom installed Blockers which are working with
the "Fast Forje Transformation" Principe. That means that the
2600/2400 Hertz FRQ's have a defined Energy when u send them
throw the line. The Blocker recogneize this and Blocks the
Tone. If you send additional "Irritating FRQ's" like for
Example 3000 Hertz, 400 Hertz.. the Energy of the 2600/2400
Hertz will go down and the Blocker doesnt recogneize that this
is a C5 Break Tone.
At the moment the Telekom is trieing to modify the Blocker System
also many Countries (Phillipines..) are installing new Blocker
Systems.
The German Telekom founded sum time ago and Special Department
for many Telephone Fraud Sections like: C5, PBX, Networks..
Right now they are analysing the Hacker Scene in Germany..
Because of the Fact, that the German Telekom is now a Private
Company, its going more flexibler and faster like an Government
Company.
The Future will show if they can block 100 % BB..
Sum Tips which u can check out (also in orther Countries):
1. The Volume is very important
2. Most Blockers around the Globe are working equal, only the
Result when u send an Break Tone is different. That means
if u send an Break Tone in Germany and the Blocker recogneizes
that this is an Break Tone nothing will happen, if ya send in
Chile this Tone you get a "Klick" from the Blocker and the Line
is dead. At the first Time its irritating bud with sum practice
u get a feeling for the different Situations..
3. Not every Line which looks like C7 is C7..
4. GOOD FRQ Scanners can help alot!
5. BE PATIENT!
6. DO NOT CALL IN DIGITAL TELEPHONESYSTEMS WITH MORE THEN 10 LINES
(FOR BUSSINESS REASONS), u get 99% BUSTED!
I heard that Japan installed an "LOOP BLOCKER"(?) an that this
Blocker is unhackable, so if u are an JAPAN Phreaker and u get
it, leave me a message. I am very interested to know something
about that System. If you had any success in using Pink Noise
(TLO) leave me also a messy..
I dont want to give too exact Infos, bud I think that this little
Info text can help u a little..
DONT FORGET: N E V E R COOPERATE WITH COPS OR TELECOMS !!!
L8r!
HAWK

117
textfiles.com/phreak/blstrike.txt Normal file
View File

@@ -0,0 +1,117 @@
Unauthorised Access UK 0636-708063 10pm-7am 12oo/24oo
|+|+|+|+|[%> Bell Walk-out <%]|+|+|+|+|
+ +
| by: kid & company |
+ +
|+|+|+|+|+|+|+|+|+|+|+|+|+|+|+|+|+|+|+|
Contract talks were breaking down between American Telephone and Telegraph
and three major unions of their employees. As a result, workers walked off the
ir jobs at midnight on August 7th. The AT&T strike was on!
We all remember the phone strike of '83. It caused us to hold on directory
assistance for several minutes. It gave us many unique error messages. It
made it virtually impossible to make any operator-assisted calls from all
around the country. For the first time in along while, the voices at AT&T were
not answe ring the phone.
As well all know, a strike is an organized work stoppage by the employees
in order to compel the employer to meet some demand. If the workers go on strik
e, it stands to reason that the company should suffer. If, for example, the uni
on of Cabbage-Patch producers was to strike, then none would be made, and consu
mers would rant and rave. If the local Cabbage-Patch conglomerate had anticipat
ed a strike, they could step up production, fill several hundred ware houses wi
th millions of surrogate orphans and, when the strike occurred, they could sell
the surplus. The workers would lose their bargaining power in this case, unles
s the Cabbage-Patch truckers' union also struck, or perhaps people stopped adop
ting the cretins, however unlikely that might seem.
This analogy leads us back to last summer when 675,000 telephone employees
went on strike. A walk-out of the magnitude should have devastated any company
. AT&T though, is the exception to the rule. What AT&T depends on are phones, w
ires, switching systems, computers, electrictiy, some optical fibers, satellite
s, microwave towers, and other nifty 21st century things that are all designed
to run without the interference of human decision. The people are really just t
here to remove illegal third party phone calls from your bill, to make sure tha
t your handwritten check matches the computer-read phone bill, or to tell you t
hat the machine you are at cannot return your dime and that you will get a chec
k for 10 cents in the mail. 97% of the calls made today don't use any operator
assistance at all. And most of the other 3% could have been dialed without the
assistance of a human. More and more "services" of your phone company are becom
ing completely automated. With ESS, customers can dial overseas direct.
Android information is popping up left and right. AT&T, a leader in technology,
doesn't need their workers all that much.
Glen E. Watts, president of the Communications Workers of America, said, "
In 1950, for example, total labor costs amounted to about 45% of the telephone
dollar while in 1980 they amounted only to 29%." John Patrick Phillips (author
of Ma Bell's Millions) says that the company encourages or even "maneuvers" a s
trike. According to him, Ma Bell reaps huge rewards from a strike. Phillips, a
disgruntled ex-employee, who at times compares the phone company to fascism, wo
uld have presented AT&T's organized scheme last August like this:
675,000 workers strike for about 3 weeks. 3 weeks out of a year amounts to
5.8% of a worker's salary. Let's say a phone worker made at the time of the st
rike a modest $250 per week (operators made $373, while systems technicians, th
e best paid workers, made $535).
At this time AT&T provided substandard service to the people for the same
prices. The 3% loss in phone usage due to lack of operators was proably easily
made up by people making an extra effort to dial direct and by the fact that so
me of the calls were being handeled by scabbing supervisory level employees. An
d so, the company nets pure profit: 3 week strike x $250/week x 675,000 workers
= $506,250,000!
Phillips also notes that because managers and supervisors were doing the d
irty work of the phone company, these people could not work on new projects. Th
is means that several hundred million dollars would not be invested in expendit
ures on new projects because there is no one to do the work. So AT&T would get
interest on this money during the strike and even for some time after it was se
ttled until work had resumed. This yields several more million dollars in profi
t for AT&T.
AT&T proably made out directly over half a billion dollars for the strike.
At the same time companys like New York Telephone sought to delay a $160 milli
on rate increase so it could ask for another increase to reflect the new contra
cts.
As part of the settlement 21 days later, top craft workers got a 5.5% incr
ease for the first year of their 3 year contract and 1.5% for each of the next
two years. They also got a $31 million training fund ($46 per employee) to help
them deal with new technology and remain employable humans. All of these "gain
s" are subsidized by the half a billion dollars gaining lots of interest which
AT&T did not have to pay to their employees. AT&T at first offered a ridiculous
3.5% increase for the first year and no increase for the next two, but after l
osing 5.8% of their salary by striking, workers got a 5.5% increase above the c
ost of living which is probably entirely subsidized by the strike itself and by
rate increases.
It's certainly a nifty deal for Ma Bell. Their workers blow off steam and
pay for their own raises, and stockholders don't have to worry one bit.
The strike had its effect on the consumer. As we all know, many were diali
ng, touchtoning, or redialing their calls almost like usual and other were seve
rely inconvenienced by a few managers and supervisors working as long distance
or directory assistance operators often for many hours overtime. New installati
ons came to a standstill and many were backlogged for several months. Any emerg
ency repairs had to be handled by supervisory personnel. But after all this, th
e same fat phone bill came to people's homes the next month, without any delay.
In actuality, users cannot complain to or boycott the phone company as the
y could the Cabbage-Patch manufacturers, in our earlier scenario. They cannot m
ake AT&T or their local company do anything because each customer is as unimpor
tant as each employee. We, as customers, are all dependent on the phone. We hav
e at least one in each home. We are billed if we use it or not, and are billed
more to have it shut off for a month or two. We are all so dependent on the lin
es that run into our homes and on the one and a half million payphones that abs
orb our money that complaints of any one or even thosuands of us are quite usel
ess. All of this utility (note the meaning of this word) was until recently cot
rolled almost exclusively by one company, so in the name of human spirit, roll
on with the divestiture.
---------------------------------------

229
textfiles.com/phreak/bluebeep.txt Normal file
View File

@@ -0,0 +1,229 @@
;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
;
; PLEASE READ THIS DOC FILE FROM THE PROGRAM.
; IT HAS COLORCODES IN IT THAT WOULD MAKE IT IMPOSSIBLE
; TO READ FROM A NORMAL TEXTFILE LISTER.
;
; THANKS.
;
; Select Info/Documentation in BlueBEEP to read this manual.
;
; This doc file is made up to be read by the Doc. Reader (TM)
; (C) 1993 by Onkel Dittmeyer of SLAM
;
; If you are interested in using Doc. Reader (TM) in your
; own programs, contact Onkel Dittmeyer.
;
;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
;
;
;
;
;
;
;
;
;
;
;
|d<><64><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|C BlueBEEP! v0.03<EFBFBD> Quick DoX
|d<><64><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>-
First, I would like to thank all people that used BlueBEEP!,
and told me the bugs, suggested new features, etc. I never
thought that so many of you would switch to BBP, but 2 days
after the release of the 0.02<EFBFBD> version, even users from
australia called me to tell me that they love this program.
|CTHANKS, THANKS, THANKS!!!
Err... One more thing to say. I ran out of fucking $$$.
Means that I had to give my modem away; the HoWLiNG MaD BBS
is DOWN. You can reach me voice under that number - unless I
find some money; the TELEKOM will disconnect my line if I do
not pay the outstanding bill of $180 in the next few days.
On the other hand, I have more time to work on BBP, and with
every version this program becomes more RuLiNG....or what!?
Plus, in this version, |CTLO users can convert their phone
|Cdirectories to BBP |c(even the new version), you can find the
corresponding menu item in the TOOLS menu.
And, ameriKKKan users can use BBP to record redbox tones to
a tape, for all people that do not have a working tape; or
just put your laptop to a payphone :)...
One more thing. Anyone out there has a car and wants to run
over my goddamn mom? Tank drivers preferred...
Finally, I would like to thank the following people for
their support and mental kicks - without them, BBP would not
be half as great as it is today:
|CUrmel
Your TLO inspirated me to make my own blue box. I think
it's going fine so far, too bad that our projects are
now rather worthless (hardcore-timings at MCI, and other
shit). We need software that says "|CTELEKOM, YOU
|CSTARTED THE WAR, YOU GOT IT !|c". And that won't work
without any hardware extensions. Why shouldn't we
cooperate? I will call you up sometime....(when the
TELEKOM decides to put the Geb<65>hrenteilsperre off my
line.....oh shit I'm not kidding).....
Rememeber, when I want to use my mouse, I use windows.
Not TLO. But NICE SOUND PROGRAMMING MAN !
Credits to you for the Sound Routines! Hat off man!
|CJoyce from AT&T USA Direct
Thank you for nice friendship. Nice fun talking to you,
but could you put me through without card please ?
OK you will be fired but who cares :))
|CJohnny Wippenheim
Thank you for the yodeling course, dude. You are the
fucking best yodler on this planet. Yodel On!
|CSmokie the Bear
Without him we wouldn't know who can prevent forest
fires. You know it kids!
|CLord Disembowelment (former TDT)
Gave me the mental kicks that I never stopped working.
Told me funny stories to keep me awake. And, he was
always there when I needed someone to talk to.
SMEIK BOSCHEREN by friend ! :))
|CLucifer
How's life going at the end of the world ? Big thanks
to you for spotting some MAJOR bugs. Lemme know when
your mom's gonna have her next mental orgasm haha....
|CElroy of the Elecronic Rats
Gave me the PD unit to generate tones on
adlib/soundblaster cards. This is the heart of BBP, and
without it it wouldn't even FART.
|CChristopher Schanck
Your Editor rules. Never seen anything more powerful.
BTW every programmer on this world should use it!
|CMarc
Sold me the great Demon Dialer, and gave me lots of
inspiration for new features I should add to BBP.
|CJim Davis
GARFIELD RULES! HAR HAR! ROTFL!!!
|CPing Pong
Lots, pantloads of amusement in the last alliance. You
are so lame d00d. I will send you a cake with a bomb to
your 13th anniversary.
|CGerman TELECOM
GAS'EM. SHOOT'EM. TERMINATE'EM.
What kind of company is this where local calls cost
money?!?
|CThe TNC Staff (especially TONE!)
You shitheads S T I N K. Admit it, you are LOSERS.
Asimov, keep raggin' on at 2400. h0h h0h h0h !
|d<><64><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|C Things that were used during the development of BlueBEEP
|d<><64><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>-
|b-|c 80 boxes of cigarettes
|b-|c 45 litres of world famous M<>llerMilch, Banana Taste
|b-|c 10 litres of plain milk
|b-|c 15 litres of Aldi's Multivitamin-Di<44>t-12-Fruchtnektar
|b-|c at least 300,-- US$ on phone bills
|b-|c 17 AT&T calling cards
|b-|c 398 shows of Married with Children and Who's The Boss
|b-|c 28 shows of Fresh Prince of Bel Air
|b-|c 3 girlfriends
|b-|c 1 mom
|b-|c 16 Garfield Comics
|b-|c 1,893,904 little pieces of paper
|b-|c and, finally, a 386-40 8meg with 212meg HDD and SBPro+SVGA
|d<><64><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|C About the Coding and Source Code
|d<><64><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>-
BlueBEEP was - compiled with Turbo Pascal 6.0
- linked with TLink 1.00
- edited in Bingo Editor 3.00
- guided by HelpPC 2.11 and THelp
- compressed with PKLite 1.03
- ansi-tuned with TheDRAW 4.61
- speeded up with SYS6a
- debugged with Turbo Debugger 2.00
and zipped up with PKZip 1.10a.
Source files used:
C:\TP\SOURCE\TYPES.PAS(162)
C:\TP\SOURCE\EXTRAS.PAS(582)
C:\TP\SOURCE\ODTYPES.PAS(160)
C:\TP\SOURCE\EDITROUT.PAS(465)
C:\TP\SOURCE\SCREEN.PAS(39)
C:\TP\SOURCE\GRWINS.PAS(63)
C:\TP\SOURCE\GRMENUS.PAS(66)
C:\TP\SOURCE\OPTIMER.PAS(102)
C:\TP\SOURCE\BBUNIT.PAS(112)
C:\TP\SOURCE\VGAGRAPH.PAS(103)
C:\TP\SOURCE\BBPANSIS.PAS(617)
SOURCE\BLUEBEEP.PAS(2003)
4474 lines, 3.6 seconds, 57040 bytes code, 31258 bytes data.
Now over to some help on the program, because this is what
this .DOC is supposed to be!
In Action Screen, use the following keys:
|B 0|b..|B1|c for digits
|B A|b..|BH|c for operator codes
|B +|c for trunk
|B ENTER|c for current number
|B F1|c to load new trunk, edit trunks in SETUP menu
|B F2|c to load new dial set, edit dialsets in SETUP menu
|B F10|c for QUICK EXIT (to your terminal program maybe)
|B CurLft/Rt|c to change dial speed
|B CurUp/Dn|c to select a new number
|B ESC|c to return to the main menu
|B SPACE|c to edit the current phone number
Note on the files:
BLUEBEEP.EXE Main Program
BLUEBEEP.PBK |R*|c Phone Book
BLUEBEEP.TRK |R*|c Trunk file
BLUEBEEP.SET |R*|c Dial sets
BLUEBEEP.CFG |R*|c Config file
BLUEBEEP.SCN |R*|c Scanning file
BLUEBEEP.RBX |R*|c Red Box file
BLUEBEEP.DOC You are just reading it..
REVISION.HIS Revision History. Read it for new features!!
CMINSOON.DOC What is coming soon in BlueBEEP ?
SYSOPNFO.DOC Information for Bulletin Board SysOps
Files flagges with "|R*|c" will be created if they don't exist.
For the lastest version call |CSecret Tectonics|c, cool guys know
the goddamn number, or at least the X.25 NUA.
If you don't, send email to onkeld@ponton.hanse.de and I will call
you where you can get the latest version in your area.
For direct support from me, give me a voice call, |C+49-40-EMAILME,
but remember, |CWE HAVE THE CENTRAL EUROPEAN TIME HERE!|c So better
call between 14:00-24:00 CET.
If you have Internet Access send Email to |Conkeld@ponton.hanse.de
I now quit out happily singing "|YHoch auf dem gelben H<>rnchen|c"...
|b <20><><EFBFBD><EFBFBD><EFBFBD>|B<><42>K<EFBFBD><4B>|b<>|BD<42><44><EFBFBD>M<EFBFBD><4D><EFBFBD><EFBFBD>|b<><62><EFBFBD>Ŀ
|b <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|B<><42>|b<><62><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|b (|BAuthor|b)

335
textfiles.com/phreak/bluebox.txt Normal file
View File

@@ -0,0 +1,335 @@
8
---------------------------------------
\ SMACK SPACE TO END /
\ CTRL-S PAUSE /
THIS BULLETIN HAS BEEN TAKEN FROM THE OSUNY FILES FROM 82/83
MANY THANKS TO THE WIZ KID FOR HELPING FILL IN THE MISSING
PORTIONS OF THIS BULLETIN WITH HIS COPY.
ENJOY,
SYSOP OF OSUNY-BBS
914/428-3488
THIS BULLETIN WILL DEAL ONLY WITH THE BASIC CONTRUCTION,
TROUBLESHOOTING AND ADJUSTMENT OF THE BLUE BOX. IF YOU
WOULD LIKE TO KNOW THE SPECIFIC JOB OF ANY PART IN THE
CIRCUIT JUST WRITE ME A MSG AND I WILL BE GLAD TO ANS-
WER IT.
WE ALL KNOW THAT THE TOUCH TONES FREQUENCIES ARE COMPOSED
OF TWO TONES (TWO DIFFERENT FREQS.) SO THAT IS THE REASON
WHY WE HAVE 2 VCO'S ( VOLTAGE CONTROLLED OSCILATORS). WE
WILL CALL THESE VCO#1 AND VCO#2. IF YOU HAVE NOTICED
VCO#1 AND VCO#2 ARE EXACTLY THE SAME TYPE OF CIRCUITS.
THAT IS WHY ONLY ONE WAS DRAWN. BUT REMEMBER THAT WHATEVER
GOES FOR VCO#1 ALSO GOES FOR VCO#2. BOTH VCO'S ARE COMPOSED
OF A HANDFULL OF PARTS. ONE CHIP TWO CAPACITORS 2 RESISTORS
AND FIVE POTENTIOMETERS. ALL OF THIS WILL GIVE YOU (WHEN PROPERLY
CALIBRATED) ONE OF THE FREQS. NECESSARY (THE OTHER ONE WILL
COME FROM VCO#2) FOR THE OPERATION OF THE BB. BOTH OF THESE
FREQS. WILL BE MIXED IN THE SPEAKER THUS FORMING THE REQUIRED
TONE.
THIS IS ONE OF THE MOST SOPHISTICATED DESIGNS I HAVE EVER MADE.
WHY?. BECAUSE OTHER DESIGNS WILL DRAIN THE BATTERY AFTER 10 -
CALLS! THIS DESIGN WILL MAKE THEM LAST 10 MONTHS!!!!!!. BUT
NEVER THE LESS DON'T FORGET TO PUT IN A SWITCH FOR ON AND OFF.
OK LET'S BUILD THE TWO VCO'S AND CALIBRATE THE UNIT BEFORE
WE GET TO THE KEYBOARD CONTRUCTION.
VCO CONTRUCTION
=== ===========
TOOLS REQUIRED
1 OCILLISCOPE (RECOMENDED BUT NOT REQUIRED)
1 FREQ. COUNTER (REQUIRED)
1 VOLT METER " " "
ELECTRONICS TOOLS (PLIERS,DRILL, SCREWDRIVERS, ETC)
PARTS
R1 1.5K RESISTOR 5%
R2 1K RESISTOR 5%
C1 .1UF ELECTROLYTIC CAPACITOR 16VDC
C2 .01UF ELECTROLYTIC CAPACITOR (MYLAR) 16VDC
IC1 2207 VCO CHIP BY EXAR ELECTRINICS
REMEMBER THE ABOVE IT IS ONLY FOR VCO#1 BUT THE SAME GOES FOR
VCO#2.
R3-R4 150 OHM RESISTORS 5%
C3-C4 .1 UF ELECTROLITIC CAPACITOR 10VDC
P1-P10 200K TRIMMER POT - 20 TURNS
DIODES USED IN THE KEYBOARD ARE 1N914 TYPE (40 OF THEM)
AND 13 SWITCHES FOR THE KEYBOARD SPST. MOMENTARY.
SPKR= YOU CAN USE A TELEPHONE SPEAKER FOR THIS(IT WORKS BEST)
BUT REMEMBER TO TAKE OUT THE DIODE THAT IS CONNECTED
ACCROSS IT.
****************************************************************
IMPORTANT NOTES
1 DO NOT USE ANYTHING ELSE THAN A MYLAR CAPACITOR FOR C2
2 PINS 10,9,8 SHOULD BE TIED TOGETHER AND BE LEFT FLOATING.
3 ALL RESISTOR SHOULD BE 5%! NOTHING ELSE
4 A TELEPHONE SPEAKER GIVES THE BEST RESULTS
*****************************************************************
TROUBLE SHOOTING
BY NOW YOU SHOULD HAVE CONSTRUCTED THE TWO VCO'S
ON A BREAD BOARD OR ANYTHING THAT PLEASES YOU.
CHECK FOR COLD SOLDER JOINTS, BROKEN WIRES, POLARITY
OF THE BATTERY, ETC.........
BEFORE WE APPLY POWER TO THE VCO'S WE HAVE TO ADJUST THE POTS
FOR THEIR HALF WAY TRAVEL POINT. THIS IS DONE BY TURNING THEM
21 TURNS TO THE RIGHT AND THEN 10 TURNS TO THE LEFT. DO THE
SAME FOR ALL TEN OF THEM.
NOW APPLY POWER TO THE UNIT CHECK TO SEE THAT YOU HAVE POWER
IN THE CHIPS BY PUTTING THE POSITIVE LEAD OF YOUR VOLT METER
ON PIN 7 AND THE NEGATIVE LEAD ON PIN 12. IF YOU DON'T HAVE
ANYTHING THERE TURN OFF THE UNIT ANT RECHECK THE WIRING.
WHEN YOU GET THE RIGHT VOLTAGES ON THE CHIPS, CONNECT A
DIODE TO A PIECE OF WIRE (LOOK AT FIG. 2 FOR THE ORIENTATION
OF THE DIODE) FROM GROUND TO ANY POT AT POINT T (LOOK CAREFULLY
AT THE SCHEMATIC FOR POINT T IT IS LABELED T1-T10 FOR ALL POTS)
YOU SHOLD BE ABLE TO HEAR A TONE, IF NOT DISSCONNECT THE LEAD
AND PLACE THE SPEAKER CLOSE TO YOUR EAR AND IF YOU HEAR A CHIRP
LIKE SOUND, THIS MEANS THAT THE TWO VCO'S ARE WORKING IF YOU DON'T,
IT MEANS THAT EITHER ONE OR BOTH OF THE VCO'S IS DEAD.
SO IN THIS CASE IT IS ALLWAYS GOOD TO HAVE AN OCILLOSCOPE ON HAND.
DISCONNECT THE SPEAKER FROM THE CIRCUIT AND HOOKUP THE OCILLISCOPE
TO ONE OF THE LEADS OF THE SPEAKER AND THE GROUND FROM THE SCOPE
TO THE GROUND OF THE BATTERY. CONNECT AGAIN THE GROUND LEAD
WITH THE DIODE CONNECTED TO IT FROM GROUND TO ANY POT ON THE
VCO THAT YOU ARE CHECKING AND YOU SHOULD SEE A TRIANGLE WAVE
IF NOT TURN THE POT IN WICH YOU ARE APPLYING THE GROUND TO
QUNTIL YOU SEE IT. WHEN YOU DO SEE IT DO THE THE SAME FOR THE
OTHER VCO TO MAKE SURE IT IS WORKING. (AMPLITUDE IS ABOUT 2VAC)
WHEN YOU GET THE TWO VCO'S WORKING YOU ARE SET FOR THE ADJUSTMENT
OF THE INDIVIDUALS POTS...
ADJUSTMENT
DISCONNECT THE SPEAKER FROM THE CIRCUIT AND CONNECT A FREQ.
COUNTER (THE POSITIVE LEAD OF THE COUNTER TO ONE OF THE SPEAKERS
LEADS THAT BELONGS TO VCO#1 OR CONNECT IT TO PIN 14).
CONNECT THE NEGATIVE LEAD TO THE BATTERY NEGATIVE AND
CONNECT THE JUMPER LEAD WITH THE DIODE FROM GROUND TO POT NUMBER 1
T1 .( THE FIRST POT NUMBER 1 POINT T1)
IF YOU GOT IT WORKING YOU SHOULD HEAR A TONE AND GET A READING ON THE
COUNTER. ADJUST THE POT FOR A FREQ. OF 1700HZ AND CONTINUE DOING THE
SAME FOR POTS 2-5 EXCEPT THAT THEY GET DIFFERENTS FREQS.
P1= 1700HZ
P2= 1300HZ
P3= 1100HZ
P4= 900HZ
P5= 1500HZ
NOW DISCONNECT THE FREQ. COUNTER FROM THE SPEAKER LEAD OF VCO#1 OR
FROM PIN 14 (WHICH EVER YOU HAD IT ATTACHED TO AT THE BEGINNING) AND
CONNECT IT TO THE SPEAKER LEAD OF VCO#2 OR TO PIN 14 OF VCO#2 AND
PERFORM THE SAME ADJUSTMENTS TO P6-10.
P6= 1100HZ
P7= 700HZ
P8= 900HZ
P9= 2600HZ MAGIC NUMBER!!!!!
P10= 1500HZ
WHEN YOU FINISH DOING ALL OF THE POT GO BACK AND RECHECK THEM
AGAIN.
KEYBOARD
IF YOU LOOK AT FIG-2 YOU WILL SEE THAT THE KEYS ARE SIMPLE SWITCHES
CONNECTED TO GROUND AND TWO DIODES ON THE OTHER END. THESE DIODES
ARE USED TO SIMPLIFY THE CONSTRUCTION OF THE KEYBOARD BECAUSE OTHERWISE
THE DISTRIBUTION OF THE GROUND SIGNAL FOR BOTH VCO'S WOULD HAVE BEEN
DONE MECHANICALLY. ONE DIODE WILL GO TO VCO#1 AND THE OTHER WILL GO TO
VCO#2. FIG-3 SHOWS THE ARRANGEMENT OF THE KEYS ON THE KEYBOARD.
BELOW IS A TABLE THAT WILL HELP YOU CONNECT
THE KEYS TO REQUIRED VCO'S POTS.
TO TO FREQ OUT FREQ OUT
KEY POT ON VCO1 POT ON VCO2 PIN 14 VCO1 PIN 14 VCO
C 1 6 1700 1100
0 2 10 1300 1500
E 1 10 1700 1500
1 4 7 900 700
2 3 7 1100 700
3 3 8 1100 900
4 2 7 1300 700
5 2 8 1300 900
6 2 6 1300 1100
7 5 7 1500 700
8 5 8 1500 900
9 5 6 1500 1100
X - 9 ---- 2600
***********************************************************************
* REMEMBER THAT FIG-2 IT IS THE SAME FOR EACH KEY EXCEPT THE "X" WHICH*
* ONLY TAKES ONE DIODE. *
***********************************************************************
AS A FINAL WORD YOU CAN BUILD THIS IN ANY TYPE OF ENCLOSURE
AND SHOULD NEVER BE USED TO MAKE FREE CALLS USING THE TELEPHONE
LINES. I HOPE THIS BULLETIN WILL CLEAR ANY QUESTION YOU MAY
HAD ON THE BLUE BOXES.
IF YOU HAVE ANY QUESTION PLEASE
LEAVE ME A MSG. AND I WILL BE VERY GLAD TO
ANSWER IT.
TXS
MR. AMERICA
PS. I WOULD LIKE TO THANK MY KEYBOARD, MY FINGERS, AND ME
FOR HELPING ME WRITTE THIS BULLETTIN. WITHOUT THEIR HELP
I WOULD HAVE NEVER FINISH THIS PROJECT.
KEY
===
FIRST A FEW KEYS TO THE DIAGRAM:
CX IS CAPACITOR #X DENOTED BY: ---] ]---
PX IS POT OR VARIABLE RESISTOR #X DENOTED BY :/
\
/<--
\
RX IS RESISTOR #X DENOTED BY /\/\/\/\
SCHEMATICS
==========
xD THE XR-2207 CHIP IS A VOLTAGE-CONTROLLED OSCILLATOR AND A 14
PIN DEVICE TH
US YOU MUST BE VERY CAREFUL WHEN SOLDERING THE PARTS
TO THIS DEVICE. IT IS A LITTLE DIFICULT TO ACTUALLY DRAW A
SCHEMATIC ON A 80 CHARACTER SCREN USING LIMITED GRAPHICS BUT WILL
GIVE IT A TRY.
TO GND_____________
]
___
C2 C3 ___
']]' ]
] ] _____]__9V+
] ] ] ]
' ' ' ' ' ' ' ]
------------------------------- ]
]7 6 5 4 3 2 1 ] ]
] < ]
]8 9 10 11 12 13 14] ]
------------------------------- ]
' ' ' ' ' ' ' ]
] ] ]
--] ]--------] ] ]
]C1 R2 ] R1 ]
GND ______]___/\/\/\/\______]_____/\/\/\/\______]
THIS IS A DIAGRAM OF HOW TO LOCATE THE DIFFERENT PINS ON THE
CHIP PLEASE NOTICE THAT PIN ONE IS THE CLOSEST TO THE NOTCH ON TOP
OF THE CHIP. THE FIRST THING WE'LL DO IS TO CONNECT POWER TO THE
CHIP (REMEMBER THAT YOU NEED TO BUILD TWO OF THESE TO GET A
COMPLETE SYSTEM) THIS IS ACCOMPLISHED BY CONNECTING THE POSITIVE
WIRE OF THE BATTERY LEAD TO PIN 1 ONE LEG OF R1 AND R2 IS SOLDER
TO PIN 11 THE OTHER LEG OF R1 GOES TO PIN 1 OR TO THE POSITIVE OF
THE BATTERY. THE OTHER LEG OF R2 GOES TO GROUND, C1 GOES BETWEEN
PIN 10 AND GROUND.
THE TIMING CAPACITOR OR C2 GOES BETWEEN PINS 2 AND 3 OF THE CHIP
PINS 8 AND 9 SHOULD BE GROUNDED TO GROUND. PIN 14 IS THE OUT PUT
AND THIS IS WHERE ONE LEG OF C4 (C3 GOES ON THE OTHER VCO) IN
SERIES WITH R3(THE SAME GOES FOR THE OTHER VCO) AND TO ONE LEAD
OF THE SPEAKER.
{ THE TRIMMER POTS P1 TO P10 SHOULD BE GROUPED IN GROUPS OF 5
POTS EACH. THE WAY YOU GROUP IT IS BY SOLDERING ONE END OF THE
POT TO EACH OTHER LEAVING THE WIPER AND THE OTHER END FREE.
] THIS END GOES TO PIN 6 OF THE CHIP
]
_____________]_____________
/ / / / /
\ \ \ \ \
/<- /<- /<- /<- /<-
\ ] \ ] \ ] \ ] \ ]
/ ] / ] / ] / ] / ]
] ] ] ] ]
] ] ] ] ]
P1 P2 P3 P4 P5
AND FINALLY THIS IS THE WAY EACH KEY SHOULD BE WIRED.
DIODE
TO PX ------>]-----] THIS IS THE CONTACT OF THE KEY
]--------- \------
TO PX ------>]-----] ]
DIODE ]
-----
--- GROUND
-
THIS MAY NOT BE THE BEST WAY TO SHOW THE SCHEMATICS BUT
AT LEAST IT IS SOMETHING.
MR. AMERICA
NOTE: THIS IS FOR INFORMATION ONLY PLEASE DO NOT BREAK ANY LAWS.
PLEASE DIRECT ANY QUESTIONS TO THE SYSOP OR TO MR. AMERICA.
---------------------------------------
COURTESY OF THE INNER VIEW
618/632-9330 10MGS 300/1200
ENTER (1-18, M=MENU, Q=QUIT) :[
o.k
/e/e
/e

[Another fine leach from Ice Pic's Gallery]
Press a key...

From Lunatic Labs UnLtd. 415-278-7421
Press a key...
***********************************************

88
textfiles.com/phreak/blv.txt Normal file
View File

@@ -0,0 +1,88 @@
The following short article appeared in the Winter 1991-92 issue of "2600", a
magazine that bills itself as "The Hacker Quarterly". (Their Internet address
is 2600@well.sf.ca.us) I thought it might be of interest, so I'm passing it
along. Enjoy!
-- Urizen
"U.S. Phone Companies Face Built-In Privacy Hole"
Phone companies across the nation are cracking down on hacker explorations
in the world of Busy Line Verification (BLV). By exploiting a weakness, it's
possible to remotely listen in on phone conversations at a selected telephone
number. While the phone companies can do this any time they want, this recently
discovered self-serve monitoring feature has created a telco crisis of sorts.
According to an internal Bellcore memo from 1991 and Bell Operating Company
documents, a "significant and sophisticated vulnerability" exists that could
affect the security and privacy of BLV. In addition, networks using a DMS-TOPS
architecture are affected.
According to this and other documents circulating within the Bell Operating
Companies, an intruder who gains access to an OA&M port in an office that has a
BLV trunk group and who is able to bypass port security and get "access to the
switch at a craft shell level" would be able to exploit this vulnerability.
The intruder can listen in on phone calls by following these four steps:
"1. Query the switch to determine the Routing Class Code assigned to
the BLV trunk group.
"2. Find a vacant telephone number served by that switch.
"3. Via recent change, assign the Routing Class Code of the BLV
trunks to the Chart Column value of the DN (directory number) of the vacant
telephone number.
"4. Add call forwarding to the vacant telephone number (Remote Call
Forwarding would allow remote definition of the target telephone number
while Call Forwarding Fixed would only allow the specification of one
target per recent change message or vacant line)."
By calling the vacant phone number, the intruder would get routed to the
BLV trunk group and would then be connected on a "no-test vertical" to the
target phone line in a bridged connection.
According to one of the documents, there is no proof that the hacker
community knows about the vulnerability. The authors did express great concern
over the publication of an article entitled "Central Office Operations--The End
Office Environment" which appeared in the electronic newsletter LEGION OF
DOOM/HACKERS TECHNICAL JOURNAL [sic]. In this article, reference is made to the
"No Test Trunk."
The article says, "All of these testing systems have one thing in common:
they access the line through a No Test Trunk. This is a switch which can drop
in on a specific path or line and connect it to the testing device. It depends
on the device connected to the trunk, but there is usually a noticeable click
heard on the tested line when the No Test Trunk drops in. Also, the testing
devices I have mentioned here will seize the line, busying it out. This will
present problems when trying to monitor calls, as you would have to drop in
during the call. The No Test Trunk is also the method in which operator
consoles perform verifications and interrupts."
In order to track down people who might be abbusing this security hole,
phone companies across the nation are being advised to perform the following
four steps:
"1. Refer to Chart Columns (or equivalent feature tables) and validate
their integrity by checking against the corresponding office records.
"2. Execute an appropriate command to extract the directory numbers to
which features such as BLV and Call Forwarding have been assigned.
"3. Extract the information on the directory number(s) from where the
codes relating to BLV and Call Forwarding were assigned to vacant directory
numbers.
"4. Take appropriate action including on-line evidence gathering, if
warranted."
Since there are different vendors (OSPS from AT&T, TOPS from NTI, etc.) as
well as different phone companies, each with their own architecture, the
problem cannot go away overnight.
And even if hackers are denied access to this "feature", BLV networks will
still have the capability of being used to monitor phone lines. Who will be
monitored and who will be listening are two forever unanswered questions.

103
textfiles.com/phreak/bombcb.txt Normal file
View File

@@ -0,0 +1,103 @@
bombcb.txt
CARDBOARD TUBE BOMBS
The following instructions explain how to make a pyrotechnic device that
makes a hell of a lot of smoke and noise, yet emits only a relatively
minor amount of shrapnel.
The best size of cardboard tubing to use for this device is from 1/4"
inner diameter to a maximum of 1/2" inner diameter. The walls should be
about 1/10" to 1/4" thick.
Tools
safety goggles
hot glue gun
power drill or dremel tool
drill bit to fit your fuze wire
knife
ceramic coffee cup
Materials/Supplies
Pyrodex RS or Pyrodex P gun powder
green hobby fuze wire
thin cardboard tube (less than 1/2")
hot glue sticks
scotch tape
SETUP
Put on your safety goggles. Do not proceed any further until you have
some kind of eye protection available.
Lay out a clean work area, and protect the surface you're working on with
either newspapers or old sheets.
Plug in the hot glue gun and set it somewhere to warm up safely.
Pour out a small amount of powder into the coffee cup. You want to keep
this amount as small as possible, in case of accidental detonation.
CONSTRUCTION
You are now ready to begin making bombs! For starters, I recommend 3" to
4" of cardboard tubing. Use a knife and make a CLEAN cut at both ends of
the piece of cardboard. My favorite cardboard is that found on some
brands of clothes hangers. You can use other rolls.
Using either a drill or a dremel tool, drill a single fuze hole exactly
midway down the tube. This hole should fit as tightly around your fuze
wire as possible, so depending on the size of the fuze wire, use an
appropriately sized bit.
Cut a length of fuze wire (4 inches is usually sufficient). Place just
the first 1/10" inside the fuze hole. Using the hot glue gun, carefully
squirt a small bead around the fuze right up against the fuze hole. This
is to seal the fuze hole, as well as to firmly attach the fuze to the
device. When you have squirted the little bead in place, twist the fuze
around, slowly sliding it into the case while continuing to twist it.
This will tend to draw the glue into the case, which will make a very
solid fit and good seal.
When the fuze is all the way in (pressed against the far side of the case
opposite the fuze hole), it's time to begin charging the device. Put a
little piece of scotch tape over one end of the tube (doesn't matter
which). Make sure no powder can leak out past this tape, and then pour
powder into the open end. Make sure the powder is able to fall past the
fuze wire sticking through the tube. Fill the tube completely.
When the tube is completely full of powder, tap the tube to allow the
powder to settle a little bit. When it has stopped settling, carefully
pour out a little bit of the powder. The amount of space you want free at
the top of the tube should be approximately 2 or 3 times the diameter of
the tube. Any less than this will not allow for a strong end seal.
Sticking the nose of the glue gun into the open end, squirt in enough glue
to fill the end, stopping when you have a blob of glue sticking out the
previously open end of the device. Before going any further, you must
wait for this glue plug to cool and solidify. I find this is a good time
to start working on my next device, and I tend to round-robin two or three
of them, so that I have no waiting while the glue cools.
When the glue has cooled, turn the glue end down and carefully peel back
the scotch tape. At this end you want to repeat what you did before,
pouring out enough of the powder to accommodate a glue plug.
When the second glue plug has cooled and solidified, you now have a
completed device! For grinners, you can dip the thing into paint, or
spraypaint it. If you want additional water-resistance, dip the device
into a thick enamel paint, or some of that liquid rubber/plastic tool
coating stuff.
DETONATION
The most dangerous parts of this device are the two glue plugs at each
end, as they can fly off with incredible force. Make sure you and others
are protected from this type of shrapnel.
If you have water-proofed them with a thick enamel paint, you can even
toss these devices into swimming pools once the fuze has been lit.
Good things to launch skyward with these devices include aluminum cans,
hubcaps, empty paint cans, old shoes, feisty cats, and anything else you
can fit one of these babies underneath. Have fun!

119
textfiles.com/phreak/booksabo.pho Normal file
View File

@@ -0,0 +1,119 @@
Date: Fri, 8 Jun 90 14:28:46 EDT
From: W T Sykes <wts@winken.att.com>
Subject: Re: Books on Telephony History
Organization: AT&T Federal Systems Research and Development - Burlington, NC
In article <8786@accuvax.nwu.edu> bbt!kfc@rti.uucp writes:
>I need some help from the telcom book worms.
>I am interested in getting titles of interesting books on the history
>of telephony. Everything from A. G. Bell biographies to the early
>days of AT&T.
>I would like to know which books are not be missed and those that I
>should not waste my time on.
>Please send title, author, and publishing company (to aid me in
>finding it) directly to me or post. If I get good response I will
>foward a summary to PT.
Patrick,
The following list and descriptions of books published by AT&T was
forwarded to kfc@bbt.UUCP. If suitable for the DIGEST you can use
them for publication. It is not my intent to advertise for my
employer, but I feel these texts are germaine interests of the DIGEST.
All descriptions are lifted without permission from an internal guide,
but all the listed texts are available for sale to the general public
. (All typos are mine.)
William T. Sykes
AT&T Fed. Sys. R&D
_A HISTORY OF ENGINEERING AND SCIENCE IN THE BELL SYSTEM SERIES -
THE EARLY YEARS (1875-1926)_; This first volume offers a
detailed overview of the first 50 years of telephone technology.
The narrative goes well beyond a simple statement of events to
deal with the "how" and "why" of technological innovation.
1073 pgs. SELECT CODE 500-467 $47.00
_A HISTORY OF ENGINEERING AND SCIENCE IN THE BELL SYSTEM SERIES -
NATIONAL SERVICE IN WAR AND PEACE (1925-1975)_; This second
volume focuses on the Bell System's contributions to
national defense before and during World War II and in the cold
war missle crisis that followed. The central subject is
engineering for urgent national defense and how the technology
of communications was adapted quickly, and in many ways
specifically for, the compelling needs of a nation at war.
757 pgs. SELECT CODE 500-468 $47.00
_A HISTORY OF ENGINEERING AND SCIENCE IN THE BELL SYSTEM SERIES -
SWITCHING TECHNOLOGY (1925-1975)_; This third volume
chronicles how switching evolved from early years characterized
by manual switchboards to the complete automation of today.
The major innovations that produced generations of switches
operating at higher and higher speeds and handling functions of
increasing complexity and flexibility are discussed.
639 pgs. SELECT CODE 500-469 $47.00
[DESCRIPTION OF 500-470 MISSING FROM MY CATALOG - wts]
_A HISTORY OF ENGINEERING AND SCIENCE IN THE BELL SYSTEM SERIES -
COMMUNICATIONS SCIENCES (1925-1980)_; This fifth volume
covers those areas of scientific research having a direct
bearing on communications. The disciplines covered are
mathematics, acoustics, picture communications, vacuum-tube
electronics, radio and microwave research, waveguides,
lightwave communications, switching, computer science,
digital communications, behavioral science, and economics.
521 pgs. SELECT CODE 500-471 $47.00
_A HISTORY OF ENGINEERING AND SCIENCE IN THE BELL SYSTEM SERIES -
ELECTRONIC TECHNOLOGY (1925-1975)_; This sixth volume is a
detailed view of the developments in electronics, from
electron tubes through thin-film. It also tells the story
of devices and components developed at AT&T between 1925 and
1975 and the major role they played in the expansion of
telecommunications during the middle of the century.
370 pgs. SELECT CODE 500-472 $47.00
_A HISTORY OF ENGINEERING AND SCIENCE IN THE BELL SYSTEM SERIES -
TRANSMISSION TECHNOLOGY (1925-1975)_; This seventh and final
volume is the story of transmission research and development
as it evolved in the middle years of the 20th Century.
812 pgs. SELECT CODE 500-473 $47.00
_ENGINEERING AND OPERATIONS IN THE BELL SYSTEM_;
This second edition of the popular text, completely revised
and restructured, offers a comprehensive view of the Bell
System in 1982-1983 just before divestiture. This book will
be useful as a general reference for anyone interested in a
first-level description of telecomunications networks and
their elements.
250 pgs. SELECT CODE 500-478 $42.60
All of the above are published by AT&T and may be obtained from
AT&T
Customer Information Center
Marketing Department
2855 N. Franklin Road
Indianapolis, IN 46209-1998
VISA, MasterCard, and American Express orders can be taken by voice at
1-800-432-6600, between 7:30 a.m. and 6:30 p.m. -EST (1-800-255-1242,
from Canada). Facsimile orders can be transmitted to: 1-317-352-8484.
William T. Sykes AT&T Federal Systems R&D Burlington, NC att!winken!wts

12
textfiles.com/phreak/booth Normal file
View File

@@ -0,0 +1,12 @@
Phone Booth Wins Again
. Three men who stole a telephone booth from a service station lot and tried
to put it inside a friend's apartment as a pratical joke were foiled when
the booth would not fit through the doorway, police in Maple Shade, New
Jersey said.
. A patrolman responding to an anonymous call about three men trying to
carry a phone booth into an apartment, found the pranksters replacing the
front door.
. The men were released on $2,000 bail each after being charged with theft.

211
textfiles.com/phreak/british.txt Normal file
View File

@@ -0,0 +1,211 @@
File: A HISTORY OF BRITISH PHREAKING
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$ $
$ The History Of British Phreaking $
$ -=- -=-=-=- -- -=-=-=- -=-=-=-=- $
$ $
$ The second in a series of $
$ THE HISTORY OF.....philes $
$ $
$ Written and Uploaded by: $
$ $
$$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$$
$ and $
$ The Legion Of Doom! $
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
With thanks to Peter McIvers for the list of frequencies mentioned later in
this phile.
NOTE: the British Post Office, is the U.S. equivelent of Ma Bell.
In Britain, phreaking goes back to the early fifties, when the technique of
'Toll A drop back' was discovered. Toll A was an exchange near St. Pauls which
routed calls between London and nearby non-London exchanges. The trick was to
dial an unallocated number, and then depress the reciever-rest for 1/2 second.
This flashing initiated the 'clear forward' signal, leaving the caller with an
open line into the Toll A exchange. He could thjen dial 018, which forwarded
him to the trunk exchange- at that time, the first long distance exchange in
Britain- and foll ow it with the code for the distant exchange to which he
would be connect ed at no extra charge.
The signals needed to control the UK network today were published in the
"Institution of Post Office Engineers Journal" and reprinted in the Sunday
Times (15 Oct. 1972).
The signalling system they use: signalling system No. 3 uses pairs of
frequencies selected from 6 tones separated by 120Hz. With that info, the
phreaks made "Bleepers" or as they are called here in the U.S. "Blue Box", but
they do utilize different MF tones then the U.S., thus, your U.S. blue box that
you smuggled into the UK will not work, unless you change the frequencies.
In the early seventies, a simpler system based on different numbers of
pulses with the same frequency (2280Hz) was used. For more info on that, try to
get ahold of: Atkinson's "Telephony and Systems Technology".
The following are timing and the frequencies for boxing in the UK and other
foreign countries. Special thanks to Peter McIvers for the phollowing inpho:
British "bleeper" boxes have the vaery same layout as U.S. blue boxes. The
frequencies are different, though. They use two sets of frequencies, forward
and backward. Forward signals are sent out by the bleeper box; the backward
signals may be ignored (it's sort of like using full duplex). The frequencies
are as follows:
U.S.:
US: 700 900 1100 1300 1500 1700
Forward: 1380 1500 1620 1740 1860 1980 Hz
Backward: 1140 1020 900 780 660 540 Hz
for example, change the 900 Hz potentiometers in your box to 1500 Hz. All
numbers 1-0 (10) are in the same order as in an American box. The ones after
this are thier codes for operator 11, operator 12, spare 13, spare 14, and 15.
One of these is KP, one (probably 15) is Star; it won't be too hard to figure
out. The signals should carry -11.5dBm +/- 1dB onto the line; the frequencies
should be within +/- 4Hz (as is the British equipment). Also, the 1VF system is
still in operation in parts of the U.K. This would encode all signals 1 to 16 as binary numbers; for instance, a five is 0101. There are six intervals per
digit, each 50ms long r a total of 300ms. First is a start pulse of 2280 for
50ms. Then, using the example of five (0101), there is a 50ms pause, a 50ms
pulse of 2280, a 50ms pause, and a 50ms pulse of 2280. Finally, there is a
50ms pause that signals the end of the digit. The frequency tolerance on the
2280 Hz is +/- 0.3%; it is sent at -6 +/- 1dBm. An idle line is signaled by
the presence of a 3825Hz tone for more than 650ms. This must be within 4Hz.
France uses the same box codes as the US, with an additional 1900Hz
acknowledgement signal, at -8.7 +/- 1dBm per frequency.
Spain uses a 2 out of 5 mf code (same frequencies as US), with a 1700 Hz
acknowledge signal.
Other places using the 1VF system are:
Australia, 2280Hz +/-6Hz, 35ms/digit at -6dB.
Germany, France: same as Australia; also, some 1VF systems in the UK.
Switzerland: same as Australia, only it uses 3000Hz, not 2280.
Sweeden: same as above, but at 2400Hz.
Spain: some parts use 1VF with 2500Hz.
There is one other major system: the 2VF system. In this system, each digit is
35ms long. The number is encoded in binary as with the 1VF system. Using the
example of five (0101), here's how the American 2VF system was sent:
2400 pulse, pause, 2040 pulse, pause, 2400 pulse, pause, 2040 pulse, pause. The
digits and pauses are all 35ms long, for a total of 280ms per digit. Other
countries are still using a similar high/low pair with the same timings. Some
parts of Italy use the 1VF system with 2040Hz; some use the 2VF system with
2040 and 2400 (same as original US) Hz. The Netherlands uses a 2VF system with
2400 and 2500 Hz pulses. With the 2VF system, all frequencies should be within
2Hz.
Also, here are some specs for American phone equipment:
Dial Tone: 350+440Hz, -17.5 to -14.5 dBm/tone.
Off-Hook (ROH): 1400+2060+2450+2600(!) on/off 5 times per second
Busy: 480+620Hz; solow busy: 0.5 +/- 0.05 sec = 1 period
(about twice a second), at -28.5 to -22.5 dBm/tone.
Ring: 440+480 Hz at -23.5 to -20.5 dBm/tone.
A ring is modulated at 20 +/- 3Hz, 2sec on, 4sec off.
Call waiting: 440Hz, on 1 second.
Recorder Connection: 1400Hz, beeps every 15minutes.
Multiparty line ring: sam% frequency and modulation as ring, but 1sec on, 2sec
off (twice as fast).
Now, back to British Phreaking:In the early days of British phreaking, the
Cambridge University Titan Computer was used to record and circulate numbers
found by the exhaustive dialing of local networks. These number s were used to
create a chain of links from local exchange to local exchange across the
country, bypassing the trunk circuits. Because the internal routing codes in
the UK network are not the same as those dialed by the caller, the phreaks had
to discover them by 'probe and listen' techniques or more commonly known in the
U.S.--SCANNING. What they did was put in likely signals and listened to find
out if they succeeded. The results of scanning were circulated to other
phreaks. Discovering each other took time at first, but evenutally the phreaks
became organized. The "TAP" of Britain was called "Undercurrents" which enabled
British phreaks to share the info on new numbers, equipment etc.
To understand what the British british phreaks did, think of the phone
netowrk in three layers of lines: Local, trunk, and international. In the UK,
Subcriber Trunk Dialing (STD), is the mechanism which takes a call from the
local lines and (legitimately) elevates it to a trunk or international
level. The UK phreaks figured that a call at trunk level can be routed through
any number of exchanges, provided that the right routing codes were found and
used correctly. They also had to discover how to get from local to trunk level
either without being charged (which they did with a bleeper box) or without
using (STD). Chaining has already been mentioned but it requires long strings
of digits and speech gets more and more faint as the chain grows, just like
it does when you stack trunks back and forth accross the U.S. The way the
security reps snagged the phreaks was to put a simple 'printermeter' or as we
call it: a pen register on the suspects line, which shows every digit dialed
from the subscribers line.
The British prefer to get onto the trunks rather than chaining. One way was
to discover where local calls use the trunks between neighboring exchanges,
start a call and stay on the trunk instead of returning to the local level on
reaching the distant switch. This again required exhaustive dialing and made
more work for Titan; it also revealed 'fiddles', which were inserted by Post
Office Engineers. What fiddling means is that the engineers rewired the
exchanges for thier own benefit. The equipment is modified to give access to a
trunk with out being charged, an operation which is pretty easy in Step by Step
(SXS) electromechanical exchanges, which were installed in Britain even in the 1970s (NOTE: I know of a back door into the Canadian system on a 4A CO., so if
you are on SXS or a 4A, try scanning 3 digit exchanges, ie: dial 999,998,997
etc. and listen for the beep-kerchink, if there are no 3 digit codes which
allow direct access to a tandem in your local exchange and bypasses the AMA so
you won't be billed, not have to blast 2600 every time you wish to box a call.
A famous British 'fiddler' revealed in the early 1970s worked by dialing 173.
The caller then added the trunk code of 1 and the subscribers local number. At
that time, most engineering test services began with 17X, so the engineers
could hide thier fiddles in the nest of service wires. When security reps
started searching, the fiddles were concealed by tones signalling: 'number
unobtainalbe' or 'equipment engaged' which switched off after a delay. The
necessary relays are small and easily hidden.
$There was another side to phreaking In the UK in the sixties. Before STD was
widespread, many 'ordinary' people were driven to occasional phreaking from
sheer frustration at the inefficient operator controlled trunk system.
This came to a head during a strike about 1961 when operators could not be
reached. Nothing complicated was needed. Many operators had been in the habit
of repeating the codes as they dialled the requested numbers so people soon
learnt the numbers they called frequently. The only 'trick' was to know which
exchanges could be dialled through to pass on the trunk number. Callers also
needed a pretty quiet place to do it, since timing relative to clicks was important
The most famous trial of British phreaks was called the Old Baily trial. Which
started on 3 Oct. 1973. What they phreaks did was to dial a spare number at a
local call rate but involving a trunk to another exchange Then they send a
'clear forward' to thier local exchange, indicating to it that the call is
finished;but the distant exchange doesn't realize because the caller's phone is
still Off the hook. They now have an open line into the distant trunk exchange
and sends to it a 'seize' signal: '1' which puts him onto its outgoing lines.
Now, if they know the codes, the world is open to them. All other exchanges
trust his local exchange to handle the billing; they just interpret the tones
they hear. Mean while, the local exchange collects only for a local call. The
investigators discovered the phreaks holding a conference somewhere in England
surrounded by various phone equipment and bleeper boxes, also printouts listing
'secret' Post Office codes. (They probably got them from trashing?) The judge
said: "some take to heroin, some take to telephones" for them phone phreaking
was not a crime but a hobby to be shared with phellow enthusists and discussed
with the Post Office openly over dinner and by mail. Their approach and
attitude to the worlds larges computer, the global telephone system, was that
of scientist s conducting experiments or programmers and engineers testing
programs and systems. The judge apeared to agree, and even asked them for
phreaking codes to use from his local exchange!!!
$-The End-$
Look for my other phine philes: The History Of E.S.S.
Electronic Toll fraud devices (Boxes)
Bell Security Tactics
& other typed in philes on many subjects.
And coming soon to a Phreak Board near You: All you ever wanted to know about
any Central Office, from SXS, PANEL to E.S.S. #1.
Later on......$-=>Lex Luthor<=-$
Remote sysop of Plover-net 516-935-2481 and Sysop of: The Legion Of Doom!
305-COE-XXXX
If your good, you'll find out the #.
[Courtesy of Sherwood Forest ][ -- (914) 359-1517]


130
textfiles.com/phreak/brtphrk.txt Normal file
View File

@@ -0,0 +1,130 @@
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$ $
$ THE HISTORY OF BRITISH PHREAKING $
$ -=- -=-=-=- -- -=-=-=- -=-=-=-=- $
$ $
$ THE SECOND IN A SERIES OF $
$ THE HISTORY OF.....PHILES $
$ $
$ WRITTEN AND UPLOADED BY: $
$ $
$$$$$$$$$$$$-=>LEX LUTHOR<=-$$$$$$$$$$$
$ AND $
$ THE LEGION OF DOOM! $
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
NOTE: THE BRITISH POST OFFICE, IS THE U.S. EQUIVALENT OF MA BELL.
IN BRITAIN, PHREAKING GOES BACK TO THE EARLY FIFTIES, WHEN THE TECHNIQUE OF
'TOLL A DROP BACK' WAS DISCOVERED. TOLL A WAS AN EXCHANGE NEAR ST. PAULS
WHICH ROUTED CALLS BETWEEN LONDON AND NEARBY NON-LONDON EXCHANGES. THE TRICK
WAS TO DIAL AN UNALLOCATED NUMBER, AND THEN DEPRESS THE RECEIVER-REST FOR 1/2
SECOND. THIS FLASHING INITIATED THE 'CLEAR FORWARD' SIGNAL, LEAVING THE CALLER
WITH AN OPEN LINE INTO THE TOLL A EXCHANGE.THE COULD THEN DIAL 018, WHICH
FORWARDED HIM TO THE TRUNK EXCHANGE AT THAT TIME, THE FIRST LONG DISTANCE
EXCHANGE IN BRITAIN AND FOLLOW IT WITH THE CODE FOR THE DISTANT EXCHANGE TO
WHICH HE WOULD BE CONNECTED AT NO EXTRA CHARGE.
THE SIGNALS NEEDED TO CONTROL THE UK NETWORK TODAY WERE PUBLISHED IN THE
"INSTITUTION OF POST OFFICE ENGINEERS JOURNAL" AND REPRINTED IN THE SUNDAY
TIMES (15 OCT. 1972).
THE SIGNALLING SYSTEM THEY USE: SIGNALLING SYSTEM NO. 3 USES PAIRS OF
FREQUENCIES SELECTED FROM 6 TONES SEPARATED BY 120HZ. WITH THAT INFO, THE
PHREAKS MADE "BLEEPERS" OR AS THEY ARE CALLED HERE IN THE U.S. "BLUE BOX", BUT
THEY DO UTILIZE DIFFERENT MF TONES THEN THE U.S., THUS, YOUR U.S. BLUE BOX
THAT YOU SMUGGLED INTO THE UK WILL NOT WORK, UNLESS YOU CHANGE THE
FREQUENCIES.
IN THE EARLY SEVENTIES, A SIMPLER SYSTEM BASED ON DIFFERENT NUMBERS OF PULSES
WITH THE SAME FREQUENCY (2280HZ) WAS USED. FOR MORE INFO ON THAT, TRY TO GET A
HOLD OF: ATKINSON'S "TELEPHONY AND SYSTEMS TECHNOLOGY".
IN THE EARLY DAYS OF BRITISH PHREAKING, THE CAMBRIDGE UNIVERSITY TITAN
COMPUTER WAS USED TO RECORD AND CIRCULATE NUMBERS FOUND BY THE EXHAUSTIVE
DIALING OF LOCAL NETWORKS. THESE NUMBERS WERE USED TO CREATE A CHAIN OF LINKS
FROM LOCAL EXCHANGE TO LOCAL EXCHANGE ACROSS THE COUNTRY, BYPASSING THE TRUNK
CIRCUITS. BECAUSE THE INTERNAL ROUTING CODES IN THE UK NETWORK ARE NOT THE
SAME AS THOSE DIALED BY THE CALLER, THE PHREAKS HAD TO DISCOVER THEM BY 'PROBE
AND LISTEN' TECHNIQUES OR MORE COMMONLY KNOWN IN THE U.S.-- SCANNING. WHAT
THEY DID WAS PUT IN LIKELY SIGNALS AND LISTENED TO FIND OUT IF THEY SUCCEEDED.
THE RESULTS OF SCANNING WERE CIRCULATED TO OTHER PHREAKS. DISCOVERING EACH
OTHER TOOK TIME AT FIRST, BUT EVENTUALLY THE PHREAKS BECAME ORGANIZED. THE
"TAP" OF BRITAIN WAS CALLED "UNDERCURRENTS" WHICH ENABLED BRITISH PHREAKS TO
SHARE THE INFO ON NEW NUMBERS, EQUIPMENT ETC.
TO UNDERSTAND WHAT THE BRITISH BRITISH PHREAKS DID, THINK OF THE PHONE
NETWORK IN THREE LAYERS OF LINES: LOCAL, TRUNK, AND INTERNATIONAL.#IN THE UK,
SUBSCRIBER TRUNK DIALING (STD), IS THE MECHANISM WHICH TAKES A CALL FROM THE
LOCAL LINES AND (LEGITIMATELY) ELEVATES IT TO A TRUNK OR INTERNATIONAL
LEVEL.#THE UK PHREAKS FIGURED THAT A CALL AT TRUNK LEVEL CAN BE ROUTED THROUGH
ANY NUMBER OF EXCHANGES, PROVIDED THAT THE RIGHT ROUTING CODES WERE FOUND AND
USED CORRECTLY. THEY ALSO HAD TO DISCOVER HOW TO GET FROM LOCAL TO TRUNK LEVEL
EITHER WITHOUT BEING CHARGED (WHICH THEY DID WITH A BLEEPER BOX) OR WITHOUT
USING (STD). CHAINING HAS ALREADY BEEN MENTIONED BUT IT REQUIRES LONG STRINGS
OF DIGITS AND SPEECH GETS MORE AND MORE FAINT AS THE CHAIN GROWS, JUST LIKE IT
DOES WHEN YOU STACK TRUNKS BACK AND FORTH ACROSS THE U.S.#THE WAY THE SECURITY
REPS SNAGGED THE PHREAKS WAS TO PUT A SIMPLE 'PRINTERMETER' OR AS WE CALL IT:
A PEN REGISTER ON THE SUSPECTS LINE, WHICH SHOWS EVERY DIGIT DIALED FROM THE
SUBSCRIBERS LINE.
THE BRITISH PREFER TO GET ONTO THE TRUNKS RATHER THAN CHAINING. ONE WAY WAS
TO DISCOVER WHERE LOCAL CALLS USE THE TRUNKS BETWEEN NEIGHBORING EXCHANGES,
START A CALL AND STAY ON THE TRUNK INSTEAD OF RETURNING TO THE LOCAL LEVEL ON
REACHING THE DISTANT SWITCH. THIS AGAIN REQUIRED EXHAUSTIVE DIALING AND MADE
MORE WORK FOR TITAN; IT ALSO REVEALED 'FIDDLES', WHICH WERE INSERTED BY POST
OFFICE ENGINEERS.
WHAT FIDDLING MEANS IS THAT THE ENGINEERS REWIRED THE EXCHANGES FOR THEIR OWN
BENEFIT. THE EQUIPMENT IS MODIFIED TO GIVE ACCESS TO A TRUNK WITH OUT BEING
CHARGED, AN OPERATION WHICH IS PRETTY EASY IN STEP BY STEP (SXS)
ELECTROMECHANICAL EXCHANGES, WHICH WERE INSTALLED IN BRITAIN EVEN IN THE 1970S
(NOTE: I KNOW OF A BACK DOOR INTO THE CANADIAN SYSTEM ON A 4A CO., SO IF YOU
ARE ON SXS OR A 4A, TRY SCANNING 3 DIGIT EXCHANGES, IE: DIAL 999,998,997
ETC.#AND LISTEN FOR THE BEEP-KERCHINK, IF THERE ARE NO 3 DIGIT CODES WHICH
ALLOW DIRECT ACCESS TO A TANDEM IN YOUR LOCAL EXCHANGE AND BYPASSES THE AMA SO
YOU WON'T BE BILLED, NOT HAVE TO BLAST 2600 EVERY TIME YOU WISH TO BOX A CALL.
A FAMOUS BRITISH 'FIDDLER' REVEALED IN THE EARLY 1970S WORKED BY DIALING 173.
THE CALLER THEN ADDED THE TRUNK CODE OF 1 AND THE SUBSCRIBERS LOCAL NUMBER. AT
THAT TIME, MOST ENGINEERING TEST SERVICES BEGAN WITH 17X, SO THE ENGINEERS
COULD HIDE THEIR FIDDLES IN THE NEST OF SERVICE WIRES. WHEN SECURITY REPS
STARTED SEARCHING, THE FIDDLES WERE CONCEALED BY TONES SIGNALLING: 'NUMBER
UNOBTAINALBE' OR 'EQUIPMENT ENGAGED' WHICH SWITCHED OFF AFTER A DELAY. THE
NECESSARY RELAYS ARE SMALL AND EASILY HIDDEN.
THERE WAS ANOTHER SIDE TO PHREAKING IN THE UK IN THE SIXTIES. BEFORE STD WAS
WIDESPREAD, MANY 'ORDINARY' PEOPLE WERE DRIVEN TO.
OCCASIONAL PHREAKING FROM SHEER FRUSTRATION AT THE INEFFICIENT OPERATOR
CONTROLLED TRUNK SYSTEM. THIS CAME TO A HEAD DURING A STRIKE ABOUT 1961 WHEN
OPERATORS COULD NOT BE REACHED. NOTHING COMPLICATED WAS NEEDED. MANY
OPERATORS HAD BEEN IN THE HABIT OF REPEATING THE CODES AS THEY DIALLED THE
REQUESTED NUMBERS SO PEOPLE SOON LEARNT THE NUMBERS THEY CALLED FREQUENTLY.
THE ONLY 'TRICK' WAS TO KNOW WHICH EXCHANGES COULD BE DIALLED THROUGH TO PASS
ON THE TRUNK NUMBER.CALLERS ALSO NEEDED A PRETTY QUIET PLACE TO DO IT, SINCE
TIMING RELATIVE TO CLICKS WAS IMPORTANT THE MOST FAMOUS TRIAL OF BRITISH
PHREAKS WAS CALLED THE OLD BAILY TRIAL.#WHICH STARTED ON 3 OCT. 1973.#WHAT
THEY PHREAKS DID WAS TO DIAL A SPARE NUMBER AT A LOCAL CALL RATE BUT INVOLVING
A TRUNK TO ANOTHER EXCHANGE THEN THEY SEND A 'CLEAR FORWARD' TO THEIR LOCAL
EXCHANGE, INDICATING TO IT THAT THE CALL IS FINISHED;BUT THE DISTANT EXCHANGE
DOESN'T REALIZE BECAUSE THE CALLER'S PHONE IS STILL OFF THE HOOK. THEY NOW
HAVE AN OPEN LINE INTO THE DISTANT TRUNK EXCHANGE AND SENDS TO IT A 'SEIZE'
SIGNAL: '1' WHICH PUTS HIM ONTO ITS OUTGOING LINES NOW, IF THEY KNOW THE
CODES, THE WORLD IS OPEN TO THEM. ALL OTHER EXCHANGES TRUST HIS LOCAL EXCHANGE
TO HANDLE THE BILLING; THEY JUST INTERPRET THE TONES THEY HEAR. MEAN WHILE,
THE LOCAL EXCHANGE COLLECTS ONLY FOR A LOCAL CALL. THE INVESTIGATORS
DISCOVERED THE PHREAKS HOLDING A CONFERENCE SOMEWHERE IN ENGLAND SURROUNDED BY
VARIOUS PHONE EQUIPMENT AND BLEEPER BOXES, ALSO PRINTOUTS LISTING 'SECRET' POST
OFFICE CODES. (THEY PROBABLY GOT THEM FROM TRASHING?) THE JUDGE SAID: "SOME
TAKE TO HEROIN, SOME TAKE TO TELEPHONES" FOR THEM PHONE PHREAKING WAS NOT A
CRIME BUT A HOBBY TO BE SHARED WITH PHELLOW ENTHUSIASTS AND DISCUSSED WITH THE
POST OFFICE OPENLY OVER DINNER AND BY MAIL. THEIR APPROACH AND ATTITUDE TO THE
WORLDS LARGEST COMPUTER, THE GLOBAL TELEPHONE SYSTEM, WAS THAT OF SCIENTISTS
CONDUCTING EXPERIMENTS OR PROGRAMMERS AND ENGINEERS TESTING PROGRAMS AND
SYSTEMS. THE JUDGE APPEARED TO AGREE, AND EVEN ASKED THEM FOR PHREAKING CODES
TO USE FROM HIS LOCAL EXCHANGE!!!
# $-THE END-$

212
textfiles.com/phreak/bsbell1.phk Normal file
View File

@@ -0,0 +1,212 @@
BULLSHITTING THE PHONE
COMPANY OUT OF
IMPORTANT INFORMATION
*******************************************************************************
Preface
-------
In the past, there have been very few good, useful text files. There would
be files telling you how you should act, how this or that worked, who got
busted, what this or that acronym stood for, and other things you didn't care
about or couldn't use. After reading some of the various technical journals,
phreak/hack magazines, gossip columns, etc., one would come away with the
feeling:
"Gee, that person that wrote that really knows alot (or is good at copying
manuals)" or
"I really don't care what m0dem rulr's favorite color or favorite movie is"
Unfortunately, one -WOULD NOT- come away with the feeling:
"Gee, I really got alot out of this file that I can use, something that will
help in a practical application."
This is because, sad to say, these files were written with the idea:
"Look how cool I am, I know this and I know that" in mind..
This file, however, is written with the idea:
"Cool, I showed you how to do this or showed you how to do that" in mind..
In this file, the following will be covered:
* The wonderful CSSC and what can be done with it
* Uses of the LAC (getting numbers from street address, unpub or not)
* Finding conference bridge numbers
* Bullshitting the Bell Business Office
THE CSSC:
--------
CSSC stands for Customer Sales and Service Center. There are several of
these across the country. Each can be reached by dialing a separate 1-800
number, but the one local to you (or that handles your area) can be reached by
dialing 1-800-222-0300 (This number appears on the bill you get from AT&T, as
it -IS- the AT&T billing office). Each CSSC can handle the entire U.S., though.
Following is what you can get from the CSSC (CN/A numbers and ID's, Customer
names and addresses, Customer Toll records)
CN/A NUMBERS AND ID's:
---------------------
Call the CSSC, say you are from an AT&T office, say AT&T Northeastern
Administrative Offices, or something to that effect. Depending on what type of
person you get when you call, it may be easy or it may be difficult. After you
identify yourself, say that you were given a bit of incorrect info and need the
correct info. For example:
"This is Bob Dwyer from Northeastern Administrative AT&T Offices, and we were
given a bit of incorrect information from this office. We were given the CN/A
number for Colorado as 518-471-8111, and that is the CN/A number for New York.
What do you show as the correct number for the CN/A for Colorado? Could you
check your HANDBOOK? (All CN/A info is kept in a reference guide called a
HANDBOOK)
The same thing can be done for CN/A ID's that is done for numbers.
*IMPORTANT NOTE*- If you screw up with one customer service rep, DO NOT LOSE
YOUR COOL! If they ask you a question that you do not know the answer to,
simply say that you must ask your supervisor, will get back witm, good-bye.
Then, you can call right back because you get a different person every time you
call.
NAMES, NUMBERS, & TOLL RECORDS
------------------------------
The CSSC also has people's names and addresses cross-referenced by number.
If you call and say you are from another AT&T Department, say that your
computers are down, and that you need them to check a number in RCAM (pronounced
Ar Kam) they should be happy to help you.
For Example:
"Hi, this is Bob Dwyer at AT&T Northeaster Administrative Offices. How are
your computers doing? Really? Ours are down. I have a number here; I need you
to see if you show it as a live account, because I *believe* that we show it to
be dead, could you check it in RCAM?
(Then give them the number, and they will say it is a live account)
"Really?? Do you show an address, or a p.o. box on that number? What do you
show as the address, we were sure it was dead? Do you show that as a dupe
account? (Dupe means duplicate) Who do you show that account for?" etc.
Again, remember, if you screw up or if they are suspicious, simply tell them you
must check with your supervisor, hang up, and call right back because you get a
different person every time.
At the CSSC, they also have toll records for all the long-distance AT&T calls
that that person made.
Simply ask the CSSC rep (after saying that your computers are down) to check all
the RETURNS on the bill. (RETURNS is the word that they use for calls).
THE LOOP ASSIGNMENT CENTER (LAC):
--------------------------------
At the LAC (an inter-office bell department), they can put an address into
the computer and come up with the phone number. The person's name will not come
up; only the phone number will come up. However, you MUST have the full street
address.
Here is how you get the # to the
LAC:
Call up the Business Office and say something to the effect of:
"Hi, this is Bob Dwyer with repair, what do you show as the number for the LAC
_
_
_
_
Line Assignment Center that handles the Houston Area (or whatever area or prefix
you need info on)
"
After they give you the number, call up the LAC and say something like:
"Hi, this is Bob Dwyer with repair, I have an address here and I need to know
the cable pair and phone number going into that address"
(You don't really need the cable pair, but if you say cable pair, they are more
likely to think that you are a phone co. employee).
BULLSHITTING BELL, IN GENERAL:
-----------------------------
It is pretty easy to BS the Bell Business Office. Simply call and identify
yourself as a worker in another Bell Office (for example repair, the LAC, etc.),
state what you need, and they should be happy to help you.
If you have a deep voice and not a 2600 hz voice, it usually helps. But you
could always pretend you are a woman if your voice is too high.
For example, if you need another phone number going into someone's house, anad
already have of of them, the business office would be an easy way to get that
information. If they have changed their number to a non-pubished number, ask
the rep if they show any ORDER ACTIVITY on the line, for example:
"Hi, this is Bob Dwyer with repair, do you show any order activity on 555-2344?
Do you show a C order? (C order means an order to Change service) Or a D order?
(An order to Disconnect service)"
If there is a C order, ask them what the C order did, for example, to get the
new number, or find out what Custom Calling features the person added, or
whatever.
FINDING BRIDGE NUMBERS:
----------------------
Conference Bridges are very easy to find. There are 3 major types of conference
bridges. These are:
1. AT&T Corum Bridges
2. "Conference System" Bridges
3. Other bridges that are usually located at Corporation Headquarters.
To find an AT&T Corum bridge, simply call information in any state, ask
for the number to AT&T NETWORK SYSTEMS for a major city in that state, call
Network Systems, say you are from Maintenance and need the number to the
conference bridge.
If they dont have a bridge there, ask for the number to the bridge that they
use. They are very dumb and usually will just give it to you. In fact, you
may have to explain to the person that answers the phone just what a bridge is.
If you identify yourself as "formerly of ATTIS Headquarters", that may help,
because there used to be 2 parts of AT&T, ATTIS (AT&T Information Systems), and
ATTCOM (AT&T Communications), but they merged.
As for "You've Dialed The Conference System" bridges, they are manufactured by a
company called WesTel in Oswego, Illinois. You can call there claiming to be
with some corporation, and ask for the name and numbers of companies that have
purchased the bridge to call them and see what they think of it. After you get
the numbers, you can call the place that bought the bridge, claim to be
maintenance, and ask for the bridge number. This has worked on 8 occaisions so
far.
As for bridges that are located at Corporation Headquarters, all you have to do
is call the HQ, claim to be maintenance, and ask for the number to the bridge.
It's as simple as that.
CONCLUSION:
----------
Whew. I hope this file has taught you how to accomplish a great many more
things than you previously knew how to do. If you didn't know anything about
what is in this file prior to reading it, then it might take quite a bit of time
to learn how to do everything in the file.
My advice is to take one step at a time, master one element before going on to
the next, and to keep a cool head while trying to engineer some of these
departments. You SHOULDN'T, if you screw up, or if the phone co. employees are
uncooperative, break down and swear at them or call them names. This will only
contribute to the destruction of these departments for engineering purposes.
Downloaded From P-80 International Information Systems 304-744-2253

286
textfiles.com/phreak/bsbell1.txt Normal file
View File

@@ -0,0 +1,286 @@
11:14 pm
*******************************************************************************
-----> DPAK PRESENTS <-----
SHARP REMOB'S GUIDE TO
BULLSHITTING THE PHONE
COMPANY OUT OF
IMPORTANT INFORMATION
*******************************************************************************
Preface
-------
In the past, there have been very few good, useful text files. There would
be files telling you how you should act, how this or that worked, who got
busted, what this or that acronym stood for, and other things you didn't care
about or couldn't use. After reading some of the various technical journals,
phreak/hack magazines, gossip columns, etc., one would come away with the
feeling:
"Gee, that person that wrote that really knows alot (or is good at copying
manuals)" or
"I really don't care what m0dem rulr's favorite color or favorite movie is"
Unfortunately, one -WOULD NOT- come away with the feeling:
"Gee, I really got alot out of this file that I can use, something that will
help in a practical application."
This is because, sad to say, these files were written with the idea:
"Look how cool I am, I know this and I know that" in mind..
This file, however, is written with the idea:
"Cool, I showed you how to do this or showed you how to do that" in mind..
In this file, the following will be covered:
* The wonderful CSSC and what can be done with it
* Uses of the LAC (getting numbers from street address, unpub or not)
* Finding conference bridge numbers
* Bullshitting the Bell Business Office
THE CSSC:
--------
CSSC stands for Customer Sales and Service Center. There are several of
these across the country. Each can be reached by dialing a separate 1-800
number, but the one local to you (or that handles your area) can be reached by
dialing 1-800-222-0300 (This number appears on the bill you get from AT&T, as
it -IS- the AT&T billing office). Each CSSC can handle the entire U.S., though.
Following is what you can get from the CSSC (CN/A numbers and ID's, Customer
names and addresses, Customer Toll records)
CN/A NUMBERS AND ID's:
---------------------
Call the CSSC, say you are from an AT&T office, say AT&T Northeastern
Administrative Offices, or something to that effect. Depending on what type of
person you get when you call, it may be easy or it may be difficult. After you
identify yourself, say that you were given a bit of incorrect info and need the
correct info. For example:
"This is Bob Dwyer from Northeastern Administrative AT&T Offices, and we were
given a bit of incorrect information from this office. We were given the CN/A
number for Colorado as 518-471-8111, and that is the CN/A number for New York.
What do you show as the correct number for the CN/A for Colorado? Could you
check your HANDBOOK? (All CN/A info is kept in a reference guide called a
HANDBOOK)
The same thing can be done for CN/A ID's that is done for numbers.
*IMPORTANT NOTE*- If you screw up with one customer service rep, DO NOT LOSE
YOUR COOL! If they ask you a question that you do not know the answer to,
simply say that you must ask your supervisor, will get back witm, good-bye.
Then, you can call right back because you get a different person every time you
call.
NAMES, NUMBERS, & TOLL RECORDS
------------------------------
The CSSC also has people's names and addresses cross-referenced by number.
If you call and say you are from another AT&T Department, say that your
computers are down, and that you need them to check a number in RCAM (pronounced
Ar Kam) they should be happy to help you.
For Example:
"Hi, this is Bob Dwyer at AT&T Northeaster Administrative Offices. How are
your computers doing? Really? Ours are down. I have a number here; I need you
to see if you show it as a live account, because I *believe* that we show it to
be dead, could you check it in RCAM?
(Then give them the number, and they will say it is a live account)
"Really?? Do you show an address, or a p.o. box on that number? What do you
show as the address, we were sure it was dead? Do you show that as a dupe
account? (Dupe means duplicate) Who do you show that account for?" etc.
Again, remember, if you screw up or if they are suspicious, simply tell them you
must check with your supervisor, hang up, and call right back because you get a
different person every time.
At the CSSC, they also have toll records for all the long-distance AT&T calls
that that person made.
Simply ask the CSSC rep (after saying that your computers are down) to check all
the RETURNS on the bill. (RETURNS is the word that they use for calls).
THE LOOP ASSIGNMENT CENTER (LAC):
--------------------------------
At the LAC (an inter-office bell department), they can put an address into
the computer and come up with the phone number. The person's name will not come
up; only the phone number will come up. However, you MUST have the full street
address.
Here is how you get the # to the
LAC:
Call up the Business Office and say something to the effect of:
"Hi, this is Bob Dwyer with repair, what do you show as the number for the LAC
_
_
_
_
Line Assignment Center that handles the Houston Area (or whatever area or prefix
you need info on)
"
After they give you the number, call up the LAC and say something like:
"Hi, this is Bob Dwyer with repair, I have an address here and I need to know
the cable pair and phone number going into that address"
(You don't really need the cable pair, but if you say cable pair, they are more
likely to think that you are a phone co. employee).
BULLSHITTING BELL, IN GENERAL:
-----------------------------
It is pretty easy to BS the Bell Business Office. Simply call and identify
yourself as a worker in another Bell Office (for example repair, the LAC, etc.),
state what you need, and they should be happy to help you.
If you have a deep voice and not a 2600 hz voice, it usually helps. But you
could always pretend you are a woman if your voice is too high.
For example, if you need another phone number going into someone's house, anad
already have of of them, the business office would be an easy way to get that
information. If they have changed their number to a non-pubished number, ask
the rep if they show any ORDER ACTIVITY on the line, for example:
"Hi, this is Bob Dwyer with repair, do you show any order activity on 555-2344?
Do you show a C order? (C order means an order to Change service) Or a D order?
(An order to Disconnect service)"
If there is a C order, ask them what the C order did, for example, to get the
new number, or find out what Custom Calling features the person added, or
whatever.
FINDING BRIDGE NUMBERS:
----------------------
Conference Bridges are very easy to find. There are 3 major types of conference
bridges. These are:
1. AT&T Corum Bridges
2. "Conference System" Bridges
3. Other bridges that are usually located at Corporation Headquarters.
To find an AT&T Corum bridge, simply call information in any state, ask
for the number to AT&T NETWORK SYSTEMS for a major city in that state, call
Network Systems, say you are from Maintenance and need the number to the
conference bridge.
If they dont have a bridge there, ask for the number to the bridge that they
use. They are very dumb and usually will just give it to you. In fact, you
may have to explain to the person that answers the phone just what a bridge is.
If you identify yourself as "formerly of ATTIS Headquarters", that may help,
because there used to be 2 parts of AT&T, ATTIS (AT&T Information Systems), and
ATTCOM (AT&T Communications), but they merged.
As for "You've Dialed The Conference System" bridges, they are manufactured by a
company called WesTel in Oswego, Illinois. You can call there claiming to be
with some corporation, and ask for the name and numbers of companies that have
purchased the bridge to call them and see what they think of it. After you get
the numbers, you can call the place that bought the bridge, claim to be
maintenance, and ask for the bridge number. This has worked on 8 occaisions so
far.
As for bridges that are located at Corporation Headquarters, all you have to do
is call the HQ, claim to be maintenance, and ask for the number to the bridge.
It's as simple as that.
CONCLUSION:
----------
Whew. I hope this file has taught you how to accomplish a great many more
things than you previously knew how to do. If you didn't know anything about
what is in this file prior to reading it, then it might take quite a bit of time
to learn how to do everything in the file.
My advice is to take one step at a time, master one element before going on to
the next, and to keep a cool head while trying to engineer some of these
departments. You SHOULDN'T, if you screw up, or if the phone co. employees are
uncooperative, break down and swear at them or call them names. This will only
contribute to the destruction of these departments for engineering purposes.
Please, though, compare the usefulness of this file to other files, and in the
future, if you should every write a file, please put information in it that
people will actually find a use for, not just information to show the world how
"cool" you are or how much you know.
..................................SHARP REMOB.................................
.-.-.-.-.!! DPAK !!.-.-.-.-.
SPECIAL THANKS TO:
-----------------
All Past and Present Members of DPAK:
Supernigger, DP, "ElYtE D00D", Squashed Pumpkin, Linebreaker 504, Lythande, Dark
Wanderer, *DETH*-2-*J00Z*, R0tTen KuQuaT, Meat Puppet & Lung K00kiez & the whole
"Money for nothing, everything for free" Crew..
Special thanks to SSWC for technical reference.
Special thanks to The Blade.
Supernigger wishes to thank The Trader and The Metron for advice and info.
DP wishes to say: Call InterCHAT, 201-861-7680
The Blade wishes to say: Call the Metal AE, 201-879-6668.
*DETH*-2-*J00Z* wishes to say: Fuck you Sandinista, Jello, Ground Zero, whatever
your alias is, you're a loud-mouthed, untrustable, lying bitch.
ElYtE D00D wishes to thank Chicken Burger for TSPS help.
This file is not to be used as part of any other publication -Sharp Remo
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
ݰ '89 The PIRATES' HOLLOW <20><>
ݰ Gfile Distribution Center / MASS Megs <20><>
ݰ 415/236/2371 RoR - Alucard 415/236/2371 <20><>
ݰ Dr. Murdock ~ Sir Death ~ Dark Nite ~ RatSnatcher ~ Pressed Rat<61><74>
ݰShawn-Da-Lay Boy Production Inc. The Electric Pub : 415/236/4380<38><30>
ݰ<><DDB0><EFBFBD><EFBFBD> The Gates of Hell are open Night and Day; <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
ݱ<><DDB1> <20> Smooth is the Descent and Easy is the Way <20> <20><><EFBFBD><EFBFBD>
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
Another file downloaded from: NIRVANAnet(tm)
& the Temple of the Screaming Electron Jeff Hunter 510-935-5845
Burn This Flag Zardoz 408-363-9766
realitycheck Poindexter Fortran 510-527-1662
My Dog Bit Jesus Suzanne d'Fault 510-658-8078
New Dork Sublime Demented Pimiento 415-864-DORK
The Shrine Tom Joseph 408-747-0778
"Raw Data for Raw Nerves"
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X

54
textfiles.com/phreak/bsif.phk Normal file
View File

@@ -0,0 +1,54 @@
----[=BELL SPECIAL INTELLIGENCE=]---
-------------[=FORCE=]--------------
------------------------------------
---[=TYPED AND UPLOADED BY...=]-----
------------[=CHRIS JONES=]---------
------------------------------------
AROUND 1970 BELL FORMED A SPECIAL TYPE OF SECURITY AGENCY KNOWN ONLY AS 'SIF'
(SPECIAL INTELLIGENCE FORCE) THIS ORGANIZATION WILL USUALLY PAY THE SUSPECTED
VICTIM A VISIT IF BELL CAN'T (BY ANY LEGAL MEANS) GET ANY INFO. ON YOU ABOUT
YOUR SUSPECTED FONE FRAUD.
THEY HAVE BEEN KNOWN IN ONE CASE TO HAVE SERIOUSLY INJURED ONE PERSON WHEN HE
REFUSED TO LET THEM IN HIS TO SEARCH IT. AFTER THEY HAD BEATEN HIM UP A BIT,
THEY PROCEDED TO CONFISCATE ALL ELECTRONIC EQUIPMENT ON THE PREMISES.
ALTHOUGH IT WAS LATER DISCOVERED THAT HE HAD NOTHING TO DO WITH PHREAKING, HIS
REPUTATION WAS PERMANENTLY RUINED, AND HE COULD NEVER GET A JOB IN HIS FIELD
AGAIN.
AFTER THE TRIAL WAS OVER AND HE WAS FOUND INNOCENT, HE NOTICED AN EXTRA WIRE
FROM RUNNING FROM HIS HOUSE TO THE FONE LINE. WHEN HE CALLED THE COMPANY AND
ASKED THEM ABOUT IT, ALL THEY SAID WAS THAT IT WAS NOT TO BE TAMPERED WITH, AND
THAT ANY TAMPERING DETECTED WOULD RESULT IN A FINE AND POSSIBLE PRISON
SENTENCE.
THIS PERSON,WHO'S NAME I CANNOT MENTION, HAD A PERMANENT RECORD ABOUT THIS
INCIDENT ON HIS FILE, AND WHEREVER HE WENT THIS RECORD FOLLOWED HIM. HE WAS SO
HARRASSED BY ALL OF THESE MATTERS THAT ON OCTOBER 12, 1973 THIS MAN COMMITTED
SUICIDE BY ASPHYXIATING HIMSELF IN HIS 1970 OLDSMOBILE BY LEAVING THE ENGINE
RUNNING WHILE STILL IN THE GARAGE. PINNED TO HIS SHIRT WAS A SUICIDE NOTE THAT
EXPLAINED ABOUT SOME OF THE INCIDENTS OF EMBEZZLEMENT BY HIGH RANKING COMPANY
OFFICIALS, EMBEZZLEMENT OF COMPANY FUNDS, AND POLITICAL SLUSH FUNDING.
BELL WAS NEVER TRIED FOR ANY OF THESE OFFENSES BECAUSE ALMOST ALL OF THE PEOPLE
WHO KNEW ABOUT THE INCIDENT WERE "ENCOURAGED" NOT TO DISCUSS THE MATTER WITH
ANYONE.
THE ONLY PERSON EVER KNOWN TO SPEAL ABOUT THE MATTER PUBLICLY WAS J. EDWARD
HYDE. HE WROTE AN ENTIRE BOOK ON ALOT OF THINGS ABOUT THE BELL SYSTEM.
------------[=NOTE=]-----------
I'M NOT SAYING THAT YOU WILL EVER HAVE A VISIT FROM ANY OF THESE PEOPLE, BUT IF
YOU DO, *********BE CAREFUL!!!!!!!!!******** THESE PEOPLE MEAN BUSINESS AND
THEY CAN RUIN YOU FOR LIFE.
-------------------------------
THE INFORMATION FOUND IN THIS ARTICLE IS NOT NECESSARILY EXPRESS THE OPINION OF
THE AUTHOR MENTIONED HEREIN AND THE THIS WRITER TAKES NO RESPONSIBLILTY FOR ANY
USE/MISUSE OF THIS MATERIAL...
-----------[=========]-------------
TYPED AND UPLOADED BY [=CHRIS JONES=]
ORIGINAL ARTICLE BY [=J. EDWARD HYDE=]
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open


348
textfiles.com/phreak/bt-info.txt Normal file
View File

@@ -0,0 +1,348 @@
/-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\
! Bell Telephone Info !
\-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/
***************************************
BRIDGING HEADS, RESIDENTIAL AND
BUSINESS MULTILINE DISTRIBUTION BOXES,
LINE AND TRUNK SPLITTERS, AND
OTHER BELL SYSTEM WIRE TERMINATIONS.
- HOW TO USE, AND/OR ABUSE THEM -
(INCLUDING A TUTORIAL ON BASIC TELE-
PHONE EAVESDROPPING TECHNIQUES.)
***************************************
WRITTEN BY : PHUCKED
AGENT
04
***************************************
IN THIS ARTICLE, I WILL FIRST
BESCRIBE THE TERMINATION, WIRING, AND
TERMINAL HARDWARE MOST COMMONLY USED
IN THE BELL SYSTEM, AND I WILL INCLUDE
A SECTION ON METHODS OF USING THEM.
***************************************
-------------
LOCAL NETWORK
-------------
THE LOCAL TELEPHONE NETWORK
BETWEEN THE CENTRAL OFFICE/EXCHANGE AND
THE TELEPHONE SUBSCRIBERS CAN BE
BREIFLY DESCRIBED AS FOLLOWS:
FROM THE CENTRAL OFFICE (OR
LOCAL EXCHANGE) OF A CERTAIN PREFIX
(ES), UNDERGROUND AREA FEEDER TRUNKS
GO TO EACH AREA THAT HAS THAT PREFIX.
(USUALLY MORE THAN ONE PREFIX PER AREA)
AT EVERY FEW STREETS OR TRACT AREAS,
THE UNDERGROUND CABLES SURFACE. THEY
THEN GO TO THE SECONDARY TERMINATION,
(THE AERIAL TELEPHONE FEEDER CABLE)
(OR BACK UNDERGROUND, DEPENDING ON THE
AREA) AND THEN TO THE SUBSRIBERS HOUSE
(OR IN THE CASE OF AN APARTMENT
BUILDING OR MUTLILINE BUSINESS, TO
A SPLITTER OR DISTRIBUTION BOX/PANEL).
****************************************
NOW THAT WE HAVE THE BASICS, I'LL TRY
AND GO IN-DEPTH ON THE SUBJECT.
------------------
UNDERGROUND CABLES
------------------
THESE ARE SOMETIMES INTER-
OFFICE TRUNKS, BUT USUALLY IN A RESID-
ENTIAL AREA THEY ARE FEEDER GROUPS THAT
GO OTO BRIDGING HEADS OR DISTRIBUTION
CASES. THE CABLES ARE ABOUT 2-3 INCHES
THICK (VARIES), AND ARE EITHER IN A
METAL OR PVC-TYPE PIPE (OR SIMILAR).
RARELY (MAYBE NOT IN SOME REMOTE RURAL
AREAS) ARE THE CABLES JUST 'ALONE' IN
THE GROUND. INSTEAD, THEY ARE USUALLY
IN AN UNDERGROUND CEMENT TUNNEL
(RESEMBLES A SMALL SEWER OR STORMDRAIN)
. THE MANHOLES ARE >HEAVY< AND WILL SAY
'BELL SYSTEM' ON THEM. THEY CAN BE OPEN
ED WITH A 1/2 INCH WIDE CROWBAR (HOOK
SIDE) INSERTED IN THE TOP RECTANGULAR
HOLE. IF YOU GET IT OPEN, GO INSIDE!!
THERE ARE LADDER RUNGS TO HELP YOU
CLIMB DOWN. YOU WILL SEE THE CABLE
PIPES ON THE WALL, WITH THE BLUE AND
WHITE STRIPED ONE BEING THE INTER-
OFFICE TRUNK GRP (AT LEAST IN MY AREA).
THE OTHERS ARE LOCAL LINES, AND ARE
USUALLY MARKED OR COLOR CODED. THERE
IS ALMOST ALWAYS A POSTED COLOR CODE
CHART ON THE WALL, NOT TO MENTION
TELCO MANUALS DESCRIBING THE CABLES
AND TERMINALS, SO I NEED NOT GET INTO
DETAIL. AGAIN: >IF YOU CAN GET INTO A
BELL MANHOLE, DO IT!, IT WILL PAY OFF
<. ALSO, THERE IS USUALLY SOME KIND
OF TEST EQUIPMENT, AND OFTEN BELL
TEST SETS ARE LEFT IN THERE.
SO GET YOUR CROWBARS!
****************************************
--------------
BRIDGING HEADS - (WE MS2'S)
--------------
THE INNOCENT-LOOKING GRAYISH-
GREEN BOXES.
WHEN IN GROUPS OF TWO OR THREE, THEY
ARE FOR SECONDAY/TERTIARY TERMINATION
AND ACCESS POINTS (BRIDGED ACCESS).
THESE ARE THE WESTERN ELECTRIC SAI
55 OR 22/E TERMINAL CASES. THEY HOLD
ON THE ORDER OF 900-1200 CABLE PAIRS.
THIS IS USUALLY THE SECOND TERM. POSI
TION ON THE LOCAL LOOP (AFTER THE MTF
FRAME AT THE CO/ OR THE UNDERGROUND
'FTP' POSITION).
THESE CAN BE EITHER
TRUNK BRIDGES OR BRIDGING FOR RESIDEN
CES. THE AREA FEEDER BRIDGING HEADS
ARE USUALLY LARGER, AND THEY HAVE THE
'WESTERN ELECTRIC' LOGO AT THE BOTTOM,
WHEREAS THE NORMAL BRIDGING HEADS
(WHICH MAY BE DIFFERENT IN SOME AREAS-
DEPENDING ON THE COMPANY YOU ARE
SERVED BY. GTE B.H'S LOOK SLIGHTLY
DIFFERENT. ALSO, DO NOT BE FOOLED
BY SPRINKLER BOXES!)
CAN BE FOUND IN JUST ABOUT EVERY CITY.
TO OPEN A BRIDGING HEAD:
IF IT IS LOCKED (AND YOU'RE FEELING
DESTRUCTIVE), PUT A HAMMER OR CROWBAR
(THE SAME ONE YOU USED ON THE MANHOLE
) IN THE SLOT ABOVE THE TOP HINGE OF
THE RIGHT DOOR. PULL HARD, AND THE
DORR WILL RIP OFF. VERY EFFECTIVE!
IF IT ISN'T LOCKED (AS USUAL),
TAKE A 7/16 INCH HEX SOCKET AND
WITH IT, TURN THE BOLT ABOUT 1/8 OF A
TURN TO THE LEFT (YOU SHOULD HEAR
A SPRING RELEASE INSIDE). HOLDING THE
BOLT, TURN THE HANDLE ALL THE WAY TO
THE RIGHT AND PULL OUT.
NOW INSIDE, FIRST CHECK FOR
A TEST-SET (WHICH ARE OFTEN LEFT BY
BELL EMPLOYEES). THERE SHOULD BE A
PANEL OF CABLE PAIRS + SCREW TERMINALS
(TYPE 45/47IB REGULAR BINDERS) . PUSH
THE PANEL BACK ABOUT AN INCH OR SO,
AND ROTATE THE TOP LATCH (ROUND WITH
A FLAT SECTION) DOWNWARD. RELEASE THE
PANEL AND IT WILL FALL ALL THE WAY
FORWARD. THERE IS USUALLY A LARGE AMO-
UNT OF WIRE AND EXTRA TERMINALS.
THE TEST-SETS ARE OFTEN HIDDEN HERE,
SO DONT OVERLOOK IT (400 FOOT ROLLS OF
#22 SOLID WIRE ARE OFTEN NEAR THE TOP
IN THE BACK OF THE BOX. 'BORROW THEM')
. ON THE RIGHT DOOR IS A METAL BOX OF
INSULATORS, BINDERS, CLIPS, ETC. TAKE
A FEW (COMPLIMENTS OF BELL...). ON EACH
DOOR IS A USEFUL ROUND METAL DEVICE.
(SAYS 'INSERT GENTLY' OR 'CLAMP GENTLY
- DO NOT OVERTIGHTEN' ETC..) ON THE
FRONT OF THE DISC, YOU SHOULD FIND TWO
TERMINALS. THESE ARE FOR YOUR TEST SET.
(IF YOU DONT HAVE ONE, DONT DEPAIR -
I'LL SHOW YOU WAYS TO MAKE BASIC TEST
SETS LATER IN THIS ARTICLE).
HOOKING THE RING (-) WIRE TO THE
'R' TERMINAL; AND THE TIP (+) WIRE
TO THE OTHER. (BY THE WAY, AN EASY WAY
TO DETERMINE THE CORRECT POLARITY IS
WITH A 1.5V LED. TAP IT TO THE TERM.
PAIR, IF I DOESNT LIGHT, SWITCH THE
POLES UNTIL IT DOES. WHEN IT LIGHTS,
FIND THE LONGER OF THE TWO LED POLES.
THIS ONE WILL BE ON THE TIP WIRE (+))
BEHIND THE DISC IS A COILED UP CORD.
THIS SHOULD HAVE A SPECIALIZED CONNECT-
OR. ITS VERY USEFUL, BECAUSE YOU
DONT HAVE TO KEEP CONNECTING AND
DISCONNECTING THE FONE (TEST SET)
ITSELF, AND THE CLIP IS DESIGNED TO AID
IN LOCATING THE PAIR AND ASSURING THE
CORRECT POLARITY.
ON THE TERMINAL BOARD, THERE
SHOULD BE ABOUT 20 PAIRS (RED/WHITE)
PER ROW PER SIDE.
HOOK THE CLIP TO ANY TERMINAL PAIR
, AND YOU'RE SET! DIAL OUT IF YOU WANT,
OR JUST LISTEN (IF SOMEONE'S ON THE
LINE). LATER, I'LL SHOW YOU A WAY TO
SET UP A TRUE 'TAP' THAT YOU CAN SET
UP, AND WILL LET THE PERSON DIAL OUT
ON HIS LINE AND RECEIVE CALLS AS
NORMAL, AND YOU CAN LISTEN IN THE
WHOLE TIME. MORE ABOUT THIS LATER...
ON MAJOR PREFIX-AREA BRIDGING
HEADS ('SAI' FOR AREA C.O. FEEDER CABLE
) YOU CAN SEE TEMPORARY 'LOCAL LOOPS',
WHICH ARE TWO CABLE PAIRS (CABLE
PAIR = RING+TIP, A FONE LINE) THAT
ARE DIRECTLY CONNECTED TO EACH OTHER
ON THE TERMINAL BOARD. THESE 'CHEAP
LOOPS' AS THEY ARE CALLED, DO NOT
WORK NEARLY AS WELL AS THE EXISTING
ONES SET UP IN THE SWITCHING HARDWARE
AT THE EXCHANGE OFFICE. (TRY SCANNING
YOUR PREFIXES' 00XX OR 99XX #'S.
THE TONE SIDES WILL ANNOUNCE THEMSELVES
WITH THE 1000 HZ LOOP TONE, AND THE
HANG SIDE WILL GIVE NO RESPONSE. THE
FIRST PERSON SHOULD DIAL THE 'HANG'
SIDE, AND THE OTHER PERSON DIAL THE,
TONE SIDE, AND THE TONE SHOULD STOP
IF YOU HAVE GOT THE RIGHT LOOP).
THE LOOPS ARE USED IN FRAME TERMINATI
ON AND IN SONIC/600 OHM TERM. TESTING
AND LINE/CABLE/FEEDER LOCATION.
IF YOU WANT TO FIND THE NUMBER
OF THE LINE THAT YOU'RE ON, YOU CAN
EITHER TRY TO DECIPHER THE 'BRIDGING
LOG' (OR WHATEVER), WHICH IS ON THE
LEFT DOOR. IF THAT DOESNT WORK, YOU
CAN USE THE FOLLWING:
---
ANI # (AUTOMATIC NUMBER INDENTICATION)
---
THIS IS A TELCO TEST NUMBER
THAT REPORTS TO YOU THE NUMBER THAT
YOURE CALLING FROM (IT'S THE SAME,
CHOPPY 'BELL BITCH' VOICE THAT YOU
GET WHEN YOU REACH A DISCONNECTED #)
(PIP OR ONE OF THE 11X SERIES ANNOUNCE
MENT FRAME MACHINES.)
FOR THE 213 NPA - DIAL 1223
213 NPA - (GTE AREAS) DIAL 114
408 NPA - DIAL 760
914 NPA - DIAL 990
THESE ARE EXTREMELY USEFUL WHEN MESSING
WITH ANY KIND OF LINE TERMINALS,
FEEDER BOXES, ETC.
----------
WHEN FINISHED, BE SURE TO CUT
OFF THE CONNECTOR AND TAKE IT WITH YOU
(THEY ARE VERY HANDY), AND CLOSE/LATCH
THE BOX TO AVOID SUSPICION.
***************************************
------
"CANS" - AERIAL-MOUNTED (TELEPHONE POLE
------ TERMINAL) BRANCH FEEDER CABLE
SPLITTER.
BASICALLY, TWO TYPES:
1> MS3A SERVICE AREA INTERFACE.
(LARGE, RECTANGULAR SILVER BOX AT
THE END OF EACH STREET.)
2> SERIES 600 LOADING COIL, INCLUDES
THE MSX AERIAL DROP SPLITTER.
(BLACK, ROUND OR RECTANGULAR THING
AT EVERY TELEPHONE POLE.)
--------
TYPE 1 - THIS IS THE CASE THAT TAKES
THE UNDERGROUND CABLE FROM THE BRIDGER
AND RUNS IT TO THE AERIAL BRANCH FEEDER
CABLE (THE LOWEST, LARGEST WIRE ON THE
TELEPHONE POLE). THE BOX IS ALWAYS ON
THE POLE NEAREST THE BRIGING HEAD,
WHERE THE LINE COMES UP. LOOK FOR THE
'CALL BEFORE YOU DIG - UNDERGROUND
CABLE' STICKERS..
THE CASE BOX IS HINGED, SO IF
YOU WANT TO CLIMB THE POLE, YOU CAN
OPEN IT WITH NO PROBLEMS. THESE USUALLY
HAVE 2 ROWS OF TERMINAL SETS.
(TOTAL APPROX. 200-600 PAIRS, DEPENDING
ON THE AREA.) THESE ARE ALL THE CABLE
PAIRS FOR YOUR STREET.
. (ITS SIMILAR TO A MINIATURE BRIDGING
HEAD). USE/ABUSE IT IN THE SAME MANNER
AS WE DID BEFORE. (NOTE: ALL THE ACTIVE
LINES CARRY FROM 15 TO 48 VDC, AND
EVEN 90VAC (WHEN RINGING), SO BE
CAREFUL - IT'S NOT GOING TO HURT YOU,
BUT IT CAN SURPRISE YOU (AND IF
YOU'RE HANGING BY ONE HAND FROM A TEL.
POLE, IT >CAN< BE HARMFUL!))
OH, BY THE WAY, IF YOU USE
ANI ON EVERY PAIR AND YOU FIND ONE
THAT ISNT IN USE ON YOUR STREET, YOU
CAN HOOK IT UP FOR YOURSELF (ALMOST).
ALSO, YOU HAVE TO BE ABLE TO IMPER-
SONATE A TELCO TECHNICIAN AND REPORT
THE NUMBER AS 'NEW ACTIVE' (GIVING
A FAKE NAME AND FAKE REPORT, ETC)
I DONT RECOMMEND THIS AND IT PROBABLY
WONT (ALMOST POSITIVELY WONT) WORK,
BUT THIS IS BASICALLY WHAT TELCO
LINEMEN DO).*
* THE USE OF THE 'TEST BOARD'
(A 7D# FOR LINEMEN TESTS, OFTEN FOUND
NXX-0003 OR NXX-0004) IS BEYOND THE
SCOPE OF THIS ARTICLE, BUT WILL BE
COVERED IN A FUTURE ARTICLE.
----
TYPE 2 - THIS IS THE SPLITTER BOX FOR
THE AERIAL DROP WIRES FOR THE GROUP OF
HOUSES AROUND THE POLE.
(USUALLY 4 OR 5 HOUSES). USE IT
LIKE I MENTIONED BEFORE. THE TERMINALS
(20 OR SO) WILL BE IN 2 HORIZONTAL
ROWS OF SETS. THE EXTRA WIRES THAT ARE
JUST 'HANGING THERE' ARE PROVISIONS
FOR EXTRA LINES TO RESIDENCES (1 EXTRA
LINE PER HOUSE, THATS WHY THE INSANE
CHARGE FOR LINE #3). IF ITS THE BOX FOR
YOUR HOUSE ALSO, HAVE FUN AND SWAP
LINES WITH YOUR NEIGHBOR! 'PIGGYBACK'
THEM OR USE A CHEESEBOX FOR A LOOP-ARO
UND, ETC.
AGAIN, I DONT RECOMMEND THIS, AND ITS
DIFFICULT TO DO IT CORRECTLY. (ALTHOUGH
USEFUL)
***************************************
---------------------------------------
DOWNLOADED FROM P-80 SYSTEMS.

97
textfiles.com/phreak/bt_oops.txt Normal file
View File

@@ -0,0 +1,97 @@
_ _
|\__ _ _ __/|
SySopS = DangerMouse Afl |_ | | | __| Co/SySopS = Marantz Afl
= Dennis T Shining/DC | | | __ = IceBerg
= Shinobi Afl _ |_|_: |___| _ = Magic SKN
/\_______________/|_____| |_____|\________________/\
\ | | _ /
\__: :_: : :_: | | :_: ____:_: :_> /
| | | | | | | | | | ____| | | <
| | | : | | : : | | | | | | 0 Day Amiga
| __| \_____/ \_______/ \______| |___|__ |
|/ |:| \| 0 Day Pc
: ::: .xXs<58>p<EFBFBD>rXx. :
. It JusT Wont Stop.:.eVeR 93 .xXt<58><74><EFBFBD>hXx. .Did you know
.____ ._ .___.___. ____.:._____._. ._.___.___.___.
|_. \| | | | | |/ ._|:|_. __| | | | _| | | ._| Over 70%
: | | | | | | | | | | ::: | _| | | | | | | | :
. | | |_| _| | | | .:. | | | |_| | | | | | | . of all uk
| |_| __|_| |_| |_| | : | | | __|_|___| |_| |
| | |/ \| | | .:: | | |/ \| | | . files have
| | : Node 1 : | | . | | : Node 2 : | |
|/ : . \| ::. |/ . . \| been on the
. : 16.8 Ds : .: : 14.4 Hst : To\x/er.
--------------------------------------------------------------------------------
From a reliable internal BT source:
British Telecom now has a list of most of the active abusers of
international toll frees (0800 numbers) and is monitering the
afforementioned lines pending prosecution.
How? Well, although BT are not stupid, and were not actively
monitoring boxer's lines, but after the BTBILLS.TXT was released,
many dudes telephoned their local exchange for the current
billing of their line.. This, together with scene informants
information on the release date of the text, gave BT the legal
right (see section 17 on customers rights - )
quote: "..if there exists reasonable grounds for suspicion of
misuse of telephone sevices.."
to assume monitoring of suspected misuse.
This, coupled with the release of BTBILLS.TXT and the rise in
household bill enquiries on that date, gave British Telecom a
list of 945 "possible misusers" of telephone services.
Monitoring commenced on all 0800 calls from those 945 enquiries
on March 14 1993 and although some of those enquiries were from
genuine customers, over 820 are now registered as "CLU" (internal
BT-speak for "Confirmed Line Misuse"
___________________________________________________________________________
|>-<>-><-<<3C>>-<>-><-<<3C>>-<>-><-=-<>-><-<<3C>>-<>-><-<<3C>>-<>-><>-><-<<3C>>-<>-><>-><|
|<|<7C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|<|
|<7C>| <20>f <20><><EFBFBD> <20>R<EFBFBD> C<><43>L, <20><><EFBFBD>'R<> <20>LR<4C><52>Х H<>R<EFBFBD>! <20>R <20><><EFBFBD> KN<4B>W S<>M<EFBFBD><4D>N<EFBFBD> WH<57> <20>S! |>|
|<7C>| |>|
|<7C>| /\__|\__ _|\_ ___/\_ /\_|\___|\_ ___/\___/\___/\______/\/\_ _ |>|
|||<7C><>/ \ (/ \ Y _/ /<2F>/ /| \ V _/ __/ __/ ______ \ V \<5C><><EFBFBD>|||
|<|::\ .\_/. /. | |. /:/. /:|. <20> /. | |. /\/. /\/. _/:|. <20> / | .\::|<7C>|
|>|:/V \\|| \ \| | /<2F><>\ /<2F><>\| <20> \| | / \ / \ \/\|| \ \__ //::|<|
|/|:\ __/| _|\_/___ |__ /__ / ___/___ |__ /__ / ___/| _|\_/ ___/Mat|>|
|<7C>|<7C><>\/<2F><>*|/<2F><><EFBFBD><EFBFBD><EFBFBD>*<2A><>\|<7C><>\/<2F><><EFBFBD>\/|/*<2A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>\|<7C><>\/<2F><><EFBFBD>\/\/<2F><><EFBFBD><EFBFBD>|/<2F><><EFBFBD><EFBFBD>\/*<2A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|||
||| |<7C>|
|||+<2B>+-+<2B>+-[] [<5B>] by MEMbER ReFErral - ONLY! - [<5B>] []-+<2B>+-+<2B>+|<7C>|
|||+<2B>+-+<2B>+-[] 3* <20>SR HST 16.8<EFBFBD><EFBFBD> DS R<><52>G<EFBFBD><47>WN - 2* <20>SR HST 14.4<EFBFBD>[]-+<2B>+-+<2B>+|<7C>|
||| |<7C>|
||| L<>S<EFBFBD><53> W<>RL<52> H<><48><EFBFBD>Q<EFBFBD><51>RT<52>RS __________________ L<>S<EFBFBD><53> W<>RL<52> H<><48><EFBFBD>Q<EFBFBD><51>RT<52>RS|<7C>|
|<|_________________________/-><-<<3C>>-<>-><>-><-\________________________|<|
|>-<>-><-<<3C>>-<>-><-<<3C>>-<>->< "ThE BrOtHeRhOoD!" >-<>-><-<<3C>>-<>-><-<<3C>>-<>k<>|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>\-><>-><-<<3C>>-<>-><>/<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
. :
__ _|____________ ___ __/\ _______|_ _ _
[FAH]| | | \ | |
|__|| . || : \|| __|_
______|: \__|: \: |______
\=====|: \=|: . \ \__|=====/
\<5C>+.:|<7C> /+|<7C> | / |::<3A>//
\<5C> <20>|____ /:<3A>|___|____ /__________|.<2E>//
: \::.<2E>: :|/<2F> <20> <20>:. ::.<2E>|/<2F>:.:+:<3A>.<2E>: :<3A>//
_ _|__________\_<>_________+___<5F>.:<3A>___:_______:<3A>+.//______
| | | |__| | |:<3A>| \
|__|| <20>___|| |. || | || || __|_/|| O \
|: \ |: |: |: : : |: ||: __/
|: \ |: | |: <20> |: \__||: <20> \ <20>
|<7C> / |<7C> |<7C> |<7C> |<7C> : \:
_ _ _|____ / |_________|____/\ __|__________|____| ____\_ _
| |/ \<5C>:. .:<3A> .:\/.<2E>:+:.:// |/ |
: ALPHA FLiGHT \+:<3A> /\:. + :<3A>. <20>// UNiTED KiNGDoM <20>
<20> \ .// \__________// HEADqUARTERS .
. \// \_________/<2F><>
[A<>RaDDer v3.0 By A<>Rc<52>]

89
textfiles.com/phreak/bt_phcrd.txt Normal file
View File

@@ -0,0 +1,89 @@
Subject: Re: fonecards
Date: Thu, 14 Sep 95 18:04:28 GMT
References: <DEwv47.Cv8@spuddy.mew.co.uk> <43blpt$9ke@columbia.acc.brad.ac.uk>
Here Ya go:
---------START OF TEXT -----------
HOW BT PHONE CARDS WORK - Transcribed by Archaos - June '93
----------------------- ---------------------- --------
Contrary to popular belief, BT phonecards do not work using a magnetic
strip system. The reason for this being that a magnetic strip would be
read only.
So how do they work then?
Well, examine a phonecard - preferably a used one if you are going to
scratch it or dissect it. If you look on the printed surface (the green
side - which is the front) you will find two lines which form a thick band.
Underneath this area is a "track" which holds the information about the
number of units used up and how many are left. A used phonecard will have
some tiny bars marked on the track near one end.
On the reverse side of the phonecard (the black side) you can see a shiny
black strip in contrast to the matt black which has text on it (on older
phone cards the whole of this side is shiny black). Anyway, this shiny strip
is "opposite" the band on the front and acts as a "window" to the information
on the track - for the simple reason that it is no ordinary shiny black
plastic. This special black plastic is not like all the others (which do
not let normal light or infra-red light pass through) but is transparent to
infra-red light. When a phonecard is in the machine, an infra-red beam is
shone through the back of the card and the reflected beam is checked to
detect the time units remaining.
Now to explain the track itself which is protected by a layer of paint that
also serves as the base for printing text and figures visible to the user.
On a 20-unit card, the track has 20 tiny rectangular areas (called
diffraction gratings - you might have come across them if you took physics)
which affect the light reflected by the cards. As the time units are used up,
the ares are destroyed by an eraser head. The design of the assembly enables
the progress of the erasing operation to be checked. in fact, the 20
rectangular areas touch each other and form a continuous strip on the card.
The area which is read is wider than the track. This makes it possible to
detect a reduction in track width.
Each unit is separated from its neighbour by a distance of 0.6mm. the erase
area is greater than the width of the track so that the unit is always
completely erased. The dimensions of both the card and the time units
suggest 140 as the theoretical maximum number of units possible.
The read-and-erase mechanism consists of a moving carriage on which are
fixed the eraser head and the optical components for reading. the carriage
is driven by a stepping device which moves along the track to determine
whether each unit is god or erased. when a unit has been consumed by the
cardphone, the area is erased in its turn and the carriage moves on one step.
OK, for those that weant to know, here is an ascii graphical representation
of the read and erase geometry :
Time units
---------------------------------------------------------
Track | | | | | | | | | 1.2mm
---------------------------------------------------------
<0.6mm>
Area read Area erased
*** *********
---------------***------------------*********------------
| | | *** | | | *|*****|* | | 1.6mm
---------------***------------------*********------------
*** *********
0.4mm 0.7mm
Well I hope you all understood that! Most of the information in this text
file was obtained from British Telecom <spit> sources so is quite likely to
be correct (after all, they should know their own cardphones!).
Archaos.
------EOF--------------
okay?
Hope I didn't offend anyone by upping this.
-- DreamshadoW --
Damn me father, for I must sin
Finger for PGP Key.

84
textfiles.com/phreak/budbx.txt Normal file
View File

@@ -0,0 +1,84 @@
/_\ /_\ /_\ /_\ /_\ /_\ /_\ /_\ /_\ /_\
\ / \ /
/_\ HOW TO MAKE YOUR FONE INTO A /_\
\ / \ /
/_\ BUD BOX /_\
\ / \ /
/_\ INVENTED BY /_\
\ / \ /
/_\ DR. D-CODE & THE PIMP /_\
\ / \ /
/_\ THE SLAUGHTERED CHICKEN /_\
\ / 702-831-4263 \ /
/_\ _ _ _ _ _ _ _ _ /_\
\ / \ / \ / \ / \ / \ / \ / \ / \ / \ /
This Box is quite similar to a Beige Box, except this is a portable unit. It
is extremely handy for free voice calls and tapping a nearby house's line.
It's really easy to make so don't worry about it (unlike a Blue Box!).
MATERIALS: >-:->> Two alligator clips
__________ >-:->> One-piece fone or normal fone (one piece is easier!)
>-:->> Soldering iron and some solder
>-:->> Some good wire
PROCEDURE:
__________
[1> Cut the wire that connects the fone to the wall. Inside there should be
4 colored wires. Yellow, red, green, and black. If the wires are not
colored, no need to get worried. The two in the middle are red & green.
Those are the 2 you need.
[2> Make sure to keep about 1-2 feet of this wire connected to the fone unless
you want to use the other wire listed above. Now solder one alligator
clip to the green wire, and one the red.
[3> If you're using the other wire, strip the ends and solder one end to of
each to the red and green on the fone, and one end to an alligator clip.
[4> Go to a nearby house and locate the little gray box. It's simple to
find, look by the gas meter. It should have the BELL logo on it.
[5> To open this thing, put your hand underneath it and hit upward. You
should get contact with the bottom edge of it.
[6> Now it should come open nice and easy. Look inside and you will see five
screws in this pattern:
* *
*
* *
[7> The screw in the middle and the two on the left do nothing. (Actually,
you may want to check the two on the left, as some people have a second
line hooked up to these two). All you need to worry about are the two on
the right. The one in the top right-hand corner is usually the green, and
the one in the bottom right-hand corner is usually the red.
[8> Clip an alligator clip to the corresponding terminals (red to red, green
to green.) You should get a dial tone. If you don't, switch the alligator
clips around. If you still don't get a dial tone (or someone's
conversation!) then the line has probably been disconnected or the fone is
off the hook.
IDEAS OF USE FOR THE BUD BOX
____________________________
Get a lot of wire and run it into your house. Then you'll be an extension
of that line. The fone will ring and you can listen to everything that's
going on the that line.
You can call direct to any place using normal BELL service (gasp!). i.e.:
1-702-831-4263. The bill will be not be charged to you. It will be charged
to your neighbors (or whoever.)
This has been an HMH presentation -- 1985
DR. D-CODE & THE PIMP

118
textfiles.com/phreak/bug.detector Normal file
View File

@@ -0,0 +1,118 @@
Unauthorised Access UK 0636-708063 10pm-7am 12oo/24oo
This file Presented by METRONET system (301)-944-3023 The bug's that this
device detects are Infinity transmitters, read the Infinity transmitter
bulletin for more info.
::::::::::::::::::::::::::::::::::::::
: :
: How to build a Bug Detector :
: :
: by :
: :
: The Gremlin :
: :
::::::::::::::::::::::::::::::::::::::
Warning: This formatted for 80 column and upper/lower case capabilities...
][][][
Basic theory
][][][
Because most bugs are triggered through certain frequencies, it is very simple
to build a small sweeping device that will trigger any bug present. The two
IC's are what create the oscillating tone. The IC1 operates at .8 Hz where the
IC2 runs at about 10 Hz. Frequency is determined by this formula:
f=1.44/(R1+2R2)C)
f measured in Hertz, R in megohms, and C in microfarads
The oscillation can be varied by the voltage placed upon pin #5. This is how
we create the wave sound. When voltage goes up, so does the frequency, and
vice-versa.
Normally, the output pin 3 is a square wave. Since we need varying wave at pin
#5, we need a triangular wave.We get this through integrating the square wave
created at pin #3 of IC1. It is acheived by D1, D2, R3, R4 and C2.
This varying output is fed into the phone line by transformer T1 which has an 8
ohm winding going to pin #3 of IC2 and the 500 end to a 0.1 microfarad capaci-
tator at the phone line.
Enuf talk..let's get movin!
][][][
Schematic Design
][][][
+9v
__________|_____________________________
| _|__|_ _|__|_ |
R1 | 4 8 | _|<D1__R3__ | 4 8 | R5
| | | | | | | |
+-----+2 3+---+ +-+5 2|--+----+----+
| | | |_>|R2__R4__| | | | |
R2 | ic1 | | | ic2 | R6 D3
| +-+6 | ___| | 6+-+ | V
| | | | | | | | | -
+---+-+7 | | +--+3 7+-+-----+----+
| |___1__| | | |___1__| |
| | | | | C4
| | | | | ^
C1 | C2 T1 _|_._C3|(_. |
^ | ^ 8--500<_|_. |
|_________|______________|__|______|__________|
|
-G-
][][][
Parts List
][][][
C1 10-uF electrolytic capacitator 25 WDVC
C2 300-uF electrolytic capacitator 25 WDVC
C3 0.1-uF capacitator
C4 0.068-uF capacitator
D1-D3 1N914
IC1,IC2 555 timers
R1, R4-R6 1-kilohm resistors
R2 91-kilohm resistor
R3 22 kilohm resistor
T1 500-to-8 ohm audio output transformer
][][][
Construction
------------
When building this unit, it is very useful to use a breadboard or vector board.
I suggest that leads being connected to phone line (T1, C3) end in a jack or a
modular connector to make the hookup easier. To test it, hook it to the phone
line (not the suspected line) and call the line you suspect is being bugged.
The party you are calling should not answer the phone.Now, the unit is
activated. 3 times, every 4 seconds, the oscillator will go up to 10 kHz and
back down again..like a bell curve..If there is a frequency sensitive bug on
the line, the phone will stop ringing, and you will be able to hear everything
said in the room. If the phone keeps ringing, chances are that all is
fine..unless the bug requires a multi-frequency trigger..but these are very
rare..
So, we can see that 415-BUG-1111 really does work! It creates the tone..any
click heard is the Phone Co's (or whoever is bugging) speaker/tape recorder
picking up!
Have phun, and hope it helped!
The Gremlin
...call the Gremlin's Lair..201-536-7794..today!...
[Thanks again Metronet!]

262
textfiles.com/phreak/bugdetector.txt Normal file
View File

@@ -0,0 +1,262 @@
!! THE BUG DETECTOR !!
BY: FORD PREFECT
UPLOADED BY: The Phoney Phoner
and The Skeleton Krew
What you will need:
(the number in brackets is a reference
number which matches the schematic. The
number in paranthesise is the amount of
the part needed.)
[1] (1) 1n34a crystal diode
[2] (2) 2n107 audio transistors
(ge-2 or equivalent)
[3] (1) 3k ohm variable resistor
[4] (2) 560 ohm 1/2 watt resistor
[5] (1) 15k ohm variable resistor
[6] (1) 500 ohm variable resistor
[7] (1) .002 Uf capacitor
[8] (1) 1.5 Volt aa battery
[9] (1) aa battery holder
[10] (1) 0-300 microammeter
(lafayette 99-g-5028 or
equivalent)
[11] (1) 10 millihenry choke (ohmite
z-50)
[12] (1) single-pole single-throw
(spst) toggle switch
[13] (1) project box (radio shack)
[14] (1) antenna (either from an old
transistor radio or a stiff
piece of wire will also work)
[15] (1) 2000 ohm headset (or a mini-
ature earphone like most tv
and radios use)
the parts can be purchased from radio
shack for less than $20. This is a
very good high-gain meter-type bug
detector. It has a crystal diode with
2 amplification stages to boost the
power of the meter. This produces a
broad-band, battery-powered, receiver
that can sense radio-frequency transm-
itters up to a mile away. Unfortun-
ately, it will also pick up a commerc-
ial am or fm station up to 3 miles
away....
Bug detector schematics:
[14] [1]
(*)-----+------\<---+------+----\
\ \ \ \ \
\ \ \ \ \
\-/ ( / [7] \ \
v ) [3] \ --- \
[11] ( / ^^^ \
[0] ) --> \ \ \
\ \ / \ \
\ \ \ \-/ \
\-/ \ \ v \
v ----+ \
\ [0] \
[0] \ \
\-/ \
v \
\
[0] \
\
\
---------------------------------------
\ /----\
\ ( /--)-----------\ --->>b<<
\ ( \/ ) \ \
------(---\ ) \ \
( \\ ) ----+---\
( <--)-----\ \ \
[2] \----/ \ \ \
\ \ \
\ / \
[0] \-/ \ \
v / \
[4] \ \
/ \
\ \
\ \
>>a<< \
\
\
---------------------------------------
\
\ [12] [8&9]
\ ____ <-><+>
\ / \
---------() ()-----\ \---->>c<<
\
[4]
>>a<<--------\/\/\/\/\----->>c<<
---------------->>d<<
\
[2] /---\-----\
( \ )
( \-\ )
>>c<<----(---\ \-----)----\
( \-->-\ ) \
( ) \
\---------/ \
[0] \-/
v
[5]
>>b<<-------\/\/\/\/\---
^
\
\
------------>>d<<
[6]
>>d<<-------/\/\/\/\/--
^
\
\
Uploaded to: The Party Line
(415) 447 - 0963
************ CAR TRACKER *************
Uploaded By: The Phoney Phoner
And The Skeleton Krew
**************************************
By: Ford Prefect
"my name is bond, james bond."
My next gadget is what is called a
bumpbeeper. It attaches to the under
side of a car with magnets and then
sends out a signal that can be heard on
a radio.
Parts list: () = diagram #
(1) 2n635a transistor
(2) 4.3K 1/2 watt resistor
(3) 1 meg potentiometer
(4) 10k 1/2 watt resistor
(5) 50pf capacitor
(6) 365pf variable capacitor
(7) .005Uf capacitor
(8) .01Uf capacitor
(9) ferrite loopstick (from a crys-
(10) coil [see text] tal radio)
(11) single-pole single-throw switch
(12) 9 volt battery
(opt.) Battery clip & case
(13) antenna
this device is a constant tone signal-
ling source that can be tuned to any
clear spot below 1000 khz. If magnets
are attached to the case, it can quick-
ly be installed under the persons car.
(9) Is a standard ferrite loopstick tha
t can be purchased at radio shack.
(10) Is simply 12 turns of plastic cov-
ered hookup wire wound over (9).
13
(*)-------\(----+-----______--- >>a<<
\ \ ^^^^^^
\ 5 \ \ 9
--- -\(-- --\(--->>b<<
- 6 \ 7
v \
--->>a<<
>>a<<------+------+------o/ o-----
\ \ 11 \
/ --- \
\ - \
/ v \
4 \ --------
\ \
\ --[][]->>c<<
--->>b<< 12
"@ j >>c<<----/\/\/\/\----+-----+-------
2 \ \ \
\ \ \
>>d<<---)\------- \ \
v >>e<<
8 -----/\/\/\--
\ 3
>>f<<-----------+
/---\
1 ( \ )
( / /-)---->>d<<
( \ > )
( ----- )
( \ )
\---/
\
\
>>b<<
>>e<<-------
\
(
)
(
10 )
\
------>>f<<
>>d<<---
\
---
-
v (ground)
to tune the transmitter:
1)pick an empty spot on the am car
radio below 1000 khz.
2)Switch on the transmitter with the
spst switch.
3)Tune the 365 variable capacitor
slowly until a shrill note can be
heard from the car radio.
4)The pitch of the note is adjustable
by turning the 1 meg potentiometer
resistantly,
Ford Prefect

248
textfiles.com/phreak/buggning.txt Normal file
View File

@@ -0,0 +1,248 @@
bug. .txt
Filnamn:BUG.TXT
----------------------------------------------------------------------------
Automatic Phone Recorder
by
Atomic Punk
May 1, 1989
This device will allow any standard cassette tape recorder the
ability to automatically record phone conversations. The device
will start the tape recorder when the phone handset is lifted and
stop the recorder when the handset is returned to the cradle.
The device is a DC switch that is normally on via the forward
biasing of Q1 via R3. Q1 now clamps Q2 into a forward state by
biasing its complement well into a saturated state via R4. The
DC switch is turned off via a negative voltage above that of the
Zener (D1). This voltage is usually about 48 volts and is the on
hook value of the phone line. This negative voltage over rides
the effect of R3 and keeps the circuit off. When the phone is
off the hook, the 48 volts drops to 10 volts, which is below the
[more]
<RETURN> zener voltage of D1, and R3 now turns the circuit on. Audio
signal is via attenuator resistor R1 and DC isolating capacitors
C1 and C2.
This device is really only a high impedance switch that isolates
the recording controlled device from the phone line via some
simple electronic circuitry. It requires no battery and obtains
power for operating from the remote jack that in most recorders
is a source of 6 volts. When the remote jack is grounded,
recorder operation starts, and when the grounding condition is
removed, recorder operation stops.
Parts list: Here's all you need:
Name Qty Description
R4 1 220 ohm 1/4 watt resistor
R3 1 39k ohm 1/4 watt resistor
R1 & R2 2 100k ohm 1/4 watt resistor
C1 & C2 2 0.01 mfd/ 50V disc cap.
Q2 1 PN2222 NPN Silicon
Q1 1 PN2907 NPN Silicon
[more]
Z1 1 15 volt Zener diode
<RETURN> P1 1 Sub-mini plug 2.5mm dia.
CL1 & CL2 2 Alligator clips
P2 1 Mini-Plug 3.5mm dia.
Enclosure 1 Suitable enclosure for device
PB1 1 1.25x1.67 perfboard
WR4 (18") #24 hook-up black wire
WR3 (18") #24 hook-up red wire
Casto Castolite or paraffin wax
[more]
Circuit Diagram
Red wire
----------|---------Z1--------|--------------------|--------|----------
| | | |
Green | | | |
-----| | | | |
| | | | |
| | | e |
| | | | |
| | R3 |-----R4---b-Q2 |---P1
| | *No connection* | | | |To remote
| | | c c |of
| *|* | | | |recorder
|--- | ------------------|-----b-Q1 | |
| | | | |
| | e | |
| | |------------|--------|
| |
| | C1
| |----------------------------3 3-----------------|
| |
| |---P2
| C2 |To Aux
|--------------R1-----------------3 3-----------------|on
Recorder
** Green and Red wires go to corresponding color of telephone wires.
** Make sure to connect Q1 and Q2 properly -- follow label c,b,e
with the wires facing toward you and flat side up.
- c is the located on the upper right hand side
- b is the next wire left of c
- e is the next wire left of b
<RETURN> Anyway that concludes this circuit. Now you'll be able to
monitor your phone line, and hear what goes on while you not
around.
**** Coming soon ******
How to safely build waterproof M-80s.
(>
(>
(>
Automatic Phone Recorder
by
Atomic Punk
May 1, 1989
This device will allow any standard cassette tape recorder the
ability to automatically record phone conversations. The device
will start the tape recorder when the phone handset is lifted and
stop the recorder when the handset is returned to the cradle.
<RETURN> The device is a DC switch that is normally on via the forward
biasing of Q1 via R3. Q1 now clamps Q2 into a forward state by
biasing its complement well into a saturated state via R4. The
DC switch is turned off via a negative voltage above that of the
Zener (D1). This voltage is usually about 48 volts and is the on
hook value of the phone line. This negative voltage over rides
the effect of R3 and keeps the circuit off. When the phone is
off the hook, the 48 volts drops to 10 volts, which is below the
[more]
zener voltage of D1, and R3 now turns the circuit on. Audio
signal is via attenuator resistor R1 and DC isolating capacitors
C1 and C2.
This device is really only a high impedance switch that isolates
the recording controlled device from the phone line via some
simple electronic circuitry. It requires no battery and obtains
power for operating from the remote jack that in most recorders
is a source of 6 volts. When the remote jack is grounded,
recorder operation starts, and when the grounding condition is
removed, recorder operation stops.
Parts list: Here's all you need:
<RETURN> Name Qty Description
R4 1 220 ohm 1/4 watt resistor
R3 1 39k ohm 1/4 watt resistor
R1 & R2 2 100k ohm 1/4 watt resistor
C1 & C2 2 0.01 mfd/ 50V disc cap.
Q2 1 PN2222 NPN Silicon
Q1 1 PN2907 NPN Silicon
[more]
Z1 1 15 volt Zener diode
P1 1 Sub-mini plug 2.5mm dia.
CL1 & CL2 2 Alligator clips
P2 1 Mini-Plug 3.5mm dia.
Enclosure 1 Suitable enclosure for device
PB1 1 1.25x1.67 perfboard
WR4 (18") #24 hook-up black wire
WR3 (18") #24 hook-up red wire
Casto Castolite or paraffin wax
[more]
Circuit Diagram
Red wire
----------|---------Z1--------|--------------------|--------|----------
| | | |
Green | | | |
-----| | | | |
| | | | |
| | | e |
| | | | |
| | R3 |-----R4---b-Q2 |---P1
| | *No connection* | | | |To remote
| | | c c |of
| *|* | | | |recorder
|--- | ------------------|-----b-Q1 | |
| | | | |
| | e | |
| | |------------|--------|
| |
| | C1
| |----------------------------3 3-----------------|
| |
| |---P2
| C2 |To Aux
|--------------R1-----------------3 3-----------------|on
Recorder
** Green and Red wires go to corresponding color of telephone wires.
** Make sure to connect Q1 and Q2 properly -- follow label c,b,e
with the wires facing toward you and flat side up.
- c is the located on the upper right hand side
- b is the next wire left of c
- e is the next wire left of b
Anyway that concludes this circuit. Now you'll be able to
monitor your phone line, and hear what goes on while you not
around.
**** Coming soon ******
How to safely build waterproof M-80s.
connect Q1 and Q2 properly -- follow label c,b,e
with the wires facing toward you and flat side up.
- c is the located on the upper right hand side
- b is the next wire left of c
- e is the next wire left of b
Anyway that concludes this circuit. Now you'll be able to
monitor your phone line, and hear what goes on while you not
<RETURN> around.
**** Coming soon ******
How to safely build waterproof M-80s.
(>
(>
(>
Automatic Phone Recorder
by
Atomic Punk
May 1, 1989
This device will allow any standard cassette tape recorder the
ability to automatically record phone conversations. The device
will start the tape recorder when the phone handset is lifted and
stop the recorder when the handset is returned to the cradle.
The
----------------------------------------------------------------------------
FIL-MENY---------------------------------------------
(B)yta area (F)il lista (K)olla i textfil
(H){mta fil (S){nda fil (U)ppladdat nyligen
(Enter) Tillbaka till KOMsystemet
Val-

92
textfiles.com/phreak/bugphone.txt Normal file
View File

@@ -0,0 +1,92 @@
Automatic Phone Recorder
by
Atomic Punk
May 1, 1989
This device will allow any standard cassette tape recorder the
ability to automatically record phone conversations. The device
will start the tape recorder when the phone handset is lifted and
stop the recorder when the handset is returned to the cradle.
The device is a DC switch that is normally on via the forward
biasing of Q1 via R3. Q1 now clamps Q2 into a forward state by
biasing its complement well into a saturated state via R4. The
DC switch is turned off via a negative voltage above that of the
Zener (D1). This voltage is usually about 48 volts and is the on
hook value of the phone line. This negative voltage over rides
the effect of R3 and keeps the circuit off. When the phone is
off the hook, the 48 volts drops to 10 volts, which is below the
[more] zener voltage of D1, and R3 now turns the circuit on. Audio
signal is via attenuator resistor R1 and DC isolating capacitors
C1 and C2.
This device is really only a high impedance switch that isolates
the recording controlled device from the phone line via some
simple electronic circuitry. It requires no battery and obtains
power for operating from the remote jack that in most recorders
is a source of 6 volts. When the remote jack is grounded,
recorder operation starts, and when the grounding condition is
removed, recorder operation stops.
Parts list: Here's all you need:
Name Qty Description
R4 1 220 ohm 1/4 watt resistor
R3 1 39k ohm 1/4 watt resistor
R1 & R2 2 100k ohm 1/4 watt resistor
C1 & C2 2 0.01 mfd/ 50V disc cap.
Q2 1 PN2222 NPN Silicon
Q1 1 PN2907 NPN Silicon
[more] Z1 1 15 volt Zener diode
P1 1 Sub-mini plug 2.5mm dia.
CL1 & CL2 2 Alligator clips
P2 1 Mini-Plug 3.5mm dia.
Enclosure 1 Suitable enclosure for device
PB1 1 1.25x1.67 perfboard
WR4 (18") #24 hook-up black wire
WR3 (18") #24 hook-up red wire
Casto Castolite or paraffin wax
[more] Circuit Diagram
Red wire
----------|---------Z1--------|--------------------|--------|----------
| | | |
Green | | | |
-----| | | | |
| | | | |
| | | e |
| | | | |
| | R3 |-----R4---b-Q2 |---P1
| | *No connection* | | | |To remote
| | | c c |of
| *|* | | | |recorder
|--- | ------------------|-----b-Q1 | |
| | | | |
| | e | |
| | |------------|--------|
| |
| | C1
[more] | |----------------------------<2D> <20>-----------------|
| |
| |---P2
| C2 |To Aux
|--------------R1-----------------<2D> <20>-----------------|on
Recorder
** Green and Red wires go to corresponding color of telephone wires.
** Make sure to connect Q1 and Q2 properly -- follow label c,b,e
with the wires facing toward you and flat side up.
- c is the located on the upper right hand side
- b is the next wire left of c
- e is the next wire left of b
Anyway that concludes this circuit. Now you'll be able to
monitor your phone line, and hear what goes on while you not
around.
Downloaded From P-80 Systems 304-744-2253

603
textfiles.com/phreak/bugroom.txt Normal file
View File

@@ -0,0 +1,603 @@
How to bug a room with a common or garden telephone.
or
The technology of Orwell's Big Brother *does* exist,
and it's quite possible it already existed way back in 1984...
-- so much for the Clipper jokes about 1984 being 10 years late...
I originally posted this info to comp.dcom.telecom.tech, but have been
asked to repost it a bit more widely for people who might have missed
it. This technology has been rumoured about for a long time, but never
pinned down solidly until a case came before the Dutch courts in which
it was used. People in various groups might like to discuss different
aspects of this - legal, political, technical and practical. Followups
to your respective groups; flames for posting something so large to me
by email only. (It was a difficult decision to make to post this big file
as widely, but I think I'm doing the right thing. Apologies in advance
to anyone who gets any of these groups by limited mailfeed only.)
Some good questions for the non-techie groups: does this sort of
bugging require a phone-tap order, or is it more like peering into
someone's home through the window from the street? Just how much is
it being used already? On whom? Can you think of any cases where
secret technology like this is the most likely explanation of events?
UK people - what if System X exchanges already had this technology
built in? - with local enhancement of the signal using powerful FFTs,
it could them be gated anywhere in the UK. Big Brother indeed.
>From now on my phone stays unplugged when not in use...
G
#########################################################################
This is a (very) rough translation of an article from the Dutch
underground phreak magazine, "HackTic", on how to bug phones that
are *on*-hook. I.e. hung up. Receiver down. On the cradle.
Following the text is 45K of compressed uuencoded postscript for you
to print out and keep - a circuit diagram that shows a working circuit
using this technique.
Don't mail me with questions about this, I just typed it in from
something I received in the post. The original author is 'billsf'
and he apparently used to be on hacktic.nl, but I tried mailing him
there recently and it bounced.
If there's anything here you think sounds wrong, check the translation
first; I've only had a couple of semesters of night classes in this
language and I know some of my translation is dubious.
G
"Afluisteren met de hoorn op de haak"
"Eavesdropping with the phone on the hook"
You probably read about it this summer Je hebt het deze zomer in de kranten
in the papers or saw it on TV: it's kunnen lezen en op TV kunnen zien:
possible to listen in to the sounds het is mogelijk om het geluid in
in a room using the microphone of a een ruimte af te luistern door de
telephone whose handset is on hook. microfoon van een telefoontoestel
waarvan de hoorn op de haak ligt.
How hard the CO tried to show that Hoe hard de PTT ook beweerde dat
this was nonsense - but a simple het onzin was: een simpel
demonstration worked wonders. demonstratie deed wonderen. De
The cameras from KRO-TV filmed how camera's van KRO Brandpunt
our home-made equipment in the bedroom registreerden hoe het door ons
next door could clearly hear the gebouwde apparaat vanuit de
sounds in our living-room. In this slaapkamer keurig het geluid in
article we won't discuss the political onze woonkamer liet horen. In dit
background or the legal case in which artikel niets over de politieke
all this was relevant. Here we show achtergronden en geen woord over
only the basic technique on which it de rechtszaak waarin dit alles een
all hinged. rol speelde. Hier is slechts de
rauwe techniek waar het allemaal
om draait.
Hoogfrequente wisselstromen
High-frequency alternating current
Als je een T-65 telefoon van de PTT zou openschroeven en je zou de
printbanen volgen, dan zou je opvallen dat het haakcontact de
microfoon afsluit op het moment dat de horn op de haak wordt gelegt.
If you open a standard modern telephone and follow the printed
circuit board inside it, you'll discover that the hookswitch turns
off the microphone as soon as the receiver is placed on hook.
Het is dus niet mogelijk om de microfoon te gebruiken zolang de
hoorn op de haak ligt, er kan immers geen stroom doorheen lopen.
So it's not possible to use the microphone as long as the receiver
is on the cradle - there can never be any current flowing through it.
Voor gelijkspanning is dat waar, mar voor een hoogfrequente
wisselspanning werk het haakkontact als condensator.
Well, that's true for direct current, but for alternating current the
hookswitch works as a capacitor.
Een condensator is immers in essentie niet anders dan twee dict bij
elkaar gemonteerde plaatjes.
A capacitor is basically nothing more than two flat surfaces in close
proximity.
De centrale zet een gelijkspanning op de lijn, en als de hoorn
wordt opgepakt zal er een stroom door de telefoon gaan lopen.
The CO puts a direct current on the line, and when you pick up
the receiver, current can flow through the telephone.
Deze stroom wordt gemoduleerd met het spraaksignal.
This current is modulated by the speech signal.
Door in plaats van deze gelijkspanning een wisselspanning op de lijn
te zetten kunnel we stroom door het toestel laten lopen zonder dat
de hoorn opgetild hoeft te worden.
But if instead of a direct current, we put an alternatic current
on the line, we can let current flow through the set even though
the receiver has not been picked up.
Deze wisselstrom wordt dan, net als de gelijkstroom wanneer de
hoorn is opgetild, gemoduleerd door de microfoon in de hoorn.
So this alternating current, unlike the direct current when the phone
is hung up, is modulated by the microphone in the handset.
Op de volgende pagina's een bouwsel dat de basisprincipes
demonstreert. Verwacht hiervan geen hi-fi.
On the following pages is a project that demonstrates the
basic principles. Don't expect this to be hi-fi...
Bij het schema.
The Diagram.
De 4046 wordt gebruikt als goedkope VCO (Voltage Controlled
Oscillator).
The 4046 is used as a cheap VCO (Voltage Controlled Oscillator).
Met de 33k weerstand op pin 11 werkt hij tussen de 30 tot 350KHz.
With the 33K (pulldown?) on pin 11, it works between 30 and 350 KHz.
Met de potentiometer kun je de frequentie instellen.
You can set the frequency with the potentiometer.
De uitgang van de 4046 kan niet genoeg stroom leveren
om de spoel to laten resoneren.
The output of the 4046 isn't powerful enough to make the coil resonate.
De transistors versterken de stroom zo'n honderd maal.
The transistors amplify the current about a hundredfold.
De spoel is instelbar tussen de 1 en 50 miliHenry.
The coil is adjustable between 1 and 50 MilliHenries
Deze spoel vormt samen met de capaciteit van de telefoon een
afstemkring.
Together with the capacity of the telephone, the coil forms an
oscillator. (???)
We brengen de telefoon in resonantie om een voltage op de lijn te
krijgen dat hoog genoeg is om de microfoon te activieren.
We bring the telephone into resonance so that the voltage on the
line is high enough to activate the microphone.
Alleen op het punt waarop de telefoon resoneert verwijnt alle ruis
en wordt het geluid in de kamer hoorbar.
Only at the point where the telephone resonates does all the noise disappear
and the sound in the room become intelligible.
De spoel wind je liefst om een kern waarbij al gegevens
zitten die vertellen windingen je nodig hebt om tot ge
gegeven inducties te komen.
You wind the coil yourself round a core which is already given
the specified windings you need to get the necessary inductances.
(??? - very dubious bit of translation here...)
Tussen de spoel en de telefoon zit een diode die het signal oppikt.
Het simpele detectorschakelingtje scheidt de audio van het
hoogfrequente signaal.
Between the telephone and the coil sits a diode which picks up
the signal. The simple detector circuit cuts out the audio from
the high frequency signal.
De audio woordt tenslotte gefilterd en naar buiten gebracht, alwaar
het verder wordt versterkt en hoorbar wordt gemaakt.
The audio is thus filtered and taken out, although it can be further
amplified and made intelligible.
Billsf.
(End of text of article)
=============================================================
I faxed the diagram to myself and turned it into postscript - it came
out not too badly - you _can_ make out all the components if you
look closely and guess intelligently. (the only dubious one
is Q1 - BC337)
Instructions for printing:
(trim off before the --cut line)
uudecode (this file)
compress -d infinity.ps.Z
lpr -Pps infinity.ps (or some local equivalent - print postscript)
(and don't ask for a text version, there isn't one)
%<-------- cut here
begin 644 infinity.ps.Z
M'YV0)4)`F=(B")DW8LJTB.$"AH(2):BDH<.FC`X06&`PA#/G88DA<LJ$H?-&
MSD4X8_#(X.BB#)XR'J&$.5-FSD44(\NX(9/"8Y&=0]ZT::.33D>?.Z'(></F
MS1D%,6=:!!&#*M07<-*,F4-'#@@9,6R`X"HGC9LS(,B4,:,`QM@R=,[("9.G
M+0@:.-QV#>-F#IN<"FS`<#M#AMLY8\)45!#CA@P<5&/4H`&B:QV86QH_!N'6
M;0L:>#G?Q=M%P1X08^K(">F&CIDT%4%DW=H51,@P9-"X)&L6+9PW<$#T42#&
M+!D0:=I(53YG#=3!T*-+GTZ]NO7KU]MBW\Z].W?MWL.+[PY^O/GST<NC7R]>
M/?OWV]W#GT]=/OW[@^WCIZ]_/_S^_K$'8(#H#4B@>08>V)Z"^"7(('D/\A?A
M?`Y.F)V%[U6(87T;KJ=AA^F!>-Z'(CI4XG@DBI@BB"MVV.*&+V(8HX4S3EAC
MA#>N-\-@,YAA!@P]_LBCB=`%"8./9HP1G9%&<K?CD3XJ6:2/0UI7'I)C1#E8
MDC!(F2657B()))B#2;EEE%A"V669(4*'I9A'*NFED6^B2>5]*=*IY9/2W4EE
MD](]2266"@!Z'9Q3"LFG?SDRV&AT0GKIY9;23<HF=`I(>BEVD4)ZJ9)";F?F
MCD\^F6F93XZA:9>KFEGEJ&5:2EVJJ`+I4*MFYKJIC-')"NIT?/(IJYNV?CIL
M=:>N"=VDH9[XZ($5SD`KJVQ*6RF04BZZY@RJ[MHFC]-2VJNUW,&ZK;ACI-IJ
MLLJZ6JRNGUHW;;==1@JOLK=ZVZ&2W`Y);GGW+AOHCO#2ZRYUP_*;KJDG+MBP
M=VW-.VFZUW;;;Z^L'EN=H%Q^RV]WYGY,+<74EDQONX'F=Z_&11H;JYPK"XRO
ME0S"C&V5&.L[AGH4NTNPOM,E3*VVWST,\<.E1ADDQ3LJ@&7/0SY-L*'7+4IT
ML5=C"NF?U=::+IGUDIEDFDN>^:.99.>7,I1GQSKUH'#_B"B%YT&-]71B(JHM
MJ6P+7.B=G`+N=;$!/DN@X81O:G&E<LJLLLTSRWMMJ!UG'73+Y^:KJKINNQQY
MN`5+WB7'29YZ\NG+6OX@P(UW?:W)<5[[<^8L2\=NKXVK3J/1$(:G;:YI'ZFX
MI[!S6#;&BAXO*N8B*\SYR/D6S[SCM;^[IJ87EXROZ0]WZCK`L=:*=Y23SKL\
MWM_S7K3ZV$6L?+"O&YRS_-O1JNWMNCO.M_6CAS_TMO3#'+N>]RM@=0U7_L.7
MR-I7,_\M4&8&,Y-[9M<\H+T.7:X+#^(8U3`F<:E'L"J/!YLUIA]1;6-_ZIB;
ME"8XVVUM;!WC4IA2V+;1)2F`54H3V`JH'HDYT$AH(Y\%1W2>$98P4#1DV\%(
M=2=3G1!AQ#-BX=C'0"K2S(K(PF(6M3B=#>['BPWB8A?%Z$(R:LV,:D,CD=`(
M1CRI<8UF;*.$U"A'NM'QC77\#Q[W>,<^LI&/?_1C'`$Y2$&2,8\9(N0A%2G&
M1\6`#$B*I"0G.<F\C-&0C60D%Q$I($U>AP8WH*0H)WDPAP7RE(5$Y2(QB<11
M^J@,-O(D%CGI(5E:D98%BHX-D&1)]N&2B*S4XB\19$LJ#A-%Q?1E,M5W3%.F
M\IFK5&4F@SG+9?*NF1JTIM&P>31JWE*;#^-F[Z2Y27`V3)SK(Z<PS>DL=I8(
MG?%QIXKDR2)ZNLB>,,(GK[QI3'WNCI_*!"@S_1E+@5Z3H#A"Z.H4ZBB&*@B>
M551G-0VZ38="RZ*'P^@4*1I.C7*0H^?TZ!=%&D:0MM.D[R2I&U$Z3Y;6TZ7W
MA&D^9;I/B7Z3IO^T:3]Q6E"=!M2G`^5I0H6Z4*(VU*@/5>D<@7I0I%[4J1F%
MZD:96E&I?I2J';7J2+5:4JR&E*LK]>I)Q9I2L"X5FM,D:TO5^E*VQM2M,X5K
M3=%:3K/:4:XYI>LZ[:I'OB;2KYT$;"T%FTO"`A.O/=7K1!$[5,86U;%'A6Q2
M#4M,RB+3LLZ,IF)O*MFG=C:JGYWJ9G<:VJN.]J>G#6IIM[K:KJ:VJ:T-ZVNK
M&MNS:O:V:9UM5FM[5]U^E;=]!>Y?A1M8X@[6N(5%[F%].U;FEE6YE87N9:6;
MV=SBMJ[4S29FM9O=;G9WG,Y=:WC;.MZWEC>NYYWK=??ZW72F-Z_K7>Q[$QM?
MSLZWL?=];'XCN]_)MC>>V_5N?ST[8-`66+3U)>V!39M@U#98M0MF;81=^V#8
M3EBV%:;MA6UKW0YC=\.]S?!N01Q<$@_7Q,5%\7%5G%P6+U?$OW5Q=&4\71I7
M]\,P;FZ.GVMC[O98P#L6;Y#).V3S%AF]1U:OA]G[8_`F&;Y+EN^3Z1ME^TX9
MOU?6;Y;YNV7_-MF]729PF`T\9@176<%E9O"9';QF"*=9PF^F<)LM'&<,SUG#
M=>8PCN\\XCR'F,\Q]G.)!7UB0J?8T"M&=(L5_6)`Z]C1/&;TC"5=8TK?F,F6
M]G&F@0QI(7>:R)\V<JB1/&HE[WG/09IDGTL-Y5-CFM7X<:735.AJ*2NHEXVN
MM95AC9U0NNL&8H@DKK?XWXB>)P:M*V$I#\UK+7<Z!F88-MZ6G>M7GQK:@,,V
M+#VM:S1S,09.$]X-MGT=:(.ZVR#2]I(4H)9B7\BRT,;!#7`0[7?#X`;4QG.S
ML8-L8)$AW]_Z,H`["^TR]&C;_;:.N6D=\$T[>3X@A/.^O9QA;$=<3<"2DAER
M4&]FH]O-T+$!N8D5Z8F+^=L**$,HZXUM:9MAVP<WM;4;INZ&FYS,-P_/UUBN
MI77[*"_8_KFW/P[Q,9B[VK8FNK[G8\EY:Z3GB0*ZRH5>1G=?$3TSR`OE8"`8
MB2M]U4J/`2Q5KO&.1UTC!J<ZTG=]ZJP+SVS2;O7,DXY%<$=[X]L>-W5>SB,2
M.OOKX4FX>;`=1*?%G>US1_R$H#V&&W"<1Z5TFI1\';FE)WXZ^%Z/VOUN;(>#
MV>1!E[?"J./T(_6(WL8[4-!?28.ULV\&DL?Z*P,4RFU#U-X"[WS5UA+M&<`R
M\YC/B^]!R'E->V?UKAQ#Z_^,(<I_OH0CIT_!)YUS-6\2!Q<+)?"E,V]SISJQ
M8@>6&8+MRO(?OM+PX5;VS+/^-+[']URNOM>;W_'5G\PA&_\@)(NOH/97O3J-
M47[))V?5$6V"MW)E,`9=%SB))AW39WET%X'K47,EY$J#$0.BEWH$XG_59@8]
MLG\"*$EE<'[LIR2%$D3E-W+<LGW[P7=PY'D#-UN^=W2#X6NI%DGS5S\`IV8W
M<(,A.$DYP!V*8B;1QR,Y0`:SUBQ/4H2/!GA-B$6P5T`U:$*X9G;FQ8%-50-?
M\H,;DRT(QX1]LATWD(3EMX-Z=W).6'(8TB_-8H,C9WA&@X7N1T;@ABU6"!VE
M=X-@""DXD`/G-V\&1WZB!$OR$6\M!X&*EXBR)S@K%WXK]'#[(8>7UB&EYX"V
MQX8)L1U<N!V..#XJAWU2<GM7EWNXIXFTMG+MMD(MY'%.0H)FAA^5R'W"9TF=
M:#QF@(%B(&^BU!VC]'L&N(>C"(.Z5TYNAX?CYX)FPW#X58P2:!VQN"2P5(S(
MEP-^&!VU6(`),DI*$DHX('C6=WF\8X(=A(SW=HNT-FLXL(,,PHP:&$TW<"C8
MUTLA"(S)Z$J9Z![A=XOIXHI4EH;<]G[D>&]*8AB00H]G="#LV(`B\H[RLC,)
M"2P<!W7R\H-@6'N79'7$)H-W^(SB0H"M2&JPR"D<F9'C07C<$6^Q@W[^>&YU
MYS31=X<=25X/"7+<P9`3R8_.*)$O6(X!B1U!@I.+)G\>:2$QAX=Q%VYQ2(*B
M2&PV:1TPZ1V\5&["]G_!)XERUXQL1A_L.)+\=Y$;")0Q>")=F1_Y<RA.$DD&
M22P)MY3M*)1V)AY<^8WU`Y9Z=A]C>6-WF8SJ2"E6V98K*6JG%I<\-I-TQHL*
M`H:%N)=%(F\4YY9U*99'F9<1,I('F4J2B1X+R(F1IU3,!X[L(4EQ=YE@1)DJ
M:8U1>2!W64=].8R>69A.B'P%*)>]1I>+Z"-DZ",YD):&J6>"@8$ZV(^MB8@[
MY8C>^$*KJ%]-B9`^LW*RYDI@>)D^J9,OQW#RL9H@&9Q@UR'76!_,^903DIQ>
MR1Y]B8$_V$+@`9V7TW<!&3Q=Z)?8&6C5MYW709H[N1_@&92!0IN:6!T&J1]!
M5X/_)AV_MX/6&8R.V9E8.1W%.9L(VFL1PHPU4GRZ21W_>23LYB[1R(^$*9M#
M]YXGM:#S:5[WZ1\;6HK<QY_HT8DKMY?5J9]_YZ%JJ)W]&1WTR2!C>2,E:A[)
M"1X3"D4UB)*ZY!TSR9;A>:"#AA\%>F]*R2`C2GVR&)+4,:/6D9D%J';RXJ(V
M]Y?7F:`.J)A'@J5%NIM,VDLU,J(]ZH"(4IW'"2Q@6II<*IP!!:+4(1C>26#H
MB1XU2I(G&J6:QW=4"AT/F*4YRI)OFIT;TI?:`9H@<J/TD:?B04(\.H%"<HR8
M)YE#RIE'JJ4^N9>*ZIYV^9@UV((4*J7507GL.3?.V*;U":/_6*B0QXL@J*JK
MNI\/TI01.JHI>HNP9)MWB*JE*JN<IJE7>5.K&6_F"*P"=J?GT:2L&9.`>J;2
MD1>&\:>Z%R7(^I:L2JAKN&PVV1;&BI(_.2&,.A_,>A[1IQWR>:A(4H1$2I5&
M6FA(RJV-!W1W!ZZS-X<!HJQZNJ?WP81RFJ61J"3I"HG9"I@>2I@K^G3T1H-%
M.8G8`:WFH78UXJ]>&I:^8TD0ZZ0%NZ7$RJU:\JVA,@.I:&`9ZSOL^7S00;%$
M5HPEBW/""IR'>GC=JK#F&!VY.2'T."/]`G_T<:X76+$!PK(7&"7M"K"N^H00
MAY,@*Z"5&2`MZZZ+B7;]2J$[^"S=%[4P@'#W2K!'&Z-'B[!`0J]'0H,*R1U/
M^Y%9BZ_HH;*@RGT])[0\4@9GNZ\;*W,319A)TB_F5@9DJU]SNS98^X5UVK1,
MFW&4.&O9@K%X.`9_6[9=VZIK>'@OAVS>^B-\FSP8DK,ZJA%12YQ;:QX^>S,;
M$HMNY[DO5[2$^[)8AJ22.WX":[E'-V^VJB`#.UT)JZ12VW<E*Y^(ZA\$:92Y
MFW7*:**J^Z)?*[D1M[>QJY-<6VZ-:XP=YW2.V!;XMKM,F*06>QUEL("E^[S$
M6[?#NE.$:0,HN;<]`G?^5;O+NJ>>*[?9>X'7>ZV^@XXU*'47F!?+Y[6*F)64
MR(^5F[6QBR'J.R,,Z8@SP'%`^ZQEA+WDJA&39[^X"Q.8"J_%&WPY2:]B=[YT
M*WV-"QZ!6L`)#("E-*A6Z\#U:\+WAFP]BKIJ6\&-*8:'-W7\HJL:S(K\YKT\
M.7D_FQ^!.G@C++\.\H[9M\/WUK!#N;\TN5>4:0;`-L,9K*_)I;Z;.\0H_$1A
M2L2!$L+B2;_W1L0(")\NC(8/XHU+[+H10\,XW!T#O+D)!\)3.+QJ["[:,:CY
M2FYN_'24.\$VC,1"JG)YU[H[B\8&BA]2[%W=I\,H#&PC6Y(__+[L\<%8K+&/
MJZT=NB1P0IG#)WR"3,&:&8E4=\<*P(V[V\AM2Z.?',EB/,D&JS[#MS,G/"NC
MLLD]]:_K@6MWW+>#C,H\(K]0&3&(3,N4S+^J/(&V[)3U=L;KFFX`1R(->\?P
M49QSS,O=$8V_?#`L/*M\#*?KT:3.IX>Y+'U:?)$KUW2ZC'6D_+V?*;H,R<!&
MF\V&NK\FV<55*B6K-[<D`LP1J\Y$/",@ZJC!6JJ`,X2K&\8N^WJOI!U-:J6%
MS%KX/![4+"X-#;6O:L$N8G8"+<SN#,8/\GWR3'I<XL'A_'[+'+'T1LZBFWYR
M'*J42'6*(FW7_-(*Q='%=XB`.M+*N50K1W(1C;9/VJQ]VG%3B9_@"[/P?*\S
MW4([[<A5$]+6D;\MW<+C,9/EZJ9[)X^G&7\$_8I41+3.NC6NPL[#!=:'$M"[
M[*92G6ZQI\`9C;1K?1\Q0'(>_2/@(=8H[=/&3#DOY\\\G49337LX,')R"M,!
MUKR#YX+\AVR5:)5>1-?_9W;,>:UGK=1KV]$H[+AM#;F5#*C(R'_CIH1,G;J_
MB:2T5HLZ&W=];7R!]]G_/,QVRSNAE$9'36N,?5BSC3[-DM1&&]FBAMM$G=F^
MO8$6G9/N5]M8YXHDPB^]Q-L^.6P(S3N!K4G2W*"_+1Y%V:,YNMC7VA_*736F
MC;+[L=WM/-VNV9K`9]W9S7[1K:"N4MJD=\2A/=!##=\39=VJ;4IT_![;K1\C
M>=IJ1MPY>-G!'"%I.=?IW1W7/1_@_:ME!,4!N\$`OLH/OAWDEC\'CI#GK7#U
M7=;H(]E:*:N"C9&>:AUV3(MFPKT73MT%;HWK#1^"6<K<';X8+=Y5Q7-YI[7`
M&U?W+9'$I8=I.#,,FH_@26(#M*BD[F5RV9?I7_S1>NF1TE>!P\/4GK5E
M'P_&95]^H`9&9(F#5@?JR!ZR/^2`C4@BR!5-B8,*=/9P>*9]`GA"G,"9V*D_
MJ76REPT-PY-WI:)-)WM9GI:(D]0C"?RIC0D1RHFL%"V\G#4*)P9@)24O\F"N
MIM0-<"JHW3D^Y5_W+X$^^@EOXPY.HOC--AD]13.>0JB&\/2FA"F`%Q\A-(].
M$T=4:AW9(V2JAMZF!8@.BMQH-B5@BK"AIHS5Y'=4O3`KN)URDJ[01L-1[UBB
M[%76"=S9N&DLNP3`R9)./C)J'N=QU@CG2T[&SHA1_<=_"DZ4<S:6)S.-#JFC
MBX#:;^6E\",2U\Y`D0`-.+H]<I(O30O(%7XWS.%JFEA=$C,J#1@>J2,B2_"Y
MD["?CZ6)VAU!D'G*C5!,]J7*Z>:Y4PD?JQ^62KC@-C\H=Z,.J7Q8)8,YI>:I
M$5AT2%[=J9)IQ7-0CA+`'`[P<\*F5MUDJ4+&1/XI"$KYH"2.)ZUCRH"2$I56
M@@[ZF$&J``+,N1)J0=>Q&_IP0(\BN-U(J")C.#HA<(2J)2+Y8(:B':K;EY;0
M`#D`TBDLC499#@Y@$YDDI&A0AW_]F;;I*EK80*AFVXOJA\J>M2JG$*G>+RJ>
MD7E.X:BT%Z$Z2"Z#5"FB2GK\'D`,V,F;/JN>%9:$=UPFHD[JINH\E'$;6,.D
M<JM#)M.%>F6BB1^"VCHIJ%B=FVJ@UB2!'Z2B(QRKO6D`>J@Z"F4:?'!XQ`""
M2`B#H.HUB4H^Q_$8J,93QC)!C&P&AL#*>X)$.!TWY'3RGX-I`>*P&BC622#S
MMV`A$B,RF!9V%GK'"Z?=Q*2-JF/W'9VK:JJAAA\5$4RF2)AX&F.<ZN*A0MBK
M0LJ'<'?0-XR@_-8PQ9"Q*I5*E-1&`6CKV:UNK)&DD]$%LG[.D$UHA;:7T*K)
M0K7F@-L:H[JT[I\W8_H#/'(+"Y"&M&ANK<\I"*:HCA-*9=4*HYZM_ZH;*EL!
M;3W2:-*R&I0%*YF:L]6F)&:5^J#L@N8,G6248HX6*][JUB!-3I_Z5)1RK!6C
M&,J8QA]J9()H8-2B="@'4P\J@?3IVEJ?LJV<AG9*\?"0&R:6:&;*JM\JYFIL
ME*KI9F%J/Z:?A$GTYS,Q2W*KI@HW83Z^J;<ZF:BNZB97^;<JKH$K,`H"U4:3
M)]EJN7JN\^B'>.FLEJ)%[HJKLCA"PK7(06ZE,F-0HKFFKI:JJ.*[DJN+'5A:
M7827RFIJB;J:A88JV@)&9$)[5>:1G'V"/"N90[L6BP7@YPBY#JP(R2,UG'&>
MVRGH&IM*EL(KEJE8KAB]*_,:F"FO.Z;*^;N^I5=K4-*IGIC=V`#[F+ZG96LT
ME4-&,;<JXOJLII_)X%_(6^JN_NC%:HQI,+).S&%CSHJY8J_A#5:([6;KM%NJ
MH_(K&O8P9;#QG2^R(AUQD4Z+8,":*+O6"UN9Y*\(;.3'KYV*0UCXF.1,B4Y?
M\G6BMI?*8-?HMEJ?SM68:(P0GQ)H]LI>0K#<*_`:O8$1'<PRX>ME8\2GD56^
M"B$Q8>+)*WI2*<($AY%>?"AL!7:YZ"L(*G2T-M(79VKDZ5K0L)JIIVB]4JYG
MH_K(H<ZDSB>S8;RJ)U=#$/L@K)*0Q11;8BR'0JK1>KI*L#7LRHG\P6M0[-RZ
M*/JQ=HG<$#Q<L08B(1O'42N`0N;QN^T\O:D7:T:PG2N/(VLF+JS':_H)2^R3
M2,29\M<04R2+B]8:<8YX"LLJ?I:P>JF=D7Y682/B4_:Y"K)C%/+5P:ID4B$Q
M>GJVL2_$MA:OPF6*K)##C*B.D.S#HB$,@%UK''?/29/HZ2W;]GDK$UJ@&K_B
MLETE.)94-;/QQ_IJ2D2SKFOUA0T2D9F)'"N)NJ7H4.8&I^XD=VSW);B*J&-G
MA#;,"E*ZK">()/"B`*PUZ1ANLY6IUBFLN;/G;)R:!HJ3/TAOA/_!(]1FYH;)
M)K-5(E.VSD*7@Q^X"E2%D:!H>;`A'D$$[:>3EA@)12#MP3$&M+`LU!F):@U5
M)1?D)/I\4NE8(8^6E/=,=S@<;GP)V0!"O>:SC^J)Q\<JHZAG0I(S/G;(IA-[
M[-UZFPCF=IXX)Y?K_QJ,11*/ZO9BC%"JJ*@Z)7Z`M(7JX7J='GU-0K?70@@.
M#*WI-GRX2RD(N2=M%"&!K-98T<Y^O(,HU^W]H(U=5DLSA('+'&,$0IB+XX\W
MFWJLM`#M.WN^88^HFB?'M2JQA0TABJ_PC_2J%*?^X*O*C#2+B9JC\Z!0N\M.
MKT%0?E3+@D0Z;084,/4?]8V+:H;5>K$KTVH-PH-MZ27GHX):L(0Y&=5P?U<"
M%L&0=+3+:R'+01R$:2<TAM+&LJH%7;O`VK55WBN+S=ZV.D*N9Z`(>SW)3KNM
M&+:[IP6;V-:S^2CM`@NNH5]M4SF]II-TJ"9K>*VTX)^2\-_-L6_C;>:KR%HF
M&A';L::R5L1I>ZG2L1".'':3`6>ICF!;NGH6D6EKJ]J>/<3E8NLF]$>4T(36
MVQ)5ITL="-Q6L-1M:264J:"FU@BK/OBV>:T4UY#JK[3@/"O7VEN^'X6JX"X+
MUJSFR,-9MZM(M7@E)A9LK-D312D(722>VK\]M`7%-4?>\I@8G'0;;?VP5^8O
MD>`JK@MC2(L?R`!\#RX1?B@,-0I<*R)(=UF+.,%]78K%+"VUW[HZ1R9?*TJ5
MEOZ:'(:]`+CAD=\A:VETQRNW*=6.LZNB\I;>2*/L:P([F:VJ69N*HD+:,V>)
MD1LH1"0S[78[58"SGPGHYN6>!RP?5$OHB)HT)X'`;\EIU2U3*"Y516@*)#'B
M[F$W[>A211UI::N4NPR>/N8I^W!5SK;X@;%%8(&U7(>-:]S0+I4MF3KF:A?8
MY7DKNXX'@I'\U"C,'F+F%'+^(;`6&)8K6,*18RV;II4R96\.$[D?9+@HZEL4
MK@9C_A7STGSR1AB0B*0M@+FX6E'IP52X7!/U$B#854IK*T?JYJW*U.^1`"HR
M1B!!<I5""FDIG+M8R+#^YW([5)XV),)H(W=>LX\N4R85]44]+:*E!%6N\:Q,
M=M_^I)'K&2JZ1A1:7Q+KXXJP#!P`1$-H?BCNQBA3YK<,2CB;T"Z..<]PIK6(
M;RNN3'HH^+*%8HI9UPVS<6Q8ZS8:KR`-%"+7?+LUV$8)3>ZZK=H-@'`2):5#
M-OM4C+2T13O+TZVWO0;3.;<5>4:MBB"Q&7F.).$RP1F\V6[6N.TNKH@M)TCP
M7D8OG@/;U"2CTJS,.2\1N7C*H82&PJO#;'I;==6MA,R+MT%,MV8F9UH*W;DD
M[)+;?T*2`"_)^]_:NI-:G9=@\KP(RH#+5@4,ZBYRIE[(MO:&Q*O8#)=N'+3+
MN62\:"$A2(&<M]AKD<(C[HZ5X,C+W`J]]=C).\2&!P<@,"NDK!A9AP+RK*RO
M,&\..L]>H.[NQ%NB=A[3V!G"].:]WL'?N_92-[1=]7(5=;S8&1!Z03:[;45M
M4P,P,<P)OOF[=",*R^CD1@J^-=C3\B'LC-<D/0/2W3[IZ-,I9E"]`,]PV=.:
M!_D+L,&&J8:'GO6:]JU70\4O"AW$42[LYP4-H2?N`?!(]G8/&J[]*A+E+P6*
M^&KLF1*I&T7'R@IN-*9=TK+LOE?DW5N,PI'(;C+5+X`A=`WL8[\%",1M'/;L
M&HFUC\$I7U*7BV_0VUA$OSEH6T#]MBGO9%#H]#Y.J.:R\B"23KN$=+J2IH"R
M;]5Q*,:X)8+PNRQ]"*;*SK%0D+[2@6&P&:4(KM,#P]]X<_+<URI:&@WAV<,)
M^)JZZ8I".H5H';T/5X37HA(>2'-'@[9[)<N[U/7>K)UMV$C^6D%Z!WI:`:E.
M(QE7E?TV#%>;`*4;G:;:AEOU2[JQR>>!NT:,P&2N"8*>^@G;B&J:G!I_YBR2
MDIOPH!0B&DOB1A3W[Z$+(I3`U*]YQXT<FD%P-J&Y(HNP7IDIHAY3.X?_VDJZ
MO0_NVNMX-@J&"+=">&H7.0T,,9K:ME#)CM-LW4W_G9R2XVA_3:KSF\X.LT7O
MYR.G9)RH6MFDDR`.G^YVVN#F:E$.X1DCA'$S!@'54HJ_CP4.S!XQ!F*PI#+&
MCJOM71\\E#BZ*$J48X_],X0PGG+3%JN[11)L]L(P;O"JQ\OA;4G%%`S+##R6
M;:BP%M!>`J-4!_1&?E(C*1SEJI/*[A><\W8CL1#X@/BF'UJOES'T.*"MG5GR
M=*P%H`)/)(;@IR9O"!32>!'/"[%WV2JAF:WM"@(;MY5E`09>#;T,1('GYZDT
MD"NU]E9(O!,)#U/_6F>2L(.;G90KEX_M^*@PN20M(F/S'A;W;^\;*)6/>T0Y
M#-[2O)6)!%5_;'30<+S&,[U<KVW#,*,5B`_PK8;@N90I)*S+!8?`T$8BV%CE
M7+L)XO7>_BAYPY2)XW:/=;`R]^[FN+,"G&'^`8-4DO#!Z"0+8H?6D]XE+K^5
MZZL3*L2I!SA\OC'"7H4][%#6O=G)Z*@E!$;*FKK&<GJ7NTSU`NZ4%2RQ7!KR
MOKV9(TPC$T-3F"]M^W2"#Z6"\>0]18=88W0@`P`[R5M_=@3M*L:PC"(/MY\E
M+^;PW7["Z]?'-T&ALR@D'B4$A7H.3,IQVK2%=5A4PON%4I+)!F&C,;XRF"28
MGTR7?#!K<9[5+1\DG-!(VB%Q\=R)$%X]U^"'((^29%1$S','9PE','UV%&O$
M#]0YDH)U*!]D3EF!R(;H:G9+,V@M2,Y'W)&YCPUP\]%#X@!33CWLM)`<5)Y^
M2(:D>`^#?#)!S'9"AW@[S3R%>X>VEL>TQ@5;"<81;W^\[HQ8[>&2`HC80C5"
M7`+ISZ;:7$RH+-4G[MZE'*GWU&_8E-YCWFL#Z[%T;5Y<4L`MC<@6@NUNJW#N
M5#S5O0BXDP%"M'Z=4DF?P)C(G+MP9W@83[4+":9PUA*UG-UCW`QI+9MEZO?$
M7356"?:RC@5;?2Y<H@1+0:H3*$+U.G0GPD`LP=+#B9,%DE'(QW42)W?7A`&H
M,%'%^X&\W''8R^WJ-QQ5+`HX4+X8"#>AJ3&%-1.2<'H\:TI8#UE89+3]QYGX
M'`>>&>TPARGXM7;<!5@<HDI#ESHD0N*M%(C(@O:JA<.LXC,<(K7-(`J!<*0W
M*#(%2Z"6&.8IQ/(U59+M'C_I.29-04?OA^;R<N.Q>!86PK/^A>*CFY`OD,0E
M*TR-`=6J[;'^1C4)`2;;23+(9FN7)2<ZBMK&L`NXE<%/6\Y6%IX>>`=7+)M4
MGE_%.]SJTDI6RSQRO^"@G+`;@28[(_J=@1H:'K7FA_C!0.*4>%'*P0#6M3C+
MNWHB]"ZZ,2O:EUX]!_'J]Z`DQ!$?E.B"F4Q9R_2ST4T[ON:CG&\-Q4N?I[1!
M"$-TL:7<MEP<?.6.X,J>RGWHH*P!92S3B<0!M#9\Z=6UU5NQNZLFCAE9]IPF
M<GG)P\@LNI5/%!3:RL"6@W`-THFID(N\&Q\54W`OM`27@Z1'W,O\1<%'`[/\
MB141!^.&F?CDK]Q$N7L1N\K=:A\DLVC+#H-^*,FFNSD##CB/WG6?6<.XO%&6
MG1WYAARZ+92I2,L9(@Z27G\0PO2P^*WO"]LFN6[IL&QIR;:A0N^$JPS,#6PG
M*;!>OP4HGC?(]*2WW[0\66BNXQ3:N<<FJU2?+[I0)*T#<[@\E66>$-VBJ]EZ
MELMMQRS<_HM!XW@L?>*FXN=VT\(ZO/4EFD(O8&G3GU5Q+Q.S^7)%=^+R.GJN
M/6H,V<QLHR$\GXP<L::9R[0JS..L;(OXX"W]\0;F+2-[#D)2S"-#+6IFLZ##
MID8P\CZA"*=%=A"(,#1S3755S;I(D,Q6&P496WHED8\CHC63N0LQUH$&XW?H
M,KQ,]!`F=1JP+)YLI]O-3K?!U9*<0C^,*B=2+[-0'$NZS#*7?SBFAC0TIW7L
MYXS)$RV<,4EBR=^CF/J_WK'[T:O8-3K,')H6#-`AO,0,)3<W"[2IBZT9/C5M
M_<$&7%9(O-*0QXQZ9LQD0[.[=TX15S,`@J6$OM%Q/[MES61?<21R.`>M>K.\
M9STIO[1SFHOR(I0(">`<PIBQ>Z\P_(RQQ;-PEXOWNKN#U)O5G\4P:3/B5X5)
MSH_)XP-)'*!LHY<REK"8P3-L2>6VCIPS3]H8PQ^A#/=L,]>.GRQU\]B-"4XR
MFL`8,;]3[0/2.T:@2NE+`3N?,[^$]Q'#H#`^JQ*BM;)P5(3$AI:XS7MR92(M
M4;UFT?`\+0ZQV?/=+&Y8A$X4B[HI:]#/Z8=EN'$2PDOB;#0OSB#<IB0;MR!=
M6MWL%6O,MYOY['$"SOZN3M@^Z[VF,/Q,!CJ-0>'>V/8JQ:;(FJ*%QJSL%[=<
M4IS.-&NDY.+&=PFFX(!`NA$N,0@-YZZZ$"T^-`YS$V?6JIQ"XZD\"[N'[S13
M"W0=6SUKM]"B@:H@D[R<1*!</%^Z\2H'DCN7/5WT^]H#$V=[GKU;4Y31X5%&
MJV/A-S@JCJDO.I8=PC%#!B[)/?2XRTJ*;$L/9FK24E\YR/=951R*N9\BBO.Z
M=H=LD`A9F!MWC/2C/EJTA0[3:2U*T<QM<_4H3-*4Y'3A@P!US*X4ZR-Z,5O#
M_#KXHCU`+LB,E2*,@/2F1$HKMQ82+80X(-%`]+'QUXQ9B4RDZ4K7KJA5O")H
MBKY%12V]AA`B0BDD'*5^F[RTT]P9G2%X=(_6".:N_DD-/9&DM=5G'"QZ_A),
M=+P&TT33UG.-%&9YQAI([TJ!U&K1IMFK3$NS<?3]ZD*/!T?9&47#$3&W39M2
MYXXQ$BNIV`4CD>]TX7:&O#W>[_`<36.D?,O@M""VT]-P.4*[Z)F?Z3\14,]J
M^<'*TYUHON(!.5WJ,D\/5*V%OJ5KSNVHXM_H/VKT&0%)?V-&<DWR4$IU&MKC
M\[9Q?7ULDC`P^3U5LDK<]8*J)A2](;)),<P)_UK>U:`;M0)#2?$>E<6A-*'5
MTU+L9`<B"HJT\"M=ES@=?H\UO.XBC)@AU]AO4)%^JKH[8N[2O?%&<V^$I'L3
M)9S2(LRJ'D)E_AIBM_-3D36XQ``6%6D#[%KWBNO<2?*(AJX5=4S/I:8KE$B$
MR"FIKYCK.1/$O10XO5*C/W\N^&C*H&MG]7Y!TRS4-0:MNRU?)EGO[_B$;1`C
M23\MJEZ9V1\#P5I9P3=G+PR+95J)RTOE3._3KH:%W"O]CMRO5#NB:-1EST`-
M!&9<=+3%;$<;RPHUYR16'\P[,@3TMOC5!0B7`W_H,&UC(.E48;T5-46EK^"Z
MU:&&`#S^$E"U*]=<-X*D+?VQF.B;+L0-E3Y?T'[5$LW>`30X]5_TYB#6-G7V
M.C$&.L^UC^%8PY8JA"Z).(<M-R$^S!YKE?HOLK/"ZC_:-"),\::*\B+0@=F-
M,F`QMN(%EBBLE6*+78?7\MA5C<KA9*\$HCD\XS`?3C'B^5J.FJ0HDD-A,W/#
M:Z4T?11`I@!C@E"1!':#%7X:E72U:Z-?#VZ=[N+Q0^=F5%N\.0:OA;8;<SU8
M'VE&=4(Q#GO!=V8Z`0#KS=P:E0OTQIN^+&6=^*[10TM>`'"0SC>PEPF-@=+:
M;5THA`+9+\KM$@*Q9Y6(-W(JS;R):U)47'8,`,<2)CJGU`RV(B%7)KJFK9^U
M@Z*+*9F4S?N!UW'F<-DP6WGIL0^W/"[7[`,".O]&NTZ"F-U-FPBO%14-6.NE
MM,3)-/RFU!S$C$W@SM+?K*`]=HZ+Y^:SA&1GV+?LHD"/\+S8!'0\9'S9_36H
M,N#=-=QN%">A)'O%\LH\K,W6]`6E71"[015G2\%H>]5!UJV;5G>2</9_>RJ6
MV%8$EX/:6G0!#RUA%ZMM*F!#<5Y;T/!H.J$G$]-]"H%U_$JO["9JJ)&>L2$>
M,F/T/0B2]J<QB-!S-^Z446&/8(Q/.=1O>,?`V^AUU_9/N?;PG`MK$K\1ZVLP
M>]:_*^5<4FC)?S7QHPH64%:J]RPMVWFM]A_1(B_;9+&]TS!_U(O*#3379)1G
MSR2$'C14,C9$)"UL;N^VVBH5+6W2\*!=;&_1^U*]EVQ[-!-:LSVG$M$*]_YY
MYWRUF1&U_71FT!-DO]VT5;J(P[>M5?@W,,W%[>9DW"T%Y!E7/K?M]I5C.2K7
MAK0$*.L^#/_<FW3AE@B)$(&S*7K<MRD"/%(8VO/T5&$*C[PUM^C9WI[+W&ZT
M?<"65@^W;#4A2-SGX@\\1L-X1;<\G6"JW%^2&YF'_LGV8O4L<J\6.YB';.V,
M#4IN48%UPV^?3AF81<;;SL7,_2E.U60W`S$K-]5MGLY-`;7(V*A[-@/8`'\C
M3%SE;%QV]\'B$^X?!P\@FTN:2V8.5W5V%Z2$<72C;,.OWPW4':J&5EBG8$/'
MW!W"AY?\8:N_26BZ?0U18J7;\7DX9\HT!90J2V_%!&P686>1D1O"]X<CN=&U
MXIQ%)$.\"%QU[$F\PJ<W#)VL1COM0Z4[MHTPFV4`>C:K9Z(WM'!C5]K5=BSR
M7`K>0L@1EC-7W%OCE:0$[]PJL_$!<A(RDG?[U1%G.OAO'W%Y.]^W&MR80>MN
MYF/&3*:Z3]AW5ZWB7G7=[D]](?#>[>X],7YWW0&QC2*;S=!T]EZ;$;/,AP+X
MC5Z="&<?"Y)ASLXJ\R!<B_K=4H]K7*".=W3,.X*2Q8QVJT2&L0U+-\+PS8K\
MP>DWDJU^4W@G-*"]50RP`?/%<HVDUD98%$L3A=ZM1`U+>L,5"K:=G%LW*BTD
M-TLC=&]Y#IU6?;.*L,?[RCP'D;8W*U&[[-][=B(Q-K,I([C8EK8\R[*TAN`N
MKP['M[+;5431K9RDETI/:L/&"H(^T"<5>.X-(5!Q!*D&#FH_A$#U?3U'2.$P
MWG[*U9K@L-P;3<6AWY[:%XZHWE'D=]FKMK6S6N(]-25TW8`:$+AJ6W@].!6Q
M?GA0E58@!83#!SB5A``.;R?']-@\5P753#C0/76CS'&+6^<;*=_O=8N5/9#A
M&OA&4H4/VWU*`/N"+]G(MQR\6:L<S1W\`NJQO$RVJGUP8>+FL'U<1<.&X;2/
MNX+3%4N=KM:1)GA9@RJ$2XQ\"Z%[1H<CHR#58O+LR@N^+CC1AT,Y2A0T$LI0
MSM,Q!V/E0M$E4K<W#TV!1XBL,Z]ZX7B"N1T-XRI>TZT'@>_:4]-3[(EGU#`,
MB'H?\#W$WY4TDC8*M[0<_,PDEBZ%;+<-OD-.>&XKM3PY=Q70TD?ENMG@+\9]
MCZ2>;3N>5U,H'+0@\2U!([=X!-T5F[15S%.29SJKN#4)9*'^&8$L?$5[;".=
ME3;>BE.VA]DQ`A/T(,-6,PYIY2Z`+1/2>LR1QTEB':+,(&Z67-UG5VEDM8W0
MA*?B:-??1$=&$FD<FCJ,DT1C9?*!@<=6"Y^3B0N#B\+8P:%(;S/_E'9+R,#C
M;(4\KDG5M'NX!Y[.E)MGX\QL&P*V-`KUG.ZNSZV$91T.J[WNN.Z\@6L9V6%`
ME240)GEN0\TD`H=,B*CK8:L:'5A4;!WLNL<VFSQW9YYY.%:AN9Z:0_GB$LKD
M./4UL'T:2<1G#W.2/[]N;2_`B6I-Y`G/7<YC"<YXQ-"-C3LPZP>^,36NNG6/
M(TXD)>-KV#!WGP"VH(%A#KQE.M#A*\XN+<19+^IV6WNHJ+=2;H29Y:<XF96-
MBN&($("%'6#;9[1Y+$J=O4!"L'&8&TY`B-$%Z`7D'7:P]6$;#HT9=V17X1N"
M+ORR0&WD/M%?&;#%O*/'6#.0)03L7,1,B8P=B(-"Z6'NY::M+;,S+%P%MQF7
M(_#CF9P#OMURN&/+:J<3;=?R()2[.DCFK7DIO;A0.T)TK\T4#>'MS5X49NXE
MRW%WP&&1*WLQ![&&;\$T>='</OWD8:E3_<A<?-=RUA)FMMRMD`0\GT@)#,_;
M<C]UKPMY_FWLCMKU]OO%^^%&8I9XMI.7/-.=X8!=FM9U&7AN4JS'!@7`1*)_
M(]%O?+V_]3!/-)Y`GX?B<_`E$12WWQ-"8!JM9MK^P8`^=LDZH:F[$$;+TY"C
MGLT.\]IN^$/MB/M6+S9Q!S;.TU>S5I9?S<5'G+\M1DR_*KK@P**+8BZZ6`&C
M$QP#,_"$2]0;T+.!&D2PSCMZ/3Y'S.04+[21B520RLW`TJ8W2W<V,A&5#.=9
M97T>I4/&L%IGA1-SFHL'A4[62H?K4(KY=H>?AH,7C4^0)EPZ'>$6?SSI!R?F
MI3]3TO.L>IX=CD\RY?9&D]L(!OIT@/7=#4-4LDKW8+',H`JT*$KQLP"3O$*3
M5+&-,*H/ZNQ!L#&2$,@WQX23)3PM%5D$HT3&WY$6M&NCAQ6)V*S*E&\8&/B'
M#%,0V;4=MG#Y`:+)+@9W%[E`5?H]K#A_XM0H%5VILQ%%2:LU/?$?!4J2CC<O
MZC:J_"MB2+PLUIENT0D=YE^>8'6KOE5H8;B^UANA)QL!A0OJ*P6=/D_WS24U
MR)@%1J_EV*`[7ZV95"G/H@1A&X?RZ,*(>]I3*8_N83XT3<QGPC54#2VWQ"-L
M*SQC<8/2Z&!N!R4;_AE"Y]NXT0NDTPA1XITZ2FV]:=MW(#=L[,D)E_9&WL:B
MJDQ;E);IS`74K&;_4TWL9`RHF]^5"A`E&:L?;FVG[3\=E'"Z]-@FQ.G0=[Z"
ME*B^,O#M,QG'2=\C?:<$!0D9((Q)JKOFXJR<[KIBY60NG..3$+9+MU!T#MW:
MC2R]?3A+ZBZ%__@SLQ%FP%2LAN8X*OF'GG"3*#4-XI!M%),5`KM.2%S?.ON,
MZ^6"=[H)QAQJA6ZAI3%9(=A5'2*CL*]+[,4G*LBT(["?[2/C+5K=\"'O$H-W
M6]>UE2!J!NAH9M->3N>#OF]GU697#:<I`HC\L*)O>VU+HE@A'5>DSK7;G.7I
MJ0NNA]&.)-V>N3/<8A#-+MH$5')GWY[/&AB`^XG:3/`WG5GNOKKS>ABJL5PP
M1@M41T%=.#SN7KMR],=-[O/TZ2XO.,O+>_2]N2/;7B([&2&H99"CSPVT]](]
MG`WLHVW<O/LS9+2'[3NX[#Z6K\SJ]=W.K>,(C'3S?#0LWBRV[YZ-A>H`F]]N
M2#P2::3QWC`X'CZUYWV^IWK:W]CZO'=UF[?CCBM5G4E78RP/6Z``2</N3ZNW
MK_?WWG72,Z+MPD@-(N_ZQ(F-#=OO4#K)#G&DFWEY1-W!(Z](2'*\U&[$*KP8
M?;__'>PY,-*Z=QDYSLW,OU-S\'&'#$X(\'[N/:FHW^"Z]^B^K3/P]MO*/=;D
MW;3Y?\!:S^\-R3V)<[ZAD^!W0[:'X84JQ^T_$8].KA+/@3WL>RVQ8,7[Q_QZ
M$I_\F:_YJ9"7=6M"CG/)3DY'/=,O:3<9V>X#!F>]@+O'XIA\!*S4>S<B.#'%
M3^;)KA%_IMS05`4"_\NBSC13\^[>G>"Z)ALQR-?P0QEHQ<Q6$=2[Z"[::/#-
M*[>[#]X@P!^V#@J5A@(Q&:^*KJ?0"'N^@!<M9F3^VRTM[BDT5"Y*"`:D%39C
M@:_?Q3GD'L6@(.N**J^P4/*?"3ZKR^_QXK`"CWEHWEOVWLQ;ZQ:'(CJQ!EW4
MG(_2.R68Y_8)HN8@M)D5\[#>7I-KU?=+LVM#Z7J+"A+X]4;(O+5:8=29:T@W
MU$@U<6'>V(C$;^TNO(-^]UI-"#F;"GFG\)GZ,'&38K&^Y:_-O"WPVB]09#BX
MC(J$//35<+;J-C#_R&O0^[Q";B5X\5UC(._1)O-!9#,_^QH-Q.B(IJBCY[,[
M=2##SSOU.Q>OS2]Y)AQ`[Y?!/F'B-V_7]KFL+8"1R9-<VCL6>+FST:AS.T]]
MEX9?$U!WQ;L5C#M"K\9&\740"P/W]?/CZ0FN@\=U-2Q!STK\X3[]$A^3T\U/
M?53F)M<'$/W'/"08#C<?MUPA6/14!,%6?R_R*B[J*%LCF042)_%-!9%.M!$-
M,:CT4OE*T84>BRY03`^2[<JX].<:P!0.5RWD6J('&.0ZE8"Z^.]<!.]<J!;&
M%2]8S@-N=O]Z1S^0;UU.NB;?;YKR;6[[`'O3'&4:<FZ%\.V1?8C."E)2PV:C
M`+IWZ/HY#DW2]V4!$/0>RP!UQW;475)XI^I[-P;/V63TLDD_:`OD&8(H08T(
ML<.\"1UDX]5/;;L2_6SQ<7:TX,?+/?#'#@T?RZ%*O3KA=H`^[YL1FV_OZ4:4
M!B'5-,9B)U9_W"-P[J,H\G+YNL?MU*[86S)>XEC/;1(-)#1,CM9?]X4#6Y]'
MB#J5^[MQ>O$=3,QIN2UJ6EUQ/.VXH_?^P5XO5S`CFC-K^>4T2EKWMU'>HA&"
M/7-VJVM`.>N$`$HP5=CO=U^5:G8^DMDTA$G3D=^0>$RL,-/]`4\A=5;9O181
M'AJ@'D2VKC&?Z`@L70^,TQ+7."'_'ZCW#&_E`-UK4L(JZ:L;M?;J5VQ_\N8(
MM'U@\;,WO_"\'0U5(S:,)>!M1O`=+$R!GU(V0.''%']1)^A-MSKQXZ_"UPJ#
M#M3SN%']G.VYH]0+R8:O:D?E%)ILJ]VS=W8/<#])I;?VJF/)2=SU7J%\_J0=
M\3%W%$;D+&@=.T!T?;M-W1F6#]*ZUG@]'YKC]?@*/23^>P7X6L2[A48`]AI9
M^AF!*FIQD/$4D>B(;3BN7M#XWBB-?@09C3N0?;7^'4S4#P*;3L%.'T\D9D_6
M+[AZ>'V<9?A:!',&#H:K47VVB%]U<?J?IN[(YI?LM9=7?EJH/PT9[F3G/_4&
M-H<6>QR02WI4Z]C[^'WZR4Z[1&Q_O;I.K!/SEE"N3Z9FD/R4/AHBT4<TN,'M
MX$?/5D)5/2D_E/HH"_%&X>D=OA7!#*FUQ*:M'XO1$IK^>6]$.N8`R*N?JWKH
M7._\=CF+]*\LGG_?9\&0ZZ:>7LC55#R!8228\!JV\![<'C&.NBJ>:C"U:9ZC
MK]5PY:`^%NB<#!-)#3!=,&\T>S'`C%EU0>!=M]_=TKMS*E`T%>OWE*@,CO&1
M^_#YF3BF(SCJOK;^J%#9S`46FMRCSAOI_8WZY/)IO*\_Y2.V^+[!_U%LM'\C
MH=_R(_DA_S;>Y.L5TCNLSR3&$\9KDN+PC]5=K[9=<5C\F6GU?`"+XVOTX_/1
M)YI!-SQBX*D1U+J@L>/'_+)E^U;NF'EDF/AN8KK\[\>V05,=$V-R3>?S3ON.
M`EM^FM\;@_A/?YS=))U[6!XTZ_:Z#F.N\@Y\_*.O@="(`=+B=U/U=%?4U]$?
MD3\H6.->Y>4'^M[(MNCV<Q]W.IM%$Z,_F#%H(C=,*640(O'X\?D01\F?\./?
MU?L#Z+E0G*$UA\'1V``H&PZRHE+]G_CF;_/GQ"J^6JX/C=/S(9#RCA0X_H=$
M;\*4C?^^<O>^E_&=JV#^^;/[S!)[IO+$^?A!%V?K+;`0]>'OO!M\%,6O'?H+
M_YK]^<.>^6H8R.1?=N^>[.GS+YUOLIY_];_8/WKE=>%2@8W\@XQ$8K@__*DG
MVD[R3Q(DWQL9^U/_X_]1L6Q5PJ`/VV:AR0`JR#+O*_W8D9[?7^6(0O8LL.:Y
MM^1YWA21FD(-WX4F0;GM,-I>J3V87RMDAU$`3'FY::9@X+Y?GQXM>&7QB@(-
MI#)_HC%JD[/,`ABT$/,YI]I]DRBOBC/-1-$&49/<CDP[9+_YE4:.4Y0HVW3E
M]OQFQ#\&@Y_";L>DD.X$O+!2K+-.S]LFYJ!YX;^I\?)]*,`6A*GN6;',Z].0
M$$HFD"<B4SG(&V3X(=CE`)&`8KR-D3V&HR>T^ERL_WB`;;UNBKG-A06Y^NI-
MW/I\0ZJ\A@=0K0>U>(%\`<55-KMY#R5F!OAY^.Q!I^9_H#W@GY'!1R0"D>LI
MA/(36[UM!]CJ1Z9J8`Q0G*!XYBY.2]/J]<<(1`.F*`(HM0A#AQRH"M<>87AX
MQR9$OQ&_1P50SQ?@P0`>`)MV`!^_DR*(TY,2J?2Q21"!E)QN&US*@L?Y`]&I
M4N:`4<!,!0X`4(1,0VR%ZYY<YA1EG2D0"\CV0TTXS$`403&#TYB-@W>5B..%
M?`!XNB<#H-(.G]>%</U1`!%_Y(C27H7+J[,)-+)=`(]@&4"MDP&MG''U,Z\`
M=T)@CSAEWN>H-[*&,`&BD[*`!JD[%S#P[$>U^`;.YJ9AMSSZGXZ@RJ<''/[=
MNFP//93.&S>OBT&X0UK$`W%;6C@\H+`/()A3>V6L`\.`X!1H2`2PE%?6"%]A
M`S^!6Z;&1UZD&RB18B6U`K=$!RU#C!KJS57<`BAD5'(`.!]1H&4&&K+RP\&E
M-^P.E"ZPS<UL&8B^>P'AEEA^N*F*GS_PA79[2B'T[#AWC<`C8$[0+"/`&28H
M!`5M[94^&2\!;-?R`8=E`Q=B*3YCGJPI$\:C:Z\0A;X>_ZQ;$"M0('C#VRJU
M.X)_QQZFH"NP%P</"3>`$"!]B*5=X$[0[K>.^,BM1B@1_9K%WXPE#B*;R\\%
MX5R!N#QT8"M+R>$3##R$_\YEWJT-#^/$H59!,@I"!%UH3KJ2TUM0YE?UVSM8
MDJ(ZC0[-S7?B*!@.7!E9?R0OBYBN6@6$#(02A!)PN=YET[\\H(+.7C(%$](Y
ME-@:L3A/1B4MRE7JZPA^Z2!T'0*BR%UP=R7/$`KNX.HV?D&6($)PW#84BPSB
M`7-\]J"[5:V",<@,)`O*]F`PMD$T(&X03Y'NH.BL!$V#J85J65J0Z6<6.^HA
M9'Q:CD"(G3U04#),L&ZL!O,5-J3PU=YO+*B68\I\_S`\G\&+H.8)<\7":.&E
MM@J#;CBPX$^+XN8*/$/LC8X)Q\&F7V^PHG,H08;AN)QES$'3!*3,8I?`$WGQ
M`O^#W,&ND[4J7P*MZ]&-[::">`,2U:;/+::IB@TB!UM\3(MD!_SO>7:[0@_N
M9+Y1=9=*$Y&)-]@2K`H.D6!2[Y^T&^E.+?>7:D&0(3XW03IZX&90.K@H"D`)
MN_XUW#NVQOTO="9LN*,\"Z0^',+9X-J(A6$&1,99N.Q6J1-=1!4P323T`Q!&
M!Q-7F4$4GH50/TA@2][IL')T#*&_8&,0+HCLPP$&!#5&Y0W+!]($\U'-4A$F
M`>M_7*,H6HS0:Y$EK&.T!0E^5ANYX!4P0!AHX1&:`W4B5I0*H&H'_=>#H?'I
M".6!!,'KF7B0-IA&4_557=)?`HX<H6+H/6@$A`O6\9QVVKG3F%CP2+@B#!/.
M/SR!6I$,G6[0A8:DDQ+.!W<W;D($82AD@^0XZG$1A4Q%@L+V&(7/=^`E1&@A
MISIS-3:[1*C0J$`H7`0J]#!8ER*+%K\OZW0#'!6J"5=%8L*"H-<BX,>QJA3*
M!@%4'<*AR9MP=(&A"Q:Z:4"%EL(.X2$*`&<10_P%^XR%7)!5(62A51BZDP=F
M'F@J;(%98;ZB5-@+;!3"8G*%'K]A1;^@?V*]Z=0\"WR%#T(L`J=0BV`>?#V(
MXQP)),"Z#;+P5RBXLQ6&"W]]P0=8%86'0N:TD!;N%WQ2@\%I6!A,U<9/RM"\
M^%1[C,*4D<](3VBPN#A@"^.`%"QTH7P06H@.*0]J]T(%:K-C8$,%Y?<.!!-Z
M"[^$=#>JX#A.*=8T@>"E@XQ\63PCX;0,8%@MM`6^U$`G1IZ#X>1-)Y@J6AC>
M"^$;`:A36H).8G@>G!)6BBR&X3G*W7:,8S,O3!=VW1:%/SUY7L2H?Y7E>)GX
M"[<,+,.*H"+KP/=TN+4@_&B%2<*J8#UP460S!.O)'*B&KQEWS^*I6P@RS!..
M#8&&L;:*FZ'`#G@(^=$A`/&$:T*RF;W0:Z@T+!31911A.K^9(94PV@7.&@P!
M^[`JPZL]WYY0,U@VS(:X#?\P=L*X2GG%*I0LO!/BRU@8U9'N%KYPWC$@:QRZ
MN$Z%X!EN(;Q/9)

41
textfiles.com/phreak/bugstaps.txt Normal file
View File

@@ -0,0 +1,41 @@
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% BUGS & %
% HOW TO TAP SOMEONES ROOM %
% %
% BY ---> *$> FIREBALL <$* %
% %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
HAVE YOU EVER HAD A STRONG DESIRE TO KNOW WHAT BOY YOUR OLDER SISTER
LIKES OR HOW YOUR PARENTS SEX LIFE IS GOING, WELL NOW YOU CAN KNOW ALL BY
BUGGING THERE ROOMS!
THE FIRST THING YOU CAN USE IS THE WIRELESS MICROPHONE FROM RADIO SHACK
$6.99. IT IS DESIGNED TO PUT VOICES ON TO AN FM RADIO BUT NO ONE SAYS YOU
CAN'T HIDE IT AND LET IT PICK UP UNSUSPECTING PEOPLE....FIRST TUNE THE
MICROPHONE WITH ANY BLANKSPOT ON YOUR FM RADIO (DON'T WORRY IT WILL EXPLAIN
HOW TO TUNE IT ON THE BACK OF THE PACKAGE.) ....THEN HIDE IT WHEN NO ONE IS
AROUND (WHEN HIDING THE MICROPHONE TALK INTO IT AS YOU'RE WALKING TO MAKE
SURE YOU HAVEN'T WALKED OUT OF IT'S RANGE.)
THERE ARE HOWEVER, 2 DISADVANTAGES TO USING ONE OF THESE MICROPHONES:
1) YOU CAN ONLY PUT IT IN A ROOM THAT IS RIGHT NEXT TO YOUR ROOM AND ONLY
ONE WALL CAN SEPERATE THEM.
2) THE MIKE IS 8 INCHES LONG AND THE ONLY DECENT HIDING PLACES FOR SOMETHING
THAT BIG IS UNDER A BED OR IN A CLOSET. (YOU MAY WANT TO TAKE IT APART TO
MAKE IT SMALLER BUT I DONT RECOMMEND DOING THIS.)
ANOTHER THING YOU CAN USE IS THE CLIP ON WIRELESS MIKE BY RADIO SHACK FOR
ABOUT $18. IT WORKS IN BASICLY THE SAME WAY EXCEPT IT IS VERY SMALL AND IT
WILL WORK THE DISTANCE OF YOUR HOUSE AND POSSIBLY EVEN YOUR NEIGHBORS HOUSE.
HAVE PHUN...I SURE DID!!
WRITTEN BY: #$> FIREBALL <$#
CALL THE GENERAL STORE AT:
201-666-2646 SYSOP:
THE STORE MANAGER.
CALL THE UNDERGROUND AT:
201-223-64 CALL THE BASEMENT:HEAD UNDERGROUND

71
textfiles.com/phreak/bumpbeep.hac Normal file
View File

@@ -0,0 +1,71 @@
MOBILE TRACKING EQUIPMENT or "Bumper Beepers".....by The Mad Phone-man
------------------------------------------------------------------------------
You remember the little "bug" installed on the bad guys car in the James Bond
flicks that allowed Bond to follow the car from a distance? Well this file is
a tutorial on them.
First, they do exist, I've built my own, but even the best commercial units
intended for law enforcement purposes wont do what the Bond model purports
to do, that is, give a printout on a moving map showing the route driven by
the bug toter.
The basics of the unit are the transmitter, which is about the size of
a pack of cigarettes and is held on via a magnet. And a receiver, using 2
identical antennas, coupled to a center zero meter which gives a heading
towards the transmitter. More on these later.
The receiver/display unit is used by pilots, amateur radio operators, and
law enforcement and security personnel to track the movements of the
transmitter
usually at short ranges, the civil air patrol uses these units to find
downed aircraft by tracking the emergency beacon, activated by the
impact of the crash. Amateurs play "hunt the fox" to keep illegal transmitters
out of the ham bands. Law enforcement personnel track the movement of people,
drugs, and weapons by attaching a transmitter to the object (or suspect's
car) to be followed.
The transmitter is usually a small VHF or UHF battery operated package
dangling a 19" flexible antenna (about the thickness of piano wire). The
transmitter does not "beep" per say, but transmits a continual carrier.
The FBI uses 167.xxx mhz for theirs and the local DA uses the intercounty
police freq of 155.37. I have seen military models that use 149.xxx mhz
around here (air force).
Now the receiver:
Two identical antennas mounted on the chase vehicle (usually magnetic mounts)
feed a pair of PIN diodes that feed a phase detector which samples the
receiver's IF output. When the received signal is directly in front of you,
signals arrive at exactly the same time at each antenna. This is calibrated to
read center 0 on the meter. (Incidentally the unit can't tell if the signal is
in front or in back of you, so the need to make sure you follow the subject
reasonably closely is apparent). If the bug travels say to 10 o'clock on the
compass rose, the needle will swing to 4 o'clock on the meter. The object here
is to always drive towards zero and you follow the bug in the most direct
direction. With a little practice,you can follow a subject on an adjcent
street without loosing him.
The meter swings because the signal arrives later at one antenna than the
other, causing a voltage change in the phase detector (an Exar Radio-teletype
decoder chip in my model).
Some recent units ive seen have Light emitting diodes in a 360 degree circle
and use 4 antennas. This gives you full circle detection capabilitys as the
phase between pairs of antennas is calculated also.
Now, prevention:
The easiest way to detect if you've been planted with one of these little
transmitters, is to walk around the car or whatever with a portable frequency
counter and check for an alien RF signal. This is also the recommended
method to de-bug your home. A small freq counter with 1.2 ghz capabilitys
sells for around $100. today. If you do find a transmitter, have fun with it.
Stick it on a train heading out of town, a Greyhound bus, or a over the road
tractor-trailer rig....my favorite is to stick it on one of their own
vehicles and watch them chase themselves....hehehe.
The Mad Phone-man (c) 1988

Downloaded From P-80 International Information Systems 304-744-2253

70
textfiles.com/phreak/bumpbeep.txt Normal file
View File

@@ -0,0 +1,70 @@
MOBILE TRACKING EQUIPMENT or "Bumper Beepers".....by The Mad Phone-man
------------------------------------------------------------------------------
You remember the little "bug" installed on the bad guys car in the James Bond
flicks that allowed Bond to follow the car from a distance? Well this file is
a tutorial on them.
First, they do exist, I've built my own, but even the best commercial units
intended for law enforcement purposes wont do what the Bond model purports
to do, that is, give a printout on a moving map showing the route driven by
the bug toter.
The basics of the unit are the transmitter, which is about the size of
a pack of cigarettes and is held on via a magnet. And a receiver, using 2
identical antennas, coupled to a center zero meter which gives a heading
towards the transmitter. More on these later.
The receiver/display unit is used by pilots, amateur radio operators, and
law enforcement and security personnel to track the movements of the
transmitter
usually at short ranges, the civil air patrol uses these units to find
downed aircraft by tracking the emergency beacon, activated by the
impact of the crash. Amateurs play "hunt the fox" to keep illegal transmitters
out of the ham bands. Law enforcement personnel track the movement of people,
drugs, and weapons by attaching a transmitter to the object (or suspect's
car) to be followed.
The transmitter is usually a small VHF or UHF battery operated package
dangling a 19" flexible antenna (about the thickness of piano wire). The
transmitter does not "beep" per say, but transmits a continual carrier.
The FBI uses 167.xxx mhz for theirs and the local DA uses the intercounty
police freq of 155.37. I have seen military models that use 149.xxx mhz
around here (air force).
Now the receiver:
Two identical antennas mounted on the chase vehicle (usually magnetic mounts)
feed a pair of PIN diodes that feed a phase detector which samples the
receiver's IF output. When the received signal is directly in front of you,
signals arrive at exactly the same time at each antenna. This is calibrated to
read center 0 on the meter. (Incidentally the unit can't tell if the signal is
in front or in back of you, so the need to make sure you follow the subject
reasonably closely is apparent). If the bug travels say to 10 o'clock on the
compass rose, the needle will swing to 4 o'clock on the meter. The object here
is to always drive towards zero and you follow the bug in the most direct
direction. With a little practice,you can follow a subject on an adjcent
street without loosing him.
The meter swings because the signal arrives later at one antenna than the
other, causing a voltage change in the phase detector (an Exar Radio-teletype
decoder chip in my model).
Some recent units ive seen have Light emitting diodes in a 360 degree circle
and use 4 antennas. This gives you full circle detection capabilitys as the
phase between pairs of antennas is calculated also.
Now, prevention:
The easiest way to detect if you've been planted with one of these little
transmitters, is to walk around the car or whatever with a portable frequency
counter and check for an alien RF signal. This is also the recommended
method to de-bug your home. A small freq counter with 1.2 ghz capabilitys
sells for around $100. today. If you do find a transmitter, have fun with it.
Stick it on a train heading out of town, a Greyhound bus, or a over the road
tractor-trailer rig....my favorite is to stick it on one of their own
vehicles and watch them chase themselves....hehehe.
The Mad Phone-man (c) 1988


137
textfiles.com/phreak/bust2.lod Normal file
View File

@@ -0,0 +1,137 @@
"Intense probe targets shadowy hackers group with local ties"
-----------------------------------------------------------
Sunday, April 15, 1990 / Austin American-Statesman
by Kyle Pope
A shadowy gang of computer hackers with ties to Austin has become the
target of a massive federal probe into the nation's high-tech underground.
Federal and local authorities involved in the inquiry seized evidence from
three Austin homes and a business in March. They say some action on the local
cases, possibly including indictments or arrests, is expected in the next
month.
The computer crime crackdown - the largest ever launched by the U.S.
government - has resulted in the temporary disbanding of the Legion of Doom, a
notorious national group of young computer hobbyists with at least two Austin
members.
State and federal investigators say the 6-year-old group, which once
boasted more than 150 members in nearly every U.S. state, has been connected
to a string of computer crimes in Texas, Georgia, Arizona, Illinois,
California and New Jersey.
Officials say group members have electronically stolen money and long-
distance telephone access numbers, changed credit reports, planted data-
destroying computer viruses in government networks, attempted to tamper with
hospital patient records, and distributed information that, if used, could
have debilitated the nation's 911 emergency response network.
So far, only four Legion of Doom members have been indicted for the
crimes, and none has gone to trial.
However, an investigation team coordinated by Assistant U.S. Attorney
William Cook in Chicago and including the secret Service, the U.S. Department
of Justice, the FBI and a handful of state attorney generals, has in the past
six months raided the homes and businesses of about a dozen suspected legion
members across the country.
In Austin, Secret Service agents, local police and officers from the
University of Texas Police Department seized computer equipment and documents
from three homes as part of the probe.
One local business, a role-playing game-publishing company called Steve
Jackson Games, also was raided in the March crackdown, but officials say the
firm is not a primary target of the hacker investigation. The firm is
believed to have been raided because investigators wanted to examine equipment
used by an employee.
The search warrants used in the raids remain sealed from public view, and
Secret Service and UTPD officials declined to comment on the case.
Law enforcement sources say one of the targets of the Austin investigation
is a juvenile who is not believed to be a member of the hacker group.
The two other Austinites under investigation are legion members,
authorities say, and have been linked to the 911 probe centered in Chicago.
According to law enforcement sources, the two men helped circulate
information about the 911 system's software through a national bulletin board
network that hackers could call by using a telephone, a computer and a modem.
In addition, details about ways to tamper with the emergency system were
published in Phrack, a legion newsletter.
While no one in Austin has been indicted or arrested, officials said they
expect some action on the local cases in the next month.
And state and federal authorities involved in the national investigation
say they are preparing dozens of additional indictments aimed at the entire
membership roster of the Legion of Doom.
"It doesn't matter whether you commit a burglary by telephone or by
breaking into a building," said Gail Thackeray, an assistant attorney general
in Arizona, one of a handful of state investigators working solely on computer
crime.
"Did they expect that the rest of us would sit by and let every idiot kid
in America break into our 911 system?" she said. "I do not respect the right
of hackers to learn what they want to learn at the expense of the rest of us."
Thackeray, who helped investigate a hacker's attempt to break into the
computer system at the Barrow Neurological Institute in Phoenix, said the
recent legion crackdown is a result of improved coordination among law
enforcement agencies with jurisdiction over computer crime. In addition, she
said, the effort has been boosted by a new breed of investigators with
computing expertise.
Because of the potential for widespread damage to both government and
business computer systems, officials say the hacker probe has caught the eye
of the Justice Department, which is pushing U.S. attorneys throughout the
country to beef up their computer crime-fighting capacity.
"There is a push on Capitol Hill to shore up our activity in this area,"
said an assistant U.S. attorney who asked not to be named. "I think this is
the beginning of a boom."
Said Thackeray: "There's more computer crime going on out there than any
one agency can handle. We're totally flooded."
For members of the Legion of Doom, the unwanted law enforcement attention
is nothing new.
Formed in 1984 and named for a gang that took on Superman and other heroes
in the television cartoon Superfriends, the group has survived two other waves
of criminal investigations.
The first, in 1985, resulted in the arrest and conviction of five of the
legion's founders for credit card fraud and theft by wire.
After a brief resurgence, group members again were arrested en masse in
1987, only to revive again in 1988.
But according to investigators familiar with the group, pressure form the
recent legion crackdown is the most intense to date. Several of the
investigators said the legion has shut down, at least for now.
A history of the group written by one of its founders and obtained by the
Austin American-Statesman seems to bear out investigators' suspicions.
The 10-page document recounts significant developments in the group's
history, from its founding in 1984 (an event "that would ultimately change the
face of the computer underground forever," the brochure states), to its
current, besieged status.
The pamphlet acknowledges that "there is no indication that points to a
resurgence in the future" and ends with the words "Legion of Doom (1984-
1990)."
The brochure also takes potshots at federal investigators and the media,
often accused by legion members of exaggerating their crimes and
sensationalizing the group.
"The Legion of Doom has been called everything from 'organized crime' to a
'communist threat to national security' to an 'international conspiracy of
computer terrorists bent on destroying the nation's 911 service,'" the
brochure states.
"Nothing comes closer to the actual truth than 'bored adolescents with too
much spare time.'"
Finally, the legion history includes an "alumni" list that contains the
code names of 38 current and former members.
According to the legion's own accounting, 14 of the 38 people on the list
have either been convicted of computer crimes or are under investigation.
Officials familiar with the group say the legion's characterization of
itself as a clique of bored whiz kids is inaccurate. Instead, they portray
group members as sophisticated and organized malcontents who do not accept
conventional concepts of respect and trust.
"These are not just wacky kids," Thackeray said. "They have absolute
contempt for the rest of us."
"They are constantly in a high-level skill kind of game, part of a thrill.
They've totally lost touch with reality."
William Murray, a systems security fellow for the Ernst & Young accounting
firm, said even though hackers take advantage of the tremendous power of
personal computers, they still view their crimes as an electronic game of cat
and mouse.
"This whole sense of excitement and joy is not tempered," Murray said.
"Nobody has told them that they have a responsibility for polite behavior."
Some states, including Arizona, are developing treatment programs for
hackers. Patterned after Alcoholics Anonymous and drug-treatment centers, the
programs are aimed at rehabilitating hackers who have grown dependent on their
craft.
"It is absolutely addictive behavior," Thackeray said. "When they get
their hands on tools as powerful as these computers, they lost all judgement."


92
textfiles.com/phreak/busts.txt Normal file
View File

@@ -0,0 +1,92 @@
info about recent phreaking busts
by pad (phreakers and distributors)
compiled and re-edited by acid house
------------------------------------------------------------------------------
before taking off, let me make something perfectly clear. this g-file
applies to all current and future phreakers. just for the so-called "elite"
hackers that you heard all the time. if you have phreaked between dec 1988
and this date, or are planning to start phreaking, this applies to you.
in addition, this file is not bullshit. we have consulted many phreakers
in different areas and they all knew what we said was true because of recent
incidents in their area. you may have heard about these busts before, but
its good to read this file just in case. we wrote this g-file on january 8,
1989, so all info is recent.
recently, two services have been very popular to phreak with. they
were both pitifully easy to hack, and they both had superb and quick
connections with boards across the usa. in addition, thousands of phreaker
used them--through modem and voice, and no one got caught. the two access
ports were 950-0266 and 950-1729. the 1729 service is known as "futuretech",
but the name of the 0266 still remains unknown to everyone, and is possibly
a trap set up to catch phreakers. up until december, 1988, they were safe
to phreak with and didn't even try to catch phreakers. however, starting
in december, a major attack was relased on phreakers nationwide, and it
is still going on as of this date.
both servies joined forces with all of the major phone companies in
december to, at first, find who called 950-0266 and 950-1729. from december
1st-december 31st, a trace was put on those two numbers and whoever called
those numbers was contacted by their phone company and they were asked why
they called those numbers. we are sure that many people reading this file
received such a call, as some of our members did. however, since this was
just the first stage of the tracing, and both futuretech and the 0266 company
did not have their tracing equipment in yet, they were not able to tell
what the callers of the access ports did once they were connected. in
short, giving any story to the phone company about why you called those ports
would do just fine, since they had no record about what anyone did once they
called into the port. all they had on record was the fact that people called.
however, once they found any phone number as one of those calling the access
ports 950-1729 or 0266, they put a tap on the offending lines and monitored
them carefully. however, there were still few busts because most people
who got such calls from their phone company about phreaking decided that
they would never phreak again.
but remember, this was just stage one. it got worse. on january 1st,
1989, the phone companies welcomed in the new year with new equipment. the
company that ran 0266 had the better equipment, and could tell where the
calls were originating, however the 1729 company was only able to tell which
numbers were called. futuretech (the 1729 company) took immediate action
on the 1st and contacted all of the people and boards who were called, and
asked for info on who called them at certain times, and if the people called
knew any hackers or phreakers. with that info, they could tell the phone
company to tap phone lines, and a few people ended up getting busted. there
is rumor of 1729 getting the full tracing equipment in by now, but we have
not verified it as of this date. overall, it is unsafe to phreak with 1729.
950-0266's company was much more harsh. on january 2nd, they found
all of the big-time abusers of their codes, along with a handful of the
"lesser" phreakers who only made a few calls, and took action. they sent
feds and police to search houses and confiscate entire computer systems, in
addition to throwing people in jail and pressing charges. this is still
going on. many phreakers have been severely busted for using 0266,
especially in california. this a warning: 0266 is very dangerous and any
use of these codes almost guarantees you being caught. this is not bullshit,
it is the truth. 0266 has a very sophisticated ani system (auto-number
identification system), and they bust everyone that they can get the police
to go after. if you have been using 0266, stop now! there is no point to
get your life ruined over a few stupid wares from out-of-state bbs's.
remember, they are busting all phreakers, not just the so-called "big-time"
ones. even people who make less then $10 worth of illegal calls have a good
chance of getting busted.
this still leaves the question about what is safe to use from a pay-phone.
do not use 1729 from a pay-phone. they will investigate the person you called
called, and can put a tap on your line if they find out about the pay-phone
phreaking. as far as 0266, they are more interested in hitting the
computer phreakers, so it is still relatively safe to use 0266 from a pay
phone, but don't press your luck. keep your phreaked-pay-phone calls to
a minimum and you will probably be safe.
your question now is probably, "but what can i do now?? what about
all those rad wares on that board in georgia i'm on??" well, yes, there
is still one way to phreak that is safe. pc pursuit. although several
rumors have gone around about pc pursuit being dangerous, we have contacts
and know for a fact that it is not. if you have pcp codes, don't give them
out like they are simple to get. the more people that have them, the faster
they die, and you will find that they are hard to get because there is no
way to get your computer to hack them. the only way to get a pcp code is
through connections, and if you have no connections, you should really
value your pcp codes. if any further developments come up with pcp or the
0266/1729's, another g-file will be written.
in a nutshell, lay off 0266 and 1729. you are almost guaranteed to be
busted, especially at this point in time. this file has been true. it is
not bullshit. and it may just save you from ruining your life.
-pirates and distributor

153
textfiles.com/phreak/busyline.txt Normal file
View File

@@ -0,0 +1,153 @@
BUSY LINE VERIFICATION
WRITTEN BY PHANTOM PHREAKER
This file describes how a TSPS operator does a BLV (Busy Line
Verification) and an EMER INT (Emergency Interrupt) upon a busy line that a
customer has requested to be 'broken' into. I have written this file to
hopefully clear up all the misconceptions about Busy Line Verification and
Emergency Interrupts.
BLV is 'Busy Line Verification'. That is, discovering if a line is
busy/not busy. BLV is the telco term, but it has been called Verification,
Autoverify, Emergency Interrupt, break into a line, REMOB, and others. BLV is
the result of a TSPS that uses a Stored Program Control System (SPCS) called
the Generic 9 program. Before the rise of TSPS in 1969, cordboard operators
did the verification process. The introduction of BLV via TSPS brought about
more operator security features. The Generic 9 SPCS and hardware was first
installed in Tucson, Daytona, and Columbus, Ohio, in 1979. By now virtually
every TSPS has the Generic 9 program.
A TSPS operator does the actual verification. If caller A was in the 815
Area code, and caller B was in the 314 Area code, A would dial 0 to reach a
TSPS in his area code, 815. Now, A, the customer, would tell the operator he
wished an emergency interrupt on B's number, 314+555+1000. The 815 TSPS op who
answered A's call cannot do the interrupt outside of her own area code, (her
service area), so she would call an Inward Operator for B's area code, 314,
with KP+314+TTC+121+ST, where the TTC is a Terminating Toll Center code that
is needed in some areas. Now a TSPS operator in the 314 area code would be
reached by the 815 TSPS, but a lamp on the particular operators console would
tell her she was being reached with an Inward routing. The 815 operator then
would say something along the lines of she needed an interrupt on
314+555+1000, and her customers name was J. Smith. Now, the 314 Inward (which
is really a TSPS) would dial B's number, in a normal Operator Direct Distance
Dialing (ODDD) fashion. If the line wasn't busy, then the 314 Inward would
report this to the 815 TSPS, who would then report to the customer (caller A)
that 314+555+1000 wasn't busy and he could call as normal. However if the
given number (in this case, 314+555+1000) was busy, then several things would
happen and the process of BLV and EMER INT would begin. The 314 Inward would
seize a Verification trunk (or BLV trunk) to the toll office that served the
local loop of the requested number (555+1000). Now another feature of TSPS
checks the line asked to be verified against a list of lines that can't be
verified, such as radio stations, police, etc. If the line number a customer
gives is on the list then the verification cannot be done, and the operator
tells the customer.
Now the TSPS operator would press her VFY (VeriFY) key on the TSPS
console, and the equipment would outpulse (onto the BLV trunk)
KP+0XX+PRE+SUFF+ST. The KP being Key Pulse, the 0XX being a 'screening code'
that protects against trunk mismatching, the PRE being the Prefix of the
requested number (555), the SUFF being the Suffix of the requested number
(1000), and the ST being STart, which tells the Verification trunk that no
more MF digits follow. The screening code is there to keep a normal Toll
Network (used in regular calls) trunk from accidentally connecting to a
Verification trunk. If this screening code wasn't present, and a trunk
mismatch did occur, someone calling a friend in the same area code might just
happen to be connected to his friends line, and find himself in the middle of
a conversation. But, the Verification trunk is waiting for an 0XX sequence,
and a normal call on a Toll Network trunk does not outpulse an 0XX first.
(Example: You live at 914+555+1000, and wish to call 914+666+0000. The routing
for your call would be KP+666+0000+ST. The BLV trunk cannot accept a 666 in
place of the proper 0XX routing, and thus would give the caller a re-order
tone.) Also, note that the outpulsing sequence onto a BLV trunk can't contain
an Area Code. This is the reason why if a customer requests an interrupt
outside of his own NPA, the TSPS operator must call an Inward for the area
code that can outpulse onto the proper trunk. If a TSPS in 815 tried to do an
interrupt on a trunk in 314, it would not work. This proves that there is a
BLV network for each NPA, and if you somehow gain access to a BLV trunk, you
could only use it for interrupts within the NPA that the trunk was located in.
BLV trunks 'hunt' to find the right trunks to the right Class 5 End Office
that serves the given local loop. The same outpulsing sequence is passed along
BLV trunks until the BLV trunk serving the Toll Office that serves the given
End Office is found.
There is usually one BLV trunk per 10,000 lines (exchange). So, if a Toll
Office served ten End Offices, that Toll Office would have 100,000 local loops
that it served, and have 10 BLV trunks running from TSPS to that Toll Office.
Now, the operator (in using the VFY key) can hear what is going on on the
line, (modem, voice, or a permanent signal, indicating a phone off-hook) and
take appropriate action. She can't hear what's taking place on the line
clearly, however. A speech scrambler circuit within the operator console
generates a scramble on the line while the operator is doing a VFY. The
scramble is there to keep operators from listening in on people, but it is not
enough to keep an op from being able to tell if a conversation, modem signal,
or a dial tone is present upon the line. If the operator hears a permanent
signal, she can only report back to the customer that either the phone is
off-hook, or there is a problem with the line, and she can't do anything about
it. In the case of caller A and B, the 314 Inward would tell the 815 TSPS, and
the 815 TSPS would tell the customer. If there is a conversation on line, the
operator presses a key marked EMER INT (EMERgency INTerrupt) on her console.
This causes the operator to be added into a three way port on the busy line.
The EMER INT key also deactivates the speech scrambling circuit and activates
an alerting tone that can be heard by the called customer. The alerting tone
that is played every 10 seconds tells the customer that an operator is on the
line. Some areas don't have the alerting tone, however. Now, the operator
would say 'Is this XXX-XXXX?' where XXX-XXXX would be the Prefix and Suffix of
the number that the original customer requesting the interrupt gave the
original TSPS. The customer would confirm the operator had the correct line.
Then the Op says 'You have a call waiting from (customers name). Will you
accept?'. This gives the customer the chance to say 'Yes' and let the calling
party be connected to him, while the previous party would be disconnected. If
the customer says 'No', then the operator tells the person who requested the
interrupt that the called customer would not accept. The operator can just
inform the busy party that someone needed to contact him or her, and have the
people hang up, and then notify the requesting customer that the line is free.
Or, the operator can connect the calling party and the interrupted party
without loss of connection.
The charges for this service (in my area at least) run 1.00 for asking the
operator to interrupt a phone call so you can get through. There is an .80
charge if you ask the operator to verify whether the phone you're trying to
reach is busy because of a service problem or because of a conversation. If
the line has no conversation on it, there will be no charge for the
verification.
When the customer who initiated the emergency interrupt gets his telephone
bill, the charges for the interrupt call will look similar to this:
12-1 530P INTERRUPT CL 314 555 1000 OD 1 1.00
The 12-1 is December first of the current year; 530P is the time the call
was made to the operator requesting an interrupt; INTERRUPT CL is what took
place, that is, an interrupt call; 314 555 1000 is the number requested; OD
stands for Operator Dialed; the 1 is the length of the call (in minutes); and
the 1.00 is the charge for the interrupt. The format may be different,
depending upon your area and telephone company.
One thing I forgot to mention about TSPS operators. In places where a
Remote Trunking Arrangement is being used, and even places where they aren't
in use, you may be connected to a TSPS operator in a totally different area
code. In such a case, the TSPS that you reach in a Foreign NPA will call up an
inward operator for your Home NPA, if the line you requested an EMER INT on
was in your HNPA. If the line you requested EMER INT on was in the same NPA of
the TSPS that you had reached, then no inward operator would be needed and the
answering operator could do the entire process.
Verification trunks seem to be only accessible by a TSPS/Inward operator.
However, there have been claims to people doing Emergency Interrupts with blue
boxes. I don't know how to accomplish an EMER INT without the assistance of an
operator, and I don't know if it can be done. If you really wish to
participate in a BLV/EMER INT, call up an Inward Operator and play the part of
a TSPS operator who needs an EMER INT upon a pre-designated busy line. Billing
is handled at the local TSPS so you will not have to supply a billing number
if you decide to do this.
If you find any errors in this file, please try to let me know about it,
and if you find out any other information that I haven't included, feel free
to comment.

64
textfiles.com/phreak/busyring.phk Normal file
View File

@@ -0,0 +1,64 @@
/----------------------------------------------------------------------------\
\ The Ring-Busy Device /
/ \
\ Written By M0rtaSkuld /
/ Dedicated to an old friend \
\ whom I owe this knowledge to: / /
/__________________________________________________The Emporer!______________\
^^^^^^^^^^^
Preface
-------
A ring-busy device is exactly what it states, when connected to a phone line
it will cause a busy signal anytime a call is made to that particular line.
The only thing odd that the calling party will recognize is one ring before
the busy signal is actually heard, but no worry because the first ring will
not be heard by the person with the device connected to their line. They can
still use their phone to make outgoing calls which is great because this way
they will not get suspicious. This little wonder is so easy to make all you
need is a 7 k resistor and an enemy. This is particularly useful for your
most hated local sysop. Hook this baby up and all of a sudden no one is
calling his board anymore, they must not like it anymore cuz it's just a
shitty little PD board revolving around Star Trek, oh well, I might as well
give up." Mission accomplished!!!!!!!!!!!!!! I use to get my 7 k resistors
at my local Radio HAck, but on a recent attempt I was told that they do not
carry them, but considering this Radio Hack was in phucking Hickville I was
not surprised. I'm sure they can be found at any Radio Hack in your local
metropolis, plus there are countless electronics catalogs that you will
definitely be able to get them at. So onward to this simple process.
The Construction
----------------
Like I said before all you need is a 7 k resistor and access to the small
box outside the victims house where the phone line line enters. The box is
usually (every one that I have seen) is black. Once this box is opened you
will see a number of terminals. If there is only one line coming into the
house then there is only red and green terminals if there are two lines than
there will also be a yellow and black terminal. Simply connect the 7 k
resistor to the red and green terminals.(between them) R-7-G. For two lines
the configuration goes Y-7-B. Got it? Your done. Go home and laugh your
ass off.
Disclaimer
----------
I hate this part, but here we go. This info is exactly that INFO. That is
what it is meant to be used as. Actually executing this plan is illegal,
but then again what isn't these daze. Later!!
P.S. Hey Emporer I hope you get to read this cuz you are responsible for
introducing me to this scene. I hope to see you back someday. Consider it,
as we've said so many times before "We could get in trouble, but hey, what
the phuck, it's worth it."
P.S.S Yo MEAT IS MURDER so change your phucking ways and remember the ALF
is watching. You CAN'T hide.
-:-M0rtaSkuld-:-
Downloaded From P-80 International Information Systems 304-744-2253

111
textfiles.com/phreak/busyver2.txt Normal file
View File

@@ -0,0 +1,111 @@
+============================================================================+
! !
! BUSY VERIFICATION CIRCUIT part ][ By: The Wizard of the World of Cryton!
! !
+============================================================================+
[1]: Busy Verification circuits allow an operator to bridge the path between
two connected ports, to verify that either or both are busy, and to speak to
parties using the monitored ports (3-way conference). These circuits are
considered to be service port circuits. One complete busy verification circuit
consists of two PWBA's: 814434-026 and 814434-046. This figure shows the
difference between a normal call connection and a busy verification connection
as well as showing the interconnection of circuits associated with a busy
verification call.
Normal Call Connection Versus Busy Verification Connection
----------------------------------------------------------
NORMAL CALL CONNECTION:
+----------+ +----------+ +-----------+
+------+ | | | | | TIMESLOT |
Phone<--->|PORT A|<------>|- - - - - |<--->|- - - - - |<--->|- - - + |
+------+ |PORT GROUP| |PORT GROUP| | ! |
-------+ |MUX/DEMUX | | CONTROL | | ! |
Phone<--->|PORT A|<------>|- - - - - |<--->|- - - - - |<--->|- - - + |
+------+ | | | | |INTERCHANGE|
+----------+ +----------+ +-----------+
BUSY VERIFICATION CONNECTION:
+----------+ +----------+ +-----------+
+------+ | | | | | TIMESLOT |
Phone<--->|PORT A|<------>|- - - - - |<--->|- - - - - |<--->|- - - + |
+------+ |PORT GROUP| |PORT GROUP| | ! |
-------+ |MUX/DEMUX | | CONTROL | | ! |
Phone<--->|PORT A|<------>|- - - - - |<--->|- - - - - |<--->|- + + |
+------+ | | | | | ! ! |
| | | | | ! ! |
BUSY +--------+ | | | | | ! ! |
VERIFI- | + - - -|<----->|- - - - - |<--->|- - - - - |<--->|- + ! |
CATION | * - - -|<----->|- - - - - |<--->|- - - - - |<--->|- - - + |
CURCUIT | + - - -|<----->|- - - - - |<--->|- - - - - |<--->|- + |
+--------+ | | | | | ! |
| | | | | ! |
TO/FROM +------+ | | | | | ! |
MONITOR<->|PORT C|<------>|- - - - - |<--->|- - - - - |<--->|- + |
ING OP. +------+ | | | | |INTERCHANGE|
+----------+ +----------+ +-----------+
[2]: The busy verification circuit consists of three operational amplifiers
and three sets of XMT OUT and RCV IN leads. See diagram...
Busy Verification Circuit, Block Diagram
----------------------------------------
Amplifier A
|\ +-----+
+------------>| \_____XMT_OUT_\| |
! +------->| / /| |
! ! |/ |CODEC|
! ! RCV IN | |
! ! +---------------------| |
! ! ! Amplifier B +-----+
! ! ! |\ +-----+
*------------->| \____XMT_OUT_\| |
| ! *---->| / /| |
! ! ! |/ |CODEC|
! ! ! RCV IN | |
! *-------------------------| |
! ! ! Amplifier C +-----+
! ! ! |\ +-----+
! ! +---->| \____XMT_OUT_\| |
! +-------->| / /| |
! |/ |CODEC|
! RCV IN | |
+------------------------------| |
+-----+
The inputs to each amplifier are the RCV IN signals from the two sets of leads
not associated with that amplifier. Each RCV IN signal is the output of one of
three CODEC's on PWBA 814434-026. The output of each amplifier is an XMT OUT
signal, which is the input to one of three CODEC's. With this arrangement, two
of the sets of busy verification circuit leads are switched into the two
conversation paths that provide two-way communication between the two ports to
be monitored. Signals on both paths then are fed into the amplifier associated
with the third set of leads. This third set of leads is switched to the port
that serves the monitoring operator. Thus, the XMT OUT lead from the third set
carries voice signals from both monitored ports for transfer to the operator.
The RCV IN lead of the third set carries the operators message to the parties
on both monitored ports.
[3]: Each of the operational amplifiers has unity gain. A coupling capacitor
and voltage divider on the RCV IN analog input provides the proper frequency
response and signal level for the amplifier inputs.
[4]: The busy verification circuit is an optional and nonredundant portion of
line and/or line and service group cells, using three port positions per cell.
A component failure on this circuit never affects service to more then three
ports and, therefore, is considered to be a minor failure. A component failure
can cause loss of busy verification monitoring and/or loss of voice
transmission through up to three ports.
Thats all for this time, stay tuned for Part 3!!! Phreak on dudes!
\
-===THE=WIZARD=]>>>)}
/
(*)- The *ELITE* Phreaker's Club -(*)

49
textfiles.com/phreak/busyveri.txt Normal file
View File

@@ -0,0 +1,49 @@
The *ELITE* Phreaker's Club presents:
BUSY VERIFICATION CONFERENCE CIRCUIT.
1. ONE BUSY VERIFICATION CONFERENCE CIRCUIT IS ALWAYS PROVIDED.THE CIRCUIT IS A
THREE-WAY CONFERENCE BRIDGE THAT ENABLES AN OPERERATOR TO VERIFY THE BUSY/IDLE
CONDITION OF A SUBSCRIBER LINE.UPON REQUEST OF A PARTY ATTEMPTING TO REACH A
SPECIFIED DIRECTORY NUMBER, THE OPERATOR DIALS THE CALLED LINE NUMBER TO
DETERMINE IF THE LINE IS IN USE,IF THE RECEIVER IS OFF THE HOOK,OR IF THE LINE
IS IN LOCKOUT DUE TO A FAULT CONDITION.THE OPERATOR THEN RETURNS TO THE PARTY
TRYING TO REACH THE DIRE CTORY NUMBER AND STATES THE CONDITION OF THE
LINE.LINES WITH DATA SECURITY CAN NOT BE ACCESSED FOR BUSY VERIFICATION WHEN
THE LINE IS IN USE.(REFER ALSO TO DATA SECURITY)
2. THREE PORTS ARE ASSIGNED TO EACH BUSY VERIFICATION CONFERENCE CIRCUIT.ONE
PORT IS FOR OPERATOR ACCESS AND TWO PORTS ARE USED TO SPLIT AN EXISTING CONNECT
ION.TO VERIFY THE BUSY/IDLE CONDITION OF A LINE,THE OPERATOR ESTABLISHED A CONE
CTION TO THE OPERATOR ACCESS PORT AND DIALS THE DIRECTORY NUMBER OF THE LINE TO
BE VERIFIED.IF THE LINE IS IN USE,THE EXISTING CONNECTION IS BROKEN AND
IMMEDIATLY RE-ESTABLISHED THROUGH THE OTHER TWO PORTS OF THE BUSY VERIFICATION
CIRCUIT WITHOUT INTERRUPTION TO THE ESTABLIS HED SPEECH PATH.THE BUSY
VERIFICATION CIRCUIT IS CONTROLLED BY ACCESS CODE. A DEDICATED TRUNK CAN BE
USED BUT IS NOT NECESSARY.
3. THE BUSY VREIFICATION CIRCUIT ALSO CAN BE USED FOR TEST VERIFY FROM THE WIRE
CHIEFS TEST PANEL.
B. ADDITIONAL BUSY VERIFICATION CONFERENCE CIRCUITS (002749)
O.K. THERE IT IS-RIGHT OUT OF AN ESS MANUAL WORD FOR WORD! (AND IM GETTING 25
LINEAR FEET OF ESS MANUALS!!! NOT COUNTING THE STACK RECEIVED SO FAR!
HAR-HAR-HAR
NUFF SAID-
BOOTLEG
THE *ELITE*
$25 PER YEAR
THE BOOTLEGGER MAGAZINE
3310 HOLLAND LOOP ROAD
CAVE JUNCTON,OREGON 97523
IF YOU LIKED THIS PHILE-SUBSCRIBE NOW FOR MORE OF THE SAME.
VOICE 503-592-4461
MODEM 503-592-2001
[>Downloaded from The World of Cryton<] [414] 462-8978 *ELITE* Phreaker's
Club]

642
textfiles.com/phreak/butler.1 Normal file
View File

@@ -0,0 +1,642 @@
*******************************************************************************
* *
* An Introduction to the Computer Underground *
* *
* Brought to you by, *
* *
* The Butler... *
* *
* 2/26/91 *
*******************************************************************************
Due to my own impatience waiting for other H/P magazines to be released I
decided to release this file in solo form. I am going to call it BUTLER#1
because there will be updates and additions to follow.
The Computer Underground consists of mainly two forms of media, printed
and electronic, both will be discussed in this file. I use the word underground
because the contents of this file are not the types of titles you would run
across at your local bookstore or newsstand. The kind of information that
makes up underground publications is mainly technical in nature, but,
definitley not limited to that. One can also find tidbits about off-the-wall
polical views, drugs, weapons, and other topics that are not normally in
the mainstream of our society.
The Computer Underground...
Com-put-er Un-der-ground \kem-`py<70>t-er\ \`en-der-`gra<72>nd\ (1970's)
A group organized in secrecy, hidden behind aliases, to promote the free
exchange of information regarding anything and everything including but
not limited to: Computers, Telephones, Radios, Chemicals, and ideas.
The CU is made up of men and women all over the globe and of all ages. Most
of those involved in the CU consider it a hobby, but, there are those that
are involved strictly for illegal purposes, i.e. Selling Pirated Software. I,
like most people involved enjoy the information that can be obtained through
all of the different avenues in the CU, i.e. Bulletin Boards, Underground
Periodicals, Network Digests, and General Discussions between members.
The most common way members communicate is through Bulletin Boards. If you are
reading this you know what a BBS is because this will not be released in
printed form. There are thousands of BBSes around the world run by people for
many reasons including: legitmate businesses, Software Technical Support, Hobby
related, Pirated Software, Message Centers, etc...Some of the more common ones
are RIPCO, Face-2-Face, Exec-PC, The Well, etc...
Currently there are many regular electronic magazines that are being published
and there have been many that have discontinued for one reason or another.
Some current ones include: PHRACK, NIA, PHANTASY, CUD, etc...Some discontinued
ones include: PIRATE, PHUN, NARC, etc...
There is a current debate about wether or not an electronic media has the same
constitutional rights as the printed one. That is for our congressmen to
decide, but, you could voice your opinion. I personally can't see the differ-
-ence. Now, don't get me wrong I do not support the publishing of Long-
distance codes or anything of that nature, but, I do support the exchange of
other information, i.e. how to unprotect a game, how to make a smoke bomb, etc...
There are also "Underground Publications" like TAP, 2600, Cybertech, etc.
These magazines are published in hard copy and deal with every considerable
topic regarding the CU. Most of these magazines publish completely legal
information that is obtained from public sources and is available to anyone
and everyone.
I doubt that any of the following sources of information would mind if you use
an alias to order any of their material, so I would reccommend that you do
just in case! You might even want to get yourself a private mail box for all
of this "underground" information. I would also advise you to use a money
order when purchasing anything also. They usually cost an extra 50 cents at the
post office. And don't worry about using money orders with these people because
I have personally made purchases from many of them without trouble.
The following information is provided to enable you to become more familiar
with the CU and unusual information in general. Have fun and try not to
get yourself in trouble.
Now for the meat of this Article!!!!
E L E C T R O N I C M A G A Z I N E S
PHRACK Predacessor to this magazine
Author: Knight Lightning & Taran King
Network Address:c483307@umcvmb.missouri.edu
Other Address:
BBS: None
Last Issue: Phrack #30
PHRACK CLASSIC This Magazine
Author: Doc Holiday, Crimson Death & Various Contributors
Network Address: pc@well.uucp or cdeath@stormking.com
Other Address:
BBS: None
Last Issue: Phrack Classic #32 11/90
LOD Legion Of Doom Technical Journals
Author: Eric Bloodaxe, Lex Luthor, Prime Suspect, Phase Jitter,
Professor Phalken, Skinny Puppy.
Network Address: None
Other Address:
BBS:
Last Issue: LOD Tech Journal #4 May 20, 1990
PHUN Phreakers/Hackers Underground Network
Author: Red Knight
Network Address: N/A
Other Address:
BBS:
Last Issue: P/HUN #5 05/07/90
ATI Acivist Times, Incorporated
Author: Ground Zero
Network Address: gzero@tronsbox.xei.com
Other Address: ATI P.O. Box 2501 Bloomfield, NJ 07003
BBS:
Last Issue: ATI #53 12/05/90
NIA Network Information Access
Author: Gardian Of Time Judge Dredd
Network Address: elisem@nuchat.sccsi.com
Other Address:
BBS:
Last Issue: NIA #69 01/15/91
PHANTASY
Author: The Mercenary
Network Address: None
Other Address: The I.I.R.G. 862 Farmington Ave, Suite-306,
Bristol, Ct 06010
BBS: Rune Stone 203-485-0088
Last Issue: Phantasy V1N4 1/20/91
PIRATE
Author: Various Authors
Network Address: N/A
Other Address:
BBS: N/A
Last Issue: V1 #5 April 1990
ANE Anarchy 'N' Explosives
Author: Varous Authors
Network Address: N/A
Other Addrerss:
BBS: N/A
Last Issue: #7 06/16/89
NARC Nuclear Phreakers/Hackers/Carders
Author: The Oxidizer
Network Address: N/A
Other Address:
BBS:
Last Issue: NARC #7 Fall 1989
SYNDICATE REPORTS
Author:The Sensi
Network Address:
Other Address:
BBS:
Last Issue:
This is not an attempt to list all of the known magazines but just some of the
more popular ones. If I left a particular one out that you feel should of been
included I apologize.
All of the above magazines can be found in the CUD archives and at many of the
Bulletin Board Sytems listed at the end of this file.
P R I N T E D M A G A Z I N E S
Author: Emmanuel Goldstein
Network Address: 2600@well.sf.ca.us
Other Address: 2600 Magazine, P.O. Box 752, Middle Island, NY 11953
2600 Magazine is published quarterly, 48 pages per issue.
Subscriptions are $18 U.S. for a year in the U.S. and Canada,
$30 overseas. Corporate subscriptions are $45 and $65 respectively.
Back issues are available for $25 per year, $30 per year overseas
and they go back to 1984.
Phone 516-751-2600
Fax 516-751-2608
TAP/YIPL Formerly YIPL "Youth International Party Line"
Now TAP "Technical Assistance Party"
TAP Magazine
P.O. Box 20264
Louisville, KY 40250
Most all issues will cost $1.00 for US Citizens and $2.00
for overseas. Terms are CASH, postal money order,
or regular money order with the payee left blank.
BBS: 502-499-8933
Cybertek Magazine
Published by OCL/Magnitude
P.O. Box 64
Brewster NY 10509
$2.50 for sample issue
$15 year for 6 issues
Mondo 2000 (Formerly Reality Hackers Magazine / High Frontiers)
P.O. Box 10171
Berkley, CA 94709-5171
Phone 415-845-9018
Fax 415-649-9630
$24 for five issues
Frank Zappa subscribes to Mondo 2000!!!
Fact Sheet Five
6 Arizona Ave
Rensselaer, NY 12144-4502
$3.50 for a sample issue.
$33 a year for 8 issues
Phone 518-479-3707
Fact Sheet Five reviews any independent news media, i.e. 2600, TAP,
Books, Music, Software, etc.
Full Disclosure by Glen Roberts
P.O. Box 903-C
Libertyville, Illinois 60048
Free sample issue
$18 for 12 issues
Deals with Privacy, electronic surveillance and related topics.
Anvil
P.O. Box 640383f
El Paso, TX 79904
Computer Security Digest
150 N. Main Street
Plymouth, MI 48170
Phone 313-459-8787
Fax 313-459-2720
$125 U.S. per year.
Overseas $155 U.S. per year.
HAC-TIC Dutch Hacking Magazine
Network Address: ropg@ooc.uva.nl
Other Address: Hack-Tic P.O. Box 22953 1100 DL Amsterdam
Phone: +31 20 6001480
Privacy Journal
P.O. Box 15300
Washington D.C. 20003
Phone 202-547-2865
Monitoring Times
140 Dog Branch Road
Brasstown, North Carolina 28902
B O O K S
Anarchist Cookbook???
Poor Man's James Bond by Kurt Saxon
Big Secrets by William Poundstone
Bigger Secrets by William Poundstone
How to get anything on anybody by Lee Lapin
Signal--Communication Tools for the Information Age A Whole Earth Catalog
(Highly Reccommended!!!)
Neuromancer by William Gibson
Out of The Inner Circle by Bill Laundreth
Hackers by Steven Levy
The Cooko's Egg by Clifford Stoll
The Shockwave Rider
Information for sale by John H. Everett
Hackers Handbook III by Hugo Cornwall
Datatheft by Hugo Cornwall
The International Handbook on Computer Crime by U. Sieber
Fighting Computer Crime by D. Parker
Foiling the System Breakers by J. Lobel
Privacy in America by D. Linowes
Spectacular Computer Crimes by Buck BloomBecker
Steal This Book by Abbie Hoffman
M I S C E L L A N E O U S C A T A L O G S
Loompanics LTD
P.O. Box 1197
Port Townsend, WA 98368
Paladin Press
????
Consumertronics
2011 Crescent DR.
P.O. Drawer 537
Alamogordo, NM 88310
Phone 505-434-0234
Fax 500-434-0234(Orders Only)
Consumertronics sells manuals on many different hacking/phreaking related
topics, i.e. "Voice Mail Box Hacking", "Computer Phreaking", etc.
Eden Press Privacy Catalog
11623 Slater "E"
P.O. Box 8410
Fountain Valley, CA 92728
Phone 1-800-338-8484 24hrs, 7 days a week.
Here is the opening paragraph from their catalog:
Welcome to the Privacy Catalog, Over 300 publications explore every aspect of
privacy in ways that are not only unique, but also provocative. Some books may
seem "controversial", but that results only from the fact that people can enjoy
many different views of the same subject. We endeavor to offer views that will
prove both helpful and thoughtful in the many areas where privacy may be a
concern.
Criminal Research Products
206-218 East Hector Street
Conshocken,PA 19428
Investigative equipment and electronic surveillance items.
Ross Engineering Associates
68 Vestry STreet
New York,NY 10013
Surveillance items
Edmund Scientific CO.
101 E. Gloucester Pike
Barrington, NJ 08007
Catalog of gadgets and devices including items which are useful to the
surveillance craft.
Diptronics
P.O. BOX 80
Lake Hiawatha, NJ 07034
Microwave TV Systems
Catalog costs $3
Garrison
P.O. BOX 128
Kew Gardens, NY 11415
Locksmithing tools and electronic security gadgets.
Catalog costs $2.
Bnf Enterprises
P.O. BOX 3357
Peabody, MA 01960
General electronics supplier.
Mouser Electronics
11433 Woodside avenue
Santee, CA 92071
Sells most electronic components parts and equipment.
Benchmark Knives
P.O. BOX 998
Gastonia, NC 28052
Call for a free catalog. (704-449-2222).
Excalibur Enterprises
P.O. BOX 266
Emmans, PA 18049
Night vision devices.
Catalog costs $5
DECO INDUSTRIES
BOX 607
Bedford Hills, NY 10157
Sells mimiture Electronic Kits
Matthews Cutlery
38450-A N. Druid Hills RD.
Decatur, GA 30033
Their catalog contains over 1000 knives and costs $1.50.
U.S. Cavalry Store
1375 N. Wilson Road
Radcliff, KY 40160
Military & paramilitary clothing & gear.
Catalog costs $3.
The Intelligence Group
1324 West Waters Avenue
Lighthouse Point, FL 33064
Sells video equipment used for investigative purposes.
Columbia Pacific University
1415 Third Street
San Rafael, CA 94901
Bachelors, Masters, and Doctorate degrees
Video & Satellite Marketeer
P.O. BOX 21026
Columbus, OH 43221
Newsletter containing video, vcr, satellite dishes, etc.
Santa Fe Distributors
14400 W. 97'TH Terrace
Lenexa, KS 66215
Radar detectors and microwave tv systems.
(913-492-8288)
Alumni Arts
BOX 553
Grant's Pass, OR 97526
Reproductions of college diplomas.
Catalog costs $3
Merrell Scientific CO.
1665 Buffalo Road
Rochester, NY 14624
Chemical suppliers
Catalog costs $3.
K Products
P.O. BOX 27507
San Antonio, TX 78227
I.D. Documents.
Catalog costs $1.
City News Service
P.O. BOX 86
Willow Springs, MO 65793
Press I.D. cards.
Catalog costs $3.
Matthews Police Supply CO.
P.O. BOX 1754
Matthews, NC 28105
Brass knuckles etc.
Taylor
P.O. BOX 15391
W. Palm Beach, FL 33416
Drivers license, student I.D. cards, etc.
Capri Electronics
ROUTE 1
Canon, GA 30250
Scanner accessories
Liberty Industries
BOX 279 RD 4
Quakertown, PA 18951
Pyrotechnic components
Catalog costs $1
DE VOE
P.O. BOX 32
BERLIN PA 15530
Sells information on making electronic detonators.
Scanner World USA
10 New Scotland Avenue
Albany, NY 12208
Cheap scanner receivers.
H & W
P.O. BOX 4
Whitehall, PA 18052
Human Skulls, arms, legs, etc.
A complete list is available for $1 and Self Addressed Stamped Envelope.
Abbie-Yo Yo Inc.
P.O. Box 15
Worcester MA 01613
This is an old address that I could not verify but, they used to sell the book
"Steal This Book".
For most of these catalogs you could probably play dumb and just send them a
letter asking for a catalog or brochure without paying a cent. Pretending not
to know that their catalogs cost anything.
M I S C E L L A N E O U S R E P O R T S & P A P E R S
Crime & Puzzelment by John Barlow
The Baudy World of the Byte Bandit A Postmodernist Interpretation of the
Computer Underground by Gordon Meyer & Jim Thomas
Concerning Hackers Who Break into Computer Systems by Dorothy E. Denning
The Social Organization of the Computer Underground by Gordon R. Meyer
Computer Security "Virus Highlights Need for Improved Internet Management"
By the United States General Accounting Office.
GAO/IMTEC-89-57
Call 202-275-6241 for up to 5 free copies.
N E T W O R K D I G E S T S
Telecom Digest
Moderator: Pat Townsen
Network Address: telecom@eecs.nwu.edu
Risks Digest
Moderator: Peter G. Neumann
Network Address: Risks@csl.sri.com
Virus-l Digest
Moderator: Kenneth R. Van Wyk
Network Address: krvw@cert.sei.cmu.edu
Telecom Privacy Digest
Moderator: Dennis G. Rears
Network Address: telecom-priv@pica.army.mil
EFF News Electronic Frontier Foundation
Network Address: effnews@eff.org
Other Address: 155 Second Street Cambridge, MA 02141
Phone: 617-864-0665
Computer Underground Digest
Moderators: Jim Thomas & Gordon Meyer
Network Address: tk0jut2@niu
F T P S I T E S C O N T A I N I N G C U M A T E R I A L
192.55.239.132
128.95.136.2
128.237.253.5
130.160.20.80
130.18.64.2
128.214.5.6 "MARS Bulletin Board" Login "bbs"
128.82.8.1
128.32.152.11
128.135.12.60
All of the above accept anonymous logins!
B U L L E T I N B O A R D S
Ripco 312-528-5020
Face-2-Face 713-242-6853
Rune Stone 203-485-0088 Home of NIA
The Works 617-861-8976
The Well 415-332-6106
Blitzkrieg 502-499-8933 Home of TAP
Uncensored 914-761-6877
Manta Lair 206-454-0075 Home of Cybertek
I N D I V I D U A L N E T W O R K A D D R E S S E S
Aristotle Former Editor of TAP Magazine
uk05744@ukpr.uky.edu or uk05744@ukpr.bitnet
Dorthy Denning Author of "Concerning Hackers Who Break into
Computer Systems"
denning@src.dec.com
Clifford Stoll Author of "Cukoos Egg"
cliff@cfa.harvard.edu
Craig Neidorf Former Editor of Phrack Magazine
c483307@umcvmb.missouri.edu
Ground Zero Editor of ATI Inc.
gzero@tronsbox.xei.com
M I S C S O F T W A R E
SPAudit Self-Audit-Kit
1101 Connecticut Avenue
Northwest Suiet 901
Washington DC 20036
Phone 202-452-1600
Fax 202-223-8756
Free!!!
I would like to thank everyone for giving me permission to use their information
in this file.
The information provided here is for informational purposes only. What you
choose to do with it is your responsibility and no one elses. That means not
me, and not the BBS you downloaded this from!
To my knowledge this is the most comprehensive and upto date list of underground
books, catalogs, magazines, electronic newsletters, and network addresses
available. If there are any additions or corrections to this list please
contact me via the Ripco BBS.
The Butler...

153
textfiles.com/phreak/bxblack.txt Normal file
View File

@@ -0,0 +1,153 @@
***************************************
* *
* HOW TO BUILD A BLACK BOX *
* *
***************************************
TO ALL WHO DARE --
WHAT IS A BLACK BOX? A BLACK BOX
IS A DEVICE THAT IS HOOKED UP TO YOUR
FONE THAT FIXES YOUR cONE SO THAT WHEN
YOU GET A CALL, THE CALLER DOESN'T GET
CHARGED FOR THE CALL. THIS IS GOOD FOR
CALLS UP TO 1/2 HOUR, AFTER 1/2 HOUR
THE FONE CO. GETS SUSPICIOUS, AND THEN
YOU CAN GUESS WHAT HAPPENS.
THE WAY IT WORKS:
WHAT THIS LITTLE BEAUTY DOES IS
KEEP THE LINE VOLTAGE FROM DROPPING TO
10V WHEN YOU ANSWER YOUR FONE. THE
LINE IS INSTED KEPT AT 36V AND IT WILL
MAKE THE FONE THINK THAT IT IS STILL
RINGING WHILE YOUR TALKING. THE REASON
FOR THE 1/2 HOUR TIME LIMIT IS THAT THE
FONE CO. THINKS THAT SOMETHING IS WRONG
AFTER 1/2 AN HOUR OF RINGING.
ALL PARTS ARE AVAILABLE RADIO
SHACK. USING THE LEAST POSSIBLE PARTS
AND ARANGEMENT, THE COST IS $0.98 !!!!
AND THAT IS PARTS FOR TWO OF THEM!
TALK ABOUT A DEAL! IF YOU WANT TO
SPLURGE THEN YOU CAN GET A SMALL PC
BOARD, AND A SWITCH. THERE ARE TWO
SCHEMATICS FOR THIS BOX, ONE IS FOR
MOST NORMAL FONES. THE SECOND ONE IS
FOR FONES THAT DON'T WORK WITH THE
FIRST. IT WAS MADE FOR USE WITH A BELL
TRIMLINE TOUCH TONE FONE.
** SCHEMATIC 1 FOR MOST FONES **
** LED ON: BOX ON **
FROM >--------------------GREEN-> TO
LINE >--! 1.8K LED !---RED--> FONE
!--/\/\/\--!>--!
! !
------>/<-------
SPST
PARTS: 1 1.8K 1/2 WATT RESISTOR
1 1.5V LED
1 SPST SWITCH
YOU MAY JUST HAVE TWO WIRES WHICH YOU
CONNECT TOGETHER FOR THE SWITCH.
** SCHEMATIC 2 FOR ALL FONES **
** LED ON: BOX OFF **
FROM >---------------GREEN-> TO
LINE >------- ---RED--> FONE
! LED !
-->/<--!>--
! !
---/\/\/---
1.8K
PARTS: 1 1.8K 1/2 WATT RESISTOR
1 1.5V LED
1 DPST SWITCH
HERE IS THE PC BOARD LAYOUT THAT I
RECOMMEND USING. IT IS NEAT AND IS
VERY EASY TO HOOK UP.
SCHEMATIC #1 SCHEMATIC #2
************** ****************
* * * ------- *
* --<LED>--- * * ! ! *
* ! ! * * ! <SWITCH> *
* RESISTOR ! * * ! ! ! *
* ! ! * * ! ! / *
* -------- ! * * ! ! \ *
* ! ! * * ! <LED>! / *
* --SWITCH-- * * ! ! \ *
* ! ! * * ! ! / *
L * ! ! * F L * ! ! ! * F
I>RED- -RED>O I>RED- ---RED>O
N>-----GREEN---->N N>-----GREEN------>N
E * H * E E * * E
************** ****************
ONCE YOU HAVE HOOKED UP ALL THE
PARTS, YOU MUST FIGURE OUT WHAT SET OF
WIRES GO TO THE LINE AND WHICH GO TO
THE FONE. THIS IS BECAUSE OF THE FACT
THAT LED'S MUST BE PUT IN, IN A CERTAIN
DIRECTION. DEPENDING ON WHICH WAY YOU
PUT THE LED IS WHAT CONTROLS WHAT WIRES
ARE FOR THE LINE & FONE.
HOW TO FIND OUT:
HOOK UP THE BOX IN ONE DIRECTION
USING ONE SET OF WIRES FOR LINE AND THE
OTHER FOR FONE.
*NOTE* FOR MODEL I SWITCH SHOULD BE OF
F.
*NOTE* FOR MODEL ][ SWITCH SHOULD BE
SET TO SIDE CONNECTING THE LED.
ONCE YOU HAVE HOOKED IT UP, THEN
PICK UP THE FONE AND SEE IF THE LED IS
ON. IF IT IS, THE LED WILL BE LIT. IF
IS DOESN'T LIGHT THEN SWITCH THE WIRES
AND TRY AGAIN. ONCE YOU KNOW WHICH ARE
WHICH THEN LABEL THEM. *NOTE* - IF
NEITHER DIRECTIONS WORKED THEN YOUR
SWITCH WAS IN THE WRONG POSITION. NOW
LABLE THE SWITCH IN ITS CURRENT
POSITION AS BOX ON.
HOW TO USE IT:
THE PURPOSE OF THIS BOX IS NOT TO
POEPLE WHO CALL YOU SO IT WOULD MAKE
SENCE THAT IT CAN ONLY BE USED TO
RECEIVE! CALLS. WHEN THE BOX IS *ON*
THEN YOU MAY ONLY RECIEVE CALLS. YOUR
FONE WILL RING LIKE NORMAL AND THE LED
ON THE BOX WILL FLASH. IF YOU ANSWER
THE FONE NOW, THEN THE LED WILL
LIGHT AND THE CALLER WILL NOT BE CHARGE
D.
HANG UP THE FONE AFTER YOU ARE DONE
TALKING LIKE NORMAL. YOU WILL NOT BE
ABLE TO GET A DIAL-TONE OR CALL WHEN
THE BOX IS ON, SO TURN THE BOX *OFF*
FOR NORMAL CALLS. I DON'T RECOMMEND
THAT YOU LEAVE IT ON ALL THE TIME, AS
YOU DON'T WANT IT TO ANSWER WHEN MA
BELL CALLS!


63
textfiles.com/phreak/bxbrown.txt Normal file
View File

@@ -0,0 +1,63 @@
/-/-/-/-/-/-\-\-\-\-\-\
<:-\-Brown Box Plans-/-:>
\-\-\-\-\-\-/-/-/-/-/-/
(>Introduction<)
This is a fairly simple modification that can be made to any phone. All it
does is allow you to take any 2 lines in your house and create a party
line. So far I have not heard of Any problems with it from my friends that
have set one up and I have not had any either. There is one thing that you
will notice when you are one of the two people who is called by a person
with this box. The other person0will sount a little bit faint. I could
overcome this with some amplifiers but then there wouldn't be very many of
these boxes made.
I think that the convenience of having two people on line at any one time
will make up for the minor volume loss.
(>Phone Modification Instructions<)
Here is the diagram:
KEY:___________________________________
! PART ! SYMBOL !
-----------------------------------
!BLACK WIRE ! * !
!YELLOW WIRE ! = !
!RED WIRE ! + !
!GREEN WIRE ! - !
!SPDT SWITCH ! _/_ !
! _/_ !
!VERTICAL WIRE ! | !
!HORIZONTAL WIRE ! _ !
-----------------------------------
* = - +
* = - +
* = - +
* = - +
* = - +
* ==_/_- +
*******_/_++++++
| |
| |
| |
|_____PHONE____|
---------------------------------------
In some houses the black and yellow are already wired in others you will
have to go out to your box and rewire it. A good way to figure out which
line is which is to take the phone you are looking for off the hook. Then
you only need to take the red and green wires entering your phone and hook
them to the different pairs of red and green going into the house. You
can't hurt anything in the phone or telephone by probeing. When you find
the pair that you want take the black from your line and attach it to the
red of the other line then take the yellow and attach it to the green
line. Now you are all set to go. For people with rotary phones you can
have one person call you then place the second call out to the other
person. Though not a phreakers tool, the brown box can be phun.


81
textfiles.com/phreak/bxgold.txt Normal file
View File

@@ -0,0 +1,81 @@
GOLD BOX PLANS: COURTESY OF SIR WILLIAM
HOW TO BUILD IT
_______________
YOU WILL NEED THE FOLLOWING:
TWO 10K OHM AND THREE 1.4K OHM RESISTORES, TWO 2N3904 TRANSISTORS, TWO
PHOTOCELLS, TWO RED LED'S (THE MORE LIGHT PRODUCED THE BETTER), A BOX THAT
WILL NOT LET LIGHT IN, AND RED AND GREEN WIRE.
LIGHT FROM THE #1 LED MUST SHING DIRECTLY ON THE PHOTOCELL #1. THE GOLD
BOX I MAID NEEDED THE TOP OF THE LED'S TO TOUCH THE PHOTOCELL FOR IT TO
WORK. THE SAME APPLIES TO THE #2 PHOTOCELL AND LED.
1
:-PHOTOCELL--:
: :
: :BASE
: 1 TTTTT
: +LED- TRANSISTOR
: TTTTT
: : :
: -I(-- : :COLLECTOR
RED1--< >:--: :-------:-----GREEN2
-I(-- : ----------:
: :
2 :-/+/+/-/+/+/-/+/+/-/+/+/
LED 10K 10K 1.4K 1.4K
RESISTORES
2
-PHOTOCELL-----------------
: :
:BASE :
TTTTT :
TRANSISTOR :
TTTTT :
: :EMITTER :
GREEN1- --------------------------RED2
: :
/+/+/
1.4K
THE 1.4K RESISTOR IS VERIABLE AND IF THE SECCOND PART OF THE GOLD BOX IS
SKIPPED IT WILL STILL WORK BUT WHEN SOMEONE PICKS THE PHONE UP THEY WILL
HEAR A FAINT DIAL TONE IN THE BACKGROUND AND MIGHT REPORT IT TO THE
GESTOPO ER...(AT&T). 1.4K WILL GIVE YOU GOOD RECEPTION WITH LITTLE RISK OF
A GESTOPO AGENT AT YOUR DOOR.
NOW THAT YOU HAVE BUILT IT TAKE TWO GREEN WIRES OF THE SAME LENTH STRIP
THE ENDS, TWIST TWO ENDS TOGETHER AND CONNECT THEM TO GREENND PLACE A
PEICE OF TAPE ON IT WITH LINE #1 WRITING ON IT. CONTINUE THE PROCESS WITH
RED1 ONLY US E RED WIRE. REPEAT WITH RED2 AND GREEN2 BUT CHANGE TO LINE #2.
HOW TO INSTALL
______________
YOU WILL NEED TO FIND TWO PHONE LINES THAT ARE CLOSE TOGETHER. LABEL ONE
OF THE PHONES LINES LINE #1. CUT THE PHONE LINES AND TAKE THE OUTER COATING
OFF IT. THERE SHOULD BE 4 WIRES. CUT THE YELLOW AND BLACK WIRES OFF AND
STRIP THE RED AND GREEN WIRES FOR BOTH LINES.
LINE #1 SHOULD BE IN TWO PEICES TAKE THE GREEN WIRE OF ONE END AND CONNECT
IT TO THE ONE OF THE GREEN WIRES ON THE GOLD BOX. TAKE THE OTHER HALF OF
LINE # 1 AND HOOK THE FREE GREEN WIRE TO THE GREEN WIRE ON THE PHONE LINE.
REPEAT THE PROCESS WITH RED1 AND THE OTHER LINE.
ALL YOU NEED TO DO NOW IS TO RIGHT DOWN THE PHONE NUMBERS OF THE PLACE YOU
HOOKED IT UP AT AND GO HOME AND CALL IT. YOU SHOULD GET A DIAL TONE!!! IF
NOT LEAVE ME A MESSAGE ON THE MODEM MADNESS BBS xxx-xxx-xxxx OR TRY
CHANGING THE EMITTER WITH COLLECTOR. OH, AND HOOKING IT UP TO A PAYPHONE
IS A FEDERAL OFFENCE AND IT IS ILLEAGAL TO PUT ON ANY PHONE. I RECOMMEND
YOU SEE YOUR LOCAL POLICE DEPARTMENT BEFORE DOING ANYTHING SAID IN THIS
ARTICLE. (HAHAHAHA!!!!!!)


132
textfiles.com/phreak/ca.txt Normal file
View File

@@ -0,0 +1,132 @@
American & Canadian Prefixes
AC State Cities
--- ---------------------------------------------------------------------------
201 New Jersey Jersey City,Newark
202 D.C.Washington
203 Connecticut
204 Manitoba
205 Alabama
206 Washington Seattle, Tacoma
207 Maine
208 Idaho
209 California Fresno, Modesto
212 New York Bronx, Manhattan
213 California Los Angeles
214 Texas Dallas
215 Pennsylvania Allentown, Philadelphia, Reading
216 Ohio Akron, Canton, Cleveland, Youngstown
217 Illinois Champaign-Urbana, Springfield
218 Minnesota Duluth
219 Indiana Gary, South Bend
301 Marlyland
302 Delaware
303 Colorado Boulder, Denver, Durango, Ft. Collins, Grand Junction
304 West Virginia
305 Florida Broward County, Dade County, Key West, Miami, Monroe County
306 Saskatchewan
307 Wyoming
308 Nebraska North Platte, Scottsbluf
309 Illinois Peoria
312 Illinois Chicago
313 Michigan Ann Arbor, Detroit, Flint
314 Missouri Columbia, Jefferson City, St. Louis
315 New York Syracuse, Utica
316 Kansas Dodge City, Wichita
317 Indiana Indianapolis, Kokomo
318 Louisiana Lake Charles, Shreveport
319 Iowa Davenport, Dubuque
401 Rhode Island
402 Nebraska Lincoln, Omaha
403 Alberta
404 Georgia Atlanta
405 Oklahoma Enid, Oklahoma City
406 Montana
407 Florida Brevard, Indian River, Orange County, Orlando, Osceola, Palm Beach,
Seminole County, St. Lucie
408 California Monterey, San Jose
409 Texas Galveston
412 Pennsylvania Pittsburgh
413 Massachusates Pittsfield, Springfield
414 Wisconsin Green Bay, Milwaukee
415 California Oakland, San Francisco
416 Ontario Toronto
417 Missouri Springfield
418 Quebec Quebec City
419 Ohio Toledo
502 Kentucky Frankfort, Louisville, Paducah
503 Oregon
504 Louisiana Baton Rouge, New Orleans
505 New Mexico
506 New Brunswick
507 Minnesota Rochester
508 Massachusates Brockton, Lawrence, Lowell, Worchester
509 Washington Spokane, Walla Walla, Yakima
512 Texas Austin, Brownsville, Corpus Cristi, San Antonio
513 Ohio Cincinnati, Dayton
514 Quebec Montreal
515 Iowa Des Moines
516 New York Long Island
517 Michigan Bay City, Lansing
518 New York Albany, Schenectady, Troy
519 Ontario London
601 Mississippi
602 Arizona
603 New Hampshire
604 British Columbia
605 South Dakota
606 Kentucky Ashland, Winchester
607 New York Binghamtom, Elmira
608 Wisconson Madison
609 New Jersey Atlantic City, Camden, Trenton
612 Minnesota Minneapolis, St. Paul
613 Ontario Ottawa
614 Ohio Columbus
615 Tennessee Chattanooga, Knoxville, Nashville
616 Michigan Battle Creek, Grand Rapids, Kalamazoo
617 Massachusates Boston, Cambridge, Quincy, Waltham
618 Illinois Cairo
619 California El Centro, Palma Springs, San Diego
701 North Dakota
702 Nevada
703 Virginia Alexandria, Arlington, Roanoke
705 Ontario North Bay, Sault Ste. Marie
707 California Eureka
709 Newfoundland
712 Iowa Sioux City
713 Texas Houston
714 California Anaheim, River Side
715 Wisconsin Eau Claire, Wausau
716 New York Buffalo, Niagara Falls, Rochester
717 Pennsylvania Harrisburg, Scranton, Wilkes-Barre
718 New York Brooklyn, Queens, Straten Island
719 Colorado Alamosa, Colorado Springs, Leadville, Pueblo
801 Utah
802 Vermont
803 South Carolina
804 Texas Charlottesville, Norfolk, Richmond
805 California Bakersfield, Santa Barbara
806 Texas Amarillo, Lubbock
807 Ontario Thunder Bay
808 Hawaii
809 Virgin Islands/Puerto Rico
812 Indiana Evansville
813 Florida Ft. Myers, St. Petersburg, Tampa
814 Pennsylvania Altoona, Erie
815 Illinois La Salle, Rockford
816 Missouri Kansas City
817 Texas Fort Worth, Waco
818 California Pasadena
901 Tennessee Memphis
902 Nova Scotia/Prince Edward Island
904 Florida Jacksonville, Pensacola, Talahassee
906 Michigan Sault Ste. Marie
907 Alaska
912 Georgia Savannah
913 Kansas Lawrence, Topeka
914 New York Peekskill, Poughkeepsie, White Plains, Yonkers
915 Texas Abilene, El Paso
916 California Sacremento
918 Oklahoma Tulsa
919 North Carolina Greensboro, Raleigh, Winston-Salem

1401
textfiles.com/phreak/cable.phk Normal file
View File

File diff suppressed because it is too large Load Diff

50
textfiles.com/phreak/call-wai Normal file
View File

@@ -0,0 +1,50 @@
Date: 25 Dec 87 01:41:01 GMT
From: portal!cup.portal.com!Patrick_A_Townson@uunet.uu.net
Organization: The Portal System (TM)
Subject: Re: Sophisticated modems and Call Waiting
Dave Levenson questions having two lines in the same hunt group when one is
used for modeming --
My modems will auto answer, but generally I don't use that feature, and I
usually leave it turned off via software. My configuration, which I think is
ideal, works like this --
We only give out one number to persons calling. This number is mainly for
voice. The second number is mainly for my outbound modem calls, and I never
give the number to anyone except a person I am expecting to receive a modem
call from.
Both lines have call waiting, and the ability to suspend same (*70). When a
call is in progress on line one and a second call arrives, call waiting will
notify us. The second call can be brought in, and under Starline, switched
to the second line by /flash/#2/announce/flash. I get the call on the second
line, my roomate goes back to the call already in progress on line one.
If we wish, implementing cancel call waiting on line one forces a second
incoming call to <hunt> to line two. If I am on the modem (i.e. cancel
call waiting by default) then busy is returned to the second caller. If
not, then line two rings and the call is answered.
If on the other hand we each have a call on a line and a <third> call comes
in, it will be via call waiting (usually on line one) and it can be
answered and retained on line one or transferred to line two, where again,
it will trigger call waiting. It can be answered by whichever of us is on
line two, and held or disposed of.
If I am on a modem call (almost always outgoing), then *70 is defaulted into
the dialing string...and an accidental wrong number, for example, which would
otherwise ring line two and disturb me is shunted via hunt to line one....
Line one appears on single line instruments in the kitchen and my roomate's
bedroom, and in the living room area. Line two appears on a single line
phone in my bedroom and on the two modems (I will never be in both places
at the same time). A Black Box swither allows either my Apple computer or
my terminal to use either modem....and allows either modem to use the phone
line, or allows the terminal to talk to the computer via null modem or
to the printer, etc.
Patrick Townson
(at the time this was written I was a user on Portal Communications.)

291
textfiles.com/phreak/call.faq Normal file
View File

@@ -0,0 +1,291 @@
Subject: Frequently Asked Questions About Caller-ID
Organization: TELECOM Digest
Sender: telecom@eecs.nwu.edu
Approved: telecom@eecs.nwu.edu
X-Submissions-To: telecom@eecs.nwu.edu
X-Administrivia-To: telecom-request@eecs.nwu.edu
X-Telecom-Digest: Volume 14, Issue 446, Message 9 of 9
Lines: 281
[TELECOM Digest Editor's Note: It is time to re-run this article by
Padgett which appeared earlier this year in the Digest. We will let
this be the authoritative answer to the commentaries running in this
issue of the Digest. PAT]
Frequently Asked Questions About Caller-ID
v1.1 Mar. 1994
1) What is Caller-ID ?
First ask "What is ANI"
2) OK, What is ANI ?
ANI or Automatic Number Identification is a mechanism by which
the different telephone companies determine what account is to be
charged for a call, This information is passed between Telcos and
was originally for billing purposes and predated both SS7
(Signaling System 7) and (C)LASS (Local Area Signaling Services
was the original AT&T designations, the "C" was added by Bellcore
after divesture) services which make CNID or Calling Number
IDentification as Caller-ID is more properly known, possible.
Since the Telcos had ANI, the decision was made to make it
available to authorized parties such as 911 service and law
enforcement agencies. ANI is also used to let a Telco operator
know who is calling.
More recently, ANI is used to report to 800 and 900 subscribers,
who made the calls they have received, in the first case so that
the 800 subscriber knows who the charge is for, and so that 900
number subscribers know who to charge.
Thus while ANI is similar to CALLER-ID and may provide the same
information, they are actually two different services and ANI
information is not necessarily the same as what will appear on a
CALLER-ID display.
3) Now (maybe) what is Caller-ID ?
Caller-ID is a Telco offering that is a byproduct of (C)LASS
services. In this case, only those numbers reported by
participating exchanges are returned, exactly which are and which
are not is currently (March 1994) at the Telco's discretion.
The Federal Government has stated that it is their intent that
nationwide CNID be available by mid-1995. The full text of this
decision may be found FCC Report No. DC-2571 issued on March 8,
1994.
The biggest effect of the ruling is to mandate transport of CPN
(customer provided number) information between interconnecting
networks eliminating the effective inter-LATA-only limitation
that exists today in most areas.
Currently there are two types of Caller-ID. The first (often
referred to as "basic" service) just returns the calling number
or an error message and the date/time of the call.
The second ("enhanced" Caller-ID) also may return the directory
information about the calling number. At a minimum, the name of
the subscriber is returned (the subscriber is not the same as the
caller, the phone company has no way to determine who is actually
on the line).
4) How is the Caller-ID information provided ?
As a 1200 baud, 7 data bits, 1 stop bit data stream usually
transmitted following the first and before the second ring signal
on the line. Note that this is not a standard Bell 212 or CCITT
v22 data format so a standard modem will probably not be able to
receive it. Further, the serial information exists as such only
from the recipient's switch to the callee's location. Between
carriers the signal exists as data packets.
The signal is provided before the circuit is complete: picking up
the receiver before the data stream is finished will stop/corrupt
the transmission.
Currently there are two types of information returned: a "short
form" which contains the date/time (telco and not local) of the
call and the calling number or error message. The "long form"
will also contain the name and possibly the address (directory
information) of the calling phone.
The "short form" stream consists of a set of null values,
followed by a two byte prefix, followed by the DATE (Month/Day),
TIME (24 hour format), and number including area code in ASCII,
followed by a 2s compliment checksum. Most modems/caller id
devices will format the data but the raw stream looks like this :
0412303232383134333434303735353537373737xx
or (prefix)02281334407555777(checksum)
A formatted output would look like this:
Date - Feb 28
Time - 1:34 pm
Number - (407)555-7777
5) Can a Caller-ID signal be forged/altered ?
Since the signal is provided by the local Telco switch and the
calling party's line is not connected until after the phone is
answered, generally the signal cannot be altered from the distant
end. Manipulation would have to take place either at the switch
or on the called party's line.
However, the foregoing applies only to a properly designed CNID
unit. For instance the Motorola M145447 chip has a "power down"
option that wakes the Chip up when the phone rings for just long
enough to receive, process, and deliver the CNID signal after
which it shuts down until the next call.
Should this option be disabled, the chip will be in a "listen
always" state and it is theoretically possible to "flood" a line
making a vulnerable box record successive erroneous numbers.
I have received a report of a device called "Presto Chango" that
can transmit an extra ADSI modem tone after the call has been
picked up that will cause a susceptible box to display the later
information. It was also reported to me that CNID boxes marketed
by US-West as their brand and made by CIDCO have been used to
demonstrate the "Presto Chango" box.
6) What is "ID Blocking" ?
Most Telco's providing Caller-ID have been required to also
provide the ability for a calling party to suppress the Caller-ID
signal. Generally this is done by pressing star-six-seven before
making the call. In most cases this will block the next call only
however some Telcos have decided to implement this in a
bewildering array of methods. The best answer is to contact the
service provider and get an answer in writing.
Currently this is supplied as either by-call or by-line blocking.
By-Call is preferred since the caller must consciously block the
transmission on each call. By-Line blocking as currently
implemented has the disadvantage that the caller, without having
a second caller-id equipped line to use for checking, has no way
of knowing if the last star-six-seven toggled blocking on or off.
Note that blocking is provided by a "privacy" bit that is
transmitted along with the CNID information and so is still
available to the Telco switch, just not to the subscriber as a
CNID signal. Consequently related services such as call trace,
call return, & call block may still work.
7) What happens if a call is forwarded ?
Generally, the number reported is that of the last phone to
forward the call. Again there are some Telco differences so use
the same precaution as in (6). If the forwarding is done by
customer owned equipment there is no way of telling but will
probably be the last calling number.
Note that as specified, CNID is *supposed* to return the number
of the originating caller but this is at the mercy of all
forwarding devices, some of which may not be compliant.
8) What happens if I have two phone lines and a black box to do
the forwarding ?
If you have two phone lines or use a PBX with outdialing
features, the reported number will be that of the last line to
dial. Currently there is no way to tell a black box from a human
holding two handsets together.
9) I called somebody from a company phone (555-1234) but their
Caller-ID device reported 555-1000.
Often a company with multiple trunks from the Telco and their own
switch will report a generic number for all of the trunks.
There is a defined protocol for PBXs to pass true CNID
information on outgoing lines but it will be a long time before
all existing COT (Customer Owned Telephone) equipment is upgraded
to meet this standard unless they have a reason to do so.
10) I run a BBS. How can I use Caller-ID to authenticate/log
callers ?
There are two ways. The first utilizes a separate Caller-ID box
with a serial cable or an internal card. This sends the
information back to a PC which can then decide whether to answer
the phone and what device should respond. Some of these are
available which can handle multiple phone lines per card and
multiple cards per PC.
The second (and most common) is for the capability to be built in
a modem or FAX/modem. While limited to a single line per modem,
the information can be transmitted through the normal COM port to
a program that again can decide whether or not to answer the
phone and how. There is a FreeWare Caller-ID ASP script for
Procomm Plus v2.x available for FTP from the Telecom archive.
Most such software packages will also log each call as it is
received and the action taken.
Of course for true wizards, there are chips available (one of the
first was the Motorola MC145447) that can recognize the CNID
signal and transform it into a proper RS-232 (serial) signal.
11) How is security enhanced by using Caller-ID over a Call-Back
service or one-time-passwords for dial-up access ?
Caller-ID has one great advantage over any other mechanism for
telephone lines. It allows the customer to decide *before*
picking up the receiver, whether to answer the call.
Consider hackers, crackers, and phreaks. Their goal in life is to
forcibly penetrate electronic systems without permission (sounds
like rape doesn't it ?). They employ demon dialers and "finger
hacking" to discover responsive numbers, often checking every
number in a 10,000 number exchange.
If they get a response such as a modem tone, they have a target
and will often spend days or weeks trying every possible
combination of codes to get in. With Caller-ID answer selection,
the miscreant will never get to the modem tone in the first
place, yet for an authorized number, the tone will appear on the
second ring. Previously the best solution for dial-ups was to set
the modem to answer on the sixth ring (ats0=6). Few hackers will
wait that long but it can also irritate customers.
12) What error messages will Caller-ID return ?
a) "Out of Area" - (Telco) the call came from outside the Telco's
service area and the Telco either has no available information or
has chosen not to return what information it has.
b) "Blocked" or "Private" - (Telco) the caller either has
permanent call blocking enabled or has dialed star-six-seven for
this call. You do not have to answer either.
c) "Buffer Full" - (device manufacturer) there are many Caller-ID
devices on the market and exactly how they have chosen to
implement storage is up to the manufacturer. This probably mans
that the divide has a limited buffer space and the device is
either losing the earliest call records or has stopped recording
new calls.
d) "Data Error" or "Data Error #x" - (device manufacturer)
signal was received that was substandard in some way or for which
the checksum did not match the contents.
e) "No Data Sent" - (device manufacturer) Signal was received
consisting entirely of nulls or with missing information but a
proper checksum.
13) Why are so many people against Caller-ID ?
FUD - Fear, Uncertainty, & Doubt or 10,000,000 lemmings can't be
wrong. There were some justifiable concerns that some people
(battered wives, undercover policemen) might be endangered or
subject to harassment (doctors, lawyers, celebrities) by
Caller-ID. As mentioned above there are several legitimate ways
to either block Caller-ID or to have it return a different
number. It is up to the caller. The advantage is that with
Caller-ID, for the first time, the called party has the same
"right of refusal".
Expect yet another Telco service (at a slight additional charge)
to be offered to return an office number for calls made from
home. Crisis centers could return the number of the local police
station.
Compiled by Padgett Peterson. Constructive comments to:
padgett@tccslr.dnet.mmc.com Brickbats >nul.
Thanks for additional material to:
David J. Kovan
Robert Krten
John Levine
David G. Lewis
Karl Voss
but the mistakes are all mine - Padgett (Ignorance is curable)
___ Blue Wave/QWK v2.12

141
textfiles.com/phreak/call_800.txt Normal file
View File

@@ -0,0 +1,141 @@
Call and Tell
The zip code tells the U.S. Postal Service where to deliver the mail.
It also tells direct marketers what to deliver. Combining the zip
code with census and other data provides marketers with a rich vein of
demographic information concerning your income, buying habits and
socio-economic preference for squash instead of handball.
If all this is not enough, the past decade has given direct marketers
another wedge into the collective psyche of American consumers: your
telephone number. Combining the resources of massive computer data
bases with the ability of an emerging "smart" telephone network to
identify callers, the direct-marketing industry is using the telephone
number to track down a person's name, address--and life-style. If
your household is deemed "desirable" to a marketer--perhaps one of the
"Pools & Patios" crowd, as one telemarketer puts it--an 800 or 900
line service representative may know it before the call is answered.
Target direct marketing is not new. A company that subscribes to an
800 or 900 service can receive a monthly listing of the numbers of
callers, which can then be matched with names and addresses using a
reverse telephone directory. Correlating that information with
demographic data produces valuable mailing or phone lists. (An 800
call is toll free, whereas the caller pays for dialing a 900 number.
A caller interested enough to pay a fee is more likely to buy a
product, marketers reason.)
To the consumer, all this means that products can be more closely
matched to personal tastes, with the result that the junk mail might
just contain something worth buying. What's new is that
information-age marketers have begun to acquire the technology to
carry out this screening process instantly and without the caller's
knowledge.
Beginning this year, Telesphere Communications, Inc., and Oakbrook
Terrace, Ill., company with $550 million in annual sales, will offer a
service to 900 subscribers that can peg the location of an incoming
call using an are code and the number's three-digit prefix. Knowing
where the call originates allows a salesperson to prepare a pitch.
Later a reverse directory can be used to identify the caller, and a
data base can determine which of 40 demographic "clusters" fits that
person. In the near future, these services may be provided while the
caller is still on the lines.
Telesphere gets in demographic information from PRIZM, a data base
owned by Claritas Corporation in Alexandria, Va. PRIZM can pinpoint a
neighborhood for virtually everyone in the U.S. using census and other
public demographic information. "It works on the theory that birds of
a feather flock together," says Harvey B. Uelk, a Telesphere sales
director.
So if you are lucky, the pitchman will know if you fall in the fifth
cluster in the data base: "Furs & Station Wagons." This group is
described as "'new money' living in expensive new neighborhoods....
They are winners--big producer, and big spenders." A not so fortunate
caller might be lumped into the "Emergent Minorities" cluster. These
people, says a promotional report, are "almost 80 percent black, the
remainder largely composed of Hispanics and other foreign-born
minorities.... Emergent Minorities shows...below-average levels of
education and [below-average] white-collar employment. The stuggle
for emergence from poverty is still evident in these neighborhoods."
The risk that a household, through clustering, might become the
telemarketing equivalent of a bad credit risk has not escaped the
notice of the American Civil Liberties Union and other public interest
groups who fear that minorities might be excluded from mortgage and
credit opportunities or a gay neighborhood may be blacklisted by an
insurance advertising campaign. A telemarketer might display
different sales pitches on a service representative's computer screen,
depending on whether the incoming caller hails from the "Money &
Brains" or the "Coalburg & Corntown" cluster.
Marc Rotenberg of Computer Professionals for Social Responsibility
likens calling an 800 or 900 number to walking into a store. "A
person should have a right to enter a store without disclosing
creditworthiness, residence or annual income," Rotenberg asserts.
Lobbying by privacy groups has focused so far on supporting national
legislation that would, in effect, allow a caller to keep his wallet
in his back pocket until he decides to make a purchase.
The law would give the caller the option of blocking a number from
being displayed immediately bya receiving party. This would be done
by pressing "*-6-7," or a similar combination of numbers, before
making a call. (Marketers could still get callers' 800 or 900 numbers
with their statements each month, however.) Although the law failed
to pass Congress last year, it is scheduled to be reintroduced this
year.
Individual states are not necessarily waiting for Congress. A
Pennsylvania court has banned "Caller ID" service--a decision that is
on appeal--and a number of state public utility commisions have
ordered that blocking be offered free of charge. For the moment,
states' actions may not affect most telemarketers, whose 800 and 900
calls are usually routed over the long-distance phone network and
displayed to a clerk using a service called automatic number
identification.
Support for blocking has come not just from privacy advocates but from
the White House's Office of Consumer Affairs, four of the seven
regional Bell companies and the Direct Marketing Association in New
York City. As with junk mail, the direct-marketing industry
acknowledges that the consumer should have the right to choose not to
receive unsolicited information.
On the opposite end of the line, a number of telephone companies
contend that caller identification services are a clear boon to
subscribers. Bell Atlantic, an ardent opponent of call blocking, has
compiled a list of subscribers who have used the Caller ID service to
stop obscene phone calls or fake pizza orders and to track down
burglars.
For their part, some direct marketers assert that fears of
misappropriatio of personal information are greatly exaggerated: they
are interested in patterns of group behavior, not the personal
preferences of the individual. "We try to identify market segments
that are most likely to respond to a particular marketer's products or
services," explains Philip H. Bonello, director of corporate planning
for Metromail, a Lombard, Ill., firm that owns a data base of 86
million households that supplies the direct-marketing industry.
But the public is clearly concerned about electronic privacy. In
January Lotus Development Corporation, a Cambridge, Mass., software
company, and Equifax, Inc., an Atlanta-based credit bureau, withdrew
plans to market Lotus Marketplace on compact discs after some 30,000
people asked that their names be removed from the files. This data
base contains demographic information on about 120 million
individuals.
The public debate over privacy could grow still more heated if
telephone companies try to market their internal data bases of
information about residential customers. Limited attempts to do so
have sometimes met with resistance. Recently New England Telephone
and New York Telephone dropped a service offering residential and
business directory listings when hundreds of thousands of customers
asked that their names be taken off the lists.
Legislation may help stem abuses. A public outcry may force companies
to lay low. But the irresistible lure of knowing name, phone number
and lifestyle means that computerized telemarketing is here to stay.
Caveat salutator: let the caller beware.

111
textfiles.com/phreak/callattnow.phk Normal file
View File

@@ -0,0 +1,111 @@
HOW TO HARRASS AT&T AND LET THEM PAY!
(HOW TO CALL AT&T COLLECT USING MCI OR ANY COMPANY)
---------------------------------------------------
Written by: TESLA - Long Island 25
This file will teach the hackers and phreakers how to call AT&T
collect using the carrier of their choice (don't use AT&T 'cuz
they don't lose money). We recommend using overpriced carriers
or especially from CANADA.
WHY: AT&T sucks. For years they were the only long distance company.
Other companies spent millions on networks to compete when
they should have been able to compete all along. NOW IT'S TIME
TO GIVE ALL ThE LITTLE COMPANIES BACK SOME MONEY. LET AT&T
PAY THEIR COMPETITORS!
ALSO WHY: Because of Federal Criminal Case #93-133 in the US DISTRICT
COURT OF WESTERN PA (USA vs. Keith Maydak et al). This was
a set up by AT&T to ruin a small company and put the officers
in jail 'cuz they knew too much. This is a pretty lame file.
Our good files will be released upon the conviction of
Keith Maydak. Our other files will assist in the great
AT&T BANKRUPTCY. In other words, sell your AT&T stock. Also,
be advised, Keith Maydak does not condone the release of
this article or our fight for him; however, we must fight for
him.
SPREAD THIS FILE!
(Hey, Bob Allen, Dickhead... we head that AT&T long-distance traffic is
only growing 5.5% a year and MCI is growing nearly 20%. Time to sell
the AT&T stock. Oh, yeah, Bob, if 1000 hackers do what I say, it will
cost AT&T $1,000,000 per year. If 10000 hackers do it, it'll cost AT&T
$10,000,000 per year. Ha ha! If we start getting people from small
goofy countries to do this, shit, we could cost AT&T more than the
long distance network makes in profit... serves you right. You mess
with the wrong people)
OKAY HERE GOES:
Most AT&T offices accept collect calls. This is because countries like
CANADA hate their ass and block their 800 customer service numbers. That's
kool. But, they'll also take calls from the US. It's much more fun
to call collect because they gotta pay for the bill to one of their
competitors. We especially like to call using ONCOR 'cuz they really
rip AT&T off plus it blocks your phone number from appearing on AT&T's
bill. (To use ONCOR, dial 800-288-2880<tone>4129282105-0-ACN CALLING)
Also, we have the BELL OPERATOR give us 1-800-COLLECT (MCI) and they
put MCI's headquarters phone number on AT&T's bill (as long as you can
block ANI in your area- try it). Even so, don't worry about AT&T
harrassing you, they don't.
GOAL: Do this at least $100 per month ($1200/year); or more. That's
only about 10 calls on rip-off carriers (10555 (ONCOR), 10370
(AMNEX), etc...) and it'll be around $100.
Alright: Here's a few number that take collect calls:
816-654-6000 This is the residential calling card center. Use this
to be transferred to any extension from 6000-6999 they
are all AT&T; you can harrass them, etc... even cancel
a neighbors calling card (Hi, my phone number is XXXX
and I lost my AT&T card I don't know the number)
816-654-6004 This is the business customers calling card center.
Do the same thing to these people. More phun, ask
for the CARD PROTECTION UNIT and tell them your
card needs some protection. Ask for extension 6900
and they'll give you the away from home program, these
people will send you $10.00 certificate for signing
up to a program that's totally stupid and free.
304-341-3125 This is like on of the billing offices; they'll transfer
304-341-3020 you to anything in like 341-3XXX. Have phun. Harrass
them. We had phun one night talking to the SECURITY
MANAGER. They called him at home at 4AM. We told him
we were the police. AND WE DID IT ALL COLLECT.
412-553-7458 These people will tell you how to call the US From foreign
lands. They will also send you the "Int'l Travelers
Calling Guide" and free USA DIRECT guides. Order 1 for
yourself, 1 for the police, one for everyone. Also,
tell them you're a business and you need 500 plastic
WORLD CONNECT ACCESS # CARDS. These are good to floss
your teeth or burn at the mall (stink up the whole place)
FIRE! FIRE!
904-636-2737 This is AT&T Teletravel. AKA AT&T Telethattheirparaniod.
For $10 these people will sign you up to TELETRAVEL a great
servie that lets you dial an 800# enter a code, then make
2 calls to toll-free numbers using three-way. Then, after
you make like 30 calls, they cancel your account and claim
you were using their service to hack. We weren't, but they
cancelled us anyway. Tell them to send you a free info
pak... or we even talked them into sending us a green
SUNVISOR. Tell these people you wanna talk to corp security
and they'll connect you. Tell these people they suck.
There are many more. Local offices like Pittsburgh (412) 366-3000 take
calls on the weekends. Just say the call is from JOHN, or ATT CUSTOMER
or anything. Find more numbers, post them, addendum this file, and
pass it around. If we can make this a worm-type text file, we can have
AT&T losing millions. AND IT'LL BE PHUN! The longer the call, the
more it costs AT&T!
AT&T: Just another part of the I SCAM. I is for idiot. Idiot is anyone
who has AT&T as their 1+ carrier.
Downloaded From P-80 International Information Systems 304-744-2253

108
textfiles.com/phreak/callback.dit Normal file
View File

@@ -0,0 +1,108 @@
***** 8 m m
* 8 8 m m
* 8 8 m m
* 8 888 8 m m
***** * 8 mmmmm mmmmm back, or dial in ...
------------------------------------------------------------------------------
The S-VER verification Callback.
Some BBSes have a Callback verification installed.
One populair type is the 'S-VER verification', developed by Steve Gabrilowitz.
It let's you enter your phonenumber, in order to hangup and callback, waiting
for you to enter your password. The poor guy must have starved now, since no
sysop appears to register the package...
Suppose you don't like to give your number away, for some reason. In that case
you can try a few tricks on the S-VER. If you're a sysop, you can test your
system's security, and understand the weak spots :-)
A few hints for common 'testing':
1) Collect information on the subject, the more you know, the more chance you
get to succeed. Version of software ? Required hardware ? Properties of the
latter ? In this case: obtain a copy of s_ver092 yourselves!
2) Make assumptions based on your info, where and when could the security fail ?
This requires knowledge of the system in use, experience and 'talent'.
3) How can I create a situation assumed at stage 2) ?
This often requires a lot of creativity, luck and again 'talent'.
4) Evaluate the results.
Why did it work ? or why not. You learn from your mistakes and successes.
Step by step:
Get your own S-VER software, and examine everything! You'll notice it's share-
ware, but did the sysops allready register it ???
After reading the docs, you can conclude that some phonenumbers can be excluded
from verification <now think what would happen if...>
Exceptional useful are the bugreports included in docs :-) Nice helpful people,
those shareware authors...
Assumption: Dial back BEFORE the callback seizes the line to call you.
That's the 'schoolbook' solution on callbacks.
Problem: you can't dialin faster than the S-VER seizes the line...
WORK ON THAT: You increase your dialin chance by making your modem dial faster,
try ATS11=2 setting or even ATS11=1, wow! that's lightingspeed dialing huh ? :-)
add a ATS10=1 inorder to detect a loss of carrier very quick.
With these settings you redial after the S-Ver has hung up on you with a/
With a bit of luck YOU are using the line before S-VER can, now pickup the phone
inorder to hold the line (You do have a phone don't you ?) and wait for the
S-VER (thinking to call you, but it isn't) to give a carrier, you respond with a
ata and type in your password...and you've passed a real dialback :-)
Not bad for a practice, I'd say. Ofcourse, this isn't a document on abusing
callbacks, I merely want to state that a callback ISN'T the ultimate security.
Allthough many people think it is. Do not rely on your security-systems with
blind faith !
-------------------------------------------------------------------------------
Document update:
After a lot of fieldwork, it appears that this fastdial trick even works on
expensive industrial modems with a build-in hardware dialback !
The key is to enable your modem to dial as fast as lightning. Try add some
extra's:
Here is my favorite initstring: AT L3 X4 S6=1 S10=1 S11=40 S12=0
You may call it 'The Default Hackerstring':
AT for waking up the microprocessor in your modem,
L3 for a louder speaker, since you want to hear what's going on.
X4 enables blind-dialing.
S6=1 set the dialtone waiting time to the minimum.
S10=1 minimizes the time after a carrier drop.
S11=40 let's your modem fire DTMF tones ... use the smallest number possible
for as long as a succesful dial can be made, don't overdo it!
S12=0 disables any guardtime involved after a +++ sequence is given.
-------------------------------------------------------------------------------
Expensive HiSpeed modems often have 'remote command' modes. But the commands
are to divers to discribe, since almost every brand uses his own commandset.
But it is usually something like AT*A to set the other modem in a remote-mode.
Ofcourse you could allways try sending the string:
NO CARRIER
to the other end, hoping that the owners are really dorks from space, but you
never know...maybe you get an answer back i.e.
ATDT0,xxxxxx ....miracles still exists ;-)
Tracker
Oh, by the way, along with this document I've include another dialback package
from Michel Overtoom, I didn't ask for any permission, but I guess he won't
mind. Some good programming he preformed. (the nice fellow included the source)

Some files were not shown because too many files have changed in this diff Show More