____________________________________.
! !
! PIRATE TREK SYSTEMS PRESENTS !
! !
! THE BOOK OF BIOC !
! !
! A COMPILED PHREAKING TUTORIAL !
!____________________________________!
UPLOADED BY -THE TRIXTER-
HOW TO BE A REAL PHREAK
In the phone phreak society there are certain values that exist in order to be
a true phreak, these are best summed up by The Magician: "Many people think of
phone phreaks as slime, out to rip off bell for all she is worth. Nothing
could be further from the truth! Granted, there are some who get their kicks
by making free calls; However, they are not true phone phreaks. Real phone
phreaks are 'telecommunications hobbyists' who experiment, play with and learn
from the phone system. Occasionally this experimenting, and a need to
communicate with other phreaks (with-out going broke), leads to free calls.
The free calls are but a small subset of a >true< phone phreaks activities.
THE TEN COMMANDMENTS
Reprinted from tap issue #86. (Tap, room 603, 147 W 42 street, New York, NY
10036. Send an SASE for their info sheet "What the hell is tap?" and tell them
that BIOC agent 003 told you about it.)
THE PHONE PHREAK'S TEN COMMANDMENTS
I. BOX THOU NOT OVER THINE HOME
TELEPHONE WIRES, FOR THOSE WHO
DOEST MUST SURELY BRING THE
WRATH OF THE CHIEF SPECIAL
AGENT DOWN UPON THY HEADS.
II. SPEAKEST THOU NOT OF IMPORTANT
MATTERS OVER THINE HOME TEL-
EPHONE WIRES, FOR TO DO SO IS TO
RISK THINE RIGHT OF FREEDOM.
III. USE NOT THINE OWN NAME WHEN
SPEAKING TO OTHER PHREAKS, FOR
THAT EVERY THIRD PHREAK IS AN
FBI AGENT IS WELL KNOWN.
IV. LET NOT OVERLY MANY PEOPLE KNOW
THAT THY BE A PHREAK, AS TO DO
SO IS TO USE THINE OWN SELF AS
A SACRIFICIAL LAMB.
V. IF THOU BE IN SCHOOL, STRIVE TO
GET THIN SELF GOOD GRADES, FOR
THE AUTHORITIES WELL KNOW THAT
SCHOLARS NEVER BREAK THE LAW.
VI. IF THOU WORKEST, TRY TO BE A
EMPLOYEE, AND IMPRESSEST THINE
BOSS WITH THINE ENTHUSIASM, FOR
IMPORTANT EMPLOYEES ARE OFTEN
SAVED BY THEIR OWN BOSSES.
VII. STOREST THOU NOT THINE STOLEN
GOODES IN THINE OWN HOME, FOR
THOSE WHO DO ARE SURELY NON-
BELIEVERS IN THE BELL SYSTEM
SECURITY FORCES, AND ARE NOT
LONG FOR THIS WORLD.
VIII. ATTRACTEST THOU NOT THE ATT-
ENTION OF THE AUTHORITIES, AS
THE LESS NOTICABLE THOU ART, THE
BETTER.
IX. MAKEST SURE THINE FRIENDS ARE
INSTANT AMNESIACS AND WILL NOT
REMEMBER THAT THOU HAVE CALLED
ILLEGALLY, FOR THEIR COOPERATION
WITH THE AUTHORITIES WILL SURELY
LESSEN THINE TIME FOR FREEDOM ON
THIS EARTH.
X. SUPPORTEST THOU TAP, AS IT IS
THINE NEWSLETTER, AND WITHOUT
IT, THY WORK WILL BE FAR MORE
LIMITED.
CN/A NUMBERS
Customer name & address bureaus exist so that authorized bell employees may
obtain the name & address of any customer in the bell system by giving the CN/A
operator the customer's tel. #. All customers are maintained on file including
unlisted #'s. These bureaus have many uses for phreaks.
Here is how an employee might go about calling CN/A:
"HI, this is john doe from the Miami residental service center, can I have the
customer's name at (123) 555-1212." The employees usually use these for
checking who belongs to a # that someone claimed they didn't call.
If you sound cheery and natural the operator will never ask any questions. If
you don't sound like a mature adult, don't use it! Always practice first & so
you don't screw up and make the operator suspicious. Use name that sounds
real, not your pirate name either! Also say that you are from a city that is
far away from the one that you are calling.
The CN/A number for the NY area & vicinity (212, 315, 516, 518, 607, 716,
& 914) is (518) 471-8111 and is open during business hours. Don't abuse it!
AT&T NEWSLINES
AT&T newslines are numbers at area phone offices that telco employees call to
find out the latest info on new technology, stocks, etc. The recorded reports
range from very boring to very interesting.
HERE ARE A FEW OF THE NUMBERS:
*(201) 483-3800 NJ (518) 471-2272 NY
(203) 771-4920 CN (717) 255-5555 PA
(212) 393-2151 NY (717) 787-1031 PA
(516) 234-9941 NY *(914) 948-8100 NY
Some of these numbers are toll-free, but you can't always count on it.
* These numbers are not always up!
Numbers from other areas are available by request from F)BIOC L)AGENT 003.
ANI NUMBERS
ANI numbers identify the phone number that you are calling from. It is useful
when playing in cans (those big silver boxes on telephone poles) to find out
the # of the line. It is also good to find out the # of a phone that doesn't
have it printed on it. In the 914 area code the ani # is 990. if you just
have to dial the last 4 digits for a local #, ie. congers (268), dial
1-990-1111, where 1111 are dummy digits there is also a less useful type of ANI
# which will identify the area code & exchange. It is NXX-9901, where NXX is
the exchange. In the 212 & 516 area codes the ANI # is 958. Sysop Note: (In
an ESS Network, try 114. In a non-ESS Network, try 1958, or 1-990-1111.)
PHREAK NEWSLETTER
TAP is the "official" phone phreak newsletter, and has existed since 1971. Each
4 page issue is crammed full of information on phone phreaking, computer
phreaking, free gas, free electricity, free postage, breaking & entering info,
etc. It is largely phone phreak oriented, however.
A 10 issue subscription costs $8.00, if you get a bulk rate sealed envelope
subscription. I would recommend the first class subscription, which is $10.
As of this writing (7-16-83), the current issue is #86, and issue #50 is 8
pages instead of the usual 4. Back issues are $0.75 each, and issue #50 is
$1.50. A brief index to the first 80 issues is available for an SASE, or free
with a subscription order. TAP is non-profit, and in desperate need of
material (articles), money, and volunteers.
TAP
ROOM 603
147 WEST 42ND STREET
NEW YORK, NY 10036
BELIEVE ME: IT WILL BE THE BEST $10
YOU WILL EVER SPEND.
BLACK BOX
The black box is a device that attached to a called parties phone that allows
him/her to receive free long distance calls from friends who call.
You only need 2 parts: a spst toggle switch and a 10,000 ohm (10 k), 1/2
watt, 10% resistor. any electronics place should have these.
Now, cut two pieces of wire, about 6 inches, and attach these to the two screws
on the switch. turn your normal ddside down and unscrew the 2 screws. Locate
the "F" and "RR" screws on the network box. Wrap the resistor between these 2
screws and make sure that the wires touch only the proper terminals! Now
connect one wire from the switch to the RR terminal. Finally, attach the
remaining wire to the green wire (disconnect it from its terminal). Now bring
the switch out the rear of the phone and close it up. Put the switch in a
position where you get a dial tone, mark this normal. Mark the other side
free.
When your friends call (at a prearranged time), quickly lift & drop the
receiver as fast as possible. This will stop the ringing, if not try again.
It is very important that you do it fast! now put the switch in the free
position and pick up the phone. Keep all calls short & under 15 minutes.
When someone calls you long-distance, they are billed from the moment you
answer. The telco knows when you answer due to a certain amount of voltage
that flows when you pick up the phone. However, the resistor cuts down on the
voltage so it is below the billing range but sufficient enough to operate the
mouthpiece. Answering the phone for a fraction of a second stops the ring but
it is not enough for billing to start. If the phone is answered for even one
full second, billing will start and you will be cut off when you hang up and
switch to free.
WARNING: BELL CAN RANDOMLY LOOK FOR
BLACK BOXES SO BE CAREFUL!
Have you ever been in an office or somewhere and wanted to make a free fone
call but some asshole put a lock on the fone to prevent out-going calls?
Fret no more phellow phreaks, for every system can be beaten with a little
knowledge!
There are two ways to beat this obstacle, first pick the lock, I don't have
the time to teach locksmithing so we go to the second method which takes
advantage of telephone electronics.
To be as simple as possible, when you pick up the fone you complete a circuit
know as a local loop. When you hang-up you break the circuit. When you dial
(pulse) it also breaks the circuit but not long enough to hang up! So you can
"push-dial." To do this you >rapidly< depress the switchhook. For example, to
dial an operator (and then give her the number you want called) >rapidly< &
>evenly< depress the switchhook 10 times. To dial 634-1268, depress 6 x's
pause, then 3 x's, pause, then 4 x's, etc. It takes a little practice but
you'll get the hang of it. Try practicing with your own # so you'll get a busy
tone when right. It'll also work on TOUCH-TONE(TM) since a DTMF line will also
accept pulse. Also, never depress the switchhook for more than a second or
it'll hang-up!
Finally, remember that you have just as much right to that fone as the asshole
who put the lock on it!
EXCHANGE SCANNING
Almost every exchange in the bell system has test #'s and other "goodies" such
as loops with dial-ups.
These "goodies" are usually found between 9900 and 9999 in your local exchange.
If you have the time and initiative, scan your exchange and you may become
lucky!
HERE ARE MY FINDINGS IN THE 914-268 EXCHANGE:
9900 - ANI (SEE SEPARATE BULLETIN)
9901 - ANI (SEE SEPARATE BULLETIN)
9927 - OSC. TONE (POSSIBLE TONE SIDE OF
A LOOP)
9936 - VOICE # TO THE TELCO CENTRAL
OFFICE
9937 - VOICE # TO THE TELCO CENTRAL
OFFICE
9941 - COMPUTER (DIGITAL VOICE
TRANSMISSION?)
9960 - OSC. TONE (TONE SIDE LOOP) --
MAY ALSO BE A COMPUTER IN SOME
EXCHANGES
9961 - NO RESPONSE (OTHER END OF LOOP?)
9962 - NO RESPONSE (OTHER END OF LOOP?)
9963 - NO RESPONSE (OTHER END OF LOOP?)
9966 - COMPUTER (SEE 9941)
9968 - TONE THAT DISAPPEARS--RESPONDS
TO CERTAIN TOUCH-TONE KEYS
MOST OF THE NUMBERS BETWEEN 9900 & 9999 WILL RING OR GO TO A "WHAT #, PLEASE?"
OPERATOR.
HAVE PHUN AND REMEMBER IT'S ONLY A LOCAL CALL!
TOUCH-TONE & FREE CALLS
THERE ARE SEVERAL WAYS TO MAKE FREE CALLS (SPRINT, MCI, ETC.) USING A
ROTARY PHONE. THEY ARE:
1. USE A NUMBER THAT ACCEPTS VOICE AS
WELL AS DTMF. SUCH A # IS (800)
521-8400. AS OF WRITING THIS, A
CODE WAS 00717865.
A) IF USING VOICE, WAIT FOR THE
COMPUTER TO SAY, "AUTHORIZATION
#, PLEASE." THEN SAY EACH
DIGIT SLOWLY, IT WILL BEEP
AFTER EACH DIGIT IS SAID.
AFTER EVERY GROUP OF DIGITS, IT
WILL REPEAT WHAT YOU HAVE SAID,
THEN SAY YES IF IT IS CORRECT,
OTHERWISE SAY NO. IF THE
ACCESS CODE IS CORRECT, IT WILL
THANK YOU AND ASK FOR THE
DESTINATION #, THEN SAY THE
AREA CODE + NUMBER AS ABOVE.
ANOTHER SUCH # IS (800) 245-
8173, WHICH HAS A 6 DIGIT
ACCESS CODE. (NOTE: IF USING
TOUCH-TONE ON THIS #, ENTER THE
CODE IMMEDIATELY AFTER THE TONE
STOPS.)
2. HOOK UP A TOUCH-TONE FONE INTO
YOUR ROTARY FONE. ATTACH THE RED
WIRE FROM THE TOUCH-TONE FONE TO
THE "R" TERMINAL INSIDE THE FONE
ON THE NETWORK BOX. THEN HOOK THE
GREEN WIRE TO THE "B" TERMINAL.
TO USE THIS DIAL THE # USING
ROTARY & THEN USE THE TOUCH-TONE
FOR THE CODES. (DON'T HANG UP THE
ROTARY FONE WHILE DOING THIS
THOUGH!) IF THIS DOESN'T WORK
THEN REVERSE THE 2 WIRES. (NOTE:
IF YOUR LINE CAN ACCEPT TOUCH-TONE
BUT YOU HAVE A ROTARY FONE THEN
YOU CAN HOOK UP A TONE FONE
DIRECTLY FOR ALL CALLS BUT THIS
USUALLY ISN'T THE CASE.)
SUCH AS RADIO SHACK'S 43-138.
OTHER ALTERNATIVES
4. USE A CHARGE-A-CALL FONE. (THESE
ALSO MAKE GREAT EXTENTIONS IF YOU
REMOVE IT USING A HEX WRENCH WITH
A HOLE IN THE MIDDLE ON THE CENTER
SCREW!)--(THESE FONES FOR THE
BENEFIT OF THOSE WHO DON'T KNOW
ARE BLUE WITH NO COIN SLOTS)
5. USE A PAY FONE THAT WANTS YOUR
MONEY BEFORE THE DIAL TONE. PUT
IN YOUR DIME, DIAL THE #; IF IT'S
AN 800 # THEN YOUR DIME WILL COME
BACK, IMMEDIATELY PUT A DIME BACK
IN (IT'LL COME BACK WHEN YOU HANG
UP!) IF IT IS A TONE FIRST FONE
AND IT DISCONNECTS THE KEYPAD
(SOME DON'T) THEN FIND ANOTHER
FONE.
TELCO TRACING
THE GOOD 'OL DAYS:
------------------
Way back before I was a phreak, ma bell would have to manually trace a call if
they thought something was fucked up. First they would send a 2000 HZ tracing
tone, it would be followed by alot of noise and clicks. It took about 2-3
minutes to trace a call and alot of people were involved in the process. So at
1 in the morning they would have to wake up people for the tracees (phreak
jargon for a pay fone). But never use the same one more than once or twice
because the Gestapo (er..excuse me mean bell security) has been know for
staking out troubled fortresses. It's also possible for TRAVELNET or SP to ask
for a trouble # but the telco is slow in processing stuff--especially for the
competition--so don't fret phellow phreaks.
MODERN TECHNOLOGY:
------------------
this can be attributed to ESS + CCIS which can be traced in 1 second.
MISCELLANEOUS STUFF
Here are a phew (pushing it on that word) bits of info on telephone
electronics. If you don't appreciate it then I say "PHUCK U."
VOLTAGES:
When your fone is on-hook (ie-hung up) there is a 48 volt DC current flowing
through the line (I have a great idea about hooking a battery charger up to my
fone ). When the fone is off-hook the voltage drops down to around 15VDC. The
black box (see separate articles) exploits this for free calls since bell uses
this voltage drop when the called party picks up to start billing. Bell may
also reverse the polarity of the line to start billing--if you have a tone fone
the keypad won't work if the polarity is reversed. Usually, the red wire is
called the tip since it is the more (+) of the 2 wires + the green wire is
called the ring (-).
RING TRIP:
When someone calls you bell has to send 90 volts AC down your line at about 60
HZ to activate your bell (this is why deaf people can have light bulbs & fans
go off instead of a bell). The device that does the ringing is called a
ringing generator and the process of ringing is called a ring trip. This costs
bell money and they don't like using all that electricity from the local
rip-off power company - so let it ring. This is also, how bell can check for
extra fones from their central office by seeing how much voltage the line takes
while ringing and they can tell how many fones you're not suppose to have.
Solution: disconnect the bell.
MODERN TECHNOLOGY:
------------------
The 2 worst enemies to the phreak besides the FBI + bell security, are: ESS +
CCIS. ESS stands for Electronic Switching System and it can trace a call in
seconds, it also records all calls and can even tap into lines (er..I mean
check for line quality) and record calls. CCIS stands for common channel
inter-office signaling and it allows for control signals to be sent via
separate data links instead of tones over the voice channel--start kissing your
blue box goodbye.
