Section 2 - Phreaks & Phreaking

2.0 Phreaking

Phreak's are people who enjoy learning about the phone system, especially the technical details, and the unpublished details that phone companies would rather we didn't know about. Phreak's are also interested in the workings of the phone company, and trying find ways around the system, often the billing and accounting procedures.

A major part of Phreaking is attempting to obtain phone calls for free or below the rate at which the phone company would like to charge. The alt.ph.uk news group is not here to teach people how to defraud phone companies though, and most of the discussion is likely to be of purely technical interest.

2.1.0 Boxing

Phreaks may also be interested in 'boxes', there are many types of boxes which have varying degrees of success, boxes are usually categorised by colour and offer a variety of facilities from seizing operator control of the line, and hence calling for free (Blue Box) and stopping calling party being billed (Black Box) to a charging ni-cads with your phone (Chartreuse Box), also various other add-ons such as amps, hold buttons, in use lights etc.

2.1.1 Which boxes work in UK

This list of boxes stolen from the alt.2600 FAQ and converted for the uk (this is just an 'educated' guess of what will or will not work in the uk, this is only in *theory* and any which I say will work will probably need a lot of modification to work, that's if you can find a schematic thats half way readable :) )

Acrylic  Steal Three-Way-Calling, Call Waiting and programmable

         Call Forwarding on old 4-wire phone systems                    NO!

Aqua     Drain the voltage of the FBI lock-in-trace/trap-trace          NO!

Beige    Linemans handset                                               YES

Black    Allow callers to dial in for free                              NO

Blast    Phone microphone amplifier                                     YES

Blotto   Supposedly shorts every fone out in the immediate area         JOKE

Blue     Take operator control of a line (phone for free)               NO

Brown    Create a party line from 2 phone lines                         YES

Bud      Tap into your neighbors phone line                             YES

Chartreuse   Use the electricity from your phone line                   YES

Cheese   Connect two phones to create a diverter                        YES

Chrome   Alter traffic lights                                           NO

Clear    A telephone pickup coil and a small amp used to make free      NO!

         calls on Fortress Phones

Color    Line activated telephone recorder                              YES

Copper   Cause crosstalk interference on an extender                    ???

Crimson  Hold button                                                    YES

Dark     Re-route outgoing or incoming calls to another phone           NO!

Dayglo   Connect to your neighbors phone line                           YES

Divertor Re-route outgoing or incoming calls to another phone           NO!

DLOC     Create a party line from 2 phone lines                         YES

Gold     Dialout router                                                 ???

Green    Emulate the Coin Collect, Coin Return, and Ringback tones      NO!

Infinity Remotely activated phone tap                                   YES

Jack     Touch-Tone key pad                                             YES

Light    In-use light                                                   YES

Lunch    AM transmitter                                                 YES

Magenta  Connect a remote phone line to another remote phone line       NO!

Mauve    Phone tap without cutting into a line                          ???

Neon     External microphone                                            YES

Noise    Create line noise                                              YES

Olive    External ringer                                                YES

Party    Create a party line from 2 phone lines                         YES

Pearl    Tone generator                                                 YES

Pink     Create a party line from 2 phone lines                         YES

Purple   Telephone hold button                                          YES

Rainbow  Kill a trace by putting 120v into the phone line (joke)        JOKE

Razz     Tap into your neighbors phone                                  YES

Red      Free calls from payphones                                      YES

Rock     Add music to your phone line                                   YES

Scarlet  Cause a neighbors phone line to have poor reception            YES

Static   Keep the voltage on a phone line high                          YES

Switch   Add hold, indicator lights, conferencing, etc..                ???

Tan      Line activated telephone recorder                              YES

Tron     Reverse the phase of power to your house, causing

         your electric meter to run slower                              ???

TV Cable "See" sound waves on your TV                                   ???

Urine    Create a capacitative disturbance between the ring and

         tip wires in another's telephone headset                       ???

Violet   Keep a payphone from hanging up                                NO!

White    Portable DTMF keypad                                           YES

Yellow   Add an extension phone                                         YES

Any of the above the generate tones will have to be modified

DOES ANYONE FANCY KEEPING THIS LIST (+ WORKING DIAGS) UP TO DATE. IT WOULD MAKE A VERY VALUABLE RESOURCE

2.1.2 What are the UK DTMF tones


             1209Hz     1336Hz     1477Hz     1633Hz

697Hz          1          2          3          A

770Hz          4          5          6          B

852Hz          7          8          9          C

941Hz          *          0          #          D

(See the comp.dcom.telecom FAQ for an explanation of the ABCD tones) ( Taken from the Uk.Telecom FAQ )

2.2 War-Dialling

War-Dialling (aka scanning) is the practise of repetitively dialling phone numbers, to find out what is on the other end. These are mainly voices, although sometimes you may find trunks, carriers (modems), VMBs, FAXs, and other strange stuff. 'Tone-Loc' is a highly acclaimed package to aid scanning. Normally you scan a block of numbers (the most common scans are of 0800 / 0500 because they're free) and keep a log of anything interesting you find for later attention. Scanning may be illegal under the computer misuse act See Section 4.2

2.3 Loops

See the alt.2600 FAQ for an explanation of what loops are and how the can be used. There are virtually no known loops in the UK, mainly because if the do exist, no one scans for them (because unlike the US, BT don't offer free local calls, so scanning is limited to 0800/0500 numbers. ).

2.4 How are 0800/0500 numbers used ?

You pickup the phone, dial the number, and wait for them to answer :-). Other than that they're used in blue boxing, using calling cards, finding modems and voicemail/PABX abuse. The reason the get a lot of attention from phreaks is they are FREE !

2.4.1 What are the 0800 89xxxx numbers for ?

They are direct overseas lines (known as country direct numbers), most will ask you for pin numbers. BTs originally lumped all it direct overseas lines in this area, but it has now realised this wasn't such a good idea and is distributing them more evenly.

Mercury's country direct numbers are evenly distributed through out the 0500 xxxxxx range.

Country direct numbers are numbers which forwards calls to a regular number in the remote country. I believe these numbers are arranged with your local Telco, who rent a number of 0800/0500 lines from BT/Mercury and pay BT/Mercury for incoming calls over them. The remote telco then resells these numbers to company's requiring a toll-free number from the UK. You are not charged for the call, the company you reach is paying for the call, as with all 0800/0500 numbers.

The UK.Telecom FAQ gives a method of obtain a list of US companies with UK 0800 numbers from AT&T

[ Has anyone tried this ? ]

2.5 What is Voicemail (vmb) and what can I do with it ?

VMB (Voice Mail Boxes) are used by company to help manage internal phone systems. They offer a range of services from personal answer phones to internal routing of calls. One facility often abused is the ability to get an outside line.

Try reading ColdFire's guide to Meridian Mail, the address of his web page can be found in section 5. Details of other VMBs are around, but Im not sure where to find them on the net.

2.6 Are there UK CNA Numbers ?

CNA stands for customer name and addresses. A CNA number is a phone number for telephone company personnel to call and get the name and address for a phone line BT do have their own internal service, but AFAIK there are none available to the public (unlike the US).

2.7 Are there any UK numbers that always ring busy / never answer ?

[ More info on this would be appreciated ]

2.8 What is caller ID and what can I do with it ?

On modern exchanges BT sends the phone number of the number that called you (when possible), just before the first ring. BT will sell you a device to read these (approx 50quid ?). Home-brew (obviously non BT Approved) are around. You also have to pay BT for the recieving the data [amount ?]

You can block the sending of your phone number you are dialling by prefixing it with 141. Your also have the number of the last person who called (from a phone that supplies caller ID) by dialing 1471 (on some exchanges this number can be automatically redial by dialing 1474)


Section 1, 3, 4, 5, 6