textfiles/phreak/2600stuf

  2600260026002600260026002600260026002600260026002600260026002600260026002600
  2600                                                                    2600
  2600            Excerpts from Various Issues of 2600 Magazine           2600
  2600                                                                    2600
  2600                    Brought to you by:  The Fixer                   2600
  2600                                                                    2600
  2600     Call: The Private Sector 201-366-4431                          2600
  2600           The Metal AE 201-879-6668                                2600
  2600           BC Tel Phone Mart 604-658-1586                           2600
  2600           Tommy's Holiday Camp 604-595-0085                        2600
  2600           The Neutral Zone BBS/AE (it's BACK!!) 604-478-1363       2600
  2600                                                                    2600
  2600260026002600260026002600260026002600260026002600260026002600260026002600


A note before I get on with it: This file is for those of you who, for whatever
reason, do not or have not read 2600 magazine.  This issue of this file covers
the best short articles from September 1985 to August 1986.
Anyways, why bother waiting for me to type this stuff up?  Why not do as I do
and get a subscription?  All you have to do is send $12 to 2600, Box 752,
Middle Island NY 11953-0752.  Call them voice at 516-751-2600 or call the 2600
BBS, THE PRIVATE SECTOR, at 201-366-4431.  The things they need most are money
and articles, they can get money by more subscribers but they need YOU to write
GOOD articles on hacking, phreaking, etcetera in order to keep going.

  2600260026002600260026002600260026002600260026002600260026002600260026002600

::::August 1985::::
-------------------------------------------------------------------------------

2600 A Hacking Victim...

When we received our June SBS Skyline bill, we were a bit surprised.  Over six
hundred dollars of it came from calls we never made.  But what's really
interesting is the way that the Skyline people handled it.  In early June, we
got a call telling us that their sophisticated equipment detected hackers
trying to guess a code by scanning numerically.  They said our code would soon
be discovered, so they were going to give us a new one, with two extra digits
added.  They did this and that very day our old code was inactivated.  The
illegal calls had occurred BEFORE that day, and we figure Skyline must have
known this.  Maybe they thought that 2600, in our corporate clumsiness, would
pay a huge bill without investigation.  Many big companies would.  Gotta give
them credit for trying.
When we called up about it, they didn't want to handleit over the phone!  "Send
the bill through the mail," they said.  Mark the calls you made and we'll
deduct the rest."  Why are phone companies so afraid to do things over the
phone?
As long as Skyline decided to give the "perpetrators" some extra time before
the investigation starts,  we figure we might as well lend a hand too.  Our old
code was 880099.  We loved that code and are very upset at losing it.  Our new
eight digit one is very difficult to remember and nowhere near as fun.
And one last note about those new eight digit numbers.  Phone phreaks have
ALREADY figured out a way around them.  If you dial the first six digits of an
eight digit code, then the ten digit phone number and hit a # key, you'll get
your tone back!  That means there are only a hundred possible codes since there
are only two more digits to figure out  and one of them DEFINITELY works!  If
you enter six digits that are not part of an eight digit code, and then a ten
digit phone number, you'll get an error message immediately or that fake
carrier tone Skyline loves to send out.  That tone, incidentally, is for you
hackers with Apples and Commodores that scan all night long looking for the
code that will get you through to a number that responds with a carrier tone.
In the morning, you see how many carrier detects you got and which codes got
them for you.  Skyline's idea is that if EVERY invalid code gives a hacker a
carrier tone, there is no way for a computer to separate the good codes from
the bad ones.  Come on!  How about setting your computer to dial a NON-carrier
and telling it to print out only those codes that DIDN'T get a carrier tone?
And there are probably a hundred more ways.  Big corporations can be SO much
fun.

-------------------------------------------------------------------------------

::::September 1985::::

Reaching Out On Your Own
by Forest Ranger

Verification is a very touchy subject.  The telephone company wants to keep
verification secret from anyone beyond telco employees.  But as phone phreaks
should know that is quite impossible.  There are two types of operators that do
verifications.  "0" (TSPS) for local verifications and IO (INWARD) operators
for verifications beyond your NPA.  They use their operator console, but other
people use blue boxes.

                           KP:NPA+0+XX+NPA+XXX+XXXX:ST

The first NPA (area code) is yours and the 0 will get you on your TSPS
operator lines.  The next XX part is an area identifier.  They are 00,11,22,
33,44,55,66,77,88,99.  There are ten possible choices depending on which area
you are in.  For example, blue box verification for Michigan would be 
KP:313+0+66+NPA+XXX+XXXX:ST.  The second NPA is the NPA of the number you are
going to verify.  The XXX+XXXX part is the rest of the number you are going to
verify.
Once you have routed your verification you will receive a series of clicks
(tandems stacking), the you will hear a beep and you will be on the line.
You won't understand what anyone is saying because everything is scrambled.
The verification will last about thirty seconds.  Then you will be beeped out
and finally disconnected.
Federal laws regarding line listening have become much stronger - especially
after 1974 when a subcommittee of the House of Representatives held a public
hearing called "Telephone Monitoring Practices by Federal Agencies".  At this
hearing it was discovered that Bell had listened in to lines of their employees
and had the power to listen in on anyone.  This shocked many people and made
federal laws concerning such activity much stronger.  My point is don't abuse
this verification, because all you need is a simple descrambler from Radio
Shack to descramble the conversation on the line.

-------------------------------------------------------------------------------

::::November 1985::::

The History of ESS
by Lex Luthor

Of all the new 1960's wonders of telephone technology - satellites,
ultra-modern Traffic Service Positions (TSPS) for operators, the picturephone,
and so on - the one that gave Bell Labs the most trouble was, and unexpectedly
became the greatest development effort in Bell System's history, was the
perfection of an electronic switching system, or ESS.  ESS should be well known
to many a technical enthusiast.  It is known as the big brother of the phone
system, capable of controlling almost all aspects of any phone call and keeping
track of calling patterns.  How ESS works and what it is capable of has been
covered previously in 2600 (February, 1984) and will be covered in future
issues.
It may be recalled that such a system was the specific end in view when the
project that had culminated in the invention of the transistor had been
launched back in the 1930's.  After successful accomplishment of that planned
miracle in 1947-48, further delays were brought about by financial strategy and
the need for further development of the transistor itself.   In the early
1950's, a Labs team began serious work on electronic switching.  As early as
1955, Western Electric became involved when five engineers from the Hawthorne
works were assigned to collaborate with the Labs on the project.  The
president of AT&T in 1956 wrote confidently, "At Bell Labs, development of the
new electronic switching system is going full speed ahead.  We are sure this
will lead to many improvements in service and also to greater efficiency.  The
first trial will start in Morris, Illinois in 1959.".  Shortly thereafter,
Kappel said that the cost of the whole project would probably be $45 million.
But it gradually became apparent that the development of a commercially usable
electronic switching system - in effect, a computerized telephone
exchange - presented vastly greater technical problems than had been
anticipated, and that, accordingly, Bell Labs had vastly underestimated both
the time and the investment needed to do the job.  The year 1959 passed without
the promised first trial at Morris, Illinois; it was finally made in November
1960, and quickly showed how much more work remained to be done.  As time
dragged on and costs mounted, there was concern at AT&T and something
approaching panic at Bell Labs.  But the project had to go forward; by this
time the investment was too great to be sacrificed, and in any case, forward
projections of increased demand for telephone service indicated that within a
few years a time would come when, without the quantum leap in speed and
flexibility that electronic switching would provide, the national network would
be unable to meet the demand.  In November 1963, an all-electronic switching
system went into use at the Brown Engineering Company at Cocoa Beach, Florida.
But this was a small installation, essentially another test installation,
serving only a single company.  Kappel's tone on the subject in the 1964 annual
report was almost apologetic: "Electronic switching equipment must be
manufactured in volume to unprecedented standards of reliability...To turn out
the equipment economically and with good speed, mass production methods must
be developed; but, at the same time, there can be no loss in precision...."
Another year and millions of dollars later, on May 30, 1965, the first
commercial electronic central office was put into service at Succasunna, New
Jersey.
Even at Succasunna, only 200 of the town's 4300 subscribers initially had the
benefit of electronic switching's added speed and additional services, such as
provision for three party conversations and automatic trasnfer of incoming
calls.  But after that, ESS was on its way.  In January 1966, the second 
commercial installation, this one serving 2900 telephones, went into service in
Chase, Maryland.  By the end of 1967 there were additional ESS offices in
California, Connecticut, Minnesota, Georgia, New York, Florida, and
Pennsylvania; by the end of 1970 there were 120 offices serving 1.8 million
customers; and by 1974 there were 475 offices serving 5.6 million customers.
The difference between conventional switching and electronic switching is the
difference between "Hardware" and "Software"; in the former case, maintenance
is done on the spot, with screwdriver and pliers, while in the case of
electronic switching, it can be done remotely, by computer, from a central
point, making it possible to have only one or two technicians on duty at a time
at each switching center.
The development program, when the final figures were added up, was found to
have required a staggering four thousand man-years of work at Bell Labs and to
have cost not $45 million but $500 million!





Dear 2600:

   Is it true that Blue Boxing is on the way out?  I hear it has something to
do with CCIS.  What exactly is this and why is it so troublesome to phreaks?

                                                                Worried Phreak


Dear Worried:

   Blue Boxes are indeed a dwindling resource.  But there's no need to throw
them out yet.  They aren't going to be totally useless for quite some time.
   Basically, AT&T is converting to CCIS trunks.  These don't allow boxing.
   In-band signaling is the only kind of trunk sugnaling that supports boxing.
It is by far the most prevalent at the moment.  Basically, in-band uses a 2600
hertz tone to indicate that a trunk is idle, and thus can accept routing 
instructions from an "outsider".
   To box a call, the criminal blasts 2600 down the line after making a long
distance call.  The line thinks it's idle and waits for routing instructions.
Now the criminal puts a KP tone and a ST tone around the number that he's
trying to get through to.  These comprise the routing instructions.  Thus, the
line thinks it's idle, then it receives the routing instructions, and routes
the call to whereever the person sent it.  Now, his central office (CO) which
does all the billing still thinks he is making the call to wherever, so it
keeps billing him at that rate.  If it happens to think he was making a
toll-free call, it won't bill him at all!
   Another form of signaling is out of band.  This uses control tones out of
the normal band of telephoone transmission (approximately 800 hertz to 3000
hertz).  The idle tone is 3200, others shifted upward as well.  So why couldn't
you make a new box?  Don't forget, it's out of band.  These tones aren't in
normal transmission, so the local CO and customer interface loop just don't
bother to transmit them.  You can blast all the 3200 you want - it won't go
through the CO to the trunk.  But this is not the "death of boxing" as it has
several disadvantages to the telco too numerous to mention.
   The real death of boxing lies in Common Channel Interoffice Signaling
(CCIS).  This is a direct connect data line going from one ESS switcher to
another at speeds up to 4.8 kB (usually 1.2) - incredible speeds.  All
routing instructions are sent through these lines.  It isn't looking for
control tones on the trunk; it's getting them elsewhere.  This means that you
can blast 2600 hertz tones all you like.  It won't make a difference because
the equipment is no longer listening for them.  This kind of signaling is being
phased in all over the country.  Look for one in your neighborhood.
   Since CCIS has benefits for really high volume trunks, you can try looking
for long distance trunks to Canada, or rural states.  These probably won't be
phased in for a long time, if at all.  (Remember, very few companies just
invest in new technology for new tech's sake; even AT&T won't be able to do
this for long).






The Early Phreak Days
by Jim Wood

   When I decided to get married back in 1962, I traded my DJ and broadcasting
odd jobs for one at the phone company; employment which, at the time, was
ultimately secure though my take-home pay was about $300 a month.
   Assigned to the Palo Alto, California central office as a Toll
Transmissionman, my duties included maintenance of toll traffic circuits and
related short-haul N and ON carrier equipment.  Circuit testing was initiated
at a black bakelite Type 17B Toll Testboard.  A field of several hundred jacks
gave access to as many inter-office trunks, many to the San Jose 4A and
Oakland 4M 4-wire switching centers.
   Though it was strictly forbidden, one could easily and safely "deadhead"
toll calls for one's self, family, or friends from the testboard.  Around
Christmastime our office could easily have been confused with the Operator room
on the floor below.
   The 17B testboard had a 0-9, DTMF keypad arranged in two rows of 5 buttons
wired to the central office "multifreq" supply.  A rack of vacuum tube L/C
oscillators comprised the MF supply and was buried somewhere in the bowels of
the building.
   Long days with too much (mostly union) staff and not enough to do
precipitated a lot of screwing around on the job.  Some of these guys would
just daydream out the windows, others would hassle and torment the Operators
downstairs.  One favorite trick was to sneak into the access space behind the
bank of 3C switchboards and push the cords slowly up towards the Operators.
The screams and commotion caused by a tip, ring, and sleeve "snake" was worth
the risk of getting chewed out by the old battleaxe who ran the place.  Myself,
I just played with the Bell System; never with any intent to defraud, merely
to increase my understanding of how the whole thing worked.
   It was a singularly dull day that I hit on the idea of "deadheading" calls
through one of the local subscriber loop jacks which rang into the testboard.
Sure enough, I could rotary-dial through the step office to Sacramento (the
shortest hop on L carrier with inband signalling), "dump" the call in
Sacramento with a blast of 2600 fromthe 19c oscillator mounted overhead, then
multifreq out of Sacramento anywhere I wanted to go.  Wow!  I could hardly wait
to demonstrate this potential source of lost revenues to my first-line
supervisor.  Both he and his boss were mildly impressed, but assigned minimal
importance to the event, since, in their words, "no one has a multifreq supply
at home."
   Ma Bell invented the transistor but was among the last to put it into
service.  One of the few places a transistor was used was used in our office
was in the alarm circuit of the ON carrier system.  The 13H was a wretched
little "top hat" PNP with just enough beta to work in a bridged-T oscillator
configuration.  A half-dozen of these, some Olson Radio pushbuttons, and a 
handful of resistors and caps made a dandy MF supply.
   The next demonstration was from the Chief's own desk and did finally raise
some concern.  I was asked to "donate" the box and told to keep the findings
strictly to myself.  I have done so for 20 years now.

-------------------------------------------------------------------------------

::::February 1986::::

It Could Happen To You!

   A bizarre story is unfolding in New York City, one which typifies both
hacker ingenuity and corporate indifference to the average customer.
   It all started when Hacker A met Hacker B on a loop somewhere.  At first,
they got along quite well, exchanging all kinds of information.  Over time,
however, Hacker B got more and more obsessed, while Hacker A wanted to get on
with a normal life.  B would not stop calling A, which led A to tell B that if
he didn't stop bothering him, he would get the authorities on his case.  Well,
B didn't and A did.  And that's where the trouble really started.
   For the last couple of years, almost every few minutes, A's phone has been
ringing.  At the other end is B or someone or something that B has programmed.
Sometimes nothing is said; sometimes a threat is uttered; sometimes the caller
just laughs.  A and his family have been trying, literally for years, to put an
end to this.  At first they simply changed the number to an unlisted one.
Within an hour, B had found the new one.  So they tried to change it again.
New York Telephone refused.  Either they would have to pay an exorbitant fee
this time, or the number would not be changed.  They said it was impossible for
somebody to find out their number so fast - he must have been told by somebody
in the family.
   This scene was repeated a number of  times, with A's family changing their
number practically a dozen times and having to pay the fee for most of them.
It reached the point where B would call them BEFORE they received their new
number to tell them what the new number would be.
   This wasn't all.  B had also managed to charge outrageous amounts to the
family's phone bill.  He would call their answering machine collect on a long
distance trunk and make it sound to the operator as though he'd said "yes".
then he'd leave the connection open for hours.  He also managed to place third
party calls, using their number as the billing number.  Their bill was
outrageous and the phone company insisted that they were responsible for it.
Their service was disconnected and today they are slowly paying back the huge
debt.
   Meanwhile, A has tried to get the authorities to look at B (whose address
and phone number he has), with only lukewarm interest.  The FBI says it has
an eye on him, but won't help A deal with the phone company.
   To this day it continues.  The calls keep coming and A is powerless to do
anything.  B knows the phone system like the back of his hand and he can make
it do almost anything.  The phone company does not want to admit this and, on
many levels, isincapable of understanding it themselves.  The result: an
innocent victim gets it from both ends.


-------------------------------------------------------------------------------

::::May 1986::::

The SBS/Skyline Algorythm
by Nynex Phreak

SBS Skyline has one of the easiest methods of finding codes of all of the long
distance companies.  It's very similar to the old Sprint bug which allowed
people to find codes very quickly, even without the use of a computer.
To see how this methodd works, access SBS Skyline at their equal access number
(950-1088).  Enter six digits.  These are the six digits you are "betting" on
to be part of a valid code.  After the six digits, enter five other numbers
(it's not important what numbers they are).  If you hear a ring immediately
after the last number, followed by "Message MS2", the six digits are part of
a valid code.  If you don't hear a ring, hit the pound sign (#) key.  If you
get your tone back, the six digits were not part of a valid code.  You can try
a new six digit series without having to hang up and redial.  This is what
makes this method so fantastically easy.  (If you don't get your tone back
after hitting the pound sign and also don't get "Message MS2", chances are
you've stumbled across one of those SBS toll-free numbers.  This might also be
the case if you get "Message MS2" before entering five additional numbers.)
After finding a working set of six digits, all that must be done is to
find the next one or two numbers of the code.  Enter the six digit code,
followed by an additional one number to guess, followed by four random
digits.  If it rings and gives "Message MS2", this is not the right guess.
You must hang up and redial Skyline for each unsuccessful attempt at this
point.  If it doesn't ring, and you can get the tone back by hitting the pound
sign, you have found a seven digit code.  If you try all the numbers from zero
to nine and they all give "Message MS2", then you have two digits to
guess--your six digits are actually part of an eight digit code.  The same
method must be used, except your range is now from 00 to 99.

-------------------------------------------------------------------------------


(>View:101 BCTEL TOLL SECURITY BUGS


(just kidding folks, I wish there WAS such a file...)


       -=( The FIXER )=-