622 lines
36 KiB
Plaintext
622 lines
36 KiB
Plaintext
![]() |
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
BIOC AGENT 003'S COURSE IN [BASIC TELECOMMUNICATIONS] Part I
|
|||
|
Revised 18-July-84 Word Processed by Tharrys Ridenow
|
|||
|
|
|||
|
[PREFACE]:
|
|||
|
In this course, I plan to cover as much material as possible relating to
|
|||
|
telecommunications. First in the syllabus are the Long-Distance (LD) Ser-
|
|||
|
vices, which are the topic of Part I. In future issues, such subjects as the
|
|||
|
network, colored boxes, telephone electronics, central office equipment, opera-
|
|||
|
tors, special #'s, and much, much more will be covered.
|
|||
|
|
|||
|
[LONG-DISTANCE SERVICES]:
|
|||
|
In an attempt to offer lower prices, alternatives to Bell have been set up.
|
|||
|
Services such as SPRINT, Metrofone, ITT, MCI, Travelnet, and many others are
|
|||
|
all familiar to us. These services are known as Specialized Common Carriers
|
|||
|
(SCC's) or Other Common Carriers (OCC's). <Don't confuse this with Switching
|
|||
|
Control Center, also known as SCC.>
|
|||
|
The basis of all these services are that they on their own switching equip-
|
|||
|
--More--(7%)
ment. First, we will look at those services which use a local dial-up. The
|
|||
|
--More--(7%)
principle of these are:
|
|||
|
--More--(8%)
1) You dial the local #,
|
|||
|
--More--(8%)
2) When it picks up, you get a second dial tone, then enter a code.
|
|||
|
--More--(8%)
3) You then enter the destination #, and voila!, you're connected! A free
|
|||
|
call!
|
|||
|
|
|||
|
Next we will look at several of the services...
|
|||
|
(Note: A/C and NPA are abbreviations for Area Code, pfx=prefix, sfx=suffix)
|
|||
|
|
|||
|
SPRINT:
|
|||
|
Sprint, also known as SPC, was one of the first LD services. Many boards
|
|||
|
contain SPC #'s, and I plan to include a list of them as an appendix to this
|
|||
|
course so you can find your local #. (Another, more dangerous, way is by cal-
|
|||
|
ling 1-800-521-4949, asking the nice lady at the other end of the line for your
|
|||
|
local SPRINT access number, complaining that your autodialer had it but just
|
|||
|
crashed.)
|
|||
|
The codes for SPC are 8 digits long. SPC is not considered safe, since many
|
|||
|
people have been busted on it! It is common knowledge that SPRINT has declared
|
|||
|
war on phreaks. So, fight back (with care)!
|
|||
|
Some dialups: 914-997-1616 415-777-1211 415-832-5016
|
|||
|
Format: At tone---> 8 digit code+A/C+pfx+sufx
|
|||
|
|
|||
|
METROFONE:
|
|||
|
Metrofone, run by Western Union, is very popular among phone phreaks due to
|
|||
|
the large abundance of codes and it (at the time of this writing) is considered
|
|||
|
--More--(17%)
fairly safe.
|
|||
|
Recently (7/84), Metrofone has allegedly been placing "trap codes" on BBS's
|
|||
|
which are being traced. I suggest that you hack your own for safety purposes.
|
|||
|
The code is 6 digits long. To find out the local dial-up for your area, use
|
|||
|
the procedure under SPRINT with 800-325-1403.
|
|||
|
Format: At tone---> 6 digit code+A/C+pfx+sufx
|
|||
|
|
|||
|
ITT:
|
|||
|
ITT is a little different in that upon hearing the dial tone after calling
|
|||
|
the local access #, you enter the A/C and then the #. You will then hear a
|
|||
|
short tone, then immediately enter your 7 digit access code.
|
|||
|
Format: At tone---> A/C+pfx+sufx, beep, 7 digit access code
|
|||
|
|
|||
|
MCI:
|
|||
|
MCI has dial-ups in most areas but the codes are not interchangable (i.e., a
|
|||
|
code that works for the New York dial-up will not work for the Boston dial-up.)
|
|||
|
Format: At tone---> 5 digit code+A/C+pfx+sufx
|
|||
|
|
|||
|
MCI CREDIT CARD (MCI CC):
|
|||
|
This MCI service, also known as MCI Execunet, is for people who travel a
|
|||
|
lot (i.e. business pigs) and need a code that works in several places. There-
|
|||
|
fore, the codes on THIS system are interchangable throughout the dial-ups un-
|
|||
|
--More--(25%)
like the regular MCI service.
|
|||
|
Format: At tone---> 7 digit code+A/C+pfx+sufx
|
|||
|
|
|||
|
SKYLINE:
|
|||
|
SBS Skyline is a new service owned by IBM, Comsat, and Aetna. It has the
|
|||
|
same local access # across the country: 950-1088. It is supposed to have 6
|
|||
|
(possibly 8) digit codes and is alleged to be very dangerous.
|
|||
|
Most of the services in 950 have crystal clear connections.
|
|||
|
|
|||
|
CALLING CARDS:
|
|||
|
Calling Cards are Bell's version of SPRINT, MCI, etc. Calling Cards are used
|
|||
|
primarily from pay phones. The format is: NPA+pfx+sufx+CCCC. NPA is usually
|
|||
|
the A/C of the billed # that the call is to be billed to. This may be replaced
|
|||
|
by a three digit RAO (Revenue Accounting Office) code in some NPA's or a spe-
|
|||
|
cial billing number. Pfx-sufx is the number that the call is billed to. CCCC
|
|||
|
is a checkcode (or PIN, Personal Identification Number) that adds the security
|
|||
|
to calling cards. The codes used to be predictable until 1983. Now CCCC ap-
|
|||
|
pears to be sequentially generated so the codes cannot be calculated from a
|
|||
|
formula!
|
|||
|
The easiest way to find these codes is in a busy airport or college where
|
|||
|
they are used a lot. Just get close and copy down someone's code (if you are
|
|||
|
that unscrupulous!). Don't rip off poor people-- go for the rich business
|
|||
|
--More--(34%)
pigs!
|
|||
|
You usually call the operator to make a CC call but on many fortress fones,
|
|||
|
you can dial 0+<the number you want to call> and you will get a recording and
|
|||
|
tone where you enter your calling card #. By pressing the # sign (octothorpe)
|
|||
|
after each call instead of hanging up, you can make many calls at once without
|
|||
|
having to retype the CC # each time. This is good for busy numbers. Also, if
|
|||
|
you want to call the # of the card, i.e. the billed #, you just have to enter
|
|||
|
the last four digits of the CC # at the tone.
|
|||
|
Now, suppose you do get a real operator. Since mostly business people use
|
|||
|
calling cards, it is suggested that you act a little like a business person-
|
|||
|
i.e. rushed, older, businesslike, and slightly pissed at the operator (keyword:
|
|||
|
slightly). All you have to tell her is the CC #. If she asks for the # you
|
|||
|
are calling from, tell her, but change the last digit or two. If she asks you
|
|||
|
more questions, she is probably suspicious, so hang up. Although you SHOULD
|
|||
|
make up some answers to certain questions to satisfy the operator that you are
|
|||
|
legit. The most important thing you should know when making a CC call is the
|
|||
|
area code and city of the card.
|
|||
|
Finally, in case the operator is listening, always talk businesslike for the
|
|||
|
first few seconds until the operator clicks off (they have been known to listen
|
|||
|
in on calls [understatement!]). Also, always use CC's from pay phones or
|
|||
|
charge-a-call fones only!
|
|||
|
|
|||
|
--More--(45%)
CAUTION: All the CC codes are now rapidly checked due to CCIS (Common
|
|||
|
Channel Inter-office Signaling) and ESS (Electronic Switching
|
|||
|
System). If you try to hack CC codes you can be fairly sure that
|
|||
|
Bell security (affectionately known in the phreaking world as the
|
|||
|
Gestapo) will get a message from the CO (Central Office, i.e.
|
|||
|
exchange)!
|
|||
|
|
|||
|
[800 SERVICES]:
|
|||
|
You are probably all familiar with WATS. WATS #'s (Wide Area Telephone Ser-
|
|||
|
vice, otherwise known as 800 #'s) are very popular due to the fact that they
|
|||
|
are toll-free. They often contain WATS extenders. Extenders were originally
|
|||
|
used by salesmen in the field who called up their company's 800 # (INWATS #)
|
|||
|
and then used the company's low-priced OUTWATS line to make the call. This is
|
|||
|
cheaper to the company than using the Bell calling card which makes a sur-
|
|||
|
charge.
|
|||
|
On the original extenders there were no codes! Companies soon realized that
|
|||
|
their #'s were being used and added the present-day security codes. The sales-
|
|||
|
man would then dial the 800 number and enter the code (usually 4 digits), he
|
|||
|
would then receive a second dial tone from the company's PBX (Private Branch
|
|||
|
Exchange - their own switching equipment, i.e. switchboard). He would then ac-
|
|||
|
cess the OUTWATS line by dialing 8 or 9 and then the #. These codes were ori-
|
|||
|
ginally hand-hacked, but some pioneer phreak (Captain Crunch) added an inter-
|
|||
|
--More--(56%)
face to Charlie, his Apple ][ computer, which was capable of generating DTMF
|
|||
|
tones (Dual Tone Multi Frequency, i.e. generic term for touchtone (TM)) and
|
|||
|
trying all the codes. The only problem was that Ma Bell got suspicious when
|
|||
|
they saw that someone had called the Joe Blow Rubber Company 800 # in Califor-
|
|||
|
nia 4,568 times at 2 am and each call lasted for only 1 second!
|
|||
|
|
|||
|
TRAVELNET:
|
|||
|
Travelnet is a service, owned by GM, that uses WATS as well as local access
|
|||
|
#'s. The 800 # is 800-521-8400.
|
|||
|
Format: At tone---> 8 digit code, tone, A/C+pfx+sufx.
|
|||
|
Travelnet is also unique in that it accepts voice recognition for those times
|
|||
|
when touch-tone is not available (how convenient!). If you don't do anything
|
|||
|
after the tone, you will hear a voice that says "Authorization #, please." You
|
|||
|
then say each digit slowly. It will beep after you say each digit. After each
|
|||
|
group of digits, it will repeat what you have said. Say YES if it is right,
|
|||
|
otherwise say NO. If the authorization code is correct, it will say thank you
|
|||
|
and then ask for the destination #. Follow the same procedure as above. The
|
|||
|
voice system is very user friendly and you should have no problems with it.
|
|||
|
|
|||
|
TEL-TEC:
|
|||
|
Tel-Tec is at 800-323-3026. In my experiences, you usually get a very shitty
|
|||
|
connection. This I use for last resorts. Format: AT tone---> 6 digit code+
|
|||
|
--More--(66%)
A/C+pfx+sufx. Tel-Tex (for TX only): 800-432-2071.
|
|||
|
|
|||
|
Caution: Like the 950 exchange, 800 numbers can be easily traced. This
|
|||
|
doesn't mean that they trace everything, though.
|
|||
|
|
|||
|
OTHERS:
|
|||
|
There are many other 800 services and PBX's (such as Dimension 2000 at 800-
|
|||
|
848-9000). There is just not enough room to discuss them all. As you have
|
|||
|
probably noticed I have posted no codes. Check the phreak section of various
|
|||
|
BBS's to find the latest codes or hack them yourself. I suggest that you don't
|
|||
|
use codes found on BBS's though, since they may be traps! Hand-hack good pos-
|
|||
|
sibilities or use a "smart" modem with a hacking program (contact your local
|
|||
|
pirate).
|
|||
|
|
|||
|
[HOW MA BELL CATCHES PHONE HACKERS]:
|
|||
|
Besides suspicion and random checks, Ma Bell sets up "trap numbers." Trap
|
|||
|
numbers were set up on certain dial-ups such as Sprint, MCI, etc. Whenever the
|
|||
|
dialup is called a "trouble card" is dropped at the central office. This means
|
|||
|
that a record of the called #, the CALLER'S #, and time are printed out. These
|
|||
|
cards (or printouts in an ESS CO) are usually ignored unless SPC or somebody
|
|||
|
detects fraud, i.e., unauthorised use of a customer's account. Then they call
|
|||
|
Bell and find out the name and number and instantly nail the phreak who made
|
|||
|
--More--(75%)
the call. They will then either demand that you pay some enormous fee and
|
|||
|
they'll forget the whole matter; give them info on other phreaks, boards, etc.;
|
|||
|
or prosecute you on the federal rap of Theft of Communications Service, which
|
|||
|
carries fines of up to 10 years in jail and/or $10,000. They don't usually go
|
|||
|
for legal action first, though. If you don't actually use any codes, they can
|
|||
|
still nail you for harassing fone calls.
|
|||
|
"Trap and Trace" is another favorite of the Gestapo. With this method you
|
|||
|
cannot hang up until the trace is completed!
|
|||
|
Why does Bell help their competition? Actually, it is rather simple. People
|
|||
|
were using SPRINT to break into Bell's ESS computers. Bell could only trace
|
|||
|
the calls back to SPRINT. So, SPRINT helps Bell catch the people it wants and
|
|||
|
vice-versa. ("You rub my back and I'll rub yours" type of deal.)
|
|||
|
By the way, trap numbers are also how Bell catches people who make harassing
|
|||
|
phone calls to private residences.
|
|||
|
Also, certain TelCo exchanges running ESS (see Part IV) generate reports
|
|||
|
called the "800 Exceptional Calling Report" which lists people who have made
|
|||
|
extensive or long calls to 800 #'s. Since many people use legit 800's a lot,
|
|||
|
they also wind up on the list. If Bell does have a certain problem with an 800
|
|||
|
#, though, they just have to check their records.
|
|||
|
If Bell has sufficient reason to suspect you of illegal activities, they may
|
|||
|
put a pen recorder on your line to record every single digit you dial along
|
|||
|
with other pertinent information.
|
|||
|
--More--(87%)
Finally, do not forget that these services have a copy of the number that you
|
|||
|
called. So, if a customer says that he didn't call a certain #, they will usu-
|
|||
|
ally call up that # and try to find out who did call at that time.
|
|||
|
So, to be safer on SPC, MCI, and others, follow the following suggestions:
|
|||
|
1) Use a fortress fone (pay phone) whenever possible. Although they have
|
|||
|
been known to stake out pay fones... Just don't use the same fone over and
|
|||
|
over again. In other words, move around.
|
|||
|
2) Only call institutional switchboards, businesses that have no record of
|
|||
|
your call, and friends who are instant amnesiacs.
|
|||
|
3) Try to keep all calls under 15 minutes when possible.
|
|||
|
Note: No system is totally safe! When I classify something as safe or
|
|||
|
dangerous, that is my opinion as well as that of several other phreaks. These
|
|||
|
opinions are based on how many people have been busted on them, what type of
|
|||
|
equipment they are using, and inside information. I cannot possibly guarantee
|
|||
|
that you will not be caught. Actually, with CCIS and ESS nothing is really
|
|||
|
safe anymore. Besides, what phun whould there be in life without a few risks?
|
|||
|
Also, I have known people who used 800 #'s and SCC's for several years daily
|
|||
|
with no problems.. I also know people who used a system for a week and were
|
|||
|
busted!
|
|||
|
|
|||
|
At this point, I would like to mention the "official" phreak newsletter, TAP.
|
|||
|
TAP contains much information about phone phreaking and other illegal activi-
|
|||
|
--More--(98%)
ties. Send an SASE for their info sheet, "What the hell is TAP?" Their ad-
|
|||
|
dress is:
|
|||
|
TAP
|
|||
|
Room 603
|
|||
|
147 West 42nd Street
|
|||
|
New York, New York 10036
|
|||
|
|
|||
|
Please enter either [file-name], [l], [h], [q], or [?]
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
BIOC AGENT 003'S COURSE IN [BASIC TELECOMMUNICATIONS] Part II
|
|||
|
Revised 18-July-84 Word Processed by Tharrys Ridenow
|
|||
|
|
|||
|
PREFACE:
|
|||
|
In Part II, we will explore the various special Bell #'s, such as: CN/A,
|
|||
|
AT&T Newslines, loops, 99XX #'s, ANI, ringback, and a few others.
|
|||
|
|
|||
|
CN/A : Customer Name and Address
|
|||
|
|
|||
|
CN/A, which stands for Customer Name and Address, are bureaus that exist so
|
|||
|
that authorized Bell employees can find out the name and address of any custo-
|
|||
|
mer in the Bell System. All #'s are maintained on file including unlisted #'s.
|
|||
|
|
|||
|
Here's how it works:
|
|||
|
|
|||
|
1) You have a # and you want to find out who owns it, e.g. (914) 555-1234.
|
|||
|
2) You look up the CN/A # for that NPA in the list below. In the example,
|
|||
|
--More--(3%)
the NPA is 914 and the CN/A # is 518-471-8111.
|
|||
|
3) You then call up the CN/A # (during business hours) and say something like
|
|||
|
"Hi, this is John Jones from the residential service center in Miami. Can I
|
|||
|
have the customers name at 914-555-1234. That # is 914-555-1234." Make up
|
|||
|
your own REAL sounding name, though. Or, if you sound mature enough, just say
|
|||
|
"Look up 914-555-1234 please."
|
|||
|
4) If you sound natural and cheery, the operator will ask no questions.
|
|||
|
|
|||
|
NOTE: Due to the break-up, several operating companies are now asking for ID
|
|||
|
#'s when you make a request. This has recenty happened to me in 617 and I just
|
|||
|
told the operator that I was calling from the so-and-so business office in New
|
|||
|
York, and she said that she'll put it through this time!
|
|||
|
|
|||
|
|
|||
|
Here's the list:
|
|||
|
|
|||
|
NPA CN/A # NPA CN/A # NPA CN/A # NPA CN/A #
|
|||
|
--- ------------ --- ------------ --- ------------ --- ------------
|
|||
|
201 201-676-7070 202 202-384-9620 203 203-789-6815 204 204-949-0900
|
|||
|
205 205-988-7000 206 206-382-8000 207 617-787-5300 208 303-293-2333
|
|||
|
209 415-546-0118 212 518-471-8111 213 213-501-3255 214 214-698-9711
|
|||
|
215 412-633-5600 216 614-464-2345 217 217-525-7000 218 402-345-0600
|
|||
|
--More--(9%)
219 317-265-4834 301 301-534-1168 302 412-633-5600 303 303-293-2333
|
|||
|
304 304-344-8041 305 912-784-0440 306 306-347-2878 307 303-292-2333
|
|||
|
308 402-345-0600 309 217-525-7000 312 312-769-9600 313 313-223-8690
|
|||
|
314 314-726-7142 315 518-471-8111 316 816-275-2782 317 317-265-4834
|
|||
|
318 504-245-5330 319 402-345-0600 401 617-787-5300 402 402-345-0600
|
|||
|
403 403-425-2652 404 912-784-0440 405 405-236-6121 406 303-293-2333
|
|||
|
408 415-543-6374 412 412-633-5600 413 617-787-5300 414 608-252-6932
|
|||
|
415 415-546-0107 416 416-922-6686 417 314-726-7142 418 514-287-5151
|
|||
|
419 614-464-2345 501 405-236-6121 502 502-583-2861 503 503-241-3440
|
|||
|
504 504-245-5330 505 303-293-2333 506 506-648-3041 507 402-345-0600
|
|||
|
509 206-382-8000 512 512-828-2501 513 614-464-2345 514 514-287-5151
|
|||
|
515 402-345-0600 516 518-471-8111 517 313-232-8690 518 518-471-8111
|
|||
|
519 416-922-6686 601 601-961-0877 602 303-293-2333 603 617-787-5300
|
|||
|
604 CLOSED 9/82! 605 402-345-0600 606 502-583-2861 607 518-471-8111
|
|||
|
608 414-252-6932 609 201-676-7070 612 402-345-0600 613 416-922-6686
|
|||
|
614 614-464-2345 615 615-373-5791 616 313-223-8690 617 617-787-5300
|
|||
|
618 217-525-7000 701 402-345-0600 702 415-546-0118 703 804-747-1411
|
|||
|
704 912-784-9111 705 416-922-6686 707 415-546-0107 709 ****N/A*****
|
|||
|
712 402-345-0600 713 713-820-4112 714 213-501-3255 715 608-252-6932
|
|||
|
716 518-471-8111 717 412-633-5600 801 303-293-2333 802 617-787-5300
|
|||
|
803 912-784-0440 804 304-344-8040 805 415-546-0118 806 512-828-2501
|
|||
|
807 416-922-6686 808 212-334-4336 809 212-334-4336 812 317-265-4834
|
|||
|
--More--(16%)
813 813-228-7871 814 412-633-5600 815 217-525-7000 816 816-275-2782
|
|||
|
817 214-698-9711 819 514-287-5151 901 615-373-5791 902 902-421-4110
|
|||
|
903 ****N/A***** 904 912-784-0440 906 313-223-8690 907 ****N/A*****
|
|||
|
912 912-784-0440 913 816-275-2782 914 518-471-8111 915 512-828-2501
|
|||
|
916 415-546-0118 918 405-236-6121 919 912-784-0440
|
|||
|
|
|||
|
Bell uses these #'s find out who owns a # that a customer claims he never
|
|||
|
called.
|
|||
|
|
|||
|
Some CN/A #'s remain the same for long periods of time; others, such as
|
|||
|
those in NPA's 213 (and other California Area Codes) change quite frequently.
|
|||
|
The 213 CN/A (also used for the new NPA's 818 and 619) usually remains some-
|
|||
|
where in the 213-501-XXXX exchange.
|
|||
|
For the CN/A # for the 900 SAC and the 976 exchange call the local CN/A #
|
|||
|
or 212-334-3611.
|
|||
|
NOTE: This is the most complete list of CN/A #'s in my possession which was
|
|||
|
procured from by business office.
|
|||
|
Another "cheap way" of doing a CN/A without knowing the CN/A # is to call
|
|||
|
the local business office of the area where the fone # you want to check is lo-
|
|||
|
cated. Then make an inquiry into something. When the representative asks for
|
|||
|
your #, give him the # you want checked. Chances are that he will say, "Is
|
|||
|
this Mr. X" and you now know who the line belongs to.
|
|||
|
--More--(22%)
Incidentally, if you tell the Telco to make your directory listing appear
|
|||
|
as Jack Meoff, Yog Sothoth, or a similar pseudonym with no address you will
|
|||
|
avoid an unlisted # charge. Also, if some asshole tried to pull a CN/A on your
|
|||
|
# (or your BBS #), the CN/A operator will tell them that the line belongs to
|
|||
|
Yog Sothoth. You can still have the bill sent to your real name, though,
|
|||
|
without affecting the CN/A.
|
|||
|
There is also a type of reverse CN/A bureau. This is usually called NON
|
|||
|
PUB DA or TOLL LIB. These #'s would most certainly change immediately if they
|
|||
|
were published here. With these #'s you tell them the name and locality. Then
|
|||
|
they shake you down for your name, supervisor's name, etc. if you haven't al-
|
|||
|
ready told them. They will ask you a few other questions which, if you answer
|
|||
|
them with the right incantation or practice the art of "social engineering"
|
|||
|
(AKA bullshitting) you have the unlisted #! You can also get detailed billing
|
|||
|
information from these bureaus.
|
|||
|
|
|||
|
AT&T NEWSLINES:
|
|||
|
Newslines are recordings that Bell employees call up to find out the latest
|
|||
|
info on stock, technology, et cetera concerning the Bell System.
|
|||
|
Here are the #'s that are currently known to phreaks (at least me, anyway):
|
|||
|
|
|||
|
201-483-3800 New Jersey 203-771-4921 Connecticut 212-393-2151 New York
|
|||
|
213-621-4141 California 213-829-0111 CA--GTE 213-449-8830 California
|
|||
|
--More--(29%)
312-368-8000 Illinois 313-223-7223 Michigan 314-247-5511 Montana
|
|||
|
408-493-5000 California 412-633-3333 Pennsylvania 414-678-3511 Wisconsin
|
|||
|
416-929-4323 Ontario 503-228-6271 Oregon 513-421-9060 Ohio
|
|||
|
516-234-9914 New York 518-471-2272 New York 617-955-1111 Massachusetts
|
|||
|
702-789-6711 Nevada 713-224-6116 Texas 714-238-1111 California
|
|||
|
717-255-5555 Pennsylvania 717-787-1031 Pennsylvania 802-955-1111 Vermont
|
|||
|
808-533-4426 Hawaii 813-223-5666 Florida 914-948-8100 New York
|
|||
|
916-480-8000 California
|
|||
|
|
|||
|
Rev-- With the break-up, some of the above #'s are going to change, but AT&T
|
|||
|
still plans on keeping this service.
|
|||
|
Also, many of the smaller companies, such as NY Telephone, have their own
|
|||
|
newswires. Here is a list of NYTelco newswires:
|
|||
|
212-395-2200 314-476-4492 516-234-9914
|
|||
|
518-471-2272 716-847-1950 914-390-2055
|
|||
|
|
|||
|
|
|||
|
LOOPS
|
|||
|
First of all, you must understand the concept of loops. I think that the
|
|||
|
best way that this is understood is the way that Phred Phreek explained it...
|
|||
|
|
|||
|
"No self-respecting Phone Phreak can go through life without knowing what a
|
|||
|
--More--(34%)
loop is, how to use one, and the types that are available.
|
|||
|
"The loop is a great alternative communication medium that has many poten-
|
|||
|
tial uses that haven't even been tapped yet. In order to explain what a loop
|
|||
|
is, it would be helpful to visualise two fone numbers (lines) just floating
|
|||
|
around in the Telco Central Office (CO). Now, if you (and a friend perhaps)
|
|||
|
were to call these two numbers at the same time, POOOOFFF!!!, you are now con-
|
|||
|
nected together. I hear what you're saying out there- 'Big deal' or 'Why
|
|||
|
should Ma Bell collect here two MSU's (MeSsage Units) for one lousy phone
|
|||
|
call?'
|
|||
|
"Well... think again. Haven't you ever wanted someone to call you back
|
|||
|
but were reluctant to give out your home phone number (like the last time you
|
|||
|
tried to get your friend's unlisted number from the business office)? Or how
|
|||
|
about a collect call to your friend waiting on a loop, who will gladly accept
|
|||
|
the charges? Or better yet, stumbling upon a loop that has multi-user capacity
|
|||
|
(for those late-night conferences). Best of all is finding a non-supervised
|
|||
|
loop that doesn't charge any MSU's or tolls to one or both parties. Example:
|
|||
|
many moons ago, a loop affectionately known as 'The 332 Loop' was non-sup (i.e.
|
|||
|
non supervised) on the tone side. I had my friend in California dial the free
|
|||
|
(non-sup) side, (212) 332-9906 and I diled the side that charged, 332-9900. As
|
|||
|
you can see, I was charged one MSU, and my friend was charged zilch, for as
|
|||
|
long as we wished to talk!"
|
|||
|
|
|||
|
--More--(41%)
Ahhh... have I perked your interest yet? If so, here is how to find a
|
|||
|
loop of your very own. First, do all of your loop searching at NIGHT! This is
|
|||
|
because the loops serve a genuine test function which the Telco uses during the
|
|||
|
day. (We don't want to run into an irate lineman, do we?) To find a loop,
|
|||
|
having two #'s is a definite plus. If not, have a friend dial #'s from his
|
|||
|
phone. Last resort, try calling from two adjacent pay phones.
|
|||
|
Now, get your trusty white pages (*), and turn to the page where it lists
|
|||
|
the # of MSU's from your exchange (or exchanges in your primary calling area).
|
|||
|
The idea is to find a loop that is within your primary calling area or is only
|
|||
|
1 MSU in your area (call area A). This is so you don't go bankrupt trying to
|
|||
|
find a loop. Write down all of these exchanges and do a 99XX scan of those ex-
|
|||
|
changes. (99XX scanning will be discussed shortly.)
|
|||
|
Before we get up to 99XX scanning, we will look at some other loop info:
|
|||
|
|
|||
|
Loops are found in pairs which are usually close to each other. For exam-
|
|||
|
ple, in NPA 212, where the infamous loops are found, there is a standard loop
|
|||
|
format:
|
|||
|
Manhattan and Bronx: NNX-9977/9979
|
|||
|
Brooklyn and Queens: NNX-9900/9906
|
|||
|
|
|||
|
NNX is the exchange to be scanned. Here are some loops that have been
|
|||
|
found in NYC. These are used mostly by phreaks and call-in lines for pirate
|
|||
|
--More--(47%)
radio stations:
|
|||
|
|
|||
|
212-220-9900/9906 212-283-9977/9979 212-352-9900/9906
|
|||
|
212-365-9977/9979 212-529-9900/9906 212-562-9977/9979
|
|||
|
212-982-9977/9979 212-986-9977/9979
|
|||
|
|
|||
|
[Editor's note: On the West Coast, the plan can change slightly: in the
|
|||
|
San Francisco Bay Area loops are found in the 00XX prefix, such as the one in
|
|||
|
415-540-0044/0045. Loops are rather scarce in the 415 area, but the pair in
|
|||
|
0044/0045 is a good bet when scanning, like the standard format above.]
|
|||
|
|
|||
|
The lower # is the tone side (singing switch). The higher # is always
|
|||
|
silent. The tone disappears on the lower # when somebody calls the other side
|
|||
|
of the loop. If you are on the higher number, you'll have to listen to the
|
|||
|
clicks to see if somebody dialed-in. The NYC 982 & 986 loops are different
|
|||
|
from others. Usually when you park on a loop, you will hear who ever calls in
|
|||
|
on the other half. When they're done, the next caller (if any) will be queued
|
|||
|
in, one after another. On the NYC 982 & 986, you sometimes can't get any more
|
|||
|
callers in after the first. Furthermore, if you park one of these loops and
|
|||
|
there is nobody on the other end for more than 4 minutes, you may be automati-
|
|||
|
cally disconnected. These loops are good for backup purposes when all other
|
|||
|
loops are busy.
|
|||
|
--More--(53%)
|
|||
|
99XX Scanning:
|
|||
|
Many exchanges in the Bell System have a wide variety of test #'s and other
|
|||
|
"goodies," such as loops.
|
|||
|
These "goodies" are usually found between 9900 and 9999 in your local ex-
|
|||
|
change. If you have the time and initiative, scan your exchange and you may
|
|||
|
become lucky!
|
|||
|
Here are my findings in 914-268:
|
|||
|
9901: Verification (recording of a/c and exchange)
|
|||
|
9936: Voice # to the Telco CO
|
|||
|
9937: Voice # to the Telco CO
|
|||
|
9941: Carrier
|
|||
|
9960: Osc. Tone (tone side loop)
|
|||
|
9963: Tone (stops: muted)
|
|||
|
9966: Carrier
|
|||
|
9968: Tone that disappears--responds to certain touchtone keys
|
|||
|
Most of the #'s between 9900 and 9999 will ring, be busy, go to a special
|
|||
|
intercept operator ("what #, please") or will go to a "the # you have
|
|||
|
reached..." recording. What you find depends upon the switching equipment in
|
|||
|
the exchange and the Telco operating company.
|
|||
|
When searching for loops, you may find one of the following possibilities
|
|||
|
when you find one:
|
|||
|
--More--(58%)
1. You can hear through the loop (not muted) but there is a 1/2 second
|
|||
|
click every 10 seconds that interrupts the audio. This type is good for
|
|||
|
backup use but the @#$&% click is super annoying.
|
|||
|
2. One side of the loop is busy; try it again later.
|
|||
|
3. The tone disappears, but you cannot hear through it (the loop is muted,
|
|||
|
try again in a month or so).
|
|||
|
4. You get the "The # you have reached..." recording. No loop there!
|
|||
|
|
|||
|
Most loops are muted (#3), but their status does change from time to time.
|
|||
|
It all depends if the Telco maintenance personnel remember to "throw the
|
|||
|
switch" i.e. turn off the loop.
|
|||
|
Since I have done the above 914-268-99XX scan, Congers (268) has installed
|
|||
|
new switching equipment (DMS100). Some of the numbers are the same, but I have
|
|||
|
noted that on the DMS100, the recordings are also stored in this area. 268-
|
|||
|
9903, 9906, 9909, and 9912 are all different recordings. Also, there are 2
|
|||
|
fortress fone recordings at 268-9911 (deposit 5 cents or else) and 268-9913
|
|||
|
(deposit 10 cents). None of these recordings supe and alot of other 99XX #'s
|
|||
|
don't supe either.
|
|||
|
In Washington, there is a sweep tone test at (202) 560-9944. [Sweep tone
|
|||
|
tests are used to detect infinity transmitters (aka harmonic bugs) on the
|
|||
|
line. In the 415 area, NNX-0046 is almost always a sweep tone test.]
|
|||
|
|
|||
|
--More--(64%)
In NYC (212), you'll find the infamous loop lines (as mentioned above).
|
|||
|
It will be easier to scan your exchange if you make up a chart like this:
|
|||
|
|
|||
|
|
|||
|
.------------------NPA-NNX-(99/00) XX SCAN CHART----------------.
|
|||
|
| Number .=0==.=1==.=2==.=3==.=4==.=5==.=6==.=7==.=8==.=9== |
|
|||
|
| 990 : : : : : : : : : : |
|
|||
|
| 000 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 991 : : : : : : : : : : |
|
|||
|
| 001 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 992 : : : : : : : : : : |
|
|||
|
| 002 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 993 : : : : : : : : : : |
|
|||
|
| 003 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 994 : : : : : : : : : : |
|
|||
|
| 004 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 995 : : : : : : : : : : |
|
|||
|
--More--(70%)
| 005 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 996 : : : : : : : : : : |
|
|||
|
| 006 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 997 : : : : : : : : : : |
|
|||
|
| 007 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 998 : : : : : : : : : : |
|
|||
|
| 009 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| 999 : : : : : : : : : : |
|
|||
|
| 009 : : : : : : : : : : |
|
|||
|
|---------------------------------------------------------------|
|
|||
|
| B- Busy (try again at another time) C- Carrier (computer)|
|
|||
|
| I- ignore (at a higher #= loop) O- intercept Operator ("What |
|
|||
|
| # you callin'?" R- rings (try again at another time) |
|
|||
|
| Rn- Recording (make a note of what types) S- sweep tone test |
|
|||
|
| T- tone (tone at a lower # + ignore) V- voice # to the Telco |
|
|||
|
| Central Office, usually answer with the city name and area. |
|
|||
|
\---------------------------------------------------------------/
|
|||
|
|
|||
|
--More--(76%)
This leaves you with 100 boxes (1 for each number between (99/00)00 and
|
|||
|
(99/00)99. You should make your boxes big enough so you can write some sort of
|
|||
|
shorthand like that given above in them.
|
|||
|
There will be others and you should find interesting tones, noises, and oth-
|
|||
|
er test functions. Also, the more important the exchange is, the more you will
|
|||
|
find. For example, in 914-623, I found well over 10 voice #'s!
|
|||
|
Also, loops are USUALLY, but not EXCLUSIVELY found in the 99/00XX series.
|
|||
|
For example, 713-324-1799/1499 is a loop.
|
|||
|
|
|||
|
What is the perfect loop? Here is what I would look for:
|
|||
|
1. Non-sup on one or both sides. To check for a non-sup loop, go to a tone-
|
|||
|
first fortress fone and dial the #. If it asks for a dime, it is supervised.
|
|||
|
If the call goes through, then it is non-suped!
|
|||
|
2. 800 loops would be a plus. They are not necessarily found between 9900
|
|||
|
and 9999, though. I would check the 1XXX series first.
|
|||
|
3. Multi-user loops are also a plus for those late night conferences.
|
|||
|
|
|||
|
NOTE: If there is nothing in the 99XX area in your exchange or if 99XX is
|
|||
|
used for actual numbers, then try 0XXX and 1XXX scanning in that ord-
|
|||
|
er.
|
|||
|
|
|||
|
Finally, remember that it is only a local call to find out what your CO has
|
|||
|
--More--(82%)
in store for you. If you find anything interesting, be sure to drop me a line.
|
|||
|
|
|||
|
NOTE: Your local white pages can be a valuable asset. You can also order
|
|||
|
other fone books from your business office (usually free for books
|
|||
|
within your operating company's district). A large fone book, such as
|
|||
|
Manhattan, contains much more info in the first few pages than other
|
|||
|
books.
|
|||
|
|
|||
|
ANI : Automatic Number Identification
|
|||
|
|
|||
|
Automatic Number Identification is a number that you call up that will tell
|
|||
|
you what # you are calling from.
|
|||
|
This has a few uses. First, were you ever somewhere and the fone didn't
|
|||
|
have a # printed on it? Or perhaps you were fooling around in some cans (those
|
|||
|
big boxes on fone poles that contain terminals for lineman use--to be discussed
|
|||
|
in a future chapter) and you want to know what the line # is?
|
|||
|
In NPA 914, the ANI is 990. In NPA's 212 and 516, ANI is 958. This varies
|
|||
|
from area to area. Here is a list of some ANI's I've seen:
|
|||
|
211/311 401-222-2222 890-751-5191 202-222-2222 222-222-222
|
|||
|
1-XXX-1111 (in some 914 area, esp. under step-by-step switching, you
|
|||
|
have to dial 1-990-1111) (760-1111 in 415 area code)
|
|||
|
|
|||
|
--More--(88%)
To find ANI for other areas, check 3 digit #'s first, usually in the 9XX
|
|||
|
series (excluding 911, please!). In areas under step-by-step, try 1-9XX-1111.
|
|||
|
ANI may also be in 99XX. Last resort, try to get friendly with your neigh-
|
|||
|
bor who works for the fone company.
|
|||
|
|
|||
|
RINGBACK
|
|||
|
|
|||
|
Ringback, as its name implies, calls back the # you are at when you dial
|
|||
|
the ringback #.
|
|||
|
Ringback, in NPA 914, is 660. You dial 660+ the last 4 digits of the fone
|
|||
|
# you're calling from. You will then get a tone. Hangup quickly and pickup
|
|||
|
again in about 2 seconds. You will then get a second tone, hangup AGAIN and
|
|||
|
the fone will ring.
|
|||
|
In NYC, it is also 660, but you may have to press 6 or 7 before you hang up
|
|||
|
for the first time (ie, at the first tone).
|
|||
|
Other ringback numbers include:
|
|||
|
331 [619/714] 536+nnnn [305] 958+nnnn [202] (nnnn=last 4 digits of
|
|||
|
fone #) 26011- this 5 digit format is used primarily on step-by-step.
|
|||
|
The last 2 digits (11) are dummy digits. 890-897-nnnn
|
|||
|
119911/11010/0009910 GTE
|
|||
|
350, 850, 580, 890 -nnnn (415 area, payphones)
|
|||
|
|
|||
|
--More--(93%)
The reason you get the tone when you pick-up after it rings is because in
|
|||
|
some areas, people were using ringback as an in-house intercom. They would
|
|||
|
dial ringback, and when it stopped ringing, they would pickup and talk with the
|
|||
|
person on the other extension. Bell didn't like this since there is usually
|
|||
|
only 1 piece of common control equipment in each exchange that does the ring-
|
|||
|
back. When people used this as an intercom, repairmen and linemen couldn't get
|
|||
|
through! In some areas, especially under step-by-step, ringback can still be
|
|||
|
used as an intercom. Also, under step-by-step, the ringback procedure is usu-
|
|||
|
ally simple. For example, in one area you would dial 26011 and hangup; it
|
|||
|
would then ringback.
|
|||
|
|
|||
|
TOUCH-TONE TEST
|
|||
|
|
|||
|
In areas that have a touch-tone test, you dial the ringback #. At the
|
|||
|
first tone, you touchtone digits 1-0. If they are correct it will beep twice.
|
|||
|
I have also seen a DTMF test in some areas at 890-751-5191.
|
|||
|
|
|||
|
Coming Soon:
|
|||
|
In the next part, we will look at the numbering plan and dialing procedures
|
|||
|
(ie international, etc.).
|
|||
|
|
|||
|
Breakup of Bell:
|
|||
|
--More--(98%)
The operating companies are not going to change all the switching equipment
|
|||
|
around. While there will be some changes, most of the information here will
|
|||
|
remain pertinent after January 1, 1984. Just substitute the word "fone net-
|
|||
|
work" or "telco" for "Bell System."
|
|||
|
|
|||
|
December 8, 1983
|
|||
|
Acknowledgements: TAP, Phred Phreek, Judas Gerard, The Magician, and Dark
|
|||
|
Priest.
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
{G-Files} Command <?>:
|
|||
|
|
|||
|
Please enter either [file-name], [l], [h], [q], or [?]
|