385 lines
18 KiB
Plaintext
385 lines
18 KiB
Plaintext
File: BASIC TELCOM V
|
||
|
||
*******BIOC Agent 003's course in******
|
||
* *
|
||
* ========================== *
|
||
* =BASIC TELECOMMUNICATIONS= *
|
||
* ========================== *
|
||
* PART V *
|
||
***************************************
|
||
|
||
Revised: 08-AUG-84
|
||
|
||
PREFACE:
|
||
|
||
Previous installments of this series here focused on telephony from a Network
|
||
point-of-view. Part V will deal with telephone electronics focusing primarily
|
||
on the subscriber's telephone. Hereinafter simply referred to as "fone."
|
||
|
||
Wiring:
|
||
-------
|
||
|
||
Assuming a standard one-line fone, there are usually 4 wires that lead out of
|
||
the fone set. These are standardly colored red, green, yellow, & black. The
|
||
red & green wires are the two that are actually hooked up to your CO. The
|
||
yellow wire is sometimes used to ring different fones on a party line (ie, one
|
||
#, several families--found primarily in rural areas where they pay less for the
|
||
service and they don't use the fone as much); otherwise, the yellow is usually
|
||
just ignored. On some two-line fones, the red & green wires are used for the
|
||
first fone # and the yellow & black are used for the second line. In this case
|
||
there must be an internal or external device that switches between the two
|
||
lines and provides a hold function. (Such as Radio Shack's outrageously priced
|
||
2 line & hold module).
|
||
|
||
In telephony, the green & red wires are often referred to as tip (T) & ring
|
||
(R), respectively. The tip is the more positive of the two wires. This naming
|
||
goes back to the old operator cord boards where one of the wires was the tip of
|
||
the plug and the other was the ring (of the barrel).
|
||
|
||
A rotary fone (aka dial or pulse) will work fine regardless of whether the red
|
||
(or green) wire is connected the tip(+) or ring(-). A touch-tone (TM) fone is
|
||
a different story, though. It will not work except if the tip(+) is the green
|
||
wire. [Although, some of the more expensive DTMF fones do have a bridge
|
||
rectifier which compensates for polarity reversal.] This is why under certain
|
||
(non-digital) switching equipment you can reverse the red & green wires on a
|
||
touch-tone fone and receive free DTMF service. Even though it won't break dial
|
||
tone, reversing the wires on a rotary line on a digital switch will cause the
|
||
tones to be generarted.
|
||
|
||
Voltages, Etc.
|
||
--------------
|
||
|
||
When your telephone is on-hook (ie, hung up) there is approximately 48 volts of
|
||
DC potential across the tip & ring. When the handset of a fone is lifted a few
|
||
switches close which cause a loop to be connected (known as the "local loop")
|
||
between your fone & the CO. Once this happens DC current is able to flow
|
||
through the fone with less resistance. This causes a relay to energize which
|
||
causes other CO equipment to realize that you want service. Eventually, you
|
||
should end up with a dial tone. This also causes the 48 VDC to drop down into
|
||
the vicinity of 12 volts. The resistance of the loop also drops below the 2500
|
||
ohm level, though FCC licensed telephone equipment must have an off-hook
|
||
impedance of 600 ohms. As of now, you ahands of our "friends" at D&B. To say
|
||
the least, they weren't exactly thrilled about it. In fact, they did not
|
||
even believe that they had a security problem! (Well, that just goes
|
||
to prove that if you are good, no one knows that you are there!)
|
||
|
||
In a big effort to defeat us, they called in an outside service to
|
||
spruce up their "security." Well, fortunately for us, we were able to
|
||
find out about the new system! (Which wasn't really a problem. First,
|
||
they had the new dial-ups when you logged on, and as always they have a
|
||
nice little place on Telenet! (Where we do most of our work: C 20188).
|
||
|
||
Now, they have set up a new system they like to call DunsNet.
|
||
They are trying to pass it off as a ectionately call this mute a black box.
|
||
|
||
the following are instructions on how to build a simple black box. Of course,
|
||
anything that prevents the voltage from dropping would work.
|
||
|
||
You only need two parts: A SPST toggle switch and a 10,000 ohm (10 K), 1/2
|
||
watt resistor. Any electronics store should stock these parts.
|
||
|
||
Now, cut 2 pieces of wire (about 6 inches long) and attach one end of each wire
|
||
to one of the terminals on the switch. Now turn your K500 (standard desk fone)
|
||
upside down and take off the cover. Locate wire (disconnect it from its
|
||
terminal). Now bring the switch out the rear of the fone and replace the
|
||
cover.
|
||
|
||
Put the switch in a position where you receive a dial tone. Mark this position
|
||
NORMAL. Mark the other side FREE.
|
||
|
||
When your phriends call (at a prearranged time), quickly lift & drop the
|
||
receiver as fast a possible. This will stop the ringing (do it again if it
|
||
doesn't) with out starting the billing. It is important that you do
|
||
it quickly (less than 1 second). Then put the switch in the FREE position and
|
||
pick up the fone. Keep all calls short and preferrably under 15 minutes.
|
||
|
||
NOTE: If someone picks up an extension in the called parties house and
|
||
that fone is not set for FREE then billing will start.
|
||
|
||
NOTE: An old way of signalling a phriend that you are about to call is making
|
||
a collect call to a non-existant person in the house. Since your friend
|
||
will not accept the charges, he will know that you are about to call
|
||
and thus prepare the black box (or visa versa).
|
||
|
||
WARNING: The Telco can detect black boxes if they suspect one on your line.
|
||
This is done due to the presence of AC voice signal at the wrong DC
|
||
level!
|
||
|
||
Pictoral Diagram:
|
||
(Standard Rotary K500 fone)
|
||
---------------------------------------
|
||
! !
|
||
***BLUE WIRE**>>F< !
|
||
! * * !
|
||
**WHITE WIRE** * !
|
||
! * !
|
||
! RESISTOR !
|
||
! * !
|
||
! * !
|
||
! >RR<*******SWITCH**** !
|
||
! * !
|
||
****GREEN WIRE********************** !
|
||
! !
|
||
---------------------------------------
|
||
|
||
NOTE: The Black Box will not work under ESS or other similar digital switches
|
||
since ESS does not connect the voice circuits until the fone is picked
|
||
up (& billing starts). Instead, ESS uses an "artificial" computer
|
||
generated ring.
|
||
|
||
Ringing:
|
||
--------
|
||
|
||
To inform a subscriber of an incoming call, the Telco sends 90 volts (PK) of
|
||
pulsing DC down the line (at around 15 to 60 Hz; usually 20 Hz). In most fones
|
||
this causes a metal armature to be attracted alternately between two
|
||
electro-magnets thus striking 2 bells. of course, the standard bell (patented
|
||
in 1878 by Tom A. Watson) can be replaced by a more modern electronic bell or
|
||
signaling device.
|
||
|
||
Also, you can have lights and other similar devices in lieu of (or in
|
||
conjunction with) the bell. A simple neon light (with its corresponding
|
||
resistor) can simply be connected between the red & green wires (usually L1 &
|
||
L2 on the network box) so that it lights up on incoming calls.
|
||
|
||
WARNING: 90 VDC can give quite a shock. Exercise extreme caution if you wish
|
||
to further persue these topics.
|
||
|
||
Also included in the ringing circuit is a capacitor tbig savings of time since
|
||
the hassle of using a a time shared public network does not exist. We're
|
||
sure that Mr. J.W.P. of DUNSPRINT had more on his mind when he wrote the
|
||
letter (on the system)! DunsNet is accessible from a regular dial-up. We
|
||
have not been able to get a number yet for this system, but once on it
|
||
allegedly works just like Telenet! Two carriage returns and you will see
|
||
"DunsNet" then the familiar "@" symbol. To use the system like we showed
|
||
you, type "RPTS" at thiup to drop a trouble card for long periods of ringing
|
||
then a "no-no" detection device may be placed on the line.
|
||
|
||
Incidentally, the term "ring trip" refers to the CO process involved to stop
|
||
the AC ringing signal when the calling fone goes off hook.
|
||
|
||
NOTE: It is suggested that you actually dissect fones to help you better
|
||
understand them. It will also help you to better understand the concepts
|
||
here if you actually prove them to yourself. For example, actually
|
||
take the voltage readings on your fone line [any simple
|
||
multi-tester (a must) will do.] Phreaking is an interactive
|
||
process not a passive one!
|
||
|
||
Dialing:
|
||
--------
|
||
|
||
On a standard fone, there are two common types of dialing: pulse & DTMF. Of
|
||
course, some people insist upon being different and don't use the DT thus
|
||
leaving them with MF (Multi Frequncy, aka operator, blue box) tones. This is
|
||
another "no-no" and the Telco Security gentelmen have a special knack for
|
||
dealing with such "phreaks" on the network.
|
||
|
||
When you dial rotary, you are actually rapidly breaking & reconnecting
|
||
(breaking & making) the local loop once for each digit dialed. Since the
|
||
physical connection must be broken, you cannot dial if another extension (of
|
||
that #) is off-hook. Neither of the fones will be able to dial pulse unless
|
||
the other hangs up.
|
||
|
||
Another term often referred to in telephone electronics is the break ratio. In
|
||
the US, the standard is 10 pulses per second. When the circuit is opened it is
|
||
called the break interval. When it is closed it is called the make interval.
|
||
In the US, there is a 60 millisecond (ms) make period and a 40 ms break period.
|
||
(60+40=100 ms = 1/10 second). This is referred to as a 60% make interval.
|
||
Some of the more sophisticated electronic fones can switch between a 60% & a
|
||
67% make interval. This is due to the fact that many foreign nations use a 67%
|
||
break interval.
|
||
|
||
Have you ever been in an office or a similar facility and saw a fone waiting
|
||
to be used for a free call but some asshole put a lock on it to prevent
|
||
outgoing calls?
|
||
|
||
Well, don't fret phellow phreaks, you can simulate pulse dialing by rapidly
|
||
depressing the switchook. (If you depress it for longer than a second it will
|
||
be construed as a disconnect.) By rapidly switchooking you are causing the
|
||
local loop to be broken & made similar to rotary dialing! Thus if you can
|
||
manage to switchook rapidly 10 times you can reach an operator to place any
|
||
call you want! This takes alot of practice, though. You might want to
|
||
practice on your own fone dialing a friend's # or something else. Incidentally,
|
||
this method will also work with DTMF fones since all DTMF lines can also handle
|
||
rotary.
|
||
|
||
Another problem with pulse dialing is that it produces high-voltage spikes that
|
||
make loud clicks in the earpiece and cause the bell to "tinkle." If you never
|
||
noticed this then your fone has a special "anti-tinkle" & earpiece shorting
|
||
circuit (most do). If you have ever dissected a rotary fone (a must for any
|
||
serious phreak) you would have noticed that there are 2 sets of contact that
|
||
open and close during pulsing (on the back of the rotary dial under the plastic
|
||
cover). One of these actually opens and closes the loop while the other mutes
|
||
the earpiece by shorting it out. The second contacts also activates a special
|
||
anti-tinkle circuit that puts a 340 ohm resistor across the ringing circuit
|
||
which prevents the high voltage spikes from interferring with the bell.
|
||
|
||
Dual Tone Multi Frequency (DTMF) is a modern day improvement on pulse dialing
|
||
in several ways. First of all, it is more convenient for the user since it
|
||
is faster and can be used for signaling after the call is completed (ie, SCC's,
|
||
computers, etc.). Also, it is more up to par with modern day switching
|
||
equipment (such as ESS) since pulse dialing was designed to actually move
|
||
relays by the number of digits dialed (in SxS offices).
|
||
|
||
Each key on a DTMF keypad produces 2 frequencies simultaneously (one from the
|
||
high group and another from the low group).
|
||
|
||
-------------------------
|
||
Low Group ! Q ! ABC ! DEF ! !
|
||
697 Hz-! 1 ! 2 ! 3 ! A !
|
||
! ! ! ! !
|
||
!-----!-----!-----!-----!
|
||
! GHI ! JKL ! MNO ! !
|
||
770 Hz-! 4 ! 5 ! 6 ! B !
|
||
! ! ! ! !
|
||
!-----!-----!-----!-----!
|
||
! PRS ! TUV ! WXY ! !
|
||
852 Hz-! 7 ! 8 ! 9 ! C !
|
||
! ! ! ! !
|
||
!-----!-----!-----!-----!
|
||
! ! OPER! ! !
|
||
941 Hz-! * ! 0 ! # ! D !
|
||
! ! Z ! ! !
|
||
!-----!-----!-----!-----!
|
||
1209 1336 1477 1633
|
||
(High Group--in Hz)
|
||
|
||
A portable DTMF keypad is known as a white box.
|
||
|
||
The fourth column (1633 Hz) is not normally found on regular fones but it
|
||
does have several special uses. For one, it is used to designate the priority
|
||
of calls on AUTOVON, the military fone network. These key are called: Flash,
|
||
Immediate, Priority, & Routine (with variations) instead of ABCD. Secondly,
|
||
these keys are used for testing purposes by the Telco. In some area you can
|
||
find loops as well as other neat tests (see Part II) on the 555-1212 directory
|
||
assistance exchange. For this, you would call up an DA in certain areas [that
|
||
have an Automatic Call Distributor (ACD)] and hold down the "D" key which
|
||
should blow the operator off. You will then hear a pulsing dial tone which
|
||
indicates that you are in the ACD internal testing mode. You can get on one
|
||
side of a loop by dialing a 6. The other side is 7. Some phreaks claim that
|
||
if the person on side 6 hangs up, occasionally the equipment will screw up and
|
||
start directing directory assistance calls to the other side of the loop.
|
||
Another alleged test is called REMOB which allows you to tap into lines by
|
||
entering a special code followed by the 7 digit number you want to monitor.
|
||
Then there is the possibility of mass conferencing.
|
||
|
||
ACD's are become rare though. You will probably have to make several NPA-555-
|
||
1212 calls before you find one.
|
||
|
||
You can modify regular fones quite readily so that they have a switch to change
|
||
between the 3rd and 4th columns. This is called a silver box (aka grey box) and
|
||
plans can be found in Tap as well as on many BBS's.
|
||
|
||
Transmitter/Receiver:
|
||
---------------------
|
||
|
||
When you talk into the transmitter, the sound waves from your voice cause a
|
||
diaphragm to vibrate and press against the carbon granules (or another similar
|
||
substance). This causes the carbon granules to compress and contract thus
|
||
changing the resistance of the DC coupled path through it. Therefore, your AC
|
||
voice signal is superimposed over the DC current of the local loop. The
|
||
receiver works in a similar fashion where the simple types utilize a
|
||
magnet, armature, & diaphragm.
|
||
|
||
Hybrid/Induction Coil:
|
||
----------------------
|
||
|
||
As you may have noticed, there are two wires for the receiver and two for the
|
||
transmitter in the fone, yet the local loop consists of 2 wires instead of 4.
|
||
This 4-wire to 2-wire conversion is done inside the fone by a device known as
|
||
an induction coil which uses coupling transformers. All of the internal Telco
|
||
trunks also use 4 wires. It is only the local loop that uses 2 since it is
|
||
cheaper. A device in the CO known as a hybrid converts between 4 and 2 wire
|
||
set-ups similar to the induction coil inside the fone. Special data
|
||
transmission lines require extremely low signal to noise ratios, they require
|
||
the full four wires--two for transmission and two for receiving (even on the
|
||
local loop).
|
||
|
||
Miscellaneous:
|
||
--------------
|
||
|
||
In the telephone, there is also a balancing network consisting of a few
|
||
capacitors & resistors which provide sidetone. Sidetone allows the caller to
|
||
hear his own volume in the receiver. He can then adjust his voice accordingly.
|
||
This prevents people from shouting or speaking too softly without noticing it.
|
||
|
||
Hold:
|
||
|
||
When a telephone goes off hook, the resistance drops below 2500 ohms. At this
|
||
point, the Telco will send a dial tone. To put someone on hold you must put a
|
||
1000 ohm resistor (1 watt) across the Tip & Ring before it reaches the
|
||
switchook. In this way, when the fone is hung up (for hold) the resistance
|
||
remains below 2500 ohms which causes the CO to believe that you are still
|
||
off-hook. You can build a simple hold device using the following pictoral
|
||
diagram:
|
||
/
|
||
(RED) O-------------------------/
|
||
[L1] ! ! !
|
||
! ! !
|
||
1000 Ohm ! !
|
||
Resistor Ringing !
|
||
! Circuit !
|
||
! ! !
|
||
/ ! Switch-
|
||
/ SPST Switch ! Hook
|
||
! ! !
|
||
! ! !
|
||
! ! !/
|
||
(GREEN) O------------------------/
|
||
[L2]
|
||
--> To Rest of
|
||
Fone
|
||
|
||
This hold device is only effective if you also hang up the fone. To make a
|
||
hold/mute switch, simple connect a wire in place of the 1K resistor to effect a
|
||
short circuit (who cares if you damage CO equipment?).
|
||
|
||
Conclusion:
|
||
-----------
|
||
|
||
NOTE: Many of the electronics components of normal fones (K500) are enclosed
|
||
in the network box (which shouldn't be opened).
|
||
|
||
I have assumed that the reader has a basic knowledge of electronics. Also,
|
||
I have assumed that you have read the 4 previous installments of this series
|
||
(and hopefully enjoyed them).
|
||
|
||
In part VI, we will take a look at fortress fones.
|
||
|
||
Suggested Further Reading:
|
||
--------------------------
|
||
|
||
Electronics Courses A-D, TAP, @ $.75 each.
|
||
|
||
Electronic Telephone Projects, A.J. Caristi, Howard Sams Books.
|
||
|
||
Everything you Always Wanted to Know About 1633 Hz Tones but Were Afraid to
|
||
Ask, The Magician, TAP, issue #62.
|
||
|
||
Free BELL phone calls, TAP, Fact sheet #2, @ $.50.
|
||
|
||
Free GTE phone calls, TAP, Fact sheet #3, @ $.50.
|
||
|
||
How to modify your Bell Touch Tone Fone to..
|
||
|
||
TAP/Room 603/147 W 42 St./New York, NY 10036. Please specify by backissue
|
||
#'s (not article names). All back-issues are $1 each. Subscriptions are
|
||
$10/year (10 issues). Say that BIOC Agent 003 sent you.
|
||
|
||
Another good phreak publication:
|
||
|
||
2600/Box 752/Middle Island, NY 11953. Subscriptions are $10/year. Backissues
|
||
are $1 each.
|
||
|
||
Excelsior,
|
||
|
||
*****BIOC (P) 1984 BIOC
|
||
*=$=*Agent International
|
||
*****003
|
||
|
||
July 18, 1984
|
||
|
||
<<=-FARGO 4A-=>>
|
||
|
||
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open
|
||
|