____________________________________
! !
! Pirate Trek Systems Presents !
! !
! The Book of BIOC !
! !
! A Compiled Phreaking Tutorial !
!____________________________________!
How to be a Real Phreak
In the phone phreak society there are certain values that exist in order to
be a true phreak, these are best summed up by the Magician:
"Many people think of phone phreaks as slime, out to rip off Bell for all she
is worth. Nothing could be further from the truth! Granted, there are
some who get their kicks by making free calls; however, they are not true
phone phreaks. Real phone phreaks are 'Telecommunications Hobbyists' who
Experiment, play with and learn from the phone system. Occasionally this
experimenting, and a need to communicate with other phreaks (without
going broke), leads to free calls. The free calls are but a small subset
of a >true< phone phreaks activities."
The Ten Commandments
Reprinted from TAP Issue #86. (TAP, Room 603, 147 W 42 Street, New York, NY
10036. Send a SASE for their info sheet "What the hell is TAP?" and
tell them that BIOC Agent 003 told you about it.)
The Phone Phreak's Ten Commandments
I. Box thou not over thine home telephone wires, for those who
doest must surely bring the wrath of the chief special
agent down upon thy heads.
II. Speakest thou not of important matters over thine home telephone
wires, for to do so is to risk thine right of freedom.
III. Use not thine own name when speaking to other phreaks, for
that every third phreak is an FBI agent is well known.
IV. Let not overly many people know that thy be a phreak, as to do
so is to use thine own self as a sacrificial lamb.
V. If thou be in school, strive to get thine self good grades, for
the authorities well know that scholars never break the law.
VI. If thou workest, try to be a good employee, and impressest thine
boss with thine enthusiasm, for important employees are often
saved by their own bosses.
VII. Storest thou not thine stolen goodes in thine own home, for
those who do are surely nonbeleivers in the Bell System
Security Forces, and are not long for this world.
VIII. Attractest thou not the attention of the authorities, as
the less noticeable thou art, the better.
IX. Makest sure thine friends are instant amnesiacs and will not
remember that thou have called illegally, for their cooperation
with the authorities will surely lessen thine time for freedom on
this earth.
X. Supportest thou TAP, as it is thine newsletter, and without
it, thy work will be far more limited.
CN/A Numbers
Customer Name & Address Bureaus exist so that authorized Bell Employees may
obtain the Name & Address of any customer in the Bell System by giving
the CN/A Operator the customer's telephone number. All customers are maintained
on file including unlisted number's. These bureaus have many uses for phreaks.
Here is how an employee might go about calling CN/A:
"Hi, this is John Doe from the Miami Residential Service Center, can I have
the customers name at (123) 555-1212." The employees usually use these for
checking who belongs to a number that someone claimed they didn't call.
If you sound cheery and natural the operator will never ask any questions.
If you don't sound like a mature adult, don't use it! Always practice first
and have a script ready so you don't screw up and make the operator suspicious.
Use a name that sounds real, not your pirate name either! Also say that you are
from a city that is far away from the one that you are calling.
The CN/A number for the NY area and vicinity (212, 315, 516, 518, 607, 716,
& 914) is >>>>>>>>>(518) 471-8111<<<<<< and is open during business hours.
Don't abuse it!
AT&T Newslines
AT&T newslines are numbers at area phone offices that Telco employees call
to find out the latest info on new technology, stocks, etc. The recorded
reports range from very boring to very interesting.
Here are a few of the numbers:
*(201) 483-3800 NJ (518) 471-2272 NY
(203) 771-4920 CN (717) 255-5555 PA
(212) 393-2151 NY (717) 787-1031 PA
(516) 234-9941 NY *(914) 948-8100 NY
Some of these numbers are toll-free, but you can't always count on it.
* These numbers are not always up!
Numbers from other areas are available by request from F)Bioc L)Agent 003.
ANI Numbers
ANI numbers identify the phone number that you are calling from. It is
that doesn't have it printed on it. In the 914 area code the ANI # is 990. If
you just have to dial the last 4 digits for a local #, ie Congers (268), dial
1-990-1111, where 1111 are dummy digits. There is also a less useful type of ANI
# which will identify the area code & exchange. It is NXX-9901, where NXX is
the exchange. In the 212 & 516 area codes the ANI # is 958.
Phreak Newsletter
TAP is the "Official" phone phreak newsletter, and has existed since 1971.
Each 4 page issue is crammed full of information on phone phreaking,
computer phreaking, free gas, free electricity, free postage, breaking and
entering info, etc. It is largely phone phreak oriented, however.
A 10 issue subscription costs $8.00, if you get a bulk rate sealed envelope
subscription. I would recommend the first class subscription, which is $10.
As of this writing (7-16-83), the current issue is #86, and issue #50 is
8 pages instead of the usual 4. Back issues are $0.75 each, and issue #50
is $1.50. A brief index to the first 80 issues is available for a SASE, or
free with a subscription order. TAP is non-profit, and in desperate need of
material (articles), money, and volunteers.
TAP
Room 603
147 West 42nd Street
New York, NY 10036
Believe me: It will be the best $10 you will ever spend...
Black Box
The Black Box is a device that attached to a called parties phone allows
him/her to receive free long distance calls from friends who call.
You only need 2 parts: A SPST toggle switch and a 10,000 OHM (10 K), 1/2
watt, 10% resistor. Any electronics place should have these.
Now, cut two pieces of wire, about 6 inches, and attach these to the two
screws on the switch. Turn your normal DDSide down and unscrew the two
screws. Locate the "F" and "RR" screws on the network box. Wrap the
resistor between these two screws and make sure that the wires touch only the
proper terminals! Now connect one wire from the switch to the RR terminal.
Finally, attach the remaining wire to the green wire (disconnect it from its
terminal). Now bring the switch out the rear of the phone and close it up.
Put the switch in a position where you get a dialtone, and mark this normal.
Mark the other side free.
When your friends call (at a prearranged time), quickly lift and drop
the receiver as fast as possible. This will stop the ringing, if not try
again. It is very important that you do it fast! Now put the switch in the
free position and pick up the phone. Keep all calls short and under 15
minutes.
When someone calls you long-distance, they are billed from the moment you
answer. The Telco knows when you answer due to a certain amount of
voltage that flows when you pick up the phone. However, the resistor cuts down
on the voltage so it is below the billing range but sufficient enough to
operate the mouthpiece. Answering the phone for a fraction of a second stops
the ring but it is not enough for billing to start. If the phone is
answered for even one full second, billing will start and you will be cut
off when you hang up and switch to free.
Warning: Bell can randomly look for Black boxes so be careful!
---------------------------------------
: :
***Blue wire**>>F< :
: * * :
**White wire**** * :
: * :
: Resistor :
: * :
: * :
: >RR<*******Switch*** :
: * :
****Green Wire********************* :
: :
---------------------------------------
DIAL LOCKS
Have you ever been in an office or somewhere and wanted to make a free
fone call but some asshole put a lock on the fone, well fret no more phellow
phreaks, for every system can be beaten with a little knowledge!
There are two ways to beat this obstacle, first pick the lock, and I don't
have the time to teach locksmithing so we go to the second method which takes
advantage of telephone electronics.
To be as simple as possible, when you pick up the fone you complete a circuit
known as a local loop. When you hang-up you break the circuit. When you dial
(pulse) it also breaks the circuit but not long enough to hang up! So you can
"push-dial." To do this you >RAPIDLY< depress the switchhook. For example,
to dial an operator (and then give her the number you want called) >RAPIDLY<
& >EVENLY< depress the switchhook 10 times. To dial 634-1268, depress 6 X'S,
pause, then 3 X'S, pause, then 4 X'S, etc. It takes a little practice but
you'll get the hang of it. Try practicing with your own number so you'll
get a busy tone when right. It'll also work on touch-tone(tm) since a DTMF
line will also accept pulse. Also, never depress the switchhook for more
than a second or it'll hang-up!
Finally, remember that you have just as much right to that fone as the asshole
who put the lock on it!
Exchange Scanning
Almost every exchange in the Bell System has test #'S and other "Goodies"
such as loops with dial-ups.
These "Goodies" come lucky!
Here are my findings in the 914-268 exchange:
9900 - ANI (See separate bulletin)
9901 - ANI (See separate bulletin)
9927 - OSC. Tone (Possible tone side of a loop)
9936 - Voice number to the Telco Central Office
9937 - Voice number to the Telco Central Office
9941 - Computer (Digital Voice Transmission?)
9960 - OSC. Tone (Tone side loop) -- May also be a computer in some exchanges
9961 - No Response (Other end of loop?)
9962 - No Response (Other end of loop?)
9963 - No Response (Other end of loop?)
9966 - Computer (See 9941)
9968 - Tone that disappears -- responds to certain touch-tone keys
Most of the numbers between 9900 & 9999 will ring or go to a "What #, please?"
operator.
Have phun and remember it's only a local call!
Touch-tone and Free Calls
There are several ways to make free calls (Sprint, MCI, etc.) using a
rotary phone. They are:
1. Use a number that accepts voice as well as DTMF. Such a # is (800)
521-8400. As of writing this, a code was 00717865.
A) If using voice, wait for the computer to say, "Authorization
number, please." Then say each digit slowly, it will beep
after each digit is said. After every group of digits, it
will repeat what you have said, then say yes if it is correct,
otherwise say no. If the access code is correct, it will
thank you and ask for the destination number, then say the
area code + number as above. Another such number is (800) 245-
8173, which has a six-digit access code. (Note: if using
touch-tone on this #, enter the code immediately after the tone
stops)
2. Hook up a touch-tone fone into your rotary fone. Attach the red
wire from the touch-tone fone to the "R" terminal inside the fone
on the network box. Then hook the green wire to the "B" terminal.
To use this dial the # using rotary and then use the touch-tone
for the codes. (Don't hang up the rotary fone while doing this
though!) If this doesn't work then reverse the two wires. (Note:
if your line can accept touch-tone but you have a rotary fone then
you can hook up a tone fone directly for all calls but this
usually isn't the case) (Such as Radio Shack's 43-138).
Other alternatives
4. Use a charge-a-call fone. (These also make great extensions if you
remove it using a hex wrench with a hole in the middle on the center
screw!)--(these fones for the benefit of those who don't know, they
are blue with no coin slots)
5. Use a pay fone that wants your money before the dial tone. Put
in your dime, dial the #; if it's an 800 # then your dime will come
back, immediately put a dime back in (it'll come back when you hang
up!) If it is a tone first fone and it disconnects the keypad
(some don't) then find another fone.
Telco Tracing
The Good 'Ol Days:
------------------
Way back before I was a phreak, Ma Bell would have to manually trace a call if
they thought something was fucked up. First they would send a 2000 HZ
tracing tone, that would be followed by a lot of noise and clicks. It took
about 2-3 minutes to trace a call and a lot of people were involved in the
process. So at 1 in the morning they would have to wake up people for the
tracees (Phreak jargon for a pay fone). But never use the same one
more than once or twice because the Gestapo (er....excuse me, I meant
Bell Security) has been known for staking out troubled fortresses. It's
also possible for Travelnet or Sprint to ask for a trouble # but the Telco
is slow in processing stuff -- especially for the competition -- so don't fret
phellow phreaks.
Modern Technology:
------------------
This can be attributed to ESS + CCIS which can be traced in 1 second.
----------------------------------------------------------------------------