use, the existing connection is broken and immediately re-established through the
other two ports of the busy verification circuit without interruption. Busy verification
circuit is controlled by access code. A dedicated trunk can be used but is not
necessary.
The busy verification circuit also can be used for test verify from the wire chiefs test
panel B. Additional busy verification conference circuits (002749) there it is right out
of an ESS manual word for word! And I'm getting 25 linear feet of ESS manuals! ! Not
counting the stack received so far!
109.White Box Plans by The Jolly Roger
Introduction:
The White Box is simply a portable touch-tone keypad. For more information on touch-
tone, see my Silver Box Plans.
Materials:
1 Touch-Tone Keypad
1 Miniature 1000 to 8 Ohm Transformer (Radio Shack # 273-1380)
1 Standard 8 Ohm Speaker
2 9V Batteries
2 9V Battery Clips
Procedure:
Connect the Red Wire from the Transformer to either terminal on the speaker.
Connect the White Wire from the transformer to the other terminal on the speaker.
Connect the Red Wire from one Battery Clip to the Black Wire from the other Battery
Clip.
Connect the Red Wire from the second Battery Clip to the Green Wire from the Keypad.
Connect the Blue Wire from the Keypad to the Orange/Black Wire from the Keypad.
Connect the Black Wire from the first Battery Clip to the two above wires (Blue and
Black/Orange).
Connect the Black Wire from the Keypad to the Blue Wire from the Transformer.
Connect the Red/Green Wire from the Keypad to the Green Wire from the Transformer.
Make sure the Black Wire from the Transformer and the remaining wires from the Keypad
are free.
Hook up the Batteries.
Optional:
Put it all in a case.
Add a Silver Box to it.
Use:
Just use it like a normal keypad, except put the speaker next to the receiver of the phone
you're using.
110.The BLAST Box by The Jolly Roger
Ever want to really make yourself be heard? Ever talk to someone on the phone who just
doesn't shut up? Or just call the operator and pop her eardrum? Well, up until recently it
has been impossible for you to do these things. That is, unless of course you've got a blast
box. All a blast box is, is a really cheap amplifier, (around 5 watts or so) connected in place
of the microphone on your telephone. It works best on model 500 AT&T Phones, and if
constructed small enough, can be placed inside the phone.
Construction:
Construction is not really important. Well it is, but since I'm letting you make
your own amp, I really don't have to include this.
Usage:
Once you've built your blast box, simply connect a microphone (or use the microphone from
the phone) to the input of the amplifier, and presto. There it is. Now, believe it or not, this
device actually works. (At least on crossbar.) It seems that Illinois bell switching systems
allow quite a lot of current to pass right through the switching office, and out to whoever
you're calling. When
you talk in the phone, it comes out of the other phone (again it works best if the phone
that you're calling has the standard western electric earpiece) incredibly loud. This device
is especially good for PBS Subscription drives. Have "Phun", and don't get caught!
111.Dealing with the Rate & Route Operator by The Jolly Roger
It seems that fewer and fewer people have blue boxes these days, and that is really too
bad. Blue boxes, while not all that great for making free calls (since the TPC can tell when
the call was made, as well as where it was too and from), are really a lot of fun to play
with. Short of becoming a real live TSPS operator, they are about the only way you can
really play with the network.
For the few of you with blue boxes, here are some phrases which may make life easier
when dealing with the rate & route (R&R) operators. To get the R&R op, you send a KP + 141
+ ST. In some areas you may need to put another NPA before the 141 (i.e., KP + 213 + 141 +
ST), if you have no local R&R ops.
The R&R operator has a myriad of information, and all it takes to get this data is mumbling
cryptic phrases. There are basically four special phrases to give the R&R ops. They are
NUMBERS route, DIRECTORY route, OPERATOR route, and PLACE NAME.
To get an R&R an area code for a city, one can call the R&R operator and ask for the
numbers route. For example, to find the area code for Carson City, Nevada, we'd ask the
R&R op for "Carson City, Nevada, numbers route, please." and get the answer, "Right... 702
plus." meaning that 702 plus 7 digits gets us there.
Sometimes directory assistance isn't just NPA+131. The way to get these routings is to
call R&R and ask for "Anaheim, California, directory route, please." Of course, she'd tell us
it was 714 plus, which means 714 + 131 gets us the D.A. op there. This is sort of pointless
example, but I couldn't come up with a better one on short notice.
Let's say you wanted to find out how to get to the inward operator for Sacremento,
California. The first six digits of a number in that city will be required (the NPA and an
NXX). For example, let us use 916 756. We would call R&R, and when the operator
answered, say, "916 756, operator route, please." The
operator would say, "916 plus 001 plus." This means that 916 + 001 + 121 will get you the
inward operator for Sacramento. Do you know the city which corresponds to 503 640?
The R&R operator does, and will tell you that it is Hillsboro, Oregon, if you sweetly ask for
"Place name, 503 640, please."
For example, let's say you need the directory route for Sveg, Sweden. Simply call R&R, and
ask for, "International, Baden, Switzerland. TSPS directory route, please." In response to
this, you'd get, "Right... Directory to Sveg, Sweden. Country code 46 plus 1170." So you'd
route yourself to an international sender, and send 46 + 1170 to get the D.A. operator in
Sweden.
Inward operator routings to various countries are obtained the same way "International,
London, England, TSPS inward route, please." and get "Country code 44 plus 121."
Therefore, 44 plus 121 gets you inward for London.
Inwards can get you language assistance if you don't speak the language. Tell the foreign
inward, "United States calling. Language assistance in completing a call to (called party) at
(called number)."
R&R operators are people are people too, y'know. So always be polite, make sure use of
'em, and dial with care.
112.Cellular Phreaking by The Jolly Roger
The cellular/mobile phone system is one that is perfectly set up to be exploited by phreaks
with the proper knowledge and equipment. Thanks to deregulation, the regional BOC's (Bell
Operating Companies) are scattered and do not communicate much with each other.
Phreaks can take advantage of this by pretending to be mobile phone customers whose
"home base" is a city served by a different BOC, known as a "roamer". Since it is
impractical for each BOC to keep track of the customers of all the other BOC's, they will
usually allow the customer to make the calls he wishes, often with a surcharge of some
sort.
The bill is then forwarded to the roamer's home BOC for collection. However, it is fairly
simple (with the correct tools) to create a bogus ID number for your mobile phone, and
pretend to be a roamer from some other city and state, that's "just visiting". When your
BOC tries to collect for the calls from your alleged "home BOC", they will discover you are
not a real customer; but by then, you can create an entirely new electronic identity, and
use that instead.
How does the cellular system know who is calling, and where they are? When a mobile
phone enters a cell's area of transmission, it transmits its phone number and its 8 digit ID
number to that cell, who will keep track of it until it gets far enough away that the sound
quality is sufficiently diminished, and then the phone is "handed off" to the cell that the
customer has walked or driven into. This process continues as long as the phone has power
and is turned on. If the phone is turned off (or the car is), someone attempting to call the
mobile phone will receive a recording along the lines of "The mobile phone customer you
have dialed has left the vehicle or driven out of the service area." When a call is made to
a mobile phone, the switching equipment will check to see if the mobile phone being called
is "logged in", so to speak, or present in one of the cells. If it is, the call will then act (to
the speaking parties) just like a normal call - the caller may hear a busy tone, the phone
may just ring, or the call may be answered.
How does the switching equipment know whether or not a particular phone is authorized to
use the network? Many times, it doesn't. When a dealer installs a mobile phone, he gives
the phone's ID number (an 8 digit hexadecimal number) to the local BOC, as well as the
phone number the BOC assigned to the customer. Thereafter, whenever a phone is present
in one of the cells, the two numbers are checked - they should be registered to the same
person. If they don't match, the telco knows that an attempted fraud is taking place (or
at best, some transmission error) and will not allow calls to be placed or received at that
phone. However, it is impractical (especially given the present state of deregulation) for
the telco to have records of every cellular customer of every BOC. Therefore, if you're
going to create a fake ID/phone number combination, it will need to be "based" in an area
that has a cellular system (obviously), has a different BOC than your local area does, and
has some sort of a "roamer"
agreement with your local BOC.
How can one "phreak" a cellular phone? There are three general areas when phreaking
cellular phones; using one you found in an unlocked car (or an unattended walk-about
model), modifying your own chip set to look like a different phone, or recording the phone
number/ID number combinations sent by other local cellular phones, and using those as
your own. Most cellular phones include a crude "password" system to keep unauthorized
users from using the phone - however, dealers often set the password (usually a 3 to 5
digit code) to the last four digits of the customer's mobile phone number. If you can find
that somewhere on the phone, you're in luck. If not, it shouldn't be TOO hard to hack,
since most people aren't smart enough to use something besides "1111", "1234", or
whatever. If you want to modify the chip set in a cellular phone you bought (or stole),
there are two chips (of course, this depends on the model and
manufacturer, yours may be different) that will need to be changed - one installed at the
manufacturer (often epoxied in) with the phone's ID number, and one installed by the
dealer with the phone number, and possible the security code. To do this, you'll obviously
need an EPROM burner as well as the same sort of chips used in the phone (or a friendly
and unscrupulous dealer!). As to recording the numbers of other mobile phone customers
and using them; as far as I know, this is just theory... but it seems quite possible, if you've
got the equipment to record and decode it. The cellular system would probably freak out if
two phones (with valid ID/phone number combinations) were both present in the network
at once, but it remains to be seen what will happen.
113.Cheesebox Plans by The Jolly Roger
A Cheesebox (named for the type of box the first one was found in) is a type of box which
will, in effect, make your telephone a Pay-Phone.....This is a simple, modernized, and easy
way of doing it....
Inside Info: These were first used by bookies many years ago as a way of making calls to
people without being called by the cops or having their numbers traced and/or tapped......
How To Make A Modern Cheese Box
Ingredients:
1 Call Forwarding service on the line
1 Set of Red Box Tones
The number to your prefix's Intercept operator (do some scanning for this one)
How To:
After you find the number to the intercept operator in your prefix, use your call-
forwarding and forward all calls to her. .this will make your phone stay off the
hook(actually, now it waits for a quarter to be dropped in)...you now have a cheese box... In
Order To Call Out On This Line: You must use your Red Box tones and generate the
quarter dropping in...then, you can make phone calls to people...as far as I know, this is
fairly safe, and they do not check much...Although I am not sure, I think you can even
make credit-card calls from a cheesebox phone and not get traced...