textfiles/phreak/hmb1.txt

 
Another Safe Cracker Production 
                                     
       Hacking Ma Bell           
                                     
          Part One              
                                     
  
Spencer Whipple, Jr. 
c/o 73 Magazine 
Peterborough, NH 03548 
 
Basic Telephone Systems 
Part One 
 
Lifting Ma Bell's Cloak of Secrecy 
---------------------------------- 
     Though telephones predate radio communications by many years, they 
aren't nearly as simple as they appear at first glance. In fact, some 
aspects of telephone systems are most interesting and quite ingenious. 
In this article we will describe some of these more interesting and perhaps 
less well-known areas of telephone systems. 
     But before going farther, let me explain and apologize for the fact 
that some of the information in this article may not be altogether complete, 
up to date, or even correct. I do not work for any phone company, and therefore
do not have access to internal telephone company literature. Moreover, 
there is very little material available in books or magazines which describes 
how US telephone systems work. Much of the information in this article has 
been obtained piece-meal from many different sources such as books, popular 
magazines, computer data communications journals, handbooks, and sometimes 
just plain hear-say. I have tried to correlate as much as possible all the 
little bits and pieces into a coherent picture which makes sense, but there is 
no easy way to be sure of all the little details. So think of this article as 
if it is a historical novel - generally accurate and, regardless of whether it 
is completely true or not, fascinating. 
     With this out of the way, let's go on. Figure 1 shows a simple diagram 
which explains how your home telephone fits into the overall picture. You, as 
the customer, are generally referred to as the 'subscriber'. Your telephone 
connects to the Central Office through a two-wire cable which may be miles long
and which may have a resistance on the order of hundreds or even thousands 
of Ohms. This cable is essentially a balanced line with a characteristic im- 
pedence of around 900 Ohms, but this varies greatly with different calls. (This
is why it is so hard to keep a hybrid phone-patch balanced.) 
     The main power in the central office comes from 48 volt storage batteries 
which are constantly kept trickle-charged. This battery is connected to your 
line through a subscriber relay and a balanced audio transformer. The relay 
is sensitive enough to detect even quite small currents through your line. 
     The buttons which stick up out of your telephone case when you lift the 
handset accuate the hook switch. The name probably dates back to the days when 
the handset (or even earlier, the earpiece) hung on the side of the phone from 
a hook. In any case, when your phone is hung up it is said to be on the hook; 
when you lift the handset to make a call it is said to go off the hook. With 
the phone on hook, the line is connected only to the bell (called the ringer). 
Because the bell circuit has a capacitor in it, no dc current can flow through 
the phone. As a result, the subscriber relay back in the central office will 
be deenergized, indicating to the central office (let's abbreviate that as CO 
from now on) that your phone is hung up. Since there is no current through 
your line or phone, there is no voltage drop anywhere, and so if you measure 
the voltage across the phone line at your home you will see the entire 48 volts
(or even more if the CO batteries are well charged). The positive (grounded) 
lead is called the tip and negative lead is called the ring; these names cor- 
respond to the tip and ring of a three-circuit phone plug. 
     Now suppose you want to place a call. You pick up the handset, and the 
phone goes off the hook. This completes the dc circuit through the dial, micro-
phone, and the hybrid network which is basically a complicated transformer 
circuit. At this point current starts to flow from the battery through your 
line and phone, and the subscriber relay back at the CO pulls in. The line 
voltage across your phone now drops to just a few volts because the line is 
loaded down by the low resistance of the phone. The CO now searches for some 
idle dialing circuits, and when it finds them, connects a dial tone back to 
your phone. When you hear this, you start dialing. 
     The dial shown in Fig. 1 is a rotary dial of the type which you turn with 
your finger (we will talk about Touchtone dials later). When you dial a number,
the dial acts as a short circuit until you release the dial and let the built- 
in spring return it back to the resting position. As it is returning, it starts
to open and close the circuit in sequence to indicate the number you dialed. 
If you dial a 1,it opens the circuit once; if you dial a 9 it opens the circuit
nine times. As the dial is returning it causes the subscriber relay to open and
close in step. This enables the CO to recognize the number you want. When you 
finish dialing, the dial becomes just a plain short circuit which passes 
current through the microphone and the hybrid network. Since the mike is a 
carbon unit, it needs this current to work. 
     When the CO receives the complete number, it starts to process your 
call. If you dialed another subscriber in the same area, it may connect you 
directly to that subscriber's line. Calls to phones a little further away may 
have to be routed through another CO, while long distance calls may go through 
one or more long distance switching centers (called tandems) and possibly 
many other CO's before arriving at the destination. At the completion of this 
process, you may get either a ringing signal, indicating that the phone at 
the other end is ringing, one of several types of busy signals, or possibly 
just silence, if something goes wrong somewhere. 
     When you talk to the person at the other end, the cable carries audio 
in both directions at the same time. Your carbon microphone varies the current 
in your circuit, and this current variation is detected by a balanced trans- 
former in the CO.At the same time, audio coming back to your phone goes through
the hybrid network to your earphone. (In phone company lingo they like to call 
the mike a transmitter, and the earphone is called a receiver.) 
     You may be interested in the makeup of the various tones you may hear 
on your telephone; these tones are important to people such as computer com- 
munications designers who have to build equipment which will recognize dial 
or other signalling tones: 
     Dial tone in older exchanges may still be a combination of 120 and 600 Hz 
but the newer exchanges use a combination of 350 and 440 Hz. There is often 
a slight change in the dc line voltage at the beginning of dial tone, and 
this may also be detected. 
     Busy signal is a combination of 480 and 620 Hz which alternates for 1/2 
second on and 1/2 second off (i.e., 60 interruptions per minute) when the 
party you are calling is busy. The same busy signal may be used for other 
conditions such as busy interoffice or long distance circuits, but would then 
be interrupted either 30 times a minute or 120 times per minute. This is a 
standard agreed on by an international telecommunications organization called 
CCITT (and I don't offhand remember the French words it stands for), but 
occasionally other frequencies up to 2kHz are used. A siren-like sound varying 
between 200 and 400 Hz is often used for other error conditions. 
     The ringing tone, which you hear coming back to you when the phone rings 
on the other end of the connection, is nowadays mostly a combination of 440 
and 480 Hz, but there is a great variation between CO's. Very often a higher 
frequency such as 500 Hz is interrupted at 20 Hz, and other tones are used as 
well. The tone is usually on for two seconds and off for 4 seconds. 
     The ringing current, actually used to ring the bell in a telephone, is an 
ac voltage since it has to activate a ringer which has a capacitor in series 
with it.Different companies use different ringing currents, but the most common
is 90 volts at 20 Hz. Since a typical phone may be thousands of feet away from 
the CO, the thin wires used may have a fairly high line resistance. Hence only 
a relatively small current can be applied to the bell, certainly not enough 
to ring something like a doorbell. This problem is solved by making the bell 
resonant mechanically at the ringing frequency so that even a fairly small 
amount of power is enough to start the striker moving hard enough to produce 
a loud sound. This is the reason why a low frequency ac is used. Although this 
raises some problems in generating a 20 Hz signal at a high enough voltage, 
it has the advantage that a bell will respond to a ringing current only if 
the frequency is quite close to the bell's naturally resonant frequency. 
If you build two bells, one resonant at 20 Hz and the other resonant at 30 Hz, 
and connect them together to the same line, you can ring just one bell at a 
time by connecting a ringing current of the right frequency to the line; this 
has some useful applications in ringing just one phone on a party line. 
     Now let's look at some of the components of the phone itself. We will 
consider the most common new phone, a model 500 C/D manufactured by Western 
Electric and used by Bell System affiliated phone companies. This is the 
standard desk phone, having modern rounded lines and usually having a G1 or 
G3 handset. It was developed about 1950 and replaced the older 300-series 
phones which had the older F1 handset and had sharper corners and edges. (There
was an inbetween phone, where they took an old 300 series phone and put a 
new case on it which resembled the 500-style case but had a straight up-and 
down back - the back of the case came straight down right behind the handset 
cradle,whereas the true 500-style telephone has what looks like a step sticking
out behind the cradle). If you are still in doubt as to which phone you have, 
the bell loudness control is a wheel on the 500-type phone and a lever on the 
300-type. If you live in the boondocks, you may still have the 200-type phone 
(sometimes called the ovalbase) or maybe even the desk-stand type that looked 
like a candlestick, with the microphone mounted on top and the earpiece hanging
on the side from a hook. Neither of these phones had a built in bell, and so 
you probably have a bell box attached to your wall. (If you have a phone with 
a handle on the side which you crank to call the operator, the following does 
not apply to your phone !) 
     Fig. 2 shows the bell circuit, which consists of a two-coil ringer and 
a 0.5 uF capacitor. On Western Electric phones the capacitor is mounted inside 
the network assembly, which also has a large number of screws on top which 
act as connection points for almost everything inside the phone. (I have 
never been able to find out why the ringer has two coils of unequal resistance 
but it apparently has something to do with determining which subscriber on a 
party line makes which call.) In most phones, the yellow and the green wires 
are connected at the wall terminal block so that the bell is connected directly
across the telephone line; disconnecting the yellow lead would turn off the 
bell (although sometimes the connection is made internally by connecting the 
black lead from the ringer directly to the L1 terminal, in which case the 
yellow lead is disconnected. 
     You may wonder why a yellow lead is needed at all when only two wires 
are normally used anyway. It is true that only two wires enter the house from 
the outside; one of these is the tip and the other is the ring. In a non-party 
line the ringing current as well as all talk voltages are applied between the 
tip and the ring, and it doesn't actually matter which of the phone leads 
goes to the tip and which to the ring if you have a rotary dial phone. If you 
have a Touchtone dial, then you have to observe polarity so that the transistor
circuit in the dial works, in which case you have to make sure that the green 
lead goes to the tip and the red lead goes to the ring. 
     The yellow lead is commonly used for party lines. On a two-party line 
ringing current from the CO is applied not between the two lines, but between 
one line and ground. In that case the yellow lead goes to ground while the 
other side of the ringer (the red lead) is connected to either the tip or the 
ring, depending on the party. In this way, it is possible to ring only one 
party's bell at a time. 
     The remaining connections inside the telephone are shown in Fig.3. The 
components labeled VR are varistors: the phone companies must be the world's 
biggest users of these devices, which are variable resistors whose resistance 
drops as the voltage across them rises. Their function in the phone set is 
to short out parts of the set if the applied voltage gets too high. For in- 
stance, VR2 is connected directly across the earphone (receiver) and acts as 
a volume limiter to lower the volume if the applied voltage gets too high - 
a great way to protect your eardrums. 
     As you can see in Fig.3 we use the standard phone company way of ident- 
ifying normally open and and normally closed switches - an X in a wire is 
normally a normally open contact of a switch or relay, while a short bar means 
a normally closed contact.The arrows in the drawing show the path of dc current
through the phone when it was off the hook. Starting at the green wire, the 
current path goes through a set of contacts on the hook switch, then through 
the pulsing contacts on the dial, through part of the network, through the 
mike, back through a second winding on the network, and finally through a 
second contact on the hook switch and back out to the red wire. 
     The hook switch actually has three sets of contacts, two normally open 
(open, that is, when the hand set is on the hook) which completes the dc cir- 
cuit when you pick up the handset, and a normally closed contact which is 
wired directly across the earphone. This contact's function is to short the 
earphone during the time that the dc circuit is being opened or closed through 
the phone - this prevents you from being blasted by a loud click in the ear- 
phone. 
     The dial has two contacts. One of these is the pulsing contact, which 
is normally closed and only opens during dialing on the return path of the 
dial after you let go of it. The second contact, labelled the off-normal con- 
tact, shorts the earphone as soon as you start turning the dial, and releases 
the short only after the dial returns back to the normal position. In this 
way you do not hear the clicking of the dial in the phone as you dial. 
     Finally, the phone has the hybrid network which consists of a four-winding
transformer and a whole collection of resistors, capacitors, and varistors. 
The main function of the network is to attenuate your own voice to lower its 
volume in your earphone. The simplest phone you could build would be just 
a series circuit consisting of a dial, a }ike, and an earphone. But the signals
coming back from the other party are so much weaker than your own signals, 
that an earphone sensitive enough to reproduce clearly and loudly the voice 
of the other person would then blast your eardrums with the sound of your own 
voice. The function of the network is to partially cancel out the signal pro- 
duced by the local mike, while permitting all of the received signal to go to 
the earphone. This technique is similar to the use of a hybrid phone patch 
with a VOX circuit, where you want the voice of the party on the telephone 
to go to your transmitter, but want to keep the receiver signal out of the 
transmitter. 
     In addition to the parts needed for the hybrid, the network also contains 
a few other components (such as the RC network across the dial pulsing 
contacts) and screw-type connection points for the entire phone. 
     A Touchtone phone is similar to the dial shown here, except that the 
rotary dial is replaced by a Touchtone dial. In addition to its transistor- 
ized tone generator, the standard Touchtone pad has the same switch contacts 
to mute the earphone, except that instead of completely shorting the earphone, 
as the rotary dial does, the Touchtone dial switches in a resistor which only 
partially mutes the phone. The circuit of the Touchtone dial is shown in 
recent editions of the ARRL Handbook so we won't print it here, but Fig.4 
shows two possible connections of such dials for amateur use. Fig.4 (a) shows 
the connection for coupling the dial output electrically to a transmitter in- 
put, while Fig.4 (b) shows how to connect it to a 500 Ohm earphone (such as 
the earphone from a telephone handset) for acoustic coupling into a transmitter
microphone. Fig.5 shows how the terminals on a Trimline Touchtone pad cor- 
respond to the colored wires coming from the standard desk-type phone pad. 
     It is fairly common knowledge as to what frequencies are used for Touch- 
tone signalling, but a misprint in several recent ARRL publications gives the 
wrong frequency for one of the high tones, so here is a short table which 
repeats the correct numbers : 
 
       LOW 
       TONE       HIGH TONE GROUP (Hz) 
       GROUP 
       (Hz)       1209    1336    1477    1633 
       697         1        2       3       A 
       770         4        5       6       B 
       852         7        8       9       C 
       941         *        0       #       D 
 
Each digit is composed of one frequency from the low group and one frequency 
from the high group; for instance, the digit 6 is generated by producing a 
low tone of 770 Hz and a high tone of 1477 Hz at the same time. The American 
Touchtone pads generate both of these tones with the same transistor, while 
European pads (yes, there are some) use two transistors, one for each tone. 
In addition to the first three high tones, a fourth one of 1633 has been 
decided on for generating four more combinations, called A through D in the 
above table. These are not presently in use, although the standard phone Touch-
tone pad can easily be modified to produce this tone, since the required tap 
on the inductor used to generate the tone is already present and only an 
additional switch contact is needed to use it; information on this simple 
conversion is found in the 73 publication 'Digital Control of Repeaters'. 
     What is not generally known is that the U.S. Air Force uses a different 
set of Touchtone frequencies, in the range of 1020 to 1980 Hz. Since many 
of the phones available for purchase in stores come from Department of Defense 
surplus sales, it will be interesting when these phones become available. 
     Another Touchtone dial presently used by amateurs is made up of a thin 
elastomeric switch pad made by the Chomerics Corp. (77 Dragon Court, Woburn, 
Mass. 01801) and a thick-film hybrid IC made by Microsystems International 
(800 Dorchester Boulevard, Montreal, Quebec). The pad is the Chomerics ER- 
20071, which measures about 2 1/4 inch wide by 3 inches high, and only about 
3/16 inch thick (Chomerics also makes a smaller model ER21289, but it is very 
difficult to use and also apparently unreliable).Microsystems International 
makes several very similar ICs in the ME8900 series, which use different 
amounts of power and generate different amounts of audio. Some of these also 
contain protection diodes to avoid problems if you use the wrong polarity on 
the IC, and there are so many models to choose from that you should get the 
technical data from the manufacturer before ordering one. There are a number 
of US distributors, including Newark Electronics, Milgray and Arrow Electronics
in New York. KA Electronics Sales advertised both the pad and the IC in the 
July 1974 issue of 73 Magazine. In single quantities, the pad goes for about 
$9 and the IC costs about $18, although it drops in price if you order larger 
quantities. 
     A simple circuit for the IC and pad isshown in the ARRL publication 'FM 
and Repeaters for the Radio Amateur'. While this circuit is perfectly good, 
it does not work in the presence of a strong rf. If you want to mount this pad 
and IC on a portable 2-meter rig, you will have to use bypass capacitors and 
chokes to keep the rf out of the IC. Bypass pins 8 and 16 of the IC to pin 13 
with small discs of about 0.001 or 0.01 uF, right at the IC, using very short 
leads. Then put small 2 to 5 microhenry chokes in series with pins 8, 13 and 
16 right at the IC. If needed, put more chokes at the other end of each lead. 
Ohmite Z-144 chokes are good but a little bulky; the small 1.8 microhenry 
chokes used in Motorola Handie-Talkies (Motorola type 24-82723HO1) are about 
the size of a 1/8watt resistor and almost as good.It may seem a little funny to
put chokes in the ground leads,as all hams are trained to use good rf grounds, 
but the object is to keep rf out of the IC at all costs and this accomplishes 
that by letting the IC float above ground if needed,but removing any rf voltage
which might appear across the IC leads. It is also possible to generate the 
Touchtone tones with separate oscillators or with IC oscillators (such as the 
NE566), as is done in pads sold by Data Engineering. This system may not be 
as stable or accurate as other systems, though. 
     One of the problems with any current IC is that the frequency changes 
if rf gets near it. Many hams are having a hard time mounting such IC pads 
on their 2-meter Handie-Talkies. But a solution seems in sight - Mostek, a 
large IC company, is coming out with an IC Touchtone generator which has cheap 
3.58 MHz external crystal as reference, and then produces the tone frequencies 
by dividing the 3.58 MHz down with flip flops to get the required tone frequen-
cies. This approach not only promises to be more reliable in the presence of 
rf, but should also be cheaper since it would not need the custom (and expen- 
sive) laser trimming of components that the Microsystems International IC 
needs to adjust the frequencies within tolerence. 
     At the other end of the telephone circuit, in the CO, various circuits 
are used to decode the digit you dial into the appropriate signals needed to 
perform the actual connection. In dial systems, this decoding is done by relay 
circuits, such as steppers. This circuitry is designed for dialing at the rate 
of of 10 pulses per second, with a duty cycle of about 60% open, 40% closed. 
The minimum time between digits is about 600 milliseconds, although a slightly 
greater time between digits is safer since it avoids errors. In practice, 
many COs will accept dialing at substantially slower or faster rates, and often
you will see a dial that has been speeded up by changing the mechanical gov- 
ernor to operate almost twice as fast; it depends on the type of CO equipment. 
     Touchtone decoding is usually done by filter circuits which separate out 
the Touchtone tones by filters and then use a transistor circuit to operate 
a relay. A common decoder is the 247B, which is designed for use in small 
dial switchboard systems of the type that would be installed on the premises 
of a business for local communication between extensions. It consists of a 
limiter amplifier, seven filters and relay drivers (one for each of the seven 
tones commonly used) and some timing and checking circuitry. Each of the seven 
relays has multiple contacts, which are then connected in various serial/par- 
allel combinations to provide a grounding of one of ten output contacts, when a
digit is received. The standard 247B does not recognize the * and # digits, 
but can be modified easily enough if you have the unit diagram. 
     The 247B decoder is not very selective, and can easily be triggered by 
voice unless some additional timing circuits are connected at the output to 
require that the relay closure exceed some minimum time interval before it is 
accepted. Slightly more complicated decoders which have the time delays built 
in are the A3-type and the C-type Touchtone receivers. Both of these are used 
in customer-owned automatic switchboards when a caller from the outside (via 
the telephone company) wants to be able to dial directly into the private 
switchboard to call a specific extension. The C-type unit is similar to the 
247B in that it has ten outputs one for each digit. The A3-type does not have 
output relays, but instead has seven voltage outputs, one for each of the 
seven basic tones, for activating external 48-volt relays. The A-3 unit is 
ideal for activating a Touchtone encoder, which can then be used to regenerate 
the touchtone digits if the original input is noisy. This might be very useful 
in a repeater autopatch, for cleaning up Touchtone digits before they are 
sent to the telephone system. 
     In addition to the above,there are probably other types of units specially
designed for use in the CO, but information on these is not readily available. 
It is also fairly easy to build a Touchtone decoder from scratch. Though the 
standard telephone company decoders all use filter circuits, it is much easier 
(though perhaps not as reliable) to use NE567 phase-locked-loop integrated 
circuits. 
     An interesting sidelight to Touchtone operation is that it greatly speeds 
up the process of placing a call. With a Touchtone dial it is possible to 
dial a call perhaps 3 to 5 times faster than with a rotary dial. Since the 
CO equipment which receives and decodes the number is only needed on your line 
during the dialing time, this means that this equipment can be switched off 
your line sooner and can therefore handle more calls. In fact, the entire 
Touchtone system was invented so that CO operation would be streamlined and 
less equipment would be needed for handling calls. It is ironic that the cus- 
tomer should be charged extra for a service which not only costs the telephone 
company nothing, but even saves it money. 
     Another practice which may or may not cost the telephone company money 
is the connection of privately-owned extension phones. You have probably seen 
these sold by mail order houses and local stores. The telephone companies 
claim that connecting these phones to their lines robs them of revenue and 
also may cause damage to their equipment. There are others, of course, that 
hold the opinion that the easy availability of extensions only causes people 
to make more calls since they are more convenient, and that the companies 
really benefit from such use. The question of damage to equipment is also not 
easily answered, since most of the extension phones are directly compatible, 
and in many cases the same type as the telephone company itself uses. Be that 
as it may, this may be a good time to discuss such use. 
     Prior to an FCC decision on telephone company interconnection in the 
Caterphone case in 1968, all telephone companies claimed that the connection 
of any equipment to their lines was illegal. This was a slight misstatement 
as no specific laws against such use were on the books. Instead, each local 
telephone company had to file a tariff with the public service commission 
in that state, and one of the provisions of that tariff was that no connection 
of any external equipment was allowed. By its approval of that tariff, the 
public service commission gave a sort of implicit legal status to the 
prohibition. 
     In the Caterphone case, however, the FCC ruled that the connection of 
outside equipment had to be allowed. The phone companies then relaxed their 
tariff wording such that the connection of outside equipment was allowed if 
this connection was through a connecting arrangement 'provided by the telephone
company' for the purpose of protecting its equipment from damage. Although 
this result has been challenged in several states, that seems to be the present
status. The strange thing is that some telephone companies allow intercon- 
nection of customer equipment without any hassle whatsoever, while others 
really make things difficult for the customer. 
 
                                             ...WHIPPLE 
 
                                          (and Safe Cracker) 
 
 
The End