377 lines
22 KiB
Plaintext
377 lines
22 KiB
Plaintext
2600260026002600260026002600260026002600260026002600260026002600260026002600
|
||
2600 2600
|
||
2600 Excerpts from Various Issues of 2600 Magazine 2600
|
||
2600 2600
|
||
2600 Brought to you by: The Fixer 2600
|
||
2600 2600
|
||
2600 Call: The Private Sector 201-366-4431 2600
|
||
2600 The Metal AE 201-879-6668 2600
|
||
2600 BC Tel Phone Mart 604-658-1586 2600
|
||
2600 Tommy's Holiday Camp 604-595-0085 2600
|
||
2600 The Neutral Zone BBS/AE (it's BACK!!) 604-478-1363 2600
|
||
2600 2600
|
||
2600260026002600260026002600260026002600260026002600260026002600260026002600
|
||
|
||
|
||
A note before I get on with it: This file is for those of you who, for whatever
|
||
reason, do not or have not read 2600 magazine. This issue of this file covers
|
||
the best short articles from September 1985 to August 1986.
|
||
Anyways, why bother waiting for me to type this stuff up? Why not do as I do
|
||
and get a subscription? All you have to do is send $12 to 2600, Box 752,
|
||
Middle Island NY 11953-0752. Call them voice at 516-751-2600 or call the 2600
|
||
BBS, THE PRIVATE SECTOR, at 201-366-4431. The things they need most are money
|
||
and articles, they can get money by more subscribers but they need YOU to write
|
||
GOOD articles on hacking, phreaking, etcetera in order to keep going.
|
||
|
||
2600260026002600260026002600260026002600260026002600260026002600260026002600
|
||
|
||
::::August 1985::::
|
||
-------------------------------------------------------------------------------
|
||
|
||
2600 A Hacking Victim...
|
||
|
||
When we received our June SBS Skyline bill, we were a bit surprised. Over six
|
||
hundred dollars of it came from calls we never made. But what's really
|
||
interesting is the way that the Skyline people handled it. In early June, we
|
||
got a call telling us that their sophisticated equipment detected hackers
|
||
trying to guess a code by scanning numerically. They said our code would soon
|
||
be discovered, so they were going to give us a new one, with two extra digits
|
||
added. They did this and that very day our old code was inactivated. The
|
||
illegal calls had occurred BEFORE that day, and we figure Skyline must have
|
||
known this. Maybe they thought that 2600, in our corporate clumsiness, would
|
||
pay a huge bill without investigation. Many big companies would. Gotta give
|
||
them credit for trying.
|
||
When we called up about it, they didn't want to handleit over the phone! "Send
|
||
the bill through the mail," they said. Mark the calls you made and we'll
|
||
deduct the rest." Why are phone companies so afraid to do things over the
|
||
phone?
|
||
As long as Skyline decided to give the "perpetrators" some extra time before
|
||
the investigation starts, we figure we might as well lend a hand too. Our old
|
||
code was 880099. We loved that code and are very upset at losing it. Our new
|
||
eight digit one is very difficult to remember and nowhere near as fun.
|
||
And one last note about those new eight digit numbers. Phone phreaks have
|
||
ALREADY figured out a way around them. If you dial the first six digits of an
|
||
eight digit code, then the ten digit phone number and hit a # key, you'll get
|
||
your tone back! That means there are only a hundred possible codes since there
|
||
are only two more digits to figure out and one of them DEFINITELY works! If
|
||
you enter six digits that are not part of an eight digit code, and then a ten
|
||
digit phone number, you'll get an error message immediately or that fake
|
||
carrier tone Skyline loves to send out. That tone, incidentally, is for you
|
||
hackers with Apples and Commodores that scan all night long looking for the
|
||
code that will get you through to a number that responds with a carrier tone.
|
||
In the morning, you see how many carrier detects you got and which codes got
|
||
them for you. Skyline's idea is that if EVERY invalid code gives a hacker a
|
||
carrier tone, there is no way for a computer to separate the good codes from
|
||
the bad ones. Come on! How about setting your computer to dial a NON-carrier
|
||
and telling it to print out only those codes that DIDN'T get a carrier tone?
|
||
And there are probably a hundred more ways. Big corporations can be SO much
|
||
fun.
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
::::September 1985::::
|
||
|
||
Reaching Out On Your Own
|
||
by Forest Ranger
|
||
|
||
Verification is a very touchy subject. The telephone company wants to keep
|
||
verification secret from anyone beyond telco employees. But as phone phreaks
|
||
should know that is quite impossible. There are two types of operators that do
|
||
verifications. "0" (TSPS) for local verifications and IO (INWARD) operators
|
||
for verifications beyond your NPA. They use their operator console, but other
|
||
people use blue boxes.
|
||
|
||
KP:NPA+0+XX+NPA+XXX+XXXX:ST
|
||
|
||
The first NPA (area code) is yours and the 0 will get you on your TSPS
|
||
operator lines. The next XX part is an area identifier. They are 00,11,22,
|
||
33,44,55,66,77,88,99. There are ten possible choices depending on which area
|
||
you are in. For example, blue box verification for Michigan would be
|
||
KP:313+0+66+NPA+XXX+XXXX:ST. The second NPA is the NPA of the number you are
|
||
going to verify. The XXX+XXXX part is the rest of the number you are going to
|
||
verify.
|
||
Once you have routed your verification you will receive a series of clicks
|
||
(tandems stacking), the you will hear a beep and you will be on the line.
|
||
You won't understand what anyone is saying because everything is scrambled.
|
||
The verification will last about thirty seconds. Then you will be beeped out
|
||
and finally disconnected.
|
||
Federal laws regarding line listening have become much stronger - especially
|
||
after 1974 when a subcommittee of the House of Representatives held a public
|
||
hearing called "Telephone Monitoring Practices by Federal Agencies". At this
|
||
hearing it was discovered that Bell had listened in to lines of their employees
|
||
and had the power to listen in on anyone. This shocked many people and made
|
||
federal laws concerning such activity much stronger. My point is don't abuse
|
||
this verification, because all you need is a simple descrambler from Radio
|
||
Shack to descramble the conversation on the line.
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
::::November 1985::::
|
||
|
||
The History of ESS
|
||
by Lex Luthor
|
||
|
||
Of all the new 1960's wonders of telephone technology - satellites,
|
||
ultra-modern Traffic Service Positions (TSPS) for operators, the picturephone,
|
||
and so on - the one that gave Bell Labs the most trouble was, and unexpectedly
|
||
became the greatest development effort in Bell System's history, was the
|
||
perfection of an electronic switching system, or ESS. ESS should be well known
|
||
to many a technical enthusiast. It is known as the big brother of the phone
|
||
system, capable of controlling almost all aspects of any phone call and keeping
|
||
track of calling patterns. How ESS works and what it is capable of has been
|
||
covered previously in 2600 (February, 1984) and will be covered in future
|
||
issues.
|
||
It may be recalled that such a system was the specific end in view when the
|
||
project that had culminated in the invention of the transistor had been
|
||
launched back in the 1930's. After successful accomplishment of that planned
|
||
miracle in 1947-48, further delays were brought about by financial strategy and
|
||
the need for further development of the transistor itself. In the early
|
||
1950's, a Labs team began serious work on electronic switching. As early as
|
||
1955, Western Electric became involved when five engineers from the Hawthorne
|
||
works were assigned to collaborate with the Labs on the project. The
|
||
president of AT&T in 1956 wrote confidently, "At Bell Labs, development of the
|
||
new electronic switching system is going full speed ahead. We are sure this
|
||
will lead to many improvements in service and also to greater efficiency. The
|
||
first trial will start in Morris, Illinois in 1959.". Shortly thereafter,
|
||
Kappel said that the cost of the whole project would probably be $45 million.
|
||
But it gradually became apparent that the development of a commercially usable
|
||
electronic switching system - in effect, a computerized telephone
|
||
exchange - presented vastly greater technical problems than had been
|
||
anticipated, and that, accordingly, Bell Labs had vastly underestimated both
|
||
the time and the investment needed to do the job. The year 1959 passed without
|
||
the promised first trial at Morris, Illinois; it was finally made in November
|
||
1960, and quickly showed how much more work remained to be done. As time
|
||
dragged on and costs mounted, there was concern at AT&T and something
|
||
approaching panic at Bell Labs. But the project had to go forward; by this
|
||
time the investment was too great to be sacrificed, and in any case, forward
|
||
projections of increased demand for telephone service indicated that within a
|
||
few years a time would come when, without the quantum leap in speed and
|
||
flexibility that electronic switching would provide, the national network would
|
||
be unable to meet the demand. In November 1963, an all-electronic switching
|
||
system went into use at the Brown Engineering Company at Cocoa Beach, Florida.
|
||
But this was a small installation, essentially another test installation,
|
||
serving only a single company. Kappel's tone on the subject in the 1964 annual
|
||
report was almost apologetic: "Electronic switching equipment must be
|
||
manufactured in volume to unprecedented standards of reliability...To turn out
|
||
the equipment economically and with good speed, mass production methods must
|
||
be developed; but, at the same time, there can be no loss in precision...."
|
||
Another year and millions of dollars later, on May 30, 1965, the first
|
||
commercial electronic central office was put into service at Succasunna, New
|
||
Jersey.
|
||
Even at Succasunna, only 200 of the town's 4300 subscribers initially had the
|
||
benefit of electronic switching's added speed and additional services, such as
|
||
provision for three party conversations and automatic trasnfer of incoming
|
||
calls. But after that, ESS was on its way. In January 1966, the second
|
||
commercial installation, this one serving 2900 telephones, went into service in
|
||
Chase, Maryland. By the end of 1967 there were additional ESS offices in
|
||
California, Connecticut, Minnesota, Georgia, New York, Florida, and
|
||
Pennsylvania; by the end of 1970 there were 120 offices serving 1.8 million
|
||
customers; and by 1974 there were 475 offices serving 5.6 million customers.
|
||
The difference between conventional switching and electronic switching is the
|
||
difference between "Hardware" and "Software"; in the former case, maintenance
|
||
is done on the spot, with screwdriver and pliers, while in the case of
|
||
electronic switching, it can be done remotely, by computer, from a central
|
||
point, making it possible to have only one or two technicians on duty at a time
|
||
at each switching center.
|
||
The development program, when the final figures were added up, was found to
|
||
have required a staggering four thousand man-years of work at Bell Labs and to
|
||
have cost not $45 million but $500 million!
|
||
|
||
|
||
|
||
|
||
|
||
Dear 2600:
|
||
|
||
Is it true that Blue Boxing is on the way out? I hear it has something to
|
||
do with CCIS. What exactly is this and why is it so troublesome to phreaks?
|
||
|
||
Worried Phreak
|
||
|
||
|
||
Dear Worried:
|
||
|
||
Blue Boxes are indeed a dwindling resource. But there's no need to throw
|
||
them out yet. They aren't going to be totally useless for quite some time.
|
||
Basically, AT&T is converting to CCIS trunks. These don't allow boxing.
|
||
In-band signaling is the only kind of trunk sugnaling that supports boxing.
|
||
It is by far the most prevalent at the moment. Basically, in-band uses a 2600
|
||
hertz tone to indicate that a trunk is idle, and thus can accept routing
|
||
instructions from an "outsider".
|
||
To box a call, the criminal blasts 2600 down the line after making a long
|
||
distance call. The line thinks it's idle and waits for routing instructions.
|
||
Now the criminal puts a KP tone and a ST tone around the number that he's
|
||
trying to get through to. These comprise the routing instructions. Thus, the
|
||
line thinks it's idle, then it receives the routing instructions, and routes
|
||
the call to whereever the person sent it. Now, his central office (CO) which
|
||
does all the billing still thinks he is making the call to wherever, so it
|
||
keeps billing him at that rate. If it happens to think he was making a
|
||
toll-free call, it won't bill him at all!
|
||
Another form of signaling is out of band. This uses control tones out of
|
||
the normal band of telephoone transmission (approximately 800 hertz to 3000
|
||
hertz). The idle tone is 3200, others shifted upward as well. So why couldn't
|
||
you make a new box? Don't forget, it's out of band. These tones aren't in
|
||
normal transmission, so the local CO and customer interface loop just don't
|
||
bother to transmit them. You can blast all the 3200 you want - it won't go
|
||
through the CO to the trunk. But this is not the "death of boxing" as it has
|
||
several disadvantages to the telco too numerous to mention.
|
||
The real death of boxing lies in Common Channel Interoffice Signaling
|
||
(CCIS). This is a direct connect data line going from one ESS switcher to
|
||
another at speeds up to 4.8 kB (usually 1.2) - incredible speeds. All
|
||
routing instructions are sent through these lines. It isn't looking for
|
||
control tones on the trunk; it's getting them elsewhere. This means that you
|
||
can blast 2600 hertz tones all you like. It won't make a difference because
|
||
the equipment is no longer listening for them. This kind of signaling is being
|
||
phased in all over the country. Look for one in your neighborhood.
|
||
Since CCIS has benefits for really high volume trunks, you can try looking
|
||
for long distance trunks to Canada, or rural states. These probably won't be
|
||
phased in for a long time, if at all. (Remember, very few companies just
|
||
invest in new technology for new tech's sake; even AT&T won't be able to do
|
||
this for long).
|
||
|
||
|
||
|
||
|
||
|
||
|
||
The Early Phreak Days
|
||
by Jim Wood
|
||
|
||
When I decided to get married back in 1962, I traded my DJ and broadcasting
|
||
odd jobs for one at the phone company; employment which, at the time, was
|
||
ultimately secure though my take-home pay was about $300 a month.
|
||
Assigned to the Palo Alto, California central office as a Toll
|
||
Transmissionman, my duties included maintenance of toll traffic circuits and
|
||
related short-haul N and ON carrier equipment. Circuit testing was initiated
|
||
at a black bakelite Type 17B Toll Testboard. A field of several hundred jacks
|
||
gave access to as many inter-office trunks, many to the San Jose 4A and
|
||
Oakland 4M 4-wire switching centers.
|
||
Though it was strictly forbidden, one could easily and safely "deadhead"
|
||
toll calls for one's self, family, or friends from the testboard. Around
|
||
Christmastime our office could easily have been confused with the Operator room
|
||
on the floor below.
|
||
The 17B testboard had a 0-9, DTMF keypad arranged in two rows of 5 buttons
|
||
wired to the central office "multifreq" supply. A rack of vacuum tube L/C
|
||
oscillators comprised the MF supply and was buried somewhere in the bowels of
|
||
the building.
|
||
Long days with too much (mostly union) staff and not enough to do
|
||
precipitated a lot of screwing around on the job. Some of these guys would
|
||
just daydream out the windows, others would hassle and torment the Operators
|
||
downstairs. One favorite trick was to sneak into the access space behind the
|
||
bank of 3C switchboards and push the cords slowly up towards the Operators.
|
||
The screams and commotion caused by a tip, ring, and sleeve "snake" was worth
|
||
the risk of getting chewed out by the old battleaxe who ran the place. Myself,
|
||
I just played with the Bell System; never with any intent to defraud, merely
|
||
to increase my understanding of how the whole thing worked.
|
||
It was a singularly dull day that I hit on the idea of "deadheading" calls
|
||
through one of the local subscriber loop jacks which rang into the testboard.
|
||
Sure enough, I could rotary-dial through the step office to Sacramento (the
|
||
shortest hop on L carrier with inband signalling), "dump" the call in
|
||
Sacramento with a blast of 2600 fromthe 19c oscillator mounted overhead, then
|
||
multifreq out of Sacramento anywhere I wanted to go. Wow! I could hardly wait
|
||
to demonstrate this potential source of lost revenues to my first-line
|
||
supervisor. Both he and his boss were mildly impressed, but assigned minimal
|
||
importance to the event, since, in their words, "no one has a multifreq supply
|
||
at home."
|
||
Ma Bell invented the transistor but was among the last to put it into
|
||
service. One of the few places a transistor was used was used in our office
|
||
was in the alarm circuit of the ON carrier system. The 13H was a wretched
|
||
little "top hat" PNP with just enough beta to work in a bridged-T oscillator
|
||
configuration. A half-dozen of these, some Olson Radio pushbuttons, and a
|
||
handful of resistors and caps made a dandy MF supply.
|
||
The next demonstration was from the Chief's own desk and did finally raise
|
||
some concern. I was asked to "donate" the box and told to keep the findings
|
||
strictly to myself. I have done so for 20 years now.
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
::::February 1986::::
|
||
|
||
It Could Happen To You!
|
||
|
||
A bizarre story is unfolding in New York City, one which typifies both
|
||
hacker ingenuity and corporate indifference to the average customer.
|
||
It all started when Hacker A met Hacker B on a loop somewhere. At first,
|
||
they got along quite well, exchanging all kinds of information. Over time,
|
||
however, Hacker B got more and more obsessed, while Hacker A wanted to get on
|
||
with a normal life. B would not stop calling A, which led A to tell B that if
|
||
he didn't stop bothering him, he would get the authorities on his case. Well,
|
||
B didn't and A did. And that's where the trouble really started.
|
||
For the last couple of years, almost every few minutes, A's phone has been
|
||
ringing. At the other end is B or someone or something that B has programmed.
|
||
Sometimes nothing is said; sometimes a threat is uttered; sometimes the caller
|
||
just laughs. A and his family have been trying, literally for years, to put an
|
||
end to this. At first they simply changed the number to an unlisted one.
|
||
Within an hour, B had found the new one. So they tried to change it again.
|
||
New York Telephone refused. Either they would have to pay an exorbitant fee
|
||
this time, or the number would not be changed. They said it was impossible for
|
||
somebody to find out their number so fast - he must have been told by somebody
|
||
in the family.
|
||
This scene was repeated a number of times, with A's family changing their
|
||
number practically a dozen times and having to pay the fee for most of them.
|
||
It reached the point where B would call them BEFORE they received their new
|
||
number to tell them what the new number would be.
|
||
This wasn't all. B had also managed to charge outrageous amounts to the
|
||
family's phone bill. He would call their answering machine collect on a long
|
||
distance trunk and make it sound to the operator as though he'd said "yes".
|
||
then he'd leave the connection open for hours. He also managed to place third
|
||
party calls, using their number as the billing number. Their bill was
|
||
outrageous and the phone company insisted that they were responsible for it.
|
||
Their service was disconnected and today they are slowly paying back the huge
|
||
debt.
|
||
Meanwhile, A has tried to get the authorities to look at B (whose address
|
||
and phone number he has), with only lukewarm interest. The FBI says it has
|
||
an eye on him, but won't help A deal with the phone company.
|
||
To this day it continues. The calls keep coming and A is powerless to do
|
||
anything. B knows the phone system like the back of his hand and he can make
|
||
it do almost anything. The phone company does not want to admit this and, on
|
||
many levels, isincapable of understanding it themselves. The result: an
|
||
innocent victim gets it from both ends.
|
||
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
::::May 1986::::
|
||
|
||
The SBS/Skyline Algorythm
|
||
by Nynex Phreak
|
||
|
||
SBS Skyline has one of the easiest methods of finding codes of all of the long
|
||
distance companies. It's very similar to the old Sprint bug which allowed
|
||
people to find codes very quickly, even without the use of a computer.
|
||
To see how this methodd works, access SBS Skyline at their equal access number
|
||
(950-1088). Enter six digits. These are the six digits you are "betting" on
|
||
to be part of a valid code. After the six digits, enter five other numbers
|
||
(it's not important what numbers they are). If you hear a ring immediately
|
||
after the last number, followed by "Message MS2", the six digits are part of
|
||
a valid code. If you don't hear a ring, hit the pound sign (#) key. If you
|
||
get your tone back, the six digits were not part of a valid code. You can try
|
||
a new six digit series without having to hang up and redial. This is what
|
||
makes this method so fantastically easy. (If you don't get your tone back
|
||
after hitting the pound sign and also don't get "Message MS2", chances are
|
||
you've stumbled across one of those SBS toll-free numbers. This might also be
|
||
the case if you get "Message MS2" before entering five additional numbers.)
|
||
After finding a working set of six digits, all that must be done is to
|
||
find the next one or two numbers of the code. Enter the six digit code,
|
||
followed by an additional one number to guess, followed by four random
|
||
digits. If it rings and gives "Message MS2", this is not the right guess.
|
||
You must hang up and redial Skyline for each unsuccessful attempt at this
|
||
point. If it doesn't ring, and you can get the tone back by hitting the pound
|
||
sign, you have found a seven digit code. If you try all the numbers from zero
|
||
to nine and they all give "Message MS2", then you have two digits to
|
||
guess--your six digits are actually part of an eight digit code. The same
|
||
method must be used, except your range is now from 00 to 99.
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
|
||
(>View:101 BCTEL TOLL SECURITY BUGS
|
||
|
||
|
||
(just kidding folks, I wish there WAS such a file...)
|
||
|
||
|
||
-=( The FIXER )=-
|
||
|
||
|
||
|