THE PHR REAKEAKERERS’S’ RECIPE BOBOOOKK THE PHREAKERS’ RECIPE BOOK AN ANALOG LOVE STORY 002 PHREAKERS' RECIPE BOOK スタ 魔 ジオ 悪 :: :: : : 䜹
I 䜿
䝲
䝍 䝕
܈
䵼
Ⴭ
ᛙ
䝅
ON 䝔
䝲
䞒 WERKS®
䝯
䞘
і
䞑
䝌
䞃 䝉 䝑 䝮
PHREAKERS’ RECIPE BOOK 003
スタ 魔 ジオ 悪 :: :: : : 䜹
I 䜿
䝲
䝍 䝕
܈
䵼
Ⴭ
ᛙ
䝅
ON 䝔
䝲
䞒 WERKS®
䝯
䞘
і
䞑
䝌
䞃 䝉 䝑 䝮
FIRST INTERNATIONAL EDITION, SEPTEMBER 2017
Copyright © 2017 by Édition Delince Incorporated. All rights reserved under International and Pan-American Copyright.
Published in the United States by Édition Delince Incorporated, Miami Florida USA.
Édition Delince ISBN: 978-1-944556-29-7
For information, address:
ONIWERKS PO BOX 61121 MIAMI, FL 33261 USA
Published in The United States of America www.oniwerks.com
2 3 0 5 0 A 0 0 6 1
THE PHREAKERS’ RECIPE BOOK AN ANALOG LOVE STORY 008 PHREAKERS' RECIPE BOOK Recipes
PHREAKERS’ RECIPE BOOK 009 Aqua Box Plans by Jolly Roger
Every true phreaker lives in fear of the dreaded F.B.I. 'Lock In Trace.' For a long time, it was impossible to escape from the Lock In Trace. This box does offer an escape route with simple directions to it. This box is quite a simple concept, and almost any phreaker with basic electronics knowledge can construct and use it.
------The Lock In Trace ------
0010 PHREAKERS' RECIPE BOOK A lock in trace is a device used by the F.B.I. to lock into the phone users location so that he can not hang up while a trace is in progress. For those of you who are not familiar with the concept of 'locking in', then here's a brief description. The F.B.I. can tap into a conversation, sort of like a three-way call connection. Then, when they get there, they can plug electricity into the phone line. All phone connections are held open by a certain voltage of electricity.
That is why you sometimes get static and faint connections when you are calling far away, because the electricity has trouble keeping the line up. What the lock in trace does is cut into the line and generate that same voltage straight into the lines. That way, when you try and hang up, voltage is retained. Your phone will ring just like someone was calling you even after you hang up. (If you have call waiting, you should understand better about that, for call waiting intercepts the electricity and makes a tone that means someone is going through your line. Then, it is a matter of which voltage is higher. When you push down the receiver,
PHREAKERS’ RECIPE BOOK 0011 then it see-saws the electricity to the other side. When you have a person on each line it is impossible to hang up unless one or both of them will hang up. If you try to hang up, voltage is retained, and your phone will ring.
That should give you an understanding of how calling works. Also, when electricity passes through a certain point on your phone, the electricity causes a bell to ring, or on some newer phones an electronic ring to sound.)
So, in order to eliminate the trace, you somehow must lower the voltage level on your phone line. You should know that every time someone else picks up the phone line, then the voltage does decrease a little. In the first steps of planning this out, Xerox suggested getting about a hundred phones all hooked into the same line that could all be taken off the hook at the same time. That would greatly decrease the voltage level. That is also why most three-way connections that are using the bell service three way calling (which is only $3 a month) become quite faint after a
0012 PHREAKERS' RECIPE BOOK while. By now, you should understand the basic idea. You have to drain all of the power out of the line so the voltage can not be kept up. Rather sudden draining of power could quickly short out the F.B.I. voltage machine, because it was only built to sustain the exact voltage necessary to keep the voltage out. For now, imagine this. One of the normal Radio Shack generators that you can go pick up that one end of the cord that hooks into the central box has a phone jack on it and the other has an electrical plug. This way, you can “flash” voltage through the line, but cannot drain it. So, some modifications have to be done.
------Materials ------a) A BEOC (Basic Electrical Output Socket) like a small lamp-type connection, where you just have a simple plug and wire that would plug into a light bulb. b) One of cords mentioned above, if you can't find one then construct your own... Same voltage connection, but the
PHREAKERS’ RECIPE BOOK 0013 restrainer must be built in (I.E. The central box) c) Two phone jacks (one for the modem, one for if you are being traced to plug the aqua box into). d) Some creativity and easy work.
*Notice: No phones have to be destroyed/ modified to make this box, so don't go out and buy a new phone for it!
------Procedure ------
All right, this is a very simple procedure. If you have the BEOC, it could drain into anything: a radio, or whatever. The purpose of having that is you are going to suck the voltage out from the phone line into the electrical appliance so there would be no voltage left to lock you in with.
1) Take the connection cord. Examine the plug at the end. It should have only two prongs. If it has three, still, do not fear.
0014 PHREAKERS' RECIPE BOOK Make sure the electrical appliance is turned off unless you wanna become a crispy critter while making this thing. Most plugs will have a hard plastic design on the top of them to prevent you from getting in at the electrical wires inside. Well, remove it. If you want to keep the plug (I don't see why...) then just cut the top off. When you look inside, Lo and Behold, you will see that at the base of the prongs there are a few wires connecting in. Those wires conduct the power into the appliance. So, you carefully unwrap those from the sides and pull them out until they are about an inch ahead of the prongs. If you don't wanna keep the jack, then just rip the prongs out. If you are, cover the prongs with insulation tape so they will not connect with the wires when the power is being drained from the line.
2) Do the same thing with the prongs on the other plug, so you have the wires evenly connected. Now, wrap the end of the wires around each other. If you happen to have the other end of the voltage cord hooked into the phone, stop reading now, you're too fucking stupid to
PHREAKERS’ RECIPE BOOK 0015 continue. After you've wrapped the wires around each other, then cover the whole thing with the plugs with insulating tape. Then, if you built your own control box or if you bought one, then cram all the wires into it and re-close it. That box is your ticket out of this.
3) Re-check everything to make sure it's all in place. This is a pretty flimsy connection, but on later models when you get more experienced at it then you can solder away at it and form the whole device into one big box, with some kind of cheap Mattel hand-held game inside to be the power connector. In order to use it, just keep this box handy. Plug it into the jack if you want, but it will slightly lower the voltage so it isn't connected. When you plug it in, if you see sparks, unplug it and restart the whole thing. But if it just seems fine then leave it.
------Use ------
Now, so you have the whole thing plugged in and all... Do not use this unless the
0016 PHREAKERS' RECIPE BOOK situation is desperate! When the trace has gone on, don't panic, unplug your phone, and turn on the appliance that it was hooked to. It will need energy to turn itself on, and here's a great source...
The voltage to keep a phone line open is pretty small and a simple light bulb should drain it all in and probably short the F.B.I. computer at the same time.
Happy boxing and stay free!
------Jolly Roger
PHREAKERS’ RECIPE BOOK 0017 The Beige Box (Revision 2.0) by The Jolly Roger
------Introduction ------
Have you ever wanted a lineman’s handset? Surely every phreak has at least once considered the phun that he could have with one. After searching unlocked phone company trucks for months, we had an idea. We could build one. We did, and named it the "Beige Box" simply because that is the color of ours.
0018 PHREAKERS' RECIPE BOOK The beige Box is simply a consumer lineman’s handset, which is a phone that can be attached to the outside of a person’s house. To fabricate a beige Box, follow along.
------Construction and Use ------
The construction is very simple. First you must understand the concept of the device. In a modular jack, there are four wires. These are red, green, yellow, and black. For a single line telephone, however, only two matter: the red (ring) and green (tip). The yellow and the black are not necessary for this project. A lineman’s handset has two clips on it: the ring and the tip. Take a modular jack and look at the bottom of it’s casing. There should be a grey jack with four wires (red, green, yellow & black) leading out of it. To the end of the red wire attach a red alligator clip. To the end of the green wire attach a green alligator clip. The yellow and black wires can be removed, although I would only set them aside so that you can use the modular
PHREAKERS’ RECIPE BOOK 0019 jack in future projects. Now insert your telephone’s modular plug into the modular jack. That’s it. This particular model is nice because it is can be easily made, is inexpensive, uses common parts that are readily available, is small, is lightweight, and does not require the destruction of a phone.
------Beige Box Uses ------
There are many uses for a Beige Box. However, before you can use it, you must know how to attach it to the output device. This device can be of any of Bell switching apparatus that include germinal sets (i.e. remote switching centers, bridging heads, cans, etc.). To open most Bell Telephone switching apparatus, you must have a 7/16 inch hex driver (or a good pair of needle nose pliers work also). This piece of equipment can be picked up at your local hardware store. With your hex driver (or pliers), turn the security bolt(s) approximately 1/8 of an inch counter-clockwise and open. If your output device is locked, then you must
0020 PHREAKERS' RECIPE BOOK have some knowledge of destroying and/ or picking locks. However, we have never encountered a locked output device. Once you have opened your output device, you should see a mass of wires connected to terminals. On most output devices, the terminals should be labeled “T” (Tip -- if not labeled, it is usually on the left) and “R” (Ring -- if not labeled, usually on the right).
Remember: Ring - red - right. The “Three R’s” -- a simple way to remember which is which. Now you must attach all the red alligator clip (Ring) to the “R” (Ring) terminal. Attach the green alligator clip (Tip) to the “T” (Tip) terminal.
Note: If instead of a dial tone you hear nothing, adjust the alligator clips so that they are not touching each other terminals. Also make sure they are firmly attached. By this time you should hear a dial tone. Dial ANI to find out the number you are using (you wouldn’t want to use your own). Here are some practical applications:
> Eavesdropping
PHREAKERS’ RECIPE BOOK 0021 > Long distance, static free, free fone calls to phriends
> Dialing direct to Alliance Teleconferencing (also no static)
> Phucking people over
> Bothering the operator at little risk to yourself
> Blue Boxing with greatly reduced chance of getting caught
> Anything at all you want, since you are on an extension of that line.
------Eavesdropping ------
To be most effective, first attach the Beige Box then your phone. This eliminates the static caused by connecting the box, therefore reducing the potential suspicion of your victim. When eavesdropping, it is always best to
0022 PHREAKERS' RECIPE BOOK be neither seen nor heard. If you hear someone dialing out, do not panic; but rather hang up, wait, and pick up the receiver again. The person will either have hung up or tried to complete their call again. If the latter is true, then listen in, and perhaps you will find information worthy of blackmail! If you would like to know who you are listening to, after dialing ANI, pull a CN/A on the nu m b er.
------Dialing Long Distance ------
This section is self explanatory, but don’t forget to dial a “1” before the NPA.
------Dialing Direct to Alliance Teleconferencing ------
Simply dial 0-700-456-1000 and you will get instructions from there. I prefer this method over PBX’s, since PBX’s often have poor reception and are more difficult to come by.
PHREAKERS’ RECIPE BOOK 0023 ------Phucking People Over ------
This is a very large topic of discussion. Just by using the other topics described, you can create a large phone bill for the person (they will not have to pay for it, but it will be a big hassle for them). In addition, since you are an extension of the person’s line, you can leave your phone off the hook, and they will not be able to make or receive calls. This can be extremely nasty because no one would expect the cause of the problem.
------Bothering the Operator ------
This is also self explanatory and can provide hours of entertainment. Simply ask her things that are offensive or you would not like traced to your line. This also corresponds to the previously described section, Phucking People Over. After all, guess who’s line it gets traced to? He he he...
0024 PHREAKERS' RECIPE BOOK ------Blue Boxing ------
See a file on Blue Boxing for more details. This is an especially nice feature if you live in an ESS-equiped prefix, since the calls are, once again, not traced to your line...
------POTENTIAL RISKS OF BEIGE BOXING ------
Overuse of the Beige Box may cause suspicion within the Gestapo, and result in legal problems. Therefor, I would recommend you:
> Choose a secluded spot to do your Beige Boxing,
> Use more than one output device
> Keep a low profile (i.e., do not post under your real name on a public BBS concerning your accomplishments)
> In order to make sure the enemy has
PHREAKERS’ RECIPE BOOK 0025 not been inside your output device, I recommend you place a piece of transparent tape over the opening of your output device. Therefor, if it is opened in your absence, the tape will be displaced and you will be aware of the fact that someone has intruded on your territory.
Now, imagine the possibilities: a $2000 dollar phone bill for that special person, 976 numbers galore, even harassing the operator at no risk to you! Think of it as walking into an enemies house, and using their phone to your heart’s content.
------Jolly Roger
0026 PHREAKERS' RECIPE BOOK Black Box Plans by The Jolly Roger
------Introduction: ------
At any given time, the voltage running through your phone is about 20 Volts. When someone calls you, this voltage goes up to 48 Volts and rings the bell. When you answer, the voltage goes down to about 10 Volts. The phone company pays attention to this. When the voltage drops to 10, they start billing the person who called you.
PHREAKERS’ RECIPE BOOK 0027 ------Function: ------
The Black Box keeps the voltage going through your phone at 36 Volts, so that it never reaches 10 Volts. The phone company is thus fooled into thinking you never answered the phone and does not bill the caller. However, after about a half hour the phone company will get suspicious and disconnect your line for about 10 seconds.
------Materials: ------
1 1.8K 1/2 Watt Resistor 1 1.5V LED 1 SPST Switch
------Procedure: ------
(1) Open your phone by loosening the two screws on the bottom and lifting the c a s e o f f.
0028 PHREAKERS' RECIPE BOOK (2) There should be three wires: Red, Green, and Yellow. We’ll be working with the Red Wire.
(3) Connect the following in parallel:
A. The Resistor and LED. B. The SPST Switch.
In other words, you should end up with this:
(Red Wire)
!---/\/\/\--O--! (Line)-----! !-----(Phone) !-----_/_------! /\/\/\ = Resistor O = LED _/_ = SPST
------Use: ------
The SPST Switch is the On/Off Switch of the Black Box. When the box is off, your phone behaves normally. When the box is
PHREAKERS’ RECIPE BOOK 0029 on and your phone rings, the LED flashes. When you answer, the LED stays on and the voltage is kept at 36V, so the calling party doesn’t get charged. When the box is on, you will not get a dial tone and thus cannot make calls.
Also remember that calls are limited to half an hour.
------Jolly Roger
P.S. Due to new Fone Company switching systems & the like, this may or may not work in your area. If you live in bumfuck Kentucky, then try this out. I make no guarantees! (I never do...) ---- JR
0030 PHREAKERS' RECIPE BOOK Blue Box Plans courtesy of the Jolly Roger
To quote Karl Marx, blue boxing has always been the most noble form of phreaking. As opposed to such things as using an MCI code to make a free fone call, which is merely mindless pseudo-phreaking, blue boxing is actual interaction with the Bell System toll network. It is likewise advisable to be more cautious when blue boxing, but the careful phreak will not be caught, regardless of what type of switching system he is under.
In this part, I will explain how and why
PHREAKERS’ RECIPE BOOK 0031 blue boxing works, as well as where. In later parts, I will give more practical information for blue boxing and routing information. To begin with, blue boxing is simply communicating with trunks. Trunks must not be confused with subscriber lines (or “customer loops”) which are standard telefone lines. Trunks are those lines that connect central offices. Now, when trunks are not in use (i.e., idle or “on-hook” state) they have 2600Hz applied to them. If they are two-way trunks, there is 2600Hz in both directions. When a trunk IS in use (busy or “off-hook” state), the 2600Hz is removed from the side that is off-hook. The 2600Hz is therefore known as a supervisory signal, because it indicates the status of a trunk; on hook (tone) or off-hook (no tone). Note also that 2600Hz denoted SF (single frequency) signaling and is “in-band.” This is very important. “In- band” means that is within the band of frequencies that may be transmitted over normal telefone lines. Other SF signals, such as 3700Hz are used also. However, they cannot be carried over the telefone network normally (they are “out-of-band” and are therefore not able
0032 PHREAKERS' RECIPE BOOK to be taken advantage of as 2600Hz is. Back to trunks. Let’s take a hypothetical phone call. You pick up your fone and dial 1+806-258-1234 (your good friend in Amarillo, Texas). For ease, we’ll assume that you are on #5 Crossbar switching and not in the 806 area. Your central office (CO) would recognize that 806 is a foreign NPA, so it would route the call to the toll centre that serves you. [For the sake of accuracy here, and for the more experienced readers, note that the CO in question is a class 5 with LAMA that uses out-of-band SF supervisory signaling]. Depending on where you are in the country, the call would leave your toll centre (on more trunks) to another toll centre, or office of higher “rank”. Then it would be routed to central office 806-258 eventually and the call would be completed.
------Illustration ------
A---CO1------TC1------TC2----CO2----B
A.... you
PHREAKERS’ RECIPE BOOK 0033 CO1=your central office TC1.. your toll office. TC2.. toll office in Amarillo. CO2.. 806-258 central office. B.... your friend (806-258-1234)
In this situation it would be realistic to say that CO2 uses SF in-band (2600Hz) signaling, while all the others use out- of-band signal- ling (3700Hz). If you don’t understand this, don’t worry. I am pointing this out merely for the sake of accuracy. The point is that while you are connected to 806-258-1234, all those trunks from YOUR central office (CO1) to the 806- 258 central office (CO2) do *NOT* have 2600Hz on them, indicating to the Bell equipment that a call is in progress and the trunks are in use.
Now let’s say you’re tired of talking to your friend in Amarillo, so you send a 2600Hz down the line. This tone travels down the line to your friend’s central office (CO2) where it is detected. However, that CO thinks that the 2600Hz is originating from Bell equipment, indicating to it that you’ve hung up, and thus the trunks are once again idle (with
0034 PHREAKERS' RECIPE BOOK 2600Hz present on them). But actually, you have not hung up, you have fooled the equipment at your friend’s CO into thinking you have. Thus,it disconnects him and resets the equipment to prepare for the next call. All this happens very quickly (300-800ms for step-by-step equipment and 150-400ms for other equipment). When you stop sending 2600Hz (after about a second), the equipment thinks that another call is coming towards
--> on hook, no tone --> off hook.
Now that you’ve stopped sending 2600Hz, several things happen:
1) A trunk is seized.
2) A “wink” is sent to the CALLING end from the CALLED end indicating that the CALLED end (trunk) is not ready to receive digits yet.
3) A register is found and attached to the CALLED end of the trunk within about two seconds (max).
4) A start-dial signal is sent to the
PHREAKERS’ RECIPE BOOK 0035 CALLING end from the CALLED end indicating that the CALLED end is ready to receive digits.
Now, all of this is pretty much transparent to the blue boxer. All he really hears when these four things happen is a . So, seizure of a trunk would go something like this:
1> Send a 2600Hz 2> Terminate 2600Hz after 1-2 secs. 3> [beep][kerchunk]
Once this happens, you are connected to a tandem that is ready to obey your every command. The next step is to send signaling information in order to place your call. For this you must simulate the signaling used by operators and automatic toll-dialing equipment for use on trunks. There are mainly two systems, DP and MF. However, DP went out with the dinosaurs, so I’ll only discuss MF signaling. MF (multi-frequency) signaling is the signaling used by the majority of the inter- and intra-lata network. It is also used in international dialing known as the CCITT no.5 system. MF signals consist of
0036 PHREAKERS' RECIPE BOOK 7 frequencies, beginning with 700Hz and separated by 200Hz. A different set of two of the 7 frequencies represent the digits 0 through 9, plus an additional 5 special keys. The frequencies and uses are as follows:
Frequencies (Hz) Domestic Int’l ------700+900 1 1 700+1100 2 2 900+1100 3 3 700+1300 4 4 900+1300 5 5 1100+1300 6 6 700+1500 7 7 900+1500 8 8 1100+1500 9 9 1300+1500 0 0 700+1700 ST3p Code 1 900+1700 STp Code 1 1100+1700 KP KP1 1300+1700 ST2p KP2 1500+1700 ST ST
The timing of all the MF signals is a nominal 60ms, except for KP, which should have a duration of 100ms. There should also be a 60ms silent period between
PHREAKERS’ RECIPE BOOK 0037 digits. This is very flexible however, and most Bell equipment will accept outrageous timings. In addition to the standard uses listed above, MF pulsing also has expanded usages known as “expanded inband signaling” that include such things as coin collect, coin return, ring-back, operator attached, and operator attached, and operator released. KP2, code 11, and code 12 and the ST_ps (STart “primes” all have special uses which will be mentioned only briefly here.
To complete a call using a blue box once seizure of a trunk has been accomplished by sending 2600Hz and pausing for the , one must first send a KP. This readies the register for the digits that follow.
For a standard domestic call, the KP would be followed by either 7 digits (if the call were in the same NPA as the seized trunk) or 10 digits (if the call were not in the same NPA as the seized trunk). [Exactly like dialing normal fone call]. Following either the KP and 7 or 10 digits, a STart is sent to signify that no more digits follow. Example of a complete call:
0038 PHREAKERS' RECIPE BOOK 1> Dial 1-806-258-1234
2> wait for a call-progress indication (such as ring,busy,recording,etc.)
3> Send 2600Hz for about 1 second.
4> Wait for about ll-progress indication (such as ring,busy,recording,etc.) 5> Send KP+305+994+9966+ST
The call will then connect if everything was done properly. Note that if a call to an 806 number were being placed in the same situation, the are code would be omitted and only KP + seven digits + ST would be sent. Code 11 and code 12 are used in international calling to request certain types of operators. KP2 is used in international calling to route a call other than by way of the normal route, whether for economic or equipment reasons. STp, ST2p, and ST3p (prime, two prime, and three prime) are used in TSPS signaling to indicate calling type of call such as coin-direct dialing.
PHREAKERS’ RECIPE BOOK 0039 The Blotto Box by The Jolly Roger
(I bet that NO ONE has the balls to build this one!)
Finally, it is here! What was first conceived as a joke to fool the innocent phreakers around America has finally been conceived! Well, for you people who are unenlightened about the Blotto Box, here is a brief summery of a legend.
For years now every pirate has dreamed of the Blotto Box. It was at first made as a joke to mock more ignorant people into thinking that the function of it actually
0040 PHREAKERS' RECIPE BOOK was possible. Well, if you are The Voltage Master, it is possible. Originally conceived by King Blotto of much fame, the Blotto Box is finally available to the public.
NOTE: Jolly Roger can not be responsible for the information disclosed in the file! This file is strictly for informational purposes and should not be actually built and used! Usage of this electronic impulse machine could have the severe results listed below and could result in high federal prosecution! Again, I TAKE NO RESPONSIBILITY! All right, now that this is cleared up, here is the basis of the box and it’s function.
The Blotto Box is every phreaks dream... you could hold AT&T down on its knee’s with this device. Because, quite simply, it can turn off the phone lines everywhere. Nothing. Blotto. No calls will be allowed out of an area code, and no calls will be allowed in. No calls can be made inside it for that matter. As long as the switching system stays the same, this box will not stop at a mere area code. It will stop at nothing. The electrical impulses that emit from this box will open every line.
PHREAKERS’ RECIPE BOOK 0041 Every line will ring and ring and ring... the voltage will never be cut off until the box/generator is stopped. This is no 200 volt job, here. We are talking GENERATOR. Every phone line will continue to ring, and people close to the box may be electrocuted if they pick up the phone. But, the Blotto Box can be stopped by merely cutting of the line or generator. If they are cut off then nothing will emit any longer. It will take a while for the box to calm back down again, but that is merely a superficial aftereffect. Once again: Construction and use of this box is not advised! The Blotto Box will continue as long as there is electricity to continue with. OK, that is what it does, now, here are some interesting things for you to do with it...
-*-=>Blotto Functions/Installin’<=-*-
Once you have installed your Blotto, there is no turning back. The following are the instructions for construction and use of this box. Please read and heed all warnings in the above section before you attempt to construct this box.
0042 PHREAKERS' RECIPE BOOK ------Materials: ------
- A Honda portable generator or a main power outlet like in a stadium or some such place. - 400 volt rated coupler that splices a female plug into a phone line jack. - A meter of voltage to attach to the box i t s e l f. - A green base (i.e. one of the nice boxes about 3’ by 4’ that you see around in your neighborhood. They are the main switch boards and would be a more effective line to start with. or: A regular phone jack (not your own, and not in your area code!
- A soldering iron and much solder. - A remote control or long wooden pole.
Now. You must have guessed the construction from that. If not, here goes, I will explain in detail. Take the Honda Portable Generator and all of the other listed equipment and go out and hunt for a green base. Make sure it is one on the ground or hanging at head level from a
PHREAKERS’ RECIPE BOOK 0043 pole, not the huge ones at the top of telephone poles. Open it up with anything convenient, if you are two feeble that fuck don’t try this.
Take a look inside... you are hunting for color-coordinating lines of green and red. Now, take out your radio shack cord and rip the meter thing off. Replace it with the voltage meter about. A good level to set the voltage to is about 1000 volts. Now, attach the voltage meter to the cord and set the limit for one thousand. Plug the other end of the cord into the generator. Take the phone jack and splice the jack part off.
Open it up and match the red and green wires with the other red and green wires. NOTE: If you just had the generator on and have done this in the correct order, you will be a crispy critter. Keep the generator off until you plan to start it up. Now, solder those lines together carefully. Wrap duck tape or insulation tape around all of the wires. Now, place the remote control right on to the startup of the generator. If you have the long pole, make sure it is very long and
0044 PHREAKERS' RECIPE BOOK stand back as far away as you can get and reach the pole over.
NOTICE: If you are going right along with this without reading the file first, you still realize now that your area code is about to become null! Then, getting back, twitch the pole/remote control and run for your damn life. Anywhere, just get away from it. It will be generating so much electricity that if you stand to close you will kill yourself.
The generator will smoke, etc. but will not stop. You are now killing your area code, because all of that energy is spreading through all of the phone lines around you in every direction. Have a nice day!
--*-=>The Blotto Box: Aftermath<=-*--
Well, that is the plans for the most devastating and ultimately deadly box ever created. My hat goes off to: King Blotto (for the original idea).
------Jolly Roger
PHREAKERS’ RECIPE BOOK 0045 Brown Box Plans by The Jolly Roger
This is a fairly simple mod that can be made to any phone. All it does is allow you to take any two lines in your house and create a party line. So far I have not heard of anyone who has any problems with it. There is one thing that you will notice when you are one of the two people who is called by a person with a brown box. The other person will sound a little bit faint. I could overcome this with some amplifiers but then there wouldn’t be very many of these made [Why not?]. I think the convenience of having two people on the line at once will make up for
0046 PHREAKERS' RECIPE BOOK any minor volume loss.
------Here is the diagram: ------
KEY: ______| PART | SYMBOL | | ------| | BLACK WIRE | * | | YELLOW WIRE | = | | RED WIRE | + | | GREEN WIRE | - | | SPDT SWITCH | _/_ | | _/_ | | VERTICAL WIRE | | | | HORIZONTAL WIRE | _ | ------* = - + * = - + * = - + * = - + * = - + * == _/_ - + ****** _/_ ++++++++ | | | | | | | | | | |____ PHONE __ |
------Jolly Roger
PHREAKERS’ RECIPE BOOK 0047 Cerulean Box Make hydrogen from your phone line written and designed by compudroid
------Disclaimer: ------
I take no responsibility for your actions. This file is for informational and educational purposes only.
------Description: ------
0048 PHREAKERS' RECIPE BOOK The cerulean box is a device that when hooked up to a phone the box will make hydrogen.
------Materials: ------
2 test tubes 1 jar 2 alligator clips 1 rubber stopper water electrical tape salt
------Instructions: ------
Take the two alligator clips and cut off one end of each. Strip the cut off end of each wire about an inch. Then fill the jar with water and mix the salt in until the water is saturated with salt. Put the two test tubes in the salt water open end up. Then turn the test tubes upside-down so the open ends are down
PHREAKERS’ RECIPE BOOK 0049 and the tubes should now be filled with water. Take the electrical tape and tape the two upside down water filled test tubes to the inside of the jar so they are secure. Now take the two striped ends of the wires and place one under each test tube and then tape them so that they are secure. Connect the two alligator to the red and green jacks in your modular plug thing. Now just let it sit and you should see bubbles forming on the stripped wire and floating up into the test tubes. One test tube will be filling with hydrogen and the other will be filling with oxygen. The one that fills twice as fast as the other is hydrogen because there are two atoms of hydrogen for every atom of oxygen. Once one is about full unplug the alligators and then stick the stopper in the test tube while it is still under water. You know have a test tube full of hydrogen. Here is what the “box” should look like.
0050 PHREAKERS' RECIPE BOOK | | | | | | | | | | <------jar of water | | | | | | | | | | ^ ^ ^ ^ ____ ^ ^h20 ^ | | ^ ^ ^ ^ | | | | <----- test tube | |
______| | | | | | --- red ------| red ------green ------| |____| |______| | | | ------| | ^ ^ ^ ^ ^ | ^ ^ ^ ^ | ^ ^ ^ ^ | | | | | | | ^ ^ ^ ^ ^ | ^ salt water ^ ^ ^ ^ ^
PHREAKERS’ RECIPE BOOK 0051 Chartreuse Box Extract free electricity from your phone line by Wonko The Sane
------The Marshals of Dynamic Discord Present ------The Chartreuse Box (or any other obnoxious color ------
0052 PHREAKERS' RECIPE BOOK ------Intro ------
The Chartreuse Box, so named because this is an obnoxious box and chartreuse is an obnoxious color, is designed to take advantage of the thousands of dollars Ma Bell pays to the electric company each day. As you know, your telephone line is a constant power source. The chart box is designed to allow you to tap that power source for whatever sicko purposes you might have in mind.
------Parts ------
[1]- 1 four prong to modular phone adapter (the rectangular beige boxes with phone line jacks at one end and four prongs out the other.) [2]- 1 low power broad range rheostat. [3]- some wire [4]- a soldering iron [5]- some electric tape [6]- a 70 volt. DC fuse (optional) [7]- 1 SPST switch
PHREAKERS’ RECIPE BOOK 0053 ------Assembly ------
Plug the adapter into a phone line, and use a multi-tester to note which posts are charged. Use a magic marker to mark the positive and negative poles. Do this first.
Take the adapter, and turn it upside down. You should observe that the bottom fits into the top. Use a pocket- knife small screwdriver, battle axe etc. to remove the bottom. Don’t break it.
Detach the two wires not connected to charged poles, and scrap em. Detach the other two wires as well. Take your rheostat, and mount it on the outside of the box, drilling a small hole in the box, to run wires through.
Run wire from the charged connections from the line jack, through the rheostat, to the charged poles. (see diagram).
0054 PHREAKERS' RECIPE BOOK positive line \/ +------+ ------..... : : line jack+ :...... # :rheostat :#...... (fuse)....[=====] ------.. : : :... +------+ :...... #...... [=====] ^ negative line
Key: # - Rheostat poles .. - Wiring path [=] - Outside posts
Attach the fuse somewhere in the line if you feel like it.
When the phone rings 90 volts of pulsing DC power get shot down your line, and can really fuck up whatever you have the chart box hooked up to. Therefore, the fuse is a good idea.
You can also hook a switch up to the wiring, to give you more control over when power starts to flow. Once all the wiring is complete, push the wires and the fuse into the casing, and re-close it. Then tape around the side of the box, to hold the wires that come out to the rheostat down. I highly recommend
PHREAKERS’ RECIPE BOOK 0055 that you mark the charged posts with a marker, so you can easily identify them.
------Use ------
To use the chart box, hook it up to a phone line, and grab a multi-tester or voltmeter. Use the voltmeter to read off th voltage from your chart box. You can get up to 12 volts (more if you use a transformer) from the box, but you can use the rheostat to calibrate the box for whatever voltage you need. Once the voltage is set, remove the box from the line, hook your device up to the charged poles, and plug the box back in. If you’re really in a constructive mood, build a switch into the box. Now leech Ma Bell’s precious energy to your hearts content.
------Footnote ------
This device has other potential uses. One of the most obvious, and least useful (at least to my view) is as a volume control for
0056 PHREAKERS' RECIPE BOOK your phone. Maybe you have an aunt that talks REAL LOUD!!!!! Also, you can use this device to set up a feedback loop to mess up someone else’s phone line. Finally, it may be possible to use the chart box to tone down your connection, and provide a little background noise, so that ESS doesn’t pick up on your blue boxing. This is not a guaranteed method, but if you do it just right, you can make the 2600 blast sneak by the ESS detection code.
Naturally, the main purpose of the chart box is to leech Ma Bell just like she leeches you.
Hail Discordia!
Naturally, the main purpose of the chart box is to leech Ma Bell!
Captured From: THE IMAGINATION FACTORY BBS (513)-787-3777 24 hours - 7 days
PHREAKERS’ RECIPE BOOK 0057 Cheesebox Plans Courtesy of The Jolly Roger
A Cheesebox (named for the type of box the first one was found in) is a type of box which will, in effect, make your telephone a Pay-Phone.....This is a simple,modernized, and easy way of doing it....
Inside Info: These were first used by bookies many years ago as a way of making calls to people without being called by the cops or having their numbers traced and/or tapped......
How To Make A Modern Cheese Box
0058 PHREAKERS' RECIPE BOOK ------Ingredients: ------
1 Call Forwarding service on the line 1 Set of Red Box Tones
The number to your prefix’s Intercept operator (do some scanning for this one)
------How To: ------
After you find the number to the intercept operator in your prefix, use your call-forwarding and forward all calls to her... this will make your phone stay off the hook(actually, now it waits for a quarter to be dropped in)...you now have a cheese box...
In Order To Call Out On This Line:
You must use your Red Box tones and generate the quarter dropping in...then, you can make phone calls to people...as far as I know, this is fairly safe, and they do
PHREAKERS’ RECIPE BOOK 0059 not check much...Although I am not sure, I think you can even make credit-card calls from a cheesebox phone and not get traced
0060 PHREAKERS' RECIPE BOOK The Chrome Box A Portable Self- Contained Device to Manipulate Traffic Signals \ by Remote Control
Modem Free Earth Outlaw Telecommandos 14-JUN-88
------
PHREAKERS’ RECIPE BOOK 0061 Emergency vehicles in many cities are now using devices called OptoComs. OptoComs are a system of sensors on traffic lights that detect a pattern of flashes from vehicle-mounted strobe lights.
This flash pattern varies from city to city depending on the manufacturer of the equipment used. Often the sensors are installed only at major intersections. Nevertheless, the Chrome Box, which simulates these strobe patterns can often be used to give your car the same priority as an ambulance, paramedic van, firetruck or police car.
Because of the varying patterns on different systems this phile will outline a general procedure for making the Chrome Box.
------Decoding Flash Patterns: ------
First, you need to observe an emergency vehicle in action. You can wait until you
0062 PHREAKERS' RECIPE BOOK encounter one by chance, running out to see when you hear a siren, or when you pull over in your car to let one pass by. You might wait near a fire station for the next emergency to occur. Or, if you are very impatient, you can summon one by calling in a false alarm (not recommended in areas with limited services - that could divert attention from a real emergency). If the OptoComs in your area are the kind with a pattern of single flashes at a steady rhythm, you have merely to buy a strobe light at Radio Shack & adjust the flash rate until you can induce a traffic light to change.
If the flash pattern is more complex, you can videotape the emergency vehicle & then play back the tape in single-frame mode, counting the number of frames between each flash. Each video frame is 1/30 of a second, using this you can calculate the time between flashes in the pattern. Another way is to count the number of flashes (or flash-groups) in one minute and use that to compute the rate. Counting video frames will give you a good idea of the spacing of the flashes in a complex pattern. For really accurate
PHREAKERS’ RECIPE BOOK 0063 information, call the fire station & ask them, or write to the manufacturer for a service manual, which will include a schematic diagram that you can use to build one. A good cover story for this is that you are a consultant & one of your clients asked you to evaluate Optocom systems, or you could pose as a free- lance journalist writing an article.
------Modifying the Strobe Light: ------
You may not have to modify the strobe at all. But if you need a faster flash rate than your strobe allows, open it up & find the large capacitor inside. Capacitors are marked in microfarads, abbreviated as mf, mfd or ufd.
By replacing the capacitor with one of the same voltage-rating (usually 250 volts or more) and a SMALLER value in microfarads, you can increase the flash rate. Halving the microfarads doubles the rate.
The other component that can be
0064 PHREAKERS' RECIPE BOOK changed is the potentiometer (the speed control device with the knob on it). Using a smaller value (measured in Ohms or Kilohms, abbreviated with the Greek letter ‘omega’ or the letter K) will speed up] the strobe. There may also be a resistor (small cylinder with several colored stripes on it, and wires coming out of each end). Replacing this resistor with one of smaller value will also speed up the strobe.
To generate a complex pattern, you will either have to design and build a triggering circuit using IC chips, or rig up a mechanical device with a multiple- contact rotary switch and a motor. It HAS been done.
To modify the strobe for mobile operation the simplest thing is to get a 110-volt inverter that will run off of a car battery by plugging into the cigarette lighter & run the strobe from that. Or, you can figure out (or find in a hobby electronics magazine) a strobe circuit that will run from batteries.
Battery-powered strobes may also be
PHREAKERS’ RECIPE BOOK 0065 available, either assembled or as kits.
------Stealth Technology: ------
Most light sensors and photocells are more sensitive in the infrared area of the light spectrum. Infrared (IR) is invisible to the human eye. Putting an infrared filter over the strobe light may allow the Chrome Box to operate in traffic undetected by police or other observers. IR filters can be obtained from military surplus sniper-scope illuminators, or from optical supply houses like Dow- Corning or Edmund’s Scientific Co.
------Using the Chrome Box: ------
Mounted on your car, the Chrome Box can guarantee you green lights at major intersections in cities that have OptoComs.
Hand-held Chrome Boxes may be used to create gridlock by interfering with
0066 PHREAKERS' RECIPE BOOK the normal flow of traffic. If you have access to a window overlooking a traffic light, you can play pranks by switching the signals at inappropriate moments, or you can plug the strobe into an exposed outlet at a laundromat or gas station.
Some Decoded Patterns:
Torrance, California
Standard large Radio Shack strobe lights are used. Moderately fast rate.
* * * * * * * *
Manhattan Beach,CA
Flash-pairs in a 4:1 ratio, at a rate of 2 flash-pairs per second.
* * * * * * * *
<------1 sec ----->
********************************************* ********************* * Please add any new patterns or info you discover to this Phile *
PHREAKERS’ RECIPE BOOK 0067 Thanks to those who posted observations on the South Bay WWIV’s.
0068 PHREAKERS' RECIPE BOOK Clear Box Plans by The Jolly Roger
The clear box is a new device which has just been invented that can be used throughout Canada and rural United States. The clear box works on “Post- pay” pay phones (fortress fones). Those are the pay phones that don’t require payment until after the connection is established. You pick up the fone, get a dial tone, dial your number, and then insert your money after the person answers.
If you don’t deposit the money then you can not speak to the person on
PHREAKERS’ RECIPE BOOK 0069 the other end because your mouth piece is cut off but not the ear-piece. (Obviously these phones are nice for free calls to weather or time or other such recordings). All you must do is to go to your nearby Radio Shack, or electronics store, and get a four-transistor amplifier and a telephone suction cup induction pick-up. The induction pick-up would be hooked up as it normally would to record a conversation, except that it would be plugged into the output of the amplifier and a microphone would be hooked to the input. So when the party that is being called answers, the caller could speak through the little microphone instead. His voice then goes through the amplifier and out the induction coil, and into the back of the receiver where it would then be broadcast through the phone lines and the other party would be able to hear the caller. The Clear Box thus ‘clears up’ the problem of not being heard. Luckily, the line will not be cut-off after a certain amount of time because it will wait forever for the coins to be put in.
The biggest advantage for all of us
0070 PHREAKERS' RECIPE BOOK about this new clear box is the fact that this type of pay phone will most likely become very common. Due to a few things: 1st, it is a cheap way of getting the DTF, dial-tone-first service, 2nd, it doesn’t require any special equipment, (for the phone company) This pay phone will work on any phone line. Usually a pay phone line is different, but this is a regular phone line and it is set up so the phone does all the charging, not the company.
------Jolly Roger.
PHREAKERS’ RECIPE BOOK 0071 The Conference Box By: Madd Max
What is a Conference Box?
After hooking a conference box on your line you can talk on two lines at the same time. Therefore, if you already have 3-way on both lines, you could talk to 4 people at the same time (5-Way...). This version works (Unlike that box you can ‘PICK UP’ at Radio Shack...).
What do I need?
Item Description ------C1 10-uF, 50-volt electrolytic capacitor
0072 PHREAKERS' RECIPE BOOK C2 Another 10-uF, 50,volt electrolytic capacitor C3 10-uF, 15-volt tantalum capacitor R1 10K, 1/4 watt, 10% composition resistor R2 100-ohm, 1/4 watt, 10% composition resistor Q1 2N3904 npn silicon transistor S1 Dpst toggle switch S2 Another Dpst toggle switch T0 Telephone coupling transformer, Microtran T2110 or equivalent Some wire or a circuit board (Design your own)
Some electronic equipment A box A little patience
Notes:
The ‘Item’ is used to indicate where it goes in the diagram. You can use any transformer which is rated at about 900 ohms both primary and secondary, over the frequency range of about 300 to 3000 Hz.
PHREAKERS’ RECIPE BOOK 0073 + ‘ \: ! S2 ‘ /: ! /: ‘ ‘ *------,- / :--* ! ‘ ! / ! !+ ‘ ! !+ ! R1# ! ‘ Line 2 Q1 Q1 R2# $C3 C2 @ @T0@ @ @ @ @ @ @ @ @------$----*----*----* @------$----*----*----* @ *------* ------@------*----* @ @ +
! ! ! ! + ‘ / C1 / C1 ‘ Telephone ‘ Telephone ‘ Set S1 S1 / ! ‘ ! ‘ ! ‘ ‘ How does everything go together? + *------*------$------,----* Line 1 *------*------*
0074 PHREAKERS' RECIPE BOOK What did all that mean?
Symbol Meaning ------Horizontal Wire
! Vertical Wire
* Point where wire splits, separates, merges, etc.
/ * * ‘ ‘ ‘ A Dpst toggle switch ‘ ‘ / * *
$ Capacitor
# Resistor
@ To the Transformer
+ Positive end (of line or capacitor)
PHREAKERS’ RECIPE BOOK 0075 - Negative end
\: :-- Transistor /:
How do I use it?
Pick up the telephone set and flip the first switch on. You should get a dial tone. Dial someone and tell them to hang on. Flip the second switch and you should get another dial tone. Dial another number. After they answer, you should be able to talk to both of them and they should be able to talk to one another. If you have 3-Way on one (or both lines) you can flip the switch corresponding to that line on and off (RAPIDLY) to switch the 3-Way.
NOTE: Because you went to all the trouble of making this with a transformer, it should sound PERFECT!
0076 PHREAKERS' RECIPE BOOK Cross Box A quick 2-line bridge
A simple box used to introduce crosstalk between phone lines. Cross Boxes have several uses:
(1) To eavesdrop on conversations. You are on line #2 listening to your cheating spouse on line #1 slobbering over the new love.
(2) To annoy or harass the other line user with whatever crosstalk that’s played into their line.
(3) As an el cheapo Cheese Box.
PHREAKERS’ RECIPE BOOK 0077 (4) To provide background music, sound effects, etc.
Many designs are possible. However, the best consists of 600:600 ohm transformer coupling between the two lines. Be sure to DC-isolate each transformer with a 0.47 uF, 100V non-polarized capacitor between it and the phone line. A 10K ohm multi-turn pot should be wired in series with one of the transformer leads to reduce volume as needed.
The Cross Box can be used with an audio amp on one side, instead of another phone line. The audio amp could provide background music, commentary, etc. It could be used in conjunction with a Crimson Box to provide Music-on-Hold.
0078 PHREAKERS' RECIPE BOOK The Dark Side Research Group Proudly Presents: The DARK BOX: Multi- Purpose Network Manipulation Unit
By: Cablecast 0perator (]<)0PYWR0NGDE 1987, 1990 DSR/ATR All Rights Fucked ------
PHREAKERS’ RECIPE BOOK 0079 ------Introduction ------
The Dark Box is the newest device to enter the “colored box” market and is guaranteed to re-revolutionize the art of telecommunications fraud. The device’s inventor, Cablecast 0perator, became quite bored with the old forms of phreaking, having to worry about codes dying, or being traced. The unit you are about to build was spawned by the need for a more versatile, safe and interesting way to phreak. You don’t need any special tones or attack dialers, just your good old every-day DTMF pushbutton phone.
The box’s basic design allows you to call anywhere on earth (or elsewhere for all we care) without fear of being billed or traced. But it’s uses do not stop there! When hooked up properly, it can be used to emulate multi-line bridges, loop lines and direct in-dials.
It’s really quite simple. The device is plugged into two phone lines, other
0080 PHREAKERS' RECIPE BOOK than your own, or one end into a phone line and the other into another box. When there is an incoming call, the device senses this and picks up the phone. Your call is then transferred to the other line or onto the loop. When you hang up, the device senses this, too, and it hangs up also, waiting for the next caller.
To illustrate this, whip out your good old analog multimeter and hook it up to your phone line. See that nice, juicy voltage on there? Now call it on your other line. The voltage will jump and the polarity will go all to hell. This version of the Dark Box uses an alternating current detector to tell if the phone is ringing because sensing voltage is unreliable and not entirely universal. Now pick up your second line. There is a momentary blackout on it and then the voltage becomes constant. Now hang up the phone you called in on. There will be another blackout on your other line ans then the voltage will pop back up again. On the box, hangup is detected by the line current passing through an opto- isolator that is holding the relay open.
PHREAKERS’ RECIPE BOOK 0081 When it is cut off for the split second the blackout occurs, the relay is cut off and the phone hangs up.
NOTE: With the rapid expansion of digital ESS’s, the little phone company quirks that are essential for the device’s operation might not be available in your area. Check your line with the meter as directed to be sure!
------Trip To Radio Snack ------
On your next trip out to your friendly neighborhood Radio Shack, get yourself these:
1) 1 Audio Isolation Transformer 555 IC Timer Opto-isolator (Transistor Output) (2) NPN Transistors (2N3904 or 6 Will Do Nicely) (2) 100k 1/4w Resistors (2) Normal Diodes 1k 1/4w Resistor 10mF Electrolytic Capacitor Disc Capacitor (.01mF)
0082 PHREAKERS' RECIPE BOOK DPST Relay 9v Battery or Likewise AC Adapter and Timer
It’ll run you about five or six bucks, unless of course you get a five finger discount...It can be mounted on a small IC perfboard, or whatever you like depending on how small you want it.
If you can’t display the schematic that goes along with this, we’ll do it like connect the dots, it’ll be fun!!
+ O P Q ______|__ |____|____ |__ | __ | ___ A - |o | - H I - |o |- N | C | B - | 555 | - G J - | OptoIs |- M | O DPDT/DPST | C - | ICTimer | - F K - |______|- L | I Relay | D - |______| - E | L ______|__ | | | | | - R S T
This is the wiring diagram for X1, the 1:1 Audio Transformer:
RED -- (white) ------O| |O ------(red) -- YEL O| |O GRN -- (black) ------O| |O ------(yellow) -- BLK
They don’t have to be paired exactly like that, just remember that white goes with black, and red goes with yellow.
PHREAKERS’ RECIPE BOOK 0083 Text coding of the schematic is very simple. If you have ever assembled one of those 1,000,000,000,000-in-1 electronics kits from Shack, you can do this... I will guide you with TO and THRU. There is a difference:
A ---- * ---- B A ----- R1 ----- B | R1
"A TO R1 TO B" "A THRU R1 TO B" Parallel Circuit Series Circuit
These are the abbreviations for the components:
RED, GRN, YEL, BLK = Phone line red and green respectively Dx(Anode/Cathode) = The Diodes Where x={1,2} Qx(Emitter/Base/Collector) = Transistors x={1,2} C1(+/-) = Electrolytic Capacitor (observe polarity!) C2 = Disc Capacitor R1 = 1k Resistor Rx = 100k Resistor x={2,3}
Ya dig it, mon? If this is too complex for you, try and view the schematic through Generic Software’s CADD, or try to draw your own out from the directions below. Sometimes it helps to do this in visual terms!
0084 PHREAKERS' RECIPE BOOK OK, let’s go to it...
<-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-> 1: GRN thru R3 to Q1(Emitter) to GND 2: RED thru D1(Anaode) to Q1(Base) 3: Q1(Collector) to B 4: +V thru R1 to B 5: +V to M to D to H to Q2(Collector) 6: H thru R2 to G to F thru C1(+) to GND 7: E thru C2 to A to GND 8: C thru D2(Anode) to Q2(Base) to L 9: Q2(Emitter) thru COIL to GND 10: RED to I 11: J thru X1 to T 12: GRN to R 13: BLK thru X1 to Q 14: YEL to O <-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=->
There. That wasn’t too hard now, was it? Now let’s test it. A word to the wise: Do not substitute batteries or other power supplies in place of the telephone line. If you do, then you risk blowing the transformer and the opto-isolator.
-=> Testing The Puppy <=-
Now that you have it built, double check
PHREAKERS’ RECIPE BOOK 0085 and make sure everything is OK before you apply power to it. If everything you have is right, there might be some weird, uncaught error in the file, or you have bad parts. Contact us or try again.
A voltmeter and a logic probe can come in handy here...
Connect the battery, but not the phone line yet. Your relay should not throw. If it does, check the 555 and the transistor triggering it.
If that’s ok, short out the emitter and collector on Q1 momentarily.
The relay should throw for about two or three seconds then shut off.
If not, check that trigger circuit again.
Now plug in RED and GRN. If your relay trips, you might have the RED and GRN reversed, or Q1 is not wired properly.
If you’re ok, call it on your other line. It should ring once and then pick up. If it’s busy, perhaps D1 is not right. If it
0086 PHREAKERS' RECIPE BOOK doesn’t answer the phone, check Q1 to make sure all contacts are right.
Ok, FINAL TEST! Connect YEL and BLK and call the line that RED and GRN are on. It should pick up and you should hear a steady dial tone and be able to dial DTMF on it, etc., etc., etc. There are several problems that could arise here.
1) No dial tone means it’s either not hooked up right, or the transformer is bad.
2) If you only get it for about three seconds before it hangs up on you, you are not getting complete isolation from the other line. Check the transformer.
3) If the dial tone you hear is “bobbled” then you have a major voltage spillover, isolate the second line from the rest of the circuit.
If everything checks out, you have just built a DARK BOX!! Now let’s have fun with it...
PHREAKERS’ RECIPE BOOK 0087 ------Applications And Operations ------
You already have the basic unit constructed. This is sort of a Pseudo- Extender or Pseudo-Diverter. Place it on any two phone lines (other than your own) and be sure you know the number for the RED- GRN pair. Now when you call the line that’s hooked up to RED and GRN, you get the dial tone from the YEL/BLK pair, and it’s just like you were at that person’s house using THEIR phone! But you’re not, you could be in Tahiti if you want! This is, basically, how you avoid billing of calls.
If you want to use this box from long distance without having to pay for it yourself, you could wire a black box resistor onto the RED/GRN pair. It’s not your phone line, what do you care?
For loop lines and cheese boxes, wire two Dark Boxes back to back on any two phone lines.
For a multiple line bridge, you need as
0088 PHREAKERS' RECIPE BOOK many boxes as you want dial-ins. Loop all the YEL’s and BLK’s together respectively and plug the RED/GRN’s into a hunt group (You know, call 555-0000 and if it’s busy, you’ll be transferred to 555- 0001, etc., etc.), this way, hackers can drop in and out at will. Didn’t Cap’n Crunch do something like this?
If you want to make credit card calls instead of dialing direct, attach the box to two pay phones that are next to each oth er.
That way, you don’t have to freeze your ass off to avoid having your phone number put on the guy’s card bill. Make sure the pay phones will accept incoming calls!
Patch YEL/BLK into an audio amplifier and into the paging system at someplace like K-Mart.
Imagine the riot you can start by paging “INS! Stay where you are!” The xfrmer should push out a line level audio, so interfacing to most sound applications should be a snap.
PHREAKERS’ RECIPE BOOK 0089 A word about Caller ID. CI has been introduced since the invention of the box. The box can bypass CI to an extent, being that if the box calls someone who caller IDs you, they’ll get the second phone line of the box, and not you. However, if the in-dialing line for the box has CI and you call directly into it and someone happens to be there to get it, you could be in serious trouble. A solution to this would be to use the box on a pay phone that will accept incoming calls.
Since no one gives a fuck who calls a pay phone, chances are it won’t CI’d. You could also place the box in an area that doesn’t have CI, whereas in order for CI to work, both the caller and the callee must be in service areas.
Don’t be limited by only these suggestions! Be creative and let us know how you use it! Make a DID for your school’s PABX, or get your Vic Modem to auto-answer! There HUNDREDS of uses for this revolutionary device waiting to be discovered!
0090 PHREAKERS' RECIPE BOOK ------One Final Word ------
The staff of Dark Side Research would like to thank our friend, Rebecca, who has encouraged us to press on in the Box’s development even during times when it seemed hopeless.
Enjoy you new toy....
Cablecast 0perator
PHREAKERS’ RECIPE BOOK 0091 Gold Box Plans by The Jolly Roger
HOW TO BUILD IT ______
You will need the following:
Two 10K OHM and three 1.4K OHM resistors Two 2N3904 transistors Two Photo Cells Two Red LED’S (The more light produced the better) A box that will not let light in Red and Green Wire
Light from the #1 LED must shine directly on the photocell #1. The gold box I made
0092 PHREAKERS' RECIPE BOOK needed the top of the LED’s to touch the photo cell for it to work.
The same applies to the #2 photo cell and LED.
1 : -PHOTOCELL-- : : : : : BASE : 1 TTTTT : +LED- TRANSISTOR : TTTTT : : : : - I (-- : : COLLECTOR RED1 -- < > : -- : : ------: ----- GREEN2 -I ( -- : ------: : : 2 : -/+/+/-/+/+/-/+/+/-/+/+/ LED 10K 10K 1.4K 1.4K RESISTORS
2 -PHOTOCELL------: : : BASE : TTTTT : TRANSISTOR : TTTTT : : : EMITTER : GREEN1------RED2 : : /+/+/ 1.4K
The 1.4K resistor is variable and if the second part of the gold box is skipped it will still work but when someone picks up the phone they will hear a faint dial tone in the background and might report it to
PHREAKERS’ RECIPE BOOK 0093 the Gestapo er...(AT&T).
1.4K will give you good reception with little risk of a Gestapo agent at your door.
Now that you have built it take two green wires of the same length and strip the ends, twist two ends together and connect them to green1 and place a piece of tape on it with “line #1” writing on it.
Continue the process with red1 only use red wire. Repeat with red2 and green2 but change to line #2.
------HOW TO INSTALL ------You will need to find two phone lines that are close together. Label one of the phone lines “Line #1”. Cut the phone lines and take the outer coating off it. There should be 4 wires. Cut the yellow and black wires off and strip the red and green wires for both lines.
Line #1 should be in two pieces. Take the green wire of one end and connect it to one of the green wires on the gold box.
0094 PHREAKERS' RECIPE BOOK Take the other half of line #1 and hook the free green wire to the green wire on the phone line. Repeat the process with red1 and the other line.
All you need to do now is to write down the phone numbers of the place you hooked it up at and go home and call it. You should get a dial tone!!! If not, try changing the emitter with the collector.
Have a great time with this!
------Jolly Roger
PHREAKERS’ RECIPE BOOK 0095 New Gold Box Plans By The X MAN - Field Testing Work Done by The Pyro and Mr. Sinister
Written July 27. 1993
A Gold Box is a most wonderful thing. With about $5.00 in parts and 30 minutes of soldering, you can effectively create your own portable diverters.
Definition of a Gold Box-When linked across two telephone lines, a Gold Box allows you to call one phone number and
0096 PHREAKERS' RECIPE BOOK get the other’s dial-tone. This allows virtually untraceable long-distance calling. Simply hook it up to your favorite victims’ phone lines one night, go home and dial their number, and phreak all night long at their expense. As long as you remove the box after you’re done, there will be nothing left but a monstrous phone bill.
For easier reading the schematics have been converted to GIF format and can be viewed or printed using any standard GIF utility.
------PARTS LIST ------(I’ve also included Radio Shack conversion #’s for everyone’s convenience).
2 - 2N3904 NPN Transistors (RS Cat#- 276-2009) 2 - 10K Ohm Resistors (RS Cat#-271-1335) 2 - 1.5K Ohm Resistors (RS Cat#-271-025) 1 - 1.2K Ohm Resistor (RS Cat#-271-024) 2 - Red LED’s (RS Cat#-276-033A) 2 - Photocells (RS Cat#-276-1657) 2 - Gator Clips
PHREAKERS’ RECIPE BOOK 0097 1 - 3” X 2” Circuit Board 1 - Nice little box to put it all in (About 3” X 2”)
The schematics are fairly straightforward, and if you can’t read a simple circuit diagram you probably shouldn’t be on this BBS to begin with so TAKE OFF LAMER!
NOTES:
- Make sure that the LED’s shine directly on the Photocells and that the box lets in no light.
- You need only complete the first part of the circuit for a working Box, but whenever someone picks up the phone line, they will hear a very faint dial-tone.
Once the device is completed hook it up between two sets of phone lines. If you know the numbers, so much the better, if not, use ANI to get them. Go to the nearest unrelated phone and call the number hooked up to Red 1. You should hear a dial-tone. ANI that number from where you are and it should be the
0098 PHREAKERS' RECIPE BOOK second phone line. HAPPY PHREAKING!
ADDITIONAL FIELD -TESTING NOTES:
- No ring is detected by the victim when you call his/her/its line.
- If they pick up the line they will hear nothing (A faint dial-tone if you only complete the first part of the schematics)
- When the device is not in use, the person can use his phone normally. This is exceptionally useful when you hooks The Box across two pay phone lines. Just scratch off the numbers on the pay phones so no one else can call. Go home and call the pay phones, then when you get the first one’s dial-tone, Red Box your way around the world!! This method works exceptionally well because as far as Ma Bell is concerned, that call was paid for. A Gold/Red combination like the above can be reliable long-term method of Phreaking. But PLEASE, PLEASE don’t be total idiot and call the pay phones during the time when someone might pick up the phone and report the loss of a
PHREAKERS’ RECIPE BOOK 0099 dial-tone to SW Bell!!! I believe doing this sort of a thing to a pay phone is a Federal Offense, so, naturally, this phile is for information purposes only-Yeah, Right!
Live Long and Multiply!
The X Man
00100 PHREAKERS' RECIPE BOOK Green Box Plans by the Jolly Roger
Paying the initial rate in order to use a red box (on certain fortresses) left a sour taste in many red boxers mouths, thus the green box was invented. The green box generates useful tones such as COIN COLLECT, COIN RETURN, AND RINGBACK. These are the tones that ACTS or the TSPS operator would send to the CO when appropriate.
Unfortunately, the green box cannot be used at the fortress station but must be used by the CALLED party.
PHREAKERS’ RECIPE BOOK 00101 Here are the tones:
COIN COLLECT 700+1100hz COIN RETURN 1100+1700hz RING-BACK 700+1700hz
Before the called party sends any of these tones, an operator release signal should be sent to alert the MF detectors at the CO. This can be done by sending 900hz + 1500hz or a single 2600 wink (90 ms.)
Also do not forget that the initial rate is collected shortly before the 3 minute period is up. Incidentally, once the above MF tones for collecting and returning coins reach the CO, they are converted into an appropriate DC pulse (-130 volts for return and +130 for collect). This pulse is then sent down the tip to the fortress. This causes the coin relay to either return or collect the coins.
The alleged “T-network” takes advantage of this information. When a pulse for coin collect (+130 VDC) is sent down the line, it must be grounded somewhere. This is usually the yellow or black wire.
00102 PHREAKERS' RECIPE BOOK Thus, if the wires are exposed, these wires can be cut to prevent the pulse from being grounded. When the three minute initial period is almost up, make sure that the black and yellow wires are severed, then hang up, wait about 15 seconds in case of a second pulse, reconnect the wires, pick up the phone, and if all goes well, it should be “JACKPOT” time.
------Jolly Roger
PHREAKERS’ RECIPE BOOK 00103 Hoz Box (pronounced hose) Brought to ya by a Phreak Who Cares.
OK, so there’s a zillion other kinds of boxes that will give you a conference line. What makes this one better? You can assemble it in five seconds if you memorize these instructions! This thing is so EASY to make you probably need to buy one part! All right, lets get to the instructions.
------Things you need to build it: ------
2 fone lines in your house 3 modular plug to plug cords (you pick the lengths) 1 modular in-line duplex coupler (cost me $2.99)
I found the coupler at Ace hardware. It’s part BT-44 from Black Point Products in
00104 PHREAKERS' RECIPE BOOK Richmond, CA (if that helps at all). Anyway, stick a cord in the side of the coupler that has one outlet, and put the other side of that cord into a fone. Then put one cord in the duplex side and connect the other end of it to line #1. Stick the plug of the third cord into the second hole on the duplex side, but don’t connect it to your second fone line yet.
You should be able to hear a dial tone in your fone now.
Now that you have the thing assembled, call some one. Once they’re on, talk or do whatever. When you feel like calling another person, tell whoever is on the line to not play with fone buttons, and put the other side of the third cord into your second line. You should still be able to hear the first person you were talking to (maybe a little faintly), and a dial tone. Now dial the other person. That’s all there is to it.
This works with touch tone, I don’t know about those lame rotary dial things, but who has those anyway. Though this may not be your idea of
PHREAKERS’ RECIPE BOOK 00105 Phreaking, I think you usually have to pay extra for a conference line, so it is kind of ripping off the fone co. Anyway, it ranks above hold buttons!
//Me questions or comments //At THE UNSINKABLE TITANIC //(415) 521-9710 !!HOZZUS MAXIMUS!!
00106 PHREAKERS' RECIPE BOOK The Logic Box By. TeCHn0 LoGiC
The concept of the logic box is very simple. It disables your victim’s caller ID unit with an ERROR message. It uses a simple design and simple instructions. This box does basically what the *67 method does, but more and more Ma Bell’s are beginning to charge for that. Some places it is $.80 per use, that can get a bit hefty after many uses. So 5 finger some batteries and start calling!
PHREAKERS’ RECIPE BOOK 00107 ------Materials ------9 Volt battery 5 In. of fone cord 2 Alligator clips A 9 Volt battery connector cord A soldering iron A brain
(1) Cut one end of battery connector and splice the 2 wires
(2) Solder the 2 alligator clips to the end wires of the battery connector
(3) Take the fone cord and cut the gray insulation off till the colored wires are exposed DO NOT CUT COLORED WIRES!
(4) Strip the RED & GREEN wire just enough to fit the alligator clips on
(5) Plug the cord into the wall and then into your fone
Thats it! Now to use the box....
(1) Dial the victim’s number
00108 PHREAKERS' RECIPE BOOK (2) As soon as you dial the last digit plug the 9 volt battery into the connector
(3) Your call will go through and your victim’s caller ID will say “ERROR”
*** Editor’s Note: This file has no relation to LogicBox of sysfail ***
Shouts: sodium, Dj-Ohki, Jigoku, v_plus_plus, Shylock aka Tophat, zXanazx, Lucky225, Jouser, NightDreamer
PHREAKERS’ RECIPE BOOK 00109 MAGENTA BOX. Designed and Written by Street Fighter.
First of all I named this the Magenta Box because all of the **** that made boxes, whose only purpose is adding a hold button to your phone, used all of the fucking colors. I can afford a fucking piece of shit Radio Shack 2-line phone with hold. A box’s purpose is to fuck with the Telco., not to add a fucking hold button to your phone. Anyway I will get on with this.
00110 PHREAKERS' RECIPE BOOK ------PARTS LIST: ------
SPDT Miniature PC RELAY (about 9v, 500 ohm) DPDT Miniature PC RELAY (about 6v, 500 ohms, 12 mA) 2000 or so uF electrolytic capacitor 1 meg resistor .01 uF capacitor 555 timer chip 2 diodes (1N914) 10 K resistor 1 K resistor 9 volt battery -w- clip PC Board 4 alligator clips some kind of a box (small) some 20 or 22 gauge wire to work with.
If you don’t know how to put together a project by looking at a schematic, then isn’t the project to start with. I would ask someone with some electronics knowledge to give you a helping hand. This has to be put together on a PC-board. Enough talk, now the schematic:
PHREAKERS’ RECIPE BOOK 00111 RING #2 o--< TIP #2 o --< |
C | \| O |\ | I | \| L |\ | |--| NC o
NC o | | ^ | | | | |--| | | | | - | +------| \| | | | | +-o | | | o | +------< RING #1 | | +------< TIP #1 | | | | |
| | | | + --- |
|
| | | |
+------+ ------+ | | |--| C
|\ | O | \| I | |--| L | \ / \ / | +------+ | +--/\/\/\------+------+ | | 4 +------| 3 | |------>| --- + ------|\ | | | +--- | | | 10 K | | | 2 | ------+------+ | | _ ^_ ------o-- --+ | ---.01 uF ------| 9V - GROUND 4.7K | | 8 | ------| | | | | | | | 555 | chip | | | | ------| 1 5 ------o NC | --___ | ---o--- + ^ |
7
6 | | +------+------+------+--+------+ ------| | | / | \ | / R1 | | | | +------| +------| | | |
_ ^_ C1 000 uF
+9 v --- 2 *see note
1 Meg
(1000K)\
+
00112 PHREAKERS' RECIPE BOOK ______K E Y ______
NC - Normally Closed
--< - Alligator Clip
--- - ^- Capacitor
->|- Diode
| - ^ Diode | o o o Contacts on relay. DPDT o o o
------o
___---o Contacts on relay. SPDT ------o
-/\/\/\- Resistor
| / \ Resistor / |
Whew! Well, the schematic explains almost everything. It would be helpful to you if
PHREAKERS’ RECIPE BOOK 00113 you used one color for the line #1 clips and another for the line #2 clips. It will work even if you get the ring and tip mixed up, but you must get all of the clips on the right line. But, to be safe, you could put tags on each clip labeling it RING #1, TIP #2, etc.
Installation. Find one of those green posts that are about 3 feet high. They are everywhere.
Get a socket wrench to open it up. There will be (a) row(s) of paired up posts. Each pair of posts represents a line.
YOU *MUST* KNOW THE NUMBER OF LINE #1.
Sometimes the number is tagged on to the pair of wires leading up to the posts, if so pick these posts as your line #1. Then you can pick any other set of posts for line #2.
Now to the good part. Use of the final product.
When you call up line one from your house you will get a dial tone almost immediately.
00114 PHREAKERS' RECIPE BOOK Using DTMF you can dial anywhere that the person who owns line 2 has service to. Which means you can direct dial alliance, Australia, and your favorite BBS for FREE.
The Telco. will undoubtedly discover the device after 2 days, so post the number on your favorite boards so you can abuse it while it is in service. With a 2000 uF capacitor and a 1 meg resistor you will get a 50 minute call before it disconnects you. By lowering the value of the resistor and capacitor you can change the time to your taste.
So don’t dial a wrong number, because you will have to wait 50 minutes until it resets again. The formula for the time is the following:
2*R1 C1 C1 is in microfarads ---- * ---- R1 is in Kohms 100 10 See schematic for location of ------R1 and C1. = Minutes 60
The time produced by this formula is only approximate.
PHREAKERS’ RECIPE BOOK 00115 Well, that is one of the more complicated boxes to build. But it is very useful and will pay for itself with its first use. It would be wise to remove it before the Telco finds it so you won’t have to make another, or install it on a line that belongs to a family that is on vacation (GOOD IDEA)
Well, there it is. I hope it saves you a lot of cash.
I, Street Fighter, designed this box for the sole purpose of fucking over Ma Bell. It is not for informational purposes, but to be used to cost the TelCo thousands of dollars.
If you wish to have one built for you. Leave me E-mail on the Iron Curtain or the CornerStone or any other board I frequent. It won’t be more than $15, hopefully it will only be about $8.
DON’T LET PHREAKING DIE!
STREET FIGHTER - 1988
00116 PHREAKERS' RECIPE BOOK Meeko Box A multipurpose direct line interface Designed by Meeko 1994.
Once you have built this you will wonder how you ever managed to go without it! This is a multi purpose box. These are the features...
1.> It is able to record telephone conversations with excellent quality.
2.> It is able to play a source directly into the phone line.
3.> It can keep the phone line open.
PHREAKERS’ RECIPE BOOK 00117 4.> You can box without using a phone, and headphones!! Only your modem, and a monitor / HiFi if you wish!!!
------The following are needed for the box:------
1 x 600 ohm - 600 ohm Isolating Transformer (from RS catalogue (217-826)) 1 x 680 ohm resistor (approximately) 1 x D.P.D.T Switch 1 x S.P.D.T Switch 1 x S.P.S.T Switch 1 x Telephone Extension Lead (with socket and plug - i.e.. from Tandy’s) 1 x Stereo Phono Lead Some wire, soldering skills, and patience!!
Look at the accompanying files (IFF, GIF, and PCX versions supplied) for the wiring diagram.
------Notes on schematics: ------
Only 2 wires of the telephone are
00118 PHREAKERS' RECIPE BOOK connected out of the 4 present. The third is used as the Earth, and the fourth is not connected. You must wire either of the two wires which operate the line (the red, or the white, if a telephone extension lead from Tandy’s is used,) from the socket of the box to the common pin of the S.P.D.T Switch (usually the middle one.) Then, a wire must be taken from either of the other pins to the “F” Terminal of the Transformer. Then, either the red, or white wire of the plug (which goes from the box to the wall socket) according to the wire connected to the “F” Terminal must be connected to the “S” Terminal. (i.e.. If you connected the red wire of the box socket to the “F” Terminal, you must connect the red wire of the plug lead to the “S” Terminal.) A link wire must then be taken from the remaining pin of the S.P.D.T Switch to the “S” Terminal.
Then, a 680 ohm resistor must be connected from the red wire (of the plug line) to a pin of a S.P.S.T Switch. Then, a link wire must be taken from the other pin to the white wire.
PHREAKERS’ RECIPE BOOK 00119 On the Secondary Line of the Transformer, two link wires must be taken off, each to one of the common pins of the D.P.D.T Switch. Then, the phono lead must be connected as shown in the diagram. If you have followed these simple instructions correctly, you are now the owner of a Meeko Box!
The extension lead you buy must be cut, so that the wires from the socket part are free, and also the wires from the plug end are free. The socket (a little plastic box) can then be mounted inside a box.
------Instructions of Use:------
Either a phone or modem (or both, through a socket doubler) can be connected to the socket of the box. Then, the box is plugged into the wall socket. The S.P.D.T Switch can then be used to turn the box on or off (it is completely transparent when off.) The D.P.D.T Switch is used to select between Playing into the phone line, and recording from it. The S.P.S.T
00120 PHREAKERS' RECIPE BOOK Switch is simply used to keep the line open or closed (explained later.)
When playing into the phone line, it is best to take the output from the HiFi, or Monitor’s headphone socket, so the volume level can be adjusted, rather than from a fixed output of the Video out socket of the HiFi (or whatever).
The line quality will drop slightly when recording, and you will hear your voice in your ear at a higher level than you are used to. This is simply to stop yourself from talking too loudly; (your voice would then be recorded at a higher level than the other person’s.)
When using the box to play into the phone line, the quality does not drop at all. This is the best usage of the box! You can then box using this, rather than headphones, or your HiFi speaker!! You must either dial the 0800 890 XXX number on your phone, or through your modem terminal (ATDT 0800890XXX). Then, once you are connected to the international exchange, just use your BBing software to play into the HiFi, or
PHREAKERS’ RECIPE BOOK 00121 Monitor, or whatever, and then into the phone line. (Best through headphone output.)
You will then have to experiment to get the volume at the correct level. This will be much lower than if headphones were used, as it is much more efficient, and there is much less distortion.
So, once you have got on the international exchange, (after the click - hey this is no boxing lesson!) You must send the usual break tone, and when you hear the kickback (harder through the modem speaker), just dial as usual!
The call will connect!! You don’t even need ATX1!! If you want to make another call after, you must use the switch which keeps the line open.
(Note the resistor is there to stop the line from shorting - it is approximately the same resistance as a phone or modem offers.) Once the line is open, you can hang the modem, and then type ATX1D. Then box again!!
00122 PHREAKERS' RECIPE BOOK Just by sending the seize tones, and the dial string! Once the other party’s modem/phone is ringing, flick the switch back. (Note you can leave the switch closed, but the line quality may drop, so it is not advised.
Also, you may find that you will forget, and when you come to hang up, and go out, you are still connected to the other party’s line!!!!!) When boxing using the phone for voice calls, the switch to open the line is not used.
------
The box has been tested on an A1200, with Rox Box, NComm 3.02, a Sportster 14.4K FAX Modem (UK model), and a Pioneer N92T HiFi system.
This is the first version of the box, and an amplifier stage could be used at the secondary line of the transformer, and a potentiometer could be used as a record level selector. A filter could also be used to improve the record quality. Look out for later improvements to the box. If you have any suggestions for improvement or
PHREAKERS’ RECIPE BOOK 00123 otherwise, you can reach me (Meeko) on most of the UK BBS’s, and the main US BBS’s.
Note it is possible to sample your voice using a microphone into your computer, and change the effect in real time (to robot, or echo mode, for example) and then play this into the phone line!! This really confuses people! If you find any more uses for this box, then do let me know!
The switch for keeping the line open can also be used as a privacy switch, if your phone does not have one. (Just turn it on, and hang up your phone - the other party will still be connected - this is only useful if you have phoned them, not if they have phoned you.)
HaVe PhUn EvErYoNe!!!!
______|\/| |_ |_ |/ | | | | |__ |__ |\ |__|
Hi-ReS UK
00124 PHREAKERS' RECIPE BOOK Greetz go to the following d00dz:-
Blackthorn, Sync, THC, Harl, Tranzic, Mini Master, Sonny, Zealot, Scojack, Phantasm, Z-N0TE, Art, AmericA, Mr. Happy, Pink Floyd, Swinger, James, and all other peeps I have missed!
Oh, and not forgetting the lovely BT, AT&T, MCI, Sprint, and all of the other “excellent” telecommunications companies!!!!
PHREAKERS’ RECIPE BOOK 00125 Neon Box Audio interface BY SGT. SLAUGHTER ON JUN 28, 1985 13:30
A NEON BOX IS A VERY SIMPLE ADJUSTMENT TO YOUR FONE, THAT WILL ALLOW A VERY CLEAR PASSAGE FROM YOUR COMPUTER TONES TO YOUR FONE. IT ALSO WORKS GREAT FOR RECORDING TONES, SEX FONE, OR ANYTHING ELSE YOU WANT TO RECORD OFF OF YOUR FONE.
------TOOLS: ------
THIS MODIFICATION IS VERY SIMPLE, AND CAN BE USED ON MOST FONES, THOUGH IT IS MORE DIFFICULT ON ONE-PIECE UNITS. ALL YOU NEED IS AN OLD PAIR OF HEADFONES, OR SIMILAR, A PHILLIPS SCREWDRIVER, A SOLDERING IRON AND SOME SOLDER.
------INSTRUCTIONS ------
00126 PHREAKERS' RECIPE BOOK OPEN YOUR FONE WITH THE SCREWDRIVER. WHEN OPENED, LOOK FOR THE RED AND BLACK WIRES THAT LEAD TO THE MOUTHPIECE. (IF YOU’RE NOT SURE WHICH WIRES LEAD TO THE MOUTHPIECE, OPEN UP THE MOUTHPIECE AND FIND THE SAME COLOR WIRES ON THE BASE. FOR ONE-PIECE UNITS, JUST LOCATE THE MOUTHPIECE).
WHEN YOU HAVE FOUND THE MOUTHPIECE, OR WIRES, CUT THE HEAD OF THE HEADFONES OFF, AND ONE WIRE (THE ONE THAT LEADS TO THE RIGHT EAR). STRIP THE LEFT WIRE SO ABOUT AN EIGHTH INCH IS SHOWING. KEEP THE OTHER SIDE IN TACT.
THEN ON THE RED WIRE, SOLDER THE WIRE THAT IS SEPARATELY SEALED FROM THE OTHER ONE. ON THE BLACK WIRE (THESE ARE THE ENDS OF THE WIRE ON THE CIRCUIT BOARD)SOLDER THE WIRE WRAPPED AROUND THE OTHER WIRE. THEN SOLDER A HOLE FOR THE WIRE. YOU HAVE NOW MADE A NEON BOX.
PHREAKERS’ RECIPE BOOK 00127 Olive Box Plans Courtesy of the Jolly Roger
This is a relatively new box, and all it basically does is serve as a phone ringer. You have two choices for ringers, a piezoelectric transducer (ringer), or a standard 8 ohm speaker. The speaker has a more pleasant tone to it, but either will do fine. This circuit can also be used in conjunction with a rust box to control an external something or other when the phone rings. Just connect the 8 ohm speaker output to the inputs on the rust box, and control the pot to tune it to light the light (which can be replaced by a relay for external controlling) when the phone rings.
00128 PHREAKERS' RECIPE BOOK ______| | ^ NC ----- | -- 5 4 -- |-----/\/\/------>G | | / R2 G<-----)|------| -- 6 3 -- |-- NC | C3 | U1 | ------| -- 7 2 -- |------> TO RINGER | | ------| -- 8 1 -- |-- | |______| | | ---/\/\/---- | (----- L1 | R1 C1 ------L2
a. Main ringer TTL circuit
(>: : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : <)
_ FROM PIN 2 < ------| |_| |------>G P1
b. Peizoelectric transducer
(>: : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : <)
__ / | FROM PIN 2 < ------|( ------. .------| |/ | >| |< |S1 | | >| |< -- | | | >| |< | |__|\ | G<------. >| |<.--- \| T1
c. Elctro magnetic transducer
PHREAKERS’ RECIPE BOOK 00129 ------Parts List ------
U1 - Texas Instruments TCM1506 T1 - 4000:8 ohm audio transformer S1 - 8 ohm speaker R1 - 2.2k resistor R2 - External variable resistor; adjusts timing frequency C1 - .47uF capacitor C2 - .1uF capacitor C3 - 10uF capacitor L1 - Tip L2 - Ring L1 and L2 are the phone line.
------Shift Rate: ------
This is the formula for determining the shift rate:
1 1 SR = ------= ------= 6.25 Hz (DSR(1/f1)+DSR(1/f2)) 128 128 ---- + ---- 1714 1500
DSR = Shift Divider Rate ratio = 128 f1 = High Output Frequency = 1714 f2 = Low Output Frequency = 1500
00130 PHREAKERS' RECIPE BOOK Orange Box The Lucky225 Original! By: Lucky225
Just when you thought you ran out of colored boxes. The orange box is a box that simulates the tone the central office uses to signal Call Waiting Caller I.D. boxes when theres another call on call waiting. The way Caller I.D. Call Waiting(CIDCW) works is when theres another call the central office first notifies the caller with a call waiting tone(440hz for 300ms) followed by a ‘CAS’(CPE Alerting Signal) tone that tells the CIDCW box that another call is coming and to get ready to receive FSK caller i.d. information. When the CAS tone is
PHREAKERS’ RECIPE BOOK 00131 detected by the CIDCW box it mutes the persons handset and sends the central office an acknowledgment tone, which is usually DTMF “A” or DTMF “D”.
This acknowledgment tone is sent to tell the central office to send the FSK CID information. What the Orange box does is simulates a CAS tone(2130+2750hz). You can use this when talking to someone who has CIDCW, it well make there box flash ‘CALL WAITING’ and mute the handset, and you’ll get to hear the CIDCW box acknowledge your CAS tone. IF you had a recording of an FSK signal you could play the CAS tone, when you hear the box acknowledge your signal play the FSK signal and the CIDCW box well show the caller i.d. info you sent. To get a recording of an FSK signal order Caller I.D. Call-waiting and don’t plug in the call waiting box. When your on a call and you get call-waiting you well hear a call- waiting tone and a CAS tone, play DTMF ‘D’ or ‘A’ and you’ll actually hear the caller i.d. FSK transmission, record it. Then call up someone with CIDCW, play CAS tone, when you hear the box chirp play the recording, the caller will see the caller
00132 PHREAKERS' RECIPE BOOK i.d. information you recorded on their screen.
------What You’ll Need: ------
Tone Dialer(It cant be the LCD dialer from RadioShack, the tone will be to slow) 8.192Mhz crystal (you can get this at mouser)
------What to do: ------
If you’ve made a Redbox, this is fairly simple, open the dialer up find the 3.579545mhz crystal, it well be on the board marked as ‘X1’. De-solder it and Solder in the 8.192Mhz crystal on. That’s it, you’re done.
------Usage: ------
Turn the dialer on, press the * key, that’s the CAS tone, have fun!! :)
PHREAKERS’ RECIPE BOOK 00133 Orange-Box deluxe building plans: copyright 1991
The orange box is a design which will allow you, the phone owner to have your own free no charge caller ID system. Now we will have to do some re-routing wires for this little damn jobber to cooperate through the phone system. Below is the only small picture plan that I was able to collect. Nothing on the cyberspace has proved to me otherwise.
00134 PHREAKERS' RECIPE BOOK 11111111111111111111111111111111111111111111 1 2 Display. 2 1 1 2 2 1 1 222222222222 1 1 1 11111111111111111111111111111111111111111111 blue wire inside 33333333333------3 22222222222222 2 the red wire 3 555555555556 2 display 44444444444 cross 5333333333336 2 green wire 5 22222222222222 2 55555555555------5
The explanation for this schematic is to cross the blue and green wires. When you look at the back of your caller ID de- solder the green and blue and put blue on right and green on left. This pulls in the call Identification system instead of refusing it. Please have fun with your new toy. And a little advice. Don’t screw the phone company. He! He!
Jason Bosoghraph ILEEETSOOOOO!!!! the cyber man.
PHREAKERS’ RECIPE BOOK 00135 Red Box Plans by the Jolly Roger
Red boxing is simulating the tones produced by public pay phones when you drop your money in.
The tones are beeps of 2200 Hz + 1700 Hz
Nickle = 1 beep for 66 milliseconds. Dime = 2 beeps, each 66 milliseconds with a 66 millisecond pause between beeps. Quarter = 5 beeps, each 33 milliseconds with a 33 millisecond pause between beeps.
00136 PHREAKERS' RECIPE BOOK There are two commonly used methods being used by Phreaks to make free calls.
1. An electronic hand-held device that is made from a pair of Wien-bridge oscillators with the timing controlled by 555 timing chips.
2. A tape recording of the tones produced by a home computer. One of the best computers to use would be an Atari ST. It is one of the easier computers to use because the red box tones can be produced in basic with only about 5 statements.
------Jolly Roger
PHREAKERS’ RECIPE BOOK 00137 Party Box (free 3-way calling) Created by Greyhawke of TDK
Ever wanted three-way calling without having to pay for it? Wanted to connect two phone conversations at once, without any static or excess wiring, or even having two phone lines? Ever gone beige boxing and wanted to connect two operators (or anyone!) but didn’t have the necessary stuff with you? The party box fixes them all!
First off, go to your local Radio Shack and pick up the following parts:
00138 PHREAKERS' RECIPE BOOK (1) DPDT slide switch (all you need is DPST, but DPDTs are easy to get) (2) Modular phone jacks (4) Alligator clips Some wire (doesn’t matter what kind)
For the modular jacks, if you get the kind that look like a box with the back open, it makes a nice looking party box when you stick them together.
------Assembly: ------
Take four lengths of wire, and strip the ends about 1/4” on both ends of the wire. Connect two wires to the red and green terminals on one phone jack, and two wires to the red and green terminals on the other phone jack (so you’ve used all four pieces of wire). Connect to the other ends of each wire a red or green alligator clip (down at Radio Shack they sell some nice ones with color coded insulator sleeves. Get these, it’s REAL important that you know the red ends from the green). If you do this right,
PHREAKERS’ RECIPE BOOK 00139 you’ll have a red and green alligator clip on each of the two phone jacks, connected to the wires. By this time, you should not have any wire end loose; they should all be connected to SOMETHING.
Now, if you’ve been paying attention and you know your boxes, you’ll recognize the two pieces of equipment you’ve just assembled as beige boxes.
That’s all they are, really, is beige boxes.
Here’s what makes those two beige boxes into a single party box. Take four more short (like 1.5”) lengths of wire, and strip all the ends to about 1/4”. First connect one side of each wire to a contact on the DPDT or DPST switch. Just make sure it’s the right switch. For DPST, you won’t have a problem, but for DPDT, make sure the switch looks like this when the wires are connected:
*-**-* - *-**-* -
It’s doesn’t really matter which side you connect the wires to, just make sure
00140 PHREAKERS' RECIPE BOOK that at least two of them are in the middle. The wires are connected to the terminals surrounded by asterisks (*).
Solder each connection carefully to make sure it’s a good one that won’t fall off, and make sure none of the wires are touching each other!! If they do you’ve got a short circuit and the box won’t work!
Here’s the tricky part. Take the bottom two wires (looking at the DPDT switch from the bottom, so it looks like the above picture) and connect each one to the red terminal on the phone jacks. One wire to each jack. Then, take the top two wires and connect one to the green terminal on each phone jack.
Again, one wire to each jack. Screw down all the terminals good and tight. If you’ve done this correctly, there should be two wires leading to each red and green terminal on the two phone jacks. Set the switch so it’s in the off position.
It’s off when only the middle terminals of the switch are covered, or so that the
PHREAKERS’ RECIPE BOOK 00141 switch is on the side where there aren’t any wires coming to the terminals there. Just make sure it’s in the beige mode. Your box is now built.
(This is if you used the jacks I suggested at the top of the file.) To make it look pretty, you can cut away a portion of the plastic surrounding one of the jacks so that the switch will fit nicely in the place you cut away.
Also cut away a small half-circle on the bottom of the surrounding plastic to feed the wires out of (the ones with the alligator clips, not the ones leading to the switch). Once these two things are done, and the switch is screwed down securely, tape it all up, super-glue, who cares. It doesn’t matter; just so it stays together.
Once all this is done, here’s a few things I like to do to make things easy. Put a small dot of white paint in the lower part of the switch, so that when it’s on the paint shows. This is easy to do. Also you might want to know which line you’re using for each box. Just put a glob of
00142 PHREAKERS' RECIPE BOOK a different colored paint on each side of the party box, and put the same color paint on the wires leading out of that side of the box.
------Use: ------
When used in beige box mode (so that the switch is off), the party box will operate just like two beige boxes. There are totally, 100% separate from each other, and the conversations don’t get crossed.
However, when used in the party box mode, the party box connects both lines to each other, essentially connecting all four people to the same line.
Everyone can hear each other, and there is little or no static created by doing this. It’s works great for connecting anyone together, and all that’s needed is each beige box connected to an output device (“Bell Can”), and the switch in the party mode position. See a file on beige boxing for detained info on what to do while boxing, etc, or how to connect to a
PHREAKERS’ RECIPE BOOK 00143 Bell Can.
------Schematic: ------
This is a really easy box, but someone might want a schematic, so here’s one:
<--- to one phone jack to the other phone jack --->
------__/ ------(red [ring] wire) | __/ ! | (red [ring] wire) ------O/ !_/ O ------(green [tip] wire) | __/ | (green [tip] wire) | O/ O | | | | | ------
It’s a really bad schematic, but the little things in the middle are supposed to represent the switch in the off position, and the exclamation points just mean it’s a DPST switch that doesn’t connect the top and the bottom terminals. The (-) and the (|) are supposed to be the wire.
------Disclaimer: ------
This file is, of course, only meant for informational purposes, and is in no way meant to be used. Any tapping of
00144 PHREAKERS' RECIPE BOOK telephone lines is a federal offense, so don’t come crying to me if you get busted, because I’m telling you not to do it. I’m not responsible for you; you’re responsible for you.
------Planet Playtex: 513/426-3856 300/1200bps, 24hrs/day
This file has been a production of The Dark Knights.
- EOF
PHREAKERS’ RECIPE BOOK 00145 Scarlet Box Plans by the Jolly Roger
The purpose of a Scarlet box is to create a very bad connection, it can be used to crash a BBS or just make life miserable for those you seek to avenge.
------Materials ------2 alligator clips, 3 inch wire, or a resister (plain wire will create greatest amount of static) (Resister will decrease the amount of static in proportion to the resister you are using)
00146 PHREAKERS' RECIPE BOOK Step (1):
Find the phone box at your victims house, and pop the cover off.
Step (2):
Find the two prongs that the phone line you wish to box are connected to.
Step (3):
Hook your alligator clips to your (wire/ resister).
Step (4):
Find the lower middle prong and take off all wires connected to it, i think this disables the ground and call waiting and shit like that.
Step (5):
Now take one of the alligator clips and attach it to the upper most prong, and take the other and attach it to the lower middle prong.
PHREAKERS’ RECIPE BOOK 00147 Step (6):
Now put the cover back on the box and take off!!
** ######## ** ** # #### # ** ######## / # #### # / ######## / / / / / / / / **/ **
** ** ** **
(**) = prongs ** (/) = (wire/resister) (##) = some phone bullshit
------Jolly Roger
00148 PHREAKERS' RECIPE BOOK Silver Box Plans by the Jolly Roger
------Introduction: ------
First a bit of Phone Trivia. A standard telephone keypad has 12 buttons.
These buttons, when pushed, produce a combination of two tones. These tones represent the row and column of the button you are pushing.
PHREAKERS’ RECIPE BOOK 00149 1 1 1 2 3 4 0 3 7 9 6 7 697 (1) (2) (3) 770 (4) (5) (6) 851 (7) (8) (9) 941 (*) (0) (#)
So (1) produces a tone of 697+1209, (2) produces a tone of 697+1336, etc.
------Function: ------
What the Silver Box does is just creates another column of buttons, with the new tone of 1633. These buttons are called A, B, C, and D.
------Usefulness: ------
Anyone who knows anything about phreaking should know that in the
00150 PHREAKERS' RECIPE BOOK old days of phreaking, phreaks used hardware to have fun instead of other people’s Sprint and MCI codes. The most famous (and useful) was the good ol’ Blue Box. However, Ma Bell decided to fight back and now most phone systems have protections against tone-emitting boxes. This makes boxing just about futile in most areas of the United States (i.e. those areas with Crossbar or Step-By- Step). If you live in or near a good-sized city, then your phone system is probably up-to-date (ESS) and this box (and most others) will be useless. However, if you live in the middle of nowhere (no offense intended), you may find a use for this and other boxes.
------Materials: ------
1 Foot of Blue Wire 1 Foot of Grey Wire 1 Foot of Brown Wire 1 Small SPDT Switch (*) 1 Standard Ma Bell Phone (*) SPDT = Single Pole/Double Throw
PHREAKERS’ RECIPE BOOK 00151 ------Tools: ------
1 Soldering Iron 1 Flat-Tip Screwdriver
------Procedure: ------
(1) Loosen the two screws on the bottom of the phone and take the casings off.
(2) Loosen the screws on the side of the keypad and remove the keypad from the mounting bracket.
(3) Remove the plastic cover from the keypad.
(4) Turn the keypad so that *0# is facing you. Turn the keypad over. You’ll see a bunch of wires, contacts, two Black Coils, etc.
(5) Look at the Coil on the left. It will have five (5) Solder Contacts facing you. Solder the Grey Wire to the fourth
00152 PHREAKERS' RECIPE BOOK Contact Pole from the left.
(6) Solder the other end of the Grey Wire to the Left Pole of the SPDT Switch.
(7) Find the Three (3) Gold-Plated Contacts on the bottom edge of the keypad. On the Left Contact, gently separate the two touching Connectors (they’re soldered together) and spread them apart.
(8) Solder the Brown Wire to the Contact farthest from you, and solder the other end to the Right Pole of the SPDT Switch.
(9) Solder the Blue Wire to the Closest Contact, and the other end to the Center Pole of the SPDT Switch. ð ðð ð(10) Put the phone back together.
------Using The Silver Box: ------
What you have just done was installed a switch that will change the 369# column into an ABCD column. For example, to dial a ‘B’, switch to Silver Box Tones and hit ‘6’.
PHREAKERS’ RECIPE BOOK 00153 No-one is sure of the A, B, and C uses. However, in an area with an old phone system, the ‘D’ button has an interesting effect. Dial Directory Assistance and hold down ‘D’. The phone will ring, and you should get a pulsing tone. If you get a pissed-off operator, you have a newer phone system with defenses against Silver Boxes. At the pulsing tone, dial a 6 or 7. These are loop ends.
------Jolly Roger
00154 PHREAKERS' RECIPE BOOK How to make a portable silver box By: The Phone Phantom
This will tell you how to make a portable silver box out of:
A Radio Shack touch tone pad Some wire A Soldering iron And a SPDT switch
NOTE: You should have an IQ. above room temperature before attempting this. Also, read all of this article before starting.
WARNING: This may be hazardous to your freedom.
PHREAKERS’ RECIPE BOOK 00155 1} Take off the plastic cover that stores the batteries and remove the screw that is in the center of the batteries. Now use a screw driver to pry open the box.
2} Now you should have the two halves in your hands. On the side that has the circuit board, it should be held by two clips. Remove the circuit board now.
3} You should now be able to see the back side of the keypad. Connecting the key pad and the circuit board is a ribbon cable. With the ribbon ends connected to the keypad away from you, count from the left over four wires. On the fourth wire, take and cut the plastic on either side on the wire. Then de-solder it.
4} Now stare at the circuit board. Look at the connections of the chip. (SEE FIG.) There should be four pins not connected to anything. On the ninth pin (first row, first pin) solder a 3 inch wire to it. The other end goes to the left side of the spdt switch.
5} Go back to the cable. Solder a 2 inch
00156 PHREAKERS' RECIPE BOOK to the ribbon cable you just took out. This is because it won’t reach the switch. The other end goes to right side of the switch.
6} Now take a two inch wire and solder it to the hole that the cable came out of. Be careful not to get solder on the other wires. Now take the other end and solder it to the middle of the switch.
7} Make a hole in the top of the case to put the switch through. And put it back together.
THE FIGURE!! OF THE CHIP.
THE PIN >9< 10 11 12 13 14 15 16
1 2 3 4 5 6 7 8
(Pretty cool eh?) ______
Switch the switch left according to the way you soldered it to make silver box tones on the 3,6,9, and # keys.
PHREAKERS’ RECIPE BOOK 00157 Switch it to the right for a normal key pad.
Switching it to the middle does NOTHING!!!!
This silver is small enough to fit in your pocket for phreaking at your nearest pay phone or where ever.
This file is for information only (RIGHT!) ha ha ha!
Written by:
The Phone Phantom
And a little (very little) help from...
Bubba Hampton Fortis The Camouflaged Panis (?) Forest
Of... Teenage Wasteland
00158 PHREAKERS' RECIPE BOOK The Tron Box Written by The GREAT Captain Crunch!!
------R-----F---- I I I I I I I I- (C) (C) (C) I I I I- I I I I ------
(C) = CAPACITOR F = FUSE R = RESISTOR I,- ARE WIRE
PHREAKERS’ RECIPE BOOK 00159 ------PARTS LIST: ------
(3) ELECTROLYTIC CAPACITORS RATED AT 50V(LOWEST) .47UF (1) 20-30OHM 1/2 WATT RESISTOR (1) 120VOLT FUSE (AMP RATING BEST TO USE AT LEAST HALF OF TOTAL HOUSE CURRENT OR EVEN LESS IT KEEPS YOU FROM BLOWING YOUR BREAKER JUST IN CASE...) (1) POWER CORD (CUT UP AN EXTENSION CORD. NEED PLUG PART AND WIRE) (1) ELECTRICALLY INSULATED BOX
IF YOUR DON’T FEEL COMFORTABLE WITH ELECTRICITY THEN DON’T PLAY WITH THIS THERE IS VOLTAGE PRESENT THAT WILL ***KILL*** YOU......
THE THING WORKS WHEN THE LOAD IN YOUR HOUSE IS LOW LIKE AT NIGHT TIME. IT WILL PUT A REVERSE PHASE SIGNAL ON THE LINE AND CANCEL OUT THE OTHER PHASE AND PUT A REVERSE PHASE RUNNING EVERYTHING IN THE HOUSE. WELL IF YOU HAVE EVER SWITCHED THE POWER LEADS ON A D.C. (BATTERY POWERED) MOTOR YOU WILL SEE THAT IT RUNS BACKWARDS WELL YOUR
00160 PHREAKERS' RECIPE BOOK ELECTRIC METER SORT OF WORKS THIS WAY... SO REVERSE PHASE MAKES THE METER SLOW DOWN AND IF YOUR LUCKY IT WILL GO BACKWARDS. ANYWAY IT MEANS A CHEAPER ELECTRIC BILL.
PHREAKERS’ RECIPE BOOK 00161 White Box Plans by the Jolly Roger
------Introduction: ------
The White Box is simply a portable Touch- Tone keypad. For more information on Touch-Tone, see my Silver Box Plans.
------Materials: ------
1 Touch-Tone Keypad 1 Miniature 1000 to 8 Ohm Transformer
00162 PHREAKERS' RECIPE BOOK (Radio Shack # 273-1380) 1 Standard 8 Ohm Speaker 2 9V Batteries 2 9V Battery Clips
------Procedure: ------
(1) Connect the Red Wire from the Transformer to either terminal on the Speaker.
(2) Connect the White Wire from the Transformer to the other terminal on the Speaker.
(3) Connect the Red Wire from one Battery Clip to the Black Wire from the other Battery Clip.
(4) Connect the Red Wire from the second Battery Clip to the Green Wire from the Keypad.
(5) Connect the Blue Wire from the Keypad to the Orange/Black Wire from the Keypad.
(6) Connect the Black Wire from the first Battery Clip to the two above wires (Blue and Black/Orange).
(7) Connect the Black Wire from the Keypad to the Blue Wire from the Transformer.
PHREAKERS’ RECIPE BOOK 00163 (8) Connect the Red/Green Wire from the Keypad to the Green Wire from the Transformer.
(9) Make sure the Black Wire from the Transformer and the remaining wires from the Keypad are free.
(10) Hook up the Batteries.
------Optional: ------
(1) Put it all in a case. (2) Add a Silver Box to it.
------Use: ------
Just use it like a normal keypad, except put the speaker next to the receiver of the phone you’re using.
------Jolly Roger
00164 PHREAKERS' RECIPE BOOK Appendix
PHREAKERS’ RECIPE BOOK 00165 The Bell Glossary
ACD: Automatic Call Distributor - A system that automatically distributes calls to operator pools (providing services such as intercept and directory assistance), to airline ticket agents, etc.
Administration: The tasks of record- keeping, monitoring, rearranging, prediction need for growth, etc.
AIS: Automatic Intercept System - A system employing an audio-response unit under control of a processor to automatically provide pertinent info to callers routed to intercept.
00166 PHREAKERS' RECIPE BOOK Alert: To indicate the existence of an incoming call, (ringing).
ANI: Automatic Number Identification - Often pronounced “Annie,” a facility for automatically identify the number of the calling party for charging purposes.
Appearance: A connection upon a network terminal, as in “the line has two network appearances.”
Attend: The operation of monitoring a line or an incoming trunk for off-hook or seizure, respectively.
Audible: The subdued “image” of ringing transmitted to the calling party during ringing; not derived from the actual ringing signal in later systems.
Backbone Route: The route made up of final-group trunks between end offices in different regional center areas.
BHC: Busy Hour Calls - The number of calls placed in the busy hour.
Blocking: The ratio of unsuccessful
PHREAKERS’ RECIPE BOOK 00167 to total attempts to use a facility; expresses as a probability when computed a priority.
Blocking Network: A network that, under certain conditions, may be unable to form a transmission path from one end of the network to the other. In general, all networks used within the Bell Systems are of the blocking type.
Blue Box: Equipment used fraudulently to synthesize signals, gaining access to the toll network for the placement of calls without charge.
BORSCHT Circuit: A name for the line circuit in the central office. It functions as a mnemonic for the functions that must be performed by the circuit: Battery, Over-voltage, Ringing, Supervision, Coding, Hybrid, and Testing.
Busy Signal: (Called-line-busy) An audible signal which, in the Bell System, comprises 480hz and 620hz interrupted at 60IPM.
By-link: A special high-speed means used in crossbar equipment for routing calls
00168 PHREAKERS' RECIPE BOOK incoming from a step-by-step office. Trunks from such offices are often referred to as “by-link” trunks even when incoming to non-crossbar offices; they are more properly referred to as “DC incoming trunks.” Such high-speed means are necessary to assure that the first incoming pulse is not lost.
Cable Vault: The point which phone cable enters the Central Office building.
CAMA: Centralized Automatic Message Accounting - Pronounced like Alabama.
CCIS: Common Channel Interoffice Signaling - Signaling information for trunk connections over a separate, non- speech data link rather that over the trunks themselves.
CCITT: International Telegraph and Telephone Consultative Committee- An International committee that formulates plans and sets standards for inter- country communication means.
CDO: Community Dial Office - A small usually rural office typically served by
PHREAKERS’ RECIPE BOOK 00169 step-by-step equipment.
CO: Central Office - Comprises a switching network and its control and support equipment. Occasionally improperly used to mean “office code.”
Centrex: A service comparable in features to PBX service but implemented with some (Centrex CU) or all (Centrex CO) of the control in the central office. In the later case, each station’s loop connects to the central office.
Customer Loop: The wire pair connecting a customer’s station to the central office.
DDD: Direct Distance Dialing - Dialing without operator assistance over the nationwide inter-toll network.
Direct Trunk Group: A trunk group that is a direct connection between a given originating and a given terminating office.
EOTT: End Office Toll Trunking - Trunking between end offices in different toll center areas.
00170 PHREAKERS' RECIPE BOOK ESB: Emergency Service Bureau - A centralized agency to which 911 “universal” emergency calls are routed.
ESS: Electronic Switching System - A generic term used to identify as a class, stored-program switching systems such as the Bell System’s No.1 No.2, No.3, No.4, or No.5.
ETS: Electronic Translation Systems - An electronic replacement for the card translator in 4A Crossbar systems. Makes use of the SPC 1A Processor.
False Start: An aborted dialing attempt.
Fast Busy: (often called reorder) - An audible busy signal interrupted at twice the rate of the normal busy signal; sent to the originating station to indicate that the call blocked due to busy equipment.
Final Trunk Group: The trunk group to which calls are routed when available high-usage trunks overflow; these groups generally “home” on an office next
PHREAKERS’ RECIPE BOOK 00171 highest in the hierarchy.
Full Group: A trunk group that does not permit rerouting off-contingent foreign traffic; there are seven such offices.
Glare: The situation that occurs when a two-way trunk is seized more or less simultaneously at both ends.
High Usage Trunk Group: The appellation for a trunk group that has alternate routes via other similar groups, and ultimately via a final trunk group to a higher ranking office.
Intercept: The agency (usually an operator) to which calls are routed when made to a line recently removed from a service, or in some other category requiring explanation. Automated versions (ASI) with automatic voice-response units are growing in use.
Interrupt: The interruption on a phone line to disconnect and connect with another station, such as an Emergence Interrupt.
00172 PHREAKERS' RECIPE BOOK Junctor: A wire or circuit connection between networks in the same office. The functional equivalent to an intraoffice trunk.
MF: Multi-frequency - The method of signaling over a trunk making use of the simultaneous application of two out of six possible frequencies.
NPA: Numbering Plan Area.
ONI: Operator Number Identification - The use of an operator in a CAMA office to verbally obtain the calling number of a call originating in an office not equipped with ANI.
PBX: Private Branch Exchange - (PABX: Private Automatic Branch Exchange) An telephone office serving a private customer, Typically , access to the outside telephone network is provided.
Permanent Signal: A sustained off-hook condition without activity (no dialing or ringing or completed connection); such a condition tends to tie up equipment, especially in earlier systems.
PHREAKERS’ RECIPE BOOK 00173 Usually accidental, but sometimes used intentionally by customers in high-crime- rate areas to thwart off burglars.
POTS: Plain Old Telephone Service - Basic service with no extra “frills”.
ROTL: Remote Office Test Line - A means for remotely testing trunks.
RTA: Remote Trunk Arrangement - An extension to the TSPS system permitting its services to be provided up to 200 miles from the TSPS site.
SF: Single Frequency. A signaling method for trunks: 2600hz is impressed upon idle trunks.
Supervise: To monitor the status of a call.
SxS: (Step-by-Step or Strowger switch) - An electromechanical office type utilizing a gross-motion stepping switch as a combination network and distributed control.
Talkoff: The phenomenon of accidental synthesis of a machine-intelligible signal
00174 PHREAKERS' RECIPE BOOK by human voice causing an unintended response. “Whistling a tone”.
Trunk: A path between central offices; in general 2-wire for inter-local, 4-wire for inter-toll.
TSPS: Traffic Service Position System - A system that provides, under stored- program control, efficient operator assistance for toll calls. It does not switch the customer, but provides a bridge connection to the operator.
X-bar: (Crossbar) - An electromechanical office type utilizing a “fine-motion” coordinate switch and a multiplicity of central controls (called markers).
There are four varieties:
No.1 Crossbar: Used in large urban office application; (1938)
No 3 Crossbar: A small system started in (1974).
No.4A/4M Crossbar: A 4-wire toll machine; (1943).
PHREAKERS’ RECIPE BOOK 00175 No.5 Crossbar: A machine originally intended for relatively small suburban applications; (1948)
Crossbar Tandem: A machine used for inter-local office switching.
00176 PHREAKERS' RECIPE BOOK How Ma Bell Works by the Jolly Roger
In this article, I will first describe the termination, wiring, and terminal hardware most commonly used in the Bell system, and I will include section on methods of using them.
------LOCAL NETWORK ------
The local telephone network between the central office/exchange and the telephone subscribers can be briefly described as follows:
PHREAKERS’ RECIPE BOOK 00177 From the central office (or local exchange) of a certain prefix(es), underground area trunks go to each area that has that prefix (Usually more than one prefix per area.) At every few streets or tract areas, the underground cables surface. They then go to the telephone pole (or back underground, depending on the area) and then to the subscribers house (or in the case of an apartment building or multi-line business, to a splitter or distribution box/panel).
Now that we have the basics, I’ll try and go in-depth on the subject.
------UNDERGROUND CABLES ------
These are sometimes inter-office trunks, but usually in a residential area they are trunk lines that go to bridging heads or distribution cases. The cables are about 2-3 inches thick (varies), and are either in a metal or PVC-type pipe (or similar). Rarely (maybe not in some remote rural areas) are the cables just
00178 PHREAKERS' RECIPE BOOK ‘alone’ in the ground. Instead they are usually in an underground cement tunnel (resembles a small sewer or storm- drain.) The manholes are >heavy< and will say ‘Bell system’ on them. They can be opened with a 1/2 inch wide crowbar (Hook-side) inserted in the top rectangular hole. There are ladder rungs to help you climb down. You will see the cable pipes on the wall, with the blue and white striped one being the inter-office trunk (at least in my area). The others are local lines, and are usually marked or color coded. There is almost always a posted color code chart on the wall, not to mention Telco manuals describing the cables and terminals, so I need not get into detail. Also, there is usually some kind of test equipment, and often Bell test sets are left in there.
------BRIDGING HEADS ------
The innocent-looking grayish-green boxes. These can be either trunk bridges or bridging for residences. The major trunk bridging heads are usually larger, and
PHREAKERS’ RECIPE BOOK 00179 they have the ‘Western Electric’ logo at the bottom, whereas the normal bridging heads (which may be different in some areas-depending on the company you are served by. GTE B.H.’s look slightly different. Also, do not be fooled by sprinkler boxes!) They can be found in just about every city.
To open a bridging head: if it is locked (and you’re feeling destructive), put a hammer or crowbar (the same one you used on the manhole) in the slot above the top hinge of the right door. Pull hard, and the door will rip off. Very effective! If it isn’t locked (as usual), take a 7/8 inch hex socket and with it, turn the bolt about 1/8 of a turn to the right (you should hear a spring release inside). Holding the bolt, turn the handle all the way to the left and pull out.
To Check for a test-set (which are often left by Bell employees), go inside - First check for a test-set (which are often left by Bell employees). There should be a panel of terminals and wires. Push the panel back about an inch or so, and rotate the top latch (round with a flat
00180 PHREAKERS' RECIPE BOOK section) downward. Release the panel and it will fall all the way forward. There is usually a large amount of wire and extra terminals. The test-sets are often hidden here, so don’t overlook it (Manuals, as well, are sometimes placed in the head). On the right door is a metal box of alligator clips. Take a few (Compliments of Bell.). On each door is a useful little round metal device. (Says ‘insert gently’ or’ clamp gently - do not over-tighten’ etc..) On the front of the disc, you should find two terminals. These are for your test set. (If you don’t have one, don’t despair -I’ll show you ways to make basic test sets later in this article).
Hook the ring (-) wire to the ‘r’ terminal; and the tip (+) wire to the other. (By the way, an easy way to determine the correct polarity is with a 1.5v LED. Tap it to the term. Pair, if it doesn’t light, switch the poles until it does. When it lights,find the longer of the two LED poles: This one will be on the tip wire (+). Behind the disc is a coiled up cord. This should have two alligator clips on it.. Its very useful, because you don’t have to keep connecting and disconnecting the
PHREAKERS’ RECIPE BOOK 00181 fone (test set) itself, and the clips work nicely.
On the terminal board, there should be about 10 screw terminals per side. Follow the wires, and you can see which cable pairs are active. Hook the clips to the terminal pair, and you’re set! Dial out if you want, or just listen (If someone’s on the line). Later, I’ll show you a way to set up a true ‘tap’ that will let the person dial out on his line and receive calls as normal, and you can listen in the whole time. More about this later...
On major prefix-area bridging heads, you can see ‘local loops’ ,which are two cable pairs (cable pair = ring+tip, a fone line) that are directly connected to each other on the terminal board. These ‘cheap loops’ as they are called, do not work nearly as well as the existing ones set up in the switching hardware at the exchange office. (Try scanning your prefixes’ 00xx to 99xx #’s.) The tone sides will announce themselves with the 1008 Hz loop tone, and the hang side will give no response. The first person should dial the ‘hang’ side, and the other person dial the
00182 PHREAKERS' RECIPE BOOK tone side, and the tone should stop if you have got the right loop.)
If you want to find the number of the line that you’re on, you can either try to decipher the ‘bridging log’ (or whatever), which is on the left door. If that doesn’t work, you can use the following:
------ANI # (Automatic Number ID) ------
This is a Telco test number that reports to you the number that you are calling from (It’s the same, choppy ‘Bell bitch’ voice that you get when you reach a disconnected #)
For the 213 NPA - Dial 1223 408 NPA - Dial 760 914 NPA - Dial 990
These are extremely useful when messing with any kind of line terminals, house boxes, etc.
Now that we have bridging heads wired, we can go on... (Don’t forget to close and
PHREAKERS’ RECIPE BOOK 00183 latch the box after all... Wouldn’t want GE and Telco people mad, now, would we?)
------“CANS” - Telephone Distribution Boxes ------
Basically, two types:
1> Large, rectangular silver box at the end of each street. 2> Black, round, or rectangular thing at every telephone pole.
Type 1 - This is the case that takes the underground cable from the bridge and runs it to the telephone pole cable (The lowest, largest one on the telephone pole.) The box is always on the pole nearest the bridging head, where the line comes up. Look for the ‘Call before you Dig - Underground cable’ stickers..
The case box is hinged, so if you want to climb the pole, you can open it with no problems. These usually have 2 rows of terminal sets.
You could try to impersonate a Telco
00184 PHREAKERS' RECIPE BOOK technician and report the number as ‘new active’ (giving a fake name and fake report, etc.) I don’t recommend this, and it probably won’t (almost positively won’t) work, but this is basically what Telco linemen do).
Type 2 - This is the splitter box for the group of houses around the pole (Usually 4 or 5 houses). Use it like I mentioned before. The terminals (8 or so) will be in 2 horizontal rows of sets. The extra wires that are just ‘hanging there’ are provisions for extra lines to residences (1 extra line per house, thats why the insane charge for line #3!) If its the box for your house also, have fun and swap lines with your neighbor! ‘Piggyback’ them and wreak havoc on the neighborhood (It’s eavesdropping time...) Again, I don’t recommend this, and its difficult to do it correctly. Moving right along...
------APARTMENT / BUSINESS MULTI-LINE DISTRIBUTION BOXES ------
Found outside the building (most often on
PHREAKERS’ RECIPE BOOK 00185 the right side, but not always... Just follow the wire from the telephone pole) or in the basement. It has a terminal for all the lines in the building. Use it just like any other termination box as before.
Usually says ‘Bell system’ or similar. Has up to 20 terminals on it (usually.) The middle ones are grounds (forget these). The wires come from the cable to one row (usually the left one), with the other row of terminals for the other row of terminals for the building fone wire pairs. The ring (-) wire is usually the top terminal if the set in the row (1 of 10 or more), and the tip is in the clamp/screw below it. This can be reversed, but the cable pair is always terminated one-on- top-of-each- other, not on the one next to it. (I’m not sure why the other one is there, probably as a provision for extra lines) Don’t use it though, it is usually to close to the other terminals, and in my experiences you get a noisy connection.
Final note: Almost every apartment, business, hotel, or anywhere there is more than 2 lines this termination lines this termination method is used. If you
00186 PHREAKERS' RECIPE BOOK can master this type, you can be in control of many things... Look around in your area for a building that uses this type, and practice hooking up to the line, etc.
As an added help,here is the basic ‘standard’ color-code for multi-line terminals/wiring/etc...
Single line: Red = Ring Green = Tip Yellow = Ground * * (Connected to the ringer coil in individual and bridged ringer phones (Bell only) Usually connected to the green (Tip) Ring (-) = Red White/Red Stripe Brown White/Orange Stripe Black/Yellow Stripe Tip (+) = Green (Sometimes yellow, see above.) White/Green Stripe White/Blue Stripe Blue Black/White Stripe Ground = Black Yellow
PHREAKERS’ RECIPE BOOK 00187 ------RESIDENCE TERMINAL BOX ------
Small, gray (can be either a rubber (Pacific Telephone) or hard plastic (AT & T) housing deal that connects the cable pair from the splitter box (See type 2, above) on the pole to your house wiring. Only 2 (or 4, the 2 top terminals are hooked in parallel with the same line) terminals, and is very easy to use. This can be used to add more lines to your house or add an external line outside the house.
------TEST SETS ------
Well, now you can consider yourself a minor expert on the terminals and wiring of the local telephone network. Now you can apply it to whatever you want to do.. Here’s another helpful item:
How to make a Basic Test-Set and how to use it to dial out, eavesdrop, or seriously tap and record line activity.
00188 PHREAKERS' RECIPE BOOK These are the (usually) orange hand set fones used by Telco technicians to test lines. To make a very simple one, take any Bell (or other, but I recommend a good Bell fone like a princess or a Trimline. GTE flip fones work excellently, though..) fone and follow the instructions below. Note: A ‘black box’ type fone mod will let you tap into their line, and with the box o, it’s as if you weren’t there. They can receive calls and dial out, and you can be listening the whole time!
Very useful. With the box off, you have a normal fone test set.
------Instructions: ------
A basic black box works well with good results. Take the cover off the fone to expose the network box (Bell type fones only). The terminal should have a green wire going to it (orange or different if touch tone - doesn’t matter, its the same thing). Disconnect the wire and connect it to one pole of an SPST switch. Connect
PHREAKERS’ RECIPE BOOK 00189 a piece of wire to the other pole of the switch and connect it to the terminal. Now take a 10khm 1/2 watt 10% resistor and put it between the terminal ad the terminal, which should have a blue and a white wire going to it (different for touch tone). It should look like this:
-----Blue wire------F ! ----White wire-----! ! 10k Resistor ! ! --Green wire-- !----RR ! ! SPST
What this does in effect is keep the hook switch / dial pulse switch (F to RR loop) open while holding the line high with the resistor. This gives the same voltage effect as if the fone was ‘on-hook’, while the 10k ohms holds the voltage right above the ‘off hook’ threshold (around 22 volts or so, as compared to 15-17 or normal off hook 48 volts for normal ‘on-hook’), giving Test Set Version 2. Another design
00190 PHREAKERS' RECIPE BOOK is similar to the ‘type 1’ test set (above), but has some added features:
When the SPST switch in on, the LED will light, and the fone will become active. The green light should be on. If it isn’t, switch the dpst. If it still isn’t, check the polarity of the line and the LEDs. With both lights on, hang up the fone. They should all be off now. Now flip the dpst and pick up the fone. The red LED should be on, but the green shouldn’t. If it is, something is wrong with the circuit. You wont get a dial tone if all is correct.
When you hook up to the line with the alligator clips (Assuming you have put this circuit inside our fone and have put alligator clips on the ring and tip wires (As we did before)) you should have the spst #1 in the off position. This will greatly reduce the static noise involved in hooking up to a line. The red LED can also be used to check if you have the correct polarity.
With this fone you will have the ability to listen in on >all< audible line activity, and the people (the ‘eavesdropees’) can use
PHREAKERS’ RECIPE BOOK 00191 their fone as normal.
Note that test sets #1 and #2 have true ‘black boxes’, and can be used for free calls (see an article about black boxes).
Test Set Version 3
To do test set 3: Using a Trimline (or similar) phone, remove the base and cut all of the wire leads off except for the red (ring -) and the green (tip +). Solder alligator clips to the lug. The wire itself is ‘tinsel’ wrapped in rayon, and doesn’t solder well. Inside the one handset, remove the light socket (if it has one) and install a small slide or toggle switch (Radio Shack’s micro- miniature spst works well). Locate the connection of the ring and the tip wires on the PC board near where the jack is located at the bottom of the handset. (The wires are sometimes black or brow instead of red and green, respectively). Cut the foil and run 2 pieces of wire to your switch. In parallel with the switch add a .25 uf 200 VDC capacitor (mylar, silvered mica, ceramic, not an electrolytic). When the switch is closed,
00192 PHREAKERS' RECIPE BOOK the handset functions normally. With the switch in the other position, you can listen without being heard.
Note: To reduce the noise involved in connecting the clips to a line, add a switch selectable 1000 ohm 1/2 watt resistor in series with the tip wire. Flip it in circuit when connecting, and once on the line, flip it off again. (Or just use the ‘line disconnect’ type switch as in the type 2 test set (above)). Also avoid touching the alligator clips to any metal parts or other terminals, for i causes static on the line and raises people’s suspicions.
------RECORDING ------
If you would like to record any activity, use test set 1 or 2 above (for unattended recording of >all< line activity), or just any test set if you are going to be there to monitor when they are dialing, talking, etc.
Place a telephone pickup coil (I recommend
PHREAKERS’ RECIPE BOOK 00193 the Becoton T-5 TP coil or equivalent) onto the test set, and put the TP plug into the mic. jack of any standard tape recorder. Hit play, rec, and pause. Alternate pause when you want to record (I don’t think anyone should have any difficulty with this at all...) Well, if you still can’t make a test set or you don’t have the parts, there’s still hope. Alternate methods:
1> Find a bell test set in a manhole or a bridging head and ‘Borrow it indefinitely... 2> Test sets can be purchased from: Techni-Tool 5 Apollo Road Box 368 Plymouth Meeting PA., 19462 Ask for catalog #28
They are usually $300 - $600, and are supposed to have MF dialing capability as well as TT dialing. They are also of much higher quality than the standard bell test sets. If you would like to learn more about the subjects covered here,
I suggest:
00194 PHREAKERS' RECIPE BOOK 1> Follow Bell trucks and linemen or technicians and ask subtle questions. Also try 611 (repair service) and ask questions.. 2> Explore your area for any Bell hardware, and experiment with it. Don’t try something if you are not sure what you are doing, because you wouldn’t want to cause problems, would you?
------Jolly Roger
PHREAKERS’ RECIPE BOOK 00195 Stealing Calls from Pay phones by the Jolly Roger
Now to make free local calls, you need a finishing nail. I highly recommend “6D E.G. FINISH C/H, 2 INCH” nails. These are about 3/32 of an inch in diameter and 2 inches long (of course). You also need a large size paper clip. By large I mean they are about 2 inches long (FOLDED). Then you unfold the paper clip. Unfold it by taking each piece and moving it out 90 degrees. When it is done it should look somewhat like this:
00196 PHREAKERS' RECIPE BOOK /------\ : : : : : : : : \-----
Now, on to the neat stuff. What you do, instead of unscrewing the glued-on mouthpiece, is insert the nail into the center hole of the mouthpiece (where you talk) and push it in with pressure or just hammer it in by hitting the nail on something.
Just DON’T KILL THE MOUTHPIECE! You could damage it if you insert the nail too far or at some weird angle. If this happens then the other party won’t be able to hear what you say.
You now have a hole in the mouthpiece in which you can easily insert the paper clip. So, take out the nail and put in the paper clip.
Then take the other end of the paper clip and shove it under the rubber cord protector at the bottom of the handset (you know, the blue guy...).
PHREAKERS’ RECIPE BOOK 00197 This should end up looking remotely like... like this:
/------\ Mouthpiece : : Paper clip --> : : / : /------: ---\ : : : : ------> ======\---))) : : To earpiece ----> ^ ^ \------> : : : : Cord Blue guy
(The paper clip is shoved under the blue guy to make a good connection between the inside of the mouthpiece and the metal cord.) Now, dial the number of a local number you wish to call, sayyyy, MCI. If everything goes okay, it should ring and not answer with the “The Call You Have Made Requires a 20 Cent Deposit” recording. After the other end answers the phone, remove the paper clip. It’s all that simple, see?
There are a couple problems, however. One is, as I mentioned earlier, the mouthpiece not working after you punch it. If this
00198 PHREAKERS' RECIPE BOOK happens to you, simply move on to the next pay phone. The one you are now on is lost. Another problem is that the touch tones won’t work when the paper clip is in the mouthpiece. There are two ways around this..
A> Dial the first 6 numbers. This should be done without the paper clip making the connection, i.e., one side should not be connected. Then connect the paper clip, hold down the last digit, and slowly pull the paper clip out at the mouthpiece’s end.
B> Don’t use the paper clip at all. Keep the nail in after you punch it. Dial the first 6 digits. Before dialing the last digit, touch the nail head to the plate on the main body of the phone, the money safe thingy..then press the last number. The reason that this method is sometimes called clear boxing is because there is another type of phone which lets you actually make the call and listen to them say “Hello, hello?” but it cuts off the mouthpiece so they can’t hear you. The Clear Box is used on that to amplify your voice signals and send it through
PHREAKERS’ RECIPE BOOK 00199 the ear-piece. If you see how this is even slightly similar to the method I have just described up there, kindly explain it to ME!! Cause I don’t GET IT! Anyways, this DOES work on almost all single slot, Dial Tone First pay phones (Pacific Bell for sure). I do it all the time. This is the least, I STRESS *LEAST*, risky form of Phreaking.
------Jolly Roger
00200 PHREAKERS' RECIPE BOOK Bell Trashing by the Jolly Roger
The Phone Co. will go to extremes on occasions. In fact, unless you really know what to expect from them, they will surprise the heck out of you with their “unpublished tariffs”. Recently, a situation was brought to my attention that up till then I had been totally unaware of, least to mention, had any concern about. It involved garbage! The phone co. will go as far as to prosecute anyone who rummages through their garbage and helps himself to some
Of course, they have their reasons for
PHREAKERS’ RECIPE BOOK 00201 this, and no doubt benefit from such action. But, why should they be so picky about garbage? The answer soon became clear to me: those huge metal bins are filled up with more than waste old food and refuse... Although it is Pacific Tele. policy to recycle paper waste products, sometimes employees do overlook this sacred operation when sorting the garbage. Thus top-secret confidential Phone Co. records go to the garbage bins instead of the paper shredders. Since it is constantly being updated with “company memorandums, and supplied with extensive reference material, the Phone co. must continually dispose of the outdated materials. Some phone companies are supplied each year with the complete “System Practices” guide. This publication is an over 40 foot long library of reference material about everything to do with telephones. As the new edition arrives each year, the old version of “System Practices” must also be thrown out.
I very quickly figured out where some local phone phreaks were getting their material. They crawl into the garbage
00202 PHREAKERS' RECIPE BOOK bins and remove selected items that are of particular interest to them and their fellow phreaks. One phone phreak in the Los Angeles area has salvaged the complete 1972 edition of “Bell System Practices”. It is so large and was out of order (the binders had been removed) that it took him over a year to sort it out and create enough shelving for it in his garage.
Much of this “Top Secret” information is so secret that most phone companies have no idea what is in their files. They have their hands full simply replacing everything each time a change in wording requires a new revision. It seems they waste more paper than they can read!
It took quite a while for Hollywood Cal traffic manager to figure out how all of the local phone phreaks constantly discovered the switch-room test numbers
Whenever someone wanted to use the test-board, they found the local phone phreaks on the lines talking to all points all over the world. It got to the point
PHREAKERS’ RECIPE BOOK 00203 where the local garbage buffs knew more about the office operations than the employees themselves. One phreak went so far as to call in and tell a switchman what his next daily assignment would be. This, however, proved to be too much. The switchman traced the call and one phone phreak was denied the tool of his trade.
In another rather humorous incident, a fellow phreak was rummaging through the trash bin when he heard someone approaching. He pressed up against the side of the bin and silently waited for the goodies to come. You can imagine his surprise when the garbage from the lunchroom landed on his head. Most people find evenings best for checking out their local telco trash piles. The only thing necessary is a flashlight and, in the case mentioned above, possibly a rain coat. A word of warning though, before you rush out and dive into the trash heap. It is probably illegal, but no matter where you live, you certainly won’t get the local policeman to hold your flashlight for you.
------Jolly Roger
00204 PHREAKERS' RECIPE BOOK Basic Hacking Tutorial I Courtesy of the Jolly Roger
------What is hacking? ------
According to popular belief the term hacker and hacking was founded at MIT it comes from the root of a hack writer,someone who keeps “hacking” at the typewriter until he finishes the story. A computer hacker would be hacking at the keyboard or password works.
PHREAKERS’ RECIPE BOOK 00205 ------What you need: ------
To hack you need a computer equipped with a modem (a device that lets you transmit data over phone lines) which should cost you from $100 to $1200.
------How do you hack? ------
Hacking requires two things:
1. The phone number 2. Answer to identity elements
------How do you find the phone #? ------
There are three basic ways to find a computers phone number. 1. Scanning, 2. Directory 3. Inside info.
00206 PHREAKERS' RECIPE BOOK ------What is scanning? ------
Scanning is the process of having a computer search for a carrier tone. For example,the computer would start at (800) 111-1111 and wait for carrier if there is none it will go on to 111-1112 etc. If there is a carrier it will record it for future use and continue looking for more.
------What is directory assistance? ------
This way can only be used if you know where your target computer is. For this example say it is in Menlo Park, CA and the company name is SRI.
1. Dial 411 (or 415-555-1212) 2. Say “Menlo park” 3. Say “SRI” 4. Write down number 5. Ask if there are any more numbers 6. If so write them down. 7. Hang up on operator 8. Dial all numbers you were given
PHREAKERS’ RECIPE BOOK 00207 9. Listen fir carrier tone 10. If you hear carrier tone write down number, call it on your modem and your set to hack!
------Jolly Roger
00208 PHREAKERS' RECIPE BOOK Basic Hacking Tutorial II Courtesy of the Jolly Roger
Basics to know before doing anything, essential to your continuing career as one of the elite in the country... This article, “the introduction to the world of hacking” is meant to help you by telling you how not to get caught, what not to do on a computer system, what type of equipment should I know about now, and just a little on the history, past present future, of the hacker.
Welcome to the world of hacking! We, the people who live outside of the normal rules, and have been scorned and even
PHREAKERS’ RECIPE BOOK 00209 arrested by those from the ‘civilized world’, are becoming scarcer every day. This is due to the greater fear of what a good hacker (skill wise, no moral judgments here)|can do nowadays, thus causing anti- hacker sentiment in the masses. Also, few hackers seem to actually know about the computer systems they hack, or what equipment they will run into on the front end, or what they could do wrong on a system to alert the ‘higher’ authorities who monitor the system. This article is intended to tell you about some things not to do, even before you get on the system. I will tell you about the new wave of front end security devices that are beginning to be used on computers.
I will attempt to instill in you a second identity, to be brought up at time of great need, to pull you out of trouble. And, by the way, I take no, repeat,no, responsibility for what we say in this and the forthcoming articles.
Enough of the bullshit, on to the fun: after logging on your favorite BBS, you see on the high access board a phone number! It says it’s a great system to
00210 PHREAKERS' RECIPE BOOK “fuck around with!” This may be true, but how many other people are going to call the same number? So: try to avoid calling a number given to the public. This is because there are at least every other user calling, and how many other boards will that number spread to?
If you call a number far, far away, and you plan on going thru an extender or a re-seller, don’t keep calling the same access number (I.E. As you would if you had a hacker running), this looks very suspicious and can make life miserable when the phone bill comes in the mail. Most cities have a variety of access numbers and services, so use as many as you can. Never trust a change in the system... The 414’s, the assholes, were caught for this reason: when one of them connected to the system, there was nothing good there. The next time, there was a trek game stuck right in their way! They proceeded to play said game for two, say two and a half hours, while telenet was tracing them! Nice job, don’t you think? If anything looks suspicious, drop the line immediately!! As in, yesterday!! The point we’re trying to get across is: if
PHREAKERS’ RECIPE BOOK 00211 you use a little common sense, you won’t get busted. Let the little kids who aren’t smart enough to recognize a trap get busted, it will take the heat off of the real hackers. Now, let’s say you get on a computer system... It looks great, checks out, everything seems fine.
Ok, now is when it gets more dangerous. You have to know the computer system to know what not to do. Basically, keep away from any command something, copy a new file into the account, or whatever! Always leave the account in the same status you logged in with. Change *nothing*... If it isn’t an account with priv’s, then don’t try any commands that require them! All, yes all, systems are going to be keeping log files of what users are doing, and that will show up. It is just like dropping a trouble-card in an ESS system, after sending that nice operator a pretty tone.
Spend no excessive amounts of time on the account in one stretch. Keep your calling to the very late night if possible, or during business hours (believe it or not!). It so happens that there are more users on during business hours, and it is
00212 PHREAKERS' RECIPE BOOK very difficult to read a log file with 60 users doing many commands every minute.
Try to avoid systems where everyone knows each other, don’t try to bluff. And above all: never act like you own the system, or are the best there is. They always grab the people who’s heads swell... There is some very interesting front end equipment around nowadays, but first let’s define terms... By front end, we mean any device that you must pass thru to get at the real computer. There are devices that are made to defeat hacker programs, and just plain old multiplexers.
To defeat hacker programs, there are now devices that pick up the phone and just sit there... This means that your device gets no carrier, thus you think there isn’t a computer on the other end. The only way around it is to detect when it was picked up. If it picks up after the same number ring, then you know it is a hacker-defeater. These devices take a multi-digit code to let you into the system. Some are, in fact, quite sophisticated to the point where it will also limit the user name’s down, so only
PHREAKERS’ RECIPE BOOK 00213 one name or set of names can be valid logins after they input the code... Other devices input a number code, and then they dial back a pre-programmed number for that code. These systems are best to leave alone, because they know someone is playing with their phone. You may think “but I’ll just reprogram the dial-back.” Think again, how stupid that is... Then they have your number, or a test loop if you were just a little smarter. If it’s your number, they have your balls (if male...), If its a loop, then you are screwed again, since those loops are *monitored*. As for multiplexers... What a plexer is supposed to do is this:
The system can accept multiple users. We have to time share, so we’ll let the front- end processor do it... Well, this is what a multiplexer does. Usually they will ask for something like “enter class” or “line:”. Usually it is programmed for a double digit number, or a four to five letter word. There are usually a few sets of numbers it accepts, but those numbers also set your 300/1200/2400 baud data type.
00214 PHREAKERS' RECIPE BOOK These multiplexers are inconvenient at best, so not to worry. A little about the history of hacking: hacking, by my definition, means a great knowledge of some special area. Doctors and lawyers are hackers of a sort, by this definition. But most often, it is being used in the computer context, and thus we have a definition of “anyone who has a great amount of computer or telecommunications knowledge.” You are not a hacker because you have a list of codes... Hacking, by my definition, has then been around only about 15 years. It started, where else but, MIT and colleges where they had computer science or electrical engineering departments.
Hackers have created some of the best computer languages, the most awesome operating systems, and even gone on to make millions. Hacking used to have a good name, when we could honestly say “we know what we are doing”. Now it means (in the public eye): the 414’s, Ron Austin, the NASA hackers, the ARPANET hackers...
All the people who have been caught, have done damage, and are now going to have
PHREAKERS’ RECIPE BOOK 00215 to face fines and sentences. Thus we come past the moralistic crap, and to our purpose: educate the hacker community, return to the days when people actually knew something...
------Jolly Roger
00216 PHREAKERS' RECIPE BOOK Cellular Phreaking courtesy of The Jolly Roger
The cellular/mobile phone system is one that is perfectly set up to be exploited by phreaks with the proper knowledge and equipment. Thanks to deregulation, the regional BOC’s (Bell Operating Companies) are scattered and do not communicate much with each other. Phreaks can take advantage of this by pretending to be mobile phone customers whose “home base” is a city served by a different BOC, known as a “roamer”. Since it is impractical for each BOC to keep track of the customers of all the other BOC’s, they will usually allow the customer
PHREAKERS’ RECIPE BOOK 00217 to make the calls he wishes, often with a surcharge of some sort.
The bill is then forwarded to the roamers’ home BOC for collection. However, it is fairly simple (with the correct tools) to create a bogus ID number for your mobile phone, and pretend to be a roamer from some other city and state, that’s “just visiting”. When your BOC tries to collect for the calls from your alleged “home BOC”, they will discover you are not a real customer; but by then, you can create an entirely new electronic identity, and use that instead.
How does the cellular system know who is calling, and where they are? When a mobile phone enters a cell’s area of transmission, it transmits its phone number and its 8 digit ID number to that cell, who will keep track of it until it gets far enough away that the sound quality is sufficiently diminished, and then the phone is “handed off” to the cell that the customer has walked or driven into. This process continues as long as the phone has power and is turned on. If the phone is turned off (or the car is),
00218 PHREAKERS' RECIPE BOOK someone attempting to call the mobile phone will receive a recording along the lines of “The mobile phone customer you have dialed has left the vehicle or driven out of the service area.” When a call is made to a mobile phone, the switching equipment will check to see if the mobile phone being called is “logged in”, so to speak, or present in one of the cells. If it is, the call will then act (to the speaking parties) just like a normal call - the caller may hear a busy tone, the phone may just ring, or the call may be answered.
How does the switching equipment know whether or not a particular phone is authorized to use the network? Many times, it doesn’t. When a dealer installs a mobile phone, he gives the phone’s ID number (an 8 digit hexadecimal number) to the local BOC, as well as the phone number the BOC assigned to the customer. Thereafter, whenever a phone is present in one of the cells, the two numbers are checked - they should be registered to the same person. If they don’t match, the telco knows that an attempted fraud is taking place (or at best, some
PHREAKERS’ RECIPE BOOK 00219 transmission error) and will not allow calls to be placed or received at that phone. However, it is impractical (especially given the present state of deregulation) for the telco to have records of every cellular customer of every BOC.
Therefore, if you’re going to create a fake ID/phone number combination, it will need to be “based” in an area that has a cellular system (obviously), has a different BOC than your local area does, and has some sort of a “roamer” agreement with your local BOC.
How can one “phreak” a cellular phone? There are three general areas when phreaking cellular phones; using one you found in an unlocked car (or an unattended walk-about model), modifying your own chip set to look like a different phone, or recording the phone number/ID number combinations sent by other local cellular phones, and using those as your own. Most cellular phones include a crude “password” system to keep unauthorized users from using the phone - however, dealers often set the password (usually a 3 to 5 digit code) to the last four digits
00220 PHREAKERS' RECIPE BOOK of the customer’s mobile phone number. If you can find that somewhere on the phone, you’re in luck. If not, it shouldn’t be TOO hard to hack, since most people aren’t smart enough to use something besides “1111”, “1234”, or whatever.
If you want to modify the chip set in a cellular phone you bought (or stole), there are two chips (of course, this depends on the model and manufacturer, yours may be different) that will need to be changed - one installed at the manufacturer (often epoxied in) with the phone’s ID number, and one installed by the dealer with the phone number, and possible the security code. To do this, you’ll obviously need an EPROM burner as well as the same sort of chips used in the phone (or a friendly and unscrupulous dealer!). As to recording the numbers of other mobile phone customers and using them; as far as I know, this is just theory... But it seems quite possible, if you’ve got the equipment to record and decode it.
The cellular system would probably freak out if two phones (with valid ID/phone
PHREAKERS’ RECIPE BOOK 00221 number combinations) were both present in the network at once, but it remains to be seen what will happen.
------Jolly Roger
00222 PHREAKERS' RECIPE BOOK