2736 lines
78 KiB
Plaintext
2736 lines
78 KiB
Plaintext
|
|
HANNOVER, UNITED GERMANY! [09-28-92!]
|
|
---------------------------------------
|
|
|
|
CCITT UNDERGROUND INFORMATIONS
|
|
ISSUE-NO: 1.00
|
|
|
|
---------------------------------------
|
|
|
|
THIS TEXT CONTAINS INFORMATIONS ABOUT :
|
|
------------->>> CCITT <<<-------------
|
|
|
|
---------------------------------------
|
|
---------------> MENU! <---------------
|
|
---------------------------------------
|
|
|
|
FIRST WORDS
|
|
INFORMATIONS
|
|
WHAT CAN I DO WITH A BLUEBOX ?
|
|
EXPLAIN OTHER PHONESYSTEMS
|
|
CCITT: HOW YOU MUST DIAL
|
|
WHICH COUNTRIES CAN BLUEBOX ?
|
|
HOW SAFE IS BLUEBOXING
|
|
LIST OF INTERNATION PHONESYSTEMS
|
|
GERMAN TOLLFREE NUMBERS
|
|
STORY, HOW I HEARD ABOUT BLUEBOXING
|
|
ABOUT ME (GURU JOSH!)
|
|
TIME FOR GREETINGS
|
|
HOW TO GET IN TOUCH WITH ME
|
|
----> NOW, FOLLOW TEXTFILES WRITTEN
|
|
BY SOME DIFFERENT PERSONS...
|
|
|
|
1.) BETTER HOMES AND BLUEBOXING
|
|
- part: 1 - THEORY OF OPERATION
|
|
- part: 2 - PRATICAL APPLICATIONS
|
|
- part: 3 - ADV. SIGNALING
|
|
2.) HOW TO BLUEBOX INTO RUSSIA
|
|
3.) THE MYTH OF THE 2600HZ DETECTOR
|
|
4.) EUROTEXT: 1
|
|
|
|
FILE 1 & 2 (W) BY MARK TABAS
|
|
---------------------------------------
|
|
|
|
- FIRST WORDS -
|
|
|
|
---------------------------------------
|
|
WHY, I WRITE ANOTHER TEXTFILE ABOUT THE
|
|
CCITT NORM (SPECIAL LINE SIGNALING!) ?!
|
|
THATS SIMPLE BCOZ. I PLAN TO QUIT THE
|
|
SCENE, SINCE THE COPS CAUGHT ME, LAST
|
|
MONTH! BUT I DON'T LIKE TO QUIT WITHOUT
|
|
ANSWERING ALL THE QUESTIONS ASKED BY
|
|
SOME USERS OF MY OLD BBS...
|
|
|
|
ONLY FOR INFORMATION: THE BBS IS CLOSED
|
|
I RUN NOW A UNIX-SYSTEM WHICH IS PUBLIC
|
|
---------------------------------------
|
|
|
|
- INFORMATIONS -
|
|
|
|
---------------------------------------
|
|
I`LL NOT WRITE ANYTHING NON IMPORTANT..
|
|
IF YOU DON`T KNOW HOW BLUEBOXING WORKS,
|
|
READ EVERYTHING IN THIS TEXTFILE...
|
|
I WILL EXPLAIN HOW IT WORKS, AND WHAT'S
|
|
POSSIBLE WITH YOUR BLUEBOX.
|
|
---------------------------------------
|
|
|
|
- WHAT CAN I DO WITH A BLUEBOX ? -
|
|
|
|
---------------------------------------
|
|
WELL, YOU CAN REACH NEARLY ALL NUMBERS
|
|
WORLDWIDE! - YOU ALSO REACH UNLISTED
|
|
NUMBERS FROM ANY COUNTRY AND YOU CAN
|
|
DIAL WITH PRIORITY STATUS (FUNNY EHH!)
|
|
|
|
YOU'LL KNOW: HOW TO DO THAT ?
|
|
REALLY SIMPLE, I'LL TRY TO EXPLAIN
|
|
HOW IT WORKS - STEP BY STEP!
|
|
|
|
IF YOU THINK ABOUT USING OPERATORS
|
|
READ ALL THE NICE TEXTFILES ABOUT
|
|
OPERATORS CAREFUL...
|
|
BUT USE'EM THEY'RE KEWL AND THEY
|
|
CAN HELP YOU.. SOOOO MUCH!
|
|
---------------------------------------
|
|
|
|
- EXPLAIN PHONE-SYSTEMS -
|
|
|
|
---------------------------------------
|
|
|
|
CCITT 2
|
|
CCITT 3
|
|
CCITT 4
|
|
CCITT 5
|
|
CCITT SOCOTEL
|
|
CCITT 5 - R1
|
|
CCITT 5 - R2
|
|
|
|
SOME DIFFERENT DIALING FREQUENCIES
|
|
|
|
|
|
|
|
CCITT: -2-
|
|
----------
|
|
EG: USED IN SOUTH AFRICA
|
|
|
|
HANGUP: 600 HZ & 750 HZ, 2280 HZ
|
|
|
|
TIMING: NO INFOS
|
|
|
|
DIALING: NO INFOS
|
|
|
|
THIS SYSTEM IS TO OLD, AND ONLY USED IN
|
|
A FEW AFRICAN AND SOUTH AMERICAN
|
|
COUNTRIES... I GOT NO INFORMATIONS
|
|
ABOUT ANYTHING, ONLY AN OLD MEMBER OF
|
|
THE CHAOS COMPUTER CLUB IN GERMANY
|
|
SUPPLIED US THE FREQUENCIES FOR THE
|
|
HANGUP WITHOUT ANY TIMINS (THANKS!)
|
|
|
|
|
|
CCITT: -3-
|
|
----------
|
|
EG: USED IN ITALY
|
|
|
|
HANGUP: 2280 HZ
|
|
PULSE: 35 MS +/- 5 MS
|
|
INTERVALS: 35 MS +/- 5 MS
|
|
|
|
DIAL FREQUENCIES:
|
|
|
|
TRY THE INTERNATIONAL CCITT #-5-
|
|
|
|
|
|
CCITT: -4- (Q.121 & Q.115)
|
|
--------------------------
|
|
EG: USED IN ITALY & IRELAND ETC!
|
|
|
|
HANGUP: 2040 & 2040 HZ
|
|
|
|
FREQ1 (2040 HZ): 0
|
|
FREQ2 (2400 HZ): 1
|
|
|
|
PREFIX: 80 MS +/- 20 MS
|
|
SHORT SIGNAL: 40 MS +/- 10 MS
|
|
LONG- SIGNAL: 200 MS +/- 40 MS
|
|
|
|
DIGIT: -PULSE- SHORT INFO:
|
|
|
|
-1- 1-1-1-0 DIGIT #-1-
|
|
-2- 1-1-0-1 DIGIT #-2-
|
|
-3- 1-1-0-0 DIGIT #-3-
|
|
-4- 1-0-1-1 DIGIT #-4-
|
|
-5- 1-0-1-0 DIGIT #-5-
|
|
-6- 1-0-0-1 DIGIT #-6-
|
|
-7- 1-0-0-0 DIGIT #-7-
|
|
-8- 0-1-1-1 DIGIT #-8-
|
|
-9- 0-1-1-0 DIGIT #-9-
|
|
-0- 0-1-0-1 DIGIT #-0-
|
|
CODE 11 0-1-0-0 CALL OPERATOR
|
|
CODE 12 0-0-1-1 CALL OPERATOR
|
|
SP.C. I 0-0-1-0 SPACE CODE -
|
|
SEE Q.104
|
|
IHES 0-0-0-1 INCOMMING HALF ECHO
|
|
SUPRESSOR
|
|
(REQUIRED!)
|
|
SP.C. II 1-1-1-1 SPACE CODE
|
|
E.O.P. 0-0-0-0 END OF PULSING
|
|
|
|
KP1 PX LOCAL- CALL
|
|
KP2 PY GLOBAL CALL
|
|
CLEAR FORWARD PXX \ BETTER READ
|
|
XFER- FORWARD PYY / - Q.121! FF
|
|
|
|
FREQ1 (2040 HZ): 0
|
|
FREQ2 (2400 HZ): 1
|
|
|
|
PREFIX- SIGNAL:
|
|
---------------
|
|
P 150 MS +/- 30 MS
|
|
(0 AND 1 COMPOUND!)
|
|
|
|
CONTROL SIGNAL:
|
|
---------------
|
|
X 100 MS +/- 20 MS
|
|
(0 SHORT SINGLE SIGNAL!)
|
|
Y 100 MS +/- 20 MS
|
|
(1 SHORT SINGLE SIGNAL!)
|
|
XX 350 MS +/- 70 MS
|
|
(0 LONG- SINGLE SIGNAL!)
|
|
YY 350 MS +/- 70 MS
|
|
(1 LONG- SINGLE SIGNAL!)
|
|
|
|
|
|
CCITT: -5-
|
|
----------
|
|
EG: USED IN USA, CAN, AUSTRALIA & JAPAN
|
|
|
|
HANGUP: 2600/2400 HZ
|
|
TIMING: 0-999 MS
|
|
|
|
|
|
DIGIT:
|
|
------
|
|
-1- 700 HZ + 900 HZ
|
|
-2- 700 HZ + 1100 HZ
|
|
-3- 900 HZ + 1100 HZ
|
|
-4- 700 HZ + 1300 HZ
|
|
-5- 900 HZ + 1300 HZ
|
|
-6- 1100 HZ + 1300 HZ
|
|
-7- 700 HZ + 1500 HZ
|
|
-8- 900 HZ + 1500 HZ
|
|
-9- 1100 HZ + 1500 HZ
|
|
-0- 1300 HZ + 1500 HZ
|
|
CODE 11 700 HZ + 1700 HZ
|
|
CODE 12 900 HZ + 1700 HZ
|
|
KP1 1100 HZ + 1700 HZ
|
|
KP2 1300 HZ + 1700 HZ
|
|
ST 1500 HZ + 1700 HZ
|
|
|
|
TIMING:
|
|
-------
|
|
NUMBER-- DIGITS: 0,1-9
|
|
|
|
LENGTH: 55 MS +/- 7 MS
|
|
DELAY : 55 MS +/- 7 MS
|
|
|
|
OPERATOR DIGITS: C.11/12
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 55 MS +/- 7 MS
|
|
|
|
CONTROL- DIGITS: KP1/2 & ST
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 55 MS +/- 7 MS
|
|
|
|
SOMETIMES YOU CAN/MUST USE SHORTER OR
|
|
LONGER DIGITS AND THE "START PULSING
|
|
(ST)" IS SOMETIMES ONLY: 25 +/- 15 MS
|
|
(+/- 5 STEPS)
|
|
|
|
|
|
CCITT: -5- R1
|
|
-------------
|
|
EG: USED (LOCAL) IN CANADA & USA!
|
|
|
|
HANGUP: 2600/2600 HZ
|
|
TIMING: 0-999 MS
|
|
|
|
|
|
DIGIT:
|
|
------
|
|
-1- 700 HZ + 900 HZ
|
|
-2- 700 HZ + 1100 HZ
|
|
-3- 900 HZ + 1100 HZ
|
|
-4- 700 HZ + 1300 HZ
|
|
-5- 900 HZ + 1300 HZ
|
|
-6- 1100 HZ + 1300 HZ
|
|
-7- 700 HZ + 1500 HZ
|
|
-8- 900 HZ + 1500 HZ
|
|
-9- 1100 HZ + 1500 HZ
|
|
-0- 1300 HZ + 1500 HZ
|
|
CODE 11 700 HZ + 1700 HZ
|
|
CODE 12 900 HZ + 1700 HZ
|
|
KP1 1100 HZ + 1700 HZ
|
|
KP2 1300 HZ + 1700 HZ
|
|
ST 1500 HZ + 1700 HZ
|
|
|
|
TIMING:
|
|
-------
|
|
NUMBER-- DIGITS: 0,1-9
|
|
|
|
LENGTH: 60 MS +/- 7 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
OPERATOR DIGITS: C.11/12
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
CONTROL- DIGITS: KP1/2 & ST
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
|
|
CCITT: R2
|
|
---------
|
|
EG: USED IN HOLLAND, DENMARK & ROMANIA
|
|
|
|
HANGUP: 3825 HZ OR 3000 HZ
|
|
TIMING: 100-640 MS
|
|
|
|
|
|
DIGIT:
|
|
------
|
|
-1- 1380 HZ + 1500 HZ
|
|
-2- 1380 HZ + 1620 HZ
|
|
-3- 1500 HZ + 1620 HZ
|
|
-4- 1380 HZ + 1740 HZ
|
|
-5- 1980 HZ + 1740 HZ
|
|
-6- 1620 HZ + 1740 HZ
|
|
-7- 1380 HZ + 1860 HZ
|
|
-8- 1500 HZ + 1860 HZ
|
|
-9- 1620 HZ + 1860 HZ
|
|
-0- 1740 HZ + 1860 HZ
|
|
KP2E 1380 HZ + 1980 HZ W/O- ECHO
|
|
KP2 1500 HZ + 1980 HZ WITH ECHO
|
|
ST 1860 HZ + 1980 HZ
|
|
|
|
ALL INFOS GIVEN BY:
|
|
TELECOM PLANNING [REF. 8] CCITT - NY
|
|
|
|
I DON`T KNOW, BUT I FOUND NONE
|
|
INFORMATIONS ABOUT ANY "R2" TIMING
|
|
AND I HAVEN`T TRIED ANYTHING RIGHT NOW,
|
|
WITH "R2" ALSO SORRY... YOU CAN TRY
|
|
THE TIMINGS WHICH ARE USED IN
|
|
CCITT: -5- "R1".
|
|
|
|
TIMING:
|
|
-------
|
|
NUMBER-- DIGITS: 0,1-9
|
|
|
|
LENGTH: 60 MS +/- 7 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
CONTROL- DIGITS: KP1/2 & ST
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
|
|
|
|
CCITT: SOCOTEL
|
|
--------------
|
|
EG: USED IN SPAIN (USED IN FRANCE!)
|
|
|
|
HANGUP: 3850 HZ
|
|
PULSE: 35 MS +/- 5 MS
|
|
INTERVALS: 35 MS +/- 5 MS
|
|
|
|
DIAL FREQUENCIES:
|
|
|
|
DIGIT:
|
|
------
|
|
-1- 700 HZ + 900 HZ
|
|
-2- 700 HZ + 1100 HZ
|
|
-3- 900 HZ + 1100 HZ
|
|
-4- 700 HZ + 1300 HZ
|
|
-5- 900 HZ + 1300 HZ
|
|
-6- 1100 HZ + 1300 HZ
|
|
-7- 700 HZ + 1500 HZ
|
|
-8- 900 HZ + 1500 HZ
|
|
-9- 1100 HZ + 1500 HZ
|
|
-0- 1300 HZ + 1500 HZ
|
|
CODE 11 700 HZ + 1700 HZ
|
|
CODE 12 900 HZ + 1700 HZ
|
|
KP1 1100 HZ + 1700 HZ
|
|
KP2 1300 HZ + 1700 HZ
|
|
ST 1500 HZ + 1700 HZ
|
|
|
|
TIMING:
|
|
-------
|
|
NUMBER-- DIGITS: 0,1-9
|
|
|
|
LENGTH: 60 MS +/- 7 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
OPERATOR DIGITS: C.11/12
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
CONTROL- DIGITS: KP1/2 & ST
|
|
|
|
LENGTH: 100 MS +/- 15 MS
|
|
DELAY : 60 MS +/- 7 MS
|
|
|
|
---------------------------------------
|
|
|
|
- CCITT: HOW YOU MUST DIAL ? -
|
|
|
|
---------------------------------------
|
|
also, to dial your friend in the USA,
|
|
Canada or any other american country
|
|
you must type:
|
|
|
|
t/a-0-202-456-1414-c
|
|
|
|
to reach a cool UNIX-SYSTEM or a
|
|
friend in Europe, you must type:
|
|
|
|
t/b-49-0-511-211-0635-c
|
|
|
|
If you don't like a busy-signal so
|
|
you have to dial for america:
|
|
|
|
t/a-2-703-121-c
|
|
\--> this should be the
|
|
area-code, in which
|
|
you got the
|
|
busy-signal !
|
|
|
|
t/a-2-703-131-c
|
|
/
|
|
/--> this operator is
|
|
for directory
|
|
assistance....!
|
|
|
|
for more 1XX operators look in other
|
|
available files for us-dudes.....
|
|
|
|
important: don't use an operator,
|
|
---------- if you don't know how to
|
|
use him !
|
|
|
|
btw: we found no way to reach the
|
|
----> 115xx - operators in the USA!!
|
|
|
|
If you need directory assistance for
|
|
anonther country worldwide, type:
|
|
|
|
t/b-43-2-d-c or t/b-43-2-e-c
|
|
|
|
The lines above should give ya the
|
|
directory assistance for Austria !
|
|
I don't, at the moment, know if you can
|
|
do other things with the operators,
|
|
but you can change the area code.
|
|
(France (33) use a nice music for
|
|
the hold position if all lines are
|
|
busy!) and you can change the "2"
|
|
between "0","1" to "9" sometimes
|
|
you get other operators... and
|
|
you can always switch between
|
|
"d" and "e" (code 11/12) for operators
|
|
we're sure, you'll find some really
|
|
funny operators, and if you find
|
|
something out, leave us a message!
|
|
|
|
the number for "directory assistance"
|
|
are normally the numbers dialed by the
|
|
operators (in Germany: 0118 or 00118)
|
|
|
|
Don't forget you're another operator!
|
|
Also, try to be really an operator, or
|
|
you'll possibly get trouble....
|
|
|
|
btw: Please, send the frequencies
|
|
---> before or after the number you
|
|
---> dialed answer!
|
|
---> ----------------------------------
|
|
---> also before anything pick-up
|
|
---> the phone, or after that thing
|
|
---> dropped the phone...
|
|
---------------------------------------
|
|
|
|
- which coutries can bluebox ? -
|
|
|
|
---------------------------------------
|
|
About the question above, normally all
|
|
countries can use the bluebox but some
|
|
got a device (against bboxing!) that
|
|
mean you can't seize a trunk,or gettin
|
|
caught after you seize a trunk with
|
|
the correct frequencies...
|
|
---------------------------------------
|
|
|
|
- How Safe Is Blueboxing ? -
|
|
|
|
---------------------------------------
|
|
This should be the important question.
|
|
How safe is blueboxing, really ?!?
|
|
Also, in countries with a new
|
|
phone-system (with digital dialing!)
|
|
like (for example) in the USA & since
|
|
a few weeks ago in some citys in
|
|
Switzerland (and some other countries)
|
|
you're busted, faster than you
|
|
can get a orgasm in own-work!
|
|
In countries with special devices,
|
|
sometimes simple called: filter
|
|
(like in spain and great britain!)
|
|
you can't use a bluebox, bcoz. your
|
|
frequence(s) to seize a trunk, are
|
|
simple filtered by the devices...
|
|
Normally, you are safe while
|
|
blueboxing, if you
|
|
use a non-digital phone-system!
|
|
For example: In most citys
|
|
in United-Germany [West] ! But to be
|
|
100% sure, that you don't use digital
|
|
lines, simply test everyday before you
|
|
use the bluebox!, If you can dial with
|
|
"frequence tones", also sometimes
|
|
simple called: "touch-tones"
|
|
bcoz. If you can dial with it, you
|
|
are easy to bust for German-Telecom!
|
|
or any other phone-company!
|
|
Also, be careful by using the bluebox
|
|
or/and cards after you got a digital
|
|
line - system...
|
|
---------------------------------------
|
|
- LIST OF INTERNATIONAL PHONE SYSTEMS -
|
|
---------------------------------------
|
|
|
|
CAN -1- R1/R2
|
|
USA -1- R1/R2
|
|
URS -7- ? /R1
|
|
EGY -20 ?
|
|
AFS -27 C2
|
|
GRC -30 ?
|
|
HOL -31 R2
|
|
BEL -32 R2
|
|
-F- -33 R2/SCTL
|
|
MCO -33 R2/SCTL
|
|
-E- -34 C5: HANGUP: 2500 HZ / 2400 HZ
|
|
HNG -36 ?
|
|
-D- -37 ?
|
|
YUG -38 C3 (OR NONE HAHA!)
|
|
-I- -39 C3/C4/C5
|
|
ROU -40 R2
|
|
SUI -41 C3/C4
|
|
TCH -42 C3
|
|
AUT -43 C3/C4
|
|
GB- -44 C2/R2
|
|
DNK -45 R2/C5: HANGUP: 3000 HZ
|
|
-S- -46 R1: HANGUP: 2400 HZ
|
|
NOR -47 R1: HANGUP: 2400 HZ
|
|
POL -48 C3/R2
|
|
-D- -49 IKZ 50
|
|
PRU -51 R2
|
|
MEX -52 ?
|
|
CUB -53 R2
|
|
ARG -54 R2
|
|
-B- -55 R2
|
|
CHL -56 R2
|
|
CLM -57 ? (R2 ?)
|
|
VEN -58 ? (R2 ?)
|
|
MLA -60 ?
|
|
AUS -61 C5/R1/R2
|
|
INS -62 ?
|
|
PHL -63 R2/R1
|
|
NZL -64 C2
|
|
SNG -65 ?
|
|
THA -66 R2
|
|
JPN -81 C5/R1/R2
|
|
KRE -82 R2
|
|
VTN -84 ?
|
|
VCH -86 ?
|
|
TUR -90 ?
|
|
IND -91 C5: HANGUP: 2400 HZ
|
|
PAK -92 ?
|
|
AFG -93 ?
|
|
SLK -94 ?
|
|
BRM -95 R2
|
|
IRN -98 ?
|
|
MRC 210 C3
|
|
MRC 211 C3
|
|
MRC 212 C3
|
|
ALG 213 ?
|
|
LBR 231 R2
|
|
GHA 233 R2
|
|
CME 237 R2
|
|
KEN 254 C4
|
|
TGK 255 R2
|
|
UGA 256 C4
|
|
BDI 257 R2
|
|
MOZ 258 C5: HANGUP: 2400 HZ
|
|
ZMB 260 R2
|
|
MDG 261 C3
|
|
POR 351 R2
|
|
LUX 352 R2
|
|
IRL 353 C4
|
|
CYP 357 R2
|
|
SUR 597 R2
|
|
FJI 679 R2
|
|
BGD 880 R2
|
|
JOR 962 R2
|
|
SYR 963 R2
|
|
IRQ 964 R2
|
|
OMA 968 R2
|
|
ISR 972 SCTL
|
|
|
|
---------------------------------------
|
|
GERMAN TOLLFREE NUMBERS - BY G-TELECOM!
|
|
---------------------------------------
|
|
CALLING VIA: SIG.SYSTEM GER.TOLLFREE
|
|
---------------------------------------
|
|
AUSTRALIA -C5- 800061
|
|
BELGIUM 800032
|
|
BRAZIL -C5- 800055
|
|
CANADA -C5- 0014
|
|
CZECHOSLOWAKIA XXXXXX
|
|
CHILE -C5- 800056
|
|
DENMARK 800045
|
|
DOM.REPUBLIC XXXXXX
|
|
FINLAND 800358
|
|
FRANCE -C5- 800033
|
|
GREAT BRITAIN 800044
|
|
HONGKONG -C5- 800852
|
|
HUNGARY 800036
|
|
ICELAND -C5- 800354
|
|
IRELAND 800353
|
|
ITALY 800039
|
|
JAPAN -C5- 800081
|
|
KOREA -C5- 800082
|
|
LUXEMBOURG 800352
|
|
NETHERLAND 800031
|
|
NEW ZEALAND -C5- 800064
|
|
NORWAY 800047
|
|
PORTUGAL 800351
|
|
SAUDI ARABIA XXXXXX
|
|
SINGAPORE 800065
|
|
SPAIN 800034
|
|
SWEDEN 800047
|
|
SWITZERLAND XXXXXX
|
|
TAIWAN (ROC) -C5- 800886
|
|
THAILAND -C5- 800066
|
|
TURKEY 800090
|
|
USA (-AT&T-) -C5- 0010
|
|
USA (-MCI!-) -C5- 0012
|
|
USA (SPRINT) -C5- 0013
|
|
---------------------------------------
|
|
|
|
THATS ALL MY FRIENDS, IF YOU NEED MORE
|
|
INFORMATIONS TRY SOMETHING WITH THE
|
|
KEWL "DIALER V2.8D BY UNLIMITED ACCESS"
|
|
I THINK THATS THE BEST AROUND THE GLOBE
|
|
|
|
---------------------------------------
|
|
- Story, how I heard about BlueBoxing -
|
|
---------------------------------------
|
|
some months ago, a friend from spain
|
|
called me in the evening and told me
|
|
something about a working bluebox
|
|
and he said: I call for free now....
|
|
after, I asked this dude,
|
|
if he could explain: how does it works?
|
|
he told me, "I use a programm on a
|
|
Atari-ST (haha) and I enter the number
|
|
in a special format and when I complete
|
|
the number, I must call a friend or
|
|
another number here in Spain, and then
|
|
I send some tones (frequencies) !
|
|
after that, I can call worldwide for
|
|
free...."
|
|
|
|
This info was given by my friend: Paco
|
|
in Spain (thanxx for it!) - I got this
|
|
info in the last days of 1990 and
|
|
I tried now, something to call here
|
|
in Europe for free, bcoz. A few days
|
|
after the call from my friend, the
|
|
bluebox died in spain, and I lost the
|
|
contact, but some days later another
|
|
friend, now in Germany told me, that
|
|
a friend from him, called any
|
|
toll-free number, via satellite and
|
|
he can call worldwide for free with
|
|
a really good line... Now, I knew
|
|
100 % it's possible to call for free
|
|
around the globe, simple by using a
|
|
few
|
|
frequencies and so, I tried to find
|
|
out, which frquencies are needed...
|
|
I visited some hacker's local in my
|
|
city, and ask something about the
|
|
phone-systems and I heard something
|
|
about trunks, and beep / kerchunks
|
|
but I knew nothing about it, only
|
|
that it worked years ago in the USA!
|
|
But I got no info, that it's
|
|
possible to use in Europe too.
|
|
I talked also, with a friend of mine
|
|
in belgium and he told me something
|
|
about the phone-systems (thanxx!)
|
|
I heard about CCITT Vx-5, R1-2 etc
|
|
so I got more and more info and at
|
|
the end of january, 1991! I heard in
|
|
the line the first: beep, kerchunk!
|
|
some days later, I heard: two
|
|
beep/kerchunks, but I got no info on
|
|
how to dial after you have seized a
|
|
trunk ?
|
|
Then, I asked again some friends about
|
|
how to dial in the international
|
|
(operator) system (?)
|
|
A guy in south of Germany! told me
|
|
some weeks later something about
|
|
dialing with a bluebox...
|
|
|
|
Today, I wrote allready a bluebox
|
|
for different countries on three
|
|
computers.... - also, on amiga,
|
|
Atari-ST and my best bluebox on
|
|
the old commodore 64! - it works 100%!
|
|
I must never dial two times the same
|
|
number, to reach anybody... - and I
|
|
can dial much faster than all the other
|
|
blueboxes already published in the
|
|
computer-scene!
|
|
|
|
At the moment I work on a portable
|
|
bluebox including some other systems!
|
|
And all needed frequencies to use the
|
|
bluebox worldwide...
|
|
Coming soon.....
|
|
--------------------------------------
|
|
|
|
HELL FIRE! - ABOUT ME - GURU JOSH!
|
|
|
|
--------------------------------------
|
|
I'M NOW 23 YEARS OLD, AND I WAS BORN
|
|
IN THE NORTHERN PART OF GERMANY!
|
|
I USE COMPUTERS SINCE 1983. I GOT FROM
|
|
MY PARENTS A COMMODORE 64 AND L8ER AN
|
|
AMIGA & PC. NOW, I QUIT ALL SCENE
|
|
ACTIVITIES AFTER I WAS CAUGHT FOR
|
|
SOFTWARE PIRACY AND PHONE FRAUD.
|
|
I CAN ALSO PROGRAM IN 6502/10, 68K
|
|
ASSEMBLER, GFA-BASIC, C AND UNIX!
|
|
I WROTE ALSO ON C64 THE BEST AND WELL
|
|
KNOWN BLUEBOX AND A GOOD ONE ON AMIGA
|
|
TOO.
|
|
MY OLD BBS IS CLOSED, AND I RUN ALSO
|
|
A UNIX SYSTEM (WITH ALOT OF KEWL H/P
|
|
FILES ONLINE...!)
|
|
|
|
THAT'S ALL FOR NOW ABOUT MYSELF....
|
|
---------------------------------------
|
|
|
|
- TIME FOR GREETINGS -
|
|
|
|
---------------------------------------
|
|
AMOS KERON [ISRAEL!]
|
|
ANDREAS / PP [WEST GERMANY!]
|
|
BLACK GUARDIAN [USA!]
|
|
BLACK KNIGHT [USA!]
|
|
BUG [NORWAY!]
|
|
CODEX [WEST GERMANY!]
|
|
COOKIE [PORTUGAL!]
|
|
DR. JONES [PORTUGAL!]
|
|
DR. NO [NORWAY!]
|
|
DRACO / PP [WEST GERMANY!]
|
|
EXCALIBUR / PP [WEST GERMANY!]
|
|
FASHION LIGHT [ITALY!]
|
|
FLETCH [BELGIUM!]
|
|
FRED [WEST GERMANY!]
|
|
FRED / AMITECH [WEST GERMANY!]
|
|
GADGET / PP [WEST GERMANY!]
|
|
GIZMO / PP [WEST GERMANY!]
|
|
GRAHAM TWO / PP [WEST GERMANY!]
|
|
JOHN PLAYER / GC [WEST GERMANY!]
|
|
KARO [WEST GERMANY!]
|
|
KEEPER [WEST GERMANY!]
|
|
KEEPER [AUSTRALIA!]
|
|
KREMLIN [PORTUGAL!]
|
|
LATTICE [WEST GERMANY!]
|
|
LIXOM BAH [SWEDEN!]
|
|
LOWTEC [WEST GERMANY!]
|
|
MISTER PRESIDENT [WEST GERMANY!]
|
|
MISTER ROX [WEST GERMANY!]
|
|
MORRISON / PP [WEST GERMANY!]
|
|
NEW DEAL [WEST GERMANY!]
|
|
ONYX [WEST GERMANY!]
|
|
OZZY [WEST GERMANY!]
|
|
PACO [SPAIN!]
|
|
PSYCHE / PP [WEST GERMANY!]
|
|
ROMKERNAL [USA!]
|
|
THE WANDERER [WEST GERMANY!]
|
|
TECHNIQUE [USA!]
|
|
TIMESCAPE [ITALY]
|
|
WILBO / PP [WEST GERMANY!]
|
|
WIZLER [WEST GERMANY!]
|
|
WHITEHEAT [WEST GERMANY!]
|
|
|
|
AND TO ALL OTHERS WHICH SUPPORTED ME WITH
|
|
INFORMATIONS AND ALL THE GREAT/FANTASTIC
|
|
HINTS ABOUT BLUEBOXING...
|
|
[SPECIAL TO CCITT-BERN! (HEHE)]
|
|
|
|
|
|
--------------------------------------
|
|
> THE TEXT WAS WRITTEN <
|
|
> BY GURU JOSH <
|
|
> OF <
|
|
> PHREAKER'S PARADISE! <
|
|
> AND! <
|
|
> PHUN CLUB! <
|
|
> <
|
|
> HOW TO GET IN TOUCH, WITH ME !? <
|
|
>____________________________________<
|
|
> <
|
|
> WRITE ME A INTERNET/USENET MESSAGE <
|
|
> <
|
|
> MY ADDRESS: <
|
|
>------------------------------------<
|
|
> hellfire@hiss.han.sub.org <
|
|
> hellfire@hiss.han.de <
|
|
>____________________________________<
|
|
> <
|
|
> SIMPLE WRITE A MESSAGE TO : <
|
|
> ----------------------------- <
|
|
> "HELLFIRE" OR "GURU JOSH" <
|
|
> ----------------------------- <
|
|
>____________________________________<
|
|
|
|
|
|
SIGNED IN PEACE: GURU JOSH
|
|
|
|
|
|
---------------------------------------
|
|
NOW, FOLLOWING OTHER TEXTFILE'S WRITTEN
|
|
BY SOME DIFFERENT PEOPLE AROUND THE
|
|
WHOLE WORLD...
|
|
---------------------------------------
|
|
|
|
Note to sysops: You are welcome to
|
|
download this file and use it on
|
|
your system, providing you DO NOT
|
|
remove the credits for Mark Tabas
|
|
or KAOS. In other words, try to act
|
|
like a human being!
|
|
--------------------------------------
|
|
|
|
|
|
The Mark Tabas encounter
|
|
series presents:
|
|
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
Better Homes and Blue Boxing
|
|
|
|
Part I
|
|
|
|
Theory of Operation
|
|
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
|
|
To quote Karl Marx, blue boxing has
|
|
always been the most noble form of
|
|
phreaking. As opposed to such things
|
|
as using an MCI code to make a free
|
|
fone call, which is merely mindless
|
|
pseudo-phreaking, blue boxing is
|
|
actual interaction with the Bell
|
|
System toll network. It is likewise
|
|
advisable to be more cautious when
|
|
blue boxing, but the careful phreak
|
|
will not be caught, regardless of what
|
|
type of switching system he is under.
|
|
In this part, I will explain how and
|
|
why blue boxing works, as well as
|
|
where. In later parts, I will give
|
|
more practical information for blue
|
|
boxing and routing information.
|
|
To begin with, blue boxing is simply
|
|
communicating with trunks. Trunks must
|
|
not be confused with subscriber lines
|
|
(or "customer loops") which are
|
|
standard telefone lines. Trunks are
|
|
those lines that connect central
|
|
offices. Now, when trunks are not in
|
|
use (i.e., idle or "on-hook" state)
|
|
they have 2600Hz applied to them. If
|
|
they are two-way trunks, there is
|
|
2600Hz in both directions. When a
|
|
trunk IS in use (busy or "off-hook"
|
|
state"), the 2600Hz is removed from
|
|
the side that is off-hook. The 2600Hz
|
|
is therefore known as a supervisory
|
|
signal, because it indicates the
|
|
status of a trunk; on hook (tone) or
|
|
off-hook (no tone). Note also that
|
|
2600Hz denoted SF (single frequency)
|
|
signalling and is "in-band." This is
|
|
very important. "In-band" means that
|
|
is is within the band of frequencies
|
|
that may be transmitted over normal
|
|
telefone lines. Other SF signals, such
|
|
as 3700Hz are used also. However, they
|
|
cannot be carried over the telefone
|
|
network normally (they are "out-of-
|
|
band") and are therefore not able to
|
|
be taken advantage of as 2600Hz is.
|
|
Back to trunks. Let's take a
|
|
hypothetical phone call. You pick up
|
|
your fone and dial 1+806-258-1234
|
|
(your good friend in Armarillo,
|
|
Texas). For ease, we'll assume that
|
|
you are on #5 Crossbar switching and
|
|
not in the 806 area. Your central
|
|
office (CO) would recognize that
|
|
806 is a foreign NPA, so it would
|
|
route the call to the toll centre
|
|
that serves you. [For the sake of
|
|
accuracy here, and for the more
|
|
experienced readers, note that the
|
|
CO in question is a class 5 with
|
|
LAMA that uses out-of-band SF
|
|
supervisory signalling]. Depending
|
|
on where you are in the country, the
|
|
call would leave your toll centre
|
|
(on more trunks) to another toll
|
|
centre, or office of higher "rank".
|
|
Then it would be routed to central
|
|
office 806-258 eventually and the
|
|
call would be completed. Illustration:
|
|
|
|
A---CO1-------TC1------TC2----CO2----B
|
|
|
|
A=you CO1=your central office
|
|
TC1=your toll office.
|
|
TC2=toll office in Amarillo.
|
|
CO2=806-258 central office.
|
|
B=your friend (806-258-1234)
|
|
|
|
In this situation it would be
|
|
realistic to say that CO2 uses SF
|
|
in-band (2600Hz) signalling, while
|
|
all the others use out-of-band
|
|
signalling (3700Hz). If you don't
|
|
understand this, don't worry too much.
|
|
I am pointing this out merely for the
|
|
sake of accuracy. The point is that
|
|
while you are connected to 806-258-
|
|
1234, all those trunks from YOUR
|
|
central office (CO1) to the 806-258
|
|
central office (CO2) do *NOT* have
|
|
2600Hz on them, indicating to the
|
|
Bell equipment that a call is in
|
|
progress and the trunks are in use.
|
|
Now let's say you're tired of
|
|
talking to your friend in Amarillo
|
|
(806-258-1234) so you send a 2600Hz
|
|
down the line. This tone travels down
|
|
the line to your friend's central
|
|
office (CO2) where it is detected.
|
|
However, that CO thinks that the
|
|
2600Hz is originating from Bell
|
|
equipment, indicating to it that
|
|
you've hung up, and thus the trunks
|
|
are once again idle (with 2600Hz
|
|
present on them). But actually, you
|
|
have not hung up, you have fooled the
|
|
equipment at your friend's CO into
|
|
thinking you have. Thus,it disconnects
|
|
him and resets the equipment to
|
|
prepare for the next call. All this
|
|
happens very quickly (300-800ms for
|
|
step-by-step equipment and 150-400ms
|
|
for other equipment).
|
|
When you stop sending 2600Hz (after
|
|
about a second), the equipment thinks
|
|
that another call is coming towards
|
|
it (e.g. it thinks the far end has
|
|
come "off-hook" since the tone has
|
|
stopped. It could be thought of as a
|
|
toggle switch: tone --> on hook, no
|
|
tone -->off hook. Now that you've
|
|
stopped sending 2600Hz, several things
|
|
happen:
|
|
1) A trunk is seized.
|
|
|
|
2) A "wink" is sent to the CALLING end
|
|
from the CALLED end indicating that
|
|
the CALLED end (trunk) is not ready to
|
|
receive digits yet.
|
|
|
|
3) A register is found and attached
|
|
to the CALLED end of the trunk within
|
|
about two seconds (max).
|
|
|
|
4) A start-dial signal is sent to the
|
|
CALLING end from the CALLED end
|
|
indicating that the CALLED end is
|
|
ready to receive digits.
|
|
|
|
Now, all of this is pretty much
|
|
transparent to the blue boxer. All he
|
|
really hears when these four things
|
|
happen is a <beep><kerchunk>. So,
|
|
seizure of a trunk would go something
|
|
like this:
|
|
|
|
1> Send a 2600Hz
|
|
2> Terminate 2600Hz after 1-2 secs.
|
|
3> [beep][kerchunk]
|
|
|
|
Once this happens, you are connected
|
|
to a tandem that is ready to obey your
|
|
every command. The next step is to
|
|
send signalling information in order
|
|
to place your call. For this you must
|
|
simulate the signalling used by
|
|
operators and automatic toll-dialing
|
|
equipment for use on trunks. There
|
|
are mainly two systems, DP and MF.
|
|
However, DP went out with the dinosaur
|
|
, so I'll only discuss MF signalling.
|
|
MF (multi-frequency) signalling is the
|
|
signalling used by the majority of the
|
|
inter- and intra-lata network. It is
|
|
also used in international dialing
|
|
known as the CCITT no.5 system.
|
|
MF signalling consists of 7 frequen-
|
|
cies, beginning with 700Hz and
|
|
separated by 200Hz. A different set of
|
|
two of the 7 frequencies represent the
|
|
digits 0 thru 9, plus an additional 5
|
|
special keys. The frequencies and uses
|
|
are as follows:
|
|
|
|
Frequencies (Hz) Domestic Int'l
|
|
--------------------------------------
|
|
700+900 1 1
|
|
700+1100 2 2
|
|
900+1100 3 3
|
|
700+1300 4 4
|
|
900+1300 5 5
|
|
1100+1300 6 6
|
|
700+1500 7 7
|
|
900+1500 8 8
|
|
1100+1500 9 9
|
|
1300+1500 0 0
|
|
|
|
700+1700 ST3p Code 11
|
|
900+1700 STp Code 12
|
|
1100+1700 KP KP1
|
|
1300+1700 ST2p KP2
|
|
1500+1700 ST ST
|
|
|
|
The timing of all the MF signals is
|
|
a nominal 60ms, except for KP, which
|
|
should have a duration of 100ms. There
|
|
should also be a 60ms silent period
|
|
between digits. This is very flexible,
|
|
however, and most Bell equipment will
|
|
accept outrageous timings.
|
|
In addition to the standard uses
|
|
listed above, MF pulsing also has
|
|
expanded usages known as "expanded
|
|
inband signalling" that include such
|
|
things as coin collect, coin return,
|
|
ringback, operator attached, and
|
|
operator released. KP2, code 11, and
|
|
code 12 and the ST_ps (STart "primes")
|
|
all have special uses which will be
|
|
mentioned only briefly here.
|
|
To complete a call using a blue box,
|
|
once seizure of a trunk has been
|
|
accomplished by sending 2600Hz and
|
|
pausing for the <beep><kerchunk>, one
|
|
must first send a KP. This readies the
|
|
register for the digits that follow.
|
|
For a standard domestic call, the KP
|
|
would be followed by either 7 digits
|
|
(if the call were in the same NPA as
|
|
the seized trunk) or 10 digits (if the
|
|
call were not in the same NPA as the
|
|
seized trunk). [Exactly like dialing a
|
|
normal fone call]. Following either
|
|
the KP and 7 or 10 digits, a STart is
|
|
sent to signify that no more digits
|
|
follow. Example of a complete call:
|
|
|
|
1> Dial 1-806-258-1234
|
|
2> wait for a call-progress
|
|
indication (such as ring, busy,
|
|
recording, etc.)
|
|
3> Send 2600Hz for about 1 second.
|
|
4> Wait for about 2 seconds while a
|
|
trunk is seized.
|
|
5> Send KP+305+994+9966+ST
|
|
|
|
The call will then connect if every-
|
|
thing was done properly. Note that if
|
|
a call to an 806 number were being
|
|
placed in the same situation, the area
|
|
code would be omitted and only KP+
|
|
seven digits+ST would be sent.
|
|
Code 11 and code 12 are used in
|
|
international calling to request
|
|
certain types of operators. KP2 is
|
|
used in international calling to route
|
|
a call other than by way of the normal
|
|
route, whether for economic or
|
|
equipment reasons.
|
|
STp, ST2p, and ST3p (prime, two
|
|
prime, and three prime) are used in
|
|
TSPS signalling to indicate calling
|
|
type of call (such as coin-direct
|
|
dialed).
|
|
This has been Part I of Better
|
|
Homes and Blue Boxing. I hope you
|
|
enjoyed and learned from it. If you
|
|
have any questions, comments, threats
|
|
or insults, please fell free to drop
|
|
me a line. If you have noticed any
|
|
errors in this text (yes, it does
|
|
happen), please let me know and
|
|
perhaps a correction will be in order.
|
|
Part II will deal mainly with more
|
|
advanced principles of blue boxing,
|
|
as well as routings and operators.
|
|
|
|
Note 1: other highly trunkable
|
|
areas include: 816,305,813,609,205.
|
|
I personally have excellent luck
|
|
boxing off of 609-953-0000. Try that
|
|
if you have any trouble.
|
|
......................................
|
|
(c) January 7, 1985 Mark Tabas
|
|
......................................
|
|
$$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$
|
|
|
|
|
|
|
|
The Mark Tabas encounter series
|
|
presents...
|
|
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
Better Homes and Blue Boxing
|
|
Part ii
|
|
Practical Applications
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
(It is assumed that the reader has read
|
|
and understood Part i of this series).
|
|
|
|
The essential purpose of blue boxing
|
|
in the beginning was merely to receive
|
|
toll services free of charge. Though
|
|
this can still be done, blue boxing has
|
|
essentially outlived its usefulness in
|
|
this area. Modern day "extenders" and
|
|
long distance services provide a safer
|
|
and easier way to make free fone calls.
|
|
However, you can do things with a blue
|
|
box that just can't be done with any-
|
|
thing else. For ordinary toll-fraud, a
|
|
blue box is impractical for the
|
|
following reasons:
|
|
|
|
1. Clumsy equipment required (blue
|
|
box or equivalent)
|
|
2. Most boxed calls must be made
|
|
through an extender. Not for
|
|
safety reasons, but for reasons
|
|
I'll explain later.
|
|
3. Connections are often sacrificed
|
|
because considerable distances
|
|
must be dialed to cross a
|
|
seizable trunk, in addition to
|
|
awkward routing.
|
|
|
|
As stated in reason #2, boxed calls
|
|
are usually made through an extender.
|
|
This is for billing reasons. If you
|
|
recall from Part i, 2600Hz is used as a
|
|
"supervisory" signal. That is, it
|
|
signals the status of a trunk--
|
|
"on-hook" or "off-hook." When you
|
|
seize a trunk (by briefly sending
|
|
2600Hz), your end (the CALLING end)
|
|
goes on hook for the duration of the
|
|
2600Hz and then goes off-hook once
|
|
again when the 2600Hz is terminated.
|
|
The CALLED end recognizes that a call
|
|
is on the way and attaches a register,
|
|
which inerprets the digits which are
|
|
to be sent. Now, understand that even
|
|
though your end has come off-hook
|
|
(no 2600Hz present), the other end is
|
|
still on-hook. You may wonder then,
|
|
why, if the other end (the CALLED end)
|
|
is still on-hook, there is no 2600Hz
|
|
coming the other way on the trunk,
|
|
when there should be. This is correct.
|
|
2600Hz *IS* present on the trunk when
|
|
you seize it and afterwards, but you
|
|
cannot hear it because of a Band
|
|
Elimination Filter (BEF) at your
|
|
central office.
|
|
Back to the problem. Remember that
|
|
when you seize a trunk, 2600Hz is
|
|
indeed coming the other way on the
|
|
trunk because the CALLED end is still
|
|
on-hook, but you don't actually hear
|
|
it because of a filter. However, the
|
|
Bell equipment knows it's there (they
|
|
can "hear" it). The presence of the
|
|
2600Hz is telling the billing equip-
|
|
ment that your call has not yet been
|
|
completed (i.e., the CALLED end is
|
|
still on-hook). When finally you do
|
|
connect with your boxed call, the
|
|
2600Hz from the called end terminates.
|
|
This tells the billing equipment that
|
|
someone picked up the fone at the
|
|
CALLED end and you should begin to be
|
|
billed. So you do start to get billed,
|
|
but for the call to the trunk, NOT the
|
|
boxed call. Your billing equipment
|
|
thinks that you've connected with the
|
|
number you used to seize the trunk.
|
|
|
|
Illustration:
|
|
|
|
1. You call 1+806-258-2222
|
|
(directly)
|
|
2. Status of trunks:
|
|
|
|
<----------------------------------->
|
|
(You) 806-258-2222
|
|
No 2600Hz-------> <------------2600Hz
|
|
|
|
When you seize a trunk (before the
|
|
number you called answers) there is
|
|
no affect on your billing equipment.
|
|
It simply thinks that you're still
|
|
waiting for the call to complete
|
|
(the CALLED end is still on-hook; it
|
|
is ringing, busy, going to recorder
|
|
or intercept operator.
|
|
Now, let's say that you've sezied
|
|
a trunk (806-258-2222) and for example,
|
|
KP+314+949+1705+ST. The call is routed
|
|
from the tandem you seized to:
|
|
314-949-1705.
|
|
|
|
Illustration:
|
|
|
|
<------------------>O<--------------->
|
|
(You) 806 314-949
|
|
tandem
|
|
No 2600Hz----------> <----------2600Hz
|
|
|
|
Note that the entire path towards
|
|
the right (the CALLED end) has no
|
|
2600Hz present and is therefore "off-
|
|
hook." The entire path towards the left
|
|
(the CALLING end) does have 2600Hz
|
|
present on it, indicating that the
|
|
CALLED end has not picked up (or come
|
|
"off-hook"). When 314-949-1705 answers,
|
|
"answer supervision" is given and the
|
|
2600Hz towards the left (the CALLING
|
|
end) terminates. This tells your
|
|
billing equipment, which thinks that
|
|
you're still waiting to be connected
|
|
with 806-258-2222, that you've
|
|
finally connected. Billing then begins
|
|
to 806-258-2222. Not exactly an
|
|
auspicious beginning for an aspiring
|
|
young phone phreak.
|
|
To avoid this, several actions may
|
|
be taken. As previously mentioned,
|
|
one may avoid being charged for the
|
|
number called to seize a trunk by
|
|
using an extender (in which case the
|
|
extender will get billed). In some
|
|
areas, boxing may be accomplished
|
|
using an 800 number, generally in the
|
|
format of 800-858-xxxx (many Amarillo
|
|
numbers) or 800-NN2-xxxx (special
|
|
intra-state class in-WATS numbers).
|
|
However, boxing off of 800 numbers is
|
|
impossible in many areas. In my area,
|
|
Denver, I am served by #1A ESS and it
|
|
is impossible for me to box off of
|
|
any 800 number.
|
|
Years ago, in the early days of blue
|
|
boxing (before my time), phreaks often
|
|
used directory assistance to box off
|
|
of because they were "free" long
|
|
distance calls. However, because of
|
|
competetive long distance companies,
|
|
directory assistance surcharges are
|
|
now $0.50 in many areas. It is
|
|
additionally advised that directory
|
|
assistance numbers not be used to box
|
|
from because of the following:
|
|
Average DA calls last under 2
|
|
minutes. When you box a call, chances
|
|
are that it will last considerably
|
|
longer. Thus, the Bell billing equip-
|
|
ment will make a note of calls to
|
|
directory assistance that last a long
|
|
time. A call to a directory assistant
|
|
lasting for 4 hours and 17 minutes
|
|
may appear somewhat suspicious.
|
|
Although the date, time, and length
|
|
of a DA call do not appear on the bill,
|
|
it is recorded on AMA tape and will
|
|
trip a trouble report if it were to
|
|
last too long. This is how most
|
|
phreaks were discovered in the old
|
|
days. Also, sometimes too many calls
|
|
lasting too long to one 800 number
|
|
may raise a few eyebrows at the local
|
|
security office.
|
|
Assuming you can complete a blue box
|
|
call, the following are listed routings
|
|
for various Bell internal operators.
|
|
These are in the format of KP+NPA+
|
|
special routing+1X1+ST, which I will
|
|
explain later. The 1X1 is the actual
|
|
operator routing, and NPA and NPA+
|
|
special routing are used for out-of-
|
|
area code calls and out-of-area code
|
|
calls requiring special routing,
|
|
respectively.
|
|
|
|
KP+101+ST ...... toll test board
|
|
KP+121+ST ...... inward op
|
|
KP+131+ST ...... directory assistance
|
|
KP+141+ST ...... was rate & route. Now
|
|
only works in 312, 815, 717,
|
|
and a few others. It has
|
|
been replaced with a univer-
|
|
sal rate & route number,
|
|
800+141+1212.
|
|
KP+151+ST ...... overseas completion
|
|
operator (inbound). Works
|
|
only in certain NPAs, such as
|
|
303.
|
|
KP+181+ST ...... in some areas, toll
|
|
station for small towns
|
|
|
|
Thus, if you seize a trunk in 806 NPA
|
|
and wanted an inward (in 806), then you
|
|
would dial KP+121+ST. If you wanted a
|
|
312 inward and were dialing on an 806
|
|
trunk, an area code would be required.
|
|
Thus, you would dial KP+312+121+ST.
|
|
Finally, some places in the network
|
|
require special routing, in addition to
|
|
an area code. An example is Franklin
|
|
Park, Ill. It requires a special
|
|
routing of 032. For this, you would
|
|
dial KP+312+032+121+ST for a Franklin
|
|
Park inward operator.
|
|
Special routings are in the format
|
|
of 0XX. They are used primarily for
|
|
load balance, so that traffic flow
|
|
may be evenly distributed. About half
|
|
of the exchanges in the network
|
|
require special routing. Note that
|
|
special routings are NEVER EVER EVER
|
|
used to dial normal telephone numbers,
|
|
only operators.
|
|
|
|
Operator functions:
|
|
|
|
TOLL TEST BOARD- Generally a cordboard
|
|
position that assists in trunk testing.
|
|
They are not used by operators, only
|
|
switchmen.
|
|
|
|
INWARD- Assists the normal TSPS (0+)
|
|
operator in completing calls out of
|
|
the TSPS's area. Also, inwards perform
|
|
emergency inerrupts when the number to
|
|
be interrupted is out of the area code
|
|
of the original (TSPS) operator. For
|
|
example, a 303 operator has a customer
|
|
that needs an emergency interrupt on
|
|
215-647-6969. The 303 operator gets
|
|
the routing for the inward that covers
|
|
215-647, since she cannot do the
|
|
interrupt herself. The routing is
|
|
found to be only 215+ (no special
|
|
routing required). So, the 303 operator
|
|
keys KP+215+121+ST. An inward answers
|
|
and the 303 says to her, "Inward, this
|
|
is Denver. I need an emergency
|
|
interrupt on 215-647-6969. My
|
|
customer's name is Mark Tabas." The
|
|
inward will then do the interrupt (off
|
|
the line, of course). If the number to
|
|
be interrupted had required special
|
|
routing, such as, say, 312-456-1234
|
|
(spec routing 032), then the 303
|
|
operator would dial KP+312+032+121+ST
|
|
for the inward to do that interrupt.
|
|
|
|
DIRECTORY ASSISTANCE- These are the
|
|
normal NPA+555+1212 operators that
|
|
assist customers with obtaining
|
|
telefone directory listings. Not much
|
|
toll-fraud potential here, except
|
|
maybe $0.50.
|
|
|
|
RATE AND ROUTE- These operators are
|
|
reached by dialing KP+800+141+1212+ST.
|
|
They assist normal (TSPS) operators
|
|
with rates and routings (thus the
|
|
name). The only uses I typically have
|
|
for them are the following:
|
|
|
|
1. Routing information. In the above
|
|
example, when the 303 operator needed
|
|
to dial an inward that served 215-647,
|
|
she needed to know if any special
|
|
routing was required and, if so, what
|
|
it was. Assuming she would use rate
|
|
and route, she would dial them and say
|
|
nicely, "Operator's route, please, for
|
|
215-647." Rate & route would respond
|
|
with "215 plus." This means that the
|
|
operator would dial KP+215+121+ST to
|
|
reach the inward that serves 215-647.
|
|
If there were special routing required,
|
|
such as in 312-456, rate & route would
|
|
respond with "312 plus 032 plus." In
|
|
that case, the operator would dial
|
|
KP+312+032+ST for the inward that
|
|
serves 312-456.
|
|
It is good practice to ask for
|
|
"operator's route" specifically, as
|
|
there are also "numbers route" and
|
|
"directory routes." If you do not
|
|
specifically ask for operator's route,
|
|
rate & route will generally assume
|
|
that is what you want anyway.
|
|
"Numbers" route refers to overseas
|
|
calls. Example, you want to know how to
|
|
reach a number in Geneva, Switzerland
|
|
(and you already have the number). You
|
|
would call routing and say "Numbers
|
|
route, please, Geneva, Switzerland."
|
|
The operator would respond with:
|
|
"Mark 41+22. 011+041+ST (plus) 041+22"
|
|
The "Mark 41+22" has to do with
|
|
billing, so disregard it. The 011+041
|
|
is access to the overseas gateway (to
|
|
be discussed in Part iii) and the 041+
|
|
22+ is the routing for Geneva from the
|
|
overseas sender.
|
|
"Directory" routings are for directory
|
|
assistance overseas. Example:
|
|
you want a DA in Rome, Italy. You would
|
|
call rate & route and say, "Directory
|
|
routing please, for Rome, Italy." They
|
|
would respond with "011+039+ST (plus)
|
|
039+1108 STart." As in the previous
|
|
example, the 011+039 is access to the
|
|
overseas gateway. The 039+1108 is a
|
|
directory assistant in Rome.
|
|
|
|
2. Nameplace information. Rate & Route
|
|
will give you the location of an NPA+
|
|
exchange. Example: "Nameplace please,
|
|
for 215-648." The operator would
|
|
respond with "Paoli, Pennsylvania."
|
|
This isn't especially useful, since you
|
|
can get the same information (legally)
|
|
by dialing 0, but using rate & route is
|
|
often much faster and it avoids having
|
|
to hang up when you are already on a
|
|
trunk.
|
|
|
|
*NOTE on Rate & Route: As a blue boxer,
|
|
always ask for "IOTC" routings. (e.g.,
|
|
"IOTC operator's route", "IOTC numbers
|
|
route", etc.) This tells them that you
|
|
want cordboard-type routings, not TSPS,
|
|
because a blue boxer is actually just a
|
|
cordboard position (that Bell doesn't
|
|
know about).
|
|
|
|
OVERSEAS COMPLETION OPERATOR (inbound)-
|
|
These operators (KP+151+ST) assist in
|
|
the completion of calls coming in to
|
|
the United States from overseas. There
|
|
are KP+151+ST operators only in a few
|
|
NPAs in the country (namely 303). To
|
|
use one, you would seize a trunk and
|
|
dial KP+303+151+ST. Then you would
|
|
tell the operator, for example, "This
|
|
is Bangladesh calling. I need U.S.
|
|
number 215-561-0562 please." [in a
|
|
broken Indian accent]. She would
|
|
connect you, and the bill would be
|
|
sent to Bangladesh (where I've been
|
|
billing my KP+151+ST calls for two
|
|
years).
|
|
|
|
Other internal Bell Operators.
|
|
|
|
KP+11501+ST ...... universal operator
|
|
KP+11511+ST ...... conference op
|
|
KP+11521+ST ...... mobile op
|
|
KP+11531+ST ...... marine op
|
|
KP+11541+ST ...... long distance
|
|
terminal
|
|
KP+11551+ST ...... time & charges op
|
|
KP+11561+ST ...... hotel/motel op
|
|
KP+11571+ST ...... overseas (outbound)
|
|
op
|
|
|
|
These 115X1 operators are identical
|
|
in routing to the 1X1 operators listed
|
|
previously, with one exception. If
|
|
special routing is required (0XX),
|
|
then the trailing 1 is left off.
|
|
|
|
Examples:
|
|
|
|
A 312 universal op ... KP+312+11501+ST
|
|
A Franklin Park (312-456) universal
|
|
op (special routing 032 required)....
|
|
................... KP+312+032+1150+ST
|
|
[The trailing 1 of 11501 is left off].
|
|
|
|
Purposes of 115X1 operators.
|
|
|
|
UNIVERSAL- Used for collect/callback
|
|
calls to coin stations.
|
|
|
|
CONFERENCE- This is a cordboard
|
|
conference operator who will set up a
|
|
conference for a customer on a manual
|
|
operation basis.
|
|
|
|
MOBILE- Assists in completion of calls
|
|
to mobile (IMTS) type telefones
|
|
|
|
MARINE- Assists in completion of calls
|
|
to ocean going vessels.
|
|
|
|
LONG DISTANCE TERMINAL- Now obsolete.
|
|
Was used for completion of long
|
|
distance calls.
|
|
|
|
TIME & CHARGES- Will give exact costs
|
|
of calls. Used to time calls and
|
|
inform customer of exactly how much
|
|
it cost.
|
|
|
|
HOTEL/MOTEL- Handles calls to/from
|
|
hotels and motels.
|
|
|
|
OVERSEAS COMPLETION (outbound)- assists
|
|
in completion of calls to overseas
|
|
points. Only works in some, if any
|
|
NPAs, because overseas assistance has
|
|
been centraized to IOCC (covered in
|
|
Part iii).
|
|
|
|
Note that all KP+1X1+ST and
|
|
KP+115X1+ST operators automatically
|
|
assume that you are a TSPS or cordboard
|
|
operator assisting a customer with a
|
|
call. DO NOT DO ANYTHING TO JEOPARDIZE
|
|
THIS! If you do not know what to do,
|
|
don't call these operators! Find out
|
|
what to do first.
|
|
|
|
This concludes Part iii. There is
|
|
one final part in which I will explain
|
|
overseas dialing, IOCC (International
|
|
Overseas Completion Centre), RQS
|
|
(Rate/Quote System), and some basic
|
|
scanning.
|
|
|
|
.......................................
|
|
(c) February 6, 1900 Mark Tabas
|
|
.......................................
|
|
|
|
|
|
|
|
|
|
The Mark Tabas encounter series
|
|
presents...
|
|
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
Better Homes and Blue Boxing
|
|
Part iii
|
|
Advanced Signalling
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
(It is assumed that the reader has read
|
|
and$understood parts i & ii before
|
|
proceeding to this part).
|
|
|
|
In parts i & ii, I covered basic
|
|
theory and domestic singalling and
|
|
operators. In this part I will explain
|
|
overseas direct boxing, the IOCC, the
|
|
RQS, and some basic scanning methods.
|
|
|
|
Overseas Dipect Boxing.
|
|
|
|
Calling outside of the United States
|
|
and Canada is accomplished by using an
|
|
"overseas gateway." There are 7 over-
|
|
seas gateways in the Bell System,
|
|
and each one is designated to serve a
|
|
certain region of the world. To
|
|
initiate an overseas call, one must
|
|
first access the gateway that the call
|
|
is to be sent on. To do this auto-
|
|
matically, decide which country you are
|
|
calling and find its country code.
|
|
Then, pad it to the left with zeros as
|
|
required so it is three digits. [Add
|
|
1, 2, or 3 zeros as required].
|
|
|
|
Examples:
|
|
|
|
Luxembourg (352) is 352 (stays the
|
|
same)
|
|
Spain (34) becomes 034 (1 zero added)
|
|
U.S.S.R. (7) becomes 007 (2 zeros
|
|
added)
|
|
Next, seize a trunk and dial KP+011+
|
|
CC+ST. Note that CC is the three digit
|
|
padded country code that you just
|
|
determined by the above method. [For
|
|
Luxembourg, dial KP+011+352+ST, Spain
|
|
KP+011+034+ST, and the U.S.S.R. KP+011+
|
|
007+ST]. This is done to route you to
|
|
the appropriate overseas gateway that
|
|
handles the country you are dialing.
|
|
Even though every gateway will allow
|
|
you to dial every dialable country, it
|
|
is good practice to use the gateway
|
|
that is designated for the country you
|
|
are calling.
|
|
After dialing KP+011+CC+ST (as CC is
|
|
defined above) you should"be connected
|
|
to an overseas gateway. It will
|
|
acknowledge by sending a wink (which
|
|
is audible as a <beep><kerchink> and a
|
|
dial tone. Once you receive internat-
|
|
ional dial tone, you may route your
|
|
call one of two ways: a) as an
|
|
operator-originated call, or b) as a
|
|
customer-originated call. To go as a
|
|
operator-originated call, key KP+
|
|
country code (NOT padded with zeros)+
|
|
city code+number+ST. You will then be
|
|
connected, providing the country you
|
|
are calling can receive direct-dialed
|
|
calls. The U.S.S.R. is an example of
|
|
a country that cannot.
|
|
|
|
Example of a boxed int'l call:
|
|
|
|
To make a call to the Pope (Rome,
|
|
Italy), first obtain the country code,
|
|
which is 39. Pad it with zeros so that
|
|
it is 039. Seize a trunk and dial
|
|
KP+011+039+ST. Wait for sender dial
|
|
tone anf then dial KP+39+6+6982+ST.
|
|
39 is the country code, 6 is the city
|
|
code, and 6982 is the Pope's number in
|
|
Rome. To go as an operator-originated
|
|
call, simply place a zero in front of
|
|
the country code when dialing on the
|
|
gateway. Thus, KP+0+39+6+6982+ST woulf
|
|
be dialed at sender dial tone. Routing
|
|
your call as operator-originated does
|
|
not affect much unless you are dialing
|
|
an operator in a foreign country
|
|
To dial an operator in a foreign
|
|
country, you must first obtain the
|
|
operator routing from rate & route for
|
|
that country. Dial rate & route and if
|
|
you're trying to get an operator in
|
|
Yugoslavia, say nicely, "IOTC
|
|
Operator's route, please, for
|
|
Yugoslavia." [In larger countries it
|
|
may be necessary to specify a city].
|
|
Rate & route will respond with,
|
|
"38 plus 11229". So, dial your over-
|
|
seas gateway, KP+011+038+ST, wait for
|
|
sender dial tone, and key KP+0+38+
|
|
11029+ST. You should then get an
|
|
operator in Yugoslavia. Note that you
|
|
must prefix the country code on the
|
|
sender with a 0 because presumably
|
|
only an operator here can dial an
|
|
operator in a foreign country.
|
|
When you dial KP+011+CC+ST for an
|
|
overseas gateway, it is translated to
|
|
a 3-digit sender code of the format
|
|
18X, depending on which sender is
|
|
designated to handle the country you
|
|
are dialing. The overseas$gateways and
|
|
their 3-digit codes are listed below.
|
|
|
|
182 ..... White Plains, NY
|
|
183 ..... New York, NY
|
|
184 ..... Pittsburg, PA
|
|
185 ..... Orlando, FL
|
|
186 ..... Oakland, CA
|
|
187 ..... Denver, CO
|
|
188 ..... New York, NY
|
|
|
|
Dialing KP+182+ST would get you the
|
|
sender in White Plains, and KP+183+ST
|
|
would get the sender in NYC, etc., but
|
|
the KP+011+CC+ST is highly suggested
|
|
(as previously mentioned). To find out
|
|
what sender you were routed to after
|
|
dialing KP+011+CC+ST, dial (at int'l
|
|
dial tone): KP+0020000+ST.
|
|
If you have difficulty in reaching
|
|
a sender, call rate and route and ask
|
|
for a numbers route for the country
|
|
you're dialing. Sometimes, KP+011+
|
|
padded country code+ST will not work.
|
|
I have found this in many 3-digit
|
|
country codes. Lexembourg, country
|
|
code 352, for example, should be
|
|
KP+011+352+ST theoretically. But it
|
|
is not. In this case, dial KP+011+
|
|
003+ST for the overseas gateway. If
|
|
you have trouble, try dialing KP+00+
|
|
first digit of country code+ST, or
|
|
call rate The IOCC.
|
|
|
|
Sometimes when"you call rate and
|
|
route and ask for an "IOTC numbers
|
|
route" or "IOTC operators route" for
|
|
a foreign country, you will get
|
|
something like "160+700" (as in the
|
|
case of the Soviet Union). This means
|
|
that the country is not dialable
|
|
directly and must be handled through
|
|
the International Overseas Completion
|
|
Centre (IOCC). For an IOCC routing,
|
|
pad the country code to the RIGHT with
|
|
zeros until it is 3 digits. Then KP+160
|
|
is dialed, plus the padded country
|
|
code, plus ST.
|
|
|
|
Examples:
|
|
|
|
The U.S.S.R. (7) ...... KP+160+700+ST
|
|
Japan (81) ............ KP+160+810+ST
|
|
Uraguay (598) ......... KP+160+598+ST
|
|
|
|
You will then be routed to the IOCC
|
|
in Pittsburg, PA, who will ask for
|
|
country, city, and number being dialed.
|
|
Many times they will ask for a ringback
|
|
[thanks to Telenet"Bob] so have a loop
|
|
ready. They will then place the call
|
|
and call you back (or sometimes put
|
|
you through directly). Some calls, such
|
|
as to Moscow, take several hours.
|
|
|
|
The Rate Quote System (RQS).
|
|
|
|
The RQS is the operator's rate/quote
|
|
system. It is a computer used by TSPS
|
|
(0+) operators to get rate and route
|
|
information without having to dial the
|
|
rate and route operator. In Part ii,
|
|
I discussed getting an inward routing
|
|
for dialing-assistance and emergency
|
|
interrupts from the rate and route
|
|
operators (KP+800+141+1212+ST). The
|
|
same information is available from
|
|
RQS. Say you want the inward routing
|
|
for 305-994. You would sieze a trunk
|
|
and dial KP+009+ST (to access the RQS).
|
|
Sometimes, if you seize a trunk in an
|
|
NPA not equipped with RQS, you need to
|
|
dial an NPA that is equipped with RQS
|
|
first, such as 303. Anyway, after you
|
|
dial KP+009+ST or KP+303+009+ST, you
|
|
will receive a wink (<beep><kerchink>)
|
|
and then RQS dial tone. At RQS dial
|
|
tone, for an inward routing for 305-994
|
|
you would dial KP+06+305+994+ST. That
|
|
is, KP+06+NPA+exchange+ST. RQS will
|
|
respond with "305 plus 033 plus". This
|
|
means you would dial KP+305+033+121+ST
|
|
for an inward that services 305-994.
|
|
If no special routing were required,
|
|
RQS would have responded with "305
|
|
plus" and you would simply dian:
|
|
KP+305+121+ST for an inward.
|
|
Another RQS feature is the echo
|
|
feature. You can use it to test your
|
|
blue box. Dial RQS (KP+009+ST) and
|
|
then key KP+07+1234567890+ST. RQS will
|
|
respond with voice identification of
|
|
the digits it recognized, between the
|
|
KP+07 and ST.
|
|
RQS can also be used for rates and
|
|
directory routings, but those are
|
|
seldom needed, so they have been
|
|
omitted here.
|
|
|
|
Simple Scanning.
|
|
|
|
If you're interested in scanning,
|
|
try dialing on a trunk, routings in the
|
|
format of KP+11XX1+ST. Begin with"11001
|
|
and scan to 11991. There are lots of
|
|
interesting things to be found there,
|
|
as Doctor Who (413 area) can tell you.
|
|
Those 11XX1 routings can also be
|
|
prefixed with an NPA, so if you want
|
|
to scan area code 212, dial KP+212+
|
|
11XX1+ST.
|
|
|
|
There, now you know as much about
|
|
blue boxing as most phreaks. If you
|
|
read and understand the material, and
|
|
put aside preconceived ideas of what
|
|
blue boxing is that you may have
|
|
aquired from inexperienced people or
|
|
other bulletin boards, you should be
|
|
well on you way to an enlightening
|
|
career in blue boxing. If you follow
|
|
the guidelines in Part i to box, you
|
|
should have no problem with the fone
|
|
company. Comments made by "phreaks" on
|
|
bulletin boards that proclaim "tracing"
|
|
of blue boxers are nonsense and should
|
|
be ignored (except for a passing
|
|
chuckle).
|
|
|
|
NOTE 1: CCIS and the downfall of blue
|
|
boxing.
|
|
|
|
CCIS stands for Common Channel Inter-
|
|
office Signalling. It is a signalling
|
|
method used between electronic
|
|
switching systems that eminiates the
|
|
use of 2600Hz and 3700Hz"supervisory
|
|
signals, and MF pulsing. This is why
|
|
many places cannot be boxed off of;
|
|
they employ CCIS, or out-of-band
|
|
signalling, which will not respond to
|
|
any tones that you generate on the
|
|
line. Eventually, all existing toll
|
|
equipment will be upgraded or replaced
|
|
with CCIS or T-carrier. In this case,
|
|
we'll all be boxing with microwave
|
|
dishes. Until then (about 1995 by
|
|
current BOC/AT&T estimates), have fun!
|
|
|
|
If you have ANY questions about this
|
|
text, please feel free to drop me a
|
|
line. I will respond to anl mail,
|
|
messages, etc. Insults are also
|
|
welcomed. And if you discover anything
|
|
interesting scanning, be sure to let
|
|
me know.
|
|
|
|
Mark Tabas
|
|
$LOD$
|
|
|
|
This text was prepared in full by Mark
|
|
Tabas for:
|
|
|
|
K.A.O.S.
|
|
Philadelphia, PA.
|
|
[215-465-3593].
|
|
|
|
Any sysop may freely download this text
|
|
and use it on his/her BBS, provided
|
|
that none of it be altered in any way.
|
|
|
|
Technical acknowledgements:
|
|
|
|
Karl Marx, X-Man, High-Rise Joe,
|
|
Telenet Bob, Lex Luthor, TUC, John Doe,
|
|
Doctor Who (413 area), The Tone Sweep,
|
|
Mr. Silicon, K00L KAT, The Glump.
|
|
|
|
References:
|
|
|
|
1. Notes on the BOC Intra-LATA Networks
|
|
Bell System publication, 1983.
|
|
2. Notes on the Network
|
|
Bell System publication, 1983.
|
|
3. Engineering and Operations in the
|
|
Bell System
|
|
Bell System publication, 1983.
|
|
4. Notes on Distance Dialing
|
|
Bell System publication, 1968.
|
|
5. Early Medieval Architecture.
|
|
.......................................
|
|
(c) February 6, 1900 Mark Tabas
|
|
.......................................
|
|
|
|
HOW TO 'BLUE BOX' INTO 'RUSSIA'
|
|
|
|
BY: MARK TABAS
|
|
|
|
---------------------------------------
|
|
|
|
HELLO,
|
|
LATELY, I HAVE BEEN QUESTIONED ABOUT
|
|
THE SUBJECT OF BOXING INTO THE SOVIET
|
|
UNION. WHILE I AM BY NO MEANS AN EXPERT
|
|
ON THIS, I HAVE PICKED UP A FEW THINGS.
|
|
|
|
STANDARD DIALING TO RUSSIA WOULD
|
|
BEGIN SOMETING LIKE THIS:
|
|
|
|
KP+011+007+ST (FOR INT'L SENDER)
|
|
KP+0+95+295+9051+ST (FOR NUMBER)
|
|
|
|
IF ALL WENT WELL, YOU WOULD BE ROUTED
|
|
INTO RUSSIA AS AN OPERATOR-ASSISTED
|
|
CALL. (BY THE WAY, THE NUMBER ABOVE IS
|
|
THE KREMLIN). HOWEVER, SINCE ALL IS NOT
|
|
WELL BETWEEN US AND THE SOVIETS, YOU
|
|
WILL PROBABLY GET A RECORDING. THIS
|
|
WILL GO SOMETHING LIKE, "INTERNATIONAL
|
|
DIRECT-DIAL SERVICE IS NO LONGER
|
|
AVAILABLE TO THE SOVIET UNION..." OR
|
|
"DUE TO CIRCUT CONGESTION IN THE
|
|
COUNTRY YOU DIALED, YOUR CALL DID NOT
|
|
COMPLETE..."
|
|
THESE RECORDINGS, HOWEVER, LIE. THEY
|
|
ARE MERELY PLACED THERE TO DETER THE
|
|
BLUE BOXER. HE HEARS THEM AND THEN,
|
|
BELIEVING THEM, GIVES UP.
|
|
SEE, THE LAST THING THAT AT&T AND THE
|
|
U.S. GOVERNMENT IN GENERAL NEED IS A
|
|
BUNCH OF 11-YEAR-OLD BLUE BOXERS
|
|
CALLING RUSSIA AND SAYING SOMETHING
|
|
LIKE: "HA HA, YOU FORNICATING COMMY
|
|
PINKOS,WE'RE GONNA BOMB THE HELL OUT OF
|
|
YOU!"
|
|
SO, THEY MAKE IT *VERY* DIFFICULT TO
|
|
BOX THE CALL. AS I SAID BEFORE, THE
|
|
RECORDINGS THAT YOU GET ARE FAKES.
|
|
WHEN NORMAL TSPS PLACE A CALL TO RUSSIA
|
|
(LEGALLY), THEY MUST CONTEND WITH THE
|
|
SAME RECORDING, ONLY INTERNATIONAL HAS
|
|
THIS NEAT EQUIPMENT THAT KEEPS DIALING
|
|
THE NUMBER OVER AND OVER AND OVER UNTIL
|
|
THE CALL GOES THROUGH. THIS NORMALLY
|
|
TAKES A FEW HOURS. IT WOULD TAKE YOU
|
|
A YEAR ON A BLUE BOX. THIS IS WHY WHEN
|
|
YOU ATTEMPT TO PLACE A LEGAL CALL TO
|
|
THE U.S.S.R., IOCC (TSPS) WILL TELL YOU
|
|
THAT THERE IS A 2-3 HOUR DELAY. OFTEN
|
|
IT IS MORE THAN THAT, IF THEY HAVE A
|
|
LINE OF CALLS.
|
|
TO HAVE IOCC PLACE A CALL, ONE WOULD
|
|
BOX KP+160+700+ST FOR RUSSIA. THIS WILL
|
|
GIVE YOU AN IOCC OPERATOR WHO ASKS FOR
|
|
COUNTRY, CITY AND NUMBER, AND A BILLING
|
|
NUMBER (THINKING THAT YOU ARE TSPS
|
|
YOURSELF). THEN THEY WANT A CUSTOMER
|
|
RINGBACK NUMBER (LOOP OR PAYFONE, IF
|
|
YOU PLAN TO HANG AROUND FOR A FEW HOURS
|
|
OR SO). HOWEVER, ON CALLS TO OTHER
|
|
COUNTRIES, THEY WILL CONNECT YOU
|
|
DIRECTLY AND DO NOT REQUIRE RINGBACK.
|
|
IOCC COUNTRY ROUTINGS ARE AS FOLLOWS:
|
|
KP+011+XXX+ST, WHERE XXX IS THE COUNTRY
|
|
CODE PADDED TO THE *RIGHT* WITH ZEROS.
|
|
TO CONTINUE ABOUT IOCC ROUTINGS, THE
|
|
COUNTRY CODE IS PADDED TO THE RIGHT
|
|
WITH ZEROS. THUS, AUSTRALIA (COUNTRY
|
|
CODE OF 61) WOULD BECOME 610, AND THE
|
|
ROUTING WOULD BE KP+160+610+ST.
|
|
THIS MESSAGE HASN'T SAID MUCH SINCE
|
|
I HAVEN'T TOLD HOW TO BOX A CALL TO
|
|
RUSSIA, I'VE JUST TALKED ABOUT ALL THE
|
|
PROBLEMS WITH CALLING THERE. THAT'S
|
|
BECAUSE IT IS EXTREMELY DIFFICULT TO
|
|
DO. UNLESS YOU ARE VERY PATIENT AND
|
|
FEEL LIKE TRYING TO BOX IT ABOUT 5000
|
|
TIMES BEFORE YOU FINALLY GET THROUGH
|
|
(IN WHICH CASE IT WOULD BE BUSY ANYWAY)
|
|
THEN YOU NEED THE HELP OF THE BELL
|
|
SYSTEM OR POSSIBLY SOME INFERIORS
|
|
LOCATED THROUGHOUT THE IRON CURTAIN.
|
|
TO PLACE A CALL TO RUSSIA, OTHER THAN
|
|
GOING THROUGH IOCC, ONE MIGHT TRY TO
|
|
CONTACT SOME SORT OF INWARD SOMEWHERE,
|
|
LIKE YUOGSLAVIA (KARL MARX'S SUGGESTION
|
|
), OR MAYBE EAST GERMANY. TO BEGIN
|
|
WITH, CALL RATE & ROUTE FOR THE IOTC
|
|
ROUTING (SAY YOU ARE ON CORDBOARD) FOR
|
|
INWARD IN YUGOSLAVIA. SHE'LL SAY SOME-
|
|
THING LIKE "038 PLUS BLAH-BLAH-BLAH"
|
|
SO YOU WOULD BOX KP+011+038+ST, WAIT
|
|
FOR INT'L TONE, THEN DIAL KP+0+38+BLAH
|
|
BLAH BLAH+121+ST. THAT SHOULD GET YOU
|
|
INWARD, YUGOSLAVIA, WHO SPEAKS LITTLE
|
|
OR NO ENGLISH AND IS AT BEST UNPLEASANT
|
|
TO DEAL WITH.
|
|
THAT'S ALL I KNOW. IF YOU HAVE A
|
|
BETTER WAY (OR ANY WAY AT ALL) TO CALL
|
|
MOTHER RUSSIA, LET ME KNOW.
|
|
|
|
MARK TABAS
|
|
|
|
|
|
The Myth of the 2600Hz Detector
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Just about everyone I talk to
|
|
these days about ESS seems to be
|
|
scared witless about the 2600Hz
|
|
detector. I don't know who thought
|
|
this one up, but it simply does not
|
|
exist. So many of you people whine
|
|
about this so-called phreak catching
|
|
device for no reason. Someone with
|
|
AT&T said they had it to catch phrea-
|
|
kers. This was just to scare the
|
|
Blue-Boxers enough to make them quit
|
|
boxing free calls.
|
|
I'm not saying ESS is without its
|
|
hang-ups, either. One thing that ESS
|
|
can detect readily is the kick-back
|
|
that the trunk circuitry sends back
|
|
to the ESS machine when your little
|
|
2600Hz tone resets the toll trunk.
|
|
After an ESS detects a kick-back it
|
|
turns an M-F detector on and recordes
|
|
any M-F tones X-mitted.
|
|
---------------------------------------
|
|
DEFEATING THE KICK-BACK DETECTOR
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
As mentioned in my previous
|
|
note, kick-back detection can be a
|
|
serious nuisance to anyone interested
|
|
in gaining control of a trunk line.
|
|
The easiest way to by-pass this
|
|
detection circuitry is not really by-
|
|
passing it at all, it is just letting
|
|
the kick-back get detected on some
|
|
other line.
|
|
This other line is your local
|
|
MCI, SPRINT, or other long distance
|
|
carrier (except AT&T). The only
|
|
catch is that the service you use
|
|
must not disconnect the line when
|
|
you hit the 2600Hz tone.
|
|
This is how you do it: Call
|
|
up your local extender, put in the
|
|
code, and dial a number in the 601
|
|
area code and the 644 exchange.
|
|
Lots of other exchanges work across
|
|
the country, I'm sure, but this is
|
|
the only one that I have found so
|
|
far. Anyway, when it starts ringing,
|
|
simply hit 2600Hz and you'll hear the
|
|
kick-back, (ka-chirp, or whatever).
|
|
Then you are ready to dial whoever
|
|
you want (conferences, inward, route
|
|
and rate, overseas, etc.) from the
|
|
trunk line in operator tones!
|
|
Since blowing 2600Hz doesn't make you
|
|
you a phreaker until the toll equip-
|
|
ment resets the line, kickback
|
|
detection is the method AT&T chooses
|
|
(for now).
|
|
This information comes as a
|
|
result of my experiments & experience
|
|
and has been verified by local AT&T
|
|
employees I have as acquaintances.
|
|
They could only say that this is
|
|
true for my area, but were pretty
|
|
sure that the same idea is imple-
|
|
mented across the country.
|
|
|
|
=======================================
|
|
|
|
Now that you know how to access a trunk
|
|
line or as operators say a loop, I will
|
|
tell you the many things you can do
|
|
with it.
|
|
|
|
Here is a list of AT&T services acces-
|
|
sible to you by using a Blue Box.
|
|
|
|
A/C+101 Toll Switching
|
|
A/C+121 Inward operator
|
|
A/C+131 Information
|
|
A/C+141 Route & Rate op.
|
|
A/C+11501 Mobile operator
|
|
A/C+11521 Mobile operator
|
|
|
|
|
|
|
|
Starting Conferances:
|
|
---------------------
|
|
|
|
This is one the most useful attributes
|
|
of blue boxing. Now the confs. are up
|
|
24 hours/day and 7 days/week and the
|
|
billing lines are being billed.
|
|
Since I beleive the above is true
|
|
(about the billing lines being billed)
|
|
I would recommend that you never let
|
|
your # show up on the conf. if you
|
|
started it, put it on a loop and then
|
|
call the loop. ENOUGH BULLSHIT!!!!!
|
|
To start the conf. dial one of these
|
|
three numbers in M-F while you are on
|
|
the trunk.
|
|
|
|
213+080+XXXX
|
|
XXXX=1050,3050
|
|
special XXXX=1000,1100,1200,1500,2200,
|
|
2500.
|
|
These #s are in L.A. and are the
|
|
most watched, I do not advise using
|
|
this NPA.
|
|
|
|
312+001+1050 or 3050
|
|
|
|
914+042+1050 or 1100,1200 ect..
|
|
|
|
|
|
***************************************
|
|
UPDATE, I BELEIVE ONLY 914 WORKS AT THE
|
|
MOMENT
|
|
***************************************
|
|
|
|
Once connected with one of these you
|
|
will either hear a re-order, busy, or
|
|
cherp. When you hear the cherp enter
|
|
the billing line in M-F. I use the
|
|
conf. dial- up.
|
|
A billing line example:
|
|
kp312+001+1050st
|
|
You will then hear two tutes and a re-
|
|
cording asking you for the # of confer-
|
|
rees including yourself. Enter a #
|
|
between 20 and 30. If you ever get over
|
|
30 people on a conferance all you will
|
|
hear is jumbled voices. After the it
|
|
says "Your conferance size is XX" then
|
|
hit # sign. Add Your favorite loop on
|
|
and hit 6 to transfer control to it.
|
|
After it says control will be transfer-
|
|
ed hang up and call the other side of
|
|
the loop, hit #sign and follow the in-
|
|
structions. A bonus for conf. is to add
|
|
an international # dial 1+011+CC+NUMBER
|
|
pretty cool ehhh.
|
|
A few extra notes.
|
|
Do not add #s that you will want to
|
|
hang up, add these through MCI or
|
|
Sprint.
|
|
|
|
You cannot blow anyone off w/2600hz
|
|
unless they are in an old X-bar or
|
|
older system.
|
|
|
|
Many D.A. operators will stay on
|
|
after you abuse them; you may have
|
|
to start another or at least don't
|
|
say any numbers.
|
|
|
|
Never add the tone side of a loop
|
|
onto a conf.
|
|
|
|
Never add more than one MCI node on
|
|
your conf.
|
|
|
|
|
|
Route & Rate:
|
|
-------------
|
|
|
|
|
|
Note Route & Rate and RQS perform the
|
|
same service.
|
|
|
|
R&R simply tells you route and
|
|
rate info which is very valuble, ex.
|
|
such as the inward routing for an ex-
|
|
change in an area code. An inward
|
|
routing will let you call her and she
|
|
can do an emergency interupt for you.
|
|
She can tell you how to get interna-
|
|
tional operators, ect.
|
|
|
|
Here are the terms you are required to
|
|
use:
|
|
|
|
International,
|
|
-operator route
|
|
for [country, city].
|
|
*Gives you inward op.
|
|
-directory route
|
|
for [country, city].
|
|
*Gives you Directory Ass.
|
|
-city route
|
|
for [country, city].
|
|
*Gives you country and city
|
|
code.
|
|
|
|
Operator route for [A/C]+
|
|
[EXCHANGE]
|
|
*Gives you inward op. route
|
|
ex. [A/C]+ or [A/C]+0XX+
|
|
when she says plus she means
|
|
plus 121.
|
|
Numbers route for [state, city]
|
|
*Gives you A/C.
|
|
|
|
Place name [A/C]+[EXCHANGE]
|
|
*Gives you city/state for that
|
|
A/C and exchange.
|
|
|
|
|
|
|
|
International calls:
|
|
--------------------
|
|
|
|
|
|
To call international over cable simply
|
|
access a trunk and dial kp011XXXst
|
|
wait for sender tone, kpXXXCC-NUMBERst
|
|
|
|
XXX - A 3 digit country code, it may
|
|
not be 3 digits so just put 1 or 2 0's
|
|
in front of it.
|
|
CC - is the city code
|
|
|
|
To go by satellite:
|
|
dial kp18Xst X - numbers 2-8
|
|
wait for sender tone then
|
|
kpXXXCCNUMBERst
|
|
|
|
|
|
---------------------------------------
|
|
|
|
Fedex will put out a file on RQS soon.
|
|
|
|
Written by: Scarface
|
|
&
|
|
Zardoz
|
|
|
|
|
|
|
|
Eurotext I
|
|
----------
|
|
THIS TEXT WAS WRITTEN BY
|
|
Rainman of Possessed
|
|
on the 3th of January 1992
|
|
|
|
|
|
DIRECTORY
|
|
---------
|
|
|
|
PART I......general txt about operators
|
|
PART II.....list of the Routing Codes
|
|
PART III....line digits
|
|
SMAG PART...new mag
|
|
LAST PART...greetinx
|
|
|
|
|
|
|
|
|
|
PART I
|
|
------
|
|
|
|
|
|
International Operator System or
|
|
"life as a operator"
|
|
---------------------------------------
|
|
|
|
It all began on a beautiful sunday
|
|
morning. I just called as usual a few
|
|
American boards and downloaded the
|
|
"news". A little bored i saws a text
|
|
file in a board. Usually i dont care
|
|
much about text files but this
|
|
one had the title "International
|
|
Operator System". It sounded cool so
|
|
i decided to downloaded that file.
|
|
But the only information i got was that
|
|
you can reach opeators with the
|
|
"Blue Box". Ok, i thought, whats so
|
|
special about it ??
|
|
The next day i asked a bit in some
|
|
other German boards and got a few more
|
|
informations about that.
|
|
"You have to dial a131313c to get a
|
|
MCI operator in the states"
|
|
Thats how my quest through the american
|
|
operators just begann...
|
|
|
|
Monday afternoon, just after school.
|
|
I load my Blue Box PRG called
|
|
"Unlimited Access". Just called
|
|
Red Sector A West and meet Splicer of
|
|
Possessed...
|
|
(ok, that were the commercials, smile)
|
|
|
|
I thought wy not playing a bit with
|
|
the operators. I was a bit nervous and
|
|
frightened. "What if they get me" ?
|
|
No, they wouldnt ! They are to stupid !
|
|
Without knowing what i really do a
|
|
called a american MCI toll free number,
|
|
send the break and called a131313c.
|
|
That should give me a operator. I heard
|
|
a tone, i waited, and then
|
|
"MCI What could i do for you".
|
|
I WAS frightened.
|
|
I didnt know what to do, so i simply
|
|
gave him a number. The number from
|
|
"Warez for Mazzes". I wanted to say
|
|
"call collect", but before i could do
|
|
anything the operator said "Thank you
|
|
for using MCI". I couldnt hardly
|
|
believe it ! They didnt asked me
|
|
for a calling card or something like
|
|
that! That was neat !
|
|
I heard the carrier.
|
|
I sended "atx1d" on my NComm
|
|
terminal. But then from my modem
|
|
speaker i heard i voice crying
|
|
"Operator ! Operator !". I was shocked,
|
|
hang up and cut the line! The voice was
|
|
calling for me ! I realized it !
|
|
They REALLY believed me to be an
|
|
operator! The next day. I was calling
|
|
the "Skeleton Crue" in the states.
|
|
Small chat with the sysop. He said
|
|
"ask Billsf for the operator system".
|
|
I did. He told me that i can reach
|
|
different operators with Blue Box.
|
|
I have to dial 131 for directory
|
|
assistance and 121 for emergency
|
|
interruption. example:
|
|
|
|
|
|
directory assistance
|
|
/
|
|
a 2 201 131 c
|
|
: :
|
|
line area code
|
|
|
|
Ok, i thought. Just wanted to check it.
|
|
Why not trying an emergeny
|
|
interuption on the Warez board ?
|
|
I died. Gave the number to the
|
|
operator. he asked me from which land
|
|
i am calling. I said Spain (Really, i
|
|
was calling from Germany). I thought,
|
|
i dont want to help you tracing me man!
|
|
I heard a the operator hacking his
|
|
computer. Then he asked me if I want to
|
|
make a point check. Without knowing
|
|
what it is I said yes. "Please wait a
|
|
moment" I heard in the line. Again
|
|
this hacking. I became nervous. Droped
|
|
the Phone....
|
|
|
|
|
|
Ok, that should be enough folks !
|
|
I have added a txt file of the
|
|
operator ya can reach with Blue Box.
|
|
|
|
Rainman of Possessed
|
|
|
|
|
|
|
|
|
|
|
|
PART II
|
|
-------
|
|
|
|
|
|
AT&T/BOC ROUTING CODES
|
|
Most codes: KP+NPA+XXX+ST where XXX=
|
|
the code, except where noted. Codes
|
|
marked with a ? are unfamiliar to us.
|
|
|
|
000 - The Rate Quote System
|
|
(RQS) (1)
|
|
001 - 005 Spare (2)
|
|
006 - 008 Reserved (3)
|
|
009 RQS
|
|
010 Reserved
|
|
011 International Origination
|
|
Toll Center (IOTC) (15)
|
|
014 TWX Switching Plan (Canada)
|
|
015 - 071 Spare
|
|
072 - 079 Reserved
|
|
080 - 081 Spare
|
|
082 - 087 Reserved
|
|
088 Spare
|
|
089 Reserved
|
|
090 - 099 Spare
|
|
100 Plant Test - balance
|
|
termination
|
|
101 Plant Test - test board
|
|
102 Plant Test - Milliwatt tone
|
|
(1004 Hz)
|
|
103 Plant Test - signaling test
|
|
termination
|
|
104 Plant Test - 2-way
|
|
transmission and noise test
|
|
105 Plant Test - Automatic
|
|
Transmission Measuring
|
|
System /
|
|
Remote Office Test Line
|
|
(ROTL)
|
|
106 Plant Test - CCSA loop
|
|
transmission test
|
|
107 Plant Test - par meter
|
|
generator
|
|
108 Plant Test - CCSA loop echo
|
|
support maintenance
|
|
109 Plant Test - echo canceler
|
|
test line
|
|
110 - 119 Operator Codes
|
|
115 Operator Leave Word
|
|
116 Inward DA
|
|
120 Network Emergency Center (?)
|
|
121 Inward Operator (9)
|
|
122 AT&T Ready line INWATS (4)
|
|
123 - 130 Reserved
|
|
131 Directory Assistance
|
|
132 - 137 Reserved
|
|
138 IDDD for Equal Access (7)
|
|
139 - 140 Reserved
|
|
141 Rate and Route (10)
|
|
142 -147 Reserved
|
|
148 points not on an NPA -
|
|
Hermosillo, Mexico (5)
|
|
149 Reserved
|
|
150 Cable Control (Satellite
|
|
Avoidance) - Hawaii (5)
|
|
151 International Assistance
|
|
152 - 157 Reserved
|
|
158 Operator Assistance for
|
|
Equal Access (7)
|
|
160 International Operator
|
|
Center (IOC) (6)
|
|
161 Trunk Trouble Reporting
|
|
162 - 167 Reserved
|
|
168 points not on an NPA -
|
|
Grenada
|
|
169 - 170 Reserved
|
|
171 points not on an NPA -
|
|
Monterey, Mexico
|
|
172 points not on an NPA -
|
|
Dominican Republic, Puerto
|
|
Rico,
|
|
Virgin Islands (Canada only)
|
|
173 Reserved
|
|
174 Cable Control (Satellite
|
|
Avoidance) Caribbean
|
|
175 Reserved
|
|
176 points not on an NPA -
|
|
Mexicali, Mexico
|
|
177 - 178 Reserved
|
|
179 points not on an NPA -
|
|
Grenada
|
|
180 points not on an NPA -
|
|
Mexico Numbers
|
|
181 Toll Station
|
|
182 International Switching
|
|
Center (ISC)
|
|
White Plains, 5 (14)
|
|
183 ISC New York, BW24
|
|
184 ISC Pittsburgh
|
|
185 ISC Atlanta OLT
|
|
186 ISC Sacramento
|
|
187 ISC Denver/Sherman Oaks (15)
|
|
188 ISC New York, 5450
|
|
189 points not on an NPA -
|
|
Mexico City, Mexico
|
|
190 points not on an NPA -
|
|
Mexico Numbers
|
|
191 Conference loop around
|
|
191 AT&T Advanced 800 intercept
|
|
recording frames (4)
|
|
192 Reserved
|
|
193 Cable Control (Satellite
|
|
Avoidance) - Grenada
|
|
194 points not on an NPA -
|
|
Tijuana, Mexico
|
|
195 AT&T Advanced 800 (4)
|
|
196 AT&T International 800 (4)
|
|
197 Reserved
|
|
198 AT&T International City
|
|
Service Center (ICSC)
|
|
199 Cable Control (Satellite
|
|
Avoidance) - Alaska
|
|
199 AT&T USA Direct (4)
|
|
|
|
4 or 5 digit codes (8)
|
|
|
|
1150,11501 Universal or Coin Callback
|
|
1151,11511 Conference Operator (11)
|
|
1152,11521 Mobile Service / Air-Ground
|
|
1153,11531 Marine Service (12)
|
|
1154,11541 Toll Terminal
|
|
1155,11551 Time and Charges callback
|
|
1156,11561 Hotel / Motel callback
|
|
1157,11571 IOTC access trunk
|
|
1158,11581 Inward- completion
|
|
assistance (BOC)
|
|
1159,11591 Inward- busy line
|
|
verification (BOC)
|
|
1160,11601 Calling Card Validation
|
|
- dial pulse equipment (13)
|
|
1161,11611 Calling Card Validation -
|
|
DTMF equipment
|
|
1162,11621 Calling Card Validation -
|
|
MF equipment
|
|
|
|
|
|
Notes:
|
|
|
|
(1) The Rate Quote System is a voice
|
|
response system used by operators
|
|
to obtain routing information.
|
|
The system, now being phased out, was
|
|
used as an alternative to calling the
|
|
Rate and Route operator.
|
|
Operators would key-in required routing
|
|
information and a synthesized
|
|
voice would respond. Though the RQS is
|
|
still operational, operators
|
|
now obtain routing information from
|
|
COMPIS (See note 10).
|
|
|
|
KP+DD+ONPA+NXX+TNPA+NXX+ST to get the
|
|
"rate step" for:
|
|
|
|
DD = 00 Now
|
|
DD = 01 Day Call (08:00-17:00)
|
|
DD = 02 Evening Call (17:00-23:00)
|
|
DD = 03 Night Call (23:00-08:00)
|
|
|
|
KP+04+? Something with Mexico,
|
|
unclear.
|
|
|
|
KP+05+NPA+NXX+ST Gives the routing for
|
|
a BOC inward (See note 9)
|
|
|
|
KP+06+NPA+NXX+ST gives the routing for
|
|
an AT&T inward operator
|
|
(See note 9)
|
|
|
|
KP+07+XXXXXXX+ST Reads back the
|
|
numbers you just typed
|
|
|
|
KP+08+? Something with Enterprise and
|
|
Zenith numbers, unclear.
|
|
|
|
KP+09+NPA+NXX+ST Gives you the current
|
|
time for the area and exchange
|
|
just dialed.
|
|
|
|
(2) When a code is marked spare, that
|
|
means that there is no current
|
|
or planned networkwide usage. It still
|
|
may be utilized as a
|
|
non-standard POTS exchange for WATS
|
|
service by local companies.
|
|
|
|
(3) When a code is marked reserved,
|
|
it means that there may be planned
|
|
networkwide usage.
|
|
|
|
(4) This code is used by an AT&T
|
|
custom service. It may be thought of
|
|
as acting like a special area code and
|
|
takes the following dialing
|
|
format: KP+XXX+YYY+YYYY+ST where XXX
|
|
is the code in question and Y can
|
|
be any number 0-9.
|
|
|
|
(5) All "points not on an NPA" and
|
|
"Cable Control" function as pseudo
|
|
area codes and are followed by a
|
|
telephone number.
|
|
|
|
(6) Calls to the IOC are dialled
|
|
as follows: KP+160+CCC+ST CCC=Country
|
|
Code (i.e. 044 or 144 for the UK).
|
|
|
|
(7) These are special codes used with
|
|
Equal Access. They are as
|
|
follows:
|
|
|
|
KP+138+PIC+ST then KP+CC+cc+xxxxx+ST
|
|
KP+158+PIC+ST
|
|
|
|
Where PIC is the primary carrier code,
|
|
CC is the country code and cc
|
|
is city code. xxxxx is subscriber
|
|
number. We are not sure exactly when
|
|
and where these are used.
|
|
|
|
(8) All four and five digit codes are
|
|
dialed as follows:
|
|
KP+NPA+XXXX+ST or KP+NPA+XXXXX+ST.
|
|
Keep in mind that not every code is
|
|
in use in every NPA.
|
|
|
|
(9) The format for an AT&T inward is
|
|
usually KP+NPA+121+ST -- In some
|
|
small cities there is an extra code
|
|
used called a Terminating Toll
|
|
Centre (TTC) or sometimes just a
|
|
city code. If a TTC is used, the
|
|
format is KP+NPA+TTC+121+ST. To get
|
|
an inward with most BOCs you dial
|
|
KP+NPA+11591+ST but there are some
|
|
which use a format of
|
|
KP+NPA+TTC+121+ST. To get the inward
|
|
routing for a particular
|
|
exchange, use the Rate Quote System
|
|
(RQS).
|
|
|
|
(10) The number for Rate and Route
|
|
was 800+141+1212 but this was
|
|
discontinued sometime last year
|
|
(1987) when the TSPS operators got a
|
|
computer terminal called COMPIS. In
|
|
each there is an inward which acts
|
|
like a Rate and Route operator.
|
|
In New York it is 716+121.
|
|
|
|
(11) With the advent of Alliance
|
|
Teleconferencing, use of the
|
|
conference operator dwindled.
|
|
There are currently four operator
|
|
handling conferences. They are as
|
|
follows: Atlanta 404+11511,
|
|
Minneapolis 507+11511, New York
|
|
212+11511 and Oakland 415+11511.
|
|
800-225-0233 translates to the
|
|
conference operator closest to you.
|
|
|
|
(12) The Marine Operator is used in
|
|
calling ships that are close to
|
|
the United States. There is an
|
|
operator called the "High Seas"
|
|
operator who can be reached by dialing
|
|
800-SEA-CALL (800-732-2255).
|
|
The High Seas operator is a service of
|
|
AT&T, while Marisat is an
|
|
independent company. A High Seas call
|
|
can go to any ocean for $14.98
|
|
for the first 3 minutes and $4.98 for
|
|
each additional minute. A
|
|
Marisat only to three oceans and costs
|
|
$10 a minute.
|
|
|
|
(13) 116X and 116XX are used to verify
|
|
an AT&T Calling Card number.
|
|
You dial KP+NPA+116XX+ST when you hear
|
|
a "bong" you dial the calling
|
|
card number. If you use 11611 you enter
|
|
the number in Touch Tone and
|
|
if you use 11621 you enter the card
|
|
number in MF using KP and ST.
|
|
|
|
(14) These ISC codes are used to
|
|
provide alternate routing for
|
|
electro-mechanical switches. Some older
|
|
electro-mechanical switches,
|
|
for example #5 Crossbar (5XB) cannot
|
|
outpulse 011+CCC (CCC=Country
|
|
Code) for international dialing.
|
|
AT&T has set up these special codes
|
|
to handle international calls. A 5XB
|
|
can dial KP+18X+ST. They would
|
|
then receive a wink (short blast of
|
|
2600 Hz) and would proceed to dial
|
|
the country code and number. If you
|
|
want to make an international call
|
|
you dial KP+(NPA)+18X+ST where the
|
|
NPA is optional. After the wink
|
|
dial the country code, city code
|
|
and number. The "," after the city
|
|
name is the switch number if there
|
|
is more then one 4-ESS in that
|
|
city.
|
|
|
|
(15) The 187 code was assigned to
|
|
Atlanta until up to the end of
|
|
February 1988. AT&T is in the process
|
|
in routing the calls to the
|
|
Sherman Oaks Office in California.
|
|
|
|
(16) To make international calls dial
|
|
KP+011+CCC+ST where CCC is the
|
|
country code; and then dial
|
|
KP+CC+XXXXXXX+ST where CC is the city
|
|
code and XXXXXXXX is the telephone
|
|
number.
|
|
|
|
|
|
|
|
|
|
|
|
PART III
|
|
--------
|
|
|
|
|
|
The line digits for Blue Boxing
|
|
|
|
|
|
0-2...normal
|
|
|
|
3-5...public buildings (fx
|
|
hospitals)
|
|
|
|
6-7...Security Services
|
|
|
|
8-9...Army
|
|
|
|
|
|
|
|
if you bluebox use the digits 0-2.
|
|
but the digit 2 is the best. you will
|
|
get the best line with it.
|
|
|
|
|