Hacker 2/HACKER2.mdf/phreak/verify.tap

Text File | 1995-01-03 | 7KB | 99 lines

             Verification
          By Fred Steinbeck

From TAP issue # 88  10-83

   There has been a great deal of controversy in the realm of phreakdom over a
mysterious subject known under a number of different names, including
"Verification", "Autoverification", "Verify", "Autoverify", "Verify Busy", and
even "VFY BY".  All of these names basically mean the same thing: the ability
to listen to another person's telephone line from any telephone in the direct-
dialable world.
   Needless to say, Bell System is very tight lipped about knowledge regarding
verification.  Indeed, the infamous book 'Notes on long distance dialing' ('68
edition) says, "Care must be taken to insure that the customer never gains
verification capabilities."  With a printed policy like that, you can imagine
what their real-world policy is like!  Even their own rate and route operators
will not give verification on routing codes (at least in my experience), one
even responding, "What?! You must be crazy! We don't give those out!"
   Before you get too far into this article, I will state simply: I don't know
how to verify. However, I have been fooling with various things related to it,
and collecting information on it for some time now.  Therefore, while I can't
do it (yet), I may be able to point some other bright TAPer on the right track,
and perhaps he or she will show us all how.  If you have knowledge not covered
in this article, but don't want to write an article on your own, please send
your ideas, comments, or information to Project Verify, C/O TAP
   Verify has also been called "Autoverify", and I have no idea why.  This is
not, to my knowledge, a Bell System term (at least I've never seen it in any
manuals)  As far as I know, there is verify, which means being able to listen
to speech (kind of; see below) on a line, and there is the "Emergency Interrupt
which allows you to take part in the conversation taking place on the line in
question.  It has been suggested that "Autoverify" is the same as an emergency
interrupt , but I tend to disagree with this idea.  It should be noted that
the verification circuitr^ does not actually let anoperator listen to a conver-
sation without making a beep on the line every so often.  Instead, she will
hear encrypted sheech.  However, I believe with the proper methods, verify can
be converted to an emergency interupt.
   Verification is normally done either by your normal "0" (TSPS) operator, if
the call is in your home NPA (HNPA), or by an inward operator (IO).  If the
call is outside your HNPA, your normal operator will call the IO for the NPA,
and say, "Verify Busy" or "Emergency Interrupt" please, 555 1212."  The IO will
perform whatever magic he or she must, and then reprot back.  If the call is in
your HNPA, though, the "0" operator can do the verification himself by using
the "VFY BY" key on her keyshelf.  However, in some areas, the operator uses a
routing code to accomplish verification, and this the loop hole we shall
attack.
  It follows that if a IO or "0" operator can do it, so can we, with a blue box
  Now, courtesy of Robert Allen (who brought it to my attention) and Susan
Thunder (who apparently discovered it), here is what used to work for getting
operators to hook you into conversations with other perople (i.e.,let you lis-
ten to them till you hung up): You'd call the operator and say "Operator, TSPS
Maintenance Engineer Calling.  Ring forward to 001 + NPA + 7d, ring back to my
number, hit ring forward, no AMA, and then position release.
   This creates some problems, and you must be familiar with the TSPS console
(by dialing "0"), you are on the "back", or incoming part of a loop.  When she
places a call for you, the call goes out on the "forward", or outgoing part of
the loop.  If an operator wants to make a call, she punches KP FWD (keypulse
forward), the number, and ST.  Ring FWD puts a 90 volt ringing signal across
the forward part of the line (and may dial the number as well).  The problem
arises from the fact that I don't know if Ring FWD will actually dial a call,
and if there is some other subtle difference between it an KP FWD.
   Let us assume ringing forwad makes a call from the TSPS console to whatever
number is given.  Ring back causes your phone to ring (it is assumed you hung
up after giving her your instructions; if you didn't you'd hear an annoying
90 volts across the earpiece...) "No AMA" means "no automatic message account-
ing", so nobody gets billed for the call, although it will show up on a tape
somewhere.  "Position Release" removes the operator from the cirui^, and allows
her to receive other calls.  This leaves an unaccounted-for ring forward.
   The verification cirui^, as you know, likes to encrypt coversation, whic is
something we don't want.  Well, the second Ring FWD sends another  90 volts
crashing against the verify ciruitry, which Juda Gerad thinks removes the voice
encryptio^ from the line, puts the operator (and you) in circuit, and puts a
beep tone on the line every five seconds.  This seems to make sense, and I am
inclined to agree with him.
   The bit about "....001 + NPA + 7D" causes the thought "MF routing code" to
spring immediately to mind.  Now, the above trick was supposed to work in the
213 NPA.  I have tried both "KP+001+213+7D+ST", and some other area codes.  I
generally get nothing, a reorder signal, or a tandem recording.
   Here's some food for thought: On an official Telcoo sheet I have, labeled "
213 NPA MF Routing Codes", 001 is listed as "VFY BY", or verify busy for the
213 NPA.  002 is listed for the 805 NPA.  Ma Bell likes to have standardized
routing codes, such logical, then, that 001 would be a sort of "standard"
verify code, and other prefixes would be tacked on at 002,003, etc. However, I
have heard from a retired operator that verification codes ar different from
area to area, and are not always nice numbers like 001, 002.  Ah, well, a guy
can hope, can't he?
   Some suggestions for future attacks on this dilemma: Everyone call your
operators and subtley ask questions.  I have found the tend to give information
out easier if you ask for something that you would ordinarily have to be a
company employee to know about, such as rate steps, operator routings, etc.
Casually let slip that you used to be (or still are) an operator, or that you
work for company security.  Also, you might want to blue box some codes like
001 followed by your NPA and the last 7D of a busy number.  If you get a sort
of "whispery noise", try blasting the line with a ringing signal (you might
piggyback another line onto yours and call the piggyback to generate the 90
volts) and see if that does anything.

Downloaded From P-80 Systems 304-744-2253