Freaks Macintosh Archive/Freaks Macintosh Archive.bin/Freaks Macintosh Archives/Phreaking⁄Wardialers/Phreaking texts/Telecommunications2.txt

Text File | 1999-01-28 | 22KB | 468 lines

    File: BASIC TELCOM II
 Read 98 times

*******BIOC Agent 003's course in******
*                                     *
*      ==========================     *
*      =BASIC TELECOMMUNICATIONS=     *
*      ==========================     *
*               PART II               *
***************************************

Revised:  18-JUL-84

PREFACE:

In part II, we will explore the various special Bell #'s, such as:  CN/A, AT&T
Newslines, loops, 99XX #'s, ANI,ringback, and a few others.


CN/A:
-----

CN/A, which stands for Customer Name and Address, are bureaus that exist so
that authorized Bell employees can find out the name and address of any
customer in the Bell System.  All #'s are maintained on file including unlisted
#'s.

Here's how it works:

 1) You have a # and you want to find out who owns it, e.g. [phone].

 2) You look up the CN/A # for that NPA in the list below.  In the example, the
NPA is 914 and the CN/A # is 518-471-8111.

 3) You then call up the CN/A # (during business hours) and say something like,
"Hi, this is John Jones from the residential service center in Miami. Can I
have the customer's name at 914-555-1234.  That # is 914-555-1234." Make up
your own REAL sounding name, though.  Or if you sound mature enough, just say
"Lookup:  914 555 1234 please."

 4) If you sound natural & cheery, the operator will ask no questions.

NOTE:  Due to the break-up, several operating companies are now asking for id
       #'s when you make a request.  This has recently happened to me in 617 &
       I just told the operator that I was calling from the so-and-so business
       office in NY, and she said that she'll put it through this time!

Here's the list:


NPA     CN/A #       NPA     CN/A #      NPA     CN/A         NPA     CN/A
---  ------------    ---  ------------   --- -------------    ---  ------------
201  201-676-7070    517  313-232-8690   202  202-384-9620    518  518-471-8111
203  203-789-6815    519  416-922-6686   204  204-949-0900    601  601-961-0877
205  205-988-7000    602  303-293-2333   206  206-382-8000    603  617-787-5300
207  617-787-5300    604  *CLOSED 9/82   208  303-293-2333    605  402-345-0600
209  415-546-0118    606  502-583-2861   212  518-471-8111    607  518-471-8111
213  213-501-3255    608  414-252-6932   214  214-698-9711    609  201-676-7070
215  412-633-5600    612  402-345-0600   216  614-464-2345    613  416-922-6686
217  217-525-7000    614  614-464-2345   218  402-345-0600    615  615-373-5791
219  317-265-4834    616  313-223-8690   301  301-534-1168    617  617-787-5300
302  412-633-5600    618  217-525-7000   303  303-293-2333    701  402-345-0600
304  304-344-8041    702  415-546-0118   305  912-784-0440    703  804-747-1411
306  306-347-2878    704  912-784-9111   307  303-292-2333    705  416-922-6686
308  402-345-0600    707  415-546-0107   309  217-525-7000    709  ****N/A*****
312  312-769-9600    712  402-345-0600   313  313-223-8690    713  713-820-4112
314  314-726-7142    714  213-501-3255   315  518-471-8111    715  608-252-6932
316  816-275-2782    716  518-471-8111   317  317-265-4834    717  412-633-5600
318  504-245-5330    801  303-293-2333   319  402-345-0600    802  617-787-5300
401  617-787-5300    803  912-784-0440   402  402-345-0600    804  304-344-8040
403  403-425-2652    805  415-546-0118   404  912-784-0440    806  512-828-2501
405  405-236-6121    807  416-922-6686   406  303-293-2333    808  212-334-4336
408  415-543-6374    809  212-334-4336   412  412-633-5600    ^^^Bermuda Only^^
413  617-787-5300    812  317-265-4834   414  608-252-6932    813  813-228-7871
415  415-546-0107    814  412-633-5600   416  416-922-6686    815  217-525-7000
417  314-726-7142    816  816-275-2782   418  514-287-5151    817  214-698-9711
419  614-464-2345    819  514-287-5151   501  405-236-6121    901  615-373-5791
502  502-583-2861    902  902-421-4110   503  503-241-3440    903  ****N/A*****
504  504-245-5330    904  912-784-0440   505  303-293-2333    906  313-223-8690
506  506-648-3041    907  ****N/A*****   507  402-345-0600    912  912-784-0440
509  206-382-8000    913  816-275-2782   512  512-828-2501    914  518-471-8111
513  614-464-2345    915  512-828-2501   514  514-287-5151    916  415-546-0118
515  402-345-0600    918  405-236-6121   516  518-471-8111    919  912-784-0440


Bell uses these #'s mainly to find out who owns a # that a customer claims he
never called.

Some CN/A #'s remain the same for long periods of time; others such as those
in NPA's 213 (& other CA area codes) change quite frequently.  The 213 CN/A
(Also used for the new NPA's:  818 & 619) usually remains somewhere in the
213-501-XXXX exchange.

For the CN/A # for the 900 SAC & the 976 exchange call the local CNA # or
212-334-3611.

NOTE:  This is the most complete list of CN/A #'s in my possession which was
       procured from my business office.

Another "cheap way" of doing a CN/A without knowing the CN/A # is to call the
local business office of the area where the fone # you want to check is
located.  Then make an inquiry into something.  When the representative
asks for your #, give him the # you want checked.  Chances are that he will
say, "Is this Mr. X" and you now know who the line belongs to.

Incidentally, if you tell the Telco to make your directory listing appear as
Jack Meoff (or a similar pseudonym) with no address you will avoid an unlisted
# charge.  Also, if some asshole tried to pull a CN/A on your # (or your BBS
#), the CN/A operator will tell them that the line belongs to Jack Meoff.  You
can still have the bill sent to your real name, though, without affecting the
CN/A.

There is also a type of reverse CN/A bureau.  This is usually called NON PUB
DA or TOLL LIB.  These #'s would most certaintly change immediately if they
were published here.  With these #'s you tell them the name & locality.They
will then shake you down for your name, supervisors name, etc. if you haven't
already told them.  They will ask you a few other questions which if you answer
 them with the right incantation or practice the art of "social engineering"
(a/k/a bullshiting), you have the unlisted #! You can also get detailed billing
information from these bureaus.

AT&T NEWSLINES:
---------------

Newslines are recordings that Bell employees call up to find out the latest
info on stock, technology, etc. concerning the Bell System.

Here are the #'s that are currently known to phreaks (at least me, anyway):


201-483-3800 NJ        513-421-9060 OH   203-771-4920 CT        516-234-9914 NY
212-393-2151 NY        518-471-2272 NY   213-621-4141 CA        617-955-1111 MA
213-829-0111 CA (GTE)  702-789-6711 NV   213-449-8830 CA        713-224-6116 TX
312-368-8000 IL        714-238-1111 CA   313-223-7223 MI        717-255-5555 PA
314-247-5511 MO        717-787-1031 PA   408-493-5000 CA        802-955-1111 VE
412-633-3333 PA        808-533-4426 HI   414-678-3511 WI        813-223-5666 FL
416-929-4323 ONT.      914-948-8100 NY   503-228-6271 OR        916-480-8000 CA

Rev-- With the break-up, some of the above #'s are going to change, but AT&T
still plans on keeping this service.

Also, many of the smaller companies, such as NY Telephone have their own
newswires.  Here is a list of NYTelco newswires:

212 395-2200        518 471-2272           516 234-9914        315 476-4492
914 390-2055        716 847-1950

=======
=LOOPS=
=======


First of all, you must understand the concept of loops.  I think that the best
way that this is understood is the way that Phred Phreek explained it...

"No self-respecting Phone Phreak can go through life without knowing what a
loop is, how to use one, and the types that are available.  The loop is a great
alternative communication medium that has many potential uses that havent't
even been tapped yet.  In order to explain what a loop is, it would be helpful
to visualize two phone numbers (lines) just floating around in the Telco
central office (CO).  Now, if you (and a friend perhaps) were to call
these two numbers at the same time, POOOOPFFF!!!, you are now connected
together.  I hear what you're saying out there..., "Big deal" or "Why should Ma
Bell collect here two MSU'S (message units) for one lousy phone call!?" Well...
think again.  Haven't you ever wanted someone to call you back but, were
reluctant to give out your home phone number (like the last time you tried to
get your  friend's unlisted # from the business offfice)?  Or how about a
collect call to your friend waiting on a loop, who will gladly accept the
charges?  Or better yet, stumbling upon a loop that you discover that has
multi-user capability (for those late-night conferences).  Best of all is
finding a non-supervised loop that doesn't charge any MSU's or tolls to one or
both parties.  Example:  many moons ago, a loop affectionately known as 'the
332 Loop' was non-sup (ie, non-supervised) on the tone side.  I had my friend
in California dial the free (non-sup) side, [phone] and I dialed the
side that charged, 332-9900. As you can see, I was charged one MSU, and my
friend was charged zilch, for as long as we wished to talk!!!"

****************************************************************************

Ahhh...have I perked your interest yet? If so, here is how to find a loop of
your very own.  First, do all of you loop searching at NIGHT!  This is because
the loops serve a genuine test function which Telco uses during the day.  (We
don't want to run into an irate lineman now, do we?)  To find a loop, having 2
#'s is a definite plus.  If not, have a friend to dial #'s at his location.
Last resort, try dialing from two adjacent pay phones. Now get your trusty
white pages (*), and turn to the page where it lists the # of MSU's from your
exchange (or exchanges in your primary calling area) The idea is to find a loop
that is within your primary calling area or is only 1 MSU in your area (call
area A). This is so you don't go bankrupt trying to find a loop.  Write down
all of these exchanges and do a 99XX scan of those exchanges (99XX scanning
will be discussed shortly).

Before we get up to 99XX scanning, we will look at some other loop info:

Loops are found in pairs which are usually close to each other.  For example,
in NPA 212, where the infamous loops are found, there is a standard loop
format:

Manhattan & Bronx-------NNX-9977/9979  Brooklyn & Queens-------NNX-9900/9906

NNX is the exchange to be scanned. Here are some loops that have been found in
NYC.  These are used mostly by Phreaks and call-in lines for pirate radio
stations:

212-220-9900/9906 212-283-9977/9979  212-352-9900/9906  212-365-9977/9979
212-529-9900/9906 212-562-9977/9979  212-982-9977/9979  212-986-9977/9979

The lower # is the tone side (singing switch).  The higher # is always silent.
The tone disappears on the lower # when somebody dials in the other side of the
loop.  If you are on the higher #, you'll have to listen to the clicks to see
if somebody dialed-in.  The NYC 982 & 986 loops are different from others.
Usually when you park on a loop, you will hear who ever calls in on the other
half.  When they're done, the next caller (if any) will be queued in, one after
another. On the NYC 982 & 986, you sometimes can't get any more callers in
after the first. Furthermore, if you park one of these loops and there is
nobody on the other end for more than 4 minutes, you may be automatically
disconnected. These loops are good for back-up purposes when all other loops
are busy.


99XX Scanning:
--------------

Many exchanges in the Bell System have a wide variety of test #'s and other
"goodies," such as loops.

These "goodies" are usually found between 9900 and 9999 in your local
exchange.  If you have the time and initiative, scan your exchange and you
may become lucky!

Here are my findings in 914-268:

9901 - Verification (recording of a/c and exchange)
9936 - Voice # to the Telco CO
9937 - Voice # to the Telco CO
9941 - Carrier
9960 - Osc. Tone (tone side loop)
9963 - Tone (stops:  muted)
9966 - Carrier
9968 - Tone that disappears--responds to certain touch-tone keys

Most of the #'s between 9900 & 9999 will ring, be busy, go to a special
intercept operator ("what #, please?") or will go to a "the # you have
reached..." recording.  What you find depends upon the switching equipment in
the exchange and the Telco operating company.

When searching for loops, you may find one of the following possibilities when
you find one:

1.  You can hear through the loop (not muted), but there is a 1/2 second
    click every 10 seconds that interrupts the audio.  This type is good for
    back-up use but the %$#'&" click is super annoying.

2.  One side of the loop is busy; try it again later.

3.  The tone disappears, but you cannot hear through it (the loop is muted,
    try again in a month or so)

4.  You get "The # you have reached recording."  No loop there!

Most loops are muted (#3), but their status does changes from time-to-time.
It all depends if the Telco maintenance personnel remember to "throw the
switch", ie, turn off the loop.

Since I have done the above 914-268 99XX scan, Congers (268) has installed
new switching equipment (DMS100).  Some of the numbers are the same, but I have
noticed that on the DMS100, the recordings are also stored in this area.
268-9903, 9906, 9909, & 9912 are all different recordings.  Also, there are 2
fortress fone recordings at 268-9911 (deposit 5 cents or else) and 268-9913
(deposit 10 cents).  None of these recordings supe and alot of other 99XX #'s
don't supe either.

In Washington, there is a sweep tone test at [phone]. [Sweep tone tests
are used to detect infinity transmitters (a/k/a harmonic bugs) on the line] In
NYC (212), you'll find the infamous loop lines (as mentioned above).

It will be easier to scan your exchange if you make up a chart like the one
below:


           NPA-NNX-99XX SCAN

--------------------------------------
!99X X>:0 :1 :2 :3 :4 :5 :6 :7 :8 :9 !
--------------------------------------
!990   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!991   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!992   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!993   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!994   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!995   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!996   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!997   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!998   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!999   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------

This leaves you with 100 boxes (1 for each # between 9900 & 9999).  You should
make your boxes big enough so you can write some sort of shorthand in them.
For example:

B - busy   (try again at another time)
R - rings  (try again at another time)
O - intercept operator ("what # you calling?)
R1- recording 1 (make a margin note of the types of reordings you get)
S - sweep tone test
T - tone   } tone at a lower # + ignore
I - ignore } at a higher # = loop
V - voice # to Telco CO - they usually answer with the city name or area.
C - carrier (computer!)

There will be others and you should use other characters that you can
understand.

Now, back to loops!  As you may have noticed in my 914-268 scan, I found a
muted loop and a tone side.  914-268 failed to come up with the silent side
of a loop!  Therefore, there is no loop in that exchange.  I then scanned
another exchange in my primary calling area (914-634) and I found a loop!!

    [phone]/9924

{Revision:  This loop has just recently died!}

So, if at first you don't succeed, move onto another exchange.

If you use the box method that I have outlined above, you will see a T & I
next to each other for a loop.

Some exchanges are special.  For example, 914-623 is a testing bureau. In this
exchange, not only did I find a loop, but I also found several interesting
tones, noises, and other test functions. Also, the more important the exchange
is, the more you will find. For example, in 914-623, I found well over 10 voice
 #'s!

Also, loops are usually, but not exclusively, found in the 99XX series.
For example:

    [phone]/1499 is a loop.

The perfect loop?  Here is what I would look for:

 1.  Non-sup on one or both sides.  To check for a non-sup loop, go to a
     tone-first fortress fone and dial the #.  If it asks for a dime, it
     is supervised.  If the call goes through, then it is non-suped!

 2.  800 loops would be a plus.  They are not necessarily found between
     9900 & 9999 though.  I would check the 1XXX series first.

 3.  Multi-user loops are also a plus for those late night conferences.

NOTE:  If there is nothing in the 99XX area in your exchange or if 99XX
       is used for actual numbers, then try 0XXX or 1XXX scanning (in
       that order).

Finally, remember it is only a local call to find out what you CO has in store
for you.  If you find anything interesting, be sure to drop me a line.

NOTE:  Your local white pages can be a valuable asset.  You can also order
       other fone books from your business office (usually free for books
       within your operating company's district).  A large fone book, such as
       Manhattan,contains much more info in the 1st few pages than other books.

=====
=ANI=
=====

Automatic Number Identification (ANI),is a number that you call up that will
tell you what # you are calling from.

This has a few uses.  First, were you ever somewhere and the fone didn't have
a # printed on it?  Or perhaps you were fooling around in some cans (those
large boxes on fone poles that contain terminals for lineman use--to be
discusses in a future chapter.) and you want to know what what the line # is.

In NPA 914, the ANI is 990.  In NPA's 212 & 516, ANI is 958.  This varies
from area to area.

Here are some other ANI's that I have seen:

211/311               401-222-2222       890-751-5191       2022222222
222222222            1-XXX-1111
              (in some 914 areas, esp. under step-by-step
               switching equipment, you have to dial 1-990-1111)

To find ANI for other areas, check 3 digits #'s first, usually in the 9XX
series (excluding 911).  In areas under step-by-step (to be discussed in a
future part), try 1-9XX-1111.

ANI may also be in 99XX.  Last resort,try to get friendly with your neighbor
who works for the fone company.


Ringback:
---------

Ringback, as its name implies, calls back the # you are at when you dial the
ringback #.

Ringback, in NPA 914, is 660.  You dial 660+the last 4 digits of the fone.  You
will then get a tone, hang-up quickly and pick-up in about 2 seconds.  You
will then get a second tone, hang-up again and the fone will ring.

In NYC, it is also 660, but you may have to press 6 or 7 before you hang up
for the first time (ie, at the first tone).

Other ringback #'s that I have seen are:  [NPA's in brackets]

               331 [619/714]        536+(last 4 digits of fone #) [305]                                             958+(last 4 digits of fone #) [202]

26011 - This 5 digit format is used primarily on step-by-step. The last 2
        digits (11) are dummy digits.
890-897-XXXX - XXXX are the last 4 digits of the fone #.
119911/11911/1199911 - GTE

The reason you get the tone when you pick-up after it rings is because in
some areas, people were using ringback as an in-house intercom.  They would
dial ringback, and when it stopped ringing, they would pick-up & talk with
the person who picked up the other extension.  Bell didn't like this since
there is usually only 1 piece of common control equipment in each exchange that
does the ringback.  When people used this as an intercom, linemen & repairmen
couldn't get through!  In some areas, especially those under step-by-step,
ringback can still be used as an intercom.  Also, under step-by-step, the
ringback procedure it usually simple.  For example, in one area you would dial
26011 and hang-up; it would then ringback.

Touch-Tone Test:
----------------

In areas that have a Touch-Tone test, you dial the ringback #.  At the first tone, you touch-tone digits 1-0.  If they are correct it will beep twice.

I have also seen a TT test in some areas at:  890-751-5191


Coming Soon:
------------

In the next part, we will look at the numbering plan & dialing procedures
(ie, international, etc.)

Break up of Bell:
-----------------

The operating companies are not going to change all the switching equipment
around.  While there will be some changes, most of the information provided
here will remain pertinent after January 1, 1984. Just substitute the word
"fone network" for Bell System.

Au Revoir,

*****BIOC
*=$=*Agent
*****003

December 8, 1983

Acknowledgements:  TAP, Phred Phreek,Judas Gerard, The Magician, & Dark Priest.

Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open