*--* 08-24-91 - 22:10:56 *--* .____________________________________. ! ! ! THE BOOK OF BIOC ! ! ! ! A COMPILED PHREAKING TUTORIAL ! !____________________________________! HOW TO BE A REAL PHREAK IN THE PHONE PHREAK SOCIETY THERE ARE CERTAIN VALUES THAT EXIST IN ORDER TO BE A TRUE PHREAK, THESE ARE BEST SUMMED UP BY THE MAGICIAN: "MANY PEOPLE THINK OF PHONE PHREAKS AS SLIME, OUT TO RIP OFF BELL FOR ALL SHE IS WORTH. NOTHING COULD BE FURTHER FROM THE TRUTH! GRANTED, THERE ARE SOME WHO GET THEIR KICKS BY MAKING FREE CALLS; HOWEVER, THEY ARE NOT TRUE PHONE PHREAKS. REAL PHONE PHREAKS ARE 'TELECOMMUNICATIONS HOBBYISTS' WHO EXPERIMENT, PLAY WITH AND LEARN FROM THE PHONE SYSTEM. OCCASIONALY THIS EXPERIMENTING, AND A NEED TO COMMUNICATE WITH OTHER PHREAKS ( WITH- OUT GOING BROKE), LEADS TO FREE CALLS. THE FREE CALLS ARE BUT A SMALL SUBSET OF A >TRUE< PHONE PHREAKS ACTIVITIES. THE TEN COMMANDMENTS REPRINTED FROM TAP ISSUE #86. (TAP, ROOM 603, 147 W 42 STREET, NEW YORK, NY 10036. SEND A SASE FOR THEIR INFO SHEET "WHAT THE HELL IS TAP?" AND TELL THEM THAT BIOC AGENT 003 TOLD YOU ABOUT IT.) THE PHONE PHREAK'S TEN COMMANDMENTS I. BOX THOU NOT OVER THINE HOME TELEPHONE WIRES, FOR THOSE WHO DOEST MUST SURELY BRING THE WRATH OF THE CHIEF SPECIAL AGENT DOWN UPON THY HEADS. II. SPEAKEST THOU NOT OF IMPORTANT MATTERS OVER THINE HOME TEL- EPHONE WIRES, FOR TO DO SO IS TO RISK THINE RIGHT OF FREEDOM. III. USE NOT THINE OWN NAME WHEN SPEAKING TO OTHER PHREAKS, FOR THAT EVERY THIRD PHREAK IS AN FBI AGENT IS WELL KNOWN. IV. LET NOT OVERLY MANY PEOPLE KNOW THAT THY BE A PHREAK, AS TO DO SO IS TO USE THINE OWN SELF AS A SACRIFICIAL LAMB. V. IF THOU BE IN SCHOOL, STRIVE TO GET THIN SELF GOOD GRADES, FOR THE AUTHORITIES WELL KNOW THAT SCHOLARS NEVER BREAK THE LAW. VI. IF THOU WORKEST, TRY TO BE A EMPLOYEE, AND IMPRESSEST THINE BOSS WITH THINE ENTHUSIASM, FOR IMPORTANT EMPLOYEES ARE OFTEN SAVED BY THEIR OWN BOSSES. VII. STOREST THOU NOT THINE STOLEN GOODES IN THINE OWN HOME, FOR THOSE WHO DO ARE SURELY NON- BELIEVERS IN THE BELL SYSTEM SECURITY FORCES, AND ARE NOT LONG FOR THIS WORLD. VIII. ATTRACTEST THOU NOT THE ATT- ENTION OF THE AUTHORITIES, AS THE LESS NOTICABLE THOU ART, THE BETTER. IX. MAKEST SURE THINE FRIENDS ARE INSTANT AMNESIACS AND WILL NOT REMEMBER THAT THOU HAVE CALLED ILLEGALLY, FOR THEIR COOPERATION WITH THE AUTHORITIES WILL SURELY LESSEN THINE TIME FOR FREEDOM ON THIS EARTH. X. SUPPORTEST THOU TAP, AS IT IS THINE NEWSLETTER, AND WITHOUT IT, THY WORK WILL BE FAR MORE LIMITED. CN/A NUMBERS CUSTOMER NAME & ADDRESS BUREAUS EXIST SO THAT AUTHORIZED BELL EMPLOYEES MAY OBTAIN THE NAME & ADDRESS OF ANY CUSTOMER IN THE BELL SYSTEM BY GIVING THE CN/A OPERATOR THE CUSTOMER'S TEL. # ALL CUSTOMERS ARE MAINTAINED ON FILE INCLUDING UNLISTED #'S. THESE BUREAUS HAVE MANY USES FOR PHREAKS. HERE IS HOW AN EMPLOYEE MIGHT GO ABOUT CALLING CN/A: "HI, THIS IS JOHN DOE FROM THE MIAMI RESIDENTAL SERVICE CENTER, CAN I HAVE THE CUSTOMERS NAME AT (123) 555-1212." THE EMPLOYEES USUALLY USE THESE FOR CHECKING WHO BELONGS TO A # THAT SOMEONE CLAIMED THEY DIDN'T CALL. IF YOU SOUND CHEERY AND NATURAL THE OPERATOR WILL NEVER ASK ANY QUESTIONS. IF YOU DON'T SOUND LIKE A MATURE ADULT, DON'T USE IT! ALWAYS PRACTICE FIRST & SO YOU DON'T SCREW UP AND MAKE THE OPERATOR SUSPICIOUS. USE NAME THAT SOUNDS REAL, NOT YOUR PIRATE NAME EITHER! ALSO SAY THAT YOU ARE FRO A CITY THAT IS FAR AWAY FROM THE ONE THAT YOU ARE CALLING. THE CN/A NUMBER FOR THE NY AREA & VICINITY (212, 315, 516, 518, 607, 716, & 914) IS>>>>>>>>>(518) 471-8111<<<<<< AND IS OPEN DURING BUSINESS HOURS. DON'T ABUSE IT! AT&T NEWSLINES AT&T NEWSLINES ARE NUMBERS AT AREA PHONE OFFICES THAT TELCO EMPLOYEES CALL TO FIND OUT THE LATEST INFO ON NEW TECHNOLOGY, STOCKS, ETC. THE RECORDED REPORTS RANGE FROM VERY BORING TO VERY INTERESTING. HERE ARE A FEW OF THE NUMBERS: *(201) 483-3800 NJ (518) 471-2272 NY (203) 771-4920 CN (717) 255-5555 PA (212) 393-2151 NY (717) 787-1031 PA (516) 234-9941 NY *(914) 948-8100 NY SOME OF THESE NUMBERS ARE TOLL-FREE, BUT YOU CAN'T ALWAYS COUNT ON IT. * THESE NUMBERS ARE NOT ALWAYS UP! NUMBERS FROM OTHER AREAS ARE AVAILABLE BY REQUEST FROM F)BIOC L)AGENT 003. ANI NUMBERS ANI NUMBERS IDENTIFY THE PHONE NUMBER THAT YOU ARE CALLING FROM. IT IS USEFUL WHEN PLAYING IN CANS (THOSE BIG SILVER BOXES ON TELEPHONE POLES) TO FIND OUT THE # OF THE LINE. IT IS ALSO GOOD TO FIND OUT THE # OF A PHONE THAT DOESN'T HAVE IT PRINTED ON IT. IN THE 914 AREA CODE THE ANI # IS 990. IF YOU JUST HAVE TO DIAL THE LAST 4 DIGITS FOR A LOCAL #, IE CONGERS (268), DIAL 1-990-1111, WHERE 1111 ARE DUMMY DIGITS THERE IS ALSO A LESS USEFUL TYPE OF ANI # WHICH WILL IDENTIFY THE AREA CODE & EXCHANGE. IT IS NXX-9901, WHERE NXX IS THE EXCHANGE. IN THE 212 & 516 AREA CODES THE ANI # IS 958. PHREAK NEWSLETTER TAP IS THE "OFFICIAL" PHONE PHREAK NEWSLETTER, AND HAS EXISTED SINCE 1971. EACH 4 PAGE ISSUE IS CRAMMED FULL OF INFORMATION ON PHONE PHREAKING, COMPUTER PHREAKING, FREE GAS, FREE ELECTRICITY, FREE POSTAGE, BREAKING & ENTERING INFO, ETC. IT IS LARGELY PHONE PHREAK ORIENTED, HOWEVER. A 10 ISSUE SUBSCRIPTION COSTS $8.00, IF YOU GET A BULK RATE SEALED ENVELOPE SUBSCRIPTION. I WOULD RECOMMEND THE FIRST CLASS SUBSCRIPTION, WHICH IS $10. AS OF THIS WRITING (7-16-83), THE CURRENT ISSUE IS #86, AND ISSUE #50 IS 8 PAGES INSTEAD OF THE USUAL 4. BACK ISSUES ARE $0.75 EACH, AND ISSUE #50 IS $1.50. A BRIEF INDEX TO THE FIRST 80 ISSUES IS AVAILABLE FOR A SASE, OR FREE WITH A SUBSCRIPTION ORDER. TAP IS NON-PROFIT, AND IN DESPERATE NEED OF MATERIAL (ARTICLES), MONEY, AND VOLUNTEERS. TAP ROOM 603 147 WEST 42ND STREET NEW YORK, NY 10036 BELIEVE ME: IT WILL BE THE BEST $10 YOU WILL EVER SPEND... BLACK BOX THE BLACK BOX IS A DEVICE THAT ATTACHED TO A CALLED PARTIES PHONE THAT ALLOWS HIM/HER TO RECEIVE FREE LONG DISTANCE CALLS FROM FRIENDS WHO CALL. YOU ONLY NEED 2 PARTS: A SPST TOGGLE SWITCH AND A 10,000 OHM (10 K), 1/2 WATT, 10% RESISTOR. ANY ELECTRONICS PLACE SHOULD HAVE THESE. NOW, CUT TWO PIECES OF WIRE, ABOUT 6 INCHES, AND ATTACH THESE TO THE TWO SCREWS ON THE SWITCH. TURN YOUR NORMAL DDSIDE DOWN AND UNSCREW THE 2 SCREWS. LOCATE THE "F" AND "RR" SCREWS ON THE NETWORK BOX. WRAP THE RESISTOR BETWEEN THESE 2 SCREWS AND MAKE SURE THAT THE WIRES TOUCH ONLY THE PROPER TERMINALS! NOW CONNECT ONE WIRE FROM THE SWITCH TO THE RR TERMINAL. FINALLY, ATTACH THE REMAINING WIRE TO THE GREEN WIRE (DISCONNECT IT FROM ITS TERMINAL). NOW BRING THE SWITCH OUT THE REAR OF THE PHONE AND CLOSE IT UP. PUT THE SWITCH IN A POSITION WHERE YOU GET A DIAL TONE, MARK THIS NORMAL. MARK THE OTHER SIDE FREE. WHEN YOUR FRIENDS CALL (AT A PREARRANGED TIME), QUICKLY LIFT & DROP THE RECEIVER AS FAST AS POSSIBLE. THIS WILL STOP THE RINGING, IF NOT TRY AGAIN. IT IS VERY IMPORTANT THAT YOU DO IT FAST! NOW PUT THE SWITCH IN THE FREE POSITION AND PICK UP THE PHONE. KEEP ALL CALLS SHORT & UNDER 15 MINUTES. WHEN SOMEONE CALLS YOU LONG-DISTANCE, THEY ARE BILLED FROM THE MOMENT YOU ANSWER. THE TELCO KNOWS WHEN YOU ANSWER DUE TO A CERTAIN AMOUNT OF VOLTAGE THAT FLOWS WHEN YOU PICK UP THE PHONE. HOWEVER, THE RESISTOR CUTS DOWN ON THE VOLTAGE SO IT IS BELOW THE BILLING RANGE BUT SUFFICIENT ENOUGH TO OPERATE THE MOUTHPIECE. ANSWERING THE PHONE FOR A FRACTION OF A SECOND STOPS THE RING BUT IT IS NOT ENOUGH FOR BILLING TO START. IF THE PHONE IS ANSWERED FOR EVEN ONE FULL SECOND, BILLING WILL START AND YOU WILL BE CUT OFF WHEN YOU HANG UP AND SWITCH TO FREE. WARNING: BELL CAN RANDOMLY LOOK FOR BLACK BOXES SO BE CAREFUL! --------------------------------------- : : ***BLUE WIRE**>>F< : : * * : **WHITE WIRE**** * : : * : : RESISTOR : : * : : * : : >RR<*******SWITCH*** : : * : ****GREEN WIRE********************* : : : --------------------------------------- DIAL LOCKS HAVE YOU EVER BEEN IN AN OFFICE OR SOMEWHERE AND WANTED TO MAKE A FREE FONE CALL BUT SOME ASSHOLE PUT A LOCK ON THE FONE TO PREVENT OUT-GOING CALLS? FRET NO MORE PHELLOW PHREAKS, FOR EVERY SYSTEM CAN BE BEATEN WITH A LITTLE KNOWLEDGE! THERE ARE TWO WAYS TO BEAT THIS OBSTACLE, FIRST PICK THE LOCK, I DON'T HAVE THE TIME TO TEACH LOCKSMITHING SO WE GO TO THE SECOND METHOD WHICH TAKES ADVANTAGE OF TELEPHONE ELECTRONICS. TO BE AS SIMPLE AS POSSIBLE, WHEN YOU PICK UP THE FONE YOU COMPLETE A CIRCUIT KNOW AS A LOCAL LOOP. WHEN YOU HANG-UP YOU BREAK THE CIRCUIT. WHEN YOU DIAL (PULSE) IT ALSO BREAKS THE CIRCUT BUT NOT LONG ENOUGH TO HANG UP! SO YOU CAN "PUSH-DIAL." TO DO THIS YOU >RAPIDLY< DEPRESS THE SWITCHHOOK. FOR EXAMPLE, TO DIAL AN OPERATOR (AND THEN GIVE HER THE NUMBER YOU WANT CALLED) >RAPIDLY< & >EVENLY< DEPRESS THE SWITCHHOOK 10 TIMES. TO DIAL 634-1268, DEPRESS 6 X'S PAUSE, THEN 3 X'S, PAUSE, THEN 4 X'S, ETC. IT TAKES A LITTLE PRACTICE BUT YOU'LL GET THE HANG OF IT. TRY PRACTICING WITH YOUR OWN # SO YOU'LL GET A BUSY TONE WHEN RIGHT. IT'LL ALSO WORK ON TOUCH-TONE(TM) SINCE A DTMF LINE WILL ALSO ACCEPT PULSE. ALSO, NEVER DEPRESS THE SWITCHHOOK FOR MORE THAN A SECOND OR IT'LL HANG-UP! FINALLY, REMEMBER THAT YOU HAVE JUST AS MUCH RIGHT TO THAT FONE AS THE ASSHOLE WHO PUT THE LOCK ON IT! EXCHANGE SCANNING ALMOST EVERY EXCHANGE IN THE BELL SYSTEM HAS TEST #'S AND OTHER "GOODIES" SUCH AS LOOPS WITH DIAL-UPS. THESE "GOODIES" ARE USUALLY FOUND BETWEEN 9900 AND 9999 IN YOUR LOCAL EXCHANGE. IF YOU HAVE THE TIME AND INITIATIVE, SCAN YOUR EXCHANGE AND YOU MAY BECOME LUCKY! HERE ARE MY FINDINGS IN THE 914-268 EXCHANGE: 9900 - ANI (SEE SEPARATE BULLETIN) 9901 - ANI (SEE SEPARATE BULLETIN) 9927 - OSC. TONE (POSSIBLE TONE SIDE OF A LOOP) 9936 - VOICE # TO THE TELCO CENTRAL OFFICE 9937 - VOICE # TO THE TELCO CENTRAL OFFICE 9941 - COMPUTER (DIGITAL VOICE TRANSMISSION?) 9960 - OSC. TONE (TONE SIDE LOOP) -- MAY ALSO BE A COMPUTER IN SOME EXCHANGES 9961 - NO RESPONSE (OTHER END OF LOOP?) 9962 - NO RESPONSE (OTHER END OF LOOP?) 9963 - NO RESPONSE (OTHER END OF LOOP?) 9966 - COMPUTER (SEE 9941) 9968 - TONE THAT DISAPPEARS--RESPONDS TO CERTAIN TOUCH-TONE KEYS MOST OF THE NUMBERS BETWEEN 9900 & 9999 WILL RING OR GO TO A "WHAT #, PLEASE?" OPERATOR. HAVE PHUN AND REMEMBER IT'S ONLY A LOCAL CALL! TOUCH-TONE & FREE CALLS THERE ARE SEVERAL WAYS TO MAKE FREE CALLS (SPRINT, MCI, ETC.) USING A ROTARY PHONE. THEY ARE: 1. USE A NUMBER THAT ACCEPTS VOICE AS WELL AS DTMF. SUCH A # IS (800) 521-8400. AS OF WRITING THIS, A CODE WAS 00717865. A) IF USING VOICE, WAIT FOR THE COMPUTER TO SAY, "AUTHORIZATION #, PLEASE." THEN SAY EACH DIGIT SLOWLY, IT WILL BEEP AFTER EACH DIGIT IS SAID. AFTER EVERY GROUP OF DIGITS, IT WILL REPEAT WHAT YOU HAVE SAID, THEN SAY YES IF IT IS CORRECT, OTHERWISE SAY NO. IF THE ACCESS CODE IS CORRECT, IT WILL THANK YOU AND ASK FOR THE DESTINATION #, THEN SAY THE AREA CODE + NUMBER AS ABOVE. ANOTHER SUCH # IS (800) 245- 8173, WHICH HAS A 6 DIGIT ACCESS CODE. (NOTE: IF USING TOUCH-TONE ON THIS #, ENTER THE CODE IMMEDIATELY AFTER THE TONE STOPS.) 2. HOOK UP A TOUCH-TONE FONE INTO YOUR ROTARY FONE. ATTACH THE RED WIRE FROM THE TOUCH-TONE FONE TO THE "R" TERMINAL INSIDE THE FONE ON THE NETWORK BOX. THEN HOOK THE GREEN WIRE TO THE "B" TERMINAL. TO USE THIS DIAL THE # USING ROTARY & THEN USE THE TOUCH-TONE FOR THE CODES. (DON'T HANG UP THE ROTARY FONE WHILE DOING THIS THOUGH!) IF THIS DOESN'T WORK THEN REVERSE THE 2 WIRES. (NOTE: IF YOUR LINE CAN ACCEPT TOUCH-TONE BUT YOU HAVE A ROTARY FONE THEN YOU CAN HOOK UP A TONE FONE DIRECTLY FOR ALL CALLS BUT THIS USUALLY ISN'T THE CASE.) SUCH AS RADIO SHACK'S 43-138. OTHER ALTERNATIVES 4. USE A CHARGE-A-CALL FONE. (THESE ALSO MAKE GREAT EXTENTIONS IF YOU REMOVE IT USING A HEX WRENCH WITH A HOLE IN THE MIDDLE ON THE CENTER SCREW!)--(THESE FONES FOR THE BENEFIT OF THOSE WHO DON'T KNOW ARE BLUE WITH NO COIN SLOTS) 5. USE A PAY FONE THAT WANTS YOUR MONEY BEFORE THE DIAL TONE. PUT IN YOUR DIME, DIAL THE #; IF IT'S AN 800 # THEN YOUR DIME WILL COME BACK, IMMEDIATELY PUT A DIME BACK IN (IT'LL COME BACK WHEN YOU HANG UP!) IF IT IS A TONE FIRST FONE AND IT DISCONNECTS THE KEYPAD (SOME DON'T) THEN FIND ANOTHER FONE. TELCO TRACING THE GOOD 'OL DAYS: ------------------ WAY BACK BEFORE I WAS A PHREAK, MA BELL WOULD HAVE TO MANUALLY TRACE A CALL IF THEY THOUGH SOMETHING WAS FUCKED UP. FIRST THEY WOULD SEND A 2000 HZ TRACING TONE, THE WOULD BE FOLLOWED B ALOT OF NOISE AND CLICKS. IT TOOK ABOUT 2-3 MINUTES TO TRACE A CALL AND ALOT OF PEOPLE WERE INVOLVED IN THE PROCESS. SO AT 1 IN THE MORNING THEY WOULD HAVE TO WAKE UP PEOPLE FOT THE TRACEES (PHREAK JARGON FOR A PAY FONE). BUT NEVER USE THE SAME ONE MORE THAN ONCE OR TWICE BECAUSE THE GESTAPO(ER..EXCUSE ME MEAN BELL SECURITY) HAS BEEN KNOW FOR STAKING OUT TROUBLED FORTRESSES. IT'S ALSO POSSIBLE FOR TRAVELNET OR SP TO ASK FOR A TROUBLE # BUT THE TELCO IS SLOW IN PROCESSING STUFF--ESPECIALLY FOR THE COMPETITION--SO DON'T FRET PHELLOW PHREAKS. MODERN TECHNOLOGY: ------------------ THIS CAN BE ATTRIBUTED TO ESS + CCIS WHICH CAN BE TRACED IN 1 SECOND. MISCELLANEOUS STUFF HERE ARE A PHEW (PUSHING IT ON THAT WORD) BITS OF INFO ON TELEPHONE ELEC- TRONICS. IF YOU DON'T APPRECIATE IT THEN I SAY PHUCK U. VOLTAGES: WHEN YOUR FONE IS ON-HOOK (IE-HUNG UP) THERE IS A 48 VOLT DC CURRENT FLOWING THROUGH THE LINE ( I HAVE A GREAT IDEA ABOUT HOOKING A BATTERY CHARGER UP TO MY FONE ). WHEN THE FONE IS OFF-HOOK THE VOLTAGE DROPS DOWN TO AROUND 15VDC. THE BLACK BOX (SEE SEPARATE ARTICLES) EXPLOITS THIS FOR FREE CALLS SINCE BELL USES THIS VOLTAGE DROP WHEN THE CALLED PARTY PICKS UP TO START BILLING. BELL MAY ALSO REVERSE THE POLARITY OF THE LINE TO START BILLING--IF YOU HAVE A TONE FONE THE KEYPAD WON'T WORK IF THE POLARITY IS REVERSED. USUALLY, THE RED WIRE IS CALLED THE TIP SINCE IT IS THE MORE (+) OF THE 2 WIRES + THE GREEN WIRE IS CALLED THE RING (-). RING TRIP: WHEN SOMEONE CALLS YOU BELL HAS TO SEND 90 VOLTS AC DOWN YOUR LINE AT ABOUT 60 HZ TO ACTIVATE YOUR BELL (THIS IS WHY DEAF PEOPLE CAN HAVE LIGHT BULBS FANS GO OFF INSTEAD OF A BELL). THE DEVICE THAT DOES THE RINGING IS CALLED A RINGING GENERATOR ANDTH PROCESS OF RINGING IS CALLED A RING TRIP. THIS COSTS BELL MONEY AND THEY DON'T LIKE USING ALL THAT ELECTRICITY FROM THE LOCAL RIP-OFF POWER COMPANY- SO LET IT RING. THIS IS ALSO, HOW BELL CAN CHECK FOR EXTRA FONES FROM THEIR CENTRAL OFFICE BY SEEING HOW MUCH VOLTAGE THE LINE TAKES WHILE RINGING AND THEY CAN TELL HOW MANY FONES YOUR NOT SUPPOSE TO HAVE. SOLUTION: DISCONNECT THE BELL. MODERN TECHNOLOGY: ------------------ THE 2 WORST ENEMIES TO THE PHREAK BESIDES THE FBI + BELL SECURITY,ARE: ESS + CCIS. ESS STANDS FOR ELECTRONIC SWITHCING SYSTEM AND IT CAN TRACE A CALL IN SECONDS, IT ALSO RECORDS ALL CALLS AND CAN EVEN TAP INTO LINES (ER.. I MEAN CHECK FOR LINE QUALITY) AND RECORD CALLS. CCIS STANDS FOR COMMON CHANNEL INTER-OFFICE SIGNALING AND IT ALLOWS FOR CONTROL SIGNALS TO BE SENT VIA SEPARATE DATA LINKS INSTEAD OF TONES OVER THE VOICE CHANNEL--START KISSING YOUR BLUE BOX GOODBYE. SOURCES: -------- FOR THOSE OF YOU WHO WANT TO GO MORE IN-DEPTH ON THE SUBJECT OF SHIT, I RECOMMEND THE FOLLOWING READING MATERIAL: 1) ELECTRONICS COURCES A-B, TAP, ROOM 603, 147 W. 42 ST., NY, NY 10036. @ 75 CENTS EA. 2) UNDERSTANDING TELEPHONE ELECT.'S, TEXAS INSTRUMENTS, RADIO SHACK MAY HAVE IT. 3) A MULTITESTER + YOUR FONE FOR YOUR OWN EXPERIMENTING. 4) MISC. INFO FROM SEVERAL SOURCES MAKE FRIENDS + GET YOUR OWN CONNECTIONS. *****BIOC AGENT 003 *****PHREAK ADVISOR OF PIRATE TREK *914-634-1268 *******BIOC AGENT 003'S COURSE IN****** * * * ========================== * * =BASIC TELECOMMUNICATIONS= * * ========================== * * PART I * * * *************************************** PREFACE: -------- IN THIS COURSE, I PLAN TO COVER AS MUCH MATERIAL AS POSSIBLE RELATING TO TELE- COMMUNICATIONS. FIRST, IN THE SYLLABUS ARE THE LONG-DISTANCE SERVICES, WHICH IS THE TOPIC OF PART I. IN FUTURE ISSUES, SUCH SUBJECTS AS THE BELL NETWORK, COLORED BOXES, TELEPHONE ELECTRONICS, CENTRAL OFFICE EQUIPMENT, COMPUTER HACKING, AND MUCH, MUCH MORE WILL BE COVERED. LONG-DISTANCE SERVICES: ----------------------- IN AN ATTEMPT TO OFFER LOWER PRICES, ALTERNATIVES TO BELL HAVE BEEN SET UP. SERVICES SUCH AS SPRINT, METROFONE, ITT, MCI, TRAVELNET, AND MANY OTHERS ARE ALL FAMILIAR TO US. THE BASIS OF ALL THESE SERVICES ARE THAT THEY OWN THEIR OWN SWITCHING EQUIPMENT. FIRST, WE WILL LOOK AT THOSE SERVICES WHICH USE A LOCAL DIAL-UP. THE PRINCIPLE OF THESE ARE: 1) YOU DIAL THE LOCAL #. 2) WHEN IT PICKS UP YOU GET A 2ND DIAL TONE, YOU THEN ENTER A CODE. 3) YOU THEN ENTER THE # AND WHALLA, YOU'RE CONNECTED, A FREE CALL! NEXT, WE WILL LOOK AT SEVERAL OF THE SERVICES: SPRINT: ------- SPRINT, ALSO KNOWN AS SPC, WAS ONE OF THE FIRST LD SERVICES. MANY BOARDS CONTAIN SPC #'S AND I PLAN TO INCLUDE A LIST OF THEM AS AN APPENDIX TO THIS COURSE SO YOU CAN FIND YOUR LOCAL #. THE CODES FOR SPC ARE 8 DIGITS LONG. SPC IS NOT CONSIDERED SAFE, SINCE MANY PEOPLE HAVE BEEN BUSTED ON IT! IT IS COMMON KNOWLEDGE THAT SPRINT HAS DECLARED WAR ON PHONE PHREAKS. SO, FIGHT BACK (WITH CARE)! [914 DIAL-UP--> (914) 997-1616] METROFONE: ---------- METROFONE, OWNED BY WESTERN UNION, IS VERY POPULAR AMONG PHONE PHREAKS DUE TO THE LARGE ABUNDANCE OF CODES AND IT (AT THE TIME OF THIS WRITING) IS CONSIDERED FAIRLY SAFE. THE CODE IS 6 DIGITS LONG. TO FIND OUT THE LOCAL DIAL-UP FOR YOUR AREA, JUST CALL (800) 325-1403 AND ASK THE "NICE LADY" FOR THE # FOR YOUR AREA. FORMAT: AT TONE--> CODE+AREA CODE (NPA)+DESTINATION # NOTE: NPA & A/C ARE ABBREVIATIONS FOR AREA CODE. ITT: ---- ITT IS A LITTLE DIFFERENT IN THAT UPON HEARING THE DIAL TONE AFTER CALLING THE LOCAL ACCESS #, YOU ENTER THE A/C AND THEN THE #. YOU WILL THEN HEAR A SHORT TONE, YOU THEN IMMEDIATELY ENTER YOUR 7 DIGIT ACCESS CODE. [DIAL-UPS:(212)248-0151, (914)997-8576] FORMAT: AT TONE, DESTINATION # + 7 DIGIT ACCESS CODE. MCI: ---- FORMAT: AT TONE, 5 DIGIT ACCESS CODE + DESTINATION #. MCI CREDIT CARD (MCI CC): ------------------------- FORMAT: AT TONE, 7 DIGIT ACCESS CODE + DESTINATION #. [212 DIAL-UP: 248-0151] NOTE: YOU CAN USUALLY CALL UP THE COMPANIES CUSTOMER SERVICE #, AND SAY YOU JUST MOVED OR SOMETHING AND ASK FOR THE ACCESS # FOR YOUR AREA CODE. TO FIND OUT THE CUSTOMER SERVICE # CALL DIR. ASST. AT (800) 555-1212. ============== =950 EXCHANGE= ============== THE 950 EXCHANGE IS A NATIONWIDE ACCESS EXCHANGE, IN MOST AREAS, THAT INCLUDES SUCH SERVICES AS SKYLINE, LEXITEL, ALLNET AND OTHERS. ALL SERVICES ON THIS EXCHANGE ARE CONSIDERED DANGEROUS DUE TO THE FACT THAT THEY HAVE THE TRACED! SKYLINE: -------- SBS SKYLINE IS A NEW SERVICE OWNED BY IBM, COMSAT AND AETNA. IT HAS THE SAME LOCAL ACCESS # ACROSS THE COUNTRY: 950-1088. IT IS SUPPOSED TO HAVE 6 (POSSIBLY 8) DIGIT CODES AND IS ALLEGED TO BE VERY DANGEROUS. ALLNET: ------- ALLNET IS AT 950-1044. IT HAS 6 DIGIT CODES. =============== =CALLING CARDS= =============== CALLING CARDS ARE BELL'S VERSION OF SPRINT, MCI, ETC. CALLING CARDS ARE USED PRIMARILY FROM PAY FONES. THE FORMAT IS: NPA-NXX-XXXX-CCCC NPA IS USUALLY THE A/C OF THE BILLED # THAT THE CALL IS TO BE BILLED TO. THIS MAY BE REPLACED BY A 3 DIGIT RAO CODE IN SOME AREAS. NXX-XXXX IS THE NUMBER THAT THE CALL IS TO BILLED TO. CCCC IS A CHECKCODE (OR PIN--PERSONAL IDENTIFICATION NUMBER) THAT ADDS THE SECURITY TO CALLING CARDS. THE CODES USED TO BE PREDICTABLE UNTIL 1983. NOW CCCC APPEARS TO BE SEQUENTIALLY GENERATED SO THE CODES CANNOT BE CALCULATED FROM A FORMULA! THE EASIEST WAY TO FIND THESE CODES ARE IN A BUSY AIRPORT OR COLLEGE WHERE THEY ARE USED ALOT. JUST GET CLOSE AND COPY DOWN SOMEONES CODE (IF YOU ARE THAT UNSCRUPULOUS!) DON'T RIP OFF POOR PEOPLE; GO FOR THE RICH BUSINESS PIGS! YOU USUALLY CALL THE OPERATOR TO MAKE A CC CALL BUT ON SOME FORTRESS FONES, YOU CAN DIAL 0+THE NUMBER YOU WANT TO CALL AND YOU WILL GET A RECORDING & TONE WHERE YOU ENTER YOUR CALLING CARD #. BY PRESSING THE # SIGN (OCTOTHORPE) AFTER EACH CALL INSTEAD OF HANGING UP, YOU CAN MAKE MANY CALLS AT ONCE WITHOUT HAVING TO RETYPE THE CC # EACH TIME. THIS IS GOOD FOR BUSY NUMBERS. ALSO, IF YOU WANT TO CALL THE # OF THE CARD, IE THE BILLED #, YOU JUST HAVE TO ENTER THE LAST 4 DIGITS OF THE CC # AT THE TONE. NOW, SUPPOSE YOU DO GET A REAL OPERATOR. SINCE MOSTLY BUSINESS PEOPLE USE CALLING CARDS, IT IS SUGGESTED THAT YOU ACT A LITTLE LIKE A BUSINESS PERSON, IE, RUSHED, OLDER, BUSINESSLIKE, AND SLIGHTLY PISSED AT THE OPERATOR (KEYWORD: SLIGHTLY). ALL YOU HAVE TO TELL HER IS THE CC #. IF SHE ASKS FOR THE # YOU ARE CALLING FROM, TELL HER, BUT CHANGE THE LAST DIGIT OR 2. IF YOU ASKS YOU MORE QUESTIONS, SHE IS PROBABLY SUSPICIOUS. HANG UP. ALTHOUGH, YOU SHOULD MAKE UP SOME ANSWERS TO CERTAIN QUESTIONS TO SATISFY THE OPERATOR THAT YOU ARE LEGIT. THE MOST IMPORTANT THING YOU SHOULD KNOW WHEN MAKING A CC CALL IS THE AREA CODE AND THE CITY OF THE CARD. FINALLY, IN CASE THE OPERATOR IS LISTENING, ALWAYS TALK BUSINESSLIKE FOR THE FIRST FEW SECONDS UNTIL THE OPERATOR CLICKS OFF (THEY HAVE BEEN KNOWN TO LISTEN IN ON CALLS (UNDERSTATEMENT)). ALSO, ALWAYS USE CC'S FROM PAY FONES OR CHARGE-A-CALL FONES ONLY! CAUTION: ALL THE CC CODES ARE NOW RAPIDLY CHECKED DUE TO CCIS (COMMON CHANNEL INTER-OFFICE SIGNALING) AND ESS (ELECTRONIC SWITCHING SYSTEM) IF YOU TRY TO HACK CC CODES YOU CAN BE FAIRLY SURE THAT BELL SECURITY (AFFECTIONATELY KNOWN AS THE GESTAPO IN THE PHREAKING WORLD) WILL GET A MESSAGE FROM THE CO (CENTRAL OFFICE, IE, EXCHANGE)! ============== =800 SERVICES= ============== YOU ARE PROBABLY ALL FAMILIAR WITH WATS. WATS #'S (WIDE AREA TELEPHONE SERVICE, OTHERWISE KNOWN AS 800 #'S) ARE VERY POPULAR DUE TO THE FACT THAT THEY ARE TOLL-FREE. THEY OFTEN CONTAIN WATS EXTNEDERS. EXTENDERS WERE ORIGINALLY USED BY SALESMEN IN THE FIELD WHO CALLED UP THEIR COMPANY'S 800 # (INWATS #) AND THEN USED THE COMPANY'S LOW-PRICED OUTWATS LINE TO MAKE THE CALL. THIS IS CHEAPER TO THE COMPANY THAN USING THE BELL CALLING CARD WHICH HAS A SURCHARGE. ON THE ORIGINAL EXTENDERS THERE WERE NO CODES! COMPANIES SOON REALIZED THAT THEIR #'S WERE BEING USED AND ADDED THE PRESENT DAY SECURITY CODES. THE SALESMAN WOULD THEN DIAL THE 800 NUMBER AND ENTER THE CODE (USUALLY 4 DIGITS), HE WOULD THEN RECEIVE A SECOND DIAL TONE FROM THE COMPANIES PBX (PRIVATE BRANCH EXCHANGE - THEIR OWN SWITCHING EQUIPMENT - IE, SWITCHBOARD). HE WOULD THEN ACCESS THE OUTWATS LINE BY DIALING 8 OR 9 AND THEN THE #. THESE CODES WERE ORIGINALLY HAND-HACKED, BUT SOME PIONEER PHREAK ADDED AN INTERFACE TO CHARLIE, HIS APPLE II COMPUTER, WHICH WAS CAPABLE OF GENERATING DTMF TONES (DUAL-TONE-MULTI-FREQUENCY - IE, GENERIC TERM FOR TOUCH-TONE (TM)) AND TRYING ALL THE CODES. THE ONLY PROBLEM WAS THAT MA BELL GOT SUSPICIOUS WHEN THEY SAW THAT SOMEONE CALLED THE JOE BLOW RUBBER COMPANY 800 # IN CALIFORNIA 4,568 TIMES AT 2 AM AND EACH CALL LASTED FOR ONLY 1 SECOND! TRAVELNET: ---------- TRAVELNET IS A SERVICE THAT USES WATS AS WELL AS LOCAL ACCESS #'S. THE 800 # IS (800) 521-8400. AFTER THE TONE, ENTER THE 8 DIGIT CODE, IF THE CODE WAS RIGHT YOU'LL GET A SECOND TONE, THEN ENTER THE AREA CODE AND NUMBER. TRAVELNET IS ALSO UNIQUE IN THAT IT ACCEPTS VOICE RECOGNITION FOR THOSE TIMES WHEN A TOUCH-TONE IS NOT AVAILABLE (HOW CONVINIENT!). IF YOU DON'T DO ANYTHING AFTER THE TONE, YOU WILL HEAR A VOICE THAT SAYS, "AUTHORIZATION #, PLEASE." YOU THEN SAY EACH DIGIT SLOWLY. IT WILL BEEP AFTER YOU SAY EACH DIGIT. AFTER EACH GROUP OF DIGITS, IT WILL REPEAT WHAT YOU HAVE SAID. SAY YES IF IT IS RIGHT, OTHERWISE, SAY NO. IF THE AUTHORIZATION CODE IS CORRECT, IT WILL SAY THANK YOU AND IT'LL THEN ASK FOR THE DESTINATION #. FOLLOW THE SAME PROCEDURE AS ABOVE. THE VOICE SYSTEM IS VERY USER FRIENDLY AND YOU SHOULD HAVE NO PROBLEMS WITH IT. TEL-TEC: -------- TEL-TEC IS AT (800) 323-3026. IN MY EXPERIENCES, YOU USUALLY GET A VERY SHITTY CONNECTION. THIS I USE FOR LAST RESORTS. FORMAT: 6 DIGIT CODE + DEST. # CAUTION: LIKE THE 950 EXCHANGE, 800 NUMBERS CAN BE EASILY TRACED. THIS DOESN'T MEAN THAT THEY TRACE EVERYTHING, THOUGH. OTHERS: ------- THERE ARE MANY OTHER 800 SERVICES AND PBX'S (SUCH AS THE DIMENSION 2000 AT 800-848-9000). THERE IS JUST NOT ENOUGH ROOM TO DISCUSS THEM ALL. AS YOU HAVE PROBABLY NOTICED, I HAVE POSTED NO CODES. CHECK THE PHREAK SECTION OF VARIOUS BBS'S TO FIND THE LATEST CODES OR HACK THEM YOURSELF. HAND-HACK GOOD POSSIBILITIES OR USE A "SMART" MODEM WITH A HACKING PROGRAM (CONTACT YOUR LOCAL PIRATE). HOW MA BELL CATCHES PHONE HACKERS: ---------------------------------- BESIDES SUSPICION AND RANDOM CHECKS, MA BELL SETS UP "TRAP NUMBERS". TRAP NUMBERS WERE SET UP ON CERTAIN DIAL-UPS SUCH AS SPRINT, MCI, ETC. WHENEVER, THE DIAL-UP IS CALLED A "TROUBLE CARD" IS DROPPED AT THE CENTRAL OFFICE. THIS MEANS THAT A RECORD OF THE CALLED #, THE CALLERS #, AND TIME ARE PRINTED OUT. THESE CARDS (OR PRINTOUTS IN AN ESS CO) ARE USUALLY IGNORED UNLESS SPC OR SOMEBODY DETECTS FRAUD, IE, UNAUTHORIZED USE OF A CUSTOMERS ACCT., THEN THEY CALL BELL AND FIND OUT THE NAME AND NUMBER AND INSTANTLY NAIL THE PHREAK WHO MADE THE CALL. THEY WILL THEN EITHER DEMAND THAT YOU PAY SOME ENORMOUS FEE AND THEY'LL FORGET THE WHOLE MATTER; GIVE THEM INFO ON OTHER PHREAKS, BOARDS, ETC.; OR PROSECUTE YOU ON THE FEDERAL RAP OF THEFT OF COMMUNICATIONS SERVICE, WHICH CARRIES FINES OF UPTO 10 YEARS IN JAIL AND/OR $10,000. THEY USUALLY DON'T GO FOR LEGAL ACTION FIRST, THOUGH. WHY DOES BELL HELP THEIR COMPETION? ACTUALLY, IT IS RATHER SIMPLE. PEOPLE WERE USING SPRINT TO BREAK INTO BELL'S ESS COMPUTERS. BELL COULD ONLY TRACE THE CALL BACK TO SPRINT. SO, SPRINT HELPS BELL CATCH THE PEOPLE IT WANTS AND VISA-VERSA. ("YOU RUB MY BACK AND I'LL RUB YOURS" TYPE OF DEAL.) BY THE WAY, TRAP NUMBERS ARE ALSO HOW BELL CATCHES PEOPLE WHO MAKE HARRASING PHONE CALLS TO PRIVATE RESIDENCES. FINALLY, DO NOT FORGET THAT THESE SERVICES HAVE A COPY OF THE NUMBER THAT YOU CALLED. SO, IF A CUSTOMER SAYS HE DIDN'T CALL A CERTAIN #, THEY WILL USUALLY CALL UP THAT # AND TRY TO FIND OUT WHO DID CALL AT THAT TIME. SO, TO BE SAFER ON SPC, MCI, AND OTHERS, FOLLOW THE FOLLOWING SUGGESTIONS: 1) USE A FORTRESS FONE (PAY FONE) WHENEVER POSSIBLE. ALTHOUGH, THEY HAVE BEEN KNOW TO STAKE OUT PAY FONES. JUST DON'T USE THE SAME FONE OVER AND OVER AGAIN. IN OTHER WORDS, MOVE AROUND. 2) ONLY CALL INSTITUTIONAL SWITCHBOARDS, BUSINESS THAT HAVE NO RECORD OF YOUR CALL, AND FRIENDS WHO ARE INSTANT AMNESIACS. 3) TRY TO KEEP ALL CALLS UNDER 15 MINUTES WHEN POSSIBLE. NOTE: NO SYSTEM IS TOTALLY SAFE! WHEN I CLASSIFY SOMETHING AS SAFE OR DANGEROUS, THAT IS JUST WITH RESPECT TO MY OPINION AS WELL AS THAT OF SEVERAL OTHER PHREAKS. THESE OPINIONS ARE BASED ON HOW MANY PEOPLE HAVE BEEN BUSTED ON THEM, WHAT TYPE OF EQUIPMENT THEY ARE USING, AND INSIDE INFORMATION. I CANNOT POSSIBLY GUARANTEE THAT YOU WILL OR WILL NOT GET CAUGHT. ACTUALLY, WITH CCIS AND ESS NOTHING IS REALLY SAFE ANYMORE. BESIDES, WHAT PHUN WOULD THERE BE IN LIFE WITHOUT RISKS! COMING SOON: ------------ IN PART II, WE WILL LOOK AT THE SPECIAL BELL NUMBERS SUCH AS CN/A, ATT NEWSLINES, LOOPS, ANI, RINGBACK, AND 99XX SCANNING. UNTIL NEXT TIME, I WOULD LIKE TO LEAVE YOU WITH A QUOTE FROM THE MAGICIAN: "MANY PEOPLE THINK OF PHONE PHREAKS AS SLIME, OUT TO RIP OFF BELL FOR ALL SHE IS WORTH. NOTHING COULD BE FURTHER FROM THE TRUTH! GRANTED, THERE ARE SOME WHO GET THEIR KICKS JUST BY MAKING FREE CALLS, HOWEVER THEY ARE NOT TRUE PHONE PHREAKS. REAL PHONE PHREAKS ARE "TELECOMMUNICATIONS HOBBYISTS" WHO EXPERIMENT, PLAY WITH AND LEARN FROM THE PHONE SYSTEM. OCCASIONALLY THIS EXPERIMENTING, AND A NEED TO COMMUNICATE WITH OTHER PHREAKS (WITHOUT GOING BROKE), LEADS TO FREE CALLS. THE FREE CALLS ARE BUT A SMALL SUBSET OF A TRUE PHONE PHREAKS ACTIVITIES." HAVE PHUN, *****BIOC *=$=*AGENT *****003 NOVEMBER 15, 1983 NOTE: THIS ARTICLE WAS WRITTEN IN UPPER & LOWER CASE. PS: PLEASE FEEL FREE TO LEAVE ANY CORRECTIONS, ADDITIONS,COMMENTS, AND/OR THREATS. PPS: OTHER BBS SYSOPS ARE WELCOME TO POST THIS MATERIAL ON THEIR BOARDS PROVIDING THAT THEY DON'T CHANGE ANYTHING. <*-------------------------------------*> Aug. 1987 I think it's worth noting that the Bi