Main
The Black Notebook

Anyone's Guide To Phreaking And Shit

compiled by The Messiah

About This Project

Boxes:

Acrylic

Aqua 1 2

Beige 1 2 3

Black 1 2 3

Blast

Blotto

Blue 1 2 3 4 5

Brown

Bud

Chartreuse

Cheese

Chrome

Clear 1 2

Copper

Crimson

Dark

Day-Glo

DLOC 1 2

Gold

Green

Infinity

Jack

Light

Lunch

Magenta 1 2

Mauve

Mega

Neon

Olive

Party

Pearl

Pink 1 2

Purple

Razz

Red 1 2 3

Rock

Scarlet

Silver 1 2 3 4 5

Static

Urine

Violet

White 1 2 3

Yellow

Other Info:

Better Homes And Blue Boxing 1 2 3

COCOT Hacking

Famous Boxes

Social Engineering FAQ

TASI

If you get caught doing something you shouldn't with one of these boxes, you're on you're own. I assume no responsibility for your actions, nor would I want to.


me
tm@sinnerz.com

http://www.sinnerz.com

IRC- TM or TMessiah on UNDERNET

Big hello to everyone out there...


about
I've always wanted to make a big file full of phreaking info. You know, a nice, searchable index of all the boxes around and all the other stuff. So here it is, biatch...

I've tried to keep the files in their original condition, but some of them are all fucked up and stuff.

Some of these files are bound to be obsolete, incorrect, or simply fucked up, so I assume no responsibility for their accuracy, your actions, or my actions, for that matter.

The name comes from a friend of mine, who had this huge black notebook with all sorts of phreaking info in it. I thought that was a pretty nifty idea, so I thought I would make this digital one.

Any comments from me will look like this:

//This is a comment!


acrylic
                        `/`\`/`\`/`\`/`\`/`\`/`\`/`\`/`\`

                         |-------Acrylic Box Plans-------|

                         |       \----------------/      |

                         |        \______By______/       |

                         |                               |

                         |          [ The Pimp ]         |

                         \_______________________________/

                           Call:

                              /\/\aharaja's Hi-Times

                            10 Meg BBS C/F 600+ G-Files

                             (xxx) - x x x - x x x x

                            \/-----------------------\/

                            ||  A High Mtn. Hackers  ||

                            ||     Presentation      ||

                            /\-----------------------/\

  Ok the purpose of this box is to get Three-Way-Calling, Call Waiting,

  programmable Call Forwarding, and an easier way of extended Bud Boxing ALL     for FREE.

  Materials:

  1) Wire stripers

  2) Couple Feet Wire

  3) AT&T/BELL Can

  4) Hex Wrench

  Idea: Ok the idea of this box is to get all of the above features by   stealing them from the fortunate ones on your block.

  Procedure:

  Step 1) Find AT&T/BELL Can that is being used to service you surrounding 	    area.

  Step 2) Open can with Hex wrench.

  Step 3) Find your line and another persons line who has 3-way, Call

          (waiting/forwarding), if the # of all the lines are not listed in                     the box you will have to use your local ANI to find them.

  Step 4) Once you have found the lines then wire the (Black & Yellow) wires           on the victims line to the (Black & Yellow) wires on you line (Be           sure your phone at home uses all 4 wire as some of the cheap           phones don't).

  Step 5) Then disconnect the victims (Black & Yellow) Wires, resulting the           the loss of these features to their line ( you mat want to leave           these wires connected, this may or may not cause problems I           haven't tried it that may yet).

  Well That Sums It Up!

  Procedure for easier extended Bud Box.

  If if for some reason your line is disconnected, or you just want to use hook someone's line to your line for fearless phreaking follow the procedure below.

  Ok Go to the local can and find a line that is used by weekend visitors or a summer/winter home, and hook their (Red & Green) Wires to your (Red & Green) Wires, and your off into the fearless world of phreaking ( i recommend you phreak from these line, so that the owners don't get uptight and look into the matter), unless of course you are doing it for revenge!

  Some Suggestions:

  Take a Bud box Along to do a ANI just to make sure you have the right line, also in some cases you will have to switch between the (Red/Green)

(Black/Yellow) or any other combination  if your area has changed the standard format which id very unlikely.

  Have Fun

                          And Call /\/\aharaja's Hi-Times

                                10 Meg BBS C/F Line

                                   600+ G-files

  And I'm not responsible for your actions.

  If you have any questions just call me at the BBS above.

  Acrylic Box: Written & Created

                      By

                  [ The Pimp ]


aqua
 /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

  /-/   Building The Aqua Box   /-/

  /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

     Every true phreaker lives in fear of the dreaded F.B.I. 'Lock in Trace.'

  For a long time, it was impossible to escape from the lock in trace.

  This box does offer an escape route with simple directions to it.This

  box is quite a simple concept, and almost any phreaker with basic

  electronics knowledge can construct and use it.

  /-/-/-/-/-/-/-/-/-/-/-/

  /-/    The Lock     /-/

  /-/    in Trace     /-/

  /-/-/-/-/-/-/-/-/-/-/-/

      A lock in trace is a device used by the F.B.I. to lock into the phone

  users location so that he can not hang up while a trace is in progress.

  For those of you who are not familiar with the concept of 'locking in',

   then here's a brief description.

       The F.B.I. can tap into a conversation, sort of like a three-way call

  connection. Then, when they get there, they can plug electricity into the

  phone line. All phone connections are held open by a certain voltage of

  electricity, that is why kou sometimes get static and faint connections

  when you are calling far away, because the electricity has trouble keeping

  the lineup. What the lock in trace does is cut into the line and generate

  that same voltage straight into the lines. That way, when you try and hang

  up, voltage is retained. Your phone will ring just like someone was

  calling you even after you hang up. (If you have call waiting, you should

  understand better about that, for call waiting intercepts the electricity

  and makes a tone that means someone is going through your line. Then, it

  is a matter of which voltage is higher. When you push down the receiver,

  then it see-saws the electricity to the other side. When you have a person

  on each line it is impossible to hang up unless one or both of them will

  hang up. If you try to hang up, voltage is retained, and your phone will

  ring. That should give you an understanding of how calling works, also.

  When electricity passes through a certain point on your phone, the

  electricity causes a bell to ring or on some newer phones an electronic

  ring to sound.)

     So, in order to eliminate the trace, you somehow must lower the voltage

  level on your phone line. You should know that every time someone else

  picks up the phone line, then the voltage does decrease a little. In the

  first steps of planning this out, Xerox suggested getting about a hundred

  phones all hooked into the same line that could all be taken off the hook

  at the same time.That would greatly decrease the voltage level. That is

  also why most three-way connections that are using the bell service three

  way calling (which is only $3 a month) become quite faint after a while.

     By now, you should understand the basic idea. You have to drain

  all of the power out of the line so the voltage can not be kept up. A

  rather sudden draining of power could quickly short out the F.B.I. voltage

  machine, because it was only built to sustain the exact voltage necessary

  to keep the voltage out.

     For now, image this. One of the normal radio shack generators that you

  can go pick up that one end of the cord that hooks into the central box

  has a phone jack on it and the other an electrical plug. This way, you can

  "flash" voltage THROUGH the line, but cannot drain it. So, some

  modifications have to be done.

  /-/-/-/-/-/-/-/-/-/-/-/

  /-/   The Aqua Box  /-/

  /-/-/-/-/-/-/-/-/-/-/-/

   Materials needed-

  - A BEOC (Basic Electrical Output Socket), like a small lamp type

    connection, where you just have a simple plug and wire that would plug

    into a light bulb.

  - One of cords mentioned above, if you can't find one then construct your

    own... same voltage connection, but the restrain or must be the central

    box)

  - TWO phone jacks (one for the modem, one for if you are being traced to

    plug the aqua box into)

  - Some cdeativity and easy work.

   NOTICE: No phones have to be destroyed/modified to make this box, so

  don't go out and buy a new phone for it!

     All right, this is a very simple procedure. If you have the BEOC, it

  could drain into anything, a radio, or whatever. The purpose of having

  that is you are going to suck the voltage out from the phone line into the

  electrical appliance so there would be no voltage left to lock you in with.

  1) Take the connection cord. Examine the plug at the end. It should have

     only two prongs, if it has three, still, do not fear. MAKE SURE THE

     ELECTRICAL APPLIANCE IS TURNED OFF unless you wanna become a cdispy

     cditter while making this thing. Most plugs will have a hard plastic

     design on the top of them to prevent you from getting in at the

     electrical wires inside. Well, get a knife and remove it. If you

     want to keep the plug (I don't see why...) then just cut the top off.

     When you look inside, lo and behold, you will see that at the base of

     the prongs there are a few wires connecting in. Those wires conduct the

     power into the appliance. So, you carefully unwrap those from the sides

     and pull them out until they are about an inch ahead of the prongs. If

     you don't wanna keep the jack, then just rip the prongs out. If you

     cover the prongs with insulation tape so they will not connect with the

     wires when the power is being drained from the line.

  2) Do the same thing with the prongs on the other plug, so you have the

     wires evenly connected. Now, wrap the end of the wires around each

     other.

     If you happen to have the other end of the voltage cord hooked into the

     phonephonep 1 reading now, you're too fucking stupid to continue.

     After you've wrapped the wires around each other, then cover the whole

     thing with the plugs with insulating tape. Then, if you built your own

     control box or if you bought one, then cdam all the wires into the and

     re-close it. That box is your ticket out of this.

  3) Re-check everything to make sure it's all in place. This is a pretty

     flimsy connection, but on later models when you get more experienced at

     it then you can solder away at it and form the whole device into one big

     box, with some kind of cheap mattel hand-held game inside to be the

     power connector.

     In order to use itl ofuld pkeep this box handy. Plug it into the jack if

     you want, but it will slightly lower the voltage so it isn't connected.

     When you plug it in, if you see sparks, un-plug it and restart the

     WHOLE thing. But if it just seems fine then leave it.

  /-/-/-/-/-/-/-/-/-/

  /-/ Using it !! /-/

  /-/-/-/-/-/-/-/-/-/

       Now, so you have the whole thing plugged in and all... DO NOT USE

  THIS UNLESS THE SITUATION IS DESPERATE! When the trace has gone on, don't

  panic, un plug your phone, and turn on the appliance that it was hooked

  to. It will need energy to turn itself on, and here's a great source...

  the voltage to keep a phone line open is pretty small and a simple light

  bulb should drain it all in and probably short the F.B.I. computer at the

  same time.

   Happy boxing and stay free!

r


aqua2
 /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

  /-/                           /-/

  /-/      THE AQUA BOX         /-/

  /-/                           /-/

  /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

  /-/                           /-/

  /-/ CONCEPT BY: CAPTAIN XEROX /-/

  /-/                           /-/

  /-/ PLANS BY: THE TRAVELER    /-/

  /-/                           /-/

  /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

   EVERY TRUE PHREAKER LIVES IN FEAR OF THE DREDDED F.B.I. 'LOCK IN TRACE.' FOR

  A LONG TIME, IT WAS IMPOSSIBLE TO ESCAPE FROM THE LOCK IN TRACE. THIS BOX DOES

  OFFER AND ESCAPE ROUTE WITH SIMPLE DIRECTIONS TO IT. THIS BOX IS QUITE A

  SIMPLE CONCEPT, AND ALMOST ANY PHREAKER WITH BASIC ELECTRONICS KNOWLEDGE CAN

  CONSTRUCT AND USE IT.

  /-/-/-/-/-/-/-/-/-/-/-/

  /-/    THE LOCK     /-/

  /-/    IN TRACE     /-/

  /-/-/-/-/-/-/-/-/-/-/-/

   A LOCK IN TRACE IS A DEVICE USED BY THE F.B.I. TO LOCK INTO THE PHONE USERS

  LOCATION SO THAT HE CAN NOT HANG UP WHILE A TRACE IS IN PROGRESS. FOR THOSE OF

  YOU WHO ARE NOT FAMILIAR WITH THE CONECPT OF 'LOCKING IN', THEN HERE'S A BREIF

  DESCIPTION.

   THE F.B.I. CAN TAP INTO A CONVERSATION, SORT OF LIKE A THREE-WAY CALL

  CONNECTION. THEN, WHEN THEY GET THERE, THEY CAN PLUG ELECTRICITY INTO THE

  PHONE LINE. ALL PHONE CONNECTIONS ARE HELD OPEN BY A CERTAIN VOLTAGE OF

  ELECTRICITY, THAT IS WHY YOU SOMETIMES GET STATIC AND FAINT CONNECTIONS WHEN

  YOU ARE CALLING FAR AWAY, BECAUSE THE ELECTRICITY HAS TROUBLE KEEPING THE LINE

  UP. WHAT THE LOCK IN TRACE DOES IS CUT INTO THE LINE AND GENERATE THAT SAME

  VOLTAGE STRAIGHT INTO THE LINES. THAT WAY, WHEN YOU TRY AND HANG UP, VOLTAGE

  IS RETAINED. YOUR PHONE WILL RING JUST LIKE SOMEONE WAS CALLING YOU EVEN AFTER

  YOU HANG UP. (IF YOU HAVE CALL WAITING, YOU SHOULD UNDERSTAND BETTER ABOUT

  THAT, FOR CALL WAITING INTERSEPTS THE ELECTRICITY AND MAKES A TONE THAT MEANS

  SOMEONE IS GOING THROUGH YOUR LINE. THEN, IT IS A MATTER OF WHICH VOLTAGE IS

  HIGHER. WHEN YOU PUSH DOWN THE RECEIVER, THEN IT SEE-SAWS THE ELECTRICITY TO

  THE OTHER SIDE. WHEN YOU HAVE A PERSON ON EACH LINE IT IS IMPOSSIBLE TO HANG

  UP UNLESS ONE OR BOTH OF THEM WILL HANG UP. IF YOU TRY TO HANG UP, VOLTAGE IS

  RETAINED, AND YOUR PHONE WILL RING. THAT SHOULD GIVE YOU AN UNDERSTANDING OF

  HOW CALLING WORKS, ALSO. WHEN ELECTRICITY PASSES THROUGH A CERTAIN POINT ON

  YOUR PHONE, THE ELECTRICITY CAUSES A BELL TO RING OR ON SOME NEWER PHONES AN

  ELECTRONIC RING TO SOUND.)

   SO, IN ORDER TO ELIMINATE THE TRACE, YOU SOMEHOW MUST LOWER THE VOLTAGE LEVEL

  ON YOUR PHONE LINE. YOU SHOULD KNOW THAT EVERY TIME SOMEONE ELSE PICKS UP THE

  PHONE LINE, THEN THE VOLTAGE DOES DECREASE A LITTLE. IN THE FIRST STEPS OF

  PLANNING THIS OUT, XEROX SUGGESTED GETTING ABOUT A HUNDRED PHONES ALL HOOKED

  INTO THE SAME LINE THAT COULD ALL BE TAKEN OFF THE HOOK AT THE SAME TIME.

  THAT WOULD GREATLY DECREASE THE VOLTAGE LEVEL. THAT IS ALSO WHY MOST THREE-

  WAY CONNECTIONS THAT ARE USING THE BELL SERVICE THREE WAY CALLING (WHICH IS

  ONLY $3 A MONTH) BECOME QUITE FAINT AFTER A WHILE.

   BY NOW, YOU SHOULD UNDERSTAND THE BASIC IDEA. YOU HAVE TO DRAIN ALL OF THE

  POWER OUT OF THE LINE SO THE VOLTAGE CAN NOT BE KEPT UP. I RATHER SUDDEN

  DRAINING OF POWER COULD QUICKLY SHORT OUT THE F.B.I. VOLTAGE MACHINE, BECAUSE

  IT WAS ONLY BUILT TO SUSTAIN THE EXACT VOLTAGE NESSECARY TO KEEP THE VOLTAGE

  OUT.

   FOR NOW, IMAGE THIS. ONE OF THE NORMAL RADIO SHACK GENERATORS THAT YOU CAN GO

  PICK UP THAT ONE END OF THE CORD THAT HOOKS INTO THE CENTRAL BOX HAS A PHONE

  JACK ON IT AND THE OTHER HAS AN ELECTRICAL PLUG. THIS WAY, YOU CAN "FLASH"

  VOLTAGE THROUGH THE LINE, BUT CANNOT DRAIN IT. SO, SOME MODIFICATIONS HAVE

  TO BE DONE.

  /-/-/-/-/-/-/-/-/-/-/-/

  /-/   THE AQUA BOX  /-/

  /-/-/-/-/-/-/-/-/-/-/-/

   MATERIALS NEEDED- A BEOC (BASIC ELECTRICAL OUTPUT SOCKET), LIKE A SMALL LAMP

                     TYPE CONNECTION, WHERE YOU JUST HAVE A SIMPLE PLUG AND WIRE

                     THAT WOULD PLUG INTO A LIGHT BULB.

                   - ONE OF CORDS MENTIONED ABOVE, IF YOU CAN'T FIND ONE THEN

                     CONSTRUCT YOUR OWN... SAME VOLTAGE CONNECTION, BUT THE

                     RESTRAINOR MUST BE BUILT IN (I.E. THE CENTRAL BOX)

                   - TWO PHONE JACKS (ONE FOR THE MODEM, ONE FOR IF YOU ARE

                     BEING TRACED TO PLUG THE AQUA BOX INTO)

                   - SOME CREATIVITY AND EASY WORK.

   NOTICE: NO PHONES HAVE TO BE DESTROYED/MODIFIED TO MAKE THIS BOX, SO DON'T GO

           OUT AND BUY A NEW PHONE FOR IT!

   ALL RIGHT, THIS IS A VERY SIMPLE PROCEDURE. IF YOU HAVE THE BEOC, IT COULD

  DRAIN INTO ANYTHING, A RADIO, OR WHATEVER. THE PURPOSE OF HAVING THAT IS

  YOU ARE GOING TO SUCK THE VOLTAGE OUT FROM THE PHONE LINE INTO THE ELECTRICAL

  APPLICENCE SO THERE WOULD BE NO VOLTAGE LEFT TO LOCK YOU IN WITH.

   1)TAKE THE CONNECTION CORD. EXAMINE THE PLUG AT THE END. IT SHOULD HAVE ONLY

  TWO PRONGS, IF IT HAS THREE, STILL, DO NOT FEAR. MAKE SURE THE ELECTRICAL

  APPLIENCE IS TURNED OFF UNLESS YOU WANNA BECOME A CRISPY CRITTER WHILE MAKING

  THIS THING. MOST PLUG WILL HAVE A HARD PLASTIC DESIGN ON THE TOP OF THEM TO

  PREVENT YOU FROM GETTING IN AT THE ELECTRICAL WIRES INSIDE. WELL, GET A NICE

  AND REMOVE IT. IF YOU WANT TO KEEP THE PLUG (I DON'T SEE WHY...) THEN JUST CUT

  THE TOP OFF.

   WHEN YOU LOOK INSIDE, LOW AND BEHOLD, YOU WILL SEE THAT AT THE BASE OF THE

  PRONGS THERE ARE A FEW WIRES CONNECTING IN. THOSE WIRES CONDUCT THE POWER INTO

  THE APPLIANCE. SO, YOU CAREFULLY UNWRAP THOSE FROM THE SIDES AND PULL THEM OUT

  UNTIL THEY ARE ABOUT AND INCH AHEAD OF THE PRONGS. IF YOU WDON'T WANNA KEEP

  THE JACK, THEN JUST RIP THE PRONGS OUT. IF YOU ARE, COVER THE PRONGS WITH

  INSULTATION TAPE SO THEY WILL NOT CONNECT WITH THE WIRES WHEN THE POWER IS

  BEING DRAINED FROM THE LINE.

   2)DO THE SAME THING WITH THE PRONGS ON THE OTHER PLUG, SO YOU HAVE THE WIRES

  EVENLY CONNECTED. NOW, WRAP THE END OF THE WIRES AROUND EACH OTHER. IF YOU

  HAPPEN TO HAVE THE OTHER END OF THE VOLTAGE CORD HOOKED INTO THE PHONE, STOP

  READING NOW, YOUR TOO FUCKING STUPID TO CONTINUE.

   AFTER YOU'VE WRAPPED THE WIRES AROUND EAHC OTHER, THEN COVER THE WHOLE THING

  WITH THE PLUGS WITH INSULATING TAPE. THEN, IF YOU BUILT YOUR OWN CONTROL BOX

  OR IF YOU BOUGHT ONE, THEN CRAM ALL THE WIRES INTO THE AND RECLOSE IT. THAT

  BOX IS YOUR TICKET OUT OF THIS.

   3)RE-CHECK EVERYTHING TO MAKE SURE IT'S ALL IN PLACE. THIS IS A PRETTY FLIMSY

  CONNECTION, BUT ON LATER MODELS WHEN YOU GET MORE EXPERIENCED AT IT THEN YOU

  CAN SAUDER AWAY AT IT AND FORM THE WHOLE DEVICE INTO ONE BIG BOX, WITH SOME

  KIND OF CHEAP MATTEL HAND-HELD GAME INSUkjsoida.

   IN ORDER TO USE IT, JUST KEEP THIS BOX HANDY. PLUG IT INTO THE JACK IF YOU

  WANT, BUT IT WILL SLIGHTLY LOWER THE VOLTAGE SO IT ISN'T CONNECTED. WHEN YOU

  PLUG IT IN, IF YOU SEE SPARKS, UNPLUG IT AND RESTART THE WHOLE THING. BUT IF

  IT JUST SEEMS FINE THEN LEAVE IT.

  /-/-/-/-/-/-/-/-/-/

  /-/ USING IT !! /-/

  /-/-/-/-/-/-/-/-/-/

   NOW, SO YOU HAVE THE WHOLE THING PLUGGED IN AND ALL... DO NOT USE THIS UNLESS

  THE SITUATION IS DESPERATE! WHEN THE TRACE HAS GONE ON, DON'T PANIC, UNPLUG

  YOUR PHONE, AND TURN ON THE APPLIANCE THAT IT WAS HOOKED TO. IT WILL NEED

  ENERGY TO TURN ITSELF ON, AND HERE'S A GREAT SOURCE... THE VOLTAGE TO KEEP

  A PHONE LINE OPEN IS PRETTY SMALL AND A SIMPLE LIGHT BULB SHOULD DRAIN IT ALL

  IN AND PROBABLY SHORT THE F.B.I. COMPUTER AT THE SAME TIME.

   HAPPY BOXING AND STAY FREE!

  LATER,

  KOPY KAT

  CALL THESE BBS:

   /------------------------------\

   |LITTLE AMERICA   (xxx)xxx-xxxx|

   |BRAINSTORM       (xxx)xxx-xxxx|

   |ROGUES GALLERY   (xxx)xxx-xxxx|

   |APPLE ENTERTAIN  (xxx)xxx-xxxx|

   |CITY OF ATLANTIS (xxx)xxx-xxxx|

   |KING'S LAIR      (xxx)xxx-xxxx|

   \------------------------------/

  /\/\/\\/\/\/\/\/\uploaded by Dos Ranger/\/\/\/\/\/\/\//\/\


beige
                          /-/-/-/-/-/-\-\-\-\-\-\

                          <:-\-Biege Box Plans-/-:>

                           \-\-\-\-\-\-/-/-/-/-/-/

  (>Introduction

          Have you ever wanted a lineman's handset?  Surely every phreak

  has at least once considered the phun that he could have with one.

  After searching unlocked phone company trucks for one for months, we

  had an idea.  We could build one.  We did, and named it the "Beige Box,"

  simply because that is the color of ours.  In the following file we

  will give complete instructions for the construction and use of a

  Beige Box.

  (>Construction

          The construction is very simple.  First, you must understand

  the concept of the device.  In a modular jack, there are four wires.

  These are red, green, yellow, and black.  For a single line telephone,

  however, only two matter: the red (ring) and green (tip).  The yellow

  and black are not necessary for this project.  A lineman's handset

  only has two clips on it: the ring and the tip.

          You will need a phone (we reccommend a touch-tone) with a

  modular plug, a modular jack, and two large alligator clips

  (preferably red and green, respectively).  Take the modular jack and

  look at the bottom of its casing.  There should be a grey jack with

  four wires (red, green, yellow, and black) leading out of it.  To the

  end of the red wire attach a red alligator clip.  To the end of the

  green wire attach a green alligator clip.  The yellow and black wires

  can be removed, although I would only set them aside so that you can

  use the modular jack in future projects.  Now insert your telephone's

  modular plug into the modular jack.  That's it.

          This particular model is nice because it can be easily made,

  is inexpensive, uses common parts that are readily available, is

  small, is lightweight, and does not require the destruction of a

  phone.

  (>Uses

          There are many uses for the Beige Box.  However, before you

  can use it, you must know how to attach it to its output device.  This

  device can be any of several Bell switching apparatus that include

  terminal sets (i.e., remote switching centers, bridging heads, cans,

  etc.).  To open most Bell Telephone switching apparatus, you must

  have a 7/16 inch hex driver.  This piece of equipment can be picked

  up at your local hardware store.  With your 7/16 hex driver, turn the

  security bolt(s) approximately 1/8 of an inch counter-clockwise and

  open.  If your output device is locked, then you must have some

  knowledge of destroying and/or picking locks.  However, we have never

  encountered a locked output device.  Once you have opened your output

  device, you should see a mass of wires connected to terminals.  On

  most of your output devices, the terminals should be labeled "T" (Tip

  -- if not labeled, it is usually on the left) and "R" (Ring -- if not

  labeled, it is usually on the right).  Remember: Ring - red -  right.

  The "Three R's" -- a simple way to remember which is which.

          Now you must attach the red alligator clip (ring) to the

  "R" (ring) terminal.  Attach the green alliagtor clip (tip) to the

  "T" (tip) terminal.  NOTE: If instead of a dial tone you hear nothing,

  re-adjust the alligator clips so that they are not touching each other

  or other terminals.  Also make sure that they are firmly attached.

  By this time you should hear a dial tone.  Dial ANI and find out the

  number that you are using (you wouldn't want to use your own).

          Here are some practical applications:

                  o  Eavesdropping

                  o  Long distance, static-free phone calls to phriends

                  o  Dialing direct to Alliance Conferencing (also static-

                     free)

                  o  Phucking people over

                  o  Bothering the operator at little risk to yourself

                  o  Blue Boxing with a greatly reduced chance of getting

                     caught

                  o  Anything at all that you want, since you are an

                     extension on that line

     <>Eavesdropping:

          To be most effective, first attach the Beige Box and then your

  phone.  This eliminates static caused by connecting the box, therefore

  reducing the potential suspicion of your victim.  When eavesdropping,

  it is always best to be neither seen nor heard.  If you hear someone

  dialing out, do not panic; but rather hang up, wait, and pick up the

  receiver again.  The person will either have hung up or tried to

  complete their call again.  If the latter is true, then listen in, and

  perhaps you will find information worthy of blackmail!  If you would

  like to know who you are listening to, after dialing ANI, pull a CN/A

  on the number.

       <>Dialing Long Distance:

          This section is self-explanatory, but don't forget to dial a

  "1" before the NPA.

        <>Dialing Direct to Alliance Conferencing:

          Simply dial 0-700-456-1000 and you will get instructions from

  there.  I prefer this method over PBXs, since PBXs often have poor

  reception and are more difficult to come by.

         <>Phucking People Over:

          This is a very large topic for discussion.  Just by using the

  other functions described, you can create a large phone bill for the

  person (they will not have to pay it, but it is a hassle for them).

  In addition, since you are an extension of the person's line, leave

  your phone off hook, and they will not be able to make or recieve

  calls.  This can be extremely nasty because no one would suspect the

  cause of the problem.

           <>Bothering the Operator:

          This is also self-explanatory and can provide hours of

  entertainment.  Simply ask or say things to her that are offensive and

  you would not like traced to your line.  This also corresponds with the

  previous described section, Phucking People Over.  After all, guess

  who's line it gets traced to? He he he...

             <>Blue Boxing:

          See a file on Blue Boxing for more details.  This is an

  especially nice feature if you live in an ESS-equipped prefix, since

  the calls are, once again, not traced to your line.

  (>Potential Risks

          Overuse of the Beige Box may cause suspicions within the Gestapo,

  and result in legal problems.  Therefore, I would recommend that you:

          o  Use more than one output device

          o  Choose a secluded spot to do your Beige Boxing

          o  Keep a low profile (i.e., do not post under your real name

             on a public BBS concerning your accomplishments)

          o  In order to make sure that the enemy has not been inside your

             ouput device, I reccomend that you place a piece of

             transparent tape over the opening of your output device.

             Therefore, if it is opened in your absence, the tape will be

             displaced and you will be aware of the fact that someone has

             been intruding upon your territory.


beige2
                               THE BEIGE BOX

                                -------------

    A beige box is an easy way of tapping into phone lines. It is basically

    an adaptor for connecting a normal phone with a BT plug onto a pair of

    phone wires.

    You will need: one cheap phone, two crocodile clips, some wire and a

    telephone socket and wallbox. If you use a master (primary) socket your

    phone will be able to ring; if you just use a secondary (slave) socket,

    it will never ring. {but see below.}

                                HOW TO MAKE IT

                                --------------

    Solder the crocodile clips onto each end of half a metre of wire. Cut

    the wire and pass it through a convenient knockout in the socket

    wallbox, so that the clips are on the outside. Connect one wire to pin

    2 of the phone socket, and one to pin 5 of the phone socket. {it is

    easier if your socket has screw terminals rather than IDC terminals,

    especially if your wire is stranded.} Screw the socket onto the wallbox

    and plug in the phone. That's it.

                                HOW TO USE IT

                                -------------

    Clip the clips onto the two wires of a phone line, and dial away.

    That's all you have to do.

                            IDEAS FOR IMPROVEMENTS

                            ----------------------

    1. If you used a secondary socket but later decide you would rather

    have a primary socket, simply add a 1.8uF 100V capacitor in the

    position marked C1 on the PCB inside the socket. {1.5uF or 2.2uF will

    do the job, if you can't get 1.8uF, but it must NOT be an electrolytic

    capacitor, and it MUST be rated 100V or over.} If you are using a

    slimline socket without a PCB, the capacitor should be wired between

    pins 2 and 3.

    2. If you want a line status indicator: get a two-colour LED {the type

    with two leads, that glows red when the current is in one direction and

    green in the other} and a 6.8k resistor. Wire these, in series, across

    the position marked SP1 on the PCB. {don't connect the middle of the

    series pair to anywhere.} For PCB-less sockets, this is the equivalent

    of pins 2 and 5, ie the pair connected to the clips. It will indicate

    the line polarity {red or green} which is not particularly important,

    and the line status {dim = in use, bright = clear} which is.

    Brought to you by ......  . ....   .  .  ... .....

                        :  :..: :..    :.' .:.......:.

                        :  :  : :...   : `. `... .:...

    Original idea by Jolly Roger, modified by THE KEZ for the UK.

    disclaimer: this is for informational purposes only. no responsibility

    is accepted for any consequences of use or misuse of any information

    contained herein. any material whose source i have not acknowledged is

    believed to be my own - if it sounds like something you invented, just

    remember great minds think alike.

K


beige3
___________________________________________________________________________

        Introducing the:                                                 !

     B B B B BB     EEEEEEEEEE   IIIIIIIIIIIII    GGGGGGGGG  EEEEEEEEEE  !

     B         B    E                  I         G           E           !

     B          B   E                  I         G           E           !

     B B B B B B    EEEEEEEEE          I         G           EEEEEEEEEE  !

     B          B   E                  I         G   GGGGG   E           !

     B           B  E                  I         G        G  E           !

     BBBBBBBBBBBB   EEEEEEEEEE   IIIIIIIIIIIII    GGGGGGGGG  EEEEEEEEEE  !

                                                                         !

      B                                                                  !

       O    - Construction and Use -                                     !

        X         Invented and Written by:                               !

                    The Exterminator and The Terminal Man                !

_________________________________________________________________________!

--------------------------------Introduction-------------------------------

    Have you ever wanted a lineman's handset? Surely every phreak has at

least once considered the phun that he could have with one. After searching

unlocked phone company trucks for months, we had an idea. We could build one.

We did, and named it the "Beige Box" simply because that is the color of ours.

In the following file we will give the construction and use  of a Beige Box.

----------------------------Construction and Use---------------------------

    The construction is very simple. First you must understand the concept of

the device. In a modular jack, there are four wires. These are red, green,

yellow, and black. For a single line telephone, however, only two matter: the

red (ring) and green (tip). The yellow and the black are not neccessary for

this project. A lineman's handset has two clips on it: the ring and the tip.

Take a modular jack and look at the bottom of it's casing. There should be a

grey jack with four wires  (red, green, yellow & black) leading out of it. To

the end of the red wire attar plug into the modular

jack. That's it. This particular model is nice because it is can be easily

made, is inexpensive, usues common parts that are readily available, is small,

is lightweight, and does not require the destruction of a phone.

--------------------------------Beige Box Uses----------------------------

    There are many uses for a Beige Box. However, before you can use it, you

must know how to attach it to the output device. This device can be of any of

Bell switching apparatus that include germinal sets (i.e. remote switching

centers, bridgin heads, cans, etc.). To open most Bell Telephone switching

apparatus, you must have a 7/16 inch hex driver (or a good pair of needle nose

pliers work also). This piece of equipment can be picked up at your local

hardware store. With your hex driver (or pliers), turn the security bolt(s)

aproximately 1/8 of an inch counter-clockwise and open. If your output device

is locked, then you must have some knowledge of destroying and/or picking

picking locks. However, we have never encountered a locked output device. Once

you have opened your output device, you should see a mass of wires connected

to terminals. On most output devices, the terminals should be labeled "T" (Tip

-- if not labeled, it is usually on the left) and "R" (Ring -- if not labeled,

usually on the right). Remember: Ring - red - right. The "Three R's" -- a

simple way to remember which is which. Now you must attach all the red

alligator clip (Ring) to the "R" (Ring) terminal. Attach the green alligator

clip (Tip) to the "T" (Tip) terminal. Note: If instead of a dial tone you hear

nothing, adjust the alligator clips so that they are not touching each other

terminals. Also make sure they are firmly attached. By this time you should

hear a dial tone. Dial ANI to find out the number you are using (you wouldn't

want to use your own). Here are some practicle aplications:

       o Eavesdropping

       o Long distance, static free free fone calls to phriends

       o Dialing direct to Alliance Telec  Code scan:  to 999999


black
                              BLACK BOX PLANS

  HERE IS HOW YOU CONSTRUCT A BLACK BOX.

    WHEN YOUR PHONE IS JUST SITTING THERE DOING NOTHING THE

  VOLTAGE THROUGH THE PHONE LINE IS ZERO. THEN IF SOMEONE CALLS

  YOU (FOR SOME STRANGE REASON) AND THE PHONE IS RINGING. THE

  VOLTAGE JUMPS TO 48 VOLTS WHICH TELLS MA BELL TO STAND BY IF YOU

  SHOULD PICK UP SO SHE CAN BILL YOU. WHEN YOU EVENTUALLY PICK UP

  THE PHONE, THE VOLTAGE DROPS TO 10 VOLTS AND THE BILLING STARTS.

  WHAT A BLACK BOX DOES IS KEEPS THE THE VOLTAGE AS 36 VOLTS,

  THEREFORE THE INCOMING CALLER NEVER GETS BILLED (INGEINIOUS)

    THE ORIGINAL BLACK BOX WAS CREATED BY AN EX-BELL EMPLOYEE WHO

  WENT BY THE NAME "CAPTAIN CRUNCH". HE GOT HIS NAME FROM THOSE

  LITTLE WHISLES YOU GOT IN BOXES OF CAPTAIN CRUNCH BECAUSE THEY

  EMITED A TONE THAT WAS EQUAL TO A COIN.CAPTAIN CRUNCH JUST

  ANNOUNCED  HIS RETIREMENT FROM PHREAKING WHEN HE WAS RELEASED

  FROM A CALIFORNIA JAIL. HE WAS CAUGHT WITH A BLUE BOX.

   CONSTRUCTION OF A

    BLACK BOX

    1] A 36 VOLT ZENER DIODE.

    2] A CERAMIC OR MYLAR CAPACITOR OF 0.1 MICROFARAD.

    3] A ELECTROLYTIC CAPACITOR OF 1.0 MICROFARAD.

   YOU CAN GET THESE AT YOUR LOCAL RADIO SHACK DEALER.

  FIRST YOU HAVE TO OPEN UP YOUR PHONE.YOU SHOULD NOTICE THREE

  WIRES COMING IN FROM THE BACK OF THE PHONE, A GREEN, RED, AND

  YELLOW. MOST OF THE TIME THEY CAN DIFFER.DON'T WORRY ABOUT THE

  YELLOW WIRE, WE WILL NOT BE USING THIS.YOU WILL NEED TO FIND THE

  MOST POSITIVE OF THE REMAINING TWO WIRES.(ALMOST ALWAYS THE

  GREEN WIRE). NOW CONNECT THE BANDED END OF THE ZENER DIODE TO

  THE MORE POSITIVE OF THESE TWO WIRES. "IN SERIES". YOU HAVE JUST

  COMPLETED THE FIRST STEP.  FOR THE SECOND STEP YOU NEED A

  CERAMIC OR MYLAR CAPACITOR OF 0.1 MICROFARAD. YOU CONNECT THIS

  "IN PARRALLEL" ACROSS THE DIODE. THIS IS NEEDED TO ALLOW THE

  DIODE TO PASS VOICE SIGNALS.  NOW FOR THE FINAL STEP TAKE YOUR

  ELECTROLYTIC CAPACITOR OF UP TO ONE MICROFARAD WITH ITS '+' END

  CONNECTED TO THE BANDED END OF THE DIODE AND THE OTHER END

  SHOULD BE CONNECTED TO THE ANODE END OF THE DIODE. MA BELL IS

  NOT TOTALLY OBLIVIOUS TO THIS.IF THE PHONE RINGS FOR ABOUT A

  HALF-HOUR THEY WILL THINK SOMETHING IS WRONG AND BILL YOU

  ANYWAY.  WHEN USING A BLACK BOX,YOUR PHONE WILL CONTINUE RING

  EVEN THOUGH YOU PICKED IT UP. YOU HAVE TO MAKE A SWITCH TO

  CONNECT ONE OF THE RINGER WIRES.THAT WILL SHUT IT OFF. THAT'S

  IT! HAVE PHUN!!!!!!!!!!!!!!!!

  <><><><><><><><><><><><><><><><><><><><><><><><><><<><>

p


black2

FROM: THE PIRATE CLUB/1200

EDITED BY: CRACKER JACK

***************************************

*                                     *

*      HOW TO BUILD A BLACK BOX       *

*                                     *

***************************************

  TO ALL WHO DARE --

     WHAT IS A BLACK BOX?   A BLACK BOX

IS  A DEVICE THAT IS HOOKED UP TO  YOUR

FONE  THAT FIXES YOUR FONE SO THAT WHEN

YOU GET A CALL,  THE CALLER DOESN'T GET

CHARGED FOR THE CALL.  THIS IS GOOD FOR

CALLS  UP TO 1/2 HOUR,  AFTER 1/2  HOUR

THE FONE CO.  GETS SUSPICIOUS, AND THEN

YOU CAN GUESS WHAT HAPPENS.

THE WAY IT WORKS:

     WHAT  THIS LITTLE BEAUTY  DOES  IS

KEEP THE LINE VOLTAGE FROM DROPPING  TO

10V  WHEN  YOU ANSWER YOUR  FONE.   THE

LINE IS INSTED KEPT AT 36V AND IT  WILL

MAKE  THE  FONE THINK THAT IT IS  STILL

RINGING WHILE YOUR TALKING.  THE REASON

FOR THE 1/2 HOUR TIME LIMIT IS THAT THE

FONE CO. THINKS THAT SOMETHING IS WRONG

AFTER 1/2 AN HOUR OF RINGING.

     ALL  PARTS  ARE  AVAILABLE   RADIO

SHACK.   USING THE LEAST POSSIBLE PARTS

AND ARANGEMENT,  THE COST IS $0.98 !!!!

AND  THAT  IS  PARTS FOR TWO  OF  THEM!

TALK  ABOUT  A DEAL!   IF YOU  WANT  TO

SPLURGE  THEN  YOU CAN GET A  SMALL  PC

BOARD,  AND  A SWITCH.   THERE ARE  TWO

SCHEMATICS  FOR THIS BOX,  ONE  IS  FOR

MOST  NORMAL FONES.   THE SECOND ONE IS

FOR  FONES  THAT DON'T  WORK  WITH  THE

FIRST.  IT WAS MADE FOR USE WITH A BELL

TRIMLINE TOUCH TONE FONE.

  **  SCHEMATIC 1 FOR MOST FONES  **

  **         LED ON: BOX ON       **

FROM >--------------------GREEN->  TO

LINE >--!   1.8K  LED  !---RED--> FONE

        !--/\/\/\--!>--!

        !              !

        ------>/<-------

              SPST

PARTS:  1 1.8K 1/2 WATT RESISTOR

        1 1.5V LED

  1 SPST SWITCH

YOU  MAY JUST HAVE TWO WIRES WHICH  YOU

CONNECT TOGETHER FOR THE SWITCH.

  **  SCHEMATIC 2 FOR ALL FONES  **

  **        LED ON: BOX OFF      **

FROM >---------------GREEN->  TO

LINE >-------      ---RED--> FONE

            !  LED !

         -->/<--!>--

         !         !

         ---/\/\/---

             1.8K

PARTS:  1 1.8K 1/2 WATT RESISTOR

        1 1.5V LED

       1 DPST SWITCH

     HERE IS THE PC BOARD LAYOUT THAT I

RECOMMEND  USING.   IT  IS NEAT AND  IS

VERY EASY TO HOOK UP.

   SCHEMATIC #1        SCHEMATIC #2

  **************     ****************

  *            *     *  -------     *

  * --<LED>--- *     *  !     !     *

  * !        ! *     *  ! <SWITCH>  *

  * RESISTOR ! *     *  ! !      !  *

  *        ! ! *     *  ! !      /  *

  * -------- ! *     *  ! !      \  *

  * !        ! *     *  ! <LED>! /  *

  * --SWITCH-- *     *  !      ! \  *

  *  !      !  *     *  !      ! /  *

L *  !      !  * F L *  !      ! !  * F

I>RED-      -RED>O I>RED-      ---RED>O

N>-----GREEN---->N N>-----GREEN------>N

E * H          * E E *              * E

  **************     ****************

     ONCE YOU HAVE HOOKED UP ALL  THE

PARTS,  YOU MUST FIGURE OUT WHAT SET OF

WIRES  GO TO THE LINE AND WHICH  GO  TO

THE FONE.   THIS IS BECAUSE OF THE FACT

THAT LED'S MUST BE PUT IN, IN A CERTAIN

DIRECTION.  DEPENDING  ON WHICH WAY YOU

PUT THE LED IS WHAT CONTROLS WHAT WIRES

ARE FOR THE LINE & FONE.

HOW TO FIND OUT:

     HOOK  UP THE BOX IN ONE  DIRECTION

USING ONE SET OF WIRES FOR LINE AND THE

OTHER FOR FONE.

*NOTE*  FOR MODEL I SWITCH SHOULD BE

OFF.

*NOTE*  FOR MODEL ][ SWITCH  SHOULD  BE

        SET TO SIDE CONNECTING THE LED.

     ONCE  YOU HAVE HOOKED IT UP,  THEN

PICK UP THE FONE AND SEE IF THE LED  IS

ON.  IF IT IS, THE LED WILL BE LIT.  IF

IS  DOESN'T LIGHT THEN SWITCH THE WIRES

AND TRY AGAIN.  ONCE YOU KNOW WHICH ARE

WHICH  THEN LABEL  THEM.   *NOTE*  - IF

NEITHER  DIRECTIONS  WORKED  THEN  YOUR

SWITCH WAS IN THE WRONG POSITION.   NOW

LABLE   THE   SWITCH  IN  ITS   CURRENT

POSITION AS BOX ON.

HOW TO USE IT:

     THE PURPOSE OF THIS BOX IS NOT  TO

POEPLE  WHO  CALL YOU SO IT WOULD  MAKE

SENCE  THAT  IT  CAN ONLY  BE  USED  TO

RECEIVE! CALLS.   WHEN THE BOX IS  *ON*

THEN YOU MAY ONLY RECIEVE CALLS.   YOUR

FONE WILL RING LIKE NORMAL AND THE  LED

ON  THE BOX WILL FLASH.   IF YOU ANSWER

THE FONE NOW, THEN THE LED WILL

LIGHT AND THE CALLER WILL NOT BE CHARGE

D.

HANG  UP  THE FONE AFTER YOU  ARE  DONE

TALKING LIKE NORMAL.   YOU WILL NOT  BE

ABLE  TO  GET A DIAL-TONE OR CALL  WHEN

THE  BOX IS ON,  SO TURN THE BOX  *OFF*

FOR  NORMAL CALLS.   I DON'T  RECOMMEND

THAT YOU LEAVE IT ON ALL THE  TIME,  AS

YOU DON'T WANT IT TO ANSWER WHEN MA

BELL CALLS!

<<<    THE PIRATE CLUB/1200    >>>


black3
                          /-/-/-/-/-/-\-\-\-\-\-\

                          <:-\-Black Box Plans-/-:>

                           \-\-\-\-\-\-/-/-/-/-/-/

  (>Introduction<)

             What is a BLACK BOX? A BLACK BOX is a device that is hooked up

  to your phone that fixes your phone so that when you get a call, the

  caller doesn't get charged for the call. This is good for calls up to 1/2

  hour, after 1/2  hour the Gestapo (the you can guess what happens.

             What this little beauty does is keep the line voltage from

  dropping  to 10v when you answer your phone. The line is insted kept at

  36v and it will make the phone think that it is still ringing while your

  talking. The reason for the 1/2 hour time limit is that the Gestapo thinks

  that something is wrong after 1/2 an hour of ringing. (I mean, come on)

  (>Phone Modification Instructions<)

       All parts are available  Radio Shack. Using the least possible parts

  and arrangement, the cost is $0.98; and that is parts for two  of them!

  Talk  about a deal! If you  want  to splurge then you can get a board, and

  a switch. There are two s

                      **  Schematic 1 for most fones  **

                      **         LED ON: BOX ON       **

                    FROM >--------------------GREEN->  TO

                    LINE >--!   1.8k  LED  !---RED--> FONE

                            !--/\/\/\--!>--!

                            !              !

                            ------>/<-------

                                 SPST

    Parts:  1 1.8k 1/2 watt resistor

            1 1.5v LED

            1 SPST switch

   *You may just have two wires which you connect together for the switch.

                       **  Schematic 2 for all fones  **

                       **        LED ON: BOX OFF      **

                     FROM >---------------GREEN->  TO

                     LINE >-------      ---RED--> FONE

                                 !  LED !

                               ---->/<--!>--

                               !         !

                               ---/\/\/---

                                  1.8k

    Parts:  1 1.8k 1/2 watt resistor

            1 1.5v LED

            1 DPST switch

         Here is the PC board layout that I recommend using. It is neat and is

  very easy to hook up:

                      Schematic #1        Schematic #2

                     **************     ****************

                     *            *     *  -------     *

                     * --<LED>--- *     *  !     !     *

                     * !        ! *     *  ! <SWITCH>  *

                     * RESISTOR ! *     *  ! !      !  *

                     *        ! ! *     *  ! !      /  *

                     * -------- ! *     *  ! !      \  *

                     * !        ! *     *  ! <LED>! /  *

                     * --SWITCH-- *     *  !      ! \  *

                     *  !      !  *     *  !      ! /  *

                   L *  !      !  * F L *  !      ! !  * F

                   I>RED-      -RED>O I>RED-      ---RED>O

                   N>-----GREEN---->N N>-----GREEN------>N

                   E * h          * E E *              * E

                     **************     ****************

             Once you have hooked up all the parts, you must figure out what

  set of wires go to the line and which go to the fone. This is because of

  the fact that LED's must be put in, in a certain direction.  Depending  on

  which way you put the LED is what controls what wires are for the line &

  fone.

             In order to find out, hook up the box in one  direction using

  one set of wires for line and the other for phone.

             *NOTE*  For Model I switch should be OFF.

             *NOTE*  For Model ][ switch  should  be

                    set to side connecting the LED.

       Once  you have hooked it up,  then pick up the fone and see if the

  LED  is on.  If it is, the LED will be lit.  If is  doesn't light then

  switch the wires and try again.  Once you know which are which  then label

  them.   *NOTE*  - If neither  directions  worked  then  your switch was in

  the wrong position.   Now lable   the   switch  in  its   current position

  as BOX ON.

  (>Black Box Usage<)

       The purpose of this box is not  to people  who  call you so it would

  make sense  that  it  can only  be  used  to recieve calls.   When the box

  is  *ON* then you may only recieve calls. Your phone will ring like normal

  and the  LED light on the box will flash. When you answer the fone the LED

  will light and the caller will not be charged. Hang up the fone after you

  are done like normal. You will not be ab

//TM sez: this one is incomplete. Sorry, gang.


black4
***************************************

*                                     *

*      How to build a BLACK BOX       *

*                                     *

***************************************

  To all who dare --

     What is a BLACK BOX?   A BLACK BOX

is  a device that is hooked up to  your

fone  that fixes your fone so that when

you get a call,  the caller doesn't get

charged for the call.  This is good for

calls  up to 1/2 hour,  after 1/2  hour

the Fone Co.  gets suspicious, and then

you can guess what happens.

The way it works:

     What  this little beauty  does  is

keep the line voltage from dropping  to

10v  when  you answer your  fone.   The

line is insted kept at 36v and it  will

make  the  fone think that it is  still

ringing while your talking.  The reason

for the 1/2 hour time limit is that the

Fone CO. thinks that something is wrong

after 1/2 an hour of ringing.

     All  parts  are  available   Radio

Shack.   Using the least possible parts

and arangement,  the cost is $0.98 !!!!

And  that  is  parts for two  of  them!

Talk  about  a deal!   If you  want  to

splurge  then  you can get a  small  PC

board,  and  a switch.   There are  two

schematics  for this box,  one  is  for

most  normal fones.   The second one is

for  fones  that don't  work  with  the

first.  It was made for use with a Bell

Trimline touch tone fone.

  **  Schematic 1 for most fones  **

  **         LED ON: BOX ON       **

FROM >--------------------GREEN->  TO

LINE >--!   1.8k  LED  !---RED--> FONE

        !--/\/\/\--!>--!

        !              !

        ------>/<-------

              SPST

Parts:  1 1.8k 1/2 watt resistor

        1 1.5v LED

        1 SPST switch

You  may just have two wires which  you

connect together for the switch.

  **  Schematic 2 for all fones  **

  **        LED ON: BOX OFF      **

FROM >---------------GREEN->  TO

LINE >-------      ---RED--> FONE

            !  LED !

         -->/<--!>--

         !         !

         ---/\/\/---

             1.8k

Parts:  1 1.8k 1/2 watt resistor

        1 1.5v LED

       1 DPST switch

     Here is the PC board layout that I

recommend  using.   It  is neat and  is

very easy to hook up.

   Schematic #1        Schematic #2

  **************     ****************

  *            *     *  -------     *

  * --<LED>--- *     *  !     !     *

  * !        ! *     *  ! <SWITCH>  *

  * RESISTOR ! *     *  ! !      !  *

  *        ! ! *     *  ! !      /  *

  * -------- ! *     *  ! !      \  *

  * !        ! *     *  ! <LED>! /  *

  * --SWITCH-- *     *  !      ! \  *

  *  !      !  *     *  !      ! /  *

L *  !      !  * F L *  !      ! !  * F

I>RED-      -RED>O I>RED-      ---RED>O

N>-----GREEN---->N N>-----GREEN------>N

E * h          * E E *              * E

  **************     ****************

     Once you have hooked up all  the

parts,  you must figure out what set of

wires  go to the line and which  go  to

the fone.   This is because of the fact

that LED's must be put in, in a certain

direction.  Depending  on which way you

put the LED is what controls what wires

are for the line & fone.

How to find out:

     Hook  up the box in one  direction

using one set of wires for line and the

other for fone.

*NOTE*  For Model I switch should be OFF.

*NOTE*  For Model ][ switch  should  be

        set to side connecting the led.

     Once  you have hooked it up,  then

pick up the fone and see if the LED  is

on.  If it is, the LED will be lit.  If

is  doesn't light then switch the wires

and try again.  Once you know which are

which  then label  them.   *NOTE*  - If

neither  directions  worked  then  your

switch was in the wrong position.   Now

lable   the   switch  in  its   current

position as BOX ON.

How to use it:

     The purpose of this box is not  to

poeple  who  call you so it would  make

sence  that  it  can only  be  used  to

receive! calls.   When the box is  *ON*

then you may only recieve calls.   Your

fone will ring like normal and the  LED

on  the box will flash.   If you answer

the fone now, then the LED will

light and the caller will not be charged.

Hang  up  the fone after you  are  done

talking like normal.   You will not  be

able  to  get a dial-tone or call  when

the  box is on,  so turn the box  *OFF*

for  normal calls.   I don't  recommend

that you leave it on all the  time,  as

you don't want it to answer when Ma

Bell calls!

   from Plover-Net

          (xxx) xxx-xxxx


blast
 [=-=================================-=]

  [=-=]        Presenting:          [=-=]

  [=-=]      The !BLAST! Box        [=-=]

  [=-=]     An *ORIGINAL* Box,      [=-=]

  [=-=]  Designed And Invented By   [=-=]

  [=-=]    (_> Shadow Hawk 1<_)     [=-=]

  [=-=================================-=]

  Ever want to really make yourself be heard? Ever talk to someone on the phone

  who just doesn't shut up? Or just call the operator and pop her eardrum? Well,

  Up until recently it has been impossible for you to do theese things. That is,

  unless of course you've got a blast box. All a blast box is, is a really cheap

  amplifier, (around 5 watts or so) connected in place of the microphone on your

  telephone. It works best on model 500 AT&T Phones, and if constructed small

  enough, can be placed inside the phone.

  Construction:

   Construction is not really important. Well it is, but since I'm letting you

  make your own amp, I really don't have to include this.

  Usage:

  Once you've built your blast box, simply connect a microphone (or use the

  microphone from the phone) to the input of the amplifier, and presto. There it

  is.  Now, believe it or not, this device actually works. (At least on

  crossbar.) It seems that illinois bell switching systems allow quite alot of

  current to pass right through the switching office, and out to whoever you're

  calling. When you talk in the phone, it comes out of the other phone (again it

  works best if the phone that you're calling has the standard western electric

  earpiece) incredibly loud. This device is espicially good for PBS Subscription

  drives.

  Have Phun, and don't get caught!

  (_> Shadow Hawk 1 <_)


blotto
                          %+%+%+%+%+%+%+%+%+%+%+%+%+

                           %HOW TO BUILD A BLOTO BOX+

                           %+%+%+%+%+%+%+%+%+%+%+%+%+

   Finally, it is here! What was first conceived as a joke to fool the inncoent

  phreakers around America has finally been concieved by the one phreak who is

  the expert on lines and voltage: The Traveler. Other boxes by the Traveler

  include the White Gold Box, the Aqua Box, The Diverti Box, and the Cold Box.

  All of those plans will soon be available in a BBS/AE near you!

   Well, for you people who are unenlightened about the Blotto Box, here is a

  brief summery of a legend.

  --*-=> The Blotto Box <=-*--

     For years now every pirate has dreamed of the Blotto Box. It was at first

  made as a joke to mock more ignorant people into thinking that the function

  of it actually was possible. Well, if you are The Voltage Master, it is

  possible. Originally conceived by King Blotto of much fame, the Blotto Box is

  finally available to the public.

     NOTE: The Traveler can not be responcable for the information disclosed in

  the file! This file is strictly for informational purposes and should not be

  actually built and used! Usage of this electronical impulse machine could have

  the severe results listed below and could result in high federal prosecution!

     All right, now that that is cleared up, here is the basis of the box and

  it's function.

     The Blotto Box is every phreaks dream... you could hold AT&T down on it's

  knee's with this device. Because, quite simply, it can turn off the phone

  lines everywhere. Nothing. Blotto. No calls will be allowed out of an area

  code, and no calls will be allowed in. No calls can be made inside it for that

  matter. As long as the switchhing system stays the same, this box will not

  stop at a mere area code. It will stop at nothing. The electrical impulses

  that emit from this box will open every line. Every line will ring and ring

  and ring... the voltage will never be cut off until the box/ generator is

  stopped. This is no 200 volt job, here. We are talking GENERATOR. Every phone

  line will continue to ring, and people close to the box may be electricuted if

  they pick up the phone.

     But, the Blotto Box can be stopped by merely cutting of the line or

  generator. If they are cut off then nothing will emit any longer. It will take

  a while for the box to calm back down again, but that is merely a superficial

  aftereffect. Once again: Construction and use of this box is not advised! The

  Blotto Box will continue as long as thee is electricity to continue with.

     OK, that is what it does, now, here are some interesting things for you to

  do with it...

  --*-=> The Blotto Box Functions and Installation <=-*--

     Once you have installed your Blotto, there is no turning back. The

  following are the instructions for construction and use of this box. Please

  read and heed all warnings in the above section before you attempt to

  construct this box.

     Materials:

               - A Honda portable generator or a main power outlet like in a

                 stadium or some such place.

               - A radio shack cord set for 400 volts that splices a female

                 plug into a phone line jack.

               - A meter of voltage to attach to the box itself.

               - A green base (i.e. one of the nice boxes about 3' by 4' that

                 you see around in your neighborhood. They are the main switch

                 boards and would be a more effective line to start with.

                 or: A regular phone jack (not your own, and not in your area

                     code!

               - A soudering iron and much souder.

               - A remote control or long wooden pole.

     Now. You must have guessed the construction from that. If not, here goes,

  I will explain in detail. Take the Honda Portable Generator and all of the

  other listed equiptment and go out and hunt for a green base. Make sure it is

  one on the ground or hanging at head level from a pole, not the huge ones at

  the top of telephone poles. Open it up with anything convienent, if you are

  two feeble that fuck don't try this. Take a look inside... you are hunting

  for color-coordinating lines of green and red. Now, take out your radio shack

  cord and rip the meter thing off. Replace it with the voltage meter about. A

  good level to set the voltage to is about 1000 volts. Now, attach the voltage

  meter to the cord and set the limit for one thousand. Plug the other end of

  the cord into the generator. Take the phone jack and splice the jack part

  off. Open it up and match the red and green wires with the other red and green

  wires. NOTE: If you just had the generator on and have done this in the

  correct order, you will be a crispy critter. Keep the generator off until you

  plan to start it up. Now, sauder those lines together carefully. Wrap duck

  tape or insultation tape around all of the wires. Now, place the remote

  control right on to the startup of the generator. If you have the long pole,

  make sure it is very long and stand back as far away as you can get and reach

  the pole over. NOTICE: If you are going right along with this without reading

  the file first, you sill realize now tHat your area code is about to become

  null! Then, getting back, twitch the pole/remote control and run for your

  damn life. Anywhere, just get away from it. It will be generating so much

  electricity that if you stand to close you will kill yourself. The generator

  will smoke, etc. but will not stop. You are now killing your area code,

  because all of that energy is spreading through all of the phone lines around

  you in every direction.

     Have a nice day!

  --*-=> The Blotto Box: Aftermath <=-*--

  Original Idea: King Blotto.


blue
Blue Box                               courtesy of the Jolly Roger

To quote Karl Marx, blue boxing has always been the most noble form of

phreaking. As opposed to such things as using an MCI code to make a free

fone call, which is merely mindless pseudo-phreaking, blue boxing

is actual interaction with the Bell System toll network.

It is likewise advisable to be more cautious when blue boxing, but the

careful phreak will not be caught, regardless of what type of switching

system he is under.

In this part, I will explain how and why blue boxing works, as well as

where. In later parts, I will give more practical information for blue

boxing and routing information. To begin with, blue boxing is simply

communicating with trunks. Trunks must not be confused with subscriber

lines (or "customer loops") which are standard telefone lines. Trunks are

those lines that connect central offices. Now, when trunks are not in

use (i.e., idle or "on-hook" state) they have 2600Hz applied to them. If

they are two-way trunks, there is 2600Hz in both directions. When a trunk

IS in use (busy or "off-hook" state), the 2600Hz is removed from the side

that is off-hook. The 2600Hz is therefore known as a supervisory

signal, because it indicates the status of a trunk; on hook (tone) or

off-hook (no tone). Note also that 2600Hz denoted SF (single frequency)

signalling and is "in-band." This is very important. "In-band" means that

is within the band of frequencies that may be transmitted over normal

telefone lines. Other SF signals, such as 3700Hz are used also. However,

they cannot be carried over the telefone network normally (they are

"out-of-band" and are therefore not able to be taken advantage of as

2600Hz is. Back to trunks. Let's take a hypothetical phone call. You pick

up your fone and dial 1+806-258-1234 (your good friend in Amarillo, Texas).

For ease, we'll assume that you are on #5 Crossbar switching and not in the

806 area. Your central office (CO) would recognize that 806 is a foreign

NPA, so it would route the call to the toll centre that serves you.

[For the sake of accuracy here, and for the more experienced readers,

note that the CO in question is a class 5 with LAMA that uses out-of-band

SF supervisory signalling]. Depending on where you are in the country,

the call would leave your toll centre (on more trunks) to another toll

centre, or office of higher "rank". Then it would be routed to central

office 806-258 eventually and the call would be completed.

            Illustration

A---CO1-------TC1------TC2----CO2----B

A.... you

CO1=your central office

TC1.. your toll office.

TC2.. toll office in Amarillo.

CO2.. 806-258 central office.

B.... your friend (806-258-1234)

In this situation it would be realistic to say that CO2 uses SF

in-band (2600Hz) signalling, while all the others use out-of-band signal-

ling (3700Hz). If you don't understand this, don't worry. I am pointing

this out merely for the sake of accuracy. The point is that while you

are connected to 806-258-1234, all those trunks from YOUR central office

(CO1) to the 806-258 central office (CO2) do *NOT* have 2600Hz on them,

indicating to the Bell equipment that a call is in progress and the trunk

are in use.

Now let's say you're tired of talking to your friend in Amarillo, so you

send a 2600Hz down the line. This tone travels down the line to your

friend's central office (CO2) where it is detected. However, that CO thinks

that the 2600Hz is originating from Bell equipment, indicating to it

that you've hung up, and thus the trunks are once again idle (with 2600Hz

present on them). But actually, you have not hung up, you have fooled the

equipment atyour friend's CO into thinking you have. Thus,it disconnects

him and resets the equipment to prepare for the next call. All this happens

very quickly (300-800ms for step-by-step equipment and 150-400ms for other

equipment). When you stop sending 2600Hz (after about a second), the

equipment thinks that another call is coming towards

--> on hook, no tone -->off hook.

Now that you've stopped sending 2600Hz, several things happen:

1) A trunk is seized.

2) A "wink" is sent to the CALLING end from the CALLED end indicating that

the CALLED end (trunk) is not ready to receive digits yet.

3) A register is found and attached to the CALLED end of the trunk within

about two seconds (max).

4) A start-dial signal is sent to the CALLING end from the CALLED end

indicating that the CALLED end is ready to receive digits.

Now, all of this is pretty much transparent to the blue boxer. All he

really hears when these four things happen is a <beep><kerchunk>. So,

seizure of a trunk would go something like this.

1> Send a 2600Hz

2> Terminate 2600Hz after 1-2 secs.

3> [beep][kerchunk]

Once this happens, you are connected to a tandem that is ready to obey your

every command. The next step is to send signalling information in order to

place your call. For this you must simulate the signalling used by

operators and automatic toll-dialing equipment for use on trunks. There are

mainly two systems, DP and MF. However, DP went out with the dinosaurs, so

I'll only discuss MF signalling. MF (multi-frequency) signalling is the

signalling used by the majority of the inter- and intra-lata network. It is

also used in international dialing known as the CCITT no.5 system.

MF signals consist of 7 frequecies, beginning with 700Hz and separated by

200Hz. A different set of two of the 7 frequencies represent the digits 0

thru 9, plus an additional 5 special keys. The frequencies and uses are as

follows:

Frequencies (Hz)  Domestic    Int'l

-------------------------------------

 700+900             1          1

 700+1100            2          2

 900+1100            3          3

 700+1300            4          4

 900+1300            5          5

1100+1300            6          6

 700+1500            7          7

 900+1500            8          8

1100+1500            9          9

1300+1500            0          0

 700+1700           ST3p       Code 1

 900+1700           STp        Code 1

1100+1700           KP         KP1

1300+1700           ST2p       KP2

1500+1700           ST         ST

 The timing of all the MF signals is a nominal 60ms, except for KP, which

should have a duration of 100ms. There should also be a 60ms silent period

between digits. This is very flexible however, and most Bell equipment will

accept outrageous timings. In addition to the standard uses

listed above, MF pulsing also has expanded usages known as "expanded

inband signalling" that include such things as coin collect, coin return,

ringback, operator attached, and operator attached, and operator

released. KP2, code 11, and code 12 and the ST_ps (STart "primes" all have

special uses which will be mentioned only briefly here.

To complete a call using a blue box once seizure of a trunk has been

accomplished by sending 2600Hz and pausing for the <beep><kerchunk>, one

must first send a KP. This readies the register for the digits that follow.

For a standard domestic call, the KP would be followed by either 7 digits

(if the call were in the same NPA as the seized trunk) or 10 digits (if the

call were not in the same NPA as the seized trunk). [Exactly like dialing

normal fone call]. Following either the KP and 7 or 10 digits, a STart is

sent to signify that no more digits follow. Example of a complete call:

1> Dial 1-806-258-1234

2> wait for a call-progress indication (such as ring,busy,recording,etc.)

3> Send 2600Hz for about 1 second.

4> Wait for about ll-progress indication (such as ring,busy,recording,etc.)

5> Send KP+305+994+9966+ST

The call will then connect if everything was done properly. Note that if a

call to an 806 number were being placed in the same situation, the are code

would be omitted and only KP + seven digits + ST would be sent.

Code 11 and code 12 are used in international calling to request

certain types of operators. KP2 is used in international calling to route a

call other than by way of the normal route, whether for economic or

equipment reasons. STp, ST2p, and ST3p (prime, two prime, and three prime)

are used in TSPS signalling to indicate calling type of call (such as

coin-direct dialing.


blue2
          ____________________________________________________________

        |                                                           |

        |                      | \            Call Info Station     |

        |                 Blue | /                And Blue Fire BBS |

        |                      | \                                  |

        |                      |_/ oxing                            |

        |                                                           |

        |                   Safely Today.                           |

        |                       Written by The Micro Master         |

        |               A Micro World Inc.   G-file.                |

        |___________________________________________________________|

        Blue Boxing:  This file assmes you have made and/or know how to make a Blue Box, that you know how to use a Blue Box, and that you know what a Blue Box can do for you.

        Blue Boxing at first:

        When Blue Boxing first started At&t (called Bell at the time) was totaly unwary for this move.  Blue Box tones where ordinginally created for the operator and the phone repair man.  Using them phreaks used to tap lines, call anywhere for free, etc.

        Then one dreaded day somebody at Bell caught on and BAM, people where busted like mad cause they thought blue box was safe.

        Suddenly, people relized that it was not safe all the time, not safe sometimes, not safe at all.  NEVER could you sue a Blue Box without being busted.  But even after all this, Bell (and now At&t) still used Blue Box tone and they are still being

used today.

        Now, how they got busted.

        Every time a Blue Box tone is used, the number is came from is put on a list.  This list contains all places where Blue Box tones came from in your area code.  Now, just cause your name is on this list dosen't mean that your busted or anything, yo

ur still fine.  However, at the end of the week another list is compared to the list of where the tones came from.  If your NOT on this list you are in BIG trouble.  Expect a vist to court.

        Now, the trick of not getting busted.

        The first thing is obvious.  You must get on the second list mentioned above.  Then your stumped, how do I get on that list?!?!?

        Getting on a Blue Box tone list.

        Alright, all operators are always on the list.  So if you have a neighbor who is an operator, just put in a tap.  No problem.

        Now your saying "Oh great, all I have to do is move nextdoor to an operator.  I read this whole G-file just to find that out!" Wrong.  That's is the easiest way but by no means the only.

        Another way:  When a phone repair man comes to your house and either instals a new line, tests an old line, fixs a phone.  Fixes a tine or works on your main Box (you know those big GREEN BOXS sitting in about every 8th house's yard.  Then your nu

mber goes on the list.

        By knowing a repair man you can get on this list or after having the line fixed, you can drag out your blue box and have some fun!

        Finnaly.  I have never succed in this but I know it DOES work.

        Run a war dial of you area until you get a gold box (also called a diverter) tone.  If you can find one go install a Gold Box somewhere.  Now scan again until you get your local At&t switching station.  Call back through the diverter and hack unti

l you get a High level persons access.  From a highlevel person access you can call in and edit the list of places where tones can come from.  Now you can use the Blue Box.  I personally have hacked a acount in At&t but it wasn't high enough to edit the l

ist but I could read it.  From reading it I fround a bunch of good places to install a Gold Box.

                 I be writing a G-phile on Gold boxing and then on on tapping a line.

        Look for more stuff soon.

                                        L8R

        THE MICRO MASTER

           MICRO WORLD INC.

        The above was tested by The Micro Master, The Storyteller and someone else who dosen't have a modem but likes to call places free.

        The tests where done on At&t's Electronic Switching System (ESS) and no busts where even made so it is presumed safe.

--------------------------------------------------------------------------------

         The Information Station   (xxx)xxx-xxxx

         The Fed's Reunion         (xxx)xxx-xxxx

         Ripco                     (xxx)xxx-xxxx

         The Blue Fire BBS         (xxx)xxx-xxxx

            Home of Micro World Inc.

--------------------------------------------------------------------------------


blue3
        [{-=:*> ASSORTED <*:=-}]

      [{-=:*> BOX FREQUINCES <*:=-}]

  (=)=(=)=(=)=(=)=(=)=(=)=(=)=(=)=(=)=(=)

          BLUE BOX FREQUENCIES:

  2600 HZ - USED TO GET ON/OFF TRUNK

  TONE MATRIX TO USE AFTER 2600 HZ.

   700:  1  :  2  :  4  :  7  :  11  :

   900:  +  :  3  :  5  :  8  :  12  :

  1100:  +  :  +  :  6  :  9  :  KP  :

  1300:  +  :  +  :  +  :  10 :  KP2 :

  1500:  +  :  +  :  +  :  +  :  ST  :

       900  :1100 :1300 :1500 : 1700 :

  USE KP (1700+1100) TO START A CALL AND

  ST (1500+1700) TO STOP. USE 2600 HZ TO

  DISCONNECT.

  ---------------------------------------

              RED BOX FREQS:

     1700 HZ AND 2200 HZ MIXED TOGETHER

    A NICKEL IS 66 MS ON (1 BEEP). A DIME IS 66MS ON, 66MS OFF,

  66MS ON (2 BEEPS) A QUARTER IS 33MS ON, 33MS OFF REPEATED 5

  TIMES. (MS= MILLISECOND). FOR  THOSE OF  YOU  WHO   DONT  KNOW,

  A  RED  BOX SIMULATES MONEY  BEING  PUT  INTO A PAY PHONE. YOU

  MUST PUT IN SOME MONEY FIRST THOUGH (THE OPERATOR  CAN TELL IF

  MONEY WAS PUT IN BUT AS TO HOW MUCH, SHE LETS THE COMPUTER

  ANSWER THAT)

  -------------------------------------

           TASI LOCKING FREQ:

    TASI   (  TIME    ASSIGNMENT   SPEECH INTERPOLATION )  IS

  USED  ON  SATELITE TRUNKS, AND BASICALLY  ALLOWS MORE THAN ONE

  PERSON TO USE A  TRUNK  BY  PUTTING THEM ON  WHILE  THE OTHER

  PERSON  ISNT TALKING. OF  COURSE,  YOU'D  NEVER HEAR THE OTHER

  PERSON TALKING ON YOUR TRUNK.

    WHEN YOU START TO  TALK, HOWEVER, THE TASI CONTROLLER  HAS TO

  FIND  AN  OPEN TRUNK FOR YOU. BECAUSE  OF  THIS,  SOME OF YOUR

  SPEECH  IS LOST( BECAUSE OF THE DELAY  IN  FINDING  A  TRUNK)

  THIS  IS CALLED CLIPPING.

    WELL,  IF YOU WERE  TRANSMITTING DATA OVER  A  TRUNK,

  CLIPPING  WOULD REALLY FUCK UP THE DATA. SO THERE IS SOMETHING

  CALLED A TASI  LOCKING FREQUENCY  WHICH KEEPS THE TASI FROM

  PUTTING ANYONE ELSE ON YOUR TRUNK OR  YOU  ON  ANYONE ELSES

  TRUNK. IN ANY CASE  THE FREQ.  IS  1850 HZ. SENT BEFORE THE

  TRANSMISSION).


blue4
          BLUE BOX PLANS

  NOTE TO ALL:THIS IS AN ORIGINAL PHILE

FROM THE OSUNY BBS(NOW DEFUNCT)...IT IS

STILL A VERY COMMONPLACE FILE, AND MANY

LAW ENFORCEMENT AGENCIES DO HAVE A

PRINTUP OF THIS FILE...IF YOU WERE EVER

CAUGHT WITH A COPY OF THIS PHILE, I

HAVE ABSOLUTELY NO IDEA NOR GRASP OF

WHAT THE CONSEQUENCES WOULD BE..ALSO

NOTE THAT IT IS AN OLD HARDWARE TYPE

FILE...UNLESS YOU ARE REALLY INTERESTED

IN BUILDING ONE, AND CAN ACCEPT THE

CONSEQUENCES OF BEING CAUGHT WITH A

HARDWARE BLUE BOX(OUTLINED ON D1'S

"PHREAKERS RIGHTS") THEN DO NOT TAKE

THIS FILE AND TRY TO USE IT...IT CAN

CERTAINLY MEAN NOTHING BUT TROUBLE

FOR YOU....

          \-=-=-=-=-=-=-=-=-=/

          \                  /

          \    THE ART AND   /

          \    PRACTICE OF   /

          \    BLUE BOXING   /

          \                  /

          \=-=-=-=-=-=-=-=-=/

      =)>ORIGINALLY TYPED BY:<(=

          ^-NICKIE HALFLINGER-^

          ^-  & MR. AMERICA  -^

THIS IS THE TONE MATRIX FOR A BOX WHICH GENERATES

TONES THAT OPERATORS USE TO DIAL..ROTARY WORKS AS WELL,

ON OPERATOR LINES, BUT THIS IS TECHNOLOGICAL(!).

NOW I AGREE WITH THE OPINION OF A WELL KNOWN PHREAK

THAT 'BOXING' IS/WILL BE FOR THE MOST PART DEAD, BUT

THIS IS TRADITION... FIRST,YOU DIAL DIR.ASST, OR AN OPER. ETC,

THEN YOU BLAST THE LINE WITH A 2600HZ TONE. THIS GIVES YOU THE

LINE, THIS IS ALSO HOW MA BELL TRACKS DOWN BLUE BOXERS...

EVEN ON OLD #4 CROSSBARS... ONCE ON A OPER.TRUNK LINE,

YOU USE YOUR BLUE BOX/ROTARY TO DIAL...

SO,  IF YOU USE 2600HZ, WHICH IS NECESSARY, UNLESS YOU

ARE *VERY* CAREFUL, YOU WILL BE SNAGGED.

FINALLY, THIS IS WHAT YOU READ!SO LONG AND HARD FOR:

700   :   1   :   2   :   4   :   7   :  11   :

900   :   +   :   3   :   5   :   8   :  12   :

1100  :   +   :   +   :   6   :   9   :  KP   :

1300  :   +   :   +   :   +   :  10   :  KP2  :

1500  :   +   :   +   :   +   :   +   :  ST   :

      :  900  : 1100  : 1300  :  1500 : 1700  :

USE KP TO START A CALL, AND ST TO STOP, WITH

THE BELOVED 2600HZ TONE TO DISCONNECT.

I ALSO HEAR THAT 2600HZ RESETS SPRINT NODES AND

GIVES YOU THEIR INITIAL TONE..

NOW, IF YOU'RE WONDERING ABOUT WHAT TO CALL FROM AN

OPERATOR TRUNK, HERE ARE SOME GOODIES TO HELP YOU OUT:

XXX+101 - TOLL  SWITCHING

XXX+131 - INFORMATION

XXX+141 - RATE & ROUTE

XXX+181 - COIN REFUND OPERATOR

XXX+11501 - MOBILE OPERATOR

XXX+11521 - MOBILE OPERATOR

XXX+11511 - CONFERENCE OPERATOR

THESE WORK WITH ROTARY OR OPERATORS TONES, BUT ONLY ON OPER.

TRUNK LINES...

THANKS FOR LISTENING!

                       BLUE BOXES, PART II

     WHILE  READING  THE FINE ARTICLE ON THE BLUE BOX I SAW  THAT

THERE A LOT OF DATA LEFT OUT OF THE DOCUMENT.   I HOPE THIS ADDS,

IN SOME SMALL WAY, TO THE INFORMATION.

TIMING SPECS WERE NOT INCLUDED.   THE TONE PAIRS ARE TO REMAIN ON

FOR 1/10 SEC. WITH 1/10 SEC. OF SLIENCE BETWEEN DIGITS.  THE 'KP'

TONES  SHOULD BE SENT FOR 2/10 SEC.   A WAY TO DEFEAT THE  2600HZ

TRAPS  IS TO SEND ALONG WITH THE 2600HZ SOME PINK  NOISE(MOST  OF

THE  ENERGY  IN THIS SIGNAL SHOULD BE ABOVE 3000HZ,  THIS  SIGNAL

WON'T MAKE IT OVER THE TOLL NETWORK,  BUT SHOULD CARRY AS FAR  AS

YOUR  LOCAL  TOLL  CENTER) SO THAT THE TRAPS  WON'T  FIND  'PURE'

2600HZ  ON THE TRUNK.   THIS IS NOT A PERFECTLY SAFE WAY TO  BOX,

BUT IT SHOULD SLOW DOWN THE DISCOVERY.

     AS  TO USE,  THE FIRST THING YOU NEED TO UNDERSTAND IS  THAT

THERE  ARE  TWO(2)  TYPES OF TOLL COMPLETING  TRUNK,  INWARD  AND

OUTWARD.  THE NAMES ARE REFERENCE TO THE OFFICE THAT IS SWITCHING

THE  CALL(THE TOLL CENTER THAT SERVES THE WATS LINE  YOU  CALLED)

AND EACH TYPE OF TRUNK HAS A DIFFERENT CLASS OF SERVICE.  FROM AN

INWARD TOLL COMPLETING TRUNK, YOU CAN REACH THE DIFFERENT SERVICE

OPERATORS,  THE TOLL TEST BOARD,  AND THE INWARD OPERATOR.   SOME

OFFICES ALSO ALLOW REMOTE TESTING AND IT IS IN THESE OFFICES THAT

YOU  CAN ACCESS THE OUTWARD TOLL COMPLETING TRUNKS.   THE OUTWARD

TRUNKS  ALLOW  YOU  TO  MAKE  VERIFICATION(EMERGENCY)  CALLS,  DO

BETWEEN  LA AND NYC),  ENABLE AND DISABLE TSPS POSITIONS,  AND IN

SOME CASES(ON SOME 4A'S) ISSUE TEMPORARY REROUTING INSTRUCTIONS(

SEND  ALL CALLS FROM LA TO NYC VIA MIAMI,  BOSTON,  OR ANY  OTHER

CLASS  5  OFFICE OR OFFICES).   BOTH TYPE OF TRUNK ALLOW  YOU  TO

PLACE A 'STANDARD' CALL WITH A BOX.

     IN  SOME  OFFICES,  MOSTLY THE SMALL ONES WITH A  TOLL  TEST

BOARD THAT IS UNATTENDED AT NIGHT AND ON WEEKENDS, YOU CAN GET AN

OUTWARD  TOLL COMPLETING TRUNK AS WELL AS PERFORMING  OTHER  TEST

AND  ROUTING FUNCTIONS.   YOU DO THIS BY USING THREE DIGIT  CODES

THAT  ARE INVALID EXCHANGES(NOT OF THE PATTERN NNX[SEE NOTE  1]).

DURING  THE  SIXITES  THE  CODES USED WERE  FAIRLY  STANDARD  AND

CONSISTENT, HOWEVER WHEN THE BOXES BECAME POPULAR AND THE PHREAKS

STARTED  DOING THINGS LIKE ROUTING ALL CALLS FROM DALLAS  TO  FT.

WORTH VIA WASHINGTON D.C. MOTHER STARTED CHANGING THE TEST CODES

ON  A  RANDOM(AS FAR AS I KNOW) BASIS.   WHAT I WOULD SUGGEST  IS

THAT EVERYBODY INTERESTED IN DOING THIS SORT OF THING PICK OUT  A

NICE  QUIET  LITTLE OFFICE SOMEWHERE AND WORK ON  DISCOVERING  THE

CODES ACCEPTABLE TO THAT OFFICE.

     EACH  NUMBERING PLAN AREA(NPA,  ALSO KNOWN AS AREA CODE) HAS

ALL OF THE OTHER TOLL OFFICES IN THE AREA AS WELL AS SERVING AS A

CONCENTRATION  POINT FOR MOST OUT OF AREA CALLS.   TO ACCESS  THE

SERVICES OF A NON-MASTER OFFICE YOU NEED IT'S 'CITY  CODE',  THIS

IS  A  THREE(3) DIGIT CODE THAT IS OF THE FORM 0XX,  AND IS  SENT

AFTER THE AREA CODE[SEE NOTE 2].  AS AN EXAMPLE,  THE 'CITY CODE'

FOR  CANTON,  OHIO IS 042;  THUS TO REACH THE INWARD OPERATOR  IN

CANTON, YOU WOULD SEND 'KP-216-042-121-ST' WHERE AS IF YOU WANTED

THE INWARD OPERATOR IN CLEVELAND, YOU WOULD SEND 'KP-216-121-ST'.

THE  REASON THIS IS NECESSARY IS THAT THE OPERATOR  IN  CLEVELAND

CAN'T VERIFY A NUMBER IN CANTON, SO IF YOU WANT TO VERIFY SOMEONE

IN CANTON YOU NEED THE CITY CODE.  ALSO, MOST AREA MASTER OFFICES

HAVE DEDICATED DATA TRUNKS TO THE NETWORK CONTROL CENTER AND THUS

DON'T  ACCEPT TEST AND REROUTING COMMANDS OVER THE SWITCHED  NET-

WORK.

     IN CONCLUSION,  THE SWITCHING NETWORK WILL DO A LOT MORE FOR

YOU THEN CONNECT YOU TO PEOPLE AND THE SMALL OFFICES THAT REQUIRE

A 'CITY CODE' ARE THE TYPE OF OFFICE TO TRY TO BREAK.

NICKIE HAFLINGER,

                                        THE COVEN.

     NOTE 1:   THE  NORMAL  FORMAT  FOR TELEPHONE NUMBERS  IS  AS

               FOLLOWS: NYN/NNX-XXXX.  WHERE N=ANY DIGIT EXCEPT 1

               AND 0; Y=0 OR 1, AND X=ANY DIGIT.  YES I KNOW THAT

               IN  SOME AREA CODES THE NNX FORMAT HAS CHANGED  TO

               NXX.   THIS  IS  A NEW OCCURRENCE AND  ONLY  OCCUR

               WHERE  THERE  HAS  BE  AN  OUTRAGEOUS   POPULATION

               INCREASE  IN  THE  LAST FEW YEARS AND ALL  OF  THE

               FUNNY  EXCHANGES ARE CONNECTED DIRECTLY TO  MASTER

               OFFICES  AND  THUS DON'T CONFLICT WITH  THE  'CITY

               CODE' FORMAT.

     NOTE 2:   YOU  CAN  OBTAIN THE 'CITY CODE' FOR A  NUMBER  BY

               CALLING RATE AND ROUTE AND ASKING FOR THE 'NUMBERS

               ROUTE' TO NYN/NNX(I.E.  914/725).  OR IF YOU LEAVE

               ME A MESSAGE WITH THE AREA CODE AND FIRST THREE OF

               A NUMBER, I WILL GET YOU THE 'CITY CODE'.

 THIS BULLETIN WILL DEAL ONLY WITH THE BASIC CONTRUCTION,

WOULD LIKE TO KNOW THE SPECIFIC JOB OF ANY PART IN THE

CIRCUIT JUST WRITE ME A MSG AND I WILL BE GLAD TO ANS-

WER IT.

 WE ALL KNOW THAT THE TOUCH TONES FREQUENCIES ARE COMPOSED

OF TWO TONES (TWO DIFFERENT FREQS.) SO THAT IS THE REASON

WHY WE HAVE 2 VCO'S ( VOLTAGE CONTROLLED OSCILATORS). WE

WILL CALL THESE VCO#1 AND VCO#2. IF YOU HAVE NOTICED

VCO#1 ANS VCO#2 ARE EXACTLY THE SAME TYPE OF CIRCUITS.

THAT IS WHY ONLY ONE WAS DRAWN. BUT REMEMBER THAT WHATEVER

GOES FOR VCO#1 ALSO GOES FOR VCO#2. BOTH VCO'S ARE COMPOSED

OF A HANDFULL OF PARTS. ONE CHIP TWO CAPACITORS 2 RESISTORS

AND FIVE POTENTIOMETERS. ALL OF THIS WILL GIVE YOU (WHEN PROPERLY

CALIBRATED) ONE OF THE FREQS. NECESSARY (THE OTHER ONE WILL

COME FROM VCO#2) FOR THE OPERATION OF THE BB. BOTH OF THESE

FREQS. WILL BE MIXED IN THE SPEAKER THUS FORMING THE REQUIRED

TONE.

WHY?. BECAUSE OTHER DESIGNS WILL DRAIN THE BATTERY AFTER 10 -

CALLS! THIS DESIGN WILL MAKE THEM LAST 10 MONTHS!!!!!!. BUT

NEVER THE LESS DON'T FORGET TO PUT IN A SWITCH FOR ON AND OFF.

 OK LET'S BUILD THE TWO VCO'S AND CALIBRATE THE UNIT BEFORE

WE GET TO THE KEYBOARD CONTRUCTION.

                       VCO CONTRUCTION

                       === ===========

  TOOLS REQUIRED

 1 OCILLISCOPE    (RECOMENDED BUT NOT REQUIRED)

 1 FREQ. COUNTER   (REQUIRED)

 1 VOLT METER       "  "  "

  ELECTRONICS TOOLS  (PLIERS,DRILL, SCREWDRIVERS, ETC)

      PARTS

 R2    1K   RESISTOR  5%

 C1    .1UF ELECTROLYTIC CAPACITOR   16VDC

 C2    .01UF ELECTROLYTIC CAPACITOR (MYLAR) 16VDC

 IC1   2207  VCO CHIP  BY EXAR ELECTRINICS

 REMEMBER THE ABOVE IT IS ONLY FOR VCO#1 BUT THE SAME GOES FOR

VCO#2.

  R3-R4  150 OHM RESISTORS  5%

  C3-C4   .1 UF  ELECTROLITIC CAPACITOR   10VDC

  P1-P10 200K TRIMMER POT - 20 TURNS

  DIODES USED IN THE KEYBOARD ARE 1N914 TYPE (40 OF THEM)

  AND 13 SWITCHES FOR THE KEYBOARD SPST. MOMENTARY.

  SPKR= YOU CAN USE A TELEPHONE SPEAKER FOR THIS(IT WORKS BEST)

        BUT REMEMBER TO TAKE OUT THE DIODE THAT IS CONNECTED

        ACCROSS IT.

****************************************************************

                 IMPORTANT NOTES

   2 PINS 10,9,8 SHOULD BE TIED TOGETHER AND BE LEFT  FLOATING.

   3 ALL RESISTOR SHOULD BE 5%! NOTHING ELSE

   4 A TELEPHONE SPEAKER GIVES THE BEST RESULTS

*****************************************************************

                TROUBLE SHOOTING

 BY NOW YOU SHOULD HAVE CONSTRUCTED THE TWO VCO'S

ON A BREAD BOARD OR ANYTHING THAT PLEASES YOU.

 CHECK FOR COLD SOLDER JOINTS, BROKEN WIRES, POLARITY

OF THE BATTERY, ETC.........

 BEFORE WE APPLY POWER TO THE VCO'S WE HAVE TO ADJUST THE POTS

FOR THEIR HALF WAY TRAVEL POINT. THIS IS DONE BY TURNING THEM

21 TURNS TO THE RIGHT AND THEN 10 TURNS TO THE LEFT. DO THE

SAME FOR ALL TEN OF THEM.

IN THE CHIPS BY PUTTING THE POSITIVE LEAD OF YOUR VOLT METER

ON PIN 7 AND THE NEGATIVE LEAD ON PIN 12. IF YOU DON'T HAVE

ANYTHING THERE TURN OFF THE UNIT ANT RECHECK THE WIRING.

WHEN YOU GET THE RIGHT VOLTAGES ON THE CHIPS, CONNECT A

DIODE TO A PIECE OF WIRE (LOOK AT FIG. 2 FOR THE ORIENTATION

OF THE DIODE) FROM GROUND TO ANY POT AT POINT T (LOOK CAREFULLY

AT THE SCHEMATIC FOR POINT T IT IS LABELED T1-T10 FOR ALL POTS)

 YOU SHOLD BE ABLE TO HEAR A TONE, IF NOT DISSCONNECT THE LEAD

AND PLACE THE SPEAKER CLOSE TO YOUR EAR AND IF YOU HEAR A CHIRP

LIKE SOUND, THIS MEANS THAT THE TWO VCO'S ARE WORKING IF YOU DON'T,

IT MEANS THAT EITHER ONE OR BOTH OF THE VCO'S IS DEAD.

SO IN THIS CASE IT IS ALLWAYS GOOD TO HAVE AN OCILLOSCOPE ON HAND.

 DISCONNECT THE SPEAKER FROM THE CIRCUIT AND HOOKUP THE OCILLISCOPE

TO ONE OF THE LEADS OF THE SPEAKER AND THE GROUND FROM THE SCOPE

TO THE GROUND OF THE BATTERY. CONNECT AGAIN THE GROUND LEAD

WITH THE DIODE CONNECTED TO IT FROM GROUND TO ANY POT ON THE

VCO THAT YOU ARE CHECKING AND YOU SHOULD SEE A TRIANGLE WAVE

UNTIL YOU SEE IT. WHEN YOU DO SEE IT DO THE THE SAME FOR THE

OTHER VCO TO MAKE SURE IT IS WORKING. (AMPLITUDE IS ABOUT 2VAC)

WHEN YOU GET THE TWO VCO'S WORKING YOU ARE SET FOR THE ADJUSTMENT

OF THE INDIVIDUALS POTS...

                       ADJUSTMENT

   DISCONNECT THE SPEAKER FROM THE CIRCUIT AND CONNECT A FREQ.

COUNTER (THE POSITIVE LEAD OF THE COUNTER TO ONE OF THE SPEAKERS

LEADS THAT BELONGS TO VCO#1 OR CONNECT IT TO PIN 14).

   CONNECT THE NEGATIVE LEAD TO THE BATTERY NEGATIVE AND

CONNECT THE JUMPER LEAD WITH THE DIODE FROM GROUND TO POT NUMBER 1

T1 .( THE FIRST POT NUMBER 1 POINT T1)

 IF YOU GOT IT WORKING YOU SHOULD HEAR A TONE AND GET A READING ON THE

COUNTER.  ADJUST THE POT FOR A FREQ. OF 1700HZ AND CONTINUE DOING THE

SAME FOR POTS 2-5 EXCEPT THAT THEY GET DIFFERENTS FREQS.

                    P1= 1700HZ

                    P2= 1300HZ

                    P3= 1100HZ

                    P4=  900HZ

                    P5= 1500HZ

 NOW DISCONNECT THE FREQ. COUNTER FROM THE SPEAKER LEAD OF VCO#1 OR

FROM PIN 14 (WHICH EVER YOU HAD IT ATTACHED TO AT THE BEGINNING) AND

CONNECT IT TO THE SPEAKER LEAD OF VCO#2 OR TO PIN 14 OF VCO#2 AND

PERFORM THE SAME ADJUSTMENTS TO P6-10.

                    P6= 1100HZ

                    P7=  700HZ

                    P8=  900HZ

                    P9=  2600HZ   MAGIC NUMBER!!!!!

                    P10= 1500HZ

  WHEN YOU FINISH DOING ALL OF THE POT GO BACK AND RECHECK THEM

                 KEYBOARD

 IF YOU LOOK AT FIG-2 YOU WILL SEE THAT THE KEYS ARE SIMPLE SWITCHES

CONNECTED TO GROUND AND TWO DIODES ON THE OTHER END. THESE DIODES

ARE USED TO SIMPLIFY THE CONSTRUCTION OF THE KEYBOARD BECAUSE OTHERWISE

THE DISTRIBUTION OF THE GROUND SIGNAL FOR BOTH VCO'S WOULD HAVE BEEN

DONE MECHANICALLY.  ONE DIODE WILL GO TO VCO#1 AND THE OTHER WILL GO TO

VCO#2. FIG-3 SHOWS THE ARRANGEMENT OF THE KEYS ON THE KEYBOARD.

          BELOW IS A TABLE THAT WILL HELP YOU CONNECT

 THE KEYS TO REQUIRED VCO'S POTS.

                TO               TO             FREQ OUT            FREQ OUT

     KEY     POT ON VCO1     POT ON VCO2        PIN 14 VCO1       PIN 14 VCO

      C          1                6              1700              1100

      0          2                10             1300              1500

      E          1                10             1700              1500

      2          3                7              1100               700

      3          3                8              1100               900

      4          2                7              1300               700

      5          2                8              1300               900

      6          2                6              1300              1100

      7          5                7              1500               700

      8          5                8              1500               900

      9          5                6              1500              1100

      X          -                9              ----              2600

***********************************************************************

* REMEMBER THAT FIG-2 IT IS THE SAME FOR EACH KEY EXCEPT THE "X" WHICH*

* ONLY TAKES ONE DIODE.                                               *

***********************************************************************

  AS A FINAL WORD YOU CAN BUILD THIS IN ANY TYPE OF ENCLOSURE

AND SHOULD NEVER BE USED TO MAKE FREE CALLS USING THE TELEPHONE

LINES. I HOPE THIS BULLETIN WILL CLEAR ANY QUESTION YOU MAY

                        IF YOU HAVE ANY QUESTION PLEASE

              LEAVE ME A MSG. AND I WILL BE VERY GLAD TO

              ANSWER IT.

                                    TXS

                               MR. AMERICA

  PS. I WOULD LIKE TO THANK MY KEYBOARD, MY FINGERS, AND ME

FOR HELPING ME WRITTE THIS BULLETTIN. WITHOUT THEIR HELP

I WOULD HAVE NEVER FINISH THIS PROJECT.


blue5
                                BLUE BOXING

                                [===========]

   This is the tone matrix for a box which generates tones that operators use to

 dial..rotary works as well, on operator lines, but this is technological(!). no

w i agree with the opinion of a well known phreak that 'boxing' is/will be for t

he most part de

ad, but this is tradition... first,you dial dir.asst, or an oper. etc , then you

 blast the line with a 2600 hz tone. this gives you the line, this is also how m

a bell tracks down blue boxers... there  are 2600hz detectors systems, and even

on old #4 cross

bars... once on a oper.trunk line, you use your blue box/rotary tdo dial...

so,  if you use 2600hz, which is necessary, unless you are *very* careful, you w

ill be snagged. finally, this is what you read! so long and hard for:

700   :   1   :   2   :   4 :   7   : 11   : 900   :   +   :   3

:   5 :   8   : 12   : 1100  :   +   :   +   :   6 :   9   : KP

: 1300  :   +   :   +   :   + :  10   : KP2  : 1500  :   +

: +   :   + :   +   : ST   : :  900  : 1100  : 1300 : 1500 : 1700

use kp to start a call, and st to stop, with the beloved 2600hz tone to disconne

ct. i also hear that 2600hz resets sprint nodes and gives you their initial tone

..

now, if you're wondering about what to call from an operator trunk, here are som

e goodies to help you out:

XXX+101 - TOLL  SWITCHING

XXX+121 - LOCAL OPERATOR

XXX+131 - INFORMATION

XXX+141 - RATE  ROUTE

XXX+181 - COIN REFUND OPERATOR

XXX+11501 - MOBILE OPERATOR

XXX+11521 - MOBILE OPERATOR

XXX+11511 - CONFERENCE OPERATOR

---CONCERNING ABOVE

     First the tones.   while all the information is correct, the timing specs w

ere not included . the tone pairs are to remain on for 1/10 sec. with 1/10 sec.

of silence between digits.  the 'kp' tones  should be sent for 2/10 sec.   a way

 to defeat the

 2600 hz traps  is to send a long with the 2600hz some pink noise(most of the en

ergy in this signal should be above 3000hz,  this signal won't make it over the

toll network,  but should carry as far as your local toll center) so that the tr

aps won't find

'pure' 2600 hz on the trunk. this is not a perfectly safe way to box, but it sho

uld slow down the discovery.

     as to use, the first thing you need to understand is that there are two(2)

types of toll completing trunk, inward and outward. the names are reference to t

he office that is switching the call(the toll center that serves the watsline yo

u called) and e

ach type of trunk has a different class of service. from an inward toll completi

ng trunk, you can reach the different service operators, the toll test board, an

d the inward operator. some offices also allow remote testing and it is in these

 offices that y

ou  can access the outward toll completing trunks. the out wardtrunks allow you

to make verification(emergency) calls, do service monitoring(tapping), stack tru

nks(busy out all trunks between la and nyc), enable and disable tsps positions,

and in some cas

es(on some 4a's) issue temporary rerouting instructions(send all calls from la t

o nyc via miami, boston, or any other class 5 office or offices). both type of t

runk allow you to place a 'standard' call with a box.

     in some offices, mostly the small ones with a toll test board that is unatt

ended at night and on weekends, you cange to an outward toll completing trunk as

 well as performing other test and routing functions. you do this by using three

 digit codes th

at are invalid exchanges (not of the pattern nnx[see note 1]). during the sixite

s the codes used were fairly standard and consistent, however when the boxes bec

ame popular and the phreaks started doing things like routing all calls from dal

las to ft. wort

h via washington d.c. others started changing the test codes on a random (as far

 as i know) basis. what i would suggest is that everybody interested in doing th

is sort of thing pick out a nice quiet little office somewhere and work on disco

vering the code

s acceptable to that office.

     each numbering plan area (npa, also known as area code)has an office design

ated as its master office. this office controls all of the other toll offices in

 the area as well asserving as a concentration point for most out of area calls.

to access the s

ervices of a non-masteroffice you need it's'city code', this is a three(3) digit

 code that is of the form 0xx, and is sent after the area code [see note 2 ]. as

 an example, the 'city code' for canton, ohio is 042; thus to reach the inward o

perator in cant

on, you would send 'kp-216-042-121-st' where as if you wanted the inward operato

r in cleveland, you would send 'kp-216-121- st'. the reason this is necessary is

 that the operator in cleveland can't verify a number in canton, so if you want

to verify someo

ne in canton you need the city code. also, most area master offices have dedicat

ed data trunks to the network control center and thus don't accept test and rero

uting commands over the switched net-work.

     in conclusion, the switching network will do a lot more for you then connec

t you to people and the small offices that require a 'city code' are the type of

 office to try to break.

     note 1: the normal format for telephone numbers is as follows: nyn/nnx-xxxx

. where n=any digit except 1 and 0;y=0 or 1, and x=any digit. yes i know that in

 some area codes the nnx format has changed to nxx. this is a new occurrence and

 only occur whe

re there has be an outrageous population increase in the last few years and all

of the funny exchanges are connected directly to master offices and thus don't c

onflict with the 'city code' format.

     note 2: you can obtain the 'city code' for a number by calling rate and rou

te and asking for the 'numbers route' to nyn/nnx(i.e. 914/725). or if you leave

me a message with the area code and first three of a number, i will get you the'

city code'.

            blue box plans

            ---- --- -----

$           BLUE BOX PLANS!           $

$   This file will explain the        $

$ construction, troubleshooting, and  $

$ adjustment of a Blue Box.           $

$                                     $

$   We all know that the touch tone   $

$ frequencies are composed of 2 tones $

$ (2 different freqs.) so that is the $

$ reason why we have 2 VCO's (Voltage $

$ Controlled Oscilators). We'll call  $

$ them VCO#1 and VCO#2. If you have   $

$ noticed VCO#1 and VCO#2 are exactly $

$ the same type of circuits. That is  $

$ why only 1 was drawn. But remember  $

$ that whatever goes for VCO#1 also   $

$ goes for VCO#2. Both VCO'S are      $

$ composed of a handfull of part. One $

$ chip, two capacitors, 2 resistors   $

$ and five potentiometers. All of     $

$ this will give you (when properly   $

$ calibrated) one of the freqencies   $

$ necessary (the other one will come  $

$ from VCO#2) for the operation of    $

$ the Blue Box. Both of these freqs.  $

$ will be mixed in the speaker to     $

$ form the required tone.             $

$                                     $

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

$                                     $

$   This is one of the most           $

$ sophisticated designs I have ever   $

$ made. Why?. Because other designs   $

$ will drain the battery after 10     $

$ calls. This design will make them   $

$ last 10 months!!!!!!. But never the $

$ less, don't forget to put in a      $

$ switch for on and off. Ok let's     $

$ build the two VCO'S and calibrate   $

$ the unit before we get to the       $

$ keyboard construction.              $

$                                     $

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

!                                     !

!          VCO CONSTRUCTION           !

!          === ============           !

!                                     !

!           TOOLS REQUIRED            !

!           ----- --------            !

!                                     !

! 1 ocilliscope(optional but not req) !

! 1 Freq. counter   (REQUIRED)        !

! 1 Volt meter       "  "  "          !

!   Electronics tools  (Pliers,drll,  !

!   screwdrivers, etc.)               !

!                                     !

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

.......................................

.                                     .

.           ! $-PARTS-$ !             .

.           -------------             .

.                                     .

. R1  1.5K RESISTOR  5%               .

. R2  1K   RESISTOR  5%               .

. C1 .1uf ELECTROLYTIC CAPACITOR 16VDC.

. C2 .01uf    "        "  (MYLQR)16VDC.

.IC1 2207 VCO CHIP BY EXAR ELECTRONICS.

.    Remember the above only says     .

.    VCO#1 but the same is for VCO#2  .

. R3-R4 150 OHM RESISTORS  5%         .

. C3-C4 .1 uf ELECTROLITIC CAPACITOR  .

.       10VDC                         .

. P1-P10 200K TRIMMER POT - 20 TURNS  .

.       DIODES USED IN THE KEYBOARD   .

.       ARE 1N914 TYPE (40 OF THEM)  .

.       13 SWITCHES FOR THE KEYBOARD  .

.       SPST MOMENTARY.               .

. SPKR=YOU CAN USE A TELEPHONE SPEAKER.

.      FOR THIS (IT WORKS BEST) BUT   .

.      REMEMBER TO TAKE OUT THE DIODE .

.      THAT IS CONNECTED ACCROSS IT.  .

***************************************

*        ---------------------        *

*        ! *IMPORTANT NOTES* !        *

*        ---------------------        *

*  1. DO NOT USE ANYTHING ELSE OTHER  *

*     THAN A MYLAR CAPACITOR FOR C2.  *

*  2. PINS 10,9,8 SHOULD BE TIED      *

*     TOGETHER AND BE LEFT FLOATING.  *

*  3. ALL RESISTORS SHOULD BE 5%!     *

*     NOTHING ELSE!                   *

*  4. A TELEPHONE SPEAKER GIVES THE   *

*     BEST RESULTS.                   *

***************************************

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%         --------------------        %

%         ! TROUBLE SHOOTING !        %

%         --------------------        %

%   By now you should have constructed%

% the two VCO'S on a bread board or   %

% anything that pleases you.          %

% Check for cold solder joints, broken%

% wires, polarity of the battery, etc.%

% Before we apply power to the VCO'S  %

% we have to adjust the pots for their%

% half way travel point. This is done %

% by turning them 21 turns to the     %

% right and then 10 turns to the left.%

% Do the same for all ten of them.    %

%-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-%

%   Now apply power to the unit check %

% to see that you have power in the   %

% chips by putting the positive lead  %

% of your volt meter on pin 7 and the %

% negative lead on pin 12. If you do  %

% not have anything there turn off    %

% the unit and RECHECK THE WIRING.    %

%-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-%

%   When you get the right voltages   %

% on the chips, connect a diode to a  %

% piece of wire (look at fig. 2 for   %

% the orientation of the diode) from  %

% ground to any pot at point T (look  %

% carefully at the schematic for      %

% point T it is labeled T1-T10 for    %

% all pots). You should be able to    %

% hear a tone, if not disconnect the  %

% lead and place the speaker close to %

% your ear and if you hear a          %

% chirp-like sound, this means that   %

% the two VCO'S are working if you    %

% don't, it means that either one or  %

% both of the VCO'S are dead. So in   %

% this case it is always good to have %

% an ocilloscope on hand.             %

% Disconnect the speaker from the     %

% circuit and hook the ocilliscope to %

% 1 of the leads of the speaker  the %

% ground from the scope to the ground %

% of the battery. Connect again the   %

% ground lead with the diode connected%

% to it from ground to any pot on the %

% VCO that you are checking and you   %

% should see a triangle wave if not   %

% turn the pot in which you are       %

% applying the ground to until you see%

% it. When you do see it do the the   %

% same for the other VCO to make sure %

% it is working. (amplitude is about  %

% 2VAC). When you get the two VCO's   %

% working you are set for the         %

% adjustment of the individuals pots. %

%                                     %

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

:            --------------           :

:            ! ADJUSTMENT !           :

:            --------------           :

:   DISCONNECT THE SPEAKER FROM THE   :

: CIRCUIT AND CONNECT A FREQ. COUNTER :

: (THE POSITIVE LEAD OF THE COUNTER TO:

: ONE OF THE SPEAKERS LEADS THAT      :

: BELONGS TO VCO#1 OR CONNECT IT TO   :

: PIN 14).                            :

:-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-:

:   CONNECT THE NEGATIVE LEAD TO THE  :

: BATTERY NEGATIVE AND CONNECT THE    :

: JUMPER LEAD WITH THE DIODE FROM     :

: GROUND TO POT NUMBER 1.T1.          :

: ( THE FIRST POT NUMBER 1 POINT T1)  :

: IF YOU GOT IT WORKING YOU SHOULD    :

: HEAR A TONE AND GET A READING ON    :

: THE COUNTER. ADJUST THE POT FOR A   :

: FREQ. OF 1700hz AND CONTINUE DOING  :

: THE SAME FOR POTS 2-5 EXCEPT THAT   :

: THEY GET DIFFERENTS FREQS. WHICH ARE:

:            $$$$$$$$$$$$$$           :

:            $ P1= 1700hz $           :

:            $ P2= 1300hz $           :

:            $ P3= 1100hz $           :

:            $ P4=  900hz $           :

:            $ P5= 1500hz $           :

:            $$$$$$$$$$$$$$           :

:   NOW DISCONNECT THE FREQ. COUNTER  :

: FROM THE SPEAKER LEAD OF VCO#1 OR   :

: FROM PIN 14 (WHICH EVER YOU HAD IT  :

: ATTACHED TO AT THE BEGINNING) AND   :

: CONNECT IT TO THE SPEAKER LEAD OF   :

: VCO#2 OR TO PIN 14 OF VCO#2 AND     :

: MAKE THE SAME ADJUSTMENTS TO P6-10. :

:            $$$$$$$$$$$$$$$          :

:            $ P6=  1100hz $          :

:            $ P7=   700hz $          :

:            $ P8=   900hz $          :

:            $ P9=  2600hz $          :

:            $ P10= 1500hz $          :

:            $$$$$$$$$$$$$$$          :

:   WHEN YOU FINISH DOING ALL OF THE  :

: POTS GO BACK AND RE-CHECK THEM.     :

:::::::::::::::::::::::::::::::::::::::

<             --------=---            >

<             ! KEYBOARD !            >

<             ------------            >

<   IF YOU LOOK AT FIG-2 YOU WILL SEE >

< THAT THE KEYS ARE SIMPLE SWITCHES.  >

< CONNECTED TO A GROUND AND TWO       >

< DIODES ON THE OTHER END. THESE      >

< DIODES ARE USED TO SIMPLIFY THE     >

< CONSTRUCTION OF THE KEYBOARD        >

< BECAUSE OTHERWISE THE DISTRIBUTION  >

< OF THE GROUND SIGNAL FOR BOTH VCO'S >

< WOULD HAVE BEEN DONE MECHANICALLY.  >

< THE DIODE WILL GO TO VCO#1 AND THE  >

< OTHER WILL GO TO VCO#2. FIG-3 SHOWS >

< THE ARRANGEMENT OF THE KEYS ON THE  >

< KEYBOARD.                           >

z5ujj-=-=->-=-=-=-=-=-=-=-?

<   BELOW IS A TABLE THAT WILL HELP   >

< YOU CONNECT THE KEYS TO THE         >

< REQUIRED VCO'S POTS.                >

<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->

<              (-FIG 2-)              >

<-----!-----!--------!--------!------->

<     !     !        !        !       >

< TO  ! TO  !  FREQ  !  FREQ  !  KEY  >

< POT ! POT !  OUT:  !  OUT:  !       >

< ON  ! ON  !        !        !       >

< VCO1! VCO2!        !        !       >

<-----!-----!--------!--------!------->

<  1  !  06 ! 1700hz ! 1100hz !   C   >

<  2  !  10 ! 1300hz ! 1500hz !   0   >

<  1  !  10 ! 1700hz ! 1100hz !   E   >

<  4  !  07 ! 0900hz ! 0700hz !   1   >

<  3  !  07 ! 1100hz ! 0700hz !   2   >

<  3  !  08 ! 1100hz ! 0900hz !   3   >

<  2  !  07 ! 1300hz ! 0700hz !   4   >

<  2  !  08 ! 1300hz ! 0900hz !   5   >

<  2  !  06 ! 1300hz ! 1100hz !   6   >

<  5  !  07 ! 1500hz ! 0700hz !   7   >

<  5  !  08 ! 1500hz ! 0900hz !   8   >

<  5  !  06 ! 1500hz ! 1100hz !   9   >

<  -  !  09 ! ------ ! 2600hz !   X   >

<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->

<   REMEMBER THAT IN FIG-2 IT'S THE   >

< SAME FOR EACH KEY EXCEPT THE "X"    >

< KEY, WHICH ONLY TAKES ONE DIODE.    >

*******************************.*******

 few KEYS to the diagram:

Cx is capacitor #x   Denoted by: ---| |---

Px is Pot or Variable resistor #x  Denoted by :/

                                               \

                                               /<--

                                    \

Rx is resistor #x  Denoted by /\/\/\/\

                            Schematics

                            ==========

     The XR-2207 chip is a Voltage-Controlled Oscillator and a 14 pin device

thus you must be very careful when soldering the parts to this device. It is

a little dificult to actually  draw  a  schematic on an 80 character screen

using limited graphics, but I will give it a try.

                                        TO GND_____________

                                              |

                                                         ___

                                               C2     C3 ___

                                            _||_          |

                                           |    |    _____|__9v+

                                           |    |    |    |

                        `   `    `    `    `    `    `    |

                        -------------------------------   |

                        7   6    5    4    3    2    1 |  |

                       |                               <  |

                       |8   9    10   11   12   13   14|  |

                        -------------------------------   |

                        `   `    `    `    `    `    `    |

                                 |    |                   |

                    --| |--------|    |                   |

                    |C1    R2         |         R1        |

          GND ______|___/\/\/\/\______|_____/\/\/\/\______|

is is a diagram of how to locate the different pins on the chip.

Please notice that pin one (1) is the closest to the notch on top of the chip.

The first thing we'll do is to connect power to the chip (remember that you

need to build two (2) of these to get a complete system) this is accomplished

by connecting the positive wire of the battery lead to pin#1 one leg of R1

and R2 is soldered to pin#11. The other leg of R1 goes to pin 1 or to the

d. C1 goes

between pin 10 and ground. The timing capacitor or C2 goes between pins 2

and 3 of the chip. Pins 8 and 9 should be grounded to ground. Pin 14 is the

output and this is where one leg of C4 (C3 goes on the other VCO) in series

with R3 (the same goes for the other VCO) and to one lead of the speaker.

     The trimmer pots P1 to P10 should be grouped in groups of 5 pots each.

The way you group it is by soldering one end of the pot to each other leaving

the wiper and the other end free.

          | This end goes to pin 6 of the chip

                   |

      _____________|_____________

       /     /     /     /     /

       \     \     \     \     \

       /<-   /<-   /<-   /<-   /<-

       \ |   \ |   \ |   \ |   \ |

       / |   / |   / |   / |   / |

         |     |     |     |     |

         |     |     |     |     |

       P1      P2    P3    P4    P5

     And finally this is the way each key should be wired.

                 diode

he contact of  the

                         |--------- \------               key

     to Px  ------>|-----|                |

                 diode                    |

                                        -----

                                         --- Ground


bhbb
 Note to sysops: You are welcome to

  download this file and use it on

  your system, providing you DO NOT

  remove the credits for Mark Tabas

  or KAOS. In other words, try to act

  like a human being!

--------------------------------------

       The Mark Tabas encounter

           series presents:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

      Better Homes and Blue Boxing

               Part I

        Theory of Operation

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

  To quote Karl Marx, blue boxing has

always been the most noble form of

phreaking. As opposed to such things

as using an MCI code to make a free

fone call, which is merely mindless

pseudo-phreaking, blue boxing is

actual interaction with the Bell

System toll network. It is likewise

advisable to be more cautious when

blue boxing, but the careful phreak

will not be caught, regardless of what

type of switching system he is under.

  In this part, I will explain how and

why blue boxing works, as well as

where. In later parts, I will give

more practical information for blue

boxing and routing information.

  To begin with, blue boxing is simply

communicating with trunks. Trunks must

not be confused with subscriber lines

(or "customer loops") which are

standard telefone lines. Trunks are

those lines that connect central

offices. Now, when trunks are not in

use (i.e., idle or "on-hook" state)

they have 2600Hz applied to them. If

they are two-way trunks, there is

2600Hz in both directions. When a

trunk IS in use (busy or "off-hook"

state"), the 2600Hz is removed from

the side that is off-hook. The 2600Hz

is therefore known as a supervisory

signal, because it indicates the

status of a trunk; on hook (tone) or

off-hook (no tone). Note also that

2600Hz denoted SF (single frequency)

signalling and is "in-band." This is

very important. "In-band" means that

is is within the band of frequencies

that may be transmitted over normal

telefone lines. Other SF signals, such

as 3700Hz are used also. However, they

cannot be carried over the telefone

network normally (they are "out-of-

band") and are therefore not able to

be taken advantage of as 2600Hz is.

  Back to trunks. Let's take a

hypothetical phone call. You pick up

your fone and dial 1+806-258-1234

(your good friend in Armarillo,

Texas). For ease, we'll assume that

you are on #5 Crossbar switching and

not in the 806 area. Your central

office (CO) would recognize that

806 is a foreign NPA, so it would

route the call to the toll centre

that serves you. [For the sake of

accuracy here, and for the more

experienced readers, note that the

CO in question is a class 5 with

LAMA that uses out-of-band SF

supervisory signalling]. Depending

on where you are in the country, the

call would leave your toll centre

(on more trunks) to another toll

centre, or office of higher "rank".

Then it would be routed to central

office 806-258 eventually and the

call would be completed. Illustration:

A---CO1-------TC1------TC2----CO2----B

A=you  CO1=your central office

TC1=your toll office.

TC2=toll office in Amarillo.

CO2=806-258 central office.

B=your friend (806-258-1234)

  In this situation it would be

realistic to say that CO2 uses SF

in-band (2600Hz) signalling, while

all the others use out-of-band

signalling (3700Hz). If you don't

understand this, don't worry too much.

I am pointing this out merely for the

sake of accuracy. The point is that

while you are connected to 806-258-

1234, all those trunks from YOUR

central office (CO1) to the 806-258

central office (CO2) do *NOT* have

2600Hz on them, indicating to the

Bell equipment that a call is in

progress and the trunks are in use.

  Now let's say you're tired of

talking to your friend in Amarillo

(806-258-1234) so you send a 2600Hz

down the line. This tone travels down

the line to your friend's central

office (CO2) where it is detected.

However, that CO thinks that the

2600Hz is originating from Bell

equipment, indicating to it that

you've hung up, and thus the trunks

are once again idle (with 2600Hz

present on them). But actually, you

have not hung up, you have fooled the

equipment at your friend's CO into

thinking you have. Thus,it disconnects

him and resets the equipment to

prepare for the next call. All this

happens very quickly (300-800ms for

step-by-step equipment and 150-400ms for other equipment).

  When you stop sending 2600Hz (after

about a second), the equipment thinks

that another call is coming towards

it (e.g. it thinks the far end has

come "off-hook" since the tone has

stopped. It could be thought of as a

toggle switch: tone --> on hook, no

tone -->off hook. Now that you've

stopped sending 2600Hz, several things

happen:

1) A trunk is seized.

2) A "wink" is sent to the CALLING end

from the CALLED end indicating that

the CALLED end (trunk) is not ready to

receive digits yet.

3) A register is found and attached

to the CALLED end of the trunk within

about two seconds (max).

4) A start-dial signal is sent to the

CALLING end from the CALLED end

indicating that the CALLED end is

ready to receive digits.

Now, all of this is pretty much

transparent to the blue boxer. All he

really hears when these four things

happen is a <beep><kerchunk>. So,

seizure of a trunk would go something

like this:

  1> Send a 2600Hz

  2> Terminate 2600Hz after 1-2 secs.

  3> [beep][kerchunk]

  Once this happens, you are connected

to a tandem that is ready to obey your

every command. The next step is to

send signalling information in order

to place your call. For this you must

simulate the signalling used by

operators and automatic toll-dialing

equipment for use on trunks. There

are mainly two systems, DP and MF.

However, DP went out with the dinosaur

, so I'll only discuss MF signalling.

MF (multi-frequency) signalling is the

signalling used by the majority of the

inter- and intra-lata network. It is

also used in international dialing

known as the CCITT no.5 system.

  MF signalling consists of 7 frequen-

cies, beginning with 700Hz and

separated by 200Hz. A different set of

two of the 7 frequencies represent the

digits 0 thru 9, plus an additional 5

special keys. The frequencies and uses

are as follows:

Frequencies (Hz)  Domestic    Int'l

--------------------------------------

 700+900             1          1

 700+1100            2          2

 900+1100            3          3

 700+1300            4          4

 900+1300            5          5

1100+1300            6          6

 700+1500            7          7

 900+1500            8          8

1100+1500            9          9

1300+1500            0          0

 700+1700           ST3p       Code 11

 900+1700           STp        Code 12

1100+1700           KP         KP1

1300+1700           ST2p       KP2

1500+1700           ST         ST

  The timing of all the MF signals is

a nominal 60ms, except for KP, which

should have a duration of 100ms. There

should also be a 60ms silent period

between digits. This is very flexible,

however, and most Bell equipment will

accept outrageous timings.

  In addition to the standard uses

listed above, MF pulsing also has

expanded usages known as "expanded

inband signalling" that include such

things as coin collect, coin return,

ringback, operator attached, and

operator released. KP2, code 11, and

code 12 and the ST_ps (STart "primes")

all have special uses which will be

mentioned only briefly here.

  To complete a call using a blue box,

once seizure of a trunk has been

accomplished by sending 2600Hz and

pausing for the <beep><kerchunk>, one

must first send a KP. This readies the

register for the digits that follow.

For a standard domestic call, the KP

would be followed by either 7 digits

(if the call were in the same NPA as

the seized trunk) or 10 digits (if the

call were not in the same NPA as the

seized trunk). [Exactly like dialing a

normal fone call]. Following either

the KP and 7 or 10 digits, a STart is

sent to signify that no more digits

follow. Example of a complete call:

  1> Dial 1-806-258-1234

  2> wait for a call-progress

     indication (such as ring, busy,

     recording, etc.)

  3> Send 2600Hz for about 1 second.

  4> Wait for about 2 seconds while a

     trunk is seized.

  5> Send KP+305+994+9966+ST

  The call will then connect if every-

thing was done properly. Note that if

a call to an 806 number were being

placed in the same situation, the area

code would be omitted and only KP+

seven digits+ST would be sent.

  Code 11 and code 12 are used in

international calling to request

certain types of operators. KP2 is

used in international calling to route

a call other than by way of the normal

route, whether for economic or

equipment reasons.

  STp, ST2p, and ST3p (prime, two

prime, and three prime) are used in

TSPS signalling to indicate calling

type of call (such as coin-direct

dialed).

   This has been Part I of Better

Homes and Blue Boxing. I hope you

enjoyed and learned from it. If you

have any questions, comments, threats

or insults, please fell free to drop

me a line. If you have noticed any

errors in this text (yes, it does

happen), please let me know and

perhaps a correction will be in order.

Part II will deal mainly with more

advanced principles of blue boxing,

as well as routings and operators.

  Note 1: other highly trunkable

areas include: 816,305,813,609,205.

I personally have excellent luck

boxing off of 609-953-0000. Try that

if you have any trouble.

......................................

(c) January 7, 1985         Mark Tabas

......................................

$$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$

        ----------------------

        :    Written for:    :

        :                    :

        :      K.A.O.S.      :

        :                    :

        :        at          :

        :                    :

        :    215-xxx-xxxx    :

        :                    :

        ----------------------

Go To Part 2

Go To Part 3


bhbb2
The Mark Tabas encounter series

presents...

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

      Better Homes and Blue Boxing

                Part ii

          Practical Applications

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

(It is assumed that the reader has read

and understood Part i of this series).

  The essential purpose of blue boxing

in the beginning was merely to receive

toll services free of charge. Though

this can still be done, blue boxing has

essentially outlived its usefulness in

this area. Modern day "extenders" and

long distance services provide a safer

and easier way to make free fone calls.

However, you can do things with a blue

box that just can't be done with any-

thing else. For ordinary toll-fraud, a

blue box is impractical for the

following reasons:

  1. Clumsy equipment required (blue

     box or equivalent)

  2. Most boxed calls must be made

     through an extender. Not for

     safety reasons, but for reasons

     I'll explain later.

  3. Connections are often sacrificed

     because considerable distances

     must be dialed to cross a

     seizable trunk, in addition to

     awkward routing.

  As stated in reason #2, boxed calls

are usually made through an extender.

This is for billing reasons. If you

recall from Part i, 2600Hz is used as a

"supervisory" signal. That is, it

signals the status of a trunk--

"on-hook" or "off-hook." When you

seize a trunk (by briefly sending

2600Hz), your end (the CALLING end)

goes on hook for the duration of the

2600Hz and then goes off-hook once

again when the 2600Hz is terminated.

The CALLED end recognizes that a call

is on the way and attaches a register,

which inerprets the digits which are

to be sent. Now, understand that even

though your end has come off-hook

(no 2600Hz present), the other end is

still on-hook. You may wonder then,

why, if the other end (the CALLED end)

is still on-hook, there is no 2600Hz

coming the other way on the trunk,

when there should be. This is correct.

2600Hz *IS* present on the trunk when

you seize it and afterwards, but you

cannot hear it because of a Band

Elimination Filter (BEF) at your

central office.

  Back to the problem. Remember that

when you seize a trunk, 2600Hz is

indeed coming the other way on the

trunk because the CALLED end is still

on-hook, but you don't actually hear

it because of a filter. However, the

Bell equipment knows it's there (they

can "hear" it). The presence of the

2600Hz is telling the billing equip-

ment that your call has not yet been

completed (i.e., the CALLED end is

still on-hook). When finally you do

connect with your boxed call, the

2600Hz from the called end terminates.

This tells the billing equipment that

someone picked up the fone at the

CALLED end and you should begin to be

billed. So you do start to get billed,

but for the call to the trunk, NOT the

boxed call. Your billing equipment

thinks that you've connected with the

number you used to seize the trunk.

Illustration:

  1. You call 1+806-258-2222

     (directly)

  2. Status of trunks:

<----------------------------------->

(You)                    806-258-2222

No 2600Hz-------> <------------2600Hz

  When you seize a trunk (before the

number you called answers) there is

no affect on your billing equipment.

It simply thinks that you're still

waiting for the call to complete

(the CALLED end is still on-hook; it

is ringing, busy, going to recorder

or intercept operator.

  Now, let's say that you've sezied

a trunk (806-258-2222) and for example,

KP+314+949+1705+ST. The call is routed

from the tandem you seized to:

314-949-1705.

Illustration:

<------------------>O<--------------->

(You)              806         314-949

                 tandem

No 2600Hz----------> <----------2600Hz

  Note that the entire path towards

the right (the CALLED end) has no

2600Hz present and is therefore "off-

hook." The entire path towards the left

(the CALLING end) does have 2600Hz

present on it, indicating that the

CALLED end has not picked up (or come

"off-hook"). When 314-949-1705 answers,

"answer supervision" is given and the

2600Hz towards the left (the CALLING

end) terminates. This tells your

billing equipment, which thinks that

you're still waiting to be connected

with 806-258-2222, that you've

finally connected. Billing then begins

to 806-258-2222. Not exactly an

auspicious beginning for an aspiring

young phone phreak.

  To avoid this, several actions may

be taken. As previously mentioned,

one may avoid being charged for the

number called to seize a trunk by

using an extender (in which case the

extender will get billed). In some

areas, boxing may be accomplished

using an 800 number, generally in the

format of 800-858-xxxx (many Amarillo

numbers) or 800-NN2-xxxx (special

intra-state class in-WATS numbers).

However, boxing off of 800 numbers is

impossible in many areas. In my area,

Denver, I am served by #1A ESS and it

is impossible for me to box off of

any 800 number.

  Years ago, in the early days of blue

boxing (before my time), phreaks often

used directory assistance to box off

of because they were "free" long

distance calls. However, because of

competetive long distance companies,

directory assistance surcharges are

now $0.50 in many areas. It is

additionally advised that directory

assistance numbers not be used to box

from because of the following:

  Average DA calls last under 2

minutes. When you box a call, chances

are that it will last considerably

longer. Thus, the Bell billing equip-

ment will make a note of calls to

directory assistance that last a long

time. A call to a directory assistant

lasting for 4 hours and 17 minutes

may appear somewhat suspicious.

  Although the date, time, and length

of a DA call do not appear on the bill,

it is recorded on AMA tape and will

trip a trouble report if it were to

last too long. This is how most

phreaks were discovered in the old

days. Also, sometimes too many calls

lasting too long to one 800 number

may raise a few eyebrows at the local

security office.

  Assuming you can complete a blue box

call, the following are listed routings

for various Bell internal operators.

These are in the format of KP+NPA+

special routing+1X1+ST, which I will

explain later. The 1X1 is the actual

operator routing, and NPA and NPA+

special routing are used for out-of-

area code calls and out-of-area code

calls requiring special routing,

respectively.

KP+101+ST ...... toll test board

KP+121+ST ...... inward op

KP+131+ST ...... directory assistance

KP+141+ST ...... was rate & route. Now

          only works in 312, 815, 717,

          and a few others. It has

          been replaced with a univer-

          sal rate & route number,

          800+141+1212.

KP+151+ST ...... overseas completion

          operator (inbound). Works

          only in certain NPAs, such as

          303.

KP+181+ST ...... in some areas, toll

          station for small towns

  Thus, if you seize a trunk in 806 NPA

and wanted an inward (in 806), then you

would dial KP+121+ST. If you wanted a

312 inward and were dialing on an 806

trunk, an area code would be required.

Thus, you would dial KP+312+121+ST.

Finally, some places in the network

require special routing, in addition to

an area code. An example is Franklin

Park, Ill. It requires a special

routing of 032. For this, you would

dial KP+312+032+121+ST for a Franklin

Park inward operator.

  Special routings are in the format

of 0XX. They are used primarily for

load balance, so that traffic flow

may be evenly distributed. About half

of the exchanges in the network

require special routing. Note that

special routings are NEVER EVER EVER

used to dial normal telephone numbers,

only operators.

  Operator functions:

TOLL TEST BOARD- Generally a cordboard

position that assists in trunk testing.

They are not used by operators, only

switchmen.

INWARD- Assists the normal TSPS (0+)

operator in completing calls out of

the TSPS's area. Also, inwards perform

emergency inerrupts when the number to

be interrupted is out of the area code

of the original (TSPS) operator. For

example, a 303 operator has a customer

that needs an emergency interrupt on

215-647-6969. The 303 operator gets

the routing for the inward that covers

215-647, since she cannot do the

interrupt herself. The routing is

found to be only 215+ (no special

routing required). So, the 303 operator

keys KP+215+121+ST. An inward answers

and the 303 says to her, "Inward, this

is Denver. I need an emergency

interrupt on 215-647-6969. My

customer's name is Mark Tabas." The

inward will then do the interrupt (off

the line, of course). If the number to

be interrupted had required special

routing, such as, say, 312-456-1234

(spec routing 032), then the 303

operator would dial KP+312+032+121+ST

for the inward to do that interrupt.

DIRECTORY ASSISTANCE- These are the

normal NPA+555+1212 operators that

assist customers with obtaining

telefone directory listings. Not much

toll-fraud potential here, except

maybe $0.50.

RATE AND ROUTE- These operators are

reached by dialing KP+800+141+1212+ST.

They assist normal (TSPS) operators

with rates and routings (thus the

name). The only uses I typically have

for them are the following:

1. Routing information. In the above

example, when the 303 operator needed

to dial an inward that served 215-647,

she needed to know if any special

routing was required and, if so, what

it was. Assuming she would use rate

and route, she would dial them and say

nicely, "Operator's route, please, for

215-647." Rate & route would respond

with "215 plus." This means that the

operator would dial KP+215+121+ST to

reach the inward that serves 215-647.

If there were special routing required,

such as in 312-456, rate & route would

respond with "312 plus 032 plus." In

that case, the operator would dial

KP+312+032+ST for the inward that

serves 312-456.

  It is good practice to ask for

"operator's route" specifically, as

there are also "numbers route" and

"directory routes." If you do not

specifically ask for operator's route,

rate & route will generally assume

that is what you want anyway.

  "Numbers" route refers to overseas

calls. Example, you want to know how to

reach a number in Geneva, Switzerland

(and you already have the number). You

would call routing and say "Numbers

route, please, Geneva, Switzerland."

The operator would respond with:

"Mark 41+22. 011+041+ST (plus) 041+22"

The "Mark 41+22" has to do with

billing, so disregard it. The 011+041

is access to the overseas gateway (to

be discussed in Part iii) and the 041+

22+ is the routing for Geneva from the

overseas sender.

  "Directory" routings are for directory assistance overseas. Example:

you want a DA in Rome, Italy. You would

call rate & route and say, "Directory

routing please, for Rome, Italy." They

would respond with "011+039+ST (plus)

039+1108 STart." As in the previous

example, the 011+039 is access to the

overseas gateway. The 039+1108 is a

directory assistant in Rome.

2. Nameplace information. Rate & Route

will give you the location of an NPA+

exchange. Example: "Nameplace please,

for 215-648." The operator would

respond with "Paoli, Pennsylvania."

This isn't especially useful, since you

can get the same information (legally)

by dialing 0, but using rate & route is

often much faster and it avoids having

to hang up when you are already on a

trunk.

*NOTE on Rate & Route: As a blue boxer,

always ask for "IOTC" routings. (e.g.,

"IOTC operator's route", "IOTC numbers

route", etc.) This tells them that you

want cordboard-type routings, not TSPS,

because a blue boxer is actually just a

cordboard position (that Bell doesn't

know about).

OVERSEAS COMPLETION OPERATOR (inbound)-

These operators (KP+151+ST) assist in

the completion of calls coming in to

the United States from overseas. There

are KP+151+ST operators only in a few

NPAs in the country (namely 303). To

use one, you would seize a trunk and

dial KP+303+151+ST. Then you would

tell the operator, for example,

"This

is Bangladesh calling. I need U.S.

number 215-561-0562 please." [in a

broken Indian accent]. She would

connect you, and the bill would be

sent to Bangladesh (where I've been

billing my KP+151+ST calls for two

years).

Other internal Bell Operators.

KP+11501+ST ...... universal operator

KP+11511+ST ...... conference op

KP+11521+ST ...... mobile op

KP+11531+ST ...... marine op

KP+11541+ST ...... long distance

                   terminal

KP+11551+ST ...... time & charges op

KP+11561+ST ...... hotel/motel op

KP+11571+ST ...... overseas (outbound)

                   op

  These 115X1 operators are identical

in routing to the 1X1 operators listed

previously, with one exception. If

special routing is required (0XX),

then the trailing 1 is left off.

Examples:

A 312 universal op ... KP+312+11501+ST

A Franklin Park (312-456) universal

op (special routing 032 required)....

................... KP+312+032+1150+ST

[The trailing 1 of 11501 is left off].

Purposes of 115X1 operators.

UNIVERSAL- Used for collect/callback

calls to coin stations.

CONFERENCE- This is a cordboard

conference operator who will set up a

conference for a customer on a manual

operation basis.

MOBILE- Assists in completion of calls

to mobile (IMTS) type telefones

MARINE- Assists in completion of calls

to ocean going vessels.

LONG DISTANCE TERMINAL- Now obsolete.

Was used for completion of long

distance calls.

TIME & CHARGES- Will give exact costs

of calls. Used to time calls and

inform customer of exactly how much

it cost.

HOTEL/MOTEL- Handles calls to/from

hotels and motels.

OVERSEAS COMPLETION (outbound)- assists

in completion of calls to overseas

points. Only works in some, if any

NPAs, because overseas assistance has

been centraized to IOCC (covered in

Part iii).

  Note that all KP+1X1+ST and

KP+115X1+ST operators automatically

assume that you are a TSPS or cordboard

operator assisting a customer with a

call. DO NOT DO ANYTHING TO JEOPARDIZE

THIS! If you do not know what to do,

don't call these operators! Find out

what to do first.

  This concludes Part iii. There is

one final part in which I will explain

overseas dialing, IOCC (International

Overseas Completion Centre), RQS

(Rate/Quote System), and some basic

scanning.

.......................................

(c) February 6, 1900         Mark Tabas

.......................................

Go To Part 1

Go To Part 3


bhbb3
The Mark Tabas encounter series

presents...

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

     Better Homes and Blue Boxing

              Part iii

         Advanced Signalling

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

(It is assumed that the reader has read

and$understood parts i & ii before

proceeding to this part).

  In parts i & ii, I covered basic

theory and domestic singalling and

operators. In this part I will explain

overseas direct boxing, the IOCC, the

RQS, and some basic scanning methods.

Overseas Dipect Boxing.

  Calling outside of the United States

and Canada is accomplished by using an

"overseas gateway." There are 7 over-

seas gateways in the Bell System,

and each one is designated to serve a

certain region of the world. To

initiate an overseas call, one must

first access the gateway that the call

is to be sent on. To do this auto-

matically, decide which country you are

calling and find its country code.

Then, pad it to the left with zeros as

required so it is three digits. [Add

1, 2, or 3 zeros as required].

Examples:

Luxembourg (352) is 352 (stays the

                         same)

Spain (34)   becomes 034 (1 zero added)

U.S.S.R. (7) becomes 007 (2 zeros added)

  Next, seize a trunk and dial KP+011+

CC+ST. Note that CC is the three digit

padded country code that you just

determined by the above method. [For

Luxembourg, dial KP+011+352+ST, Spain

KP+011+034+ST, and the U.S.S.R. KP+011+

007+ST]. This is done to route you to

the appropriate overseas gateway that

handles the country you are dialing.

Even though every gateway will allow

you to dial every dialable country, it

is good practice to use the gateway

that is designated for the country you

are calling.

  After dialing KP+011+CC+ST (as CC is

defined above) you should"be connected

to an overseas gateway. It will

acknowledge by sending a wink (which

is audible as a <beep><kerchink> and a

dial tone. Once you receive internat-

ional dial tone, you may route your

call one of two ways: a) as an

operator-originated call, or b) as a

customer-originated call. To go as a

operator-originated call, key KP+

country code (NOT padded with zeros)+

city code+number+ST. You will then be

connected, providing the country you

are calling can receive direct-dialed

calls. The U.S.S.R. is an example of

a country that cannot.

Example of a boxed int'l call:

To make a call to the Pope (Rome,

Italy), first obtain the country code,

which is 39. Pad it with zeros so that

it is 039. Seize a trunk and dial

KP+011+039+ST. Wait for sender dial

tone anf then dial KP+39+6+6982+ST.

39 is the country code, 6 is the city

code, and 6982 is the Pope's number in

Rome. To go as an operator-originated

call, simply place a zero in front of

the country code when dialing on the

gateway. Thus, KP+0+39+6+6982+ST woulf

be dialed at sender dial tone. Routing

your call as operator-originated does

not affect much unless you are dialing

an operator in a foreign country

  To dial an operator in a foreign

country, you must first obtain the

operator routing from rate & route for

that country. Dial rate & route and if

you're trying to get an operator in

Yugoslavia, say nicely, "IOTC

Operator's route, please, for

Yugoslavia." [In larger countries it

may be necessary to specify a city].

Rate & route will respond with,

"38 plus 11229". So, dial your over-

seas gateway, KP+011+038+ST, wait for

sender dial tone, and key KP+0+38+

11029+ST. You should then get an

operator in Yugoslavia. Note that you

must prefix the country code on the

sender with a 0 because presumably

only an operator here can dial an

operator in a foreign country.

  When you dial KP+011+CC+ST for an

overseas gateway, it is translated to

a 3-digit sender code of the format

18X, depending on which sender is

designated to handle the country you

are dialing. The overseas$gateways and

their 3-digit codes are listed below.

  182 ..... White Plains, NY

  183 ..... New York, NY

  184 ..... Pittsburg, PA

  185 ..... Orlando, FL

  186 ..... Oakland, CA

  187 ..... Denver, CO

  188 ..... New York, NY

  Dialing KP+182+ST would get you the

sender in White Plains, and KP+183+ST

would get the sender in NYC, etc., but

the KP+011+CC+ST is highly suggested

(as previously mentioned). To find out

what sender you were routed to after

dialing KP+011+CC+ST, dial (at int'l

dial tone): KP+0020000+ST.

  If you have difficulty in reaching

a sender, call rate and route and ask

for a numbers route for the country

you're dialing. Sometimes, KP+011+

padded country code+ST will not work.

I have found this in many 3-digit

country codes. Lexembourg, country

code 352, for example, should be

KP+011+352+ST theoretically. But it

is not. In this case, dial KP+011+

003+ST for the overseas gateway. If

you have trouble, try dialing KP+00+

first digit of country code+ST, or

call rate The IOCC.

  Sometimes when"you call rate and

route and ask for an "IOTC numbers

route" or "IOTC operators route" for

a foreign country, you will get

something like "160+700" (as in the

case of the Soviet Union). This means

that the country is not dialable

directly and must be handled through

the International Overseas Completion

Centre (IOCC). For an IOCC routing,

pad the country code to the RIGHT with

zeros until it is 3 digits. Then KP+160

is dialed, plus the padded country

code, plus ST.

Examples:

The U.S.S.R. (7) ...... KP+160+700+ST

Japan (81) ............ KP+160+810+ST

Uraguay (598) ......... KP+160+598+ST

  You will then be routed to the IOCC

in Pittsburg, PA, who will ask for

country, city, and number being dialed.

Many times they will ask for a ringback

[thanks to Telenet"Bob] so have a loop

ready. They will then place the call

and call you back (or sometimes put

you through directly). Some calls, such

as to Moscow, take several hours.

The Rate Quote System (RQS).

  The RQS is the operator's rate/quote

system. It is a computer used by TSPS

(0+) operators to get rate and route

information without having to dial the

rate and route operator. In Part ii,

I discussed getting an inward routing

for dialing-assistance and emergency

interrupts from the rate and route

operators (KP+800+141+1212+ST). The

same information is available from

RQS. Say you want the inward routing

for 305-994. You would sieze a trunk

and dial KP+009+ST (to access the RQS).

Sometimes, if you seize a trunk in an

NPA not equipped with RQS, you need to

dial an NPA that is equipped with RQS

first, such as 303. Anyway, after you

dial KP+009+ST or KP+303+009+ST, you

will receive a wink (<beep><kerchink>)

and then RQS dial tone. At RQS dial

tone, for an inward routing for 305-994

you would dial KP+06+305+994+ST. That

is, KP+06+NPA+exchange+ST. RQS will

respond with "305 plus 033 plus". This

means you would dial KP+305+033+121+ST

for an inward that services 305-994.

If no special routing were required,

RQS would have responded with "305

plus" and you would simply dian:

KP+305+121+ST for an inward.

  Another RQS feature is the echo

feature. You can use it to test your

blue box. Dial RQS (KP+009+ST) and

then key KP+07+1234567890+ST. RQS will

respond with voice identification of

the digits it recognized, between the

KP+07 and ST.

  RQS can also be used for rates and

directory routings, but those are

seldom needed, so they have been

omitted here.

Simple Scanning.

  If you're interested in scanning,

try dialing on a trunk, routings in the

format of KP+11XX1+ST. Begin with"11001

and scan to 11991. There are lots of

interesting things to be found there,

as Doctor Who (413 area) can tell you.

Those 11XX1 routings can also be

prefixed with an NPA, so if you want

to scan area code 212, dial KP+212+

11XX1+ST.

  There, now you know as much about

blue boxing as most phreaks. If you

read and understand the material, and

put aside preconceived ideas of what

blue boxing is that you may have

aquired from inexperienced people or

other bulletin boards, you should be

well on you way to an enlightening

career in blue boxing. If you follow

the guidelines in Part i to box, you

should have no problem with the fone

company. Comments made by "phreaks" on

bulletin boards that proclaim "tracing"

of blue boxers are nonsense and should

be ignored (except for a passing

chuckle).

NOTE 1: CCIS and the downfall of blue

         boxing.

CCIS stands for Common Channel Inter-

office Signalling. It is a signalling

method used between electronic

switching systems that eminiates the

use of 2600Hz and 3700Hz"supervisory

signals, and MF pulsing. This is why

many places cannot be boxed off of;

they employ CCIS, or out-of-band

signalling, which will not respond to

any tones that you generate on the

line. Eventually, all existing toll

equipment will be upgraded or replaced

with CCIS or T-carrier. In this case,

we'll all be boxing with microwave

dishes. Until then (about 1995 by

current BOC/AT&T estimates), have fun!

If you have ANY questions about this

text, please feel free to drop me a

line. I will respond to anl mail,

messages, etc. Insults are also

welcomed. And if you discover anything

interesting scanning, be sure to let

me know.

                  Mark Tabas

                    $LOD$

This text was prepared in full by Mark

Tabas for:

K.A.O.S.

Philadelphia, PA.

[215-xxx-xxxx].

Any sysop may freely download this text

and use it on his/her BBS, provided

that none of it be altered in any way.

Technical acknowledgements:

Karl Marx, X-Man, High-Rise Joe,

Telenet Bob, Lex Luthor, TUC, John Doe,

Doctor Who (413 area), The Tone Sweep,

Mr. Silicon, K00L KAT, The Glump.

References:

1. Notes on the BOC Intra-LATA Networks

   Bell System publication, 1983.

2. Notes on the Network

   Bell System publication, 1983.

3. Engineering and Operations in the

   Bell System

   Bell System publication, 1983.

4. Notes on Distance Dialing

   Bell System publication, 1968.

5. Early Medieval Architecture.

.......................................

(c) February 6, 1900         Mark Tabas

.......................................

Call 1-305-xxx-xxxx now.

Go To Part 1

Go To Part 2


brown
                           /-/-/-/-/-/-\-\-\-\-\-\

                           <:-\-Brown Box Plans-/-:>

                            \-\-\-\-\-\-/-/-/-/-/-/

  (>Introduction<)

            This is a fairly simple modification that can be made

  to any phone. All it does is allow you to take any 2 lines in

  your house and create a party line. So far I have not heard of

  any problems with it from my friends that have set one up and I

  ha

  I think that the convenience of having two people on line at any

  one time will make up for the minor volume loss.

  (>Phone Modification Instructions<)

  Here is the diagram:

  KEY:___________________________________

      ! PART                   ! SYMBOL !

      -----------------------------------

      !BLACK WIRE              !   *    !

      !YELLOW WIRE             !   =    !

      !RED WIRE                !   +    !

      !GREEN WIRE              !   -    !

      !SPDT SWITCH             !  _/_   !

      !                           _/_   !

      !VERTICAL WIRE           !   |    !

      !HORIZONTAL WIRE         !   _    !

      -----------------------------------

         *    =    -    +

         *    =    -    +

         *    =    -    +

         *    =    -    +

         *    =    -    +

         *    ==_/_-    +

         *******_/_++++++

         |              |

         |              |

         |              |

         |_____PHONE____|

  ---------------------------------------

             In some houses the black and yellow are already wired

  in others you will have to go out to your box and rewire it. A

  good way to figure out which line is which is to take the phone

  you are looking for off the hook.  Then you only need to take

  the red and green wires entering your phone and hook them to the

  different pairs of red and green going into the house.  You

  can't hurt anything in the phone or telephone by probeing.  When

  you find the pair that you want take the black from your line

  and attach it to the red of the other line then take the yellow

  and attach it to the green line.  Now you are all set to go.

  For people with rotary phones you can have one person call you

  then place the second call out to the other person. Though not

  phreakers tool, the brown box can be phun.

  ______________________________________________________________________________

  ____________________________________-END-_____________________________________


bud
 @!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@

  !@                                   @!

  @!                                   !@

  !@                                   @!

  @!            The Bud Box            !@

  !@            -----------            @!

  @!                                   !@

  !@                                   @!

  @!           Revision 1.0            !@

  !@     By: Dr. D-Code & The Pimp     @!

  @!   Of The High Mountain Hackerz    !@

  !@ HMH Inc. AE line.....xxx-xxx-xxxx @!

  @! HMH Inc. CS/CF.......xxx-xxx-xxxx !@

  !@  Both lines 10 megz and 2 drives  @!

  @!       AE password.....BOMB        !@

  !@                                   @!

  @!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@!@

  Necessary Materials

  -------------------

  Four alligator clips

  One Telephone

  Some telephone wire

  Instructions

  ------------

  1) Find a neighbor's house that has a little gray box on the side.  This box

  should have a Bell logo on it (the gay little bell in a circle).

  2) Apply pressure underneath the box and the front should come right off.

  Pull the end off of the length of the telephone wire. Then strip the ends of

  all the different colored wires inside. These should be green, red, yellow and

  black. Attach an alligator clip to each of the wires. Then clip the clips to

  the same colors in the box. Yellow to yellow, red to red and so on.

  3) Then run the wire across the street back to your house and then plug a

  phone into the other end of the wire.

  4) Now you can dial out and receive the neighbors calls. Great for tapping the

  phones and then blackmailing them. You can also stop phreaking because any

  outgoing calls will be charged to the neighbors!   Great eh?

  All sysops may use these plans if they do not change them in any way at all.

  -- (c) 1985 by Dr. D-Code & The Pimp --

  ---------------------------------------


chartreuse
      -----------------------------------------------------------------

       -                The Marshals of Dynamic Discord                -

       -                           Present                             -

       -----------------------------------------------------------------

       -      The Chartreuse Box (or any other obnoxious color)        -

       -----------------------------------------------------------------

       -                  By: Wonko The Sane                           -

       -----------------------------------------------------------------

       Intro

       -----

            The Chartreuse Box, so named because this is an obnoxious box

       and  chartreuse  is  an  obnoxious  color,  is  designed  to  take

       advantage of the thousands of dollars Ma Bell pays to the electric

       company each day.   As you know, your telephone line is a constant

       power source.   The chart box is designed to allow you to tap that

       power source for whatever sicko purposes you might have in mind.

       Parts

       -----

       [1]- 1 four prong to modular phone adapter (the rectangular beige

            boxes with phone line jacks at one end and four prongs out

            the other.)

       [2]- 1 low power broad range rheostate.

       [3]- some wire

       [4]- a soldering iron

       [5]- some electric tape

       [6]- a 70 vlt. DC fuse (optional)

       [7]- 1 SPST switch

       Assembly

       --------

            Plug the adapter into a phone line,  and use a multitester to

       note  which  posts are charged.   Use a magic marker to  mark  the

       positive and negative poles.  Do this first.

            Take  the  adapter,  and turn it  upside  down.   You  should

       observe  that the bottom fits into the top.   Use  a  pocketknife,

       small  screwdriver,  battle axe etc. to remove the bottom.   Don't

       break it.

            Detach  the  two wires not connected to  charged  poles,  and

       scrap  em.   Detach  the  other two  wires  as  well.   Take  your

       rheostat, and mount it on the outside of the box, drilling a small

       hole in the box, to run wires through.

            Run  wire  from the charged connections from the  line  jack,

       through the rheostat, to the charged poles.  (see diagram).

          positive line

                  \/        +---------+

       ---------.....       :         :

       linejack+    :......#:rheostat :#........(fuse)....[=====]

       ---------..          :         :

                 :...       +---------+

                    :............#.........................[=====]

                                        negative line

       Key:  # - Rheostate poles

             . - Wiring path

            [=]- Outside posts

            Attach  the fuse somewhere in the line if you feel  like  it.

       When  the phone rings 90 volts of pulsing DC power get  shot  down

       your line,  and can really fuck up whatever you have the chart box

       hooked up to.  Therefore, the fuse is a good idea.

            You can also hook a switch up to the wiring, to give you more

       control  over when power starts to flow.   Once all the wiring  is

       complete, push the wires and the fuse into the casing, and reclose

       it.   Then tape around the side of the box, to hold the wires that

       come  out to the rheostat down.  I highly recommend that you  mark

       the charged posts with a marker, so you can easily identify them.

       Use

       ---

            To use the chart box, hook it up to a phone line, and grab a

       multitester or voltmeter.  Use the voltmeter to read off the

       voltage from your chart box.  You can get up to 12 volts (more if

       you use a transformer) from the box, but you can use the rheostat

       to calibrate the box for whatever voltage you need.  Once the

       voltage is set, remove the box from the line, hook your device up

       to the charged poles, and plug the box back in.  If you're really

       in a constructive mood, build a switch into the box.  Now leech Ma

       Bell's precious energy to your hearts content.

       Footnote

       --------

            This device has other potential uses.  One of the most

       obvious, and least useful (at least to my view) is as a volume

       control for your phone.  Maybe you have an aunt that talks REAL

       LOUD!!!!!   Also, you can use this device to set up a feedback

       loop to mess up someone else's phone line.  Finally, it may be

       possible to use the chart box to tone down your connection, and

       provide a little background noise, so that ESS doesn't pick up on

       your blue boxing.  This is not a guaranteed method, but if you do

       it just right, you can make the 2600 blast sneak by the ESS

       detection code.

            Naturally, the main purpose of the chart box is to leech Ma

       Bell just like she leeches you.

       Hail Discordia!

     Naturally, the main purpose of the chart box is to leech Ma Bell!


cheese
                  $$$$$$$$$$-=>Making Your Phone<=-$$$$$$

                   $$$$$$$$$$-=>Into a Cheesebox <=-$$$$$$

                            /=\Typed by:Sir Knight/=\

         A Cheesebox(named for the type ofbox the first one was

  found in)is a type of box which will, in effect, make your telephone a

  Pay-Phone.....This is a simple,modernized, and easy way of doing it....

        Inside Info:These were first used by bookies many years ago as a way of

  making calls to people without being called by the cops or having their

  numbers traced and/or tapped......

       How To Make A Modern Cheese Box

       Ingredients:

       ------------

       1 Call Forwarding service on the

         line

       1 Set of Red Box Tones

       The number to your prefix's Inter-

       cept operator(do some scanning for

       this one)

       How To:

       -------

         After you find the number to the intercept operator in your prefix, use

  your call-forwarding and forward all calls to her...this will make your phone

  stay off the hook(actually, now it waits for a quarter to be dropped

  in)...you now have a cheese box... In Order To Call Out On This Line:You must

  use your Red Box tones and gener- ate the quarter dropping in...then,you can

  make phone calls to people...as far as I know, this is fairly safe, and they

  do not check much...Although I am not sure, I think you can even make

  credit-card calls from a cheesebox phoneand not get

  traced...


chrome
  \ \ \ \ \ \ \ \ \ \ \ \ \ \ \

  \[____________________________[_    \                                /

  \[      The Chrome Box        [_     A Portable Self-Contained Device

  \[        14-JUN-88           [_    /  to Manipulate Traffic Signals \

  \[   Outlaw Telecommandos     [_      /     by Remote Control       \

  \[     Modem Free Earth       [_           /                 \

  \[\\\\\\\\\\\\\\\\\\\\\\\\\\\\[_                 -=p*p=-

    _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

    Emergency vehicles in many cities are now using devices called OptoComs.

  OptoComs are a system of sensors on traffic lights that detect a pattern

  of flashes from vehicle-mounted strobe lights.

    This flash pattern varies from city to city depending on the manufacturer

  of the equipment used.  Often the sensors are installed only at major

  intersections.  Nevertheless, the Chrome Box, which simulates these strobe

  patterns can often be used to give your car the same priority as an

  ambulance, paramedic van, firetruck or police car.

    Because of the varying patterns on different systems this phile will

  outline a general procedure for making the Chrome Box.

  Decoding Flash Patterns:

   First, you need to observe an emergency vehicle in action.  You can wait

  until you encounter one by chance, running out to see when you hear a siren,

  or when you pull over in your car to let one pass by. You might wait near a

  fire station for the next emergency to occur.  Or, if you are very

  impatient, you can summon one by calling in a false alarm (not recommended

  in areas with limited services - that could divert attention from a real

  emergency).  If the OptoComs in your area are the kind with a pattern of

  single flashes at a steady rhythm, you have merely to buy a strobe light at

  Radio Shack & adjust the flash rate until you can induce a traffic light to

  change.

   If the flash pattern is more complex, you can videotape the emergency

  vehicle & then play back the tape in single-frame mode, counting the number

  of frames between each flash. Each video frame is 1/30 of a second, using

  this you can calculate the time between flashes in the pattern.  Another way

  is to count the number of flashes (or flash-groups) in one minute and use

  that to compute the rate. Counting video frames will give you a good idea of

  the spacing of the flashes in a complex pattern.  For really accurate

  information, call the fire station & ask them, or write to the manufacturer

  for a service manual, which will include a schematic diagram that you can

  use to build one. A good cover story for this is that you are a consultant &

  one of your clients asked you to evaluate Optocom systems, or you could pose

  as a free-lance journalist writing an article.

  Modifying the Strobe Light:

   You may not have to modify the strobe at all. But if you need a faster

  flash rate than your strobe allows, open it up & find the large capacitor

  inside. Capacitors are marked in microfarads, abbreviated as mf,mfd or ufd.

  By replacing the capacitor with one of the same voltage-rating (usually

  250 volts or more) and a SMALLER value in microfarads, you can increase the

  flash rate. Halving the microfarads doubles the rate.

   The other component that can be changed is the potentiometer (the speed

  control device with the knob on it). Using a smaller value (measured in

  ohms or Kilohms, abbrevaited with the greek letter 'omega' or the letter K)

  will speed up the strobe. There may also be a resistor (small cylinder with

  several colored stripes on it, and wires coming out of each end). Replacing

  this resistor with one of smaller value will also speed up the strobe.

   To generate a complex pattern, you will either have to design and build a

  triggering circuit using IC chips, or rig up a mechanical device with a

  multiple-contact rotary switch and a motor.  It HAS been done.

   To modify the strobe for mobile operation the simplest thing is to get a

  110-volt inverter that will run off of a car battery by plugging into the

  cigarette lighter & run the strobe from that.  Or, you can figure out (or find

  in a hobby electronics magazine) a strobe circuit that will run from batteries

.

  Battery-powered strobes may also be availble, either assembled or as kits.

  Stealth Technology:

   Most light sensors and photocells are more sensitive in the infrared area of

  the light spectrum. Infrared (IR) is invisible to the human eye. Putting an

  infrared filter over the strobe light may allow the Chrome Box to operate in

  traffic undetected by police or other observers. IR filters can be obtained

  from military surplus sniperscope illuminators, or from optical supply

  houses like Dow-Corning or Edmunds Scientific Co.

  Using the Chrome Box:

   Mounted on your car, the Chrome Box can guarantee you green lights at major

  intersections in cities that have OptoComs. Handheld Chrome Boxes may be

  used to create gridlock by interfering with the normal flow of traffic.  If

  you have access to a window overlooking a traffic light, you can play pranks

  by switching the signals at inappropriate moments, or you can plug the

  strobe into an exposed outlet at a laundromat or gas station.

  Some Decoded Patterns:

  Torrance, California

      Standard large Radio Shack strobe lights are used. Moderately fast rate.

      *  *  *  *  *  *  *  *

  Manhattan Beach,CA

     Flash-pairs in a 4:1 ratio, at a rate of 2 flash-pairs per second.

     * *       * *       * *       * *

     <------ 1 sec ----->

  ******************************************************************

  * Please add any new patterns or info you discover to this Phile *

  ******************************************************************


clear
                             Clear Box Plans

     The clear box is a new device which has just been invented that can be used

  throughout Canada and rural United States. The clear box works on "PostPay"

  payphones (fortress fones). Those are the payphones that dont require payment

  until after the connection is established. You pick up the fone, get

  a dial tone, dial your number, and then insert your money after the person

  answers.If you dont deposit the money then you can not speak to the person on

  the other end- because your mouth peice is cut off, but, not the ear piece.

  (obviously these phones are nice for free calls to weather or time or

  other such recordings).All you must do is to go to your nearby Radio Shack, or

  electronics store,and get a four-transistor amplifier and a

  telephone suction cup induction pick-up. The induction pick-up would be

  hooked up as it normally would to record a conversation, except that it

  ould be plugged into the out-

  put of the amplifier and a microphone would be hooked to the input. So when

  the party that is being called answers, the caller could speak through the

  little microphone instead. His voice then goes through the amplifier and out

  the induction coil, and into the back of the reciever where it would then be

  broadcast through the phone lines and the other party would be able to hear

  the caller. The Clear Box thus 'clears up' the problem of not being heard.

  Luckily, the line will not be cut-off after a certain amount of time because

  it will wait forever for the coins to be put in.The biggest advantage for all

  of us about this new clear box is the

  fact that this type of payphone will most likely become very common.

  Due to a few things: 1st, it is a cheap way of getting the DTF,dial-tone-first

  service, 2nd, it doesnt require any special equipment, (for the phone

  company)This payphone will work on any phone line. Ususally a payphone line is

  different, but this is a regular phone line and it is set up so the phone

  does all the charging, not the company.


clear2
                            CLEAR BOXING

The idea for the Clear box comes from an article in the newsletter 2600.

The clear box works on 'post pay' coin phones, pay phones that require money

only after the connection has been made. The way this works is:  After the

connection is made the mouthpiece of the phone is muted but not the earpiece,

free calls to dial-it services can be made with these phones.

   In order to talk to the person you called without paying (NOTE:  It is

against the law to do this!!)  Take yourself down to your nearby electronics

store and get a four transistor amplifier and a telephone suction cup inductive

pick-up.  Put the pick-up on the earpiece and plug it into the output of the

amplifier, and plug a microphone into the input. You then talk into your

microphone and listen normally through the earpiece.

   Radio Shack sells an item that wont need much modification,and that

should work the same as the above construction.  It is their 'Portable snap-on

handset amplifier' (Part # 43-238) Their description says to put it on the

earpiece and it will boost the callers voice to five times the normal level.

In order to make this function like a clear box one would have to take the

amplifier apart and remove the internal speaker, in it's place, connect the

suction cup inductive pickup.  Place the pick-up (which is now the speaker)

to the earpiece of the payphone, and talk into the microphone of the amplifer.

  The line will not cut off, and will wait forever for you to put the coins in.

  Note also that these types of payphones are not connected to the TSPS in

the same way as normal payphones.  The phone does all the charging and not

the Central Office.  It is because of this, that a phone connected to the

lines BEFORE the payphone would act just like a normal phone. So get out

your smallest phone, cut off the jack and strip the wires. connect the wires to

two alligator clips. Then you can clip onto the payphone's wires BEFORE they

connect to the payphone, you then have a normal telephone line that you dont

pay the bills on!


cocots
                     R e n e g a d e   L e g i o n

                    T e c h n i c a l   R e p o r t s

                         Technical Report #2

                                ....

                                ........

                                 .........

                                 ...    ....

                                 ... ....

                                 .....

                                ....

                                 ....

                                 ... ...

                                 ...   ...

                                 ..      ...

                                           ...

                                February 1991

Report Number: 4.0

COCOTS: Uses for privatly operated public telephones. How to make free calls

        use their maintenance features, and plans for a tone dialer to fool

        COCOT security systems.

Compiled : 03/25/91

Author   : Count Zero

System   : COCOT Payphones

Uses     : Free calling to most of the world

-RL-----------------------------------------------------------------Page 1

point,

   So you're walking down the street and you see a payphone gotta make an

important call, so you dig into your pocket to get a dime picking up the

handset, you suddenly notice that the payphone wants a QUARTER for a local

call! What the hell, and WHERE did this synthesized voice come from?

  Let's make this phile short and to the point a COCOT is an acronym for

Customer Owned Coin Operated Telefone in other words, a COCOT is a fone

OWNED or RENTED by a PAYING CUSTOMER (most likely, a hotel or donut shop) a

COCOT is NOT a normal payfone the Telco doesn't own it, and the actual fone

line is usually a normal customer loop (unlike payfones, where the fone line

is a "special" payfone loop, allowing the use of "coin tones" to indicate

money dropped in more on this later) SO!..A COCOT may LOOK and SMELL like

a telco payphone, but it is NOT.

* Why do COCOTs exist?

  Simple $$$$$$$! A customer owned payfone is money in the bank! You pay

MORE for local calls and long distance is typically handled by sleazy

carriers that offer bad/EXPENSIVE service the owner/renter of the COCOT opens

the coinbox and keeps the money him/herself! Also, a particularly SLEAZY

quality of a COCOT is the fact that it DOES NOT RECIEVE INCOMING CALLS this,

of course, is because of $$ if people are calling IN to a COCOT, the COCOT

is not making money and businesses always want to make as much $$ as

possible...even if it hurts the consumer (think about it..it REALLY sucks

calling someone at home from a COCOT, then not be able to have him/her call

you back to save $$ "Guess I'll have to keep feeding the COCOT quarters!")

* Where is a good place to look for COCOTs?

  Outside Dunkin Donut shops, restaurants, clubs, bars, and outside/inside

hotels "convenient" locations

*  How do I figure out if I have found a COCOT?

  Simple a COCOT will have NO TELCO LOGOS on it no New England Telephone

symbols it may look just like a Telco fone chrome, with blue stickers and

all that ALSO a COCOT typically charges MORE for a local call than a regular

Telco payfone (in Massachusetts, local calls are a dime, in places like NYC,

they are 25 cents.) a COCOT will most often have a synthesized voice that

asks you to "please deposit 25 cents" or whatever ALSO some FaNcY COCOTS

will not look like payfones at all some in hotels have weird LCD displays

and look totally different but the ALWAYS charge you more than a normal

payphone.

*  OK, I found this weird payphone in Boston that wants a quarter, and this

 synthesized voice is harassing me when does the phun begin?

-RL-----------------------------------------------------------------Page 2

point,  Soon..first of all, you must understand that the COCOT is a mimic.

Essentially, it wants you to think that it is just a plain ol' payfone pick

up the handset..hear that dialtone? hah! that dialtone is fake, synthesized

by the innards of the COCOT you are at the mercy of the COCOT. Remember

a COCOT runs off of a normal customer loop so unlike a Telco payphone where

you must deposit money to generate coin tones that are read by the CO, the

security of a COCOT depends solely on the COCOT fone itself its as if you

took your own fone and put a sign on it saying "Please put 10 cents in this

jar for every call you make." COCOTS are not naiive they won't let you near

the unrestricted dialtone until you fork over the cash-ola heh heh. Or so

they THINK!

  See, the Achilles heel of the COCOT is the FACT that ALL PAYFONES MUST LET

YOU MAKE 1-800 CALLS FOR FREE! It's not just a fact, it's the LAW so, now

pick up the handset again and place a 1-800 call any 1-800 number will do.

When they answer at the other end, just sit there do nothing ignore them.

wait for them to hang up the fone here's an example.

<DIAL 1-800-LOAN-YES>

<Ring, Ring>.....<click> "Hello, you wanna buy some money? Hello? HELLO?!"

<CLICK>

<You will now hear some static and probably a strange "waffling" noise, like

  chh,chh,chh,chh,chh>

<CLICK>......DIALTONE!

 NOW!.what have we got here? a dialtone? yes, you guessed it, the dialtone

you now hear is the UNRESTRICED dialtone of the COCOT's customer loop.

* So what?..So I got an "unrestricted dialtone"...big deal?

  Meathead! with an UNRESTRICTED dialtone, all you need to do is place a call

via DTMF tones (the tones a touch-tone keypad generates) now, try dialing a

number with the COCOTs keypad WHOA! waitasec, no sound! this is a typical

lame attempt at protection by the COCOT. Just whip out your Radio Shack

pocket tone dialer, and try calling a number ANY number place it just as

if you were calling from a home phone call a 1-900 sex line call Guam you

are FREE and the COCOTs customer loop is being billed!

***NOTE: some COCOTS are more sophisticated at protecting themselves..some

will RESET when they hear the dialtone to get around this, make a loud

hissing sound with your mouth into the mouthpiece after the 1-800 number hangs

up also, get your tone dialer ready near the mouthpiece when u hear the

dialtone, quickly dial the first digit of your number to call if you hiss

loudly enough, you MAY be able to mask the sound of the dialtone and prevent

the COCOT from resetting and once you dial the first digit of the number

you are calling, the dialtone will disappear (naturally) ok, you can stop

hissing like an idiot now finish dialing your PHREE fone call.

  Also, some COCOTs actually disable the handset after a call hangs up

(in other words, you can't send DTMF tones thru the mouthpiece) oh well,

better luck next time.

-RL-----------------------------------------------------------------Page 3

point,

HOWEVER MOST of the COCOTs I have run across ONLY disable the DTMF keypad..

so all you need is a pocket dialer to circumvent this!

OTHER THINGS TO KNOW: Sure, you can't call a COCOT, but it DOES have a number

to find out the COCOT's number, call 1-800-933-3258..this automated ANI

service will tell you the number you're dialing from now, try calling the

COCOT from another fone you will hear one of 2 things:

                 1) synthesized voice "Thank you"...CLICK..<hang up>

                 2) weird carrier

A COCOT's number is ONLY used by the company that BUILT the COCOT by calling

up a COCOT, a tech. can monitor its functioning, etc in case (1), you must

enter a 3 or 4 digit password and then you'll get into a voice menu driven

program that'll let you do "maintenance" stuff with the COCOT in case (2),

you are hooked to the COCOT's 300 bps modem (YES, a MODEM in a PAYFONE)..

likewise, if you can figure out the communication settings, you'll be into the

COCOT's maintenance routines.

Personally, I haven't had much luck (or patience) with calling up and hacking

COCOT maintenance functions. I just like making free fone calls from 'em!

COCOT ETIQUETTE:

 Now, remember, you are making free fone calls but SOMEONE has to pay for

'em...and that is the OWNER the COCOT's customer loop is billed the cost of

the calls, and if the OWNER sees a big difference in the profits made on the

COCOT (profit=coins from COCOT - bill from Telco for customer loop)..they'll

know SOMETHING is up so moral is DON'T ABUSE THEM! don't call a 1-900

number and stay on the line for 12 hours! If a COCOT is abused SEVERLY, an

owner will eventually LOSE money on the damn thing!, and that means BYE BYE

COCOT also, remember that a RECORD of ALL LONG DISTANCE calls is made to the

COCOT's customer loop..and COCOT companies will sometimes investigate "billing

discrepencies" so don't call anyone you personally know unless you are

sure they are "cool".

<RING RING> "Hello?"

       "Hello...this is Cointel, Inc....we'd like to ask you a few

        questions about a call you received from Boston on 2/12/91.

        Could you tell us the name and address of the person who

        placed the call?"

    COOL dude -> "What?...I don't remember...go to hell! <SLAM>"

    MEATHEAD -> "Uh, sure, his name is John Smith...you want his address too?"

Get the picture? Good...

COCOTs are a great resource if we use them wisely like our environment, we

gotta be careful not to plunder them make a few long distance calls and

then leave that particular COCOT alone for awhile chances are, your bills

will be "absorbed" by the profit margin of the owner and probably ignored

but the smaller the owner's profit margin gets,the more likely suspicions will

be aroused 'nuff said!

-RL-----------------------------------------------------------------Page 4

point,

I have found COCOTs EVERYWHERE some of my personal favorites are on Route 1

North of Boston check out the Dunkin Donut shops and the Burger King also,

in front of the Rat in Kenmore look around they are lurking everywhere.

(BUT..COCOT technology is relatively new..don't expect them EVERYWHERE..I know

many towns that have NONE..check out big cities....)  Here are some numbers of

COCOTs:

                 Kenmore Square,Boston,MA The Rat

                     617/247-8195

                     617/247-7913

                     617/247-8208

                     617/247-9437

  Random ones: 617/720-4430   617/233-9872

Here are some companies that deal with COCOTs...try out your social

engineering skill on them:

              Cointel, Inc.               Int'l Telecharge, Inc.

            130 Broadway St.               P.O. Box 50579

            Somerville, MA                 Dallas, TX

                       02145            1800/999-5152

             1800/322-7741

As for a Tone Dialer, don't leave home without one!...a true phreak always has

a DTMF tone dialer at hand..along with a red box!....My personal favorite is

the COMBO-BOX (red box plus DTMF) take a Radio Shack 33-memory Pocket Dialer..

open up the back...remove the little 3.579 MHz crystal (looks like a metal

cylinder..unsolder it)...solder on a couple of thin, insulated wires where the

crystal was attached...thread the wires thru one of the "vents" in the back of

the tone dialer....get ahold of a 6.5536 MHz crystal (available thru Fry's

Electronics, 89 cents a piece, phone number 415/770-3763)..go out and get some

quick drying epoxy and a Radio Shack mini Toggle Switch, DPDT, cat. no 275-626

Close the tone dialer, with the two wires sticking out one of the back vents..

screw it up tight...now, attact the crystals and wires to the switch like this

with solder:

                              I^^^^^I

                              I      xx  <3.579 crystal>small one

                              I     I

 toggle switch    ->   oooooo X      xxxxs <two wires>

                              I     I

                              I      xx  <6.5536 crystal>big one

                              I     I

                               ^^^^^^

Each "xx" prong in the diagram is actually TWO prongs....hook up the two leads

from the crystals to separate prongs (same with the wires).

Now, epoxy this gizmo to the side of the tone dialer use ALOT of epoxy, as you

must make the switch/crystals essentially EMBEDDED in epoxy resin. like this:

-RL-----------------------------------------------------------------Page 5

point,

Front View ->       ----------------------

                    I                    I T <-toggle switch

                    I  oo    oo     oo   I---

                    I                    I  |

                    I                    I---

                    I   1    2     3     I B s <-two crystals(b=big,s=small)

                    I                    I  |     in epoxy "blob"

                    I   4    5     6     I _

                    I                    I

                    I   7    8     9     I  ^two wires running to back of unit

                    I                    I

                    I   *    0     #     I

                    I                    I

                    ----------------------

                    ----------------------

Back View ->        I                    I

                 T  I  o      ----   o-----------------------vent (1 of 4)

                --- I    /          \    I

               |    I   |         -----------------speaker

                --- I   |            |   I

                s B I   |            |   I

 2 wires    ->   \-----o      ----   o   I

 running into       I                    I

 vent               I                    I

                    I                    I

                    I                    I

                    I                    I

                    ----------------------

Make sure the epoxy is really gobbed on there..you want to be certaint the

switch and crystals are firmly attached and secure in a matrix of epoxy (it

doesn't conduct electricity, so don't worry about shorting out the connections

to the toggle switch)...just don't gum up the action of the switch!

Basically, you've altered the device so you can select between 2 crystals to

generate the timing for the microprocessor in the tone dialer...

Now turn on the tone dialer NOW, you can easily switch between the 2 crystal

types the small crystal will generate ordinary DTMF tones but, by simply

flicking the switch, you generate HIGHER tones now, using the memory function

of the tone dialer, save 5 "*" in the P1 location, now dial the P1 location

using the BIG crystal, sure sounds like the tones for a QUARTER, doesn't it!

Carry this around with you always will come in handy with both Telco payphones

AND COCOTs! no Phreak should be without one!

Anyway, that about wraps it up for me references for this article include

Noah Clayton's EXCELLENT article on COCOTs in 2600 Magazine, Autumn 1990..

also, The Plague's article on Tone Dialer conversion to Red Box, 2600

Magazine, Summer 1990 (Which inspired me to create the COMBO-BOX (red box PLUS

DTMF dialer)...I strongly urge people to subscribe to 2600 Magazine...call

their office line for more details ->516/751-2600...

Remember..you can READ all you want, but if you don't get your ASS out

there and try stuff out for yourself, you are nothing but a POSER!

-RL-----------------------------------------------------------------Page 6

point,

Enough said...oh, also, I heard that SOME COCOTs have handsets in them

that can be accessed..in other words, you call the COCOT and if you hit

"0" or something else, the earpiece of the handset is activated and you can

listen in on what's goin on around the COCOT...I dunno...never worked for me,

but try these 2 "suspected" numbers...212/268-7538, -6129..try hitting "0" and

listen for any sounds...I could be wrong, I could be right..I could be black,

I could be white....

That's all folks remember, the purpose of this phile is to ENLIGHTEN, and I

in no way condone or encourage illegal activities...so don't blame me for

ANY MESS you get into this phile offered strictly as INFORMATIONAL ONLY!  I

am in no way responsible for your ass!

Also, I am not into wanton destruction, vandalism, or fraud..seek the truth,

and leave nothing but footsteps.

Remember...SHARE THE WEALTH...INFORMATION IS POWER...SHARE IT!

And drink massive amounts of Jolt cola...trust me, it's good for you.

Keep the faith, and never stop searching for new frontiers....

                    ..................................

                       ..oooOO Count Zero OOooo..

                    ..................................

-RL-----------------------------------------------------------------Page 7

EOF


copper
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

  @                            @

  @     =->The Copper<-=       @

  @        =->Box<-=           @

  @                            @

  @        Concieved By        @

  @         The Cypher         @

  @    [001010]->[1101101]     @

  @                            @

  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

  Disclaimer (I know...):

    This file is for informational purposes only.  No use of this technique

  is recommended for one of many reasons: 1) It makes other Phreaks & hacks

  very upset, 2) It makes the Telco VERY upset, and you could be put away for

  a LONG time if you dont know what youre doing.  Telco employees could learn

  something from the Copper Box. Well, anyway, off we go....

  Purpose:

    This box can destroy a phone company, no matter how big.  You could bring

  AT&T down to their knees!  Only to be used by the most irate of Phracks,

  it is intended for informational purposes only.

  History:

    This is really not a Box, but if you consider a Cheese Box a Box, then it

  is.  It was first concieved back in 1986 when a Phriend and I came up with

  the idea while using a Copper-coloured fone, hence, a Copper Box.

  Instructions:

    You must obtain [1] extender, or phone company port, like an MCI or SPRINT

  access number.  [2] A hell of a lot of nerve, and vendetta towards the phone

  company (phriend gets busted, rates increase, etc.) [3] a computer & modem

  capable of autodialing [tone.]

    Dial the number of the L/D service, then enter the code.  Dial the number of

  the service again, through the outdial number you are still on, enter code,

  then dial again and again.  You should hear, after a while (it will take a

  long time for BIG companies) a slight high-pitched, unstable tone, that grows

  louder and louder w/every dial.  Once it gets so loud that it refuses to let

  in any more sounds, you have just completed the first cycle of the Copper Box.

    Leave line off-hook for about 10 minutes or until the tone seems to calm

  down, or stop completely.  Then, dial again and repeat over and over again

  until when you dial a last time, it [the port] doesnt answer.  You have just

  killed a telephone company, extender, etc.

  Theory of Operation:

    What happens is that when the tone begins to rise, it is a result of cross-

  talk feedback.  The more you dial,  the more it grows.  In systems like these,

  the small, sensitive equipment such as amplifiers, etc. begin to burn out as

  a result of the feedback, damaging the equipment, and possibly starting a fire

  at the location of the equipment.


crimson
                          (*)*(*)*(*)*(*)*(*)

                           (*) Crimson Box (*)

                           (*)    Plans    (*)

                           (*)*(*)*(*)*(*)*(*)

  The Crimson Box is very simple device that will allow you to put

  someone on hold or make your fone busy with a large amount of

  ease. You flip a switch and the person can't hear you talking.

  Flip it back and everything is peechy.

  (*)*(*)*(*)*(*)*(*)*(*)*(*)

  (*)   Needed Materials  (*)

  (*)*(*)*(*)*(*)*(*)*(*)*(*)

  (1) 100 ohm or less resistor

  (1) SPDT toggle switch, On-On

  (3) feet of good wire

  Wire cutters

  Solder and soldering iron

  (*)*(*)*(*)*(*)*(*)*(*)*(*)*(*)*(*)

  (*)   Construction & Schemtaic  (*)

  (*)*(*)*(*)*(*)*(*)*(*)*(*)*(*)*(*)

  First I will give you the schematic and then I will explain what

  the hell is going on.

  -----------black wire on line---------

  --------+   red wire on line   +------

  --------!--+/\/\/-green wire---!------

  --------!--! yellow wire-------!------

          !  !                   !

          +--!------+            !

             +----+ ! +----------+

                  ! ! !

                  1 2 3

  Ok. The '/\/\/' is the resistor. And '1 2 3' is the switch where

  the numbers are the poles on the switch. Notice you leave the

  black and yellow wires alone.  You DO NOT cut them!

  Strip the red and green wires so you've got about an inch of

  bare wire. Solder some of the extra wire and follow the

  schematic. You should have the resistor on the green wire with

  an extra piece of wire coming from one leg of it. The other leg

  goes to the other end of the green wire. You should solder the

  green wire to the left pole of the switch and the red to the

  middle and the other end of the red to the right pole.

  Now, lift up the phone. If all you get is an annoying buzz then

  throw the [switch and you should get a dial tone.  If not, don't

  worry and just follow the instructions and schematic again.

  _______________________________________

   This has been an HMH presentaion-1985

   Crimson Box - Written and created by:

                 Dr. D-Code

     Watch for the upcoming Sand Box

  _______________________________________


dark
*-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-*

!                                                                   !

!                   The Dark Side Research Group                    !

!                                                                   !

!                         Proudly Presents:                         !

!     The DARK BOX: Multi-Purpose Network Manipulation Unit         !

!                                                                   !

!                      By: Cablecast 0perator                       !

!                                                                   !

!     (]<)0PYWR0NGDE 1987, 1990 DSR/ATR  All Rights Fucked          !

!                                                                   !

*-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-*

                        -=> Introduction <=-

The Dark Box is the newest device to enter the "colored box"  market

and is guaranteed to rerevoloutionize the art of  telecommunications

fraud. The device's inventor, Cablecast 0perator, became quite bored

with the old forms of phreaking, having to worry about codes  dying,

or being traced. The unit you are about to build was spawned by  the

need  for a more versitle, safe and interesting way to  phreak.  You

don't  need any special tones or attack dialers, just your good  old

every-day DTMF pushbutton phone.

The  box's  basic design allows you to call anywhere  on  earth  (or

elsewhere  for all we care) without fear of being billed or  traced.

But it's uses do not stop there! When hooked up properly, it can  be

used to emulate multi-line bridges, loop lines and direct in-dials.

It's  really  quite  simple. The device is plugged  into  two  phone

lines,  other  than your own, or one end into a phone line  and  the

other  into another box. When there is an incoming call, the  device

senses this and picks up the phone. Your call is then transferred to

the other line or onto the loop. When you hang up, the device senses

this, too, and it hangs up also, waiting for the next caller.

To  illustrate this, whip out your good old analog  multimeter  and

hook  it  up  to your phone line. See that nice,  juicy  voltage  on

there? Now call it on your other line. The voltage will jump and the

polarity  will  go all to hell. This version of the  Dark  Box  uses

an alternating current detector to tell if the phone is  ringing

because sensing voltage is unreliable and not entirely universal. Now

pick  up your second line. There is a momentary blackout on  it  and

then the voltage becomes constant. Now hang up the phone you  called

in  on. There will be another blackout on your other line  ans  then

the  voltage will pop back up again. On the box, hangup is  detected

by the line current passing through an optoisolator that is  holding

the relay open. When it is cut off for the split second the blackout

occurs, the relay is cut off and the phone hangs up.

NOTE: With the rapid expansion of digital ESS's, the little phone

company quirks that are essential for the device's operation might

not be available in your area. Check your line with the meter as

directed to be sure!

                    -=> Trip To Radio Snack <=-

On your next trip out to your friendly neighborhood Radio Shack, get

yourself these:

1:1 Audio Isolation Transformer

555 IC Timer

Optoisolator (Transistor Output)

(2) NPN Transistors (2N3904 or 6 Will Do Nicely)

(2) 100k 1/4w Resistors

(2) Normal Diodes

1k 1/4w Resistor

10mF Electrolytic Capacitor

Disc Capacitor (.01mF)

DPST Relay

9v Battery or Likewise AC Adapter and Timer

It'll  run you about five or six bucks, unless of course you  get  a

five finger discount...It can be mounted on a small IC perfboard, or

whatever you like depending on how small you want it.

If you can't display the schematic that goes along with this,  we'll

do it like connect the dots, it'll be fun!!

                                         +     O     P     Q

    _________         ________        ___|_____|_____|_____|___

A -|o        |- H I -|o       |- N   |   C                     |

B -|   555   |- G J -| OptoIs |- M   |   O     DPDT/DPST       |

C -| ICTimer |- F K -|________|- L   |   I       Relay         |

D -|_________|- E                    |___L_____________________|

                                         |     |     |     |

                                         -     R     S     T

This is the wiring diagram for X1, the 1:1 Audio Transformer:

     RED --(white)--------O||O--------------(red)-- YEL

                          O||O

     GRN --(black)--------O||O-----------(yellow)-- BLK

They  don't have to be paired exactly like that, just remember  that

white goes with black, and red goes with yellow.

Text  coding  of  the schematic is very simple.  If  you  have  ever

assembled one of those 1,000,000,000,000-in-1 electronics kits  from

Shack,  you can do this... I will guide you with TO and THRU.  There

is a difference:

   A ----*---- B         A ----- R1 ----- B

         |

         R1

   "A TO R1 TO B"          "A THRU R1 TO B"

  Parallel Circuit          Series Circuit

These are the abbreviations for the components:

RED, GRN, YEL, BLK  =  Phone line red and green respectively

Dx(Anode/Cathode)   =  The Diodes Where x={1,2}

Qx(Emitter/Base/Collector)  =  Transistors   x={1,2}

C1(+/-)  =  Electrolytic Capacitor  (observe polarity!)

C2       =  Disc Capacitor

R1  =  1k Resistor

Rx  =  100k Resistor  x={2,3}

Ya  dig it, mon? If this is too complex for you, try and view the

schematic through Generic Software's CADD, or try to draw your

own out from the directions below. Sometimes it helps to do this

in visual terms!

Ok, let's go to it...

<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->

 1: GRN thru R3 to Q1(Emitter) to GND

 2: RED thru D1(Anaode) to Q1(Base)

 3: Q1(Collector) to B

 4: +V thru R1 to B

 5: +V to M to D to H to Q2(Collector)

 6: H thru R2 to G to F thru C1(+) to GND

 7: E thru C2 to A to GND

 8: C thru D2(Anode) to Q2(Base) to L

 9: Q2(Emitter) thru COIL to GND

10: RED to I

11: J thru X1 to T

12: GRN to R

13: BLK thru X1 to Q

14: YEL to O

<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->

There.  That wasn't too hard now, was it? Now let's test it. A  word

to the wise: Do not substitute batteries or other power supplies  in

place  of the telephone line. If you do, then you risk  blowing  the

transformer and the optoisolator.

                     -=> Testing The Puppy <=-

Now that you have it built, double check and make sure everything is

OK  before you apply power to it. If everything you have  is  right,

there  might be some wierd, uncaught error in the file, or you  have

bad parts. Contact us or try again.

A voltmeter and a logic probe can come in handy here...

Connect  the battery, but not the phone line yet. Your relay  should

not  throw. If it does, check the 555 and the transistor  triggering

it.

If that's ok, short out the emitter and collector on Q1 momentarily.

The relay should throw for about two or three seconds then shut off.

If not, check that trigger circuit again.

Now plug in RED and GRN. If your relay trips, you might have the RED

and GRN reversed, or Q1 is not wired properly.

If  you're ok, call it on your other line. It should ring  once  and

then  pick up. If it's busy, perhaps D1 is not right. If it  doesn't

answer the phone, check Q1 to make sure all contacts are right.

Ok,  FINAL TEST! Connect YEL and BLK and call the line that RED  and

GRN are on. It should pick up and you should hear a steady dial tone

and  be  able  to dial DTMF on it, etc etc etc.  There  are  several

problems  that could arise here. 1) No dial tone means  it's  either

not  hooked up right, or the transformer is bad. 2) If you only  get

it  for about three seconds before it hangs up on you, you  are  not

getting   complete  isolation  from  the  other  line.   Check   the

transformer. 3) If the dial tone you hear is "bobbled" then you have

a major voltage spillover, isolate the second line from the rest  of

the circuit.

If everything checks out, you have just built a DARK BOX!! Now let's

have fun with it...

                -=> Applications And Operations <=-

You  already  have  the basic unit constructed. This is  sort  of  a

Pseudo-Extender or Pseudo-Diverter. Place it on any two phone  lines

(other  than your own) and be sure you know the number for the  RED-

GRN  pair.  Now when you call the line that's hooked up to  RED  and

GRN, you get the dial tone from the YEL/BLK pair, and it's just like

you  were at that person's house using THEIR phone! But you're  not,

you  could  be in Tahiti if you want! This is,  basically,  how  you

avoid billing of calls.

If you want to use this box from long distance without having to pay

for  it  yourself,  you could wire a black  box  resistor  onto  the

RED/GRN pair. It's not your phone line, what do you care?

For loop lines and cheese boxes, wire two Dark Boxes back to back on

any two phone lines.

For a multiple line bridge, you need as many boxes as you want dial-

ins. Loop all the YEL's and BLK's together respectively and plug the

RED/GRN's  into  a hunt group (You know, call 555-0000  and  if

it's  busy, you'll be transferred to 555-0001, etc etc),  this  way,

hackers  can  drop  in  and out at  will.  Didn't  Cap'n  Crunch  do

something like this?

If you want to make credit card calls instead of dialing direct,

attach the box to two payphones that are next to each other.

That way, you don't have to freeze your ass off to avoid having

your phone number put on the guy's card bill. Make sure the

payphones will accept incoming calls!

Patch YEL/BLK into an audio amplifier and into the paging system

at someplace like K-Mart. Imagine the riot you can start by

paging "INS! Stay where you are!" The xfrmer should push out

a line level audio, so interfacing to most sound applications

should be a snap.

A word about Caller ID. CI has been introduced scince the invention

of the box. The box can bypass CI to an extent, being that if the box

calls someone who caller ID's you, they'll get the second phone line

of the box, and not you. However, if the indialing line for the box

has CI and you call directly into it and someone happens to be there

to get it, you could be in serious trouble. A soloution to this would

be to use the box on a payphone that will accept incoming calls.

Scince noone gives a fuck who calls a pay phone, chances are it won't

CI'd. You could also place the box in an area that doesn't have CI,

whereas in order for CI to work, both the caller and the callee must

be in service areas.

Don't  be limited by only these suggestions! Be creative and let  us

know how you use it! Make a DID for your school's PABX, or get  your

VICModem   to   autoanswer!  There  HUNDREDS  of   uses   for   this

revoloutionary device waiting to be discovered!

                       -=> One Final Word <=-

The  staff  of Dark Side Research would like to  thank  our  friend,

Rebecca, who has encouraged us to press on in the Box's  development

even during times when it seemed hopeless.

Enjoy you new toy....

                                             Cablecast 0perator


dayglo
/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

  /                               How to build                              /

  /                           -%> Day-Glo Box <%-                           /

  /                   Written, typed, and conceptualized by                 /

  /                            John F. Kennedy                              /

  /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/

  -> Author's note:

     Yes, yes, I know that this box is similar to several other boxes,

  including the so-called "Bud box," and the "beige box." Well, my reason for

  writing this version is because of the fact that once finished constructing

  the box, the file does not contain very much information on usage. It is

  beacuse of that reason that this file was written. By the way, call

  Ground 0 at 988-4426. Thank you.

  -> What is the function of a Day-Glo box?

     Well, a Day-glo box will let you place calls for free with no time limit,

  no possibility of a wiretap, and the calls can be placed from anywhere in the

  world. Too good to be true, you say? Well, read on.

  -> How does a Day-glo box work?

     A day-glo box is very easy to make, and very inexpensive to build. It

  works like this: On the outside of every home that has a phone, there is

  something called "the outside connection box," which is where the house is

  connected to Ma Bell's network. This ingenious device connects to a) your

  phone, b) the victim's outside box. You should be starting to get the idea.

  -> How do I construct a day-glo box?

     Materials necessary: 1. Radio Shack modular conversion jack

                          2. A small experimenter's box (optional)

                          3. 1 foot of red wire. (better to overkill)

                          4. 1 foot of green wire. (same as above)

                          5. 2 medium alligator clips

     Well, in order to construct this box, you will need all of the above

  materials. Note that your wire does not necessarily have to be red or green,

  but it is necessary that you be able to tell them apart. Also, you might want

  to use thick, easily bent wire (audio hookup wire works best) instead of bell

  wire. Now, on to the construction.

     1. Remove the actual modular jack from the conversion box. This can be

        done by pushing inward and then up, or you can just cut the plastic.

     2. Remove the black and yellow wires from the jack. You can either clip

        these or rip them out.

     3. To your newly isolated jack, add the 1 foot wire extensions to the

        respective wires. Soldering and then wrapping the connections with

        electrical tape works best.

     4. Next, solder the alligator clips to the extended wires. If you do not

        wish to solder them, then just wrap the clips with the wire.

     5. Now, place this newly made contraption into a box (optional). You may

        need to drill a few holes, and possibly remove the alligator clips,

        but you should have read this file first, anyway.

  -> Wiring Diagram

    Modular--------------Red-----+----Extension wire---------< Alligator

     Jack  --------------Green---+----Extension wire---------< Clips

     Pretty easy, eh?

  -> Usage of the day-glo box

     The day-glo box will work with any phone. First, you need to locate a

  house that has a phone. Next, (it's preferable to do this at night) go up

  to the and locate the outside connection box. Pop the cover off. Locate

  prong 3 and prong 4. You will attach the green wire clip to prong 3. The

  red wire clip will go to prong 4. Now, plug your phone (preferably a

  trimline or ranger) into your modular plug. You may now either listen in on

  the call (wire tap) OR you may call out to anywhere in the world. If you

  are really daring, you can bring your computer with you. Note: This box

  may also be used in conjunction with the lunch box in order to make a

  perfect phone bug.

  -> Other neat things you can do with your new box:

     1: Call 976 numbers. This should be done very frequently. Also, I find

        that after finding the victim's outside box, several calls to the

        gay hotlin will have interesting after-effects; namely, his parents

        wondering about him.

     2: Alliance teleconferencing can be accomplished quite easily. Try it!

        Call 0-700-456-1000. Or, tell the operator you'd like to initiate a

        conference.

     3: Of course, you should place several calls to other countries. This can

        be accomplished by looking in the front of your white pages for the

        various country and city codes. You should be able to follow the

        directions provided in there.

  -> Using your box at apartments/community connection boxes:

     Have you ever wondered what those 6ft tall cabinets with the bell logo on

  them were for? Well, if you've never seen them, here's a quick description:

  They are 6ft tall by 3ft wide, and painted the dull phone company green.

  They can be opened quite easily with a 7/16ths inch socket wrench. After

  turning the bold over the handle, turn the handle to the right and pull. It

  should open, displaying over 100 different lines. Occasionally, you can find

  tech. manuals and test kits inside. They are usually located near phone

  lines.

     Okay, now, once you have opened one of these calling cabinets, locate the

  line of your choice. You will have to take out both the orange and the white

  insulated screws. The purple and white wires should come off along with the

  screws. The lines go out to the house, and the screw posts are the actual

  line. Now, you should clip the alligators to the posts, with one part of

  the clip on the insulation, and one inside the screw hole to insure the

  best connection. Oh, if you want the home to remain connected, clip the

  wires inside the hole using the alligator clips. By the way, the red

  terminal on your box goes to the orange post, and the green one to the

  white post... if that doesn't work, reverse the connection. Now, to find

  out the number you have taken over, dial 380-55555555. Yes, that's eight

  fives. A computer voice should tell you what number you are on. heh.

     I hope you can take it from here. Oh, in apartments, you can find the

  calling cabinet in the basement... remember, this is not your line, so do

  anything you want. Call the President or something.

  Disclaimer: I, John F. Kennedy, can not be held responsible for your actions

              in any way. This file was written for informational purposes only,

              and should not be used to make free phone calls. In downloading

              or copying this file, you are agreeing to this disclaimer.

  Special thanks goes out to: The Longshot, for sending me an old Phucked Agent

                              04 phile.

   or

  Special thanks goes out to: The Longshot, for sending me an old

//I know, this file is incomplete. If anyone out there has the whole file, lemme know.


dloc
  ][][][][][][][][][][][][][][][][][][][

   ][//////////////////////////////////][

   ][///////////THE/DLOC/BOX///////////][

   ][//////////////////////////////////][

   ][//////////////-=BY=-//////////////][

   ][//////////////////////////////////][

   ][//////THE/DARK/LORDS/OF/CHAOS/////][

   ][//////////////////////////////////][

   ][////PROWLER///////////////////////][

   ][///////APPRENTICE/////////////////][

   ][//////////PRO/HACK////////////////][

   ][//////////////ZEUS////////////////][

   ][////////////////TARKMETH//////////][

   ][///////////////////BLACKSTOKE/////][

   ][//////////////////////////LAZER///][

   ][//////////////////////////////////][

   ][][][][][][][][][][][][][][][][][][][

  STUFF YOU'LL NEED:

  ------------------

  A SOLDERING IRON

  A SPOOL OF LOW RESISTANCE WIRE

  2 FEMALE FONE JACKS

  2 SPST TOGGLE SWITCHES

  4 GOLD PLATED ALLIGATOR CLIPS

  A BOX TO PUT IT ALL IN

  SOME SOLDER

  A BRAIN

  HERE'S A SIMPLE DIAGRAM OF HOW IT IS

  PUT TOGETHER:

                   @            @

  KEY:             G            R

                   G            R

  G= GREEN WIRE    G            R

  R= RED WIRE      G            R

  *= FEMAL JACK    G            R

  \= SPST SWITCH   G            R

  O= CONNECTION    O------*-----O

  @= GATOR CLIPS   !            !

  -= WIRE          !            !

  != WIRE          \            \

                   !            !

                   !            !

                   !            !

                   O------*-----O

                   G            R

                   G            R

                   G            R

                   G            R

                   G            R

                   G            R

                   @            @

  ASSEMBLE IT AS ABOVE, AND PUT IT IN THE BOX, WITH THE TOGGLE

  SWITCHES PARALLEL, AND THE FEMALE JACKS MOUNTED ON EITHER SIDE

  OF THE BOX. OR, IF YOU DON'T WANT TO GO TO THE TROUBLE OF MAKING

  IT BY YOURSELF, YOU CAN GET ONE FOR $7.50 FROM DLOC. OURS ARE

  ENCASED IN A STURDY PLASTIC BOX, WITH OUR LOGO STENCILED ON THE

  SIDE, AND ARE VERY WELL MADE. IF YOU WANT TO BUY ONE, CONTACT A

  DLOC MEMBER ON ONE OF THE BOARDS LISTED BELOW IN THIS FILE.

  DLOC BOX FUNCTIONS:

  -------------------

  HOOKUP: TO HOOK UP THE BOX, PLUG YOUR FONES INTO THE JACKS ON

  THE BOX. ON MINE, THE WIRES ARE LABELED EVERY FOOT SO THAT I

  KNOW WHICH TRUNK I'M ON. CLIP THE APPROPRIATE SET OF CLIPS ON

  THE TERMINALS YOU WISH TO INVADE, AND THEN LISTEN/DIAL THROUGH

  WHICHEVER PHONE IS CONNECTED. THIS BOX HAS TWO LINES GOING

  THROUGH IT, WITH AN OPTION TO CONFER- ENCE THE TWO. I ADDED THIS

  SO IF WHILE ON ALLIANCE TELECONFERENCING, YOU WANT TO DIAL AN

  800,900,700, OR 976 NUMBER, YOU CAN SIMPLY DIAL IT WITH THE

  OTHER TRUNK AND THEN CONFERENCE THE TWO.

  CONFERENCING THE TWO LINES: TO JOIN THE TWO LINES, TURN BOTH OF

  THE TOGGLE SWITCHES TO THE ON POSITION.

  NOTE: MAKE SURE THAT NO PHONE IS CONNECTED TO THE BOX WHEN YOU

  HOOK UP THE CLIPS, AND ALSO MAKE SURE THAT BOTH SWITCHES ARE

  TURNED OFF.

  ++FILE BY PROWLER ON 3/10/88++


dloc2
][][][][][][][][][][][][][][][][][][][[][][][] ][..................................][ ][...........THE/DLOC/BOX...........][ ][..................................][ ][..............-=BY=-..............][ ][..................................][ ][......THE/DARK/LORDS/OF/CHAOS.....][ ][..................................][ ][....PROWLER.......................][ ][.......APPRENTICE.................][ ][..........PRO.HACK................][ ][..............ZEUS................][ ][................TARKMETH..........][ ][...................BLACKSTOKE.....][ ][..........................LAZER...][ ][.................................Genocide][ ][][][][][][][][][][][][][][][][][][][[][][][]STUFF YOU'LL NEED:------------------A soldering ironA spool of low resistance wire2 female fone jacks2 SPST toggle switches4 gold plated alligator clipsA box to put it all inSome solderA brainHere's a simple diagram of how it's put together                 @            @KEY:             G            R                 G            RG= Green wire    G            RR= Red wire      G            R*= Female jack   G            R\= SPST switch   G            RO= Connection    O------*-----O@= Gator clips   !            !-= Wire          !            !!= Wire          \            \                 !            !                 !            !                 !            !                 O------*-----O                 G            R                 G            R                 G            R                 G            R                 G            R                 G            R                 @            @Assemble it as above, and put it in the box, with the toggle switches parallel,and the female jacks mounted on either side of the box.  Or, if you don't wantto go to the trouble of making it by yourself, you can get one for $7.50 fromDLOC.  Ours are encased in a sturdy plastic box, with our logo stenciled on theside, and are very well made.  If you want to buy one, contact a DLOC member onone of the boards listed below in this file.DLOC BOX FUNCTIONS:-------------------Hookup: To hook up the box, plug your fones into the jacks on the box.  On_______ mine, the wires are labeled every foot so that I know which trunk I'm        on.  Clip the appropriate set of clips on the terminals you wish toinvade, and then listen/dial through whichever phone is connected.  This boxhas two lines going through it, with an option to conference the two.  I addedthis so if while on Alliance Tele-conferencing, you want to dial an 800,900,700, or 976 number, you can simply dial it with the other trunk and thenconference the two.Conferencing the two lines: To join the two lines, turn both of the toggle___________________________ switches to the on position.Note: Make sure that no phone is connected to the box when you hook up the_____ clips, and also make sure that both switches are turned off.


famous
     BOXES - GENERAL INFORMATION

   THE FOLLOWING "GOLDEN OLDIE (1980) IS FROM THE LEGENDARY "8BBS" OF BERNARD

KLATT IN SANTA CLARA, CA.  THIS IS THE FIRST PHREAK BBS THAT I EVER HEARD OF IT

WAS A PDP-8 THAT COULD SUPPORT TWO USERS.  IT "DISAPPEARED" AFTER AN OMNI

MAGAZINE ARTICLE WAS PUBLISHED ABOUT PHREAKING WAS PUBLISHED

   RESURRECTED BY BILL DOGER (PLEASE DOWNLOAD AND SAVE FOR POSTERITY)

   SUBJECT:  BASIC BOXES, PART I

   THIS IS SOME REASONABLE BASIC STUFF, SO EXPERIENCED HACKERS MAY WISH TO SKIP

THESE MESSAGES.

   WHAT I WILL PROVIDE HERE IS A SUMMARY OF THE THREE MOST IMPORTANT BOXES, SOME

OF THE WAYS THE TELCOES TRY TO CATCH BOXERS, AND SOME SUGGESTIONS ON AVOIDING

BEING CAUGHT.

   THE MOST FAMOUS BOX, THE BLUE BOX, IS ESSENTIALLY LIKE A PORTABLE TOUCH-TONE

PAD, EXCEPT THE TONES ARE NOT TOUCH-TONE (DTMF) -- THEY ARE THE TRUNK SIGNALLING

FREQUENCIES (MF).  THESE FREQUENCIES WERE GIVEN BY SUSAN IN A MESSAGE A FEW

BACK.  A GOOD BOX ALSO CONTAINS THE SUPERVISION CONTROL FREQUENCY, 2600HZ (SF).

   HACKERS USE THE BOX BY GAINING ACCESS TO A DDD (OR OTHER) NETWORK SENDER

(IT'S LIKE A DIAL TONE), USUALLY BY MAKING AN 800 OR 555 CALL.  A MUCH BETTER

ACCESS IS IF THERE ARE LOCAL TANDEMS IN YOUR AREA USED FOR NON-ACCOUNTED CALLS

BUT ALLOWING NON-LOCAL OUTGOING CALLS.

   HACKERS USE BLUE BOXES BECAUSE IT ALLOWS THE INTRODUCTION OF NETWORK DIAL

CODES OTHER THAN AREA-CODE AND NUMBER AND OPENED AN INCREDIBLY COMPLEX MAZE TO

BE EXPLORED AND TOYED WITH.  OTHER PEOPLE USED BLUE BOXES TO COMPLETE CALLS

WITHOUT PAYING.  THIS MADE AT&T INTENT ON STOPPING THE ACCESS; TO THEM THE

HACKERS TYING UP TANDEMS FROM KALAMAZOO TO MOSCOW WERE A NUISANCE, AND THE

OTHERS WERE THIEVES.

   ONE OF THE MOST SUCCESSFUL MEANS OF CATCHING BLUE BOXERS WAS AND IS THE

FEATURE IN THE ACCOUNTING PROGRAM WHICH CALLS ATTENTION TO ANY NUMBER WHICH

SHOWS A LARGE NUMBER OF 800 OR 555 CALLS.  (WE KNOW OF TELECOMMUNICATIONS

MANAGERS WHO HAVE BEEN CALLED BY AT&T TO FIND OUT WHY SO AND SO - AN EMPLOYEE -

MAKES SO MANY CALLS TO THE COMPANY 800 NUMBER.) OTHER MEANS INCLUDE ANALYZING

TRUNK TROUBLE REPORTS (IF YOUR BOX DOESN'T TREAT THE TRUNK THE SAME WAY AT&TS

EQUIPMENT DOES, IT CAN IN SOME CASES GENERATE TROUBLE REPORTS).

   ONCE THE SUSPICION IS THERE, YOUR LOCAL TELCO PUTS A "PEN RECORDER" ON YOUR

LINE, AND EVERYTHING YOU DIAL - ROTARY, TOUCH-TONE, OR MF GETS RECORDED ON PAPER

- THIS PAPER WILL BE USED AS EVIDENCE AGAINST YOU.

   EVENTUALLY THE U.S.  GOVERNMENT PROSECUTES YOU FOR "INTERSTATE FRAUD BY WIRE"

-- AN EXTREMELY BROAD LAW.  MORE ABOUT THAT LAW IN FUTURE STUFF.

   IN ORDER TO ELIMINATE BLUE BOXING, WHICH RELIES ON THE USE OF THE MF SIGNALS

ON THE SAME CIRCUIT THAT YOU TALK ON, MA BELL IS CONVERTING TO A NEW SYSTEM -

COMMON CHANNEL INTEROFFICE SIGNALLING (CCIS).  THERE ARE MANY BENEFITS OF CCIS

OTHER THAN ELIMINATING BLUE BOXING, BUT IT WILL EVENTUALLY ELIMINATE BLUE BOXING

BECAUSE IT SENDS THE NETWORK SIGNALLING INFORMATION ON DATA LINKS BETWEEN SIGNAL

TRANSFER POINTS (STPS) ASSOCIATED WITH VARIOUS SWITCHING MACHINES.

   IT WILL TAKE MANY YEARS FOR CCIS TO BE UNIVERSALLY USED, BUT IT IS GOING IN

FAST.  AS LONG AS THERE IS ONE NON-CCIS LINK IN THE NETWORK, THE HACKERS WILL

FIND IT AND PLY THEIR HOBBY.

   TO AVOID GETTING CAUGHT:  DON'T USE YOUR BOX FROM THE SAME PLACE REPEATEDLY.

DON'T COMPLETE CALLS TO FRIENDS AND SIT AND GAB -- IF NO "SIGNS AND SIGNALS" ARE

TRANSMITTED (YOU DON'T PASS INFORMATION -- YOU DON'T COMMUNICATE) YOU HAVE NOT

COMMITTED FRAUD BY WIRE.  YOU MAY GET CHARGED WITH POSSESSION, IF THE STATE LAWS

WHERE YOU ARE CAUGHT MAKE BOXES ILLEGAL (HMMM.  LIKE GUN CONTROL -- MAYBE YOU

HAVE THE BOX IN CASE OF AN EMERGENCY WHEN THE NETWORK ISN'T WORKING RIGHT -- TO

SAVE YOUR LIFE -- BUT IT CAN BE USED TO COMMIT A CRIME.  ENOUGHT OF THAT

NONSENSE).

   THE SECOND FAMOUS BOX IS THE BLACK BOX.  WITH THE BLACK BOX, YOU RECEIVE

CALLS WITHOUT THE CALLER BEING CHARGED.  THIS IS USELESS FOR HACKERS -- ONLY THE

FREEPHONE PEOPLE ARE INTERESTED.  AN EARLIER MESSAGE TALK ABOUT THE WIRES THAT

GO TO THE INTERRUPTER SWITCH IN YOUR ROTARY DIAL.  THIS IS THE BASIC INGREDIENT

IN THE BLACK BOX.  THE ONLY ADDITIONAL EQUIPMENT NEEDED IS A BATTERY TO POWER

YOUR CARBON MIKE.  USING THE BLACK BOX, THE CALLEE GOES OFF-HOOK VERY BRIEFLY,

ENOUGH TO STOP THE RINGING (SOME BLACK BOXERS HAVE BEEN KNOW TO TALK BETWEEN THE

RINGS) BUT NOT ENOUGH TO SEND ANYTHING BACK DOWN THE TRUNK TO THE CALLER SAYING

THAT THE PHONE HAD BEEN ANSWERED AND HUNG UP.  THIS WORKS IN STEP-BY-STEP (SXS)

OFFICES, NO 1 AND 5 CROSSBAR, AND SOME NON-BELL OFFICES.  BELL'S ESS OFFICES ARE

TOO CLEVER FOR THIS TRICK - YOUR PHONE ISN'T CONNECTED TO THE INCOMING TRUNK

UNLESS YOU ARE OFF-HOOK.

   MA BELL CATCHES BLACK BOXERS BY EXAMINING TRUNK RECORDS.  WHY WAS THE TRUNK

IN USE FOR SO LONG, BUT NOT OFF HOOK?  IN NO 5 XBAR OFFICES THERE WILL ALSO BE

FUNNY ACCOUNT ENTRIES -- ORIGINATE FOLLOWED BY DISCONNECT -- A LONG TIME LATER

-- WITH NO ANSWER IN BETWEEN.  ESS OFFICES CAN GENERATE THIS DATA WHEN AUDITS

ARE DONE (A RANDOM OCCURANCE).

   THE BEST WAY TO AVOID BEING CAUGHT IS TO STAY AWAY FROM THIS ONE.  AT LEAST

KEEP YOUR CALLS SHORT -- THE LENGTH OF 15-20 RINGS OR SO.

   THE FINAL FAMOUS BOX IS THE RED BOX.  THIS IS THE ELECTRONIC EQUIVALENT OF

THE CHIME PEOPLE USED TO TAKE TO A PAY PHONE SO THAT THE OPERATOR THINKS MONEY

IS BEING DEPOSITED.  THE GONGS WERE EASY TO RECORD OR OBTAIN AND OPERATORS COULD

BE EASILY FOOLED.  THE NEWER PHONES WITH THE BEEPS MADE IT NECESSARY TO COME UP

WITH SOMETHING MORE PRECISE.

   PEOPLE GET CAUGHT WHEN AN OPERATOR GETS SUSPICIOUS AND CALLS SECURITY, OR

WHEN THE ACCOUNTING INFO FOR THE PHONE SAYS THERE ISN'T ENOUGH MONEY IN THE COIN

BOX.  BELL SECURITY THEN STAKES OUT THE PAY PHONE -- AND ZAP.  NEVER USE THE

SAME PAY PHONE TWICE.  (END OF BASICS.  MORE SOMEDAY)


gold
 GOLD BOX PLANS: COURTESY OF SIR WILLIAM

  HOW TO BUILD IT

  _______________

       YOU WILL NEED THE FOLLOWING:

  TWO 10K OHM AND THREE 1.4K OHM RESISTOR ES, TWO 2N3904 TRANSISTORS, TWO

  PHOTOCE LLS, TWO RED LED'S (THE MORE LIGHT PROD UCED THE BETTER), A BOX

  THAT WILL NOT L ET LIGHT IN, AND RED AND GREEN WIRE.

   LIGHT FROM THE #1 LED MUST SHING DIREC TLY ON THE PHOTOCELL #1. THE GOLD

  BOX I MAID NEEDED THE TOP OF THE LED'S TO TOU CH THE PHOTOCELL FOR IT TO

  WORK.  THE SAME APPLIES TO THE #2 PHOTOCELL AND LED 1

      :-PHOTOCELL--:

      :            :

      :            :BASE

      :    1     TTTTT

      :  +LED-   TRANSISTOR

      :          TTTTT

      :           : :

      :  -I(--    : :COLLECTOR

  RED1--<     >:--: :-------:-----GREEN2

         -I(-- :            ----------:

               :                      :

          2    :-/+/+/-/+/+/-/+/+/-/+/+/

         LED     10K    10K   1.4K 1.4K

                   RESISTORES

              2

         -PHOTOCELL-----------------

         :                         :

         :BASE                     :

       TTTTT                       :

       TRANSISTOR                  :

       TTTTT                       :

        : :EMITTER                 :

  GREEN1- --------------------------RED2

       :   :

       /+/+/

        1.4K

  THE 1.4K RESISTOR IS VERIABLE AND IF TH E SECCOND PART OF THE GOLD BOX IS

  SKIPPE D IT WILL STILL WORK BUT WHEN SOMEONE P ICKS THE PHONE UP THEY WILL

  HEAR A FAIN T DIAL TONE IN THE BACKGROUND AND MIGHT REPORT IT TO THE

  GESTOPO ER...(AT&T).  1.4K WILL GIVE YOU GOOD RECEPTION WITH LITTLE RISK

  OF A GESTOPO AGENT AT YOUR DOOR.

     NOW THAT YOU HAVE BUILT IT TAKE TWO GREEN WIRES OF THE SAME LENTH STRIP

  THE ENDS, TWIST TWO ENDS TOGETHER AND CONN ECT THEM TO GREEN1 AND PLACE A

  PEICE OF TAPE ON IT WITH LINE #1 WRITING ON IT.  CONTINUE THE PROCESS WITH

  RED1 ONLY US E RED WIRE. REPEAT WITH RED2 AND GREEN2 BUT CHANGE TO LINE

  #2.

  HOW TO INSTALL

  ______________

     YOU WILL NEED TO FIND TWO PHONE LINES THAT ARE CLOSE TOGETHER. LABEL

  ONE OF THE PHONES LINES LINE #1.CUT THE PHONE LINES AND TAKE THE OUTER

  COUTING OFF I T. THERE SHOULD BE 4 WIRES CUT THE YELL OW AND BLACK WIRES

  OFF AND STRIP THE RE D AND GREEN WIRES FOR BOTH LINES.

     LINE #1 SHOULD BE IN TWO PEICES TAKE THE GREEN WIRE OF ONE END AND

  CONNECT IT TO THE ONE OF THE GREEN WIRES ON THE GOLD BOX. TAKE THE OTHER

  HALF OF LINE # 1 AND HOOK THE FREE GREEN WIRE TO THE G REEN WIRE ON THE

  PHONE LINE. REPEAT THE PROCESS WITH RED1 AND THE OTHER LINE.

     ALL YOU NEED TO DO NOW IS TO RIGHT D OWN THE PHONE NUMBERS OF THE PLACE

  YOU HOOKED IT UP AT AND GO HOME AND CALL IT. YOU SHOULD GET A DIAL TONE!!!

  IF NOT LEAVE ME A MESSAGE ON THE MODEM MADNESS BBS xxx-xxx-xxxx OR TRY

  CHANGING THE EMITTER WITH COLLECTOR.  OH AND HOOKING IT UP TO A PAYPHONE

  IS A FEDERAL OFFENCE AND IS ILLEAGAL TO PUT ON ANY PHONE.  I RECOMMEND YOU

  SEE YOU R LOCAL POLICE DEPARTMENT BEFORE DOING ANYTHING SAID IN THIS

  ARTICLE. (HAHAHAHA!!!!!!)


green
 :%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%:

  :%                                                                          %:

  :%                              THE GREEN BOX                               %:

  :%                                                                          %:

  :%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%:

     The Green Box generates useful tonessuch as COIN COLLECT, COIN RETURN, and

  RINGBACK.  These are the tones that ACTS or the TSPS operator would send to

  the CO when appropriate.  Unfortunately, the green box cannot be used at a

  fortress station, but must be used by the CALLED party.  The tones (hz) are:

     COIN COLLECT      700  +  1100

     COIN RETURN      1100  +  1700

     RINGBACK          700  +  1700

     Before the called party sends any of these tones, an operator released

  signal should be sent to alert the MF detectors at the CO.  This can be done

  by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a 60 ms

  gap and then the appropriate signal for at least 900 ms.  Also, do not forget

  that the initial rate is collected shortly before the 3 minute period is up.

  :-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-::-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:


infinity
(%>+<------------------------------------------------------------------->+<%)

 )+)  The Crack Shop !  presents - Infiity Boxes - Uploaded by Iron Man  (+(

(%>+<------------------------------------------------------------------->+<%)

        This stuff from IRON MAN -- foratted 80 columns

  In answer to all those who don't knowwhat an infinity transmitter is, here

is A little history:

   A guy by the name Manny Mittleman ra a company called the wireless guitar

company located on Liberty St. In NY. Aide from wireless guitars, Manny also

built all sorts of electronic wireless bugs".  One item, The infinity

transmitter was a device that was place inside an unsuspecting persons

telephone.

  When the phone number of that telephoe was dialed and a certain note was

blown into the phone from a hohner, keyof-c, harmonica, the bugged phone did

not ring, and what's more, enabled the aller to then hear everything said in

he room that the phone was located in. As long as the caller wanted to stay

on the phone, all was open to him or he.  If the phone was lifted off the

hook, the transmitter was disconected ad the "bugged" party received a dial

tone as if nothing was wrong with the lne.

  Remember, all this was constructed inthe 1960x's when ic's were not as

commonplace as they are today.  Also ber in mind that during that period in

time, even the telephone company was no quite sure on how well or how

portable tone decoding was.

Ps.  Many government agency's were someof manny's best customers.


jack
                                 JACKBOX

  MA BELL IS NOT THE ONLY ONE WITH STANDARDS! JUST ABOUT EVERY MANUFACTURER OF

  IC'S THAT GENERATE TOUCH TONES HAS ALSO GONE BY THE 16 KEY (8 TONE) STANDARD

  FOR TOUCH TONE PADS. AND IT IS EVEN EASIER TO CONVERT A TONE PAD THAT USES AN

  INTEGRATED CIRCUIT TO GENERATE THE TONES THAN CONVERTING A MA BELL PAD!

  IT WILL HELP IMMENSELY IF YOU HAVE THE SCHEMATIC FOR THE PAD IN QUESTION, OR

  AT LEAST THE PIN-OUT DIAGRAM OF THE CHIP BEING USED. PIN-OUTS CAN USUALLY BE

  OBTAINED FROM THE MANUFACTURER OR FROM AN ECG, SK, GE OR SIMILIAR

  SEMICONDUCTER HANDBOOK (PROVIDED THAT MANUFACTURER MAKES AN EQUIVALENT FOR

  THE CHIP IN YOUR PAD). I'LL USE THE RADIO SHACK CEX-4000 TONE PAD MODULE FOR

  AN EXAMPLE, EVEN THOUGH IT IS PROBABLY ALMOST THE LOUSIEST ONE YOU CAN BUY,

  IT IS FAIRLY TYPICAL ASILY AVAILABLE.

  TAKE A LOOK AT THE DIAGRAM OR THE PIN-OUT OF THE CHIP. YOU SHOULD SEE TWO

  GROUPS OF PINS, THE ROWS TONE PINS AND THE COLUMN TONE PINS. THESE WILL BE

  MARKED AS R1,R2,R3,R4 AND C1,C2,C3 (RADIO SHACK) OR OR X1,X2,X3 AND Y1,Y2,Y3

  ETC. ON OTHERS. AT ANY RATEU SHOULD BE ABLE TO DISTINGUISH WHICH THREE

  PINS CONTROL THE COLUMNS AND WHICH FOUR CONTROL THE ROWS. IF YOU'RE LUCKY,

  EACH GROUP OF ROWS AND COLUMNS WILL BE CONTIGUOUS. NOW LOOK AT THE COLUMN

  PINS, AND YOU'LL PROBABLY SEE AN EMPTY PIN RIGHT NEXT TO THEM. THIS IS THE

  COLUMN PIN FTHE 1633 HZ TONES. THESE CHIPS USUALLY ACHIEVE THEIR SWITCHING BY

  CONNECTING A ROW PIN WITH A COLUMN PIN (THAT WAY TQAN USE A0VERY SIMPLE

  KEYBOARD PAD, UNLIKE MA BELL'S COMPLICATED ONE). SO ALL YOU HAVE TO DO IS TAKE

  A SPDT SWITCH AND A FEW PIECES OF WIRE, CUT THE TRACE GOING TO THE COLUMN 3

  PIN OF THE CHIP, ATTACH A WIRE FROM THE CHIP SIDEOF THAT CUT TO ONE END OF THE

  SPDT SWITCH, A WIRE FROM THE OTHER SIDE OF THE CUT TO THE CENTER OF THE SPDT

  SWITCH, AND FINALLY, FROM THE REMAINING CONTACT ON THE SPDT SWITCH, HOOK A

  WIRE TO THE PREVIOUSLY IDENTIFIED PIN C4 (COLUMN 4). NOW YOU HAVE A "BANK

  SWITCHING ARRANGEMENT EXACTLY LIKE THE ONE DESCRIBED IN THE PREVIOUS BULLETIN

  FOR MODIFYING A MA BELL PAD.

  IF YOU CAN'T GET THE SCHEMATICS OR THE PIN OUTS FOR YOUR CHIP, DON'T DESPAIR.

  THERE IS STILL HOPE FOR YOU! YOU JUST HAVE TO TRACK THE CONNECTIONS GOING FROM

  THE PAD'S KEYS TO THE CHIP. CHANCES ARE YOU'LL FIND THAT EACH ROW HAS A COMMON

  TRACE, AND SO DOES EACH COLUMN (FOR THOSE NON-TECHNICAL FOLKS, A TRACE IS A

  CONNECTION ETCHED OUT ON A CIRCUIT BOARD). JUST FOLLOW THESE TO THE CHIP, AND

  MAKE YOUR OWN SCHEMATIC UP. NOW TAKE A LOOK FOR THAT EXTRA PIN--THERE SHOULD

  BE ONE FLOATING AROUND RIGHT NEXT TO THE COLUMN PINS. IT WILL BE NOT BE HOOKED

  UP TO ANYTHING ELSE, THAT IS, "HANGING FREE". DRILL A HOLE IN THE SIDE OF

  TONEPAD'S CASE, AND MOUNT YOUR SWITCH. RADIO SHACK SELLS A NICE MICROMINIATURE

  SWITCH THAT WORKS EXCELLENTLY! (ALMOST THE ONLY GOOD THING I CAN SAY ABOUT

  RADIO SHACK IN THIS ARTICLE)

                HAPPY PHREAKING.....


light
                          How To Make An In-Use Light

                              From The Night Owl AE

    This file describes the operation and construction of a device that will

  signal whether or not an extension of a particular phone line is off-hook.  It

  does NOT indicate whether or not a phone is being tapped, and will light

  whenever any extension is picked up.

    The principle under which this device operates is that there is a voltage

  across the red and green wires of the phone line (the other wires are rarely

  used) that drops significantly when an extension is lifted.  Though this

  voltage can be used to power a light on its own, the light would have to be of

  a very low power consumption in order not to keep the phone off-hook, and it

  would only light when the phone is on-hook.

    A simple way to get around the above problem is to use a low current relay.

  Radio Shack sells some nice 12VDC SPDT relays that work well for this purpose.

  Don't buy the red relays or the subminis; though you want a low current

  coil, you also want the contacts to be able to handle a decent current.

  DPDT (double pole, double throw) will also work, you just won't use the

  other contacts.

    For a 12 volt coil, the voltage will have to be dropped so that the relay

  will function properly.  The proper resistance is around 10K ohms, but it is

  best to use a 5K ohm fixed resistor and a 10K ohm variable (standard values,

  any combination that can cover the 10K range will work fine).  Adjust it to

  approximately 10K, or halfway for the combination above.  Connect the

  resistors in series with the coil, and we'll adjust it later.

    Due to the nature of this device (or rather, its simplicity) it will

  operate without having to be plugged into a phone, or vice versa.  In other

  words, you can plug it directly into a jack anywhere, and it'll work.

  You'll want to get a modular plug that terminates in spade lugs for this

  purpose.  Connect the green wire to one side of the coil, and the red to the

  resistors (so that it's all in series).  If you don't have an extra phone

  jack, then you will want to a) buy a Y connector so that two phones can be

  plugged into the same jack, or b) get another phone jack and install it in

  the same box with the in-use light, so that you can plug a phone into it.

  Just connect the spade lugs to their respective colors.

    For the light itself, you can use almost anything.  Even a tiny light bulb

  and a battery will work fine, but after about 5 hours of phone use, you'll

  have to replace the battery.  The best thing to use is a neon bulb powered

  by the 110V power available most places.  Buy ones with dropping resistors,

  or use a 220K resistor for dropping.  You should also get a panel lamp

  assembly to keep it steady and make it look pretty.  Since the current is

  relatively low, you can use almost any power cord, or sacrifice an old

  extension cord.  Connect it in series with the NC (normally closed) contacts

  of the relay (in series with the dropping resistor, of course).

    Your circuits should now look like this:

                        /

   --------RED----!---- 5k --- 10k -------O     O-------------------!-----110V

                      /          |     |

                            coil    NC /

                           |     |

   -------GREEN---!-----------------------O     O-- bulb --- 220k --!-----110V

    Make sure that the phone circuit (left) and the lamp circuit (right) are

  totally 100% separate, and in no danger of touching.  Use wire nuts for all

  connections in 110V that are not to a terminal post, and tape them.  For all

  wires that are exposed, use electrical tape or shrink-wrap tubing to insulate

  them.  Glue the relay to the box or mount it on a stable PC board.

    If all looks well, hook it up.  It should work immediately, but there are

  three things that can go wrong:

  1) The relay keeps the phone off the hook. To remedy this, lower the

     resistance until it doesn't.  If you can't lower the resistance enough,

     then you are using a resistor with a high current coil and you'll have to

     get one with a

     lower rating.

  2) The relay won't close.  The solution for this is the same as number 1.

  3) The relay stays closed.  Raise the resistance with the phone on hook until

     the light goes off.

    When all is working, the lamp should be on when one or more extensions are

  off-hook, and will be off when all extensions are on-hook.  It will blink when

  the phone rings.

                  This is a parts list:

        1 box.  Make it a nice one, preferably one with feet.

        1 phone cord with a modular plug at one end and spade lugs at the other.

        1 phone jack or Y adapter (optional).

        1 power cord or old extension cord.

        1 low current coil relay, double throw.

        1 5K fixed resistor.

        1 10K variable resistor.

        1 neon bulb with dropping resistor.

        1 panel lamp assembly.  Some come with bulbs.

           That's it.  You may trade this file however you wish.


lunch
 <%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>

  <%>                                                                     <%>

  <%>                             Making the                              <%>

  <%>                                                                     <%>

  <%>                              Lunch Box                              <%>

  <%>                              ===== ===                              <%>

  <%>                                                                     <%>

  <%>              Written, Typed and Created by: Dr. D-Code              <%>

  <%>                                                                     <%>

  <%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>[%>

  Introduction

  ============

  The Lunch Box is a VERY simple transmitter which can be handy for all sorts of

  things. It is quite small and can easily be put in a number of places. I have

  successfully used it for tapping fones, getting inside info, blackmail and

  other such things. The possibilities are endless. I will also include the

  plans for an equally small receiver for your newly made toy. Use it for just

  about anything. You can also make the transmitter and receiver together in

  one box and use it as a walkie talkie.

  Materials you will need

  =======================

  (1) 9 volt battery with battery clip

  (1) 25-mfd, 15 volt electrolytic capacitor

  (2) .0047 mfd capacitors

  (1) .022 mfd capacitor

  (1) 51 pf capacitor

  (1) 365 pf variable capacitor

  (1) Transistor antenna coil

  (1) 2N366 transistor

  (1) 2N464 transistor

  (1) 100k resistor

  (1) 5.6k resistor

  (1) 10k resistor

  (1) 2meg potentiometer with SPST switch

  Some good wire, solder, soldering iron, board to put it on, box (optional)

  Schematic for The Lunch Box

  ===========================

  This may get a tad confusing but just print it out and pay attention.

           [!]

            !

          51 pf

            !

         ---+----  ------------base   collector

        !        )(               2N366       +----+------/\/\/----GND

      365 pf     ()              emitter           !

        !        )(                 !              !

        +--------  ---+----         !              !

        !             !    !        !              !

       GND            /  .022mfd    !              !

                   10k\    !        !              !

                      /   GND       +------------------------emitter

                      !             !              !             2N464

                      /           .0047            !          base   collector

                2meg  \----+        !              !   +--------+       !

                      /    !       GND             !   !                !

                          GND                      !   !                !

          +-------------+.0047+--------------------+   !                !

                                                       !   +--25mfd-----+

              -----------------------------------------+   !            !

         microphone                                        +--/\/\/-----+

              ---------------------------------------------+   100k     !

                                                                        !

                    GND---->/<---------------------!+!+!+---------------+

                          switch                  Battery

                      from 2meg pot.

  Notes about the schematic

  =========================

  1.  GND means ground

  2.  The GND near the switch and the GND by the 2meg potentiometer should be

      connected.

  3.  Where you see:  )(

                      ()

                      )( it is the transistor antenna coil with 15 turns of

                         regular hook-up wire around it.

  4.  The middle of the loop on the left side (the left of "()") you should run

      a wire down to the "+" which has nothing attached to it. There is a .0047

      capacitor on the correct piece of wire.

  5.  For the microphone use a magnetic earphone (1k to 2k).

  6.  Where you see "[!]" is the antenna. Use about 8 feet of wire to broadcast

      approx 300ft. Part 15 of the FCC rules and regulation says you can't

      broadcast over 300 feet without a license. (Hahaha). Use more wire for an

      antenna for longer distances. (Attach it to the black wire on the fone

      line for about a 250 foot antenna!)

  Operation of the Lunch Box

  ==========================

  This transmitter will send the signals over the AM radio band. You use the

  variable capacitor to adjust what freq. you want to use. Find a good unused

  freq. down at the lower end of the scale and you're set. Use the 2 meg pot. to

  adjust gain. Just fuck with it until you get what sounds good. The switch on

  the 2meg is for turning the Lunch Box on and off. When everything is adjusted,

  turn on an AM radio adjust it to where you think the signal is. Have a friend

  say some shit thru the Box and tune in to it. That's all there is to it. The

  plans for a simple receiver are shown below:

  The Lunch Box receiver

  ======================

  (1) 9 volt battery with battery clip

  (1) 365 pf variable capacitor

  (1) 51 pf capacitor

  (1) 1N38B diode

  (1) Transistor antenna coil

  (1) 2N366 transistor

  (1) SPST toggle switch

  (1) 1k to 2k magnetic earphone

  Schematic for receiver

  ======================

           [!]

            !

          51 pf

            !

       +----+----+

       !         !

       )       365 pf

       (----+    !

       )    !    !

       +---------+---GND

            !

            +---*>!----base  collector-----

               diode      2N366           earphone

                          emitter    +-----

                            !        !

                           GND       !

                                     -

                                     +

                                     - battery

                                     +

             GND------>/<------------+

                    switch

  Closing statement

  =================

  This two devices can be built for under a total of $10.00. Not too bad. Using

  these devices in illegal ways is your option. If you get caught, I accept NO

  responsibility for your actions. This can be a lot of fun if used correctly.

  Hook it up to the red wire (I think) on the fone line and it will send the

  conversation over the air waves. If you have any problems or are confused,

  leave me mail on:Hi-Times=702/832/7469  Warez House=702/827/9273

  ______________________________________________________________________________

   Sysops of other systems may use the file as long as none of it is altered.

  ______________________________________________________________________________

   This has been a High Mountain Hackers Production- (c) 1985 by HMH Industries

  ______________________________________________________________________________


magenta
       HOW TO BUILD AND USE A MAGENTA BOX.

        Designed and Written by Street Fighter.

  First of all I named this the Magenta Box because all of the

  fags that made boxes, whose only purpose is adding a hold

  button to your phone, used all of the fucking colors.  I can

  afford a fucking piece of shit Radio Shack 2-line phone with

  hold.  A box's purpose is to mess with the Telco., not to add

  a fucking hold button to your phone.  Anyway I will get on with

  this.

  PARTS LIST:

               SPDT Miniature PC RELAY (about 9v, 500 ohm)

               DPDT Miniature PC RELAY (about 6v, 500 ohms, 12 mA)

               2000 or so uF electrolytic capacitor

               1 meg resistor

               .01 uF capacitor

               2    555 timer chip

               2 diodes (1N914)

               10 K resistor

               1 K resistor

               9 volt battery -w- clip

               Pc Board

               4 alligator clips

               some kind of a box (small)

               some 20 or 22 gauge wire to work with.

  If you don't know how to put together a project by looking at a

  schematic, then isn't the project to start with.  I would ask someone

  with some electronics knowledge to give you a helping hand.  This

  has to be put together on a pc-board.

  Enough talk, now the schematic:

                           +9v

                                                        |

            +---------------+----+----------------+

            |               |8   |4               |

            |            ------------             |

            /            |          |3            |                  |--|

            \            |          |-------------------->|---+------|\ |

      1 Meg /  R1        |          |             |           |     C| \|

     (1000K)\            |          |             |           -     O|\ |

            |            |   555    |             \           ?     I| \|

            |            |   chip   |        10 K /           |     L|\ |

            |           7|          |             \           +------| \|

            +------------|          |             /           |      |--|

            |           6|          |2            |           |

            +------------|          |-------------+-------+   |      NC

            |            ------------                     |   | +-o   o   o--<

            |             |1  |5          --------o NC    |   | |        TIP #2

            |             |   |           --___           |   | |    NC

          + |             |   |                ---o---+   |   | | o   o   o--<

           ---            |  ---.01 uF                |   |   | | |      RING #2

  2000 uF  -?-  C1        |  -?-          --------o-- | --+   | | |

  *see note |             |   |                       |       | | |

            |             |   |   +-------|--|C       |       | | |

            |             |   |   |       |\ |O   +---+       | | |

            |             |   |   |       | \|I   |           | | |

            |             |   |   |   +---|--|L   |           | | |

            +-------------+---+-------------------+-----------+ | |

                              |   |   |                         | |

                            ----- |   +-----------+-------------+ |

                             ---  |               |               |

                              -   +--/\/\/\----------+------------+

                           GROUND     4.7K        |  |

                             9V                   |  |

                                                  |  +------------< RING #1

                                                  |

                                                  |

                                                  +---------------< TIP #1

          K E Y

          ~~~~~

  NC - Normally Closed

  --< - Alligator Clip

  ---

  -?-   Capacitor

  ->|-  Diode

   |

   -

   ?    Diode

   |

  o   o   o

              Contacts on relay.  DPDT

  o   o   o

  --------o

    ___---o  Contacts on relay.  SPDT

  --

  --------o

  -/\/\/\-  Resistor

      |

      /

      \     Resistor

      /

      |

  Whew!  Well, the schematic explains almost everything.  It would be

  helpful to you if you used one color for the line #1 clips and another

  for the line #2 clips.  It will work even if you get the ring and tip

  mixed up, but you must get all of the clips on the right line.  But,

  to be safe, you could put tags on each clip labeling it RING #1, TIP #2,

  ect.

  Installation.  Find one of those green posts that are about 3 feet high.

  They are everywhere.  Get a socket wrench to open it up.  There will

  be (a) row(s) of paired up posts.  Each pair of posts represents a line.

  YOU *MUST* KNOW THE NUMBER OF LINE #1.  Sometimes the number is tagged

  on to the pair of wires leading up to the posts, if so pick these posts

  as your line #1.  Then you can pick any other set of posts for line #2.

  Now to the good part.  Use of the the final product.  When you call up

  line one from your house you will get a dial tone almost immediately.

  Using DTMF you can dial anywhere that the person who owns line 2 has

  service to.  Which means you can direct dial alliance, Australia, and

  your favorite BBS for FREE.

  The Telco. will undoubtably discover the device after 2 days, so post

  the number on your favorite boards so you can abuse it while it is in

  service.  With a 2000 uF capacitor and a 1 meg resistor you will

  get a 50 minute call before it disconnects you.  By lowering the value

  of the resistor and capacitor you can change the time to your taste.

  So don't dial a wrong number, because you will have to wait 50 minutes

  until it resets again.  The formula for the time is the following:

  2*R1    C1              C1 is in microfarads

  ---- * ----             R1 is in Kohms

  100     10              See schematic for location of R1 and C1.

  -----------  = Minutes

      60

  The time produced by this formula is only approximate.

  Well, that is one of the more complicated boxes to build.  But it

  is very useful and will pay for itself with its first use.   It

  would be wise to remove it before the Telco. finds it so you won't

  have to make another, or install it on a line that belongs to a

  family that is on vacation (GOOD IDEA)

  Well, there it is.  I hope it saves you a lot of cash.

  If you wish to have one built for you.  Leave me E-mail on the Iron Curtain

  or the CornerStone or any other board I frequent.  It won't be more than $15,

  hopefully it will only be about $8.


magenta2
                              THE MAGENTA BOX

                               ---------------

    This is a portable ringing generator which, if connected to a phone

    line, will make the phone on the end of it ring. It works by using a

    relay as a vibrator to generate A.C. which is then stepped up by a

    transformer and fed through a capacitor into the phone line to make the

    phone ring!

    YOU WILL NEED:

    One 5V relay with single pole change-over (SPCO) contacts

    One 6-0-6V mains transformer {KEZ SEZ: US users see text for mod.}

    Two 2uF 250V non-electrolytic capacitors

    One 6V lantern battery

    One push-to-make switch

    Wire

    HOW TO MAKE IT:

    The circuit diagram shows the relay in the normal state, ie when

    current is NOT Flowing!

           ---- SWITCH

       +---o  o-------+----------------+    +----------------+

       |              |.               |    |                |

    -------            }             6 |.  .|                |

      ---        RELAY }                }  {

    -------      COIL  }              0 }  {               OUTPUT

      ---              }           +----}  {             TO PHONE

    -------           |'           |    }  {               WIRES

      ---        COM  o NC         |    }  {    2*2uF 250V

    -------   +-----o/             |   |'  `|                |

      ---     |       o NO         | 6 NOT  |   +---||---+   |

       |      |       |            |  USED  |   |        |   |

       +------+       +------------+        +---+---||---+---+

    HOW TO USE IT:

    Connect the output wires to a suitable beige boxing point on a phone

    line. {or use a modular plug - middle two pins of the US type, outer

    two pins of the four-way UK type}

    HOW IT WORKS:

    The telephone ringing voltage is about 90V rms, which is about 255V

    peak to peak. This circuit feeds 6V peak to peak into the 6V winding of

    a transformer, which should generate 240V peak to peak in the 240V

    primary. {So in America you will have to use a 3-0-3V transformer to

    get the right step-up ratio, as your mains voltage is only 120V.} The

    relay is wired through its own contacts. At first a current flows, so

    the contacts change over and the battery current now flows into the

    transformer instead of the relay coil. This produces a pulse of current

    in the other winding, which flows through the capacitors and into the

    phone line. Meanwhile, the relay isn't connected any more and so flies

    back. This produces a pulse of current in the opposite direction on the

    mains side of the transformer. Any phone on the line will ring while

    the switch is held closed. With practice you should be able to emulate

    the ringing sound perfectly! It will certainly confuse a few people!

    Brought to you by ......  . ....   .  .  ... .....

                        :  :..: :..    :.' .:.......:.

                        :  :  : :...   : `. `... .:...

    disclaimer: this is for informational purposes only. no responsibility

    is accepted for any consequences of use or misuse of any information

    contained herein. any material whose source i have not acknowledged is

    believed to be my own - if it sounds like something you invented, just

    remember great minds think alike.


mauve
                            _________________________

                            /~~~~~~~~~~~~~~~~~~~~~~~~~\

                           |   How to Build Your Own   |

                           |                           |

                           |  |\  /|  _            __  |

                           |  | \/ | |_| | | |  | |__  |

                           |  |    | | | |_|  \/  |__  |

                           |       __                  |

                           |      |  \   _             |

                           |      |__/  / \  \_/       |

                           |      |  \  \_/  / \       |

                           |      |__/      /          |

                           |      _________/           |

                           |                           |

                            \_________________________/

                             ~~~~~~~~~~~~~~~~~~~~~~~~~

                           ____________________________

                          | Created by Captian Generic |

                          | With Help from The Genetic |

                          | Mishap.  This File Created |

                          | November 24th, 1986, 19:08 |

                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       Please bear with me, as the construction of this box will seem rather

       silly.  This box was found in a construction site.  Or rather, it found

       us at a construction site.  We were using a $5 Radio Shack phone out of

       a semi-completed office building.  One afternoon during a holiday, and

       immediately following a storm, we found our bus in shambles.  To our

       suprise, we also found that one of the phone connections we were tapping

       had been draped through a murky puddle.  The fact that suprised us even

       more was that this line still worked and now posessed some great

       capibilities.

  Materials:

  2 tupperware or similar 8oz contianers

  1 small bag earth (dirt) (12oz)

  1 pint water

  2 lantern batteries

  1 nine volt battery

  1 battery clip

  2 SPST switches

  4 ounces of iron shavings

  2 polar magnets

  5 feet wire

  1 set soldering equipment

       This is the part you won't believe.  Take the tupperware containers, and

       fill them with a mixture of the earth and the iron shavings.  Make sure

       that the mixture is well done.  (*NOTE* for best results, use the sand in

       fine ash trays.)  Cut the cut the red and green wires and splice the

       switches into them.  From the switches, solder wire to the magnets.

       Connect the red to the + (positive) side of one magnet, and the green to

       the - (negative) side of the second magnet.  From the other poles of the

       magnet, solder wires the battery & clip.  Make sure the + (positive) and

       - (negative) are correct.  Set the nine-volt battery between the two

       tupperware containers and place the battery end of the two magnets into

       the tupperware.  Now connect wire to the two poles of the lantern

       battery, and place them in the same containers as the poles of the

       magnets/9-volt battery.  You are almost done.  Finally, add just enough

       water to the two pots, and let them sit in the sun and bake like bricks.

       at this point, you have a MAUVE BOX.

  Explaning and Using What You Have:

       The red and green wires have been places into a magnetic field which is

       being charged continually be a lantern battery.  (It is necessary to

       change this battery every one to one and a half months.)  This will

       literaly pull in the nearest phone conversatiion.  (Don't try this in a

       big apartment or dorm.)  When the 9-volt battery is connected, this will

       now create enough current for the poles of the magnets to reverse

       themselves (perhaps you're seen Mr. Wizard do this.  It's just like with

       the soap).  At this point, you have a phone transmitting to one (if not

       more) of the nearest phones.  (Again, if you're in a dorm, don't try

       this.)  I suppose this just accomplishes what a tap would do, but with a

       MAUVE BOX, your fingerprints never will show on a terminal or on

       someones telephone lines.

  Notes and Addendum:

       This will only work with a touch-tone phone connected to a phone line.

       When the switches are pulled, it's off your line and into the air.  This

       is named a MAUVE BOX, becuase this is the most disgusting box, and I find

       mauve to be the single most disgusting colour I know of.  Also, this file

       is for information purposes only.  This is not to be used in an illegal

       manner. Perhaps one of these by the pool, sending to your seth co-author,

       accept no responsibility for your actions with the MAUVE BOX. Thank you...


mega
                               **MegaBox Plans** **

Gen-2600

In this file when I say CAN I mean anything that has all the local phone

lines running through it be it a junction box, a box on a pole, a PBX type

casing, a box in a manhole or whatever you have in your area. If you can't

find these (you didn't look very hard) try cutting open an underground cable

for the lines but seal it back up!

REQUIREMENTS ------------

1) The mental ability that God gave the common dog!

2) A set of phreak tools SCREWDRIVERS 7/16" HEX DRIVER DIAG CUTTERS etc.

3) A handset (rip one from GTE if posible get a blue one) or just cut the plug off of your phone cord and attach to gatorclips. (Some shits call this a beige box but it's just a MOD)

4) Basic phone knowledge.

WHAT YOU'RE GONNA DO -------------------- Like the Biege Box the

MEGA BOX isn't really a box but a MOD, but it's more than mere mortal MODS

it's a total Telco cable reroute YAK YAK YAK! You are going to hook up a

second line in your house!!! For those who don't know the phone system only

uses two wires Red(ring) and Green (Tip) the yellow and black are for a

second line (or a MEGA BOX if you so desire ). HOW TO DO IT ------------

Open up all of the phone plates in your house notice that sometimes the

yellow and black lines (Y&B from now on) usually are not connected SO.....

CONNECT them! Now what you wanna do it hook someone elses (he he he) two

working lines (green and red) to you Y&B set go out to your nearest can and

hook your currently unused Y&B to someone elses hot pair. Find one with your

handset and dial 118 to get the number make sure it's not a friend. The

inside of some can have the lines labled! If you want to you can get a LINE

1/ LINE 2 switch box from radio shack or you can just cut a phone wire and

switch the black & yellow from the wall plate to the Green & Red (usually in

the middle) for your Modem or phone. Now hook it up and switch to line TWO

or use your homemade cable do a 118 to make sure you're not on your line and

then dial away! Thre is really no way for the Telco to ever figure this out

if you put enough re-routing work and planing into it. The only thing they

can do is lock the cans so you may need a lock cutter if you live in an area

where the phreaks are so uncontrollablly powerfull (like Sarasota County)

that GTE/ATT has no choice! A step that can slow down thier investigation is

to put your own lock on it afterwards... most grey whales (telco trucks)

don't have bolt cutters or blow torches! HINTS ----- Sometimes when doing

field work on cans passer-bys will ask questions so allways wear gruby

pants, a plaid shirt, and a baseball cap (look like a fuck head ok?), and

spit dip alot! It's also good to have an ID card, just use your imagination,

no one is gonna know what it looks like anyway right? Or if you're a

perfectionist look for a GTE/ATT man and herass him and then ask to see his

ID badge. Don't call voice numbers (the phone company might catch on and

call them to see what's up) but they'll usually leave BBS's alone (you can't

talk to a carrier HA) Switch the black and yellow in the can somewhere else

either as soon as you are done or right when bills come out (when the victim

gets their $500 phone bill it'll take about a day for GTE/ATT to get out

there and investigate) Bfore I said use a cable if you can't find any cans

this is good way to do it if you are gonna be doing it for a long time,

because the physical connections can not be seen as in a can. But don't

worry about using a can the GTE/ATT guys will never notice it if you make it

look good and keep one steep ahead of them by using a line that has never

been hacked before then switch right before they start to investigate that

line... Keep them chasing thier tails! Another hint is if you get busted

forget you know us! Because I will destroy anyone who ruins my rep with the

local cops or feds. As it stands now I'm just a nice citizen (it's a clever

cover, try it out!)

GETTING FANCY (PHANCY) ----------------------

** NOTE:

only real phreaks and hardware hackers are allowed here! ** Fid a dead line

in your can (a winterized line) and hook to that. Now go to the next biggest

can in your area ( >500 pairs!) and find the dead line (big cans are almost

always mapped out so its easy to find) now hook that line to a live line and

you'll be unsing that new line... OR find another dead line in the big can

and hook to that and so on and so on! This is how you keep GTE off your ass

loop the dead lines all over the place and into another AREA CODE if you

really get into it! Done right this is a flawless method to phreak!

A LITTLEGOOD-BYE JOKE ---------------------- Well that's it for the

MEGA BOX whilein a can try this out... Get on your handset and call a hot sex

line (get one from a porn mag or a list on a BBS... if they want a credit card number

use your carding skills) then keep that line on and get on another line and

call a party line advertised in magazines or MTV and then use two pieces of

wire to hook the two lines together. Now close the box off and go on your

way! To have even more fun: go to another can and call the party line if

there is still some bitch wailing her sexual fantasies on the line you can

make a big joke out of it! You can join her, or see what everyone is saying

about her, or say you are a man of the cloth and that you don't like this

one bit and threaten to sue their asses off!

[eof]


neon
 --------------------------------------

               THE NEON BOX

  --------------------------------------

  A NEON BOX IS A VERY SIMPLE ADJUSTMENT TO YOUR FONE, THAT WILL ALLOW A VERY

  CLEAR PASSAGE FROM YOUR COMPUTER TONES TO YOUR FONE.  IT ALSO WORKS GREAT FOR

  RECORDING TONES, SEX FONE, OR ANYTHING ELSE YOU WANT TO RECORD OFF OF YOUR

  FONE.

               TOOLS:

               ------

  THIS MODIFICATION IS VERY SIMPLE, AND CAN BE USED ON MOST FONES, THOUGH IT IS

  MORE DIFFICULT ON ONE-PIECE UNITS.  ALL YOU NEED IS AN OLD PAIR OF HEADFONES,

  OR SIMILAR, A FILIPS SCREW- DRIVER, A SOLDERING IRON AND SOME SOLDER.

              INSTRUCTIONS

              ------------

  OPEN YOUR FONE WITH THE SCREWDRIVER.  WHEN OPENED, LOOK FOR THE RED AND BLACK

  WIRES THAT LEAD TO THE MOUTH- PIECE. (IF YOU'RE NOT SURE WHICH WIRES LEAD TO

  THE MOUTHPIECE, OPEN UP THE MOUTHPIECE AND FIND THE SAME COLOR WIRES ON THE

  BASE. FOR ONE-PIECE UNITS, JUST LOCATE THE MOUTHPIECE).

  WHEN YOU HAVE FOUND THE MOUTHPIECE, OR WIRES, CUT THE EARD OF THE HEAD- FONES

  OFF, AND ONE WIRE (THE ONE THAT LEADS TO THE RIGHT EAR). STRIP THE LEFT WIRE

  SO ABOUT AN EIGHTH INCH IS SHOWING. KEEP THE OTHER SIDE IN TACT.

  THEN ON THE RED WIRE, SOLDER THE WIRE THAT IS SEPARATLY SEALED FROM THE OTHER

  ONE. ON THE BLACK WIRE (THESE ARE THE ENDS OF THE WIRE ON THE CIR- CUIT BOARD)

  SOLDER THE WAIRE WRAPPED AROUND THE OTHER WIRE.  THEN SOLDER A HOLE FOR THE

  WIRE. YOU HAVE NOW MADE A NEON BOX.


olive
 (>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)

  (>                                                        <)

  (>                     Olive Box Plans                    <)

  (>                                                        <)

  (>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)

      This is a relatively new box,  and all it basically does

  is  serve  as a  phone ringer.    You have  two choices  for

  ringers, a piezoelectric transducer (ringer),  or a standard

  8 ohm speaker.   The speaker has a more pleasant tone to it,

  but either will do fine.    This circuit can also be used in

  conjunction with a rust box to control an external something

  or other  when the  phone  rings.   Just  connect  the 8 ohm

  speaker output to the  inputs on  the rust box,  and control

  the pot to tune it to light the light (which can be replaced

  by a relay for external controlling) when the phone rings.

               ______________

              |              |                 NC --|-- 5      4 --|-----/X/X/------->G

              |              |      / R2

  G<----)|----|-- 6      3 --|-- NC

      | C3    |      U1      |

       -------|-- 7      2 --|---------- --- -- - > TO RINGER

              |              |

          ----|-- 8      1 --|--

         |    |______________|  |

         |                       ---/X/X/----|(----- L1

         |                           R1      C1

          ------------------------------------------ L2

                    a. Main ringer TTL circuit

  (>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)

                                     _

  FROM PIN 2ive:< - -- --- ----------| |_| |------------->G

                                      P1

            f       b. Peizoelectric transducer

  (>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)

                                                        __  /|

  FROM PIN 2 < - -- --- ---------|(---------.  .-------|  |/ |

                                            >||<       |S1|  |

                                            >||<     --|  |  |

                                            >||<    |  |__|X |

                                G<---------.>||<.---        X|

                                             T1

                  c. Elctro magnetic transducer

  Parts List

  ----------

  U1 - Texas Instruments TCM1506

  T1 - 4000:8 ohm audio transfomer

  S1 - 8 ohm speaker

  R1 - 2.2k resistor

  R2 - External variable resistor; adjusts timing frequency

  C1 - .47uF capacitor

  C2 - .1uF capacitor

  C3 - 10uF capacitor

  L1 - Tip

  L2 - Ring

       L1 and L2 are the phone line.

  Shift Rate:

  -----------

    This is the formula for determining the shift rate:

            f        1                   1

      SR = --------------------- = ------------ = 6.25 Hz

           (DSR(1/f1)+DSR(1/f2))    128     128

                                   ----  + ----

                                   1714    1500

                DSR = Shift Devider Rate ratio = 128

                 f1 = High Output Frequency = 1714

                 f2 = Low Output Frequency = 1500


party
                                  The

                            P A R T Y   B O X

                          ---------------------

                       Created by Greyhawke of TDK

        Ever wanted three-way calling without having to pay for it?  Wanted to

connect two phone conversations at once, without any static or excess wiring,

or even having two phone lines?  Ever gone beige boxing and wanted to connect

two operators (or anyone!) but didn't have the necessary stuff with you?  The

party box fixes them all!

        First off, go to your local Radio Shack and pick up the following

parts:

(1)     DPDT slide switch  (all you need is DPST, but DPDTs are easy to get)

(2)     Modular phone jacks

(4)     Alligator clips

        Some wire (doesn't matter what kind)

        For the modular jacks, if you get the kind that look like a box with

the back open, it makes a nice looking party box when you stick them together.

Assembly:

        Take four lengths of wire, and strip the ends about 1/4" on both ends

of the wire.  Connect two wires to the red and green terminals on one phone

jack, and two wires to the red and green terminals on the other phone jack (so

you've used all four pieces of wire).  Connect to the other ends of each wire a

red or green alligator clip (down at Radio Shack they sell some nice ones with

color coded insulator sleeves.  Get these, it's REAL important that you know

the red ends from the green).  If you do this right, you'll have a red and

green aligator clip on each of the two phone jacks, connected to the wires.  By

this time, you should not have any wire end loose; they should all be connected

to SOMETHING.

        Now, if you've been paying attention and you know your boxes, you'll

recognize the two pieces of equipment you've just assembled as beige boxes.

That's all they are, really, is beige boxes.

        Here's what makes those two beige boxes into a single party box.  Take

four more short (like 1.5") lengths of wire, and strip all the ends to about

1/4".  First connect one side of each wire to a contact on the DPDT or DPST

switch.  Just make sure it's the right switch.  For DPST, you won't have a

problem, but for DPDT, make sure the switch looks like this when the wires are

connected:

                       *-**-* -

                       *-**-* -

        It's doesn't really matter which side you connect the wires to, just

make sure that at least two of them are in the middle.  The wires are connected

to the terminals surrounded by asteriks (*).  Solder each connection carefully

to make sure it's a good one that won't fall off, and make sure none of the

wires are touching each other!!  If they do you've got a short circuit and the

box won't work!

        Here's the tricky part.  Take the bottom two wires (looking at the DPDT

switch from the bottom, so it looks like the above picture) and connect each

one to the red terminal on the phone jacks.  One wire to each jack.  Then, take

the top two wires and connect one to the green terminal on each phone jack.

Again, one wire to each jack.  Screw down all the terminals good and tight.  If

you've done this correctly, there should be two wires leading to each red and

green terminal on the two phone jacks.  Set the switch so it's in the off

position.  It's off when only the middle terminals of the switch are covered,

or so that the switch is on the side where there aren't any wires coming to the

terminals there.  Just make sure it's in the beige mode.  Your box is now

built.

        (This is if you used the jacks I suggested at the top of the file.)  To

make it look pretty, you can cut away a portion of the plastic surrounding one

of the jacks so that the switch will fit nicely in the place you cut away.

Also cut away a small half-circle on the bottom of the surrounding plastic to

feed the wires out of (the ones with the alligator clips, not the ones leading

to the switch).  Once these two things are done, and the switch is screwed down

securely, tape it all up, super-glue, who cares.  It doesn't matter; just so it

stays together.

        Once all this is done, here's a few things I like to do to make things

easy.  Put a small dot of white paint in the lower part of the switch, so that

when it's on the paint shows.  This is easy to do.  Also you might want to know

which line you're using for each box.  Just put a glob of a different colored

paint on each side of the party box, and put the same color paint on the wires

leading out of that side of the box.

Use:

        When used in beige box mode (so that the switch is off), the party box

will operate just like two beige boxes.  There are totally, 100% separate from

each other, and the conversations don't get crossed.

        However, when used in the party box mode, the party box connects both

lines to each other, essentially connecting all four people to the same line.

Everyone can hear each other, and there is little or no static created by doing

this.  It's works great for connecting anyone together, and all that's needed

is each beige box connected to an output device ("Bell Can"), and the switch in

the party mode position.  See a file on beige boxing for detained info on what

to do while boxing, etc, or how to connect to a Bell Can.

Schematic:

        This is a really easy box, but someone might want a schematic, so

here's one:

      <--- to one phone jack                     to the other phone jack --->

       ---------------------------    __/   -----------------------------

       (red [ring] wire)         - __/!     -           (red [ring] wire)

       ------------------------- O/   !_/   O ---------------------------

       (green [tip] wire)      -   __/        -        (green [tip] wire)

                               - O/         O -

                               - -          - -

                               ---          ---

        It's a really bad schematic, but the little things in the middle are

supposed to represent the switch in the off posistion, and the exclamation

points just mean it's a DPST switch that doesn't connect the top and the bottom

termials.  The (-) and the (-) are supposed to be the wire.

Disclaimer:

        This file is, of course, only meant for informational purposes, and is

in no way meant to be used.  Any tapping of telephone lines is a federal

offense, so don't come crying to me if you get busted, because I'm telling you

not to do it.  I'm not responsible for you; you're responsible for you.

 _____________________________________________________________________________

-                                                                             -

-             Planet Playtex: xxx/xxx-xxxx  300/1200bps, 24hrs/day            -

-_____________________________________________________________________________-

-                                                                             -

-             This file has been a production of The Dark Knights.            -

-_____________________________________________________________________________-

-EOF


pearl
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

  $$                                                                         $$

  $$                              *****************                          $$

  $$                              * How to make a *                          $$

  $$                              *****************                          $$

  $$                                                                         $$

  $$                               <> Pearl Box <>                           $$

  $$                                                                         $$

  $$                      Written and created by: Dr. D-Code                 $$

  $$                                                                         $$

  $$ (Sysops may use this information if it's not altered in any way at all) $$

  $$                                                                         $$

  $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

  The Pearl Box:Definition - This is a box that may substitute for many boxes

  which produce tones in hertz. The Pearl Box when operated correctly can pro-

  duce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and other crucial

  tones are obviously in its sound spectrum.

  Materials you will need in order to build The Pearl Box:

  ========================================================

  C1, C2::::::::.5mf or .5uf ceramic disk capacitors

  Q1::::::::::::NPN transistor (2N2222 works best)

  S1::::::::::::Normally open momentary SPST switch

  S2::::::::::::SPST toggle switch

  B1::::::::::::Standard 9-Volt battery

  R1::::::::::::Single turn, 50k potentiometer

  R2::::::::::::  "     "    100k potentiometer

  R3::::::::::::  "     "    500k potentiometer

  R4::::::::::::  "     "    1meg potentiometer

  SPKR::::::::::Standard 8-ohm speaker

  T1::::::::::::Mini transformer (8-ohm works best)

  Misc.:::::::::Wire, solder, soldering iron, PC board or perfboard, box to

                contain the completed unit, battery clip

  Instructions for building The Pearl Box:

  ========================================

  Since the instruction are EXTREMELY difficult to explain in words, you will be

  given a schematic instead. It will be quite difficult to follow but try it any

  way. There is also a Hi-Res picture you can get that shows the schematic in

  great detail.

                           (Schematic for The Pearl Box)

                  +-------------+------------+---------+

                  !             !             \        +--S1----

                  C1            C2             \           SPKR

                  !             !               +      +--------

                  +             +           ----+T1    +

                  !\            +---------------+------+

                  !  b  c-------!

                  !   Q1                   !

                  !     e-----S2---+       !

                  !                !       !

                  !               B1       !

                  !                !       !

                  !                +-------+

                  !R1   R2   R3   R4!

                  /\/\ /\/\ /\/\ /\/\

                    +--+ +--+ +--+

  Now that you are probably thoroughly confused, let me explain a few minor de-

  tails. The potentiometer area is rigged so that the left pole is connected to

  the center pole of the potentiometer next to it. The middle terminal of T1 is

  connected to the piece of wire that runs down to the end of the battery.

  Correct operation of The Pearl Box:

  ===================================

  You may want to get some dry-transfer decals at Radio Shack to make this job a

  lot easier. Also, some knobs for the tops of the potentiometers may be useful

  too. Use the decals to calibrate the knobs.

  R1 is the knob for the ones place, R2 is for the tens place, R3 if for the

  hundreds place and R4 is for the thousands place. S1 is for producing the all

  the tones and S2 is for power.

  Step 1: Turn on the power and adjust the knobs for the desired tone.

         (Example: For 2600 hz- R1=0:R2=0:R3=6:R4=2)

  Step 2: Hit the pushbutton switch and VWALA! You have the tone. If you don't

    have a tone recheck all connections and schematic. If you still don't have

    a tone call Brainstorm BBS:xxx-xxx-xxxx, The Bay:xxx-xxx-xxxx or Pirate's

    Harbor:xxx-xxx-xxxx and leave me e-mail stating what the scene is.

  ______________________________________________________________________________

           This has been a High Mountain Hackers presentation  -  1985

  ______________________________________________________________________________

  Shakepeare is currently working on an improved version of the Pearl Box..

  look for the ppplans soon!


pink
                    (>:::::::::::::::::::::::::::::::::::<)

                     (>                                   <)

                     (>          Pink Box Plans           <)

                     (>          --------------           <)

                     (>                                   <)

                     (>:::::::::::::::::::::::::::::::::::<)

    Pink box allows you to hook two separate phone lines together to have

  three way calling with hold on either line, and well as bringing a dial tone

  into the conversation woth someone and allowing them to dial the number

  touch tone, and it will connect three way, and when they hang up, it will

  disconnect three way calling, no more playing with the hook for 3 way!!!

      schematix:

         L1                       L2

        /  \                     /  \

       R    G                   R    G

       |    |                   |    |

       |-S3-|                   |-S4-|

       |    |                   |    |

      S3    S3                  |    |

       |    |                   |    |

       |    |------S5-----------|    |

       |    |   .-----S4-------------|

       |    |   |

     |-|    |   |

     | |    |   |

     | |-PH-|   |

     |          |

     |----------|

     partz lizt:

     L1-2  modular jack hooked to ph.lines

     R-G   red and green wirez from jack

     S1-2-5-6   SPST toggle switches

     S3-4  SPST toggle switches for HOLD

     PH    modular jack to phone


pink2
 =\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\

=

  =/=> How To Build A Pink Box <=\=/=\=/=\=/=\=/=\=> Written By Baba O'Riley <=\

=

  =\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\

=

     The function of a Pink Box is to add a hold button that allows music or

  anything else to be played into the telephone while the person is on hold.

  This box can either be built right in the telephone or as a seperate box.

  \=/=\=/=\=/=\=/=\=/=\=/=\=/=> Materials Needed <=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\

      some Bell wire or phone wire

      a SPST momemtary switch       RS # 275-1547

      one resistor, 470 ohms        RS # 271-019

      one LED, 5 volts              RS # 276-041

      one SCR, number 2N5061

      audio transformer (Ratio 10K:600)

      RCA phono jack                RS # 274-346

      screwdrivers, soldering iron, solder, etc.

  /=\=/=\=/=\=/=\=/=\=/=\=/=\=/=> Construction <=\=/=\=/=\=/=\=/=\=/=\=/=\=/=\=/

=

   1. Open the wall box and locate the RED and GREEN wires.

   2. Take a piece of RED wire, strip the end, and attach it to the red lead on

      the wall box.  Do the same for the GREEN.

   3. Connect the GREEN wire to the ANODE end of the LED.

   4. Connect the CATHODE end of the LED to the UPPER pin of the primary side of

      the transformer (See diagram below).

                             _____

     To one phono pole   ---! Top !--- To CATHODE of LED

                           -!View !- Primary side

   To other phono pole   ---!_____!--- To pole or trans. & one pole of switch

   5. Connect the pin directly across to one pole of the phono jack.

   6. Connect the RED wire to one side of resistor and to the C pole of the

      transistor.

   7. Connect the open pin of the switch the other side of the resistor and to

      the G pole of the transistor.

  =/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=> Wiring Diagram <=/=\=/=\=/=\=/=\=/=\=/=\=/=\=

            RCA Jack  Transformer   LED

                        _____      C   A

    Pole of Jack --/---! Top !---/--(*)--\------GREEN wire

                      -!View !- Primary   --I---RED wire

    Pole of Jack --/---!_____!---/-I       (O)

                                   I        I

                                   I     [--I-----Pole of Switch

                                   I

                                   I--------------Pole of Switch

  =/=\=/=\=/=\=/=\=/=\=/=\=/=\=/=> Key To Symbols <=/=\=/=\=/=\=/=\=/=\=/=\=/=\=

  --       Wire

  I        Connection or wire

  /        Connection or wire

  _/       C pole of transistor    --(*)--

  [_)--    G pole of transistor    I

   I       A pole of transistor   (O)  Resis

                                   I

       _____

   ---! Top !---

     -! View!- Primary    Transformer

   ---!_____!---

  =/=\=/=\=/=\=/=\=/=\=/=\=/=\=> Use Of The Pink Box <=\=/=\=/=\=/=\=/=\=/=\=/=\

=

      Hook the RED and GREEN wires up to the appropriate terminals and hook the

  RCA jack to the output on your stereo.  Turn on your stereo at a good volume.

  Now call a friend.  To test the Box, hold down the switcn and hang up the

  phone.  The LED should go on and your friend should hear music.  If nothing

  happens, start over.  The hold is shut off if you pick up a phone on that line

  or your end hangs up.

       If you have any questions leave me mail on:

         Cook's County BBS  xxx-xxx-xxxx  /1200

         The Dugout         xxx-xxx-xxxx

         The Bujinkan       xxx-xxx-xxxx  /1200

  Brought to you by: The Crack Crew

Written by: Baba O'Riley


purple
                         How to Construct a Purple Box.

                          ------------------------------

       The Purple Box is very simple to construct.  It takes only six components

  and a PC board if you want.  The Purple Box is a telephone hold button.  It

  will allow you to switch phones very easily.

       A red LED indicates when a party is on hold and is automatically

  extinguished when either party releases the line.

       To install your Purple Box, remove the telephone case and locate the red

  and green wires.  From the green wire, make a connection to L1 and from the

  red

  wire a connection to L2.

       To test the circuit, call a friend and then while pressing the push

  button, hang up the phone.  As soon as the phone is on the hook, you may let

  go

  of the push button.

  Parts:

       D1 = Light Emitting Diode (LED)

       D2 = 1N4003 Diode

       R1 = 820 ohm 1/2 Watt

       R2 = 1K ohm  1/2 Watt

       S1 = N.O. Push Button    S1

     SCR1 = C106B1          __|__

                         +--o   o---+----R1----+

                         |         g|          |

      +--------LED--R2---+-------a--+--c--D2---+

      |                                        |

      |L1                  SCR----/            |L2

      |                                        |

    To Green                                To Red

     The SCR is a three prong IC.  The a,g, and c tell you what pins to use. The

  "g" pin is the one on the left if you look at the numbers.

                                   Have Phun,

                                   The Flash


razz
   _________________________________________________________________________

   |                                                                         |

   |                     A Crime Ring G-File Production                      |

   |                          __                __                           |

   |                         |__| The Razz Box |__|                          |

   |                                                                         |

   |                          Written by The Razz                            |

   |                                                                         |

   |                     -:+ Released by The Magnet +:-                      |

   |_________________________________________________________________________|

   |                                                                         |

   | Magnetic Field Elite.....Private Bulletin Board System.....312-966-0708 |

   |_________________________________________________________________________|

  Introduction:

          So you want to be James Bond eh? So you want to be a private eye eh.

  Well here's your chance to pick up some very important clues or ideas using

  your neighbors telephone line. Forget about climbing a telephone pole this

  sort of boxing can be done on the ground.

  Purpose:

          To tap your neighbors line without your neighbor knowing it. You can

  also make FREE (let me repeat that) FREE!! Phone calls to your favorite

  K-RAD-GNEW-WAREZ boards.

  Materials:

  1. Line Man's headset (no you can't buy one that's why we're making one you

     IDIOT)

  2. Alligator clips (clips is Plural so you need Two)

  3. A phone (preferbly one of those one peice kind that like the ones with the

     numbers and the thing the hangs up on the ONE phone piece)

  4. A Telephone wall jack box or whatever they're called

  5. Some green and some red wire

  6. Some intelligence (very Much needed)

  Plans:

          First hook up your one piece phone to the wall jack box. Then take

  the alligator clips and attach red wire to one and green wire to the other

  one. You should have 2 alligator clips with wire attached. Now strip the

  wire and open the Wall jack box you have and attach the red wire with the

  red screw on the box and the green wire with the green screw on the box.

  Your stuff should look like this.

           _______

          |  ...  |  <--one peice phone

          |  ...  |               __________________

          |       |              |                  |   <--oversize box to show

          |  123  |              |   (*)r---  (*)b  |      the detail

          |  456  |             _|         |        |

          |  789  |      ()()()|_          |        |

          |  *0#  |     ()       |    ---- |        |

          |  ...  |    ()        |   (*)g| |  (*)y  |

          |_______|   ()         |_______|_|________|

               ()    ()                  | |

               ()   ()     green wire--> | |  <--Red Wire

                ()()                     | |

                                         | |

                                    \/\/\/ /\/\/\

  Hints:

  \/\/\/- Green wire Alligator clip

  /\/\/\- Red   Wire Alligator Clip

  Using Your newly made device:

          Now that you have made or created your little Razz Box then you are

  ready to go outside and do your stuff. First go to a neighbor's house and

  find the black telephone wires. They should look like Example #1. Then cut

  off a bit of the plastic covering so the alligator clips go in easier and

  you now stick the alligator clips one on the right and one on the left side

  of the plastic wire as shown on the diagram. The Black plastic wire should

  look like the diagram. You should get a dialtone. If you do not then switch

  the alligator clips around till you do. Remember your neighbors can hear you

  as well so get one of the phones with the MUTE option so you can plug into

  theres quietly.

         | || |

         | || |

         | || |  <<<----black wire

         | || |

     \/\/\/||/\/\/\    <<<---alligator clips.

         | || |

         | || |

  Disclaimer:

          I as writer of this file take no responsibility at all (And I repeat

  NO RESPONSIBILITY) of this file. This File is ONLY for informational purposes

  ONLY.

  If you have any question, suggestion, or correction, you can contact The Razz

  or me, The Magnet, at any of the boards listed at the end of this file.

                           Copyright [12] Nov, 1988

                              -:+ The Magnet +:-

                           Crime Ring International

                                   The Razz


red
                         Red Boxing With Whistles

                             by THE RESEARCHER

  This article is presented as a news item only. It is not to be taken as an

  encouragement to make fraudulent telephone calls.

  Red boxing consists of simulating the tones produced when coins are

  deposited in a pay phone. Coin tones are beeps of 2200 Hz + 1700 Hz as

  follows:

  5 cents - 1 beep, 66 milliseconds duration.

  10 cents - 2 beeps, each 66 milliseconds duration with 66 millisecond

  pause between beeps.

  25 cents - 5 beeps, each 33 milliseconds duration with a 33 millisecond

  pause between beeps.

  Two methods have commonly been used by phone phreaks to produce these

  tones and make free calls.

  1. The traditional Red Box consisting of a pair of Wien-bridge oscillators

  with the timing controlled by 555 timer chips.

  2. Producing the signals with a computer which are recorded and then

  played back into the mouth piece of a pay phone.

  A third method has recently appeared which is a real mind blower. A phreak

  in the Midwest has extensively tested a method of red boxing which uses

  nothing more than a pair of brass or aluminum whistles. The whistles are

  1/4 inch in diameter by 4 inches long and are tuned by means of a wooden

  dowel rod which fits snugly inside. The whistles can be brought precisely

  on frequency by tuning them against a known signal source such as a

  computer capable of producing the tones. Once tuned, the whistles are

  glued or taped together so they can be blown together to produce the dual

  tone used in coin signaling.  It has been tested and proven that with a

  little practice these whistles can be used to make free calls. Now you can

  blow your money without spending a cent.


red2
 HOW TO BUILD AND USE A RED BOX......

     =<COURTESY OF  -<U.N>->=

     =<TYPED BY THE MASTER >=

      ----------------------

THE RED BOX BASICALLY SIMULATES THE SOUND OF COINS BEING DROPPED INTO THE COIN

SLOT OF A PAY TELEPHONE. A PAY TELEPHONE GENERATES A BURST OF TWO MIXED FREQUENC

IES, 1700 HZ AND 2200 HZ, FOR A SPECIFIC TIME INTERVAL TO DENOTE A NICKLR, DIME,

 OR QUARTER. A NICKLE IS 1700 HZ +2200 HZ FOR 66 MILLISECONDS. A DIME IS 1700 HZ

 + 2200 HZ FOR 66 MILLI. SECS. ON, 66 MS. OFF , THEN 66 MS ON AGAIN. FINALLY, A

QUARTER IS 1700 HZ+2200 HZ FOR 33,MS ON, 33 MS, OFF, CONTINUOSLY REPEATING FOR 5

 TIMES.

    WHEN USING A RED BOX ON A PAY PHONE, FIRST DEPOSIT A REAL NICKLE (BECAUSE T

HEY CAN TELL IF THE FIRST ONE IS A REAL ONE OR JUST A TONE), THEN USE THE TONE B

URST. YOU CAN BUILD THE CIRCUIT TO GENERATE A NICKLE TONE, THEN RECORD IT AND PL

AY IT INTO THE PAY PHONE WITH A WALKMAN CASETTE PLAYER.

     TO GET THE MAP, SEND $2 DOLLARS TO

          MASTER WORLD

          LOS ANGELES, CALIFORNIA 90025

   THE MAP HAS MANY FIGURES THAT THE COMPUTER CANNOT PRODUCE.

IF YOU HAVE THE MAP , HERE ARE SOME TIPS

   ADJUST R1 TO GET 2200 HZ AT POINT A

   ADJUST R2 "   "  1700 HZ "  "     B

   PRESS SWITCH FOR 66 MS ON AT SPEAKER

   THIS SIMULATES A NICKLE

                                        THE 555 TIMER-> 66MS TIMER

                                 THE 556 DUAL TIMER->2200HZ+1700HZ GENERATOR

                                        741->TIMER OP AMP BUFFER

                                             FOR SPEAKER

 SO REMEMBER IF YOU DON'T HAVE THE MAP SEND TWO DOLLARS TO THE ADDRESS UP

     ABOVE


red3
                        BUILDING A RED BOX

                         by JR "Bob" Dobbs

   Essentially,the red box is a device used to fool the phone company

into thinking you are depositing coins into a payphone.  Every time you

drop a coin into a payphone, the phone signals the type of coin inserted

with one or more bursts of a combination of 1700hz and 2200hz.  The tone

bursts are coded as follows:

Nickel:One 60 millisecond pulse

Dime  :Two 60 millisecond pulses separated by 60 milliseconds

Quarter:Five 35 millisecond pulses separated by 35 milliseconds

                         HOW TO USE IT

                         -------------

   Operation is simple.  Simply dial a long distance number (some areas

require you to stick in a genuine nickel first), wait for the ACTS

computer to demand your cash, and press the "deposit" button on the red

box for each coin you want to simulate.  The coin signals are coupled

from the red box into the phone with a small speaker held to the

mouthpiece.  For local calls, either you must first deposit a genuine

nickel before "simulating" more coins or place your call through the

operator with 0 + 7d.  Use some care when the operator is on the

line--sometimes they catch on to your beeper ploy.

                         CIRCUIT OPERATION

                         -----------------

   Each time the pushbutton is pressed, it triggers half of IC1,

configured as a monostable multivibrator to energize the rest of the

circuit for a length of time determined by the setting of the coin

selector switch.  This in turn starts the other half of IC1, configured

as an astable multivibrator, pulsing on and off at regular intervals at

a rate determined by the 50k pot between pins 12 and 13.  The output of

the astable thus alternately powers of IC2, configured as a square wave

oscillator, providing the required 1700hz and 2200hz to the op amp which

acts as a buffer to drive the speaker.

                         CONSTRUCTION

                         ------------

   Assemble the circuit as you wish.  Component placement is not

critical.  I found the easiest method was to use point-to-point wiring

on a "universal" PC grid board with solder ringed holes.  Use sockets if

you aren't a whiz with a soldering iron.  Be sure to leave easy access

to the potentiometers for alignment.

point,                         ALIGNMENT AND TESTING

                         ---------------------

   For alignment, a frequency counter and tiggered sweep oscilloscope

are extremely handy (but not absolutely necessary.)

   Install a temporary jumper from +9v supply to pin 14 of IC2 and

temporarily disconnect the 0.01uF capacitors from pins 5 and 9 of IC2.

Power up the circuit.  Measuring the output from pin 5 of IC2 with the

frequency counter, adjust the 20k pot between pins 1 and 6 for an output

of 1700hz.  Now adjust the 20k pot between pins 8 and 13 for an output

of 2200hz from pin 9 of IC2.  Remove the temporary jumper and re-attach

the capacitors to pins 5 and 9.  (Note: if no frequency counter is

available, the outputs can be adjusted by ear one at a time by

zero-beating the output tone with a computer generated tone of known

precision.)

   Next, temporarily disconnect the wire between pins 5 and 10 of IC1.

Set coin selector switch in the "N" (nickel) position.  With the

oscilloscope measuring the output from pin 9 of IC1, adjust the 50k pot

between pins 12 and 13 of IC1 for output pulses of 60 millisecond

duration.  Reconnect the wire between pins 5 and 10.  (Note: If no scope

is available, adjust the pulse rate by ear using computer generated

tones for comparison.)

   The remaining adjustments are made by ear.

   Leave the selector switch in the "N" position.  Adjust the 50k pot

labelled "Dime" for a quick double beep each time the pushbutton is

pressed.

   Finally, set the selector to "Quarter".  Adjust the 50k pot labelled

"Quarter" until exactly 5 very quick beeps are heard for each button

press.  Don't worry if the quarter beeps sound shorter and faster than

the nickel and dime ones.  They should be.

                         CONCLUSION

                         ----------

   If all went well to this point, your red box should be completely

aligned and functional.  A final test should now be conducted from a

payphone using the DATL (dial access test line) coin test.  Dial

09591230 and follow the computer instructions using the red box at the

proper prompts.  The computer should correctly identify all coins

"simulated" and flag any anomalies.  With a little discretion, your red

box should bring you many years of use.  Remember, there's no such thing

as spare change.!

point,                         Parts list for Red Box

                         ----------------------

Semiconductors

--------------

(2)556 dual timer

(1)741 Op Amp

(1)1N914 Switching Diode

Resistors

---------

(6)10k           (1)4.7k

(2)100k

(4)50k PC Mount Potentiometer

(2)20k Multi-Turn Potentiometer

Capacitors

----------

(10)0.01uF        (1)1.0uF

(2)10.0uF Electrolytic

Miscellaneous

-------------

(2)14 Pin Dip Socket

(1)8 Pin Dip Socket

(1)3-position Rotary Switch

(1)Momentary Push-Button Switch(normally open)

(1)SPST Toggle Switch

(1)Speaker or Telephone Earpiece Circuit Board

(1) Box

(1) 9v Battery Clip

Mounting Hardware

point,                         SCHEMATIC DRAWING

                         -----------------

       /

 ÚÄÄS1Ù  ÄÄÂÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄ¿

 +9v      R1        R2        ³        ³                ³             ³

           ÃÄÄÄC1ÄÄÄÄ´        ³       R3                ³             ³

           ³         ³    ÚÄÄÄ´        ÃÄÄÄÄÂÄC2Ä@q     S3      @n    ³

           o     ÚÄÄÄÁÄÄÄÄÁÄÄÄÁÄÄÄ¿    ³   R5    ³      @d      ³     ³

       oÄ´       ³   6    4  14   ³   R4    ³    ³      ³       ÃÄÄ¿  ³

       S2  o   ÚÄ´5             13ÃÄÄÄÄ´    g    ³      ÃÄÄÄ¿   ³  ³  ³

           ³   ³ ³                ³    ³         ³      ³   ³  R9<ÄÙ  ³

           g   ÀÄ´10  (IC1556)   8ÃÄ¿ R6<Ä¿      ³     R8<ÄÄÙ   ³     ³

                 ³                ³ ³  ³  ³      ³      ³       ³     ³

            ÚÄÄÄÄ´9             12ÃÄÁÄÄÅÄÄÙ      ÃÄÄ¿   ³       ³     ³

            ³    ³ 3  11  7  2  1 ³   C3         ³  ³   ³       ³     ³

            ³    ÀÄÂÄÄÂÄÄÄÂÄÄÂÄÄÂÄÙ    ³        R7<ÄÙ   ³       ³     ³

            ³      ³  ³   ³  ÀÄÄ´      g         ³      ³       ³     ³

            ³     C4 C5   ³     ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÁÄÄÄÄÄÄÁÄÄÄÄÄÄÄÙ     ³

            ³      ³  ³   ³    C6                                     ³

            ³      ³  ³   ³     ³                                     ³

            ³      g  g   g     g                                     ³

            ³                                                         ³

            ÀÄÄÂÄÄÄÄÄÂÄÄÄÄÄÄÄ¿                                        ³

              R11    ³      R12   ÚÄÄÄ¿                               ³

         ÚÄÄ¿  ³     ³       ³    ³   v                               ³

         v  ³  ³  ÚÄÄÅÄÄ¿    ÃÄÄÄÄÁÄÄR13ÄÄ¿                           ³

    ÚÄÄÄR10ÄÁÄÄ´  ³  ³  ³    ³            ³                           ³

    ³        ÚÄÁÄÄÁÄÄÁÄÄÁÄÄÄÄÁÄÄÄÄ¿       ³                           ³

    ³        ³ 1  4  14 10   13   ³       ³                           ³

    ³        ³                   8ÃÄÄÂÄÄÄÄ´                           ³

    ÃÄÄÄÄÄÄÂÄ´6                   ³  ³   C12                          ³

    ³      ³ ³                  12ÃÄÄÙ    ³                           ³

    ³      ÀÄ´2    IC2 556        ³       ³                           ³

   C7        ³                    ³       g                           ³

    ³     ÚÄÄ´3                 11ÃÄÄÄÄÄ¿                             ³

    ³     ³  ³    7   5   9       ³     ³                             ³

    g    C8  ÀÄÄÄÄÂÄÄÄÂÄÄÄÂÄÄÄÄÄÄÄÙ    C11                            ³

          ³       ³  C9  C10            ³                             ³

          ³       ³   ³   ³             g                             ³

          g       ³   ÀÄÂÄÙ                                           ³

                  g     ³                                             ³

                        ³            ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

                        ³            ³                 ³

                        ³           R14                ³

                        ³            ³           ³\    ³

                        ³            ³           ³  \  ³

                        ÃÄÄÄÄÄÄÄÄÄÄÄÄÅÄÄÄÄÄÄÄÄÄÄÄ³3   \³

                        ³            ³           ³    7 \

                       C13          R15          ³IC3     \

                        ³            ³           ³741    6/ÄÄÄÄÄÄ¿

                        ³            ³           ³    4 /        ³

                        ³            ³           ³    /          ³

                        g            g        ÚÄÄ´2 / ³          ³

                                              ³  ³/   ³          ³

                                              ³       g          ³

                                              ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´

                                                                C14

                                                                 ³

                                                              Speaker

                                                                 ³

                                                                 g

point,

                      Schematic part variables list.

                      ------------------------------

Resistors

---------

R1 - 10k   R2 - 10k   R3 -4.7k    R4 - 10k   R5 - 10k   R6 - 50k

R7 - 50k   R8 - 50k   R9 - 50k    R10- 20k   R11- 10k   R12- 10k

R13- 20k   R14-100k   R15-100k

Capacitors

----------

C1 - 0.01uf   C2 - 1N914 switching Diode   C3 - 1.0uf   C4 - 0.01uf

C5 - 0.01uf   C6 - 10uf   C7 - 0.01uf   C8 - 0.01uf   C9 - 0.01uf

C10 - 0.01uf   C11 - 0.01uf   C12 - 0.01uf   C13 - 0.01uf   C14 - 10uf

Switches

--------

S1 - SPST toggle

S2 - Momentary push button N.O. labeled "Deposit"

S3 - 3-position rotary switch

Miscellaneous

-------------

g - Ground

@q - Label "quarter"

@d - Label "dime"

@n - Label "nickle"

Typed up by Sine Wave from an article which originally appeared in 2600

magazine. The original contained several mistakes in the schematic

drawing which i've corrected. Hope this information enlightens you to

new and exciting possibilities via your local phone booth.


rock
                           A Shadows of IGA Production...

   ({})({})({})({})({})({})({})({})({})({})({})({})({})({})({})({})({})({})({})

   ({})                ___     __                                          ({})

   ({})  Introducing:   | |_| |_    _ _______    _____    ____             ({})

   ({})                 | | | |__      |     \  /     \  /    \ |  _/      ({})

   ({})                             _ _|_____/  |     |  |      |_/        ({})

   ({})({})({})({})({})({})({})({})    |   \    |     |  |      | \_       ({})

                               ({})    |    \   \_____/  \____/ |   \      ({})

                               ({})     _ _______    _____  _    _         ({})

                               ({})        |     \  /     \  \  /          ({})

                               ({})     _ _|_____/  |     |   \/           ({})

                               ({})        |     \  |     |   /\           ({})

                               ({})     _ _|_____/  \_____/ _/  \_         ({})

                               ({})                                        ({})

                               ({}) Created & Designed By Video Vindicator ({})

                               ({})                                        ({})

                               ({})({})({})({})({})({})({})({})({})({})({})({})

  INTRODUCTION

  ------------

    And now for all you basement engineers... Here's the ROCK BOX!  Basicly what

  the Rock Box does is channel the music from the stereo out to the phone line

  via the headphone output.  There are two models to this Box, the Basic Box

  and Advanced Box.  I would recommend the Advanced Box for better sound

  quality, although the Basic one get's the job done.  Well... Enough for the

  formalities, now for the Advanced Box!

              Identification   Materials        Specification

              --------------   ---------        -------------

              A                1 Resistor       (Brown-Black-Red-Silver)

              B                1 Resistor       (Orange-Orange-Orange-Gold)

              C                1 Resistor       (Gold-Red-Red-Grey)

              D                1 Resistor       (L.Green-D.Green-Brown-Gold)

              E                1 Resistor       (Brown-Red-Red-Gold)

              F                3 Condensators   (1070 (50v))

              G                4 Condensators   (1002 (40v))

              H                1 Condensator    (1060 (16v))

              <*> (Also S)     2 Switches       (2-Channel)

              ?#? (Also K)     1 Transformer    (LUN5250B)

              ~o~              1 LED Light      (Optional)

              J                Junction

                         Wiring Diagram -Advanced

          Switch for Volume Hi/Lo    Switch for Power On/Off

          _______________________________________________________________

         |                                        +---------+            |

         | +-----------+  C-B-A           +-------+  J   J  +--------+   |

         | |  S-S-S-O  |    |       +-S-S | S--------+   +---------> >   |  IN

         | |           |    |       |     +-S+  O    +-------------> >-+ |<LINE

         | +O S S-S+   |    |   O   | S-S    +----------------------+  | |

         | |  |    |   C    |       |   +------G-G   J+  J--------O |  | |

         | |  |  O-+   |    | +C    |                 O---------+ | |  | |

         | |  +-+  |   O B  | |  G  +----------G-G      G+      | | ++ | |

         | |    ++ |     |  F | FG                    O-G+      | |  | | |

         | <  O  | |    O+    +-------+ O    +-----+  |         | | O+ | | OUT

         |    | D+ E--O  |            O------+  K  +O O         | > >+ | |<LINE

         | +--+    |     +----------O      +----+               |      | |

    IN   | |       |   F   F--H----------~o~                    +--> >-+ |

   FROM  |<|  +----+   F      H                                          |

  STEREO>| |  <        |   F-----------O-----KKK          KKK            |

         | +------D--E-+                     ?#?      K   ?#?            |

         |_______________________________________________________________|

                                 Wiring Diagram -Basic

                           ___________________________________

                          |                                   |

                          | <------+    F--KKK--H       +---> |

                          |        |    |  ?#?  |      +----> | OUT

                     IN   | <------*----+       +------*      |<LINE

                    FROM  |        |                   +----> |

                   STEREO>| <------+                    +---> |

                          |___________________________________|

    Now some of the Benifits of this wonderful little device is that you can

  record conversations, at whatever volume you want, without those bothersome

  beeps the answering machines make.  Or another fun thing is call up a Rodent

  Bridge and blast this thing with your stereo at full... Wala!  The bridge

  will most likely be clear, even they won't sit through that shit.  It is a

  good idea to hit Radio Shack for a project box and soderless curcuit board,

  because this can be messy and a project box can easily make you look like a

  pro.  One more use for it is if your computer can generate tones to match a

  Box of some sort, this makes a GREAT amplifier for it, with almost no loss in

  clearity.  If you have any problems with a humm or it intercepting radio

  transmittions, then call up good-old Bell and get a line static clearer dealy

  and splice that into the box via the outgoing line, which SHOULD clear it up.

  If that does not seem to help, try putting a 9v battery (you know, the square

  ones) on the red and green phone lines, because this will make up for the

  power the box drains from the line.  Hope you enjoy the plans and Be watching

  for more from me!  L8r...

                                                  The Video Vindicator


scarlet
  [/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/]

   [                                   ]

   [        Scarlet box plans          ]

   [        -----------------          ]

   [  A High Mtn Hackerz Presentation  ]

   [                                   ]

   [  Written & Created by: THE PIMP   ]

   [                                   ]

   [      Call these cool Systems:     ]

   [                                   ]

   [(Maharaja's Hi-Times 10meg C/F BBS)]

   [      |x x x - x x x - x x x x|    ]

   [                                   ]

   [     (The Stash 10 meg BBS C/F)    ]

   [      |x x x - x x x - x x x x|    ]

   [                                   ]

   [/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/]

     The purpose of a Scarlet box is to create a very bad

  conection, it can be used to crash a BBS or just make life

  miserable for those you seek to avenge.

  materials: 2 aligator clips, 3 inch wire, or a resister

  (plan wire will create greatest amount of static)

  (Resister will decrease the amount of static in porportion to

  the resister you are useing)

  Step (1): Find the phone box at your victims house, and pop the cover off.

  Step (2): Find the two prongs that the phone line you wish to

            box are connected too.

  Step (3): Hook your aligator clips to your (wire/resister).

  Step (4): Find the lower middle prong and take off all wires

  connected to it, i think this disables the gound and call

  waiting and shit like that.

  Step (5): Now take one of the aligator clips and attach it to

  the upper most prong, and take the other and attach it to the

  lower middle prong.

  Step (6): Now put the cover back on the box and take off!!

     **       ########      **

     **       # #### #      **

              ########       /

              # #### #      /

              ########     /

                          /

                         /

                        /

                       /

                      /

                     /

                    /

                 **/

                 **

     **                    **

     **                    **

  (**)= prongs

   **

  (/) = (wire/resister)

  (##)= some phone bullshit

    Created by (The Pimp)

)


silver
                      The Plans For Contructing

                             A Silver Box

                        Uploaded by Elric of Imrryr

                        Lunatic Labs R&D Division

                        Written by:Unknown

Howto build a SILVER box:

Toolsand materials :  Soldering Iron, Solder, Some 22 ga.

wire,a SPDT switch, and a screwdriver.

1)Unscrew your phone (must be a touch tone, desk type)

2)Remove the mounted pad and take the clear plastic cover from

thebottom.

3)Hold the pad with the numbers 0, *, # facing you, and turn

itupside down, so you can see the yellow pc board.

4)You should see 2 black round doughnuts.

5)Position the board so the solder points for the left

doughnut face you.

6)Count over four points from the left, and attach a (green)

wireto that point.

7)Between you and the doughnuts, there should be 2 long yellow

capacitors.  To the right of these, and on the edge of the

boardthere should be 3 gold contacts. We will use the one on

theleft.

8)The contact originally is spot welded, so snip it open.

9)To the one nearest you, attach a (red) wire to the other

one,a (yellow) wire.

10)Run the wires out of the phone, and solder the switch.

11)The orientation should be (red) to center. The switch will

nowalternate between normal and 1633hz fourth column tones.


silver2
              Silver Boxing

How to build a SILVER box:

Tools and materials :  Soldering Iron, Solder, Some 22 ga.wire, a SPDT switch,

and a screwdriver.

1) Unscrew your phone (must be a touch tone, desk type)

2) Remove the mounted pad and take the clear plastic cover from the bottom.

3) Hold the pad with the numbers 0, *, # facing you, and turn

it upside down, so you can see the yellow pc board.

4) You should see 2 black round doughnuts.

5) Position the board so the solder points for the left doughnut face you.

6) Count over four points from the left, and attach a (green) wire to that

   point.

7) Between you and the doughnuts, there should be 2 long yellow

capacitors.  To the right of these, and on the edge of the

board there should be 3 gold contacts. We will use the one on the left.

8) The contact originally is spot welded, so snip it open.

9) To the one nearest you, attach a (red) wire to the other one, a (yellow)

   wire.

10) Run the wires out of the phone, and solder the switch.

11) The orientation should be (red) to center. The switch will

now alternate between normal and 1633hz fourth column tones.

         SILVER BOX DOCUMENTATION

       (CONTRIBUTED BY LEX LUTHOR)

THE SILVER BOX TRANSFORMS KEYS 3,6,9,# TO A,B,C,D.

THOSE TONES STAND FOR:

"A"- FLASH

"B"-FLASH OVERRIDE (PRIORITY

"C"-PRIORITY COMMUNICATION

"D"-PRIORITY OVERIDE (TOP MILITARY)

THOSE KEYS ONLY WORK ON CERTAIN NETWORKS. NOW WHAT DO YOU DO WITH THOSE EXTRA

TONES??? CALL ANY LONG DISTANCE DIRECTORY BY DIALING (AREA CODE) 555-1212

AND WHILE IT RINGS PRESS THE # KEY THEN AS THE OPERATOR ANSWERS YOU WILL

DISCONNECT THEM INSTANTLY AND HEAR A PULSING TONE, PRESS 6(NORMAL TON

E) AND IT WILL STOP.THEN IF ANOTHER  PERSON DOES THE SAME THING ON ANOTHER

LINE AND THEN PRESSES 7 YOU SHOULD HAVE A VOICE LINK, 414 A/C IS GOOD FOR ONE

THAT YOU CAN SCREW AROUND WITH THE TONES AND SEE WHAT YOU GET.


silver3
               How to

          Build a SILVER BOX

=======================================

ATTENTION:

  BE SURE YOU KNOW HOW TO SOLDER!  THIS

COULD PERMENANTLY DAMAGE YOUR PHONE!!!

READ EVERYTHING BEFORE DOING ANYTHING!

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Ingreadients:

     1    Blue wire about 1 foot.

     1    Gray wire about 1 foot.

     1    Brown wire about 1 foot.

          (Better to overkill....)

     1    Single pole/Double throw

          (SPDT) switch. (Smallest

          you can find.)

     1    Standard bell phone.

Tools:

     1    Soldering Iron and Solder.

     1    flat-tip screwdriver.

     1    Very patcient person.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1:   Take the casing off your phone by

     loosening the two screws

     underneath it.  (Don't take the

     screws all the way off!)

2:   Loosen (But don't remove) the

     screws on the side of the touch-

     tone keypad. (The ones that attach

     it to the mounting bracket.) and

     CAREFULLY remove the keypad from

     the mounting bracket.

3:   You will notice a plastic cover on

     the keypad; seperate the two

     halves and get the out of your

     way. (Don't destroy them, you will

     need them later.)

4:   Now, look at the top of the pad

     (so the 123 row is facing away,

     and the *0# row is toward you.

     Turn over the keypad. You should

     see a mass of wires, gold plated

     contacts, discrete components, and

     two large doughnut shaped black

     thingies. (These are the coils hat

     make the touch-tone frequencies.

     All you are going to do is connect

     the wires that Ma Bell "Forgot"

     to.)

5:   Look at the coil on the left (with

     5 solder contacts facing you,

     rather than being perpendicular to

     you.) Count over 4 contacts FROM

     the left (or 2 conacts FROM the

     right) and solder the GRAY wire to

     the fourth post FROM the left.

6:   Solder the other end of the GRAY

     wire to the LEFT pole of the SPDT

     switch.

7:   (The point of no return)..........

     Take a look at the bottom edge of

     the keypad. You should see a row

     of three gold plated contacts (to

     the right of two very large

     capasitors) look at the one on the

     left and GENTELY seperate the two

     touching connectors (They are

     soldered together with a drop of

     solder) and spread them apart.

8:   Solder the brown wire to the top

     contact (The one futhest from

     you), and solder it to the RIGHT

     pole of SPDT switch.

9:   Now, take the blue wire and solder

     it to the bottom (Closest)

     contact.  Solder the other end of

     this wire to the CENTER pole of

     SPDT switch.

***************************************

                 DONE

***************************************

10:  Now put you phone back together.

     (To make it look professonal, make

     a hole in the plastic top of your

     phone and stick the SPDT switch

     through it.

  Now, (Hopefully) when the switch is

in on position you will have a normal

phone and when it is in the other

position the 3, 6, 9, and # keys (Which

are now the A, B, C, and D keys) will

magically produce the SILVER BOX TONES!

     Have Phun and Happy Phreaking,

               Agrajag

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Brought to you by:

     AGRAJAG and

          -=%> The Hitchhikers <%=-

               Bring your towel

---------------------------------------

===================================

             USING A

           SILVER  BOX

-----------------------------------

  First off, a silver box adds the

four extra tones to your phone that

Ma Bell never told you about. They go

like this:

               1  2  3  A

               4  5  6  B

               7  8  9  C

               *  0  #  D

  There used to be many places were

you could use SILVER BOX tones, but

now you can only use it in places were

Ma Bell hasn't gotten around to

replacing here old switchboxes,

(4A), or on Autovan.

  Autovan is a special military phone

line, like a mass of private lines

hooked together (I think, but I'm not

sure).

  To see if a specific area has the

old 4A switchboxes try this test:

  Call up there directory assistance by

using XXX-555-1212, (Where XXX is

the area code you are check out. Now

hold down the "D" key as soon as you

finish dialing. (If you are using the

SILVER BOX that I showed you how to

make; Switch to SILVER BOX tones

and hold down the "#" key.) The phone

should start ringing and the operator

will answer.

  If the operator screams at you to

stop pressing your keypad, then hang

up and try a diffrent areacode. (This

one does not work.)

  If you get a pulsing tone the you got

a good line! Now try out different

numbers. 6 and 7 usually form a loop

line and two people with SILVER

BOXES can talk. But some of these

are whatched, so DON'T say anything

you wouldn't want your mother to

hear!

  I have heard the 213 works but is

being watched. Try out of the way

states like Iowa, Monatana, Wyoming,

ect...

               Have Phun,

                Agrajag

-----------------------------------

Brought to you by:

       Agrajag and

         -=%> The Hitchhikers <%=-

===================================


silver4
_______________________________________

 _______________________________________

 _

                       There May be

 Gold in That Silver Box

                       Written By

 Doctor Cypher on 09/09/88

                    A Telecom Computer

 Security Bulletin File

                        Volume One,

 Number 1, File 2 of 12

 _______________________________________

 _______________________________________

 _

          Little has been documented

 about the use of the silver box.

       Many assume a silver box is just

 a set of Autovon keys, or more

       advanced readers may be familiar

 with its use in conjunction with

       the standard Directory

 Assistance ACD (Automated Call

 Distributor

       which distributes the calls to

 the individual Directory Assistance

       operators) but in reality there

 are several applications to the

       hidden row than meets the eye.

          I will not explain the

 construction methods here, for they

 are

       widely available on many

 telecom-oriented bulletin board

 systems,

       but rather go into detail about

 using them.

      The ACD and DA operators:  The

 ACD can be reached through calling

      ------------------------   a

 Directory Assistance operator and

      holding down the D key (941+1633

 Hz) while the operator answers

      her console, the tone will trip

 the circut and drop you into the

      ACD.  One way to verify that you

 have tripped the circut is a

      Stutter-tone, or pulsing

 dialtone.  From this prompt, you can

 dial

      up to 10 possible functions:

       1 - Rings the Toll Text board -

 Useful if you dont have the

           numbers on file.

       2 - Sometimes dead circut, other

 times milliwatt test.

       3 - Sometimes milliwatt test,

 others 1000/1004 Hz tone.

       4 - Usually dead circut

       5 - Always dead circut

       6 - Low end of loop - If your

 friend calls the ACD on the same

           op. as you do, and dials 7,

 you are connected.

       7 - High end of loop.

       8 - 600 ohm termination

       9 - Usually dead circut

       0 - Usually dead circut

         Notes:  If you are having

 trouble with this method, try the 414

       DA operator.  It never fails,

 but the dial tones will sound more

       like a busy signal than a dial

 tone.

          No 'Codes'?  Well, if your

 friend lives in the same state,

       arrange to meet on the

 800-555-1212 ACD (functions: 6,7.)

       Autovon Tone Set:  The silver

 box keys also appear on the standard

       ----------------   Autovon (the

 military phone network) keypad.

       The functions are as follows:

       A - Flash

       B - Flash Override (Priority)

       C - Priority Communication (dial)

       D - Priority Override (used to

 reach busy numbers in extreme

           emergencies.  When the tone

 is hit, I believe a flag is

           set as an emergency

 condition, and only for top military)

       To use the Autovon keys, scan

 for your local  Milnet or Autovon

 port.

       All numbers are 7 digits (for

 those of you who insist on trying

 this,

       please take the proper security

 measures.)

        Centegram hacking:  Yes, your

 silver box can also be used for

        -----------------   hacking

 earlier versions of Centegram.  While

        hacking the system

 administrators box and entering an

 invalid

        code, the system will attempt

 to log you off, but hit 'C' and

        feast your ears on 'Welcome to

 the message center...'  Another

        use in Centegram hacking is

 when you are entering an auth. code,

        it will recognize A, B, C, and

 D as valid digits for added

        security.

       (Special thanks goes out to

 Phiber Optik for the help with ACD

             and Felix the Hack for the

 Centegram information.)


silver5
 ***************************************

  *            How to make a            *

  *         Portable Silver Box         *

  *                                     *

  *          By:                        *

  *              The                    *

  *                Phone                *

  *                    Phantom          *

  *                                     *

  ***************************************

    This will tell you how to make a

  portable silver box out of:

         A Radio Shack touch tone pad

         Some wire

         A Soldering iron

         And a SPDT switch

  NOTE: You should have an I.Q. above room tempature before

  attempting this.  Also, read all of this article before

  starting.

  WARNING: This may be hazardous to your freedom.

  1} Take off the plastic cover that stores the batteries and

  remove the screw that is in the center of the batteries. Now use

  a screw driver to pry open the box.

  2} Now you should have the two halves in your hands. On the side

  that has the circuit board, it should be held by two clips.

  Remove the circuit board now.

  3} You should now be able to see the back side of the keypad.

  Connecting the the key pad and the circuit board is a ribben

  cable. With the ribben ends connected to the keypad away from

  you, count from the left over four wires.  On the fourth wire,

  take and cut the plastic on either side on the wire.  Then

  desolder it.

  4} Now stare at the circuit board. Look at the connections of

  the chip.  (SEE FIG.) There should be four pins not connected to

  anything. On the ninth pin (first row, first pin) solder a 3

  inch wire to it. The other end goes to the left side of the spdt

  switch.

  5} Go back to the cable. Solder a 2 inch to the ribben cable you

  just took out. This is because it won't reach the switch. The

  other end goes to right side of the switch.

  6} Now take a two inch wire and solder it to the hole that the

  cable came out of. Becareful not to get solder on the other

  wires. Now take the other end and solder it to the middle of the

  switch.

  7} Make a hole in the top of the case to put the switch through.

  And put it back together.

  THE FIGURE OF THE CHIP.

  THE PIN >9< 10 11 12 13 14 15 16

           1  2  3  4  5  6  7  8

  (Pretty cool eh?)

  _______________________________________

  Switch the switch left according to the way you soldered it to

  make silver box tones on the 3,6,9, and # keys.  Switch it to

  the right for a normal key pad.  Switching it to the middle does

  NOTHING!!!!

  This silver is small enough to fit in your pocket for phreaking

  at your nearest pay phone or where ever.

  This file is for information only (RIGHT!) ha ha ha!

  Written by:

              The

                Phone

                    Phantom


SocEng
THE COMPLETE SOCIAL ENGINEERING FAQ!

"There's a sucker born every minute." PT Barnum

"Don't touch me, sucka." Mr. T

By bernz (official sponsor of the 1996 Croatian Olympic Men's Synchronized Swimming Team)

with shoutouts to: The Genocide2600, Silicon Toad and your big fat mama.

DISCLAIMER!!!!! THIS INFORMATION IS HERE FOR THE SOLE PURPOSE OF

ENLIGHTENMENT! IF YOU USE IT AND GET CAUGHT, NO ONE IS TO BLAME BUT

YOUR OWN IDIOTIC ASS!!!

SECTION I: INTRO

1.1 What is social engineering?

1.2 Why is there a FAQ about it?

1.3 Who cares?

1.4 Basic intro and other shit.

SECTION II: PHONE SOCIAL ENGINEERING

2.1 Basics

2.2 Equipment

2.3 Phreak stuff

2.4 Technique

SECTION III: SNAIL MAIL

3.1 Is Snail Mail acutally usefull for something?

3.2 Equipment

3.3 Technique

SECTION IV: INTERNET

4.1 Isn't this just hacking?

SECTION V: LIVE, FROM NEW YORK...

5.1 In person?

5.2 Equipment

5.3 I'm wearing a suit, now what?

SECTION VI: PUTTING IT TOGETHER

A sample problem

1.1 What is social engineering?

     The hacker's jargon dictionary says this:

Social Engineering: n.  Term used among crackers and  samurai for cracking

techniques that rely on weaknesses in  wetware rather than software; the aim

is to trick people into revealing passwords or other information that

compromises a target  system's security.  Classic scams include phoning up a

mark who has  the required information and posing as a field service tech or a

fellow employee with an urgent access problem.

     This is true. Social engineering, from a narrow point of view, is

basically phone scams which pit your knowledge and wits against another human.

This technique is used for a lot of things, such as gaining passwords,

keycards and basic information on a system or organization.

1.2 Why is there a FAQ about it?

     Good question. I'm glad I asked. I made this for a few reasons. The

first being that Social Engineering is rarely discussed. People discuss

cracking and phreaking a lot, but the forum for social engineering ideas is

stagnant at best. Hopefully this will help generate more discussion. I also

find that social engineering specialists get little respect, this will show

ignorant hackers what we go through to get passwords. The last reason is

honestly for a bit of Neophyte training. Just another DOC for them to read so

I don't get bogged with email.

1.3 Who Cares?

     To Neophytes: You should, you little fuck. If you think the world of

computers and security opens up to you through a keyboard and your redbox then

you are so fucking dead wrong. Good. Go to your school, change your grades and

be a "badass" hacker. Hacking, like real life, exists in more than just your

system. You can't use proggies to solve everything. I don't mean to sound

upset, but jesus, have a bit of innovation and a sense of adventure.

     To Experienced Hackers: Just thought it would help a bit.

1.4 Basic intro and shit for this document.

     This FAQ will address phone techniques, mail techniques, internet

techniques and live techniques. I will discuss Equipment and will put some

scripts of actual conversations from social engineering. There are times I

might discuss things that cross the line into phreaking or traditional

hacking. Don't send me email and say that my terms aren't correct and

blahblahblah isn't social engineering. I use them for convenience and lack of

better methods of explanation (eg I might say "dumpster diving is a form of

social engineering") Don't get technical.

SECTION II: PHONES

2.1 Basics

     This is probably the most common social engineering technique. It's

quick, painless and the lazy person can do it. No movement, other than fingers

is necessary. Just call the person and there you go. Of course it gets more

complicated than that.

2.2 What Equipment is necessary for this?

     The most important peice of hardware is your wetware. You have to have a

damn quick mind. As far as physical Equipment goes, a phone is necessary. Do

not have call waiting as this will make you sound less believeable. There is

no real reason why this does but getting beeped in the middle of a scam just

throws off the rhythym. The phone should be good quality and try to avoid

cordless, unless you never get static on them. Some phones have these great

buttons that make office noise in the background.

     Caller ID units are helpful if you pull off a scam using callback. You

don't want to be expecting your girlfriend and pick up the phone and say, "I

wanna fuck you" only to find out it was an IBM operator confirming your

identity. Operators don't want to have sex with you and so your scam is

fucked. Besides, call ID units are just cool because you can say, "Hello,

<blank>" when someone calls. The Radio Slut carries these pretty cheap.

     Something I use is a voice changer. It makes my voice sound deeper than

James Earl Jones or as high as a woman. This is great if you can't change your

pitch very well and you don't want to sound like a kid (rarely helpful). Being

able to change gender can also be very helpful (see technique below). I got

one for a gift from Sharper Image. This means that brand will cost quite a bit

of cash, but it's very good quality. If anyone knows of other brand of voice changers, please inform me.

2.3 Phreaking and Social engineering?

     Social Engineering and phreaking cross lines quite a lot. The most

obvious reasons are because phreaks need to access Ma Bell in other ways but

computers. They use con games to draw info out of operators.

     Redboxing, greenboxing and other phreaking techniques can be used to

avoid the phone bills that come with spending WAAAAYYY too much time on the

phone trying to scam a password. Through the internet, telnetting to

california is free. Through ma bell, it's pricey. I say making phone calls

from payphones is fine, but beware of background noise. Sounding like you're

at a payphone can make you sound pretty unprofessional. Find a secluded phone

booth to use.

2.4 How do I pull off a social engineering with a phone?

     First thing is find your mark. Let's say you want to hit your school.

Call the acedemic computer center (or its equivelent). Assuming you already

have an account, tell them you can't access your account. At this point they

might do one of two things. If they are stupid, which you hope they are, they

will give you a new password. Under that precept, they'll do that for most

people. Simply finger someone's account, specifically a faculty member. At

this point, use your voice changer when you call and imitate that teacher the

best you can. People sound different over the phone, so you'll have a bit of

help.

     Try to make the person you're imitating a female (unless you are a female). Most of the

guys running these things will give anything to a good sounding woman because the majority of

the guys running minicomputers are social messes. Act like a woman (using voice changer) and

you'll have anything you want from them.

     Most of the time the people working an area will ask for some sort of

verification for your identity, often a social security number. You should

find out as much information about a mark as you can (see mail and live

techniques) before you even think about getting on the phone. If you say you

are someone you aren't and then they ask you for verification you don't have,

they will be suspicious and it will be infinitely more difficult to take that

system.

     Once again for idiots: DO NOT TRY TO SOCIAL ENGINEER WITHOUT SUFFICIENT

INFORMATION ON YOUR MARK!

     Once people believe you are someone, get as much as you can about the

system. Ask for your password, ask for telnet numbers, etc. Do not ask for too

much as it will draw suspicion.

     You must sound like a legitimate person. Watch your mark. Learn to speak

like him/her. Does that person use contractions? Does that person say "like" a

lot? Accent? Lisp?

     The best way for observation of speech is to call the person as a

telemarketer or telephone sweepstakes person. Even if they just tell you they

can't talk to you, you can learn a quite a bit from the way they speak. If

they actually want to speak to you, you can use that oppurtunity to glean

information on them. Tell them they won something and you need their address

and social security number and other basic info.

WARNING: ABUSING SOMEONE'S SOCIAL SECURITY NUMBER IS ILLEAGAL!!!

DON'T SAY YOU WEREN'T WARNED!!!

SECTION III: SNAIL MAIL

3.1 Is snail mail really useful?

     Yes. It actually is. Snail mail is not tapped. Snail mail is cheap. Snail mail is readily available.

But how can you use it in social engineering. As I said above, it's difficult to find systems that just

let you call with no verification. They do exist but they are rare. So therefore you need info on

your mark and the mark's system. You can try the telemarketing scam, but that isn't always

succesful, as people do not trust telemarketers. For some reason, though, people trust the written

word. Morons. People will respond to sweepstakes forms with enthusiasm and will give you

whatever info you want on it. That's why snail mail is so great.

3.2 What do I need?

     Obviously you need mail "equpiment" which includes stamps and envelopes. But subtle

things are required as well. You're going to want to have return address stickers that include

"your company's" logo and name. This can be procured at places like Staples, Office Max and

other stores for a realitively cheap price.

     The most important part to mail social engineering is a layout program. WordPerfect is

okay, but I prefer QuarkXpress or PageMaker. These programs are not cheap, but can be used for

plenty of other applications and are well worth their price. IF YOU GET IT PIRATED, I DON'T

ADVOCATE THAT ACTION. With these DTP programs, you can emmulate a tottaly

professional document. More about this below.

     A private mailbox is good. If you want to be very professional, get a PO box. I'm in a

band, so I use that PO box. They can be rented at a variety of places, including Post Offices and

MailBoxes, etc. for low fees. Share the cost with others for great cost effectiveness.

3.3 I've got the stuff, now what?

     What is your mark? Generally, for a mail social engineer, your mark is going to be a large

group of people. Thus, your mail should look like a mass mail sweepstakes. Use computer labels

and the like to keep this illusion. You need a list of employees from that company and their

addresses.

     Look at the junk mail in your mail. Sweepstakes forms, mail-in orders, etc. Try tofake

that look. Something with very few lines to fill in (but with your vital info on them). A watermark

is always a good touch for these documents. Use the fonts a business would use and word your

letters in a similar fashion. Illusion is everything. The information on these should include social

security numbers. Another good idea is to say that you'll need a password to verify the prize with

a voice call. Hopefully it'll be the same as their net account password. It usually is. Yes, people

actually fall for this stuff.

     To make someone fill these out, they must be concise and visually appealling. A person

filling these out cannot be hasseled with difficult choices. Check Boxes are also a nice effect.

These must look believeable. Credibility is everything with social engineering. I cannot stress that

enough. I will soon realease examples, although you should be original and make some on your

own.

     Now, after stamping and addressing your letters, send them out and wait. Soon you

should receive some answers. At this point, use a standard phone social engineering. Social

Security numbers are the most common verification. If you find that you need some other form,

send out letters with that information. For example, sometimes mother's maiden name is used.

SECTION IV: INTERNET

4.1 Isn't this just a form of hacking?

     I guess it is to a point. Hacking takes more advantage of holes in security while the social

engineering takes advantage of holes in people's common sense. Finding your marks through a

hole in the fingering system is a great way to start an engineer. Many fingers give full names last

logins, login locations and all sorts of info. Find someone who hasn't been on in quite sometime.

     There are also the classic schemes. Pretending to be a sysop in an IRC or online chat room

can make people give up passwords with ease.

     Yes, generally actions taken in the Internet or online are considered traditional hacking,

but your knowledge of the average human's wetware comes into play.

SECTION V: LIVE, FROM NEW YORK...

5.1 In person?

     Yup. This is pretty damn important. You can do quite a bit over a phone or through mail,

but sometimes you just have to get off your ass and do things yourself. Getting a password

digging through a desk is good, so is touring an office and just looking around. Even conning

your way into a terminal works.

5.2 Equipment

     This is the only time in hacker culture where looks matter a great deal. Don't expect to

walk into VIACOM's offices wearing your Misfits T-shirt with lotsa zits and your walkman

makes you look suspicious. Look dignified. Wear a suit. Comb your hair. Don't get out of hand.

Be polite. If you want to look like you belong in that office, you should act that way, too. So you

need a suit. If you weigh more than 200 lbs (and are under 6' 2") or look like you're 20 or

younger, don't try this. You'll look dumb, be laughed at and possibly have security called on you.

You can look like an office worker's kid if you're that young. If you can do this, go ahead. Most

of us can't.

     Fake ID security cards (the kind that aligator clip to a belt or something) can be made with

a photo, a layout program and a lamination sheet. This just makes you look more official.

Sometimes one of this stick on visitor patches can be helpful. They make you look like your

unnatural observation is warrented by your visiting status.

5.3 I'm sweating in this suit..now what?

     Walk into an office building with confidence. Flash your badge or just have your visitor

tag. Pretend you really belong there. That's how you look. An office with cubicles is great. Just

walk around and peer at people's belongings. Find the company's UNIX minicomputer. They

tend to keep them behind a big plate glass window, so you can check out how its connected. This

is good scouting without having to sift through dumpsters or watching through binoculars. DO

NOT TRY TO HACK WHILE IN THE BUILDING!  IT'S PRETTY SUSPICIOUS LOOKING!

SECTION VI: PUTTING IT TOGETHER

     You want to see what your school's minutes are or you want to hack a local chemical

company to see their new toxins, but even if you had access it would be problematic to access the

passwords because they are running a VAX. Now what?

     First you get a list of employees. For schools, just use the catalog. For companies, use a

live engineering technique. Look for payroll sheets, or posted employee lists. If you look right,

you can just ask a low level employee for a list. Remember, be calm in front of people. You have

to maintain your credibility.

     Finger each employee's account. Find out who has or hasn't used their account in the past

few months. Those who haven't are your marks. Write those names down cause your gonna play

them for all they are worth, goddammit.

     Now we go to the phone book and get the employees addresses. Then we create a

document in our DTP program that emmulates a short sweepstakes form or another short

document commonly encountered in the field. It must look professional but subtle enough not to

look false. Credibility once again. Remember to include the social security number space as well

as other information. Send these out and wait or masturbate or whatever you do for a few days.

Yes, you're going to have to spend $10 on stamps unless you are on good terms with who you

engineered in person. If they trust you, go back and use the stamping machine..might as well.

     Now get your phone and call their sysadm. Use women voices first because the guys that

run these machines have rarely seen daylight, let alone women. They are EASILY manipulated

with a woman's voice. Sound helpless, they love it. If they don't give you your password, you'll

have plenty of info for them for verification. If you pretend to be a woman, they'll give youplenty

of leway. Go as far as saying you've seen them at work and think they are cute. Watch the

passwords fly.

     That's it. Once you're in, do what you do..i can't help you from here.

Any questions? Email bernz at bernz@ix.netcom.com


static
 ==============================================================================

=

  The Static Box

Created and Brought to You by: The Usurper and The Raver

  ------------------------------------------------------------------------------

-

  We were looming at the Aqua Box plans and we saw something about static on

  long-distance calls in the file.  It said that you get static because the

  voltage is not getting regulated very well.  So why not have a box that keeps

  the voltage regulated so that you can avoid static?  This would be very useful

  when calling a BBS with an extender that flakes-out and gives you garbage on

  the screen.  So here it is...

  * Note: These are our first box plans with schematics, and electronics that I

          made, so bear with me.  And yes, this has been tested.

                                   EQUIPMENT

  1. (2) Size 'AA' Batteries, and holder (You could use a adapter, so you won't

         have to buy batteries...ex. A 3,6,9,12 volt adapter in one!)

  2. (1) Two fone line connector (Has two plugs from one)

  3. (1) Modular plug w/6 inches of colored wire connected.

  4.     2 feet of telephone wire

  5. (1) 100k Resistor

  6.     Soldering Iron

  7.     Solder.....get all of this at Radio Shack of course!

                                    SCHEMATIC

                                                            __________  Two-way

                                             Static box -> |  Plug 1  \  plug

                                                           |___________\

                                               Telephone ->  |  Plug 2 |__\__

                                                             |_________|_____|

                +---------------Green-wire F/plug----+__\__

                |                                     _____|

            +---|-------\/\/\----Red-wire F/plug-----+              |   |        100k                      Modular plug

         ___-___+___   resistor

        |  _______  |

        | | - | + | |

        | | t |1.5| |

        | | l | V | |

        | | o | o | | <- I reccomend 3 volts for most connections.

        | | V | l | |

        | |1.5| t | |

        | |___|___| |

        |___________|

                                   INSTRUCTIONS

  Have your phone connected to one of the plugs, then if you want to use the

  Static box plug it into the other one and put the batteries in the case.  That

  will remove static.  This will be useful in using 2400 baud on an extender

  (because of shitty lines).  You may want to make the voltage 9 volts, with a 9

  volt battery holder.  What the hell, make two, one for 3 volts (Normal stuff),

  and one for 9 volts (Special connections like 2400 baud on a extender).  Be

  sure not to leave it hooked up, because it may make your phone act funny, and

  people may not get calls through!  You could use even a bigger voltage, an use

  it as "Lock 'n Trace", and make some asshole squirm!

  NOTE: This is the second release of this file.  A few slight modifications to

        the file structure had to be made.  Originally released on 11/21/86.

        The new release date is 12/27/87.  Merry Christmas, have a nice day, and

        don't forget to fuck your sister for us, eh?  This has been a Lords of

        Twilight release... big fuckin' deal, eh?


tasi
   TASI (  Time    Assignment   Speech Interpolation ) is

  used on  satelite trunks, and basically  allows more than one

  person to use a  trunk  by  putting them on  while  the other

  person  isnt talking. Of  course,  you'd  never hear the other

  person talking on your trunk.

    When you start to  talk, however, the TASI controller  has to

  find  an  open trunk for you. Because  of  this,  some of your

  speech  is lost( because of the delay  in  finding  a  trunk)

  this  is called Clipping.

    Well,  if you were  transmitting data over  a  trunk,

  clipping  would really fuck up the data. So there is something

 called a TASI  Locking Frequency  which keeps the tasi from

  putting anyone else on your trunk or  you  on  anyone else's

  trunk. To use the TASI Lock, send it before the

  transmission.


urine
      /==:==:==:==:==:==:==:==:==\

       !      Urine Box Plans     !

       \==:==:==:==:==:==:==:==:==/

  Now at last, Underground_Elite brings you these ultrasophisticated box plans

  for, well, uh, I guess we just kind of bring them for you. After many months

  of keeping this puppy secret, we here at Underground_Elite have finally come

  to the consensus that the public oughtn't be kept in the dark from the wrath

  of Ma Bell, that great telephone company in the sky.

  The Urine Box (tm) basically creates a capacitative disturbance between the

  ring and tip wires in another's telephone headset. I have utilized this to the

  distinct advantage of the operator of the Urine box and to the disadvantage

  of the other party involved, hopefully you won't get caught.

  Without further a doo, wire this schematic together. Copper wire (or gold)

  will work best due to its lessened resistance. It might be a good idea to

  keep the wiring cooled, to further reduce current loss.

                47k ohms         ---------------         .01 uF

    !\    !------/\/\/-----------! SPST switch !----!------)!---------!

    ! \   !                      ---------------    !                 !

    !  !--!                                         !                 ! +

    !  !----------<-!-----!--------/\/\/------------!             ----------

    ! /         PVP diode !        470k ohms                      ! 12 VDC !

    !/                    !             _                         ----------

                          !            /          .005 uF             ! -

  SPKR 20W                !-------/\/\/\/\/---------)!----<-!---------!

                          !         _/ VR1 (see note1)    PVP diode   !

                          !                                           !

                      to RING                                      to TIP

                     (your phone)                                 (your phone)

  note1 - VR1 is a three position variable resistor, enabling settings

  equivalent to 100k ohms, 210k ohms, and 320k ohms (all 110k apart).

  note2 - The diodes are silicon-germanium based bipolar RF reducers to limit

  current polarity reversal. If these are placed backwards the box will not

  work as intended.

  note3 - The speaker will emit low tones when the SPST is closed (ie the box

  is "ON") and when the settings of VR1 are moved to higher resistance the tone

  level will increase.

  note4 - Place setting evaluation symbols to represet the lowest resistance

  setting for VR1 to be "STEAM", the second (210) to be "MELT", the third (320)

  to be "VAPORIZE".

  Usage of box.

  Use in place of your normal telephone receiver. Do not attempt usage as a

  regular phone. Call victim by sending tones through speaker with tape recorded

  noise. Use touch tone sounds as pulse requires electric disruption of line,

  not just audio. After answer (listen in on SPKR 1) set VR1 to desired strength

  and let her go. Victim will feel unpleasant sensations in his/her head and

  will undergo a series of high intensity seizures, not unlike epilepsy, and

  jointly proportional to VR-1 setting and time induced.

  Settings. (The Fun Part)

  STEAM. A short -poof- of water vapor condenses within the victim's earpiece,

         rendering the telephone short circuited and the victim quite dazed.

  MELT.  Causes structural phase change of receiver (usually reinforced

         ureaformaldehyde plastic material - high tech). This has the unpleasant

         bonus of removing the victim's hand.

  VAPORIZE. If the victim is particularly nasty, this setting will remove his

         upper anatomy (if box is enabled properly, that is!). Continued usage

         of this setting is generally not recommended, as death or other serious

         injury will accompany.

  Disclaimer.

  Yes, I will refuse to take responsibility for your incompetence in electrical

  doings. This includes my reluctance to give court testimony, etc. etc.

          Wolfgang von Albatross

          Attorney at Law, ex Telco employee.


violet
                               THE VIOLET BOX

                                --------------

    Picture the scene ..... a payphone in a rural or suburban area, where

    all the telephone wires are overhead ..... next to the phone box is a

    telegraph pole with only one wire going down it ..... no prizes for

    guessing where it goes to. It might at first sight look like a prime

    site for beige boxing. However, there are obvious disadvantages to

    beige boxing here, like getting caught ..... thus, the violet box was

    created. Basically it is a way of emulating some beige box functions

    without the actual beige box, but it does have the same requirement of

    needing physical access to the line. *WARNING* The person on the other

    end may very well twig you are using this device. Only phone people you

    can trust.

                                HOW TO MAKE IT

                                --------------

    Get a 470 ohm resistor and a pair of crocodile clips. Connect a

    crocodile clip to each end of the resistor. That's it. I was going to

    call this the "yellow, violet and brown box" but I decided that name

    was too long, so I'll stick to just violet, because it sounds nice.

                                HOW TO USE IT

                                -------------

    First, you need a beige boxing point that is not too far from the

    phone. Clip one leg of the resistor on, leave the other end for the

    time being. Lift the handset, put in your money and key the number. As

    soon as it starts ringing out, it's action stations! Clip the other

    side of the resistor on and dash back to the phone. Depress the

    receiver rest for a few seconds, then let go. The person on the other

    end might have answered while you were doing this, let's just hope they

    didnd't hang up ..... anyway, you're now ready to talk. BUT every few

    minutes the phone will go 'dead' for a few seconds ..... it won't cut

    you off though.

                                 HOW IT WORKS

                                 ------------

    When a phone is on the hook it has a high resistance to DC and so

    hardly any current flows through it. (but it has a low resistance to AC

    because AC is what makes the bell ring.) When it is lifted, it has

    quite a low resistance, actually about 600 ohms. The 470 ohm resistor

    connected across the line fools the exchange into thinking the handset

    was up the whole time. It has to be disconnected for dialling, because

    pulse dialling (which is the only sort that works from payphones) works

    by opening and closing the circuit to stop and start the flow of

    current, so if the resistor was connected there the current would never

    stop flowing, and no dialling pulses would be sent. When you connect

    the resistor, the exchange just thinks there are 2 phones on the line,

    it can handle up to 4 so it's no problem. Then you hang up the

    payphone, now the exchange thinks there is just one phone; when you

    lift the receiver again, the payphone is sitting across a line with

    something already happening, so it just lets you listen to this. Of

    course, after a while it decides it's had enough of that, and tries to

    cut you off. But it doesn't manage it, because the resistor is keeping

    the line in use. The phone may be able to ring the exchange and report

    the "fault" but it can't even do that until after you have disconnected

    the resistor and made a getaway .....

                               ALTERNATIVE USE

                               ---------------

    If you also have a beige box, and access to an enemy's phone wiring

    outside the house (eg. the wires from a telegraph pole) you might like

    to try this use for the violet box ..... this can SERIOUSLY do people

    over ..... beige box from their line to anything, but the more

    expensive and embarrassing the service, the better ..... Australian

    kinky sex lines? the mind boggles ..... anyway, stick the violet box

    on, disconnect the beige box and run like hell.

    Brought to you by ......  . ....   .  .  ... .....

                        :  :..: :..    :.' .:.......:.

                        :  :  : :...   : `. `... .:...

    disclaimer: this is for informational purposes only. no responsibility

    is accepted for any consequences of use or misuse of any information

    contained herein. any material whose source i have not acknowledged is

    believed to be my own - if it sounds like something you invented, just

    remember great minds think alike.


white
          WHITE BOX PLANS

FROM: THE PIRATE CLUB/1200

EDITED BY: CRACKER JACK

THIS ARTICLE WILL TELL YOU HOW TO

CHANGE A NORMAL TOUCH TONE KEYPAD AND

CONVERT IT TO A PORTABLE UNIT. IN

ADDITION, WE GIVE THE TOUCH-TONE

FREQUENCIES.

FIRST OF ALL, THE TONES MADE BY A

TOUCH TONE TELEPHONE ARE NOT SINGLE

TONES, THEY ARE A COMBINATION OF TWO

TONES, MAKING "DTMF" (DUAL TONE

MULTI-FREQUENCY). THE NORMAL TONE

TELEPHONE DIALS 12 DIFFERENT SIGNALS,

BUT IS CAPABLE OF DIALING 16 DIFFERENT

SIGNALS (SEE BULLETIN ON SILVER

THE POWER REQUIRED BY A KEYPAD IS

ABOUT 25 VOLTS, BUT THEY WILL WORK

WITH AS LITTLE AS 15, THEREBY ALLOWING

THE USE OF TWO 9- VOLT RADIO

BATTERIES.  AS YOU MAY HAVE GUESSED,

THEY ARE ALSO DESIGNED TO OPERATE WITH

A TELEPHONE TYPE SPEAKER (AND PHONE

LINE), AND NOT THE STANDARD 8-OHM

SPEAKER WHICH NEEDS TO BE USED FOR

ADEQUATE VOLUME.  TO ACCOMPOLISH THIS,

WE USE A MATCHING TRANSFORMER, THIS IS

ONE OF THOSE MINIATURE ONES AVAILABLE

AT RADIO SHACK.  ENOUGH OF THE THEORY,

NOW FOR THE

CIRCUIT.

YOU WILL NEED:

A MINIATURE 1000 TO 8 OHM

   TRANSFORMER (RADIO SHACK # 273-1380)

A STANDARD 8-OHM SPEAKER

TWO 9-VOLT RADIO BATTERIES

TWO 9-VOLT BATTERY CLIPS

A CASE TO PUT IT ALL IN (OPTIONAL)

A FEW CONSTRUCTION NOTES, I SUGGEST

THAT YOU SOLDER AND TAPE ALL

CONNECTIONS.  IT IS ALSO IMPORTANT TO

READ THIS ENTIRE BULLETIN BEFORE

ATTEMPTING TO CONSTRUCT THIS.

FIRST, CONNECT THE RED WIRE OF THE

TRANSFORMER TO EITHER TERMINAL ON THE

SPEAKER.  NOW CONNECT THE WHITE WIRE

FROM THE TRANSFORMER TO THE OTHER

TERMINAL ON THE SPEAKER.  NEXT,

CONNECT THE RED (POSITIVE) WIRE OF ONE

OTHER BATTERY CLIP.  NOW CONNECT THE

THE REMAINING RED WIRE ON THE SECOND

BATTERY CLIP TO THE GREEN WIRE FROM

THE TOUCH TONE PAD.  CONNECT THE BLUE

WIRE FROM THE TOUCH TONE PAD TO THE

ORANGE-AND-BLACK STRIPED WIRE FROM THE

TOUCH TONE PAD.  TO THESE TWO WIRES,

NOW CONNECT THE REMAINING BLACK LEAD

FROM FIRST BATTERY CLIP.  YOU HAVE NOW

FINISHED THE POWER CONNECTION TO THE

KEYPAD.  CONNECT THE BLACK WIRE FROM

THE KEYPAD TO THE BLUE WIRE ON THE

TRANSFORMER.  NEXT CONNECT THE

RED-AND-GREEN STRIPED WIRE FROM THE

KEYPAD TO THE GREEN WIRE ON THE

TRANSFORMER.  THE BLACK WIRE ON THE

TRANSFORMER SHOULD NOT BE CONNECTED TO

ANYTHING, ALONG WITH QUITE A FEW WIRES

FROM THE KEYPAD.  THE CONNECTION OF

HAVE TO DO IS CONNECT TWO NINE VOLT

BATTERIES TO THE BATTERY CLIPS, AND

YOU'LL BE READY TO GO. YOU MAY WANT TO

MOUNT IT IN A CASE FOR EASY

PORTABILITY. NOTE THAT THE SILVER BOX

MODIFICATION CAN BE MADE TO THIS UNIT,

ALLOWING COMPLETE REMOTE PHREAKING.

WHEN NONE OF THE BUTTONS ARE PRESSED,

THIS UNIT USES NO POWER, THEREBY

ELIMINATING THE NEED FOR A POWER

SWITCH, AND EXTENDING THE LIFE OF THE

BATTERIES.

THE FOLLOWING ARE THE FREQUENCY

COMBINATIONS GENERATED BY EACH BUTTON

ON THE

KEYPAD.

KEY     FREQ. #1        FREQ. #2

1       697             1209

2       697             1336

3       697             1477

A       697             1633

4       770             1209

5       770             1336

6       770             1477

B       770             1633

7       852             1209

8       852             1336

9       852             1477

C       852             1633

*       941             1209

0       941             1336

#       941             1477

D       941             1633

ALL FREQUENCIES ARE MEASURED IN HERTZ

NOTE THAT A,B,C AND D ARE NOT NORMALLY

PRESENT (EXCEPT FOR SILVER BOXES)


white2
                            White Box Plans

                         (Uploaded by The Mystic)

  This article will tell you how to change a normal touch tone

  keypad and convert it to a portable unit. In addition, we

  give the touch-tone frequencies.

  First of all, the tones made by a touch tone telephone are not

  single tones, they are a combination of two tones, making "DTMF"

  (dual tone multi-frequency). The normal tone telephone dials 12

  different signals, but is capable of dialing 16 different signals

  (see bulletin on silver boxes).

  The power required by a keypad is about 25 volts, but they will

  work with as little as 15, thereby allowing the use of two 9-

  volt radio batteries.  As you may have guessed, they are also

  designed to operate with a telephone type speaker (and phone

  line), and not the standard 8-ohm speaker which needs to be used

  for adequate volume.  To accompolish this, we use a matching

  transformer, this is one of those miniature ones available at

  Radio Shack.  Enough of the theory, now for the circuit.

  You will need:

  A touch tone keypad

  A miniature 1000 to 8 ohm transformer (Radio Shack # 273-1380)

  A standard 8-ohm speaker

  Two 9-volt radio batteries

  Two 9-volt battery clips

  A case to put it all in (optional)

  A few construction notes, I suggest that you solder and tape all

  connections.  It is also important to read this entire bulletin

  before attempting to construct this.

  First, connect the RED wire of the transformer to either

  terminal on the speaker.  Now connect the WHITE wire from the

  transformer to the other terminal on the speaker.  Next, connect

  the RED (positive) wire of one battery clip to the black wire of

  the other battery clip.  Now connect the the remaining RED wire

  on the second battery clip to the GREEN wire from the touch tone

  pad.  Connect the BLUE wire from the touch tone pad to the

  ORANGE-and-BLACK striped wire from the touch tone pad.  To these

  two wires, now connect the remaining black lead from first

  battery clip.  You have now finished the power connection to the

  keypad.  Connect the BLACK wire from the keypad to the BLUE wire

  on the transformer.  Next connect the RED-and-GREEN striped wire

  from the keypad to the GREEN wire on the transformer.  The BLACK

  wire on the transformer should not be connected to anything,

  along with quite a few wires from the keypad.  The connection of

  the keypad is now complete.  All you have to do is connect two

  nine volt batteries to the battery clips, and you'll be ready to

  go. You may want to mount it in a case for easy portability.

  Note that the silver box modification CAN be made to this unit,

  allowing complete remote phreaking.  When none of the buttons

  are pressed, this unit uses NO power, thereby eliminating the

  need for a power switch, and extending the life of the

  batteries.

  The following are the frequency combinations generated by each

  button on the keypad.

  KEY     FREQ. #1        FREQ. #2

  ---     --------        --------

  1       697             1209

  2       697             1336

  3       697             1477

  A       697             1633

  4       770             1209

  5       770             1336

  6       770             1477

  B       770             1633

  7       852             1209

  8       852             1336

  9       852             1477

  C       852             1633

  *       941             1209

  0       941             1336

  #       941             1477

  D       941             1633

  All frequencies are measured in Hertz

  Note that A,B,C and D are not normally present (except for silver boxes)

  *****************************************************************************


white3
                           /-/-/-/-/-/-\-\-\-\-\-\

                           <:-\-White Box Plans-\-:>

                            \-\-\-\-\-\-/-/-/-/-/-/

  (>Introduction<)

            This article will tell you how to take a normal touch tone

  keypad and convert it to a portable unit. First of all, the tones made by

  a touch on telephone are not single tones, they are a combination of two

  tones, making 'DTMF' (Dual tone Munlti-frequency). The normal tone

  telephone dials 12 different signals (see bulletin on Silver Boxes). The

  power required by a keypad is about 25 volts, but they will work with as

  little as 15, thereby allowing the use of

            As you may have gussed, they are also designed to operate with a

  telephone type speaker (and phoneline), and not the standard 8-OHM speaker

  which needs to be used for adequate vtlume. To accomplish this we use a

  matching transformer, this is one of those miniature ones available at

  radio shack. Enough of the theory, no

  (>Phone Modification Instructions<)

  You will need:

  <1> Touch Tone Keypad

  <2> Minature 1000 to 8OHM transformer

     (Radio Shack # 273-1380)

  <3> A standard 8-OHM speaker

  <4> Two 9-VOLT Radio Bateries

  <5> Two 9-VOLT clips

  <6> A case to put it all in (optional)

      o A few construction notes, I suggest that you solder and tape all

  connections. It is also important to read this entire article before

  attemping to construct this.

            First, connect the red wire of the transformer to either

  terminal on the speaker. Now connect the white wire from the transformer

  to the other terminal speaker. Next, connect the red (positive) wire of

  one battery clip to the black wire on the other battery clip. Now connect

  the remaining red wire on the second battery clip to the green wire from

  the touch tone pad. Connect the blue wire from the touch tone pad to the

  orange-and-black striped wire from the touch to black lead from the first

  battery clip. You have now finished the power connection to the keypad.

            Next, connect the black wire from the keypad to the blue wire on

  the transformer. Now connect the red-and-green striped wire from the

  keypad to the green wire on the transformer. The black wire on the

  transformer should not be connected to anything, along with quite a few

  wires from the keypad.  The connection of the keypad is now complete. All

  you have to do is connect two nine volt batteries to the battery clips,

  and you'll be ready to go. You may want to mount it in a case for easy

  portability.

  (>Use of the White Box<)

            To bring the White Box to its full potential Silver box

  modifications should be made to this unit, thus allowing complete remote

  phreaking. When none of the buttons are pressed, this unit uses NO power,

  thereby eliminating the need for a power s

  ______________________________________________________________________________

  ____________________________________-END-_____________________________________


yellow
                            "YELLOW BOX PLANS"

                              By CAPTAIN HOOK

                           On Feb  3, 1986  5:47

   Now to begin with you need the following:

  1) A telephone line showing up in the wall.You can find the

     opening behind all those round plates AT&T puts in when they

     disconnect or begin to put a phone in.

  2) 1 Modular jack

  3) 1 Screwdriver

  4) 1 Human being who knows what the hell their doing!!!!  (in

     other words an IQ of 3 or so will do)

  PREPARATION:

  1) Open the plate to expose the wire running through the wall or

     you can remove an old jack to find the wire.(Note: it must be a

     complete wire not an end as is used for the setup of a normal

     phone)

  2) Cut the wire in half.Now check your other phones (Note: i had

     2 other phones so one works the other won't)

  3) Now splice up the 2 ends of the wire you just cut.You will

     find 4 or 6 color coded wires on each end.

  4) Splice up each smaller wire so as the metal is exposed.

  5) Next now this is the hard part look at the jack at match the

     colors Note: if you cant do this:

               a) get a very sharp razor blade

               b) now put to the wrists and slice that.

               c) wait about an hour and your dead KINDA FINAL ISNT IT!!!!!

  6) Each screw will now have 2 of each colore wire on it.

  7) Plug in the phone. YOUR DONE!!!!!!!!!!!!!!!!!!!!!

  NOTE:THIS PROCESS IS IRREVERSABLE!!!!