textfiles/phreak/CANNING/invadbel.phk

	     I N V A D I N G   T H E   B E L L	 S Y S T E M


  Bridging heads, residential and business multiline distribution boxes, line
and trunk splitters, and other Bell system wire terminations.

   - How to use, and/or abuse them -

(including a tutorial on basic telephone eavesdropping techniques.)

***************************************
written by :   Phucked
		 Agent	   07/29/84
		    04
***************************************

  In this article, I will first bescribe the termination, wiring, and terminal
hardware most commonly used in the Bell System, and I will include a section on
methods of using them.

***************************************

-------------
Local Network
-------------

  The local telephone network between the central office/exchange and the
telephone subscribers can be breifly described as follows:

  From the central office (or(lncal exchange) of a certain prefix(es),
underground area trunks go to each area that has that prefix.  (usually more
than one prefix per area) at every few streets or tract areas, the underground
cables surface.  they then go to the telephone pole (or back underground,
depending on the area) and then to the subsribers house (or in the case of an
apartment building or mutliline business, to a splitter or distribution
box/panel).

****************************************
Now that we have the basics, I'll try and go in-depth on the subject.

------------------
Underground cables
------------------

  These are sometimes inter-office trunks, but usually in a resid- ential area
they are trunk lines that go oto bridging heads or distribution cases.	the
cables are about 2-3 inches thick (varies), and are either in a metal or
pvc-type pipe (or similar).  Rarely (maybe not in some remote rural areas) are
the cables just 'alone' in the ground.  Instead, they are usually in an
underground cement tunnel (resembles a small sewer or stormdrain).  The manholes
are >heavy< and will say 'bell system' on them.  They can be opened with a 1/2
inch wide crowbar (hook side) inserted in the top rectangular hole.  If you get
it open, go inside!!  There are ladder rungs to help you climb down.  You will
see the cable pipes on the wall, with the blue and white striped one being the
inter-office trunk (at least in my area).  The others are local lines, and are
usually marked or color coded.	There is almost always a posted color code chart
on the wall, not to mention telco manuals describing the cables and terminals,
so I need not get into detail.	Again:	>if you can get into a bell manhole, do
it!, It will pay off <.  Also, there is usually some kind of test equipment, and
often bell test sets are left in there.  So get your crowbars!

****************************************
--------------
Bridging Heads
--------------

  The innocent-looking grayish-green boxes.  These can be either trunk bridges
or bridging for residences.  The major trunk bridging heads are usually larger,
and they have the 'western electric' logo at the bottom, whereas the normal
bridging heads (which may be different in some areas- depending on the company
you are served by.  Gte b.h.'s look slightly different.  Also, do not be fooled
by sprinkler boxes!) can be found in just about every city.

  To open a bridging head:  If it is locked (and you're feeling destructive),
put a hammer or crowbar (the same one you used on the manhole) in the slot above
the top hinge of the right door.  Pull hard, and the dorr will rip off.  Very
effective!

  If it isn't locked (as usual), take a 7/16 inch hex socket and with it, turn
the bolt about 1/8 of a turn to the right (you should hear a spring release
inside).  holding the bolt, turn the handle all the way to the left and pull
out.

  Now inside, first check for a test-set (which are often left by bell
employees).  There should be a panel of terminals and wires.  Push the panel
back about an inch or so, and rotate the top latch (round with a flat section)
downward.  Release the panel and it will fall all the way forward.  There is
usually a large amount of wire and extra terminals.  The test-sets are often
hidden here, so dont overlook it (manuals, as well, are sometimes placed in the
head).	On the right door is a metal box of alligator clips.  Take a few
(compliments of bell...).  On each door is a useful little round metal device.
(Says 'insert gently' or 'clamp gently - do not overtighten' etc..) On the front
of the disc, you should find two terminals.  These are for your test set.  (If
you dont have one, dont depair - I'll show you ways to make basic test sets
later in this article).  Hooking the ring (-) wire to the 'r' terminal; and the
tip (+) wire to the other.  (By the way, an easy way to determine the correct
polarity is with a 1.5v led.  Tap it to the term.  pair, if i doesnt light,
switch the poles until it does.  When it lights, find the longer of the two led
poles.	This one will be on the tip wire (+)) Behind the disc is a coiled up
cord.  This should have two alligator clips on it..its very useful, because you
don't have to keep connecting and disconnecting the fone (test set) itself, and
the clips work nicely.

  On the terminal board, there should be about 10 screw terminals per side.
Follow the wires, and you can see which cable pairs are active.  Hook the clips
to the terminal pair, and you're set!  Dial out if you want, or just listen (if
someone's on the line).  Later, I'll show you a way to set up a true 'tap' that
you can set up, and will let the person dial out on his line and receive calls
as normal, and you can listen in the whole time.  More about this later...

  On major prefix-area bridging heads, you can see 'local loops', which are two
cable pairs (cable pair = ring+tip, a fone line) that are directly connected to
each other on the terminal board.  These 'cheap loops' as they are called, do
not work nearly as well as the existing ones set up in the switching hardware at
the exchange office.  (Try scanning your prefixes' 00xx or 99xx #'s.  The tone
sides will announce themselves with the 1000 hz loop tone, and the hang side
will give no response.	The first person should dial the 'hang' side, and the
other person dial the tone side, and the tone should stop if you have got the
right loop)

  If you want to find the number of the line that you're on, you can either try
to decipher the 'bridging log' (or whatever), which is on the left door.  if
that doesnt work, you can use the follwing:

---
ANI # (Automatic Number Indentication)
---

  This is a telco test number that reports to you the number that youre calling
from (it's the same, choppy 'bell bitch' voice that you get when you reach a
disconnected #)

For the 213 NPA - dial 1223
	408 NPA - dial 760
	914 NPA - dial 990

  These are extremely useful when messing with any kind of line terminals, house
boxes, etc.

  Now that we have bridging heads wired, we can go on...  (dont forget to close
and latch the box after..wouldnt want to get and telco people mad, now, would
we?)

***************************************

------
"CANS" - Telephone pole distribution
------		 boxes

Basically, two types:

1> Large, rectangular silver box at the end of each street.

2> Black, round or rectangular thing at every telephone pole.

  Type 1 - This is the case that takes the underground cable from the bridger
and runs it to the telephone pole cable (the lowest, largest wire on the
telephone pole).  The box is always on the pole nearest the briging head, where
the line comes up.  Look for the 'call before you dig - Underground cable'
stickers..

  The case box is hinged, so if you want to climb the pole, you can open it with
no problems.  These usually have 2 rows of terminal sets.  These are all the
cable pairs for your street.  (Its similar to a miniature bridging head).
Use/abuse it in the same manner as we did before.  (Note:  all the active lines
carry from 15 to 48 vdc, and even 90vac (when ringing), so be careful - It's not
going to hurt you, but it can surprise you (and if you're hanging by one hand
from a tel.  pole, it >can< be harmful!))

  Oh, by the way, if you use ANI on every pair and you find one that isnt in use
on your street, you can hook it up for yourself (almost).  Also, you have to be
able to impersonate a telco technician and report the number as 'new active'
(giving a fake name and fake report, etc) I don't recommend this and it probably
won't (almost positively won't) work, but this is basically what telco linemen
do).

  Type 2 - This is the splitter box for the group of houses around the pole.
(usually 4 or 5 houses).  Use it like I mentioned before.  The terminals (8 or
so) will be in 2 horizontal rows of sets.  The extra wires that are just
'hanging there' are provisions for extra lines to residences (1 extra line per
house, thats why the insane charge for line #3!) If its the box for your house
also, have fun and swap lines with your neighbor!  'piggyback' them and wreak
havoc on the neighborhood (it's eavesdropping time...) again, I dont recommend
this, and it's difficult to do it correctly.  Moving right along..

***************************************

------------------------------
Apartment / Business Multiline
 Distribution Boxes
------------------------------

  Found outside the buliding (most often on the right side, but not always..
just follow the wire from the telephone pole) or in the basement.  It has the
terminals for all the lines in the building.  Use it just like any other
termination box as before.  Usually says 'bell system' or similar.  Has up to 20
terminals on it (usually) the middle ones are grounds (forget these).  The wires
come from the cable to one row (usually the left one) , with the other row of
terminals for the building fone wire pairs.  The ring (-) wire is usually the
top terminal if the set in the row (1 of 10 or more), and the tip is in the
clamp/screw below it.  This can be reversed, but the cable pair is always
terminated one-on-top-of-each-other, not on the one next to it.  (Im not sure
why the other one is there, probably as a provision for extra lines) dont use it
though, it is usually to close to the other terminals, and in my experiences you
get a noisy connection.

  Final note:  Almost every apartment, business, hotel, or anywhere there is
more than 2 lines this termination method is used.  If you can master this type,
you can be in control of many things...  Look around in your area for a building
that uses this type, and practice hooking up to the line, etc.

  As an added help, here is the basic 'standard' color-code for multiline
terminals/wiring/etc...

Single line:  red = ring
	    green = tip
	   yellow = ground (connected to l1 ringer coil in individual and
 bridged ringer phones (bell only)) usually connected to the green (tip)

Ring (-) = red
	   white/red stripe
	   brown
	   white/orange stripe
	   black/yellow stripe
Tip (+) =  green (sometimes yellow, see above ^)
	   white/green stripe
	   white/blue stripe
	   blue
	   black/white stripe
Ground	=  black
	   yellow

***************************************

----------------------
Residence terminal box
----------------------

  Small, gray (can be either a rubber (Pacific Telephone) or hard plastic (AT &
T) housing) deal that connects the cable pair from the splitter box (see type 2,
above) on the pole to your house wiring.  Only 2 (or 4, the 2 top terminals are
hooked in parallel with the same line) terminals, and is very easy to use.  This
can be used to add more lines to your house or add an external line outside the
house.

***************************************

  Well, now you can consider yourself a minor expert on the terminals and wiring
of the local telephone network.  Now you can apply it to whatever you want to
do..  heres another helpful item-

  How to make a basic test-set and how to use it to dial out, eavsdrop, or
seriously tap and record line activity.

---------
TEST-SETS
---------

  These are the (usually) orange hand set fones used by telco technicians to
test lines.  To make a very simple one, take any bell (or other, but i recom-
mend a good bell fone like a princess or a trimline.  GTE flip fones work
excellently, though..) Fone and cut off all the wires (including the modular
jack , if any) except the red (ring - ) and the green (tip +).	If they arent
color-coded, they are usually the inner most two in the 4 con ductor cable (the
fone cord).  Put alligator clips on it and use it as described earlier.  This
will enable you to dial out and listen, but no extra abilities.( You are in
effect just an extension of their line).  If you want to get more technical, or
you just want to listen without being heard (or detected in any normal way) you
can use one of the following test-set/tap fone designs, or make your own..

Test Set Version # 1
---------------- - -

  A 'black box' type fone mod will let you tap into their line, and with the box
on, it's as if you werent there.  They can recieve calls and dial out, and you
can be listening the whole time!  very useful.	With the box off, you have a
normal fone test set.  Instructions:  Basic black box.	Works well with good
results.  Take the cover off the fone to expose the network box (Bell type fones
only).	The <rr> terminal should have a green wire going to it (orange or
different if touch tone - doesnt matter, its the same thing).  Disconnect the
wire and connect it to one pole of an SPST switch.  Connect a piece of wire to
the other pole of the switch and connect it to the <rr> terminal.  Now take a
10k ohm 1/2 watt 10% resistor and put it between the <rr> terminal and the <f>
terminal, which should have a blue and a white wire going to it (different for
touch tone).  It should look like this:

-----BLUE WIRE-----<F>
---WHITE WIRE-----/ !
		    !
	       10K RESISTOR
		    !
--GREEN WIRE-	  -<RR>
	     !	  !
	     !	  !
	      SPST

  What this does in effect is keep the hookswitch / dial pulse switch ( f to rr
loop) open while holding the line high with the resistor.  This gives the same
voltage effect as if the fone was 'on-hook', while the 10k ohms holds the
voltage right above the 'off hook' threshold (around 22 volts or so, as compared
to 15-17 for normal off hook, 48 volts for normal 'on-hook'), giving the best
line volume and signal strength attainable without an external amplifier.

Test-set version # 2
---------------- - -

  Another design (which I use on a GTE flip phone II with good res- ults), is
similar to the 'type 1' test set (above), but has some added features:

FROM >-----------------TIP---<TO TEST
ALLIGATOR		      SET
CLIP >------ ----------RING--<PHONE
	    !		   !
	    X		   ^
	    !		  ! !
	    O		  < !
	    !		  > !
	    !		  > !
	    !		  ! !
	    !	 X--------- !
	    !	 X	    !
	    !----X	    !
		 X----0-----!
X= SPST SWITCH
O= RED LED	      0=GREEN LED
\/\/\=1.8K 1/2 watt resistor   XXXX= DPST switch

  When the spst switch in on, the led will light, and the fone will become
active.  The green light should be on.	If it isn't, switch the dpst.  If it
still isnt, check the polarity of the line and the leds.  With both lights on,
hang up the fone.  They should all be off now.	Now flip the dpst and pick up
the fone.  The red should be on, but the green shouldnt.  If it is, something is
wrong with the circuit.  You wont get a dial tone if all is correct.  When you
hook up to the line with the alligator clips (assuming you have put this circuit
inside your fone and have put alligator clips on the ring and tip wires (as we
did before)) you should have the spst #1 in the off posistion.	This will greaty
reduce the static noise involved in hooking up to a line.  the red led can also
be used to check if you have the correct polarity.

  With this fone you will have the ability to listen in on >all< audible line
activity, and the people (the 'eavesdropees') can use their fone as normal.

  Note that test sets #1 and #2 have true 'black boxes', and can be used for
free calls (see an article about black boxes).

Test Set version # 3
---------------- - -

	(Courtesy of Lex Luthor ,Sysop of Plover Net)
  Using a trimline (or similar) phone, remove the base and cut all of the wire
leads off except for the red (ring -) and the green (tip +).  Solder alligator
clips to the lugs.  The wire itself is 'tinsel' wrapped on rayon, and doesnt
solder well.  Inside the fone handset, remove the night light socket (if it has
one) and install a small slide or toggle switch (radio shack's microminiature
spst works well).  Locate the connect- ion of the ring and the tip wires on the
pc board near where the jack is located at the bottom of the handset.  (The
wires are sometimes black or brown Instead of red and green, respectively).  Cut
the foil and run 2 pieces of wire to your switch.  In parallel with the switch
add a .25 mf 200 vdc capacitor (mylar, silvered mica, ceramic, not an
electrolytic).	When the switch is closed, the handset functions normally.  With
the switch in the other position, you can listen with out being heard.	(I
would, once again, like to give credit to Lex Luthor for this simple and
effective design).

  NOTE:  To reduce the noise involved in connecting the clips to a line, add a
switch selectable 1000 ohm 1/2 watt resistor in series with the tip wire.  Flip
it in circuit when connecting, and once on the line, flip it off again.  (Or
just use the 'line disconnect' type switch as in the type2 test set (above)).
Also avoid touching the alligator clips to any metal parts or other terminals,
for It causes static on the line and raises poeple's suspicions.

Recording
---------

  If you would like to record any activity, use test set 1 or 2 above (for
unattended recording of >all< line activity), or just any test set if you are
going to be there to monitor when they are dialing, talking, etc.

  Place a telephone pickup coil (I recommend the recoton t-5 tp coil or
equivalent) onto the test set, and put the tp plug into the mic.  Jack of any
standard tape recorder.  Hit play, rec, and pause.  Alternate pause when you
want to record (I dont think anyone should have any difficulty with this at
all...)

**************************************

Well, if you still can't make a test set or you don't have the parts, there's
still hope. Alternate methods:

1> Find a bell test set in a manhole or a bridging head and
   'borrow it indefinately'...

2> According to Sir Francis Drake, Test sets can be purchased from:

     Techni-Tool

    5 APOLLO ROAD
       BOX 368
   Plymouth Meeting
      PA., 19462

  ASK FOR CATALOG #28

     They are usually $300 - $600, and are supposed to have mf dialing
capability as well as tt dialing. They are also of much higher quality
than the standard bell test sets.

***************************************

If you would like to learn more about the subjects covered here, I suggest:

1> Follow bell trucks and linemen or technicians and ask subtle questions.
   Also try 611 (repair service) and ask questions..
2> Explore your area for any Bell hardware, and expirament with it.
   Don't try something if you are not sure what youre doing, because you
   wouldnt want to cause problems, Would you?

I hope the article was informative. Be looking for

 'Invading the Bell System - Part II'

***************************************

WRITTEN BY:
	      PHUCKED
	***	AGENT	 ***
		   04

 A.K.A.
		   PHREAK ADVISOR
> THE		     C.O.R.E. DELTA
> SPINOFF MASTER      PVPC INNER CORE

***************************************

Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open