496 lines
26 KiB
Plaintext
496 lines
26 KiB
Plaintext
ELECTRONIC TOLL FRAUD DEVICES
|
|
|
|
BLUE BOXING
|
|
|
|
The following information applies primarily to the AT&T network. It is the
|
|
largest long distance carrier and has been around the longest; therefore, more
|
|
is known about its technical operation. The other carriers have their own
|
|
special weaknesses and are more easily breached using methods described in
|
|
another chapter.
|
|
|
|
What is a Blue Box?
|
|
|
|
The blue box is so named because that happened to be the color of the first one
|
|
found. A basic blue box contains 13 buttons or switches for the digits 0-9 plus
|
|
two control signals labeled "KP" and "ST". One of the buttons is used to
|
|
produce the **** Hz "disconnect" signal. Blue boxes are used to circumvent
|
|
telephone company billing equipment and make free calls to anywhere in the
|
|
world. It may be conncted directly to the phone line or acousticaly coupled to
|
|
the mouth piece of the handset. The signaling tones produced by the box may
|
|
also be recorded on a cassett tape for later playback. In spite of continuing
|
|
efforts to protect the system from fraudulent use, there has been a new wave of
|
|
blue boxing in recent years due to the advent of the personal computer and new
|
|
knowledge about "holes" in the integrity of the system. A phone preak can buy a
|
|
personal computer in a department store for less than $200.00. Armed with this
|
|
hardware and the right knowledge, he can make long distance calls including
|
|
overseas calls, set up interstate conferences with his friends that go on for
|
|
hours, call special operators who normally can be reached only by other
|
|
operators, and other "tricks"; all without charge. With the addition of a cheap
|
|
cassett recorder, he can become highly mobile and illusive.
|
|
|
|
Highly advanced and knowledgable phone prheaks are constantly probing the
|
|
system for flaws in its security. Their ability to call internal operators
|
|
gives them the power to pose as telephone company personel for the purpose of
|
|
gaining priviledged information about the system. It would be hard to estimate
|
|
how many calls from "Telephone Repair Service" or "Security" were actually
|
|
placed by phreaks doing experiments of their own or fishing for information.
|
|
|
|
How It Works
|
|
|
|
The most common form of signaling between toll offices uses a code derived from
|
|
six tones. This is refered to as multifrequency signaling or MF signaling. The
|
|
tones are played together two at a time to represent the digits 0 - 9. In
|
|
addition there are two special signals designated KP and ST. These are also
|
|
sent as dual tones. KP stands for key pulse. It is a gate opening signal which
|
|
tells the system that digits are to follow. ST means "start transit". It tells
|
|
the system that all digits have been sent. It is an end of transmission signal
|
|
and is a command to the system to start processing the information. The
|
|
principle is basicaly the same as that used for tone signaling with a push
|
|
button telephone except that the frequecies of the tones are different.
|
|
|
|
Table (X) shows the combinations of frequencies used in North America and on
|
|
CCITT Signaling System No. 5:
|
|
|
|
. Signal Frequency pair
|
|
. ------------------------------------
|
|
. KP1 (start-of-digit A + B
|
|
. transmission for a
|
|
. national call)
|
|
. KP2 (start-of-digit C + B
|
|
. transmission for an
|
|
. international call from
|
|
. an intermediate (transist) exchange)
|
|
. Digits: 1 E + D
|
|
. 2 E + A
|
|
. 3 D + A
|
|
. 4 E + C
|
|
. 5 D + C
|
|
. 6 A + C
|
|
. 7 E + F
|
|
. 8 D + F
|
|
. 9 A + F
|
|
. 0 C + F
|
|
. ST (End of digit F + B
|
|
. transmission)
|
|
|
|
The MF signals are sent over the normal voice channels. They may be sent by a
|
|
switchboard operator or by automatic equipment. On some systems the operator's
|
|
signaling is audible and sometimes the automatic signaling can be heard due to
|
|
cross talk between lines.
|
|
|
|
A **** Hz tone is transmitted continuously on all voice channels between toll
|
|
offices when the channel is free. This frequency also acts as a disconnect
|
|
signal, indicating that the voice channel should return to its unused status.
|
|
|
|
When a subscriber dials a number it reaches his local central office and
|
|
possibly toll office by dc pulsing or push button tone signaling. The toll
|
|
office selects a free voice channel in an appropriate trunk and stops the ****
|
|
Hz tone. The office at the end of that trunk detects the break in the **** Hz
|
|
signal and is alerted to receive a toll telephone number. The number is sent in
|
|
the MF code listed in table (X). One toll office passes the number to another
|
|
until the called central office is reached. The central office then rings the
|
|
called telephone.
|
|
|
|
When either party hangs up, the call is disconnected and the toll offices start
|
|
transmitting the **** Hz tone again to indicate that the channel is idle.
|
|
|
|
If a short burst of **** Hz is transmitted from a subscriber's telephone, the
|
|
toll office receives this as a signal that the subscriber has hung up. It then
|
|
places **** Hz on the channel to the next toll office. Phone phreaks call this
|
|
"whistling off" or "beeping off" a trunk. The subscriber is still connected to
|
|
a long distance switching office. This is the first step to bypass the phone
|
|
company's billing computer and make free calls to anywhere in the world.
|
|
|
|
A blue box call is started by dialing a long distance call in the normal way to
|
|
a toll free "800" number. Directory assistance numbers can also be used or a
|
|
call can be placed to a nearby destination which is cheap to call. This is the
|
|
call which will appear on the CAMA tape. Once dialing is completed, and the
|
|
called number starts to ring, you feed **** Hz into your phone for one second.
|
|
Experienced phone phreaks familiar with the timing whistle off a second or two
|
|
before the called number actually rings. The **** Hz tone is acousticaly
|
|
coupled to the phone by simply placing the blue box against the mouth piece and
|
|
pressing the appropriet button. The local CO is not listening for **** Hz to
|
|
indicate a disconnect. It monitors the current flow in the line and knows the
|
|
subscriber hung up when the current flow drops below a certain minimum. The
|
|
**** Hz tone is passed on to the toll switching office as if it were a voice
|
|
signal. The toll office is not listening for **** Hz from a CO and so passes it
|
|
on to the next toll office. At this point the tone is heard as signal that the
|
|
caller has hung up. The call is cancelled leaving the caller still connected to
|
|
a toll line between switching offices. After sending **** Hz for approximately
|
|
one second you remove it. The removal of the tone tells the distant switching
|
|
office that the line is no longer idle. It connects an incoming sender and
|
|
waits for instructions in the form of MF signaling. At this point you have
|
|
about ten seconds to start dialing the desired number on the blue box. The
|
|
number is dialed in a manner simmiler to using a push button telephone. It is
|
|
in this format: KP+(area code)+(7 digit phone number)+ST. When the called
|
|
number answers, a signal is sent back causing the CAMA tape to be punched with
|
|
the time the connection was made. At the end of the call, the CAMA tape is
|
|
punched with the number called from, the time and the number you originally
|
|
dialed. This is the information that will be used to compute your bill. The
|
|
call will be free if an 800 numer was used. The number actually reached with
|
|
the blue box is not recorded. Modern systems frequently use magnetic tape
|
|
instead of punched paper tape to record the billing information but it works
|
|
the same.
|
|
|
|
Getting Into the System
|
|
|
|
Many CO's are now using CCIS (Common Channel Interoffice Signaling). With this
|
|
system control signaling is done over different lines than those used for voice
|
|
transmission. If a toll free call is placed from an area using CCIS to another
|
|
CCIS area, transmitting **** Hz will not cause a disconnect. In 1984, just when
|
|
it appeared that blue boxing was dead except when done from a few areas of the
|
|
country, advanced "researchers" discovered holes in the system that opened it
|
|
up again all over the country including nearly every street corner pay phone.
|
|
New "holes" are constantly being found and usually are soon pluged after it is
|
|
discovered they are being used to make illegal calls. The main method in use at
|
|
this time is to call an 800 number that rings into a non CCIS area. Knowledg-
|
|
able phone phreaks predict that all of these "holes" will not be plugged until
|
|
sometime after the year 2000. By then new and better ways will probably have
|
|
been developed to beat the system. The trick to using this method is to find an
|
|
800 number that rings into one of the few remaining areas that still use the
|
|
older switching equipment. This is not difficult when you know how. When ****
|
|
Hz is transmitted, it travels over the voice channel to the toll office at the
|
|
distant end where it is recieved as a disconnect. Usually a "chirp" or
|
|
"kachink" is heard and you're in!
|
|
|
|
A few pay phones, especially those located in rural areas, will disconnect
|
|
locally if **** Hz is played into them. The effect is the same as hanging up
|
|
the receiver, then picking up again after a few seconds. This is useless for
|
|
blue boxing and would seem to be an obstical. Actually, it was a delishious
|
|
challenge to the "researchers" and soon fell as a barrier to boxing under the
|
|
probing of a few tone combinations. The local disconnect occurs because the
|
|
local CO is listening for **** Hz. The device that does the listening is called
|
|
a SF (single frequency) unit. These units are designed to disconnect only when
|
|
**** Hz is received without the presence of any other voice band frequencies.
|
|
This is to prevent accidental disconnects on voice components. To get by this
|
|
unit, **** Hz is played in combination with a second tone in the range of 3400
|
|
to 3600 Hz. This is a "guard" tone. When the SF unit hears the higher tone
|
|
along with the **** Hz signal, it does not disconnect. The CO passes the two
|
|
tones along the voice channel toward the switching office at the distant end.
|
|
As the tones pass through the long distance network, the higher tone becomes
|
|
atenuated to a subaudible level. Only the **** Hz tone reaches the distant toll
|
|
office where it produces the desired disconnect. Once again technology triumps
|
|
in determined hands. The following is a list of 800 prefixes in order by
|
|
state. The number in parentheses indicates the area code served by that prefix.
|
|
An asterisk (*) to the left of the prefix indicates that one or more 800
|
|
numbers have been found in that prefix which can be whistled off using **** Hz.
|
|
An asterisk to the right indicates that a toll switching office has been
|
|
located in the area code served by that prefix which will accept MF. There is
|
|
a lot of research yet to be done on this list. In its present form, it is a
|
|
road map of great value to the advanced blue boxer.
|
|
|
|
This system is gradually being replaced by the expanded 800 service. Prefixes
|
|
in the expanded 800 service have no relationship to area codes, but thousands
|
|
of numbers are still in place under the old system. Some of the prefixes listed
|
|
below are easy to hack for blowable numbers. (A "blowable" number is one which
|
|
will disconnect on **** Hz). Look for the ones with asterisks before and after
|
|
them like this: *XXX*.
|
|
|
|
(The following numbers are publically available, therefore legal to display):
|
|
|
|
Alabama 633 (205)
|
|
Alaska 544 (907)
|
|
Arizona 528 (602)
|
|
Arkansas 643 (501)
|
|
California 227 (415)
|
|
421 (213)
|
|
423 (213)
|
|
854 (714)
|
|
824 (916)
|
|
538 (408)
|
|
235 (805)
|
|
344 (209)
|
|
358 (707)
|
|
Colorado *525 (303)
|
|
255 (303)
|
|
Connecticut 243 (203)
|
|
Delaware 441 (302)
|
|
District of Col. 424 (202)
|
|
368 (202) For high volume traffic
|
|
Florida 327 (305)
|
|
237 (813)
|
|
*874* (904)
|
|
Georgia 841 (912)
|
|
*241 (404)
|
|
554 (404)
|
|
Hawaii 367 (808)
|
|
Idaho *635 (208)
|
|
Illinois 621 (312)
|
|
323 (312)
|
|
637 (217)
|
|
435 (815)
|
|
447 (309)
|
|
851 (618)
|
|
Indiana 428 (317)
|
|
457 (812)
|
|
348 (219)
|
|
Iowa 553 (319)
|
|
*247 (515)
|
|
831 (712)
|
|
Kansas 835 (316)
|
|
255 (913)
|
|
Kentucky 626 (502)
|
|
354 (606)
|
|
Louisiana 535 (504)
|
|
551 (318)
|
|
Maine 341 (207)
|
|
Maryland 368 (301)
|
|
Massachusetts 343 (617)
|
|
225 (617)
|
|
628 (413)
|
|
Michigan 253 (616)
|
|
521 (313)
|
|
338 (906)
|
|
517 (248)
|
|
Minnesota 328 (612)
|
|
533 (507)
|
|
*346 (218)
|
|
Mississippi 647 (601)
|
|
Missouri 821 (816)
|
|
325 (314)
|
|
641 (417)
|
|
Montana *548* (406)
|
|
Nebraska 228 (402)
|
|
445 (308)
|
|
Nevada *634 (702) (Las Vegas)
|
|
648 (702) Reno
|
|
New Hampshire 258 (603)
|
|
New Jersey 257 (609)
|
|
New Mexico 545 (505)
|
|
New York 223 (212)
|
|
847 (607)
|
|
221 (212)
|
|
431 (914)
|
|
828 (716)
|
|
645 (516)
|
|
448 (315)
|
|
833 (518)
|
|
North Carolina 334 (919)
|
|
438 (704)
|
|
North Dakota *437 (701)
|
|
Ohio 321 (216)
|
|
543 (513)
|
|
537 (419)
|
|
848 (614)
|
|
Oklahoma 654 (405)
|
|
331 (918)
|
|
Oregon *547* (503)
|
|
Pennsylvania 523 (215)
|
|
345 (215)
|
|
*458* (814)
|
|
245 (412)
|
|
233 (717)
|
|
Puerto Rico 468 (809)
|
|
Rhode Island 556 (401)
|
|
South Carolina *845* (803)
|
|
South Dakota *843* (605)
|
|
Tennessee 251 (615)
|
|
238 (901)
|
|
Texas 527 (214)
|
|
433 (817)
|
|
531 (512)
|
|
231 (713)
|
|
351 (915)
|
|
*858* (806)
|
|
Utah 453 (801)
|
|
Vermont *451 (802)
|
|
Virginia 446 (804)
|
|
368 Arlington - <For D.C.>
|
|
336 (703)
|
|
Virgin Islands 524 (809)
|
|
Washington 426 (206)
|
|
541 (509)
|
|
West Virginia 624 (304)
|
|
Wisconsin *356 (608)
|
|
558 (414)
|
|
Wyoming 443 (307)
|
|
|
|
How to Make Overseas Calls With a Blue Box
|
|
|
|
Overseas dialing is done in two stages of outpulsing. The first stage routes to
|
|
an overseas sender and uses 011, which is the international access code for
|
|
International Direct Distance Dialing (IDDD) plus the paired country code. If
|
|
the country code is two digits, the paired country code can be derived by
|
|
adding a "0" to the left of the country code. Example: The country code for
|
|
England is 44. The paired country code would be 044. First stage outpulsing for
|
|
England would then be: KP-011044-ST. If the country code contains three digits,
|
|
the paired country code cannot be derived in this way and must be looked up.
|
|
Example: The country code for Guam is 671. The paired country code is 067.
|
|
First stage outpulsing for Guam would be KP-011067-ST. Second example: The
|
|
country code for Cyprus is 357. The paired country code is 087. It is a rule
|
|
that a paired country code must never be the same as any country code.
|
|
|
|
About five seconds after the STart pulse, an international dial tone will be
|
|
heard. This will time out to a reorder in about ten seconds. When the dial
|
|
tone is heard, the system is ready to accept the second stage of pulsing in the
|
|
format: KP-country code-city code-digits-ST. At this stage it is the country
|
|
code not the paired country code which is used.
|
|
|
|
Use the paired country codes when calling inward operators. Some toll offices
|
|
are screened against 011 coming in on a long distance trunk. In that case
|
|
precede the 011 with the area code which would apply for that toll office.
|
|
Example: for a toll office in Gainsville, FL use KP-904+011+paired CC-ST.
|
|
Another way to reach the overseas senders is to call them directly with KP-
|
|
sender number-ST. If this doesn't work add the area code of the sender.
|
|
Example: KP-904185-ST.
|
|
|
|
The routing for a particular country can be found by dialing normally (pulse or
|
|
touch-tone) 011+CC+000+enough digits to add up to a total of seven including
|
|
the country code. Example: 011+44+00011. You will get a recording. At the end
|
|
of the recording, the area code of the international center will be given. The
|
|
sender used to call a particular country can vary depending on the area of the
|
|
country from which the call is originated. An international call can sometimes
|
|
be completed through the wrong sender, but this causes a print out that will
|
|
later be investigated to find out which CO it came from. To find the correct
|
|
routing when pulsing through any particular toll office use KP+paired
|
|
CC+000+ST. For example, KP-011044000-ST would give the same result as dialing
|
|
normally 011-44-00011 if you were dialing it in the area where the toll office
|
|
is located.
|
|
|
|
The first digit of a country code is the world region in which that country is
|
|
located. The world regions are: 1--North America, 2--Africa, 3 and 4--Europe,
|
|
5--South and Central America, 6--South Pacific, 7--Union of Soviet Socialist
|
|
Republics (U.S.S.R.), 8--Far East, 9--Middle East and South-East Asia.
|
|
|
|
Note 1. KP2 is not used in first or second stage outpulsing when calling any
|
|
country in the IDDD network.
|
|
|
|
Note 2. Public telephones are interfaced to TSPS (Traffic Service Position
|
|
System). If you call an 800 number and whistle off using **** Hz, the distant
|
|
toll office sends a wink back signal (a short on-hook) indicating it is ready
|
|
to receive pulsing. TSPS responds to this wink back by printing out the
|
|
original number called, the number called from, and the number MFed after the
|
|
wink back. This print out goes to the billing and security departments.
|
|
|
|
Red Boxing
|
|
|
|
Red boxing consists of simulating the tones produced when coins are deposited
|
|
in a pay phone. Coin tones are beeps of G Hz + B Hz as follows:
|
|
|
|
5 cents - 1 beep, 66 milliseconds duration.
|
|
10 cents - 2 beeps, each 66 milliseconds duration with 66 millisecond pause.
|
|
25 cents - 5 beeps, each 33 milliseconds duration with a 33 millisecond pause.
|
|
|
|
Two methods have commonly been used by phone phreaks to produce these tones and
|
|
make free calls. The traditional Red Box consisting of a pair of Wien-bridge
|
|
oscillators with the timing controlled by 555 timer chips. Producing the
|
|
signals with a computer which are recorded and then played back into the mouth
|
|
piece of a pay phone.
|
|
|
|
A third very novel method has recently appeared. A phreak in the Midwest has
|
|
extensively tested a method of red boxing which uses nothing more than a pair
|
|
of brass or aluminum whistles. The whistles are 1/4 inch in diameter by 4
|
|
inches long and are tuned by means of a wooden dowel rod which fits snugly
|
|
inside. The whistles can be brought precisely on frequency by tuning them
|
|
against a known signal source such as a computer capable of producing the
|
|
tones. Once tuned, the whistles are glued or taped together so they can be
|
|
blown together to produce the dual tone used in coin signaling. It has been
|
|
tested and proven that with a little practice these whistles can be used to
|
|
make free calls. Now you can blow your money without spending a cent.
|
|
|
|
Black Boxes
|
|
|
|
Like blue boxes, black boxes got their name from the color of the first one
|
|
found. The black box, also known as a mute, is a device which permits a
|
|
subscriber to receive incoming long distance calls without charge to the
|
|
calling party. This information is presented mainly for its historical interest
|
|
since black boxes will not work on the new electronic switching systems (ESS).
|
|
|
|
The construction and use of a black box was quite simple. A resistor of about
|
|
**** ohms was connected in series with one side of the phone line. Connected in
|
|
parallel across the resistor were a .** mfd capacitor and a single pole single
|
|
throw toggle switch. A momentary contact push button was connected across the
|
|
line ahead of the other components for the purpose of briefly shorting the
|
|
line. While waiting for an incomming call, the switch was left in the "on"
|
|
position which shorted out the resistor and left the phone connected to the
|
|
line as usual. When a call was received, the proceedure was to throw the
|
|
switch, lift the receiver and push the button for a period less than one
|
|
second. That brief short simulated taking the receiver off hook, which stopped
|
|
the phone from ringing. Releasing the button simulated placing the receiver
|
|
back on hook. Keep in mind that the receiver is really "off hook", but the
|
|
presence of the resistor in series with the line reduces the current drawn by
|
|
the phone below the level needed by telephone company equipment to detect the
|
|
"off hook" condition. The capacitor bypassed the resistor for audio signals
|
|
permitting normal conversation to take place. All the billing equipment knew
|
|
was that a toll call was placed and the called party picked up the receiver and
|
|
replaced it in less than one second. Since calls of less than 1 second
|
|
are not billed, there was no charge for the call. Later models of the black
|
|
box featured diodes to automatically do the button pushing and switch funtions.
|
|
Aside from this refinement, they worked the same as the one described.
|
|
|
|
Cheese Boxes
|
|
|
|
The first divice of this kind was found in a cheese box, thus the name. A
|
|
cheese box is a call diverter. Calls placed to one number are rerouted to
|
|
another. This requires two phone lines each with its own number. Both lines
|
|
terminate at the same location, ususally a vacant apartment or the apartment of
|
|
an elderly widow. Only the first number is given out. When this number is
|
|
called, the cheese box connects the first line to the second. The call is then
|
|
answered on the second line at a location far removed from the cheese box. This
|
|
has been a favorite trick among bookies. Law enforcement officers trace the
|
|
calls to the location of the cheese box and stage raids. When they get to the
|
|
location all they find is an empty apartment or a confused old lady. Sometimes,
|
|
realizing a cheese box is being used, they make a search for it. They don't
|
|
always find the cheese box even though they know what they are looking for.
|
|
Early cheese boxes were quite simple consisting of only a few diodes and
|
|
capacitors. They could be as small a fifty cent coin. Because of changes in the
|
|
system, later models are more sofisticated. In use today and have been
|
|
advertized in a national magazine. Apparently not illegal unless put to an
|
|
illegal use.
|
|
|
|
Silver Boxes
|
|
|
|
Used to talk or send computer data over long distance lines free of charge. A
|
|
silver box is a normal tone pad with the addition of four keys normally
|
|
reserved for military or amateur radio use. These four additional keys are
|
|
designated as follows:
|
|
|
|
A - Flash
|
|
B - Flash override priority
|
|
C - Priority communication
|
|
D - Priority override
|
|
|
|
Push button tone dialing uses a signaling method called Dual Tone Multi-
|
|
frequency or DTMF for short. It is a method of representing digits by playing
|
|
two tones together using different tones for different digits. The following
|
|
table lists the frequencies used by a tone pad including the signals of the
|
|
silver box. All frequencies are in Hertz.
|
|
|
|
Tone Dialing Frequencies
|
|
|
|
LOW
|
|
TONE HIGH TONE GROUP (HZ)
|
|
GROUP
|
|
(HZ) 1209 1336 1477 H
|
|
|
|
697 1 2 3 A
|
|
770 4 5 6 B
|
|
852 7 8 9 C
|
|
941 * 0 D
|
|
|
|
Silver boxes can be made by modifying an existing key pad or they can be built
|
|
up from a readily available tone encoder integrated circuit chip. The tones
|
|
used can also be produced by many personal computers.
|
|
|
|
Making Free Calls with a Silver Box.
|
|
|
|
Silver boxes are used to seize long distance directory assistance lines. Two
|
|
people calling at about the same time dial directory assistance for a selected
|
|
area code. Not all area codes work for this. Those in the midwest seem to be
|
|
favored. When the number rings, the "D" key is pressed. The caller will hear a
|
|
pulsing tone. The first caller presses "6" on his keypad and waits. The second
|
|
caller, following the same proceedure to this point, presses "7" on his key
|
|
pad. The two are instantly connected. Those who have experimented with this say
|
|
it doesn't matter wether the "6" or the "7" is pressed first so long as one
|
|
caller uses "6" and the other "7". Because of the necessity of prearranging
|
|
the time of a silver box call, this method hasn't really caught on except as a
|
|
fun experiment amoung advanced phone phreaks.
|
|
|
|
I have gone through this file, eliminating only references to specific
|
|
frequencies reqired for fraud. I have also eliminated the specific values for
|
|
a resistor and capacitor used to make the black box mentioned above. For your
|
|
information, all frequencies listed A - H are specific and there are no
|
|
repeats. they are not in any specific order. The beep-off tone described and
|
|
listed as **** Hz is also a single specific Frequency.
|
|
|