With thanks to Peter McIvers for the list of frequencies mentioned later in
this phile.
NOTE: the British Post Office, is the U.S. equivelent of Ma Bell.
In Britain, phreaking goes back to the early fifties, when the technique of
'Toll A drop back' was discovered. Toll A was an exchange near St. Pauls which
routed calls between London and nearby non-London exchanges. The trick was to
dial an unallocated number, and then depress the reciever-rest for 1/2 second.
This flashing initiated the 'clear forward' signal, leaving the caller with an
open line into the Toll A exchange. He could thjen dial 018, which forwarded
him to the trunk exchange- at that time, the first long distance exchange in
Britain- and foll ow it with the code for the distant exchange to which he
would be connect ed at no extra charge.
The signals needed to control the UK network today were published in the
"Institution of Post Office Engineers Journal" and reprinted in the Sunday
Times (15 Oct. 1972).
The signalling system they use: signalling system No. 3 uses pairs of
frequencies selected from 6 tones separated by 120Hz. With that info, the
phreaks made "Bleepers" or as they are called here in the U.S. "Blue Box", but
they do utilize different MF tones then the U.S., thus, your U.S. blue box that
you smuggled into the UK will not work, unless you change the frequencies.
In the early seventies, a simpler system based on different numbers of
pulses with the same frequency (2280Hz) was used. For more info on that, try to
get ahold of: Atkinson's "Telephony and Systems Technology".
The following are timing and the frequencies for boxing in the UK and other
foreign countries. Special thanks to Peter McIvers for the phollowing inpho:
British "bleeper" boxes have the vaery same layout as U.S. blue boxes. The
frequencies are different, though. They use two sets of frequencies, forward
and backward. Forward signals are sent out by the bleeper box; the backward
signals may be ignored (it's sort of like using full duplex). The frequencies
are as follows:
U.S.:
US: 700 900 1100 1300 1500 1700
Forward: 1380 1500 1620 1740 1860 1980 Hz
Backward: 1140 1020 900 780 660 540 Hz
for example, change the 900 Hz potentiometers in your box to 1500 Hz. All
numbers 1-0 (10) are in the same order as in an American box. The ones after
this are thier codes for operator 11, operator 12, spare 13, spare 14, and 15.
One of these is KP, one (probably 15) is Star; it won't be too hard to figure
out. The signals should carry -11.5dBm +/- 1dB onto the line; the frequencies
should be within +/- 4Hz (as is the British equipment). Also, the 1VF system is
still in operation in parts of the U.K. This would encode all signals 1 to 16 as binary numbers; for instance, a five is 0101. There are six intervals per
digit, each 50ms long r a total of 300ms. First is a start pulse of 2280 for
50ms. Then, using the example of five (0101), there is a 50ms pause, a 50ms
pulse of 2280, a 50ms pause, and a 50ms pulse of 2280. Finally, there is a
50ms pause that signals the end of the digit. The frequency tolerance on the
2280 Hz is +/- 0.3%; it is sent at -6 +/- 1dBm. An idle line is signaled by
the presence of a 3825Hz tone for more than 650ms. This must be within 4Hz.
France uses the same box codes as the US, with an additional 1900Hz
acknowledgement signal, at -8.7 +/- 1dBm per frequency.
Spain uses a 2 out of 5 mf code (same frequencies as US), with a 1700 Hz
acknowledge signal.
Other places using the 1VF system are:
Australia, 2280Hz +/-6Hz, 35ms/digit at -6dB.
Germany, France: same as Australia; also, some 1VF systems in the UK.
Switzerland: same as Australia, only it uses 3000Hz, not 2280.
Sweeden: same as above, but at 2400Hz.
Spain: some parts use 1VF with 2500Hz.
There is one other major system: the 2VF system. In this system, each digit is
35ms long. The number is encoded in binary as with the 1VF system. Using the
example of five (0101), here's how the American 2VF system was sent:
