HPAVC/HPAVC CD-ROM.iso/COOK1.ZIP/COOK1.TXT

Text File | 1996-12-17 | 396KB | 8,486 lines

            ANARCHY COOKBOOK v.666* By: Jolly Roger
Merged/Converted to Clean ASCII Format By: THE HAND OF FATE (THOF)

[Table of Contents]
Counterfeiting Money
Credit Card Fraud
Making Plastic Explosives from Bleach
Picking Master Locks
The Arts of Lockpicking I
The Arts of Lockpicking II
Solidox Bombs
High Tech Revenge:  The Beigebox (NEW Revision 2.0)
CO2 Bombs
Thermite Bombs
Touch Explosives
Letter Bombs
Paint Bombs
Ways to send a car to HELL
Do ya hate school?
Phone related vandalism
Highway police radar jamming




Smoke Bombs

Mail Box Bombs
Hotwiring cars
Napalm
Fertilizer Bomb
Tennis Ball Bomb
Diskette Bombs
Unlisted Phone Numbers
Fuses
How to make Potassium Nitrate
Exploding Lightbulbs
Under water igniters
Home-brew blast cannon
Chemical Equivalency List
Phone Taps
Landmines
A different kind of Molitov Cocktail
Phone Systems Tutorial I
Phone Systems Tutorial II
Basic Alliance Teleconferencing
Aqua Box Plans
Hindenberg Bomb
How to Kill Someone with your Bare Hands
Phone Systems Tutorial III
Black Box Plans
The Blotto Box
Blowgun
Brown Box Plans
Calcium Carbide Bomb
More Ways to Send a Car to Hell
Ripping off Change Machines
Clear Box Plans
CNA Number Listing
Electronic Terrorism
How to Start a Conference w/o 2600hz or M-F
Dynamite
Auto Exhaust Flame Thower



How to Break into BBs Express
Firebomb
Fuse Bomb
Generic Bomb
Green Box Plans
Portable Grenade Launcher
Basic Hacking Tutorial I
Basic Hacking Tutorial II
Hacking DEC's
Harmless Bombs
Breaking into Houses
Hypnotism
Remote Informer Issue #1
Jackpotting ATM Machines
Jug Bomb
Fun at K-Mart
Mace Substitute
How to Grow Marijuana
Match Head Bomb
Terrorizing McDonalds
"Mentor's" Last Words
The Myth of the 2600hz Detector
Blue Box Plans
Napalm II
Nitroglycerin Recipe
Operation: Fuckup
Stealing Calls from Payphones
Pool Fun
Free Postage
Unstable Explosives
Weird Drugs
The Art of Carding
Recognizing Credit Cards
How to Get a New Identity
Remote Informer Issue #2
Remote Informer Issue #3
Remote Informer Issue #4
Remote Informer Issue #5
Phreaker's Guide to Loop Lines
Ma-Bell Tutorial
Getting Money out of Pay Phones
Computer-based PBX
PC-Pursuit Port Statistics
Pearl Box Plans
The Phreak File
Red Box Plans
RemObS
Scarlet Box Plans
Silver Box Plans
Bell Trashing
Canadian WATS Phonebook
Hacking TRW
Hacking VAX & UNIX
Verification Circuits
White Box Plans
The BLAST Box
Dealing with the Rate & Route Operator
Cellular Phone Phreaking
Cheesebox Plans
How to Start Your Own Conferences



Gold Box Plans
The History of ESS
The Lunch Box
Olive Box Plans
The Tron Box
More TRW Info
"Phreaker's Phunhouse"
Phrack Magazine - Vol. 3, Issue 27 (Intro to MIDNET)
Phrack Magazine - Vol. 3, Issue 27 (The Making of a Hacker)
Phrack Magazine - Vol. 3, Issue 28 (Network Miscellany)
Phrack Magazine - Vol. 3, Issue 28 (Pearl Box Schematic)
Phrack Magazine - Vol. 3, Issue 28 (Snarfing Remote Files)
Phrack Magazine - Vol. 3, Issue 30 (Western Union, Telex,
                                    TWX & Time Service)
Phrack Magazine - Vol. 3, Issue 30 (Hacking & Tymnet)
Phrack Magazine - Vol. 3, Issue 30 (The DECWRL Mail Gateway)
Sodium Chlorate
Mercury Fulminate
Improvised Black Powder
Nitric Acid
Dust Bomb Instructions
Carbon-Tet Explosive
Making Picric Acid from Aspirin
Reclamation of RDX from C-4 Explosives
Egg-based Gelled Flame Fuels
Clothespin Switch
Flexible Plate Switch
Low Signature Systems (Silencers)
Delay Igniter From Cigarette
Nicotine
Dried Seed Timer
Nail Grenade
Bell Glossary
Phone Dial Locks -- How to Beat'em
Exchange Scanning
A Short History of Phreaking
"Secrets of the Little Blue Box" (story)
The History of British Phreaking
"Bad as Shit" (story)
Telenet
Fucking with the Operator
Phrack Magazine - Vol. 1, Issue 1 (The Phone Preak's Guide)
International Country Code Listing
Infinity Transmitter Schematic and Plans
LSD
Bananas
Yummy Marihuana Recipes
Peanuts
Chemical Fire Bottle
Igniter from Book Matches
"Red or White Powder" Propellant
Pipe Hand Grenade
European Credit Card Fraud (Written by Creditman! A
                            Cookbook III Exclusive!!)







ç█      █Counterfeiting Money                            by The Jolly Roger

Before reading this article, it would be a very good idea to get a book on
photo offset printing, for this is the method used in
counterfeiting US currency.  If you are familiar with this method
of printing, counterfeiting should be a simple task for you.

Genuine currency is made by a process called "gravure", which
involves etching a metal block.  Since etching a metal block is
impossible to do by hand, photo offset printing comes into the
process.

Photo offset printing starts by making negatives of the currency
with a camera, and putting the negatives on a piece of masking
material (usually orange in color).  The stripped negatives,
commonly called "flats", are then exposed to a lithographic plate
with an arc light plate maker.  The burned plates are then
developed with the proper developing chemical.  One at a time,
these plates are wrapped around the plate cylinder of the press.

The press to use should be an 11 by 14 offset, such as the AB Dick
360.  Make 2 negatives of the portrait side of the bill, and 1 of
the back side.  After developing them and letting them dry, take
them to a light table.  Using opaque on one of the portrait sides,
touch out all the green, which is the seal and the serial numbers.
The back side does not require any retouching, because it is all
one color.  Now, make sure all of the negatives are registered
(lined up correctly) on the flats.  By the way, every time you
need another serial number, shoot 1 negative of the portrait side,
cut out the serial number, and remove the old serial number from
the flat replacing it with the new one.

Now you have all 3 flats, and each represents a different color:
black, and 2 shades of green (the two shades of green are created
by mixing inks).  Now you are ready to burn the plates.  Take a
lithographic plate and etch three marks on it.  These marks must
be 2 and 9/16 inches apart, starting on one of the short edges.
Do the same thing to 2 more plates.  Then, take 1 of the flats and
place it on the plate, exactly lining the short edge up with the
edge of the plate.  Burn it, move it up to the next mark, and
cover up the exposed area you have already burned.  Burn that, and
do the same thing 2 more times, moving the flat up one more mark.
Do the same process with the other 2 flats (each on a separate
plate).  Develop all three plates.  You should now have 4 images
on each plate with an equal space between each bill.

The paper you will need will not match exactly, but it will do for
most situations.  The paper to use should have a 25% rag content.
By the way, Disaperf computer paper (invisible perforation) does
the job well.  Take the paper and load it into the press.  Be sure
to set the air, buckle, and paper thickness right.  Start with the
black plate (the plate without the serial numbers).  Wrap it
around the cylinder and load black ink in.  Make sure you run more
than you need because there will be a lot of rejects.  Then, while
that is printing, mix the inks for the serial numbers and the back
side.  You will need to add some white and maybe yellow to the
serial number ink.  You also need to add black to the back side.
Experiment until you get it right.  Now, clean the press and print



the other side.  You will now have a bill with no green seal or
serial numbers.  Print a few with one serial number, make another
and repeat.  Keep doing this until you have as many different
numbers as you want.  Then cut the bills to the exact size with a
paper cutter.  You should have printed a large amount of money by
now, but there is still one problem;  the paper is pure white.  To
dye it, mix the following in a pan:  2 cups of hot water, 4 tea
bags, and about 16 to 20 drops of green food coloring (experiment
with this).  Dip one of the bills in and compare it to a genuine
US bill.  Make the necessary adjustments, and dye all the bills.
Also, it is a good idea to make them look used.  For example,
wrinkle them, rub coffee grinds on them, etc.

As before mentioned, unless you are familiar with photo offset
printing, most of the information in this article will be fairly
hard to understand.  Along with getting a book on photo offset
printing, try to see the movie "To Live and Die in LA".  It is
about a counterfeiter, and the producer does a pretty good job of
showing how to counterfeit.  A good book on the subject is "The
Poor Man's James Bond".

If all of this seems too complicated to you, there is one other
method available for counterfeiting:  The Canon color laser
copier.  The Canon can replicate ANYTHING in vibrant color,
including US currency.  But, once again, the main problem in
counterfeiting is the paper used.  So, experiment, and good luck!
                                             -Jolly Roger-


Credit Card Fraud                brought to you by The Jolly Roger

For most of you out there, money is hard to come by.  Until now:

With the recent advent of plastic money (credit cards), it is
easy to use someone else's credit card to order the items you have
always desired in life.  The stakes are high, but the payoff is
worth it.

Step One:  Getting the credit card information

First off, you must obtain the crucial item:  someone's credit
card number.  The best way to get credit card numbers is to take
the blue carbons used in a credit card transaction at your local
department store.  These can usually be found in the garbage can
next to the register, or for the more daring, in the garbage
dumpster behind the store.  But, due to the large amount of credit
card fraud, many stores have opted to use a carbonless transaction
sheet, making things much more difficult.  This is where your
phone comes in handy.

First, look up someone in the phone book, and obtain as much
information as possible about them.  Then, during business hours,
call in a very convincing voice - "Hello, this is John Doe from
the Visa Credit Card Fraud Investigations Department.  We have
been informed that your credit card may have been used for
fraudulent purposes, so will you please read off the numbers
appearing on your Visa card for verification."  Of course, use
your imagination!  Believe it or not, many people will fall for



this ploy and give out their credit information.

Now, assuming that you have your victim's credit card number, you
should be able to decipher the information given.

Step Two:  Recognizing information from carbon copies

Card examples:

[American Express]
XXXX XXXXXX XXXXX
MM/Y1 THRU MM/Y2
JOE SHMOE

[American Express]
XXXX XXXXXX XXXXX
MM/Y1 THRU MM/Y2
JOE SHMOE

Explanation:
   MM/Y1 is the date the card was issued, and MM/Y2 is the
   expiration date.  The American Express Gold Card has numbers
   XXXXXX XXXXXXXX XXXXXXXX, and is covered for up to $5000.00,
   even if the card holder is broke.

[Mastercard]
5XXX XXXX XXXX XXXX
XXXX AAA DD-MM-YY MM/YY
JOE SHMOE

Explanation:
   XXXX in the second row may be asked for during the ordering
   process.  The first date is when the card was new, and the
   second is when the card expires.  The most frequent number
   combination used is 5424 1800 XXXX XXXX.  There are many of
   these cards in circulation, but many of these are on wanted
   lists, so check these first.

[Visa]
4XXX XXX(X) XXX(X) XXX(X)
MM/YY    MM/YY*VISA
JOE SHMOE

Explanation:
   Visa is the most abundant card, and is accepted almost
   everywhere.  The "*VISA" is sometimes replaced with "BWG", or
   followed with a special code.  These codes are as follows:

   [1]  MM/YY*VISA V - Preferred Card
   [2]  MM/YY*VISA CV - Classic Card
   [3]  MM/YY*VISA PV - Premier Card

   Preferred Cards are backed with money, and are much safer to
   use.  Classic Cards are newer, harder to reproduce cards with
   decent backing.  Premier Cards are Classic Cards with Preferred
   coverage.  Common numbers are 4448 020 XXX XXX, 4254 5123 6000
   XXXX, and 4254 5123 8500 XXXX.  Any 4712 1250 XXXX XXXX cards
   are IBM Credit Union cards, and are risky to use, although



   they are usually covered for large purchases.

Step Three:  Testing credit

You should now have a Visa, Mastercard, or American Express
credit card number, with the victim's address, zip code, and phone
number.  By the way, if you have problems getting the address,
most phone companies offer the Address Tracking Service, which is
a special number you call that will give you an address from a
phone number, at a nominal charge.  Now you need to check the
balance of credit on the credit card (to make sure you don't run
out of money), and you must also make sure that the card isn't
stolen.  To do this you must obtain a phone number that
businesses use to check out credit cards during purchases.  If you
go to a department store, watch the cashier when someone makes a
credit card purchase.  He/she will usually call a phone number,
give the credit information, and then give what is called a
"Merchant Number".  These numbers are usually written down on or
around the register.  It is easy to either find these numbers and
copy them, or to wait until they call one in.  Watch what they
dial and wait for the 8 digit (usually) merchant number.  Once you
call the number, in a calm voice, read off the account number,
merchant number, amount, and expiration date.  The credit bureau
will tell you if it is ok, and will give you an authorization
number.  Pretend you are writing this number down, and repeat it
back to them to check it.  Ignore this number completely, for it
serves no real purpose.  However, once you do this, the bank
removes dollars equal to what you told them, because the card was
supposedly used to make a purchase.  Sometimes you can trick the
operator by telling her the customer changed his mind and decided
not to charge it.  Of course, some will not allow this.  Remember
at all times that you are supposed to be a store clerk calling to
check out the card for a purchase.  Act like you are talking with
a customer when he/she "cancels".

Step Four:  The drop

Once the cards are cleared, you must find a place to have the
package sent.  NEVER use a drop more than once.  The following are
typical drop sites:

   [1]  An empty house

An empty house makes an excellent place to send things.  Send the
package UPS, and leave a note on the door saying, "UPS.  I work
days, 8 to 6.  Could you please leave the package on the back door
step?"  You can find dozens of houses from a real estate agent by
telling them you want to look around for a house.  Ask for a list
of twenty houses for sale, and tell them you will check out the
area.  Do so, until you find one that suits your needs.

   [2]  Rent A Spot

U-Haul sometimes rents spaces where you can have packages sent and
signed for.  End your space when the package arrives.

   [3]  People's houses




Find someone you do not know, and have the package sent there.
Call ahead saying that "I called the store and they sent the
package to the wrong address.  It was already sent, but can you
keep it there for me?"  This is a very reliable way if you keep
calm when talking to the people.

Do NOT try post office boxes.  Most of the time, UPS will not
deliver to a post office box, and many people have been caught in
the past attempting to use a post office box.  Also, when you have
determined a drop site, keep an eye on it for suspicious
characters and cars that have not been there before.

Step Five:  Making the transaction

You should now have a reliable credit card number with all the
necessary billing information, and a good drop site.

The best place to order from is catalogues, and mail order houses.
It is in your best interest to place the phone call from a pay
phone, especially if it is a 1-800 number.  Now, when you call,
don't try to disguise your voice, thinking you will trick the
salesperson into believing you are an adult.  These folks are
trained to detect this, so your best bet is to order in your own
voice.  They will ask for the following:  name, name as it appears
on card, phone number, billing address, expiration date, method of
shipping, and product.  Ask if they offer UPS Red shipping (next
day arrival), because it gives them less time to research an
order.  If you are using American Express, you might have a bit of
a problem shipping to an address other than the billing address.
Also, if the salesperson starts to ask questions, do NOT hang up.
Simply talk your way out of the situation, so you won't encourage
investigation on the order.

If everything goes right, you should have the product, free of
charge.  Insurance picks up the tab, and no one is any wiser.  Be
careful, and try not to order anything over $500.  In some states,
UPS requires a signature for anything over $200, not to mention
that anything over $200 is defined as grand theft, as well as
credit fraud.  Get caught doing this, and you will bite it for a
couple of years.  Good luck!
Making Plastic Explosives from Bleach           by The Jolly Roger

Potassium chlorate is an extremely volatile explosive compound,
and has been used in the past as the main explosive filler in
grenades, land mines, and mortar rounds by such countries as
France and Germany.  Common household bleach contains a small
amount of potassium chlorate, which can be extracted by the
procedure that follows.

First off, you must obtain:

[1]  A heat source (hot plate, stove, etc.)
[2]  A hydrometer, or battery hydrometer
[3]  A large Pyrex, or enameled steel container (to weigh
     chemicals)
[4]  Potassium chloride (sold as a salt substitute at health and
     nutrition stores)




Take one gallon of bleach, place it in the container, and begin
heating it.  While this solution heats, weigh out 63 grams of
potassium chloride and add this to the bleach being heated.
Constantly check the solution being heated with the hydrometer,
and boil until you get a reading of 1.3.  If using a battery
hydrometer, boil until you read a FULL charge.

Take the solution and allow it to cool in a refrigerator until it
is between room temperature and 0 degrees Celcius.  Filter out the
crystals that have formed and save them.  Boil this solution again
and cool as before.  Filter and save the crystals.

Take the crystals that have been saved, and mix them with
distilled water in the following proportions:  56 grams per 100
milliliters distilled water.  Heat this solution until it boils
and allow to cool.  Filter the solution and save the crystals that
form upon cooling.  This process of purification is called
"fractional crystalization".  These crystals should be relatively
pure potassium chlorate.

Powder these to the consistency of face powder, and heat gently to
drive off all moisture.

Now, melt five parts Vaseline with five parts wax.  Dissolve this
in white gasoline (camp stove gasoline), and pour this liquid on
90 parts potassium chlorate (the powdered crystals from above)
into a plastic bowl.  Knead this liquid into the potassium
chlorate until intimately mixed.  Allow all gasoline to evaporate.

Finally, place this explosive into a cool, dry place.  Avoid
friction, sulfur, sulfides, and phosphorous compounds.  This
explosive is best molded to the desired shape and density of 1.3
grams in a cube and dipped in wax until water proof.  These block
type charges guarantee the highest detonation velocity.  Also, a
blasting cap of at least a 3 grade must be used.

The presence of the afore mentioned compounds (sulfur, sulfides,
etc.) results in mixtures that are or can become highly sensitive
and will possibly decompose explosively while in storage.  You
should never store homemade explosives, and you must use EXTREME
caution at all times while performing the processes in this
article.

You may obtain a catalog of other subject of this nature by
writing:

     Information Publishing Co.
     Box 10042
     Odessa, Texas  79762

Picking Master Locks                            by The Jolly Roger

Have you ever tried to impress someone by picking one of those
Master combination locks and failed?

The Master lock company made their older combination locks with a
protection scheme.  If you pull the handle too hard, the knob will
not turn.  That was their biggest mistake.



çThe first number:

Get out any of the Master locks so you know what is going on.
While pulling on the clasp (part that springs open when you get
the combination right), turn the knob to the left until it will
not move any more, and add five to the number you reach.  You now
have the first number of the combination.

The second number:

Spin the dial around a couple of times, then go to the first
number you got.  Turn the dial to the right, bypassing the first
number once.  When you have bypassed the first number, start
pulling on the clasp and turning the knob.  The knob will
eventually fall into the groove and lock.  While in the groove,
pull the clasp and turn the knob.  If the knob is loose, go to the
next groove, if the knob is stiff, you have the second number of
the combination.

The third number:

After getting the second number, spin the dial, then enter the two
numbers.  Slowly spin the dial to the right, and at each number,
pull on the clasp.  The lock will eventually open if you did the
process right.

This method of opening Master locks only works on older models.
Someone informed Master of their mistake, and they employed a new
mechanism that is foolproof (for now).

The Arts of Lockpicking I              courtesy of The Jolly Roger

Lockpicking I:  Cars and assorted other locks

While the basic themes of lockpicking and uninvited entry have not
changed much in the last few years, some modern devices and
techniques have appeared on the scene.

Automobiles:

Many older automobiles can still be opened with a Slim Jim type of
opener (these and other auto locksmithing techniques are covered
fully in the book "In the Still of the Night", by John Russell
III);  however, many car manufacturers have built cases over the
lock mechanism, or have moved the lock mechanism so the Slim Jim
will not work.  So:

American Locksmith Service
P.O. Box 26
Culver City, CA  90230

ALS offers a new and improved Slim Jim that is 30 inches long and
3/4 inches wide, so it will both reach and slip through the new
car lock covers (inside the door).  Price is $5.75 plus $2.00
postage and handling.

Cars manufactured by General Motors have always been a bane to
people who needed to open them, because the sidebar locking unit



they employ is very difficult to pick.  To further complicate
matters, the new GM cars employ metal shields to make the use of a
Slim Jim type instrument very difficult.  So:

Lock Technology Corporation
685 Main St.
New Rochelle, NY  10801

LTC offers a cute little tool which will easily remove the lock
cylinder without harm to the vehicle, and will allow you to enter
and/or start the vehicle.  The GMC-40 sells for $56.00 plus $2.00
for postage and handling.

The best general automobile opening kit is probably a set of
lockout tools offered by:

Steck MFG Corporation
1319 W. Stewart St.
Dayton, OH  45408

For $29.95 one can purchase a complete set of six carbon lockout
tools that will open more than 95% of all the cars around.

Kwickset locks have become quite popular as one step security
locks for many types of buildings.  They are a bit harder to pick
and offer a higher degree of security than a normal builder
installed door lock.  So:

A MFG
1151 Wallace St.
Massilon, OH  44646

Price is $11.95.  Kwickset locks can handily be disassembled and
the door opened without harm to either the lock or the door by
using the above mentioned Kwick Out tool.

If you are too lazy to pick auto locks:

Veehof Supply
Box 361
Storm Lake, IO  50588

VS sells tryout keys for most cars (tryout keys are used since
there is no one master key for any one make of car, but there are
group type masters (a.k.a. tryout keys).  Prices average about
$20.00 a set.

Updated Lockpicking:

For years, there have been a number of pick attack procedures for
most pin and tumbler lock systems.  In reverse order of ease they
are as follows:

Normal Picking:  Using a pick set to align the pins, one by one,
                 until the shear line is set and the lock opens.

Racking:  This method uses picks that are constructed with a
          series of bumps, or diamond shape notches.  These picks



          are "raked" (i.e. run over all the pins at one time).
          With luck, the pins will raise in the open position and
          stay there.  Raking, if successful, can be much less of
          an effort than standard picking.

Lock Aid Gun:  This gun shaped device was invented a number of
               years ago and has found application with many
               locksmiths and security personnel.  Basically, a
               needle shaped pick is inserted in the snout of the
               "gun", and the "trigger" is pulled.  This action
               snaps the pick up and down strongly.  If the tip is
               slipped under the pins, they will also be snapped
               up and down strongly.  With a bit of luck they will
               strike each other and separate at the shear line
               for a split second.  When this happens the lock
               will open.  The lock aid gun is not 100%
               successful, but when it does work, the results are
               very dramatic.  You can sometimes open the lock
               with one snap of the trigger.

Vibrator:  Some crafty people have mounted a needle pick into an
           electric toothbrush power unit.  This vibrating effect
           will sometimes open pin tumbler locks -- instantly.

There is now another method to open pin and wafer locks in a very
short time.  Although it resembles a toothbrush pick in
appearance, it is actually an electronic device.  I am speaking of
the Cobra pick that is designed and sold by:

Fed Corporation
P.O. Box 569
Scottsdale, AR  85252

The Cobra uses two nine volt batteries, teflon bearings (for less
noise), and a cam roller.  It comes with three picks (for
different types of locks) and works both in America and overseas,
on pin or wafer locks.  The Cobra will open group one locks
(common door locks) in three to seven seconds with no damage, in
the hands of an experienced locksmith.  It can take a few seconds
more or up to a half a minute for someone with no experience at
all.  It will also open group two locks (including government,
high security, and medecos), although this can take a short time
longer.  It will not open GM sidear locks, although a device is
about to be introduced to fill that gap.  How much for this toy
that will open most locks in seven seconds?

$235.00 plus $4.00 shipping and handling.

For you hard core safe crackers, FC also sells the MI-6 that will
open most safes at a cost of $10,000 for the three wheel attack
model, and $10,500 for the four wheel model.  It comes in a sturdy
aluminum carrying case with monitor, disk drive and software.

If none of these safe and sane ideas appeal to you, you can always
fall back on the magic thermal lance...

The thermal lance is a rather crude instrument constructed from
3/8 inch hollow magnesium rods.  Each tube comes in a 10 foot



length, but can be cut down if desired.  Each one is threaded on
one end.  To use the lance, you screw the tube together with a
matted regulator (like a welding outfit uses) and hook up an
oxygen tank.  Then oxygen is turned on and the rod is lit with a
standard welding ignitor.  The device produces an incredible
amount of heat.  It is used for cutting up concrete blocks or even
rocks.  An active lance will go through a foot of steel in a few
seconds.  The lance is also known as a burning bar, and is
available from:

C.O.L. MFG
7748 W. Addison
Chicago, IL  60634
The Arts of Lockpicking II             courtesy of The Jolly Roger

So you want to be a criminal.  Well, if you want to be like James
Bond and open a lock in fifteen seconds, then go to Hollywood,
because that is the only place you are ever going to do it.  Even
experienced locksmiths can spend five to ten minutes on a lock if
they are unlucky.  If you are wanting extremely quick access, look
elsewhere.  The following instructions will pertain mostly to the
"lock in knob" type lock, since it is the easiest to pick.

First of all, you need a pick set.  If you know a locksmith, get
him to make you a set.  This will be the best possible set for you
to use.  If you find a locksmith unwilling to supply a set, don't
give up hope.  It is possible to make your own, if you have access
to a grinder (you can use a file, but it takes forever).

The thing you need is an allen wrench set (very small).  These
should be small enough to fit into the keyhole slot.  Now, bend
the long end of the allen wrench at a slight angle (not 90
degrees).  Now, take your pick to a grinder or a file, and smooth
the end until it is rounded so it won't hang inside the lock.
Test your tool out on doorknobs at your house to see if it will
slide in and out smoothly.  Now, this is where the screwdriver
comes in.  It must be small enough for it and your pick to be used
in the same lock at the same time, one above the other.  In the
coming instructions, please refer to this chart of the interior of
a lock:
______________________________
                              \ K
        |  |  |  |   |   |    / E
           |     |   |   |    \ Y           [|]  Upper tumbler pin
        ^     ^               / H           [^]  Lower tumbler pin
        ^  ^  ^  ^   ^   ^    \ O           [-]  Cylinder wall
                              / L   (This is a greatly simplified
                              \ E    drawing)
______________________________/

The object is to press the pin up so that the space between the
upper pin and the lower pin is level with the cylinder wall.  Now,
if you push a pin up, it's tendency is to fall back down, right?
That is where the screwdriver comes in.  Insert the screwdriver
into the slot and turn.  This tension will keep the "solved" pins
from falling back down.  Now, work from the back of the lock to
the front, and when you are through, there will be a click, the
screwdriver will turn freely, and the door will open.



çDo not get discouraged on your first try!  It will probably take
you about twenty to thirty minutes your first time.  After that,
you will quickly improve with practice.
Solidox Bombs                                   by The Jolly Roger

Most people are not aware that a volatile, extremely explosive
chemical can be bought over the counter:  Solidox.

Solidox comes in an aluminum can containing 6 grey sticks, and can
be bought at Kmart, and various hardware supply shops for around
$7.00.  Solidox is used in welding applications as an oxidizing
agent for the hot flame needed to melt metal.  The most active
ingredient in Solidox is potassium chlorate, a filler used in many
military applications in the WWII era.

Since Solidox is literally what the name says:  SOLID OXygen, you
must have an energy source for an explosion.  The most common and
readily available energy source is common household sugar, or
sucrose.  In theory, glucose would be the purest energy source,
but it is hard to find a solid supply of glucose.

Making the mixture:

[1]  Open the can of Solidox, and remove all 6 sticks.  One by
     one, grind up each of the sticks (preferably with a mortar
     and pestle) into the finest powder possible.
[2]  The ratio for mixing the sugar with the Solidox is 1:1, so
     weigh the Solidox powder, and grind up the equivalent amount
     of sugar.
[3]  Mix equivalent amounts of Solidox powder, and sugar in a 1:1
     ratio.

It is just that simple!  You now have an extremely powerful
substance that can be used in a variety of applications.  A word
of caution:  be EXTREMELY careful in the entire process.  Avoid
friction, heat, and flame.  A few years back, a teenager I knew
blew 4 fingers off while trying to make a pipe bomb with Solidox.
You have been warned!
High Tech Revenge: The Beigebox  rev.2          by The Jolly Roger

             -------------Introduction-------------
Have you ever wanted a lineman's handset? Surely every phreak has at
least once considered the phun that he could have with one. After searching
unlocked phone company trucks for months, we had an idea. We could build
one. We did, and named it the "Beige Box" simply because that is the color
of ours.
The beigebox is simply a consumer lineman's handset, which is a
phone that can be attached to the outside of a person's house.  To
fabricate a beigebox, follow along.

             ---------Construction and Use---------
The construction is very simple. First you must understand the concept of
the device. In a modular jack, there are four wires. These are red, green,
yellow, and black. For a single line telephone, however, only two matter:
the red (ring) and green (tip). The yellow and the black are not neccessary
for this project. A lineman's handset has two clips on it: the ring and
the tip. Take a modular jack and look at the bottom of it's casing. There
should be a grey jack with four wires  (red, green, yellow & black)



leading out of it. To the end of the red wire attach a red aligator clip.
To the end of the green wire attatch a green aligator clip. The yellow
and black wires can be removed, although I would only set them aside so
that you can use the modular jack in future projects. Now insert your
telephone's modular plug into the modular jack. That's it. This particular
model is nice because it is can be easily made, is inexpensive, uses
common parts that are readily available, is small, is lightweight,
and does not require the destruction of a phone.

             ------------Beige Box Uses------------
There are many uses for a Beige Box. However, before you can use it,
you must know how to attach it to the output device. This device can be
of any of Bell switching apparatus that include germinal sets (i.e.
remote switching centers, bridgin heads, cans, etc.). To open most Bell
Telephone switching apparatus, you must have a 7/16 inch hex driver
(or a good pair of needle nose pliers work also).
This piece of equipment can be picked up at your local hardware store.
With your hex driver (or pliers), turn the security bolt(s) approximately
1/8 of an inch counter-clockwise and open. If your output device is locked,
then you must have some knowledge of destroying and/or picking locks.
However, we have never encountered a locked output device. Once you have
opened your output device, you should see a mass of wires connected to
terminals. On most output devices, the terminals should be labeled "T"
(Tip -- if not labeled, it is usually on the left) and "R" (Ring -- if
not labeled, usually on the right).

Remember: Ring - red - right. The "Three R's" -- a simple way to
remember which is which. Now you must attach all the red alligator clip
(Ring) to the "R" (Ring) terminal.
Attach the green alligator clip (Tip) to the "T" (Tip) terminal.

Note: If instead of a dial tone you hear nothing, adjust the alligator
clips so that they are not touching each other terminals. Also make sure
they are firmly attached. By this time you should hear a dial tone.
Dial ANI to find out the number you are using (you wouldn't want to use
your own). Here are some practicle aplications:

       > Eavesdropping
       > Long distance, static free free fone calls to phriends
       > Dialing direct to Alliance Teleconferencing (also no static)
       > Phucking people over
       > Bothering the operator at little risk to yourself
       > Blue Boxing with greatly reduced chance of getting caught
       > Anything at all you want, since you are on an extension of that
line.

Eavesdropping
-------------
To be most effective, first attach the Beige Box then your phone. This
eliminates the static caused by connecting the box, therefore
reducing the potential suspicion of your victim. When eavesdropping,
it is allways best to be neither seen nor heard. If you hear someone
dialing out, do not panic; but rather hang up, wait, and pick up the
receiver again. The person will either have hung up or tried to complete
their call again. If the latter is true, then listen in, and perhaps you
will find information worthy of blackmail! If you would like to know who
you are listening to, after dialing ANI, pull a CN/A on the number.




Dialing Long Distance
---------------------
This section is self explanitory, but don't forget to dial a "1" before
the NPA.

Dialing Direct to Aliance Teleconferencing
------------------------------------------
Simply dial 0-700-456-1000 and you will get instructions from there.
I prefer this method over PBX's, since PBX's often have poor reception
and are more dificult to come by.

Phucking People Over
--------------------
This is a very large topic of discussion. Just by using the other topics
described, you can create a large phone bill for the person (they will
not have to pay for it, but it will be a big hassle for them). In addition,
since you are an extension of the person's line, you can leave your
phone off the hook, and they will not be able to make or receive calls.
This can be extremely nasty because no one would expect the cause
of the problem.
Bothering the Operator
----------------------
This is also self explanitary and can provide hours of entertainment.
Simply ask her things that are offensive or you would not like traced
to your line. This also corresponds to the previously described section,
Phucking People Over. After all, guess who's line it gets traced to?
He he he...

Blue Boxing
-----------
See a file on Blue Boxing for more details. This is an especially nice
feature if you live in an ESS-equiped prefix, since the calls are, once
again, not traced to your line...

---POTENTIAL RISKS OF BEIGE BOXING----
Overuse of the Beige Box may cause suspicians within the Gestapo,
and result in legal problems. Therefor, I would recomend you:

            > Choose a secluded spot to do your Beige Boxing,
            > Use more than one output device
            > Keep a low profile (i.e., do not post under your real
              name on a public BBS concering your occomplishments)
            > In order to make sure the enemy has not been inside your
output
              device, I recomend you place a piece of transparent tape over
              the opening of your output device. Therefor, if it is
              opened in your abscence, the tapqe will be displaced and
              you will be aware of the fact that someone has intruded
              on your teritory.

Now, imagine the possibilities:  a $2000 dollar phone bill for
that special person, 976 numbers galore, even harassing the
operator at no risk to you!  Think of it as walking into an
enemies house, and using their phone to your heart's content.

                                      ---------Jolly Roger

               How to make a CO2 bomb        by the Jolly Roger



çYou will have to use up the cartridge first by either shooting it
or whatever. With a nail, force a hole bigger so as to allow the
powder and wick to fit in easily. Fill the cartridge with black
powder and pack it in there real good by tapping the bottom of the
cartridge on a hard surface (I said TAP not SLAM!). Insert a fuse.
I recommend a good water-proof cannon fuse, or an m-80 type fuse,
but firecracker fuses work, if you can run like a black man runs
from the cops after raping a white girl.) Now, light it and run
like hell! It does wonders for a row of mailboxes (like the ones
in apartment complexes), a car (place under the gas tank), a
picture window (place on window sill), a phone booth (place right
under the phone), or any other devious place. This thing throws
shrapnel, and can make quit a mess!!  -Jolly Roger-



Thermite II... or A better way to make Thermite        by Jolly Roger

Thermite is nasty shit. Here is a good and easy way to make it.
The first step is to get some iron-oxide (which is RUST!). Here is
a good way to make large quantities in a short time:

- Get a DC convertor like the one used on a train set. Cut the
connector off, seperate the wires, and strip them both.

- Now you need a jar of water with a tablespoon or so of sodium
chloride (which is SALT!) added to it. This makes the water
conductive.

- Now insert both wires into the mixture (I am assuming you
plugged the convertor in...) and let them sit for five minutes.
One of them will start bubbling more than the other. This is the
POSITIVE(+) wire. If you do not do this test right, the final
product will be the opposite (chemically) of rust, which is RUST
ACID. You have no use for this here (although it IS useful!).

- Anyway, put the nail tied to the positive wire into the jar. Now
put the negative wire in the other end. Now let it sit overnight
and in the morning scrape the rust off of the nail & repeat until
you got a bunch of rust on the bottom of the glass. Be generous
with your rust collection. If you are going through the trouble of
making thermite, you might as well make a lot, right?

- Now remove the excess water and pour the crusty solution onto a
cookie sheet. Dry it in the sun for a few hours, or inside
overnight. It should be an orange-brown color (although I have
seen it in many different colors! Sometimes the color gets fucked
up, what can I say... but it is still iron oxide!)

- Crush the rust into a fine powder and heat it in a cast-iron pot
until it is red. Now mix the pure iron oxide with pure alluminum
filinos which can be bought or filed down by hand from an aluminum
tube or bar. The ratio or iron oxide to aluminum is 8 grams to 3
grams.

- Congrats! You have just made THERMITE! Now, to light it...

- Thermite requires a LOT of heat (more than a blow torch!) to



ignite. However, a magnesium ribbon (which is sorta hard to find..
call around) will do the trick.  It takes the heat from the
burning magnesium to light the thermite.

- Now when you see your victim's car, pour a fifty-cent sized pile
onto his hood, stick the ribbon in it, and light the ribbon with
the blow torch. Now chuckle as you watch it burn through the hood,
the block, the axle, and the pavement. BE CAREFUL! The ideal
mixtures can vaporize CARBON STEEL! Another idea is to use
thermite to get into pay phone cash boxes. HAVE FUN!! -Jolly Roger-


Touch Explosives                         by the Jolly Roger

This is sort of a mild explosive, but it can be quite dangerous in
large quantities. To make touch explosive (such as that found in a
snap-n-pop, but more powerful), use this recipe:

- Mix iodine crystals into ammonia until the iodine crystals will
not dissolve into the ammonia anymore. Pour off the excess ammonia
and dry out the crystals on a baking sheet the same way as you
dried the thermite (in other words, just let it sit overnight!).

- Be careful now because these crystals are now your touch
explosive. Carefully wrap a bunch in paper (I mean carefully!
Friction sets 'em off!) and throw them around.. pretty loud, huh?
They are fun to put on someone's chair. Add a small fish sinker to
them and they can be thrown a long distance (good for crowds,
football games, concerts, etc.) Have fun!  -Jolly Roger-


Letter Bombs                            by The Jolly Roger

- You will first have to make a mild version of thermite. Use my
recipe, but substitute iron fillings for rust.

- Mix the iron with aluminum fillings in a ratio of 75% aluminum
to 25% iron. This mixture will burn violently in a closed space
(such as an envelope). This bring us to our next ingredient...

- Go to the post office and buy an insulated (padded) envelope.
You know, the type that is double layered... Seperate the layers
and place the mild thermite in the main section, where the letter
would go. Then place magnesium powder in the outer layer. There is
your bomb!!

- Now to light it... this is the tricky part and hard to explain.
Just keep experimenting until you get something that works. The
fuse is just that touch explosive I have told you about in another
one of my anarchy files. You might want to wrap it like a long
cigarette and then place it at the top of the envelope in the
outer layer (on top of the powdered magnesium). When the touch
explosive is torn or even squeezed hard it will ignite the
powdered magnesium (sort of a flash light) and then it will burn
the mild thermite. If the thermite didn't blow up, it would at
least burn the fuck out of your enemy (it does wonders on human
flesh!).




NOW that is REVENGE!                 -Jolly Roger-


Paint Bombs                          by The Jolly Roger

To make a pain bomb you simply need a metal pain can with a
refastenable lid, a nice bright color paint (green, pink, purple,
or some gross color is perfect!), and a quantity of dry ice. Place
the paint in the can and then drop the dry ice in. Quicky place
the top on and then run like hell! With some testing you can time
this to a science. It depends on the ratio of dry ice to paint to
the size of the can to how full it is. If you are really pissed
off at someone, you could place it on their doorstep, knock on the
door, and then run!! Paint will fly all over the place HAHAHA!!
                                        -Jolly Roger-



Ways to send a car to Hell            by The Jolly Roger

There are 1001 ways to destroy a car but I am going to cover only
the ones that are the most fun (for you), the most destructive
(for them), and the hardest to trace (for the cops).

- Place thermite on the hood, light it, and watch it burn all the
way through the pavement!

- Tape a CO2 bomb to the hood, axel, gas tank, wheel, muffler,
etc.)

- Put a tampon, dirt, sugar (this on is good!), a ping pong ball,
or just about anything that will dissolve in the gas tank.

- Put potatoes, rocks, banannas, or anything that will fit, into
the tailpipe. Use a broom handle to stuff 'em up into the
tailpipe.

- Put a long rag into the gas tank and light it...

- Steal a key, copy it, replace it, and then steal the stereo.

- Break into the car. Cut a thin metal ruler into a shape like
this:
             ----
             |  |
             |  |
             |  |
             | <
             ----

Slide it into the outside window and keep pulling it back up until
you catch the lock cable which should unlock the door. This device
is also called a SLIM JIM. Now get the stereo, equalizer, radar
detector, etc. Now destroy the inside. (A sharp knife does wonders
on the seats!)

Have Fun!                                    -Jolly Roger-




çDo ya hate school?                  by The Jolly Roger

- One of my favorites for getting out of a class or two is to call
in a bomb threat. Tell 'em that it is in a locker. Then they have
to check them all, whilst you can slip away for an hour or two.
You can even place a fake bomb (in any locker but YOURS!). They
might cancel school for a week while they investigate (of course,
you will probably have to make it up in the summer...).

- Get some pure potassium or pure sodium, put it in a capsule, and
flush it down the toilet (smells awful! Stinks up the whole school!).

- Use a smoke grenade in the hallway.

- Steal the computer passwords & keys. Or steal the 80 column cards
 inside if they are (gag) IBM.

- Make friends with student assistants and have them change your
grades when the teachers hand in their bubble sheets for the report
cards.

- Spit your gum out on the carpet in the library or whatever and
grind it into the carpet. Watch the janitors cry!

- Draw on lockers or spraypaint on the building that the principal
is a fascist.

- Stick a potato in the tailpipe of the principal's car.

- USE YOUR IMAGINATION!                   -Jolly Roger-


Phone related vandalism                     by the Jolly Roger

If you live where there are underground lines then you will be
able to ruin someone's phone life very easily. All you must do is
go to their house and find the green junction box that interfaces
their line (and possibly some others in the neighborhood) with the
major lines. These can be found just about anywhere but they are
usually underneath the nearest phone pole. Take a socket wrench
and loosen the nut on the right. Then just take clippers or a
sledge hammer or a bomb and destroy the insides and pull up their
phone cable. Now cut it into segments so it can't be fixed but
must be replaced (There is a week's worth of work for 'em!!)
                                      -Jolly Roger-



Highway radar jamming                       by The Jolly Roger

Most drivers wanting to make better time on the open road will
invest in one of those expensive radar detectors. However, this
device will not work against a gun type radar unit in which the
radar signal is not present until the cop has your car in his
sights and pulls the trigger. Then it is TOO LATE for you to slow
down. A better method is to continuously jam any signal with a
radar signal of your own. I have tested this idea with the
cooperation of a local cop and found that his unit reads random



numbers when my car approached him. It is suprisingly easy to make
a low power radar transmitter. A nifty little semiconductor called
a Gunn Diode will generate microwaves when supplied with the 5 to
10 volt DC and enclosed in the correct size cavity (resonater). An
8 to 3 terminal regulator can be used to get this voltage from a
car's 12v system. However, the correct construction and tuning of
the cavity is difficult without good microwave measurement
equipment. Police radars commonly operate on the K band at 22 ghz.
Or more often on the X band at 10.525 ghz. most microwave intruder
alarms and motion detectors (mounted over automatic doors in
supermarkets & banks, etc.) contain a Gunn type
transmitter/receiver combination that transmits about 10 kilowatts
at 10.525 ghz. These units work perfectly as jammers. If you
cannot get one locally, write to Microwave Associates in
Burlington, Massachusettes and ask them for info on 'Gunnplexers'
for ham radio use. When you get the unit it may be mounted in a
plastic box on the dash or in a weather-proff enclosure behind the
PLASTIC grille. Switch on the power when on an open highway. The
unit will not jam radar to the side or behind the car so don't go
speeding past the radar trap. An interesting phenomena you will
notice is that the drivers who are in front of you who are using
detectors will hit their brakes as you approach large metal signs
and bridges. Your signal is bouncing off of these objects and
triggering their radar detectors!       HAVE FUN!
                                       -Jolly Roger-

P.S. If you are interested in this sort of thing, get a copy of
POPULAR COMMUNICATIONS. The ads in there tell you where you can
get all kinds of info on all kinds of neat equipment for all kinds
of neat things!


Smoke Bombs                         by the Jolly Roger

Here is the recipe for one helluva smoke bomb!

4 parts sugar
6 parts potassium nitrate (Salt Peter)

Heat this mixture over a LOW flame until it melts, stirring well.
Pour it into a future container and, before it solidifies, imbed a
few matches into the mixture to use as fuses. One pound of this
stuff will fill up a whole block with thick, white smoke!


Mail Box Bombs                                 by the Jolly Roger

(1) Two litre bottle of chlorine (must contain sodium hypochlorate)

    Small amount of sugar

    Small amount of water


Mix all three of these in equal amounts to fill about 1/10 of the
bottle. Screw on the lid and place in a mailbox. It's hard to
believe that such a small explosion will literally rip the mailbox
in half and send it 20 feet into the air! Be careful doing this,



though, because if you are caught, it is not up to the person
whose mailbox you blew up to press charges. It is up to the city.
                                    -Jolly Roger-


The easiest way to hotwire cars                 by the Jolly Roger

Get in the car. Look under the dash. If it enclosed, forget it
unless you want to cut through it. If you do, do it near the
ignition. Once you get behind or near the ignition look for two
red wires. In older cars red was the standard color, if not, look
for two matched pairs. When you find them, cross them and take
off!                                  -Jolly Roger-


How to make Napalm                              by the Jolly Roger

- Pour some gas into an old bowl, or some kind of container.

- Get some styrofoam and put it in the gas, until the gas won't
eat anymore. You should have a sticky syrup.

- Put it on the end of something (don't touch it!!). The unused
stuff lasts a long time!
                                       -Jolly Roger-



How to make a fertilizer bomb                       by Jolly Roger

Ingredients:

- Newspaper
- Fertilizer (the chemical kind, GREEN THUMB or ORCHO)
- Cotton
- Diesel fuel

Make a pouch out of the newspaper and put some fertilizer in it.
Then put cotton on top. Soak the cotton with fuel. Then light and
run like you have never ran before! This blows up 500 square feet
so don't do it in an alley!!               -Jolly Roger-



Tennis Ball Bombs                               by The Jolly Roger

Ingredients:

- Strike anywhere matches
- Potassium Nitrate (Black Powder)
- A Drop of Gasoline
- A tennis ball
- A nice sharp knife
- Duct tape

Break a ton of matchheads off. Then cut a SMALL hole in the tennis
ball. Stuff all of the matchheads into the ball, until you can't
fit any more in. Then tape over it with duct tape. Make sure it is
real nice and tight! Then, when you see a geek walking down the
street, give it a good throw. He will have a blast!!



                                          -Jolly Roger-


Diskette Bombs                                  by the Jolly Roger

You need:

 - A disk
 - Scissors
 - White or blue kitchen matches (they MUST be these colors!)
 - Clear nail polish

- Carefully open up the diskette (3.5" disks are best for this!)

- Remove the cotton covering from the inside.

- Scrape a lot of match powder into a bowl (use a wooden scraper,
metal might spark the matchpowder!)

- After you have a lot, spread it evenly on the disk.

- Using the nail polish, spread it over the match mixture

- Let it dry

- Carefully put the diskette back together and use the nail polish
to seal it shut on the inside (where it came apart).

- When that disk is in a drive, the drive head attempts to read
the disk, which causes a small fire (ENOUGH HEAT TO MELT THE DISK
DRIVE AND FUCK THE HEAD UP!!). ahahahahaha! Let the fuckhead try
and fix THAT!!!                        -Jolly Roger-



Unlisted Phone Numbers                          by The Jolly Roger

There are a couple of different ways of doing this. Let's see if
this one will help: Every city has one or more offices dedicated
to assigning numbers to the telephone wire pairs. These offices
are called DPAC offices and are available to service reps who are
installing or repairing phones. To get the DPAC number, a service
rep would call the customer service number for billing information
in the town that the number is located in that he is trying to get
the unlisted number of. (Got that?) The conversation would go
something like this: "Hi, Amarillo, this is Joe from Anytown
business office, I need the DPAC number for the south side of
town." This info is usually passed out with no problems, so... if
the first person you call doesn't have it, try another. REMEMBER,
no one has ANY IDEA who the hell you are when you are talking on
the phone, so you can be anyone you damn well please! (heheheheh!)
When you call the DPAC number, just tell them that you need a
listing for either the address that you have, or the name. DPAC
DOES NOT SHOW WHETHER THE NUMBER IS LISTED OR UNLISTED!! Also, if
you're going to make a habit of chasing numbers down, you might
want to check into geting a criss-cross directory, which lists
phone numbers by their addresses. It costs a couple-a-hundred bux,
but it is well worth it if you have to chase more than one or two



numbers down!                                -Jolly Roger-


Fuses                            brought to you by The Jolly Roger

You would be surprised how many files are out there that use what
falls under the category of a "fuse." They assume that you just
have a few lying around, or know where to get them. Well, in some
parts of the country, fuses are extremely hard to come by... so
this file tells you how to make your own. Both fuses presented
here are fairly simple to make, and are fairly reliable.

SLOW BURNING FUSE
~~~~~~~~~~~~~~~~~ (approx. 2 inches per minute)

Materials needed:

 - Cotton string or 3 shoelaces
 - Potassium Nitrate or Potassium Chlorate
 - Granulated sugar

Procedure:

 - Wash the cotton string or showlaces in HOT soapy water, then
rinse with fresh water

 - Mix the following together in a glass bowl:
   1 part potassium nitrate or potassium chlorate
   1 part granulated sugar
   2 parts hot water

 - Soak strings or shoelaces in this solution

 - Twist/braid 3 strands together and allow them to dry

 - Check the burn rate to see how long it actually takes!!

FAST BURNING FUSE
~~~~~~~~~~~~~~~~~ (40 inches per minute)

Materials needed:

 -Soft cotton string
 -fine black powder (empty a few shotgun shells!)
 -shallow dish or pan

Procedure:

 - moisten powder to form a paste

 - twist/braid 3 strands of cotton together

 - rub paste into string and allow to dry

 - Check the burn rate!!!






How to make Potassium Nitrate                   by The Jolly Roger

Potassium Nitrate is an ingredient in making fuses, among other
things. Here is how you make it:

Materials needed:

 -3.5 gallons of nitrate bearing earth or other material
 -1/2 cup of wood ashes
 -Bucket or other similar container about 4-5 gallons in volume
 -2 pieces of finely woven cloth, each a bit bigger than the
  bottom of the bucket
 -Shallow dish or pan at least as large in diameter as the bucket
 -Shallow, heat resistant container
 -2 gallons of water
 -Something to punch holes in the bottom of the bucket
 -1 gallon of any type of alcohol
 -A heat source
 -Paper & tape

Procedure:

 - Punch holes on the inside bottom of the bucket, so that the
metal is"puckered" outward from the bottom

 - Spread cloth over the holes from the bottom

 - Place wood ashes on the cloth. Spread it out so that it covers
the entire cloth and has about the same thickness.

 - Place 2nd cloth on top of the wood ashes

 - Place the dirt or other material in the bucket

 - Place the bucket over the shallow container. NOTE: It may need
support on the bottom so that the holes on the bottom are not
blocked.

 - Boil water and pour it over the earth very slowly. Do NOT pour
it all at once, as this will clog the filter on the bottom.

 - Allow water to run through holes into the shallow dish on the
bottom.

 - Be sure that the water goes through ALL of the earth!

 - Allow water in dish to cool for an hour or so

 - Carefully drain the liquid in the dish away, and discard the
sludge in the bottom

 - Boil this liquid over a fire for at least two hours. Small
grains of salt will form - scoop these out with the paper as they
form

 - When the liquid has boiled down to 1/2 its original volume let
it sit




 - After 1/2 hour, add equal volume of the alcohol; when this
mixture is poured through paper, small white crystals appear. This
is the posassium nitrate.

Purification:

 - Redissolve crystals in small amount of boiling water

 - Remove any crystals that appear

 - Pour through improvised filter then heat concentrated solution
to dryness.

 - Spread out crystals and allow to dry


Exploding lightbulbs                            by The Jolly Roger

Materials needed:

 -lightbulb (100w)
 -socket (duh...)
 -1/4 cup soap chips
 -blackpowder! (open some shotgun shells!)
 -1/4 cup kerosene orgasoline
 -adhesive tape
 -lighter or small blowtorch
 -glue

Procedure for a simple exploding lightbulb:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 - Drill a small hole in the top of the bulb near the threads!

 - Carefully pour the blackpowder into the hole. Use enough so
that it touches the filament!

 - Insert into socket as normal (make sure the light is off or
else YOU will be the victim!!)

 - Get the hell out!!

Procedure for a Napam Bulb:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

 - Heat kerosene/gasoline in a double boiler

 - Melt soap chips, stirring slowly.

 - Put somewhere and allow to cool

 - Heat the threads of the bulb VERY carefully to melt the glue.
Remove threads, slowly drawing out the filament. Do NOT break the
cheap electrical igniters and/or the filament or this won't work!!

 - Pour the liquid into the bulb, and slowly lower the filament
back down into the bulb. Make sure the filament is dipped into the
fluid.



ç - Re-glue the threads back on. Insert it into a socket frequently
used by the victim and get the hell out!!

When the victim flips the switch, he will be in for a BIG surprise!

Have fun!                              -Jolly Roger-



Under water igniters                            by The Jolly Roger

Materials needed:

 -Pack of 10 silicon diodes (available at Radio Shack. you will
  know you got the right ones if they are very, very small glass
  objects!)
 -Pack of matches
 -1 candle

Procedure:

 - Light the candle and allow a pool of molten wax to form in the
top.

 - Take a single match and hold the glass part of a single diode
against the head. Bend the diode pins around the matchhead so that
one wraps in an upward direction and thensticks out to the side.
Do the same with the other wire, but in a downward direction. The
diodes should now be hugging the matchhead, but its wires MUST NOT
TOUCH EACH OTHER!

 - Dip the matchhead in wax to give it a water-proof coat. These
work underwater

 - repeat to make as many as you want

How to use them:

When these little dudes are hooked across a 6v battery, the diode
reaches what is called breakdown voltage. When most electrical
components reach this voltage, they usually produce great amounts
of heat and light, while quickly melting into a little blob. This
heat is enough to ignite a matchhead. These are recommended for
use underwater, where most other igniters refuse to work. ENJOY!
                                          -Jolly Roger-


Home-brew blast cannon                          by The Jolly Roger

Materials needed:

 -1 plastic drain pipe, 3 feet long, at least 3 1/2 inches in
  diameter
 -1 smaller plastic pipe, about 6 inches long, 2 inches in
  diameter
 -1 large lighter, with fluid refills (this gobbles it up!)
 -1 pipe cap to fit the large pipe, 1 pipe cap to fit the small
  pipe



 -5 feet of bellwire
 -1 SPST rocker switch
 -16v polaroid pot-a-pulse battery
 -15v relay (get this at Radio Shack)
 -Electrical Tape
 -One free afternoon

Procedure:

 - Cut the bell wire into three equal pieces, and strip the ends

 - Cut a hole in the side of the large pipe, the same diameter as
the small pipe. Thread the hole and one end of the small pipe.
they should screw together easily.

 - Take a piece of scrap metal, and bend it into an "L" shape,
then attach it to the level on the lighter:

 /------------------------gas switch is here
 V
 /------
!lighter!!<---metal lever
!!!
!!

Now, every time you pull the 'trigger' gas should flow freely from
the lighter. You may need to enlarge the 'gas port' on your
lighter, if you wish to be able to fire more rapidly.

 - Connect two wires to the two posts on the switch

 - Cut two holes in the side of the smaller tube, one for the
switch on the bottom, and one for the metal piece on the top.
Then, mount the switch in the bottom, running the wires up and out
of the top.

 - Mount the lighter/trigger in the top. Now the switch should
rock easily, and the trigger should cause the lighter to pour out
gas. Re-screw the smaller tube into the larger one, hold down the
trigger a bit, let it go, and throw a match in there. If all goes
well, you should hear a nice big 'THUD!'

 - Get a hold of the relay, and take off the top.

1---------------
v/
 2--------------/<--- the center object is the metal finger inside
                3                                       the relay
 cc-------------/
 oo----------------4
 ii
 ll----------------5

Connect (1) to one of the wires coming from the switch. Connect
(2) to (4), and connect (5) to one side of the battery. Connect
the remaining wire from the switch to the other side of the
battery. Now you should be able to get the relay to make a little
'buzzing' sound when you flip the switch and you should see some



tiny little sparks.

 - Now, carefully mount the relay on the inside of the large pipe,
towards the back. Screw on the smaller pipe, tape the battery to
the side of the cannon barrel (yes, but looks aren't everything!)

 - You should now be able to let a little gas into the barrel and
set it off by flipping the switch.

 - Put the cap on the back end of the large pipe VERY SECURELY.
You are now ready for the first trial-run!

To Test:

Put something very, very large into the barrel, just so that it
fits 'just right'. Now, find a strong guy (the recoil will
probably knock you on your ass if you aren't careful!). Put on a
shoulderpad, earmuffs, and possibly some other protective clothing
(trust the Jolly Roger! You are going to need it!). Hold the
trigger down for 30 seconds, hold on tight, and hit the switch.
With luck and the proper adjustments, you should be able to put a
frozed orange through 1/4 or plywood at 25 feet.

Have fun!                                  -Jolly Roger-


Chemical Equivalency list                       by the Jolly Roger

Acacia..................................................Gum Arabic
Acetic Acid................................................Vinegar
Aluminum Oxide..............................................Alumia
Aluminum Potassium Sulphate...................................Alum
Aluminum Sulfate..............................................Alum
Ammonium Carbonate.......................................Hartshorn
Ammonium Hydroxide.........................................Ammonia
Ammonium Nitrate........................................Salt Peter
Ammonium Oleate.......................................Ammonia Soap
Amylacetate............................................Bananna Oil
Barium Sulfide...........................................Black Ash
Carbon Carbinate.............................................Chalk
Carbontetrachloride.................................Cleaning Fluid
Calcium Hypochloride..............................Bleaching Powder
Calcium Oxide.................................................Lime
Calcium Sulfate...................................Plaster of Paris
Carbonic Acid..............................................Seltzer
Cetyltrimethylammoniumbromide........................Ammonium Salt
Ethylinedichloride.....................................Dutch Fluid
Ferric Oxide.............................................Iron Rust
Furfuraldehyde............................................Bran Oil
Glucose.................................................Corn Syrup
Graphite...............................................Pencil Lead
Hydrochloric Acid....................................Muriatic Acid
Hydrogen Peroxide.........................................Peroxide
Lead Acetate.........................................Sugar of Lead
Lead Tero-oxide...........................................Red Lead
Magnesium Silicate............................................Talc
Magnesium Sulfate.......................................Epsom Salt
Methylsalicylate..................................Winter Green Oil



Naphthalene..............................................Mothballs
Phenol...............................................Carbolic Acid
Potassium Bicarbonate..............................Cream of Tarter
Potassium Chromium Sulfate..............................Chromealum
Potassium Nitrate.......................................Salt Peter
Sodium Oxide..................................................Sand
Sodium Bicarbonate.....................................Baking Soda
Sodium Borate................................................Borax
Sodium Carbonate......................................Washing Soda
Sodium Chloride...............................................Salt
Sodium Hydroxide...............................................Lye
Sodium Silicate..............................................Glass
Sodium Sulfate......................................Glauber's Salt
Sodium Thiosulfate.............................Photographer's Hypo
Sulfuric Acid.........................................Battery Acid
Sucrose.................................................Cane Sugar
Zinc Chloride.......................................Tinner's Fluid
Zinc Sulfate.........................................White Vitriol



Phone Taps                                      by The Jolly Roger

Here is some info on phone taps. In this file is a schematic for a
simple wiretap & instructions for hooking up a small tape recorder
control relay to the phone line.

First, I will discuss taps a little. There are many different
types of taps. there are transmitters, wired taps, and induction
taps to name a few. Wired and wireless transmitters must be
physically connected to the line before they will do any good.
Once a wireless tap is connected to the line,it can transmit all
conversations over a limited reception range. The phones in the
house can even be modifies to pick up conversations in the room
and transmit them too! These taps are usually powered off of the
phone line, but can have an external power source. You can get more
information on these taps by getting an issue of Popular
Communications and reading through the ads. Wired taps, on the
other hand, need no power source, but a wire must be run from the
line to the listener or to a transmitter. There are obvious
advantages of wireless taps over wired ones. There is one type of
wireless tap that looks like a normal telephone mike. All you have
to do is replace the original mike with thisand itwill transmit
all conversations! There is also an exotic type of wired tap known
as the 'Infinity Transmitter' or 'Harmonica Bug'. In order to hook
one of these, it must be installed inside the phone. When someone
calls the tapped phone & *before* it rings,blows a whistle over
the line, the transmitter picks up the phone via a relay. The mike
on the phone is activated so that the caller can hear all of the
conversations in the room. There is a sweep tone test at
415/BUG-1111 which can be used to detect one of these taps. If one
of these is on your line & the test # sends the correct tone, you
will hear a click. Induction taps have one big advantage over taps
that must be physically wired to the phone. They do not have to be
touching the phone in order to pick up the conversation. They work
on the same principle as the little suction-cup tape recorder
mikes that you can get at Radio Shack. Induction mikes can be
hooked up to a transmitter or be wired.



çHere is an example of industrial espionage using the phone:
 A salesman walks into an office & makes a phone call. He fakes
the conversation, but when he hangs up he slips some foam rubber
cubes into the cradle. The called party can still hear all
conversations in the room. When someone picks up the phone, the
cubes fall away unnoticed.

A tap can also be used on a phone to overhear what your modem is
doing when you are wardialing, hacking, or just plain calling a
bbs (like the White Ruins! Denver, Colorado! 55 megs online!
Atari! Macintosh! Amiga! Ibm! CALL IT! 303-972-8566! By the way, i
did this ad without the sysops consent or knowledge!).

Here is the schematic:
-------)!----)!(------------->
             )!(
  Cap ^      )!(
             )!(
             )!(
             )!(
     ^^^^^---)!(------------->
       ^  100K
       !
       ! <Input

The 100K pot is used for volume. It should be on its highest
(least resistance) setting if you hook a speaker across the
output. but it should be set on its highest resistance for a tape
recorder or amplifier. You may find it necessary to add another
10 - 40K. The capacitor should be around .47 MFD. It's only
purpose is to prevent the relay in the phone from tripping &
thinking that you have the phone off of the hook. the audio output
transformer is available at Radio Shack. (part # 273-138E for
input). The red & the white wires go to the output device. You may
want to experiment with the transformer for the best output.
Hooking up a tape recorder relay is easy. Just hook one of the phone
wires (usually red) to the the end of one of the relay & the ther
end just loop around. This bypasses it. It should look like this:

------^^^^^^^^^------------
      ---------
      RELAY^^
(part #275-004 from Radio Shack works fine)

If you think that you line is tapped, the first thing to do is to
physically inspect the line yourself ESPECIALLY the phones. You
can get mike replacements with bug detectors built in. However, I
would not trust them too much. It is too easy to get a wrong
reading.

For more info:

BUGS AND ELECTRONIC SURVEILANCE from Desert Publications
HOW TO AVOID ELECTRONIC EAVESDROPPING & PRIVACY INVASION. I do not
remember who this one is from... you might want to try Paladin
Press.

                                          -Jolly Roger-





How to make a landmine                          by The Jolly Roger

First, you need to get a pushbutton switch. Take the wires of it
and connect one to a nine volt battery connector and the other to
a solar igniter (used for launching model rockets). A very thin
piece of stereo wire will usually do the trick if you are
desperate, but I recommend the igniter. Connect the other wire of
the nine-volt battery to one end of the switch. Connect a wire
from the switch to the other lead on the solar igniter.

       switch-----------battery
         \                  /
          \                /
           \              /
            \            /
            solar  igniter
                  |
                  |
                  |
              explosive

Now connect the explosive (pipe bomb, m-80, CO2 bomb, etc.) to the
igniter by attaching the fuse to the igniter (seal it with scotch
tape). Now dig a hole; not too deep but enough to cover all of the
materials. Think about what direction your enemy will be coming from
and plant the switch, but leave the button visible (not TOO
visible!). Plant the explosive about 3-5 feet away from the switch
because there will be a delay in the explosion that depends on how
short your wick is, and, if a homemade wick is being used, its
burning speed. But if you get it right... and your enemy is close
enough......... BBBBBBBOOOOOOOOOOOOOOOOOOOOOOOOMMMM! hahahaha

                                          -Jolly Roger-


A different kind of Molitoff Cocktail               by the Jolly Roger

Here is how you do it:

 - Get a coke bottle & fill it with gasoline about half full

 - Cram a piece of cloth into the neck of it nice and tight

 - Get a chlorine tablet and stuff it in there. You are going to have
to force it because the tablets are bigger than the opening of the
bottle.

 - Now find a suitable victim and wing it in their direction. When it
hits the pavement or any surface hard enough to break it, and the chlorine
and gasoline mix..... BOOM!!!!!!
Have fun!                                    -Jolly Roger-

Phone Systems Tutorial                          by The Jolly Roger

To start off, we will discuss the dialing procedures for domestic
as well as international dialing. We will also take a look at the



telephone numbering plan.

North American Numbering Plan
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In North America, the telephone numbering plan is as follows:

A) a 3 digit Numbering Plan Area (NPA) code , ie, area code
B) a 7 digit telephone # consisting of a 3 digit Central Office
(CO) code plus a 4 digit station #

These 10 digits are called the network address or destination
code. It is in the format of:

      Area Code         Telephone #
      ---------         -----------

         N*X             NXX-XXXX

Where: N = a digit from 2 to 9
       * = the digit 0 or 1
       X = a digit from 0 to 9

Area Codes
~~~~~~~~~~

Check your telephone book or the seperate listing of area codes
found on many bbs's. Here are the special area codes (SAC's):

   510 - TWX (USA)
   610 - TWX (Canada)
   700 - New Service
   710 - TWX (USA)
   800 - WATS
   810 - TWX (USA)
   900 - DIAL-IT Services
   910 - TWX (USA)

The other area codes never cross state lines, therefore each state
must have at least one exclusive NPA code. When a community is
split by a state line, the CO #'s are often interchangeable (ie,
you can dial the same number from two different area codes).

TWX (Telex II) consists of 5 teletype-writer area codes. They are
owned by Western Union. These SAC's may only be reached via other
TWX machines. These run at 110 baud (last I checked! They are most
likely faster now!). Besides the TWX #'s, these machines are
routed to normal telephone #'s. TWX machines always respond with
an answerback. For example, WU's FYI TWX # is [phone]. The
answerback for this service is "WU FYI MAWA".

If you don't want to but a TWX machine, you can still send TWX
messages using Easylink [800/325-4112]. However you are gonna have
to hack your way onto this one!

700:

700 is currently used by AT&T as a call forwarding service. It is



targeted towards salesmen on the run. To understand how this
works, I'll explain it with an example. Let's say Joe Q. Salespig
works for AT&T security and he is on the run chasing a phreak
around the country who royally screwed up an important COSMOS
system. Let's say that Joe's 700 # is [phone]. Everytime
Joe goes to a new hotel (or most likely SLEAZY MOTEL), he dials a
special 700 #, enters a code, and the number where he is staying.
Now, if his boss received some important info, all he would do is
dial [phone] and it would ring wherever Joe last progammed
it to. Neat, huh?

800:

This SAC is one of my favourites since it allows for toll free
calls. INWARD WATS (INWATS), or Inward Wide Area
Telecommunications Service is the 800 #'s that we are all familiar
with. 800 #'s are set up in service areas or bands. There are 6 of
these. Band 6 is the largest and you can call a band 6 # from
anywhere in the US except the state where the call is terminated
(that is why most companies have one 800 number for the countery
and then another one for their state.) Band 5 includes the 48
contiguous states. All the way down to band 1 which includes only
the states contiguous to that one. Therefore, less people can
reach a band 1 INWATS # than a band 6 #.

Intrastate INWATS #'s (ie, you can call it from only 1 state)
always have a 2 as the last digit in the exchange (ie, 800-NX2-
XXXX). The NXX on 800 #'s represent the area where the business is
located. For example, a # beginning with 800-431 would terminate
at a NY CO.

800 #'s always end up in a hunt series in a CO. This means that it
tries the first # allocated to the company for their 800 lines; if
this is busy, it will try the next #, etc. You must have a minimum
of 2 lines for each 800 #. For example, Travelnet uses a hunt
series. If you dial [phone], it will first try the #
associated with 8400; if it is busy it will go to the next
available port, etc. INWATS customers are billed by the number of
hours of calls made to their #.

OUTWATS (OUTWARD WATS): OUTWATS are for making outgoing calls
only. Largecompanies use OUTWATS since they receive bulk-rate
discounts. Since OUTWATS numbers cannot have incoming calls, they
are in the format of:

   (800) *XXX-XXXX

Where * is the digit 0 or 1 (or it may even be designated by a
letter) which cannot be dialed unless you box the call. The *XX
identifies the type of service and the areas that the company can
call.

Remember:

 INWATS + OUTWATS = WATS EXTENDER

900:




This DIAL-IT SAC is a nationwide dial-it service. It is use for
taking television polls and other stuff. The first minute
currently costs an outrageous 50-85 cents and each additional
minute costs 35-85 cents. Hell takes in a lot of revenue this way!

Dial [phone] to find out what is currently on this service.

CO CODES
~~~~~~~~

These identify the switching office where the call is to be
routed. The following CO codes are reserved nationwide:

   555 - directory assistance
   844 - time. These are now in!
   936 - weather the 976 exchange
   950 - future services
   958 - plant test
   959 - plant test
   970 - plant test (temporary)
   976 - DIAL-IT services

Also, the 3 digit ANI & ringback #'s are regarded as plant test
and are thus reserved. These numbers vary from area to area.

You cannot dial a 0 or 1 as the first digit of the exchange code
(unless using a blue box!). This is due to the fact that these
exchanges (000-199) contains all sorts of interesting shit such as
conference #'s, operators, test #'s, etc.

950:

Here are the services that are currently used by the 950 exchange:

   1000 - SPC
   1022 - MCI Execunet
   1033 - US Telephone
   1044 - Allnet
   1066 - Lexitel
   1088 - SBS Skyline

These SCC's (Specialized Common Carriers) are free from fortress
phones! Also, the 950 exchange will probably be phased out with
the introduction of Equal Access

Plant Tests:

These include ANI, Ringback, and other various tests.

976:

Dial 976-1000 to see what is currently on the service. Also, many
bbs's have listings of these numbers.

N11 codes:
----------
Bell is trying to phase out some of these, but they still exist in
most areas.



ç  011 - international dialing prefix
  211 - coin refund operator
  411 - directory assistance
  611 - repair service
  811 - business office
  911 - EMERGENCY

International Dialing
~~~~~~~~~~~~~~~~~~~~~

With International Dialing, the world has been divided into 9
numbering zones. To make an international call, you must first
dial: International Prefix + Country code + National #

In North America, the international dialing prefix is 011 for
station-to-station calls. If you can dial International #'s
directly in your area then you have International Direct Distance
Dialing (IDDD).

The country code, which varies from 1 to 3 digits, always has the
world numbering zone as the first digit. For example, the country
code for the United Kingdom is 44, thus it is in world numbering
zone 4. Some boards may contain a complete listing of other
country codes, but here I give you a few:

   1 - North America (US, Canada, etc.)
  20 - Egypt
 258 - Mozambique
  34 - Spain
  49 - Germany
  52 - Mexico (southern portion)
   7 - USSR
  81 - Japan
  98 - Iran (call & hassle those bastards!)

If you call from an area other than North America, the format is
generally the same. For example, let's say that you wanted to call
the White House from Switzerland to tell the prez that his
numbered bank account is overdrawn (it happens, you know! ha ha).
First you would dial 00 (the SWISS international dialing refix),
then 1 (the US country code), followed by 202-456-1414 (the
national # for the White House. Just ask for Georgy and give him
the bad news!)

Also, country code 87 is reserved for Maritime mobile service, ie,
calling ships:

   871 - Marisat (Atlantic)
   871 - Marisat (Pacific)
   872 - Marisat (Indian)

International Switching:
------------------------

In North America there are currently 7 no. 4 ESS's that perform
the duty of ISC (Inter-nation Switching Centers). All
international calls dialed from numbering zone 1 will be routed
through one of these "gateway cities". They are:



ç  182 - White Plains, NY
  183 - New York, NY
  184 - Pittsburgh, PA
  185 - Orlando, Fl
  186 - Oakland, CA
  187 - Denver, CO
  188 - New York, NY

The 18X series are operator routing codes for overseas access (to
be furthur discussed with blue boxes). All international calls use
a signaling service called CCITT.It is an international standard
for signaling.

Ok.. there you go for now! If you wanna read more about this, read
part two which is the next file #36 in the Jolly Roger's cookbook!

                                       -Jolly Roger-


Phone Systems Tutorial part II                  by The Jolly Roger

Part II will deal with the various types of operators, office
heirarchy, & switching equipment.

Operators
~~~~~~~~~

There are many types of operators in the network and the more
common ones will be discussed.

TSPS Operator:

The TSPS [(Traffic Service Position System) ass opposed to This
Shitty Phone Service] Operator is probably the bitch (or bastard,
for the female libertationists out there) that most of us are used
to having to deal with. Here are his/her responsibilities:

1) Obtaning billing information for calling card or third number
calls

2) Identifying called customer on person-to-person calls.

3) Obtaining acceptance of charges on collect calls.

4) Identifying calling numbers. This only happens when the calling
# is not automatically recorded by CAMA (Centralized Automatic
Message Accounting) & forwarded from the local office. This could
be caused by equipment failures (ANIF- Automatic Number
Identification Failure) or if the office is not equipped for CAMA
(ONI- Operator Number Identification).

<I once has an equipment failure happen to me & the TSPS operator
came on and said, "What # are you calling FROM?" Out of curiosity,
I gave her the number to my CO, she thanked me & then I was
connected to a conversation that appeared to be between a frameman
& his wife. Then it started ringing the party I wanted to
originally call & everyone phreaked out (excuse the pun). I
immediately dropped this dual line conference!



çYou should not mess with the TSPS operator since she KNOWS which
number that you are calling from. Your number will show up on a
10-digit LED read-out (ANI board). She also knows whether or not
you are at a fortress phone & she can trace calls quite readily!
Out of all of the operators, she is one of the MOST DANGEROUS.

INWARD operator:

This operator assists your local TSPS ("0") operatorin connecting
calls. She will never question a call as long as the call is
withing HER SERVICE AREA. She can only be reached via other
operators or by a blue box. From a blue box, you would dial
KP+NPA+121+ST for the INWARD operator that will help you connect
any calls within that NPA only. (Blue Boxing will be discussed in
a future file).

DIRECTORY ASSISTANCE Operator:

This is the operator that you are connected to when you dial: 411
or NPA-555-1212. She does not readily know where you are calling
from. She does not have access to unlisted numbers, but she DOES
know if an unlisted # exists for a certain listing.

There is also a directory assistance operator for deaf people who
use teletypewriters. If your modem can transfer BAUDOT [(45.5
baud). One modem that I know of that will do this is the Apple Cat
acoustic or the Atari 830 acoustic modem. Yea I know they are hard
to find... but if you wanna do this.. look around!) then you can
call him/her up and have an interesting conversation. The # is:
800-855-1155. They use the standard Telex abbreviations such as GA
for go ahead. they tend to be nicer and will talk longer than your
regular operators. Also, they are more vulnerable into being
talked out of information through the process of "social
engineering" as Chesire Catalyst would put it.

<Unfortunately, they do not have access to much. I once
bullshitted with one of these operators a while back and I found
out that there are 2 such DA offices that handle TTY. One is in
Philadelphia and the other is in California. They have approx. 7
operators each. most of the TTY operators think that their job is
boring (based on an official "BIOC poll"). They also feel that
they are under-paid. They actually call up a regular DA # to
process your request (sorry, no fancy computers!)

Other operators have access to their own DA by dialing
KP+NPA+131+ST (MF).

CN/A operators:

CN/A Operators are operators that do exactly the opposite of what
directory assistance operators are for. In my experience, these
operators know more than the DA op's do & they are more
susceptable to "social engeneering." It is possible to bullshit a
CN/A operator for the NON-PUB DA # (ie, you give them the name &
they give you the unlisted number. See the article on unlisted
numbers in this cookbook for more info about them.). This is due
to the fact that they assume that you are a fellow company
employee. Unfortunately, the AT&T breakup has resulted in the



break-up of a few NON-PUB DA #'s and policy changes in CN/A

INTERCEPT Operator:

The intercept operator is the one that you are connected to when
there are notenough recordings available to tell you that the #
has been disconnected or changed. She usually says, "What # you
callin'?" with a foreign accent. This is the lowest operator
lifeform. Even though they don't know where you are calling from,
it is a waste or your time to try to verbally abuse them since
they usually understand very little English anyway.

Incidentally, a few area DO have intelligent INTERCEPT Operators.

OTHER Operators:

And then there are the: MObile, Ship-to-Shore, Conference, Marine
Verify, "Leave Word and Call Back," Rout & Rate
(KP+800+141+1212+ST), & other special operators who have one
purpose or another in the network.

Problems with an Operator> Ask to speak to their supervisor... or
better yet the Group Chief (who is the highest ranking official in
any office) who is the equivalent of the Madame ina whorehouse.

By the way, some CO's that willallow you to dial a 0 or 1 as the
4th digit, will also allow you to call special operators & other
fun Tel. Co. #'s without a blue box. This is ver rare, though! For
example,212-121-1111 will get you a NY Inward Operator.

Office Hierarchy
~~~~~~~~~~~~~~~~

Every switching office in North America (the NPA system), is
assigned an office name and class. There are five classes of
offices numbered 1 through 5. Your CO is most likely a class 5 or
end office. All long-distance (Toll) calls are switched by a toll
office which can be a class 4, 3, 2, or 1 office. There is also a
class 4X office callen an intermediate point. The 4X office is a
digital one that can have an unattended exchange attached to it
(known as a Remote Switching Unit (RSU)).

The following chart will list the Office #, name, & how many of
those office exist (to the best of my knowledge) in North America:

Class                 Name           Abb          # Existing
-----        ----------------------- ---      -----------------
> 1          Regional Center          RC                   12
> 2          Sectional Center         SC                   67
> 3          Primary Center           PC                  230
> 4          Toll Center              TC                1,300
> 4P         Toll Point               TP                 n/a
> 4X         Intermediate Point       IP                 n/a
> 5          End Office               EO               19,000
> 6          RSU                     RSU                 n/a

When connecting a call from one party to another, the switching
equipment usually tries to find the shortest route between the



class 5 end office of the caller & the class 5 end officeof the
called party. If no inter-office trunks exist between the two
parties, it will then move upward to the next highest office for
servicing calls (Class 4). If the Class 4 office cannot handle the
call by sending it to another Class 4 or 5 office, it will then be
sent to the next highest office in the hierarchy (3). The
switching equipment first uses the high-usage interoffice trunk
groups, if they are busy then it goes to the fina; trunk groups on
the next highest level. If the call cannot be connected, you will
probably get a re-order [120 IPM (interruptions per minute) busy
signal] signal. At this time, the guys at Network Operations are
probably shitting in their pants and trying to avoid the dreaded
Network Dreadlock (as seen on TV!).

It is also interesting to note that 9 connections in tandem is
called ring-around-the-rosy and it has never occured in telephone
history. This would cause an endless loop connection [a neat way
to really screw up the network].

The 10 regional centers in the US & the 2 in Canada are all
interconnected. they form the foundation of the entire telephone
network. Since there are only 12 of them, they are listed below:

Class 1 Regional Office Location   NPA
--------------------------------   ---
Dallas 4 ESS                       214
Wayne, PA                          215
Denver 4T                          303
Regina No. 2SP1-4W (Canada)        306
St. Louis 4T                       314
Rockdale, GA                       404
Pittsburgh 4E                      412
Montreal No. 1 4AETS (Canada)      504

That's it for now! More info to come Future update to the
Cookbook! Have fun!                        -Jolly Roger-



Basic Alliance Teleconferencing                 Courtesy of the Jolly Roger

Introduction:
------------
This phile will deal with accessing, understanding and using the Alliance
Teleconferencing Systems.... it has many sections and for best use should
be printed out...enjoy...

Alliance:
--------
Alliance Teleconferencing is an independant company which allows the
general
public to access and use it's conferencing equipment.  Many rumors have
been floating apound that Alliance is a subsidary of AT&T.
Well, they are wrong.  As stated above, Alliance is an entirely independant
company.  They use sophisticated equipment to allow users to talk to many
people at once.

The Number:



---------
Alliance is in the 700 exchange, thus it is not localized, well, not
in a way.  Alliance is only in certain states, and only
residents of these certain states can access by dialing direct.  This,
however, will be discussed in a later chapter.  The numbers for alliance
are
as follows:
     0-700-456-1000 (chicago)
              -1001 (los angeles)
              -1002 (chicago)
              -1003 (houston)
              -2000 (?)
              -2001 (?)
              -2002 (?)
              -2003 (?)
              -3000 (?)
              -3001 (?)
              -3002 (?)
              -3003 (?)

The locations of the first 4 numbers are known and i have stated them.
However, the numbers in the 200x and 300x are not definately known.
Rumor has it that the pattern repeats itself but this has not been proven.

Dialing:
-------
As stated before, Alliance is only in certain stated and only these states
can access them via dialing direct.  However, dialing direct causes your
residence to be charged for the conference and conference bills are not
low!!!
Therefore, many ways have been discovered to start a conference without
having it billed to ones house.  They are as follows:

     1) Dialing through a PBX
     2) Incorporating a Blue Box
     3) Billing to a loop
     4) Billing to a forwarded call

I am sure there are many more but these are the four i will deal with.

Dialing through a PBX:
------- ------- - ---
Probably the easiest method of creating a free conference is through a PBX.
Simply call one in a state that has Alliance, input the PBX's code,
dial 9 for an outside line and then dial alliance.
An example of this would be:

PBX: 800-241-4911

When it answers it will give you a tone.  At this tone input your code.

Code: 1234

After this you will receive another tone, now dial 9 for an outside line.
You will now hear a dial tone.  Simply dial Alliance from this point and
the conference will be billed to the PBX.

Using a Blue Box:



----- - ---- ---
Another rather simple way of starting a conference is with a Blue Box.
The following procedure is how to box a conference:
Dial a number to box off of.  In this example we will use 609-609-6099
When the party answers hit 2600hz.  This will cause the fone company's
equipment to think that you have hung up.  You will hear a <beep><kerchunk>
You have now 'seized' a trunk.  After this, switch to multi-frequency
and dial:

KP-0-700-456-x00x-ST
KP=KP tone on Blue Box
x=variable between 1 and 3
ST=ST tone on Blue Box
The equipment now thinks that the operator has dialed Alliance from her
switchboard and the conference shall be billed there.  Since Blue Boxing
is such a large topic, this is as far as I will go into it's uses.

Billing to a loop:
------- -- - ----
A third method of receiving a free conference is by billing out to a
loop.  A loop is 2 numbers that when two people call, they can talk
to each other.  You're saying woop-tee-do right? Wrong! Loops can be
<very> usefull to phreaks.  First, dial alliance direct.  After going
through the beginning procedure, which will be discussed later in this
tutorial, dial 0 and wait for an Alliance operator.  When she answers
tell her you would like to bill the conference to such and such a
number. (A loop where your phriend is on the other side) She will then
call that number to receive voice verification.
Of course your phriend will be waiting and will accept the charges.
Thus, the conference is billed to the loop.

Billing to call forwarding:
------- -- ---- ----------
When you dial a number that is call forwarded, it is first answered by
the original location, then forwarded.  The original location will
hang up if 2600hz is received from only ond end of the line.
Therefore, if you were to wait after the forwarded residence answered,
you would receive the original location's dial tone.

     Example:
Dial 800-325-4067
The original residence would answer, then forward the call, a second
type of ringing would be heard.  When this second residence answers
simply wait until they hang up.  After about twenty seconds you will
then receive the original residence's dial tone since it heard 2600hz
from one end of the line.  Simply dial Alliance from this point and the
conference will be billed to the original residence.
These are the four main ways to receive a free conference.  I am sure
many more exist, but these four are quite handy themselves.

Logon Procedure:
----- ---------
Once Alliance answers you will hear a two-tone combination.  This is their
way of saying 'How many people do you want on the conference dude?'
Simply type in a 2-digit combination, depending on what bridge of Alliance
you are on, between 10 and 59.  After this either hit '*' to cancel the
conference size and inout another or hit '#' to continue.
You are now in Alliance Teleconferencing and are only seconds away from



having your own roaring conference going strong!!!

Dialing in Conferees:
------- -- ---------
To dial your first conferee, dial 1+npa+pre+suff and await his/her answer.

npa=area code
pre=prefix
suff=suffix

If the number is busy, or if no one answers simply hit '*' and your call
will be aborted.  But, if they do answer, hit the '#' key.
This will add them to the conference.
Now commence dialing other conferees.

Joining Your Conference:
------- ---- ----------
To join your conference from control mode simply hit the '#' key.
Within a second or two you will be chatting with all your buddies.
To go back into control mode, simply hit the '#' key again.

Transferring Control:
------------ -------
To transfer control to another conferee, go into control mode, hit the
# 6+1+npa+pre+suff of the conferee you wish to give control to. If after,
you wish to abort this transfer hit the '*' key.

<note>:Transfer of control is often not available.  When you
receive a message stating this, you simply cannot transfer control.

Muted Conferences:
----- -----------
To request a muted conference simply hit the 9 key.  I am not exactly
sure what a muted conference is but it is probably a way to keep unwanted
eavesdroppers from listening in.

Dialing Alliance Operators:
------- -------- ---------
Simply dial 0 as you would from any fone and wait for the operator to
answer.

Ending Your Conference:
------ ---- ----------
To end your conference all together, that is kick everyone including
yourself off, go into control mode and hit '*'...after a few seconds
simply hang up.  Your conference is over.

Are Alliance Operators Dangerous?
--- -------- --------- ---------
No.  Not in the least.  The worst they can do to you while you are having
a conference is drop all conferees including yourself.  This is in no
way harmful, just a little aggravating.

Alliance and Tracing:
-------- --- -------
Alliance can trace, as all citizens of the United States can.
But this has to all be pre-meditated and AT&T has to be called and it's
really a large hastle, therefore, it is almost never done.  Alliance simply



does not want it known that teenagers are phucking them over.
The only sort of safety equipment Alliance has on-line is a simple pen
register.  This little device simply records all the numbers of the
conferees dialed.  No big deal.  All Alliance can do is call up that
persons
number, threaten and question.  However, legally, they can do nothing
because
all you did was answer your fone.

<note>:Almost all instructions are told to the person in command by
Alliance
recordings.  A lot of this tutorial is just a listing of those
commands plus information gathered by either myself or the phellow
phreaks of the world!!!

(written by the Trooper)

Aqua Box Plans                                            by Jolly Roger

Every true phreaker lives in fear of the dreadded F.B.I. 'Lock In Trace.'
For a long time, it was impossible to escape from the Lock In Trace.
This box does offer an escape route with simple directions to it.
This box is quite a simple concept, and almost any phreaker with basic
electronics knowledge can construct and use it.

The Lock In Trace
------------------
A lock in trace is a device used by the F.B.I. to lock into the phone
users location so that he can not hang up while a trace is in progress.
For those of you who are not familiar with the conecpt of 'locking in',
then here's a brief desciption. The F.B.I. can tap into a conversation,
sort of like a three-way call connection. Then, when they get there,
they can plug electricity into the phone line. All phone connections
are held open by a certain voltage of electricity.
That is why you sometimes get static and faint connections when you are
calling far away, because the electricity has trouble keeping the line
up. What the lock in trace does is cut into the line and generate that same
voltage straight into the lines. That way, when you try and hang up,
voltage
is retained. Your phone will ring just like someone was calling you
even after you hang up. (If you have call waiting, you should understand
better about that, for call waiting intersepts the electricity and makes
a tone that means someone is going through your line. Then, it is a matter
of which voltage is higher. When you push down the receiver,then it
see-saws
the electricity to the other side. When you have a person on each line
it is impossible to hang up unless one or both of them will hang up.
If you try to hang up, voltage is retained, and your phone will ring.
That should give you an understanding of how calling works. Also, when
electricity passes through a certain point on your phone, the electricity
causes a bell to ring, or on some newer phones an electronic ring to
sound.)
So, in order to eliminate the trace, you somehow must lower the
voltage level on your phone line. You should know that every time
someone else picks up the phone line, then the voltage does decrease
a little. In the first steps of planning this out, Xerox suggested getting
about a hundred phones all hooked into the same line that could all
be taken off the hook at the same time. That would greatly decrease the



voltage level. That is also why most three-way connections that are using
the bell service three way calling (which is only $3 a month) become quite
faint after a while. By now, you should understand the basic idea. You
have to drain all of the power out of the line so the voltage can
not be kept up. Rather sudden draining of power could quickly short out
the F.B.I. voltage machine, because it was only built to sustain
the exact voltage nessecary to keep the voltage out. For now, imagine
this. One of the normal Radio Shack generators that you can go
pick up that one end of the cord that hooks into the central box has a
phone jack on it and the other has an electrical plug. This way, you
can "flash" voltage through the line, but cannot drain it. So, some
modifications have to be done.

Materials
----------
A BEOC (Basic Electrical Output Socket), like a small lamp-type
connection, where you just have a simple plug and wire that would plug
into a light bulb.
One of cords mentioned above, if you can't find one then construct your
own... Same voltage connection, but the restrainor must be built in (I.E.
The central box)
Two phone jacks (one for the modem, one for if you are being traced to
plug the aqua box into)
Some creativity and easy work.

*Notice: No phones have to be destroyed/modified to make this box, so
don't go out and buy a new phone for it!

Procedure
---------
All right, this is a very simple procedure. If you have the BEOC, it could
drain into anything: a radio, or whatever. The purpose of having
that is you are going to suck the voltage out from the phone line into
the electrical appliance so there would be no voltage left to lock
you in with.
1)Take the connection cord. Examine the plug at the end. It should have
only two prongs. If it has three, still, do not fear. Make sure the
electrical appliance is turned off unless you wanna become a crispy critter
while making this thing. Most plugs will have a hard plastic design on the
top of them to prevent you from getting in at the electrical wires inside.
Well, remove it. If you want to keep the plug (I don't see why...)
then just cut the top off. When you look inside, Lo and Behold,
you will see that at the base of the prongs there are a few wires
connecting in. Those wires conduct the power into the appliance.
So, you carefully unwrap those from the sides and pull them out until
they are about an inch ahead of the prongs. If you don't wanna keep the
jack, then just rip the prongs out. If you are, cover the prongs with
insultation tape so they will not connect with the wires when the power
is being drained from the line.
2)Do the same thing with the prongs on the other plug, so you have the
wires evenly connected. Now, wrap the end of the wires around each other.
If you happen to have the other end of the voltage cord hooked into the
phone, stop reading now, you're too fucking stupid to continue. After
you've wrapped the wires around each other, then cover the whole thing with
the plugs with insulating tape. Then, if you built your own control box
or if you bought one, then cram all the wires into it and reclose it.
That box is your ticket out of this.
3)Re-check everything to make sure it's all in place. This is a pretty



flimsy connection, but on later models when you get more experienced at
it then you can solder away at it and form the whole device into one
big box, with some kind of cheap mattel hand-held game inside to be
the power connector.  In order to use it, just keep this box handy.
Plug it into the jack if you want, but it will slightly lower the
voltage so it isn't connected. When you plug it in, if you see sparks,
unplug it and restart the whole thing. But if it just seems fine then leave
it.

Use
----
Now, so you have the whole thing plugged in and all... Do not use this
unless the situation is desperate! When the trace has gone on, don't
panic, unplug your phone, and turn on the appliance that it was hooked
to. It will need energy to turn itself on, and here's a great source...
The voltage to keep a phone line open is pretty small and a simple light
bulb should drain it all in and probably short the F.B.I. computer at
the same time.

Happy boxing and stay free!               ------------Jolly Roger


Hindenberg Bomb                                       by the Jolly Roger

Needed:1 Balloon
1 Bottle
1 Liquid Plumr
1 Piece Aluminum FoilL
1 Length Fuse

Fill the bottle 3/4 full with Liquid Plumr and add a little piece of
aluminum foil to it. Put the balloon over the neck of the bottle until
the balloon is full of the resulting gas.  This is highly flammable
hydrogen.
Now tie the baloon.  Now light the fuse, and let it rise.
When the fuse contacts the balloon, watch out!!!

-------[=How to Kill Someone==]------------[=WITH YOUR BARE HANDS=]-----

            AN EXCERPT FROM THE ANARCHISTS COOKBOOK.....
                   Courtesy of the Jolly Roger

This file will explain the basics of hand-to-hand combat, and will tell
of the best places to strike and kill an enemy...
When engaged in hand-to-hand combat, your life is always at stake.
There is only one purpose in combat, and that is to kill your enemy.
Never face an enemy with the idea of knocking him out.
The chances are extremely good that he will kill YOU instead.
When a weapon is not available, one must resort to the full
use of his natural weapons. The natural weapons are:

1. The knife edge of your hands.
2. Fingers folded at the second joint or knuckle.
3. The protruding knuckle of your second finger.
4. The heel of your hand.
5. Your boot
6. Elbows
7. Knees



8. and Teeth.

Attacking is a primary factor. A fight was never
won by defensive action. Attack with all of your strength.
At any point or any situation, some vulnerable point on your enemies
body will be open for attack. Do this while screaming as screaming has
two purposes.

1. To frighten and confuse your enemy.
2. To allow you to take a deep breath which, in turn, will put
more oxygen in your blood stream. Your balance and balance of your
enemy are two inportant factors; since, if you succeed in making
your enemy lose his balance, the chances are nine to
one that you can kill him in your next move. The best over-all
stance is where your feet are spread about shoulders width apart,
with your right foot about a foot ahead of the left. Both arms
should be bent at the elbows parallel to each other. Stand on the
balls of your feet and bend your waist slightly. Kinda of like a
boxer's crouch. Employing a sudden movement or a scream or yell can
throw your enemy off-balance. There are many vulnerable points of
the body. We will cover them now:

Eyes:Use your fingers in a V-shape and attack in gouging motion.

Nose:(Extremely vulnerable) Strike with the knife edge of the hand
along the bridge, which will cause breakage, sharp pain, temporary
blindness, and if the blow is hard enough, death. Also, deliver a blow
with the heel of your hand in an upward motion, this≡ ≡will shove the
bone up into the brain causing death.

Adam's Apple: This spot is usually pretty well protected, but if you
get the chance, strike hard with the knife edge of your hand. This
should sever the wind-pipe, and then it's all over in a matter of
minutes.

Temple: There is a large artery up here, and if you hit it hard
enough, it will cause death. If you manage to knock your enemy down,
kick him in the temple, and he'll never get up again.

Back of the Neck: A rabbit punch, or blow delivered to the base of
the neck can easily break it, but to be safe, it is better to
use the butt of a gun or some other heavy blunt object.
Upper lip: A large network of nerves are located. These nerves are
extrememly close to the skin. A sharp upward blow will cause extreme
pain, and unconciosness.

Ears: Coming up from behind an enemy and cupping the hands in a clapping
motion over the victims ears can kill him immediately. The vibrations
caused from the clapping motion will burst his eardrums, and cause
internal bleeding in the brain.

Groin: A VERY vulnerable spot. If left open, get it with knee
hard, and he'll buckle over very fast.

Kidneys: A large nerve that branches off to the spinal cord comes very
close to the skin at the kidneys. A direct blow with the knife edge
of your hand can cause death.




There are many more ways to kill and injure an enemy, but these should
work best for the average person. This is meant only as information
and I would not recommend that you use this for a simple High School Brawl.
Use these methods only, in your opinion, if your life is in danger.
Any one of these methods could very easily kill or cause permanent damage
to someone. One more word of caution, you should practice these moves
before using them on a dummy, or a mock battle with a friend.
(You don't have to actually hit him to practice, just work on accuracy.)

Phone Systems Tutorial III                      by The Jolly Roger

PREFACE:

THIS ARTICLE WILL FOCUS PRIMARILY ON THE STANDARD WESTERN ELECTRIC SINGLE-
SLOT COIN TELEPHONE (AKA FORTRESS FONE) WHICH CAN BE DIVIDED INTO 3 TYPES:
- DIAL-TONE FIRST (DTF)
- COIN-FIRST (CF):  (IE, IT WANTS YOUR $ BEFORE YOU RECEIVE A DIAL TONE)
- DIAL POST-PAY SERVICE (PP):  YOU PAYAFTER THE PARTY ANSWERS

DEPOSITING COINS (SLUGS):
-------------------------
ONCE YOU HAVE DEPOSITED YOUR SLUG INTO A FORTRESS, IT IS SUBJECTED TO A
GAMUT OF TESTS. THE FIRST OBSTACAL FOR A SLUG IS THE
MAGNETIC TRAP.  THIS WILL STOP ANY LIGHT-WEIGHT MAGNETIC SLUGS AND COINS.
IF IT PASSES THIS, THE SLUG IS THEN CLASSIFIED AS A NICKEL, DIME, OR
QUARTER.  EACH SLUG IS THEN CHECKED FOR APPROPRIATE SIZE AND WEIGHT.  IF
THESE
TESTS ARE PASSED, IT WILL THEN TRAVEL THROUGH A NICKEL, DIME, OR QUARTER
MAGNET AS APPROPRIATE.  THESE MAGNETS SET UP AN EDDY CURRENT EFFECT WHICH
CAUSES COINS OF THE APPROPRIATE CHARACTERISTICS TO SLOW DOWN SO THEY
WILL FOLLOW THE CORRECT TRAJECTORY.  IF ALL GOES WELL, THE COIN WILL FOLLOW
THE
CORRECT PATH (SUCH AS BOUNCING OFF OF THE NICKEL ANVIL) WHERE IT WILL
HOPEFULLY FALL INTO THE NARROW ACCEPTED COIN CHANNEL.
THE RATHER ELABORATE TESTS THAT ARE PERFORMED AS THE COIN TRAVELS DOWN THE
COIN CHUTE WILL STOP MOST SLUGS AND OTHER UNDESIRABLE COINS, SUCH AS
PENNIES, WHICH MUST THEN BE RETRIEVED USING THE COIN RELEASE LEVER.
IF THE SLUG MIRACULOUSLY SURVIVES THE GAMUT, IT WILL THEN STRIKE THE
APPROPRIATE TOTALIZER ARM CAUSING A RATCHET WHEEL TO ROTATE ONCE FOR EVERY
5-CENT INCREMENT (EG, A QUARTER WILL CAUSE IT TO ROTATE 5 TIMES).
THE TOTALIZER THEN CAUSES THE COIN SIGNAL OSCILLATOR TO READOUT A DUAL-
FREQUENCY SIGNAL INDICATING THE VALUE DEPOSITED TO ACTS (A COMPUTER) OR THE
TSPS OPERATOR. THESE ARE THE SAME TONES USED BY PHREAKS IN THE INFAMOUS RED
BOXES. FOR A QUARTER, 5 BEEP TONES ARE
OUTPULSED AT 12-17 PULSES PER SECOND (PPS).  A DIME CAUSES 2 BEEP TONES AT
5 - 8.5 PPS WHILE A NICKEL CAUSES ONE BEEP TONE AT 5 - 8.5 PPS.  A BEEP
CONSISTS OF 2 TONES:  2200 + 1700 HZ. A RELAY IN THE FORTRESS CALLED THE "B
RELAY" (YES, THERE IS ALSO AN 'A RELAY') PLACES A CAPACITOR ACROSS THE
SPEECH CIRCUIT DURING TOTALIZER READOUT TO PREVENT THE "CUSTOMER" FROM
HEARING THE RED BOX TONES. IN OLDER 3 SLOT PHONES:  ONE BELL
(1050-1100 HZ) FOR A NICKEL, TWO BELLS FOR A DIME, AND ONE GONG (800 HZ)
FOR A
QUARTER ARE USED INSTEAD OF THE MODERN DUAL-FREQUENCY TONES.

=============
=TSPS & ACTS=
=============




WHILE FORTRESSES ARE CONNECTED TO THE CO OF THE AREA, ALL TRANSACTIONS ARE
HANDLED VIA THE TRAFFIC SERVICE POSITION SYSTEM (TSPS).  IN AREAS THAT
DO NOT HAVE ACTS, ALL CALLS THAT REQUIRE OPERATOR ASSISTANCE, SUCH AS
CALLING CARD AND COLLECT, ARE AUTOMATICALLY ROUTED TO A TSPS OPERATOR
POSITION. IN AN EFFORT TO AUTOMATE FORTRESS
SERVICE, A COMPUTER SYSTEM KNOWN AS AUTOMATED COIN TOLL SERVICE (ACTS) HAS
BEEN IMPLEMENTED IN MANY AREAS.  ACTS LISTENS TO THE RED BOX SIGNALS FROM
THE
FONES AND TAKES APPROPRIATE ACTION.  IT IS ACTS WHICH SAYS, "TWO DOLLARS
PLEASE
(PAUSE) PLEASE DEPOSIT TWO DOLLARS FOR THE NEXT TEN SECONDS" (AND OTHER
VARIATIONS). ALSO, IF YOU TALK FOR MORE THAN THREE MINUTES AND THEN
HANG-UP,
ACTS WILL CALL BACK AND DEMAND YOUR MONEY.  ACTS IS ALSO RESPONSIBLE FOR
AUTOMATED CALLING CARD SERVICE. ACTS ALSO PROVIDE TROUBLE DIAGNOSIS FOR
CRAFTSPEOPLE (REPAIRMEN SPECIALIZING IN FORTRESSES).  FOR EXAMPLE, THERE IS
A
COIN TEST WHICH IS GREAT FOR TUNING UP RED BOXES.  IN MANY AREAS THIS TEST
CAN
BE ACTIVATED BY DIALING 09591230 AT A FORTRESS (THANKS TO KARL MARX FOR
THIS
INFORMATION).  ONCE ACTIVATED IT WILL REQUEST THAT YOU DEPOSIT VARIOUS
COINS.
IT WILL THEN IDENTIFY THE COIN AND OUTPULSE THE APPROPRIATE RED BOX
SIGNAL.  THE COINS ARE USUALLY RETURNED WHEN YOU HANG UP.
TO MAKE SURE THAT THERE IS ACTUALLY MONEY IN THE FONE, THE CO INITIATES A
"GROUND TEST" AT VARIOUS TIMES TO DETERMINE IF A COIN IS ACTUALLY IN THE
FONE.  THIS IS WHY YOU MUST DEPOSIT AT LEAST A NICKEL IN ORDER TO USE A RED
BOX!

GREEN BOXES:
------------

PAYING THE INITIAL RATE IN ORDER TO USE A RED BOX (ON CERTAIN FORTRESSES)
LEFT A SOUR TASTE IN MANY RED BOXER'S MOUTHS THUS THE GREEN BOX WAS
INVENTED.
THE GREEN BOX GENERATES USEFUL TONES SUCH AS COIN COLLECT, COIN RETURN, AND
RINGBACK.  THESE ARE THE TONES THAT ACTS OR THE TSPS OPERATOR WOULD SEND TO
THE CO WHEN APPROPRIATE. UNFORTUNATELY, THE GREEN BOX CANNOT BE USED AT A
FORTRESS STATION BUT IT MUST BE USED BY THE CALLED PARTY.

HERE ARE THE TONES:
     COIN COLLECT       700 + 1100 HZ
     COIN RETURN       1100 + 1700 HZ
     RINGBACK           700 + 1700 HZ
BEFORE THE CALLED PARTY SENDS ANY OF THESE TONES, AN OPERATOR RELEASED
SIGNAL SHOULD BE SENT TO ALERT THE MF DETECTORS AT THE CO.  THIS CAN BE
ACCOMPLISHED BY SENDING 900 + 1500 HZ OR A SINGLE 2600 HZ WINK (90 MS)
FOLLOWED BY A 60 MS GAP AND THEN THE APPROPRIATE SIGNAL FOR AT LEAST 900
MS.
ALSO, DO NOT FORGET THAT THE INITIAL RATE IS COLLECTED SHORTLY BEFORE THE 3
MINUTE PERIOD IS UP. INCIDENTALLY, ONCE THE ABOVE MF TONES
FOR COLLECTING AND RETURNING COINS REACH THE CO, THEY ARE CONVERTED INTO
AN APPROPRIATE DC PULSE (-130 VOLTS FOR RETURN & +130 VOLTS FOR COLLECT).
THIS
PULSE IS THEN SENT DOWN THE TIP TO THE FORTRESS.  THIS CAUSES THE COIN
RELAY
TO EITHER RETURN OR COLLECT THE COINS. THE ALLEGED "T-NETWORK" TAKES



ADVANTAGE
OF THIS INFORMATION.  WHEN A PULSE FOR COIN COLLECT (+130 VDC) IS SENT DOWN
THE LINE, IT MUST BE GROUNDED SOMEWHERE.  THIS IS USUALLY EITHER THE
YELLOW OR BLACK WIRE.  THUS, IF THE WIRES ARE EXPOSED, THESE WIRES CAN BE
CUT TO PREVENT THE PULSE FROM BEING GROUNDED.  WHEN THE THREE MINUTE
INITIAL PERIOD IS ALMOST UP, MAKE SURE THAT THE BLACK & YELLOW WIRES ARE
SEVERED; THEN HANG UP, WAIT ABOUT 15 SECONDS IN CASE OF A SECOND PULSE,
RECONNECT THE WIRES, PICK UP THE FONE, HANG UP AGAIN, AND IF ALL GOES WELL
IT
SHOULD BE "JACKPOT" TIME.

PHYSICAL ATTACK:
----------------

A TYPICAL FORTRESS WEIGHS ROUGHLY 50 LBS. WITH AN EMPTY COIN BOX.  MOST OF
THIS IS ACCOUNTED FOR IN THE ARMOR PLATING.  WHY ALL THE SECURITY?  WELL,
BELL CONTRIBUTES IT TO THE FOLLOWING: "SOCIAL CHANGES DURING THE 1960'S
MADE THE MULTISLOT COIN STATION A PRIME TARGET FOR:  VANDALISM, STRONG ARM
ROBBERY, FRAUD, AND THEFT OF SERVICE. THIS BROUGHT ABOUT THE INTRODUCTION
OF
THE MORE RUGGED SINGLE SLOT COIN  STATION AND A NEW ENVIRONMENT FOR COIN
SERVICE." AS FOR PICKING THE LOCK, I WILL QUOTE MR. PHELPS:
"WE OFTEN FANTASIZE ABOUT 'PICKING THE LOCK' OR 'GETTING A MASTER
KEY.'  WELL, YOU CAN FORGET ABOUT IT. I DON'T LIKE TO DISCOURAGE PEOPLE,
BUT
IT WILL SAVE YOU FROM WASTING ALOT OF OUR TIME--TIME WHICH CAN BE PUT TO
BETTER USE (HEH, HEH)." AS FOR PHYSICAL ATTACK, THE COIN PLATE
IS SECURED ON ALL FOUR SIDE BY HARDENED STEEL BOLTS WHICH PASS THROUGH TWO
SLOTS EACH.  THESE BOLTS ARE IN TURN INTERLOCKED BY THE MAIN LOCK.
ONE PHREAK I KNOW DID MANAGE TO TAKE ONE OF THE 'MOTHERS' HOME (WHICH WAS
ATTACHED TO A PIECE OF PLYWOOD AT A CONSTRUCTION SITE; OTHERWISE, THE
PERMANENT ONES ARE A BITCH TO DETACH FROM THE WALL!).  IT TOOK HIM ALMOST
TEN HOURS TO OPEN THE COIN BOX USING A POWER DRILL, SLEDGE HAMMERS, AND
CROW
BARS (WHICH WAS EMPTY -- PERHAPS NEXT TIME, HE WILL DEPOSIT A COIN FIRST TO
HEAR IF IT SLUSHES DOWN NICELY OR HITS THE EMPTY BOTTOM WITH A CLUNK.)
TAKING THE FONE OFFERS A HIGHER MARGIN OF SUCCESS.  ALTHOUGH THIS MAY BE
DIFFICULT OFTEN REQUIRING BRUTE FORCE AND THERE HAS BEEN SEVERAL CASES OF
BACK AXLES BEING LOST TRYING TO TAKE DOWN A FONE!  A QUICK AND DIRTY WAY TO
OPEN THE COIN BOX IS BY USING A SHOTGUN.  IN DETROIT, AFTER ECOLOGISTS
CLEANED OUT A MUNICIPAL POND, THEY FOUND 168 COIN PHONE RIFLED.
IN COLDER AREAS, SUCH AS CANADA, SOME SHREWD PEOPLE TAPE UP THE FONES USING
DUCT TAPE, POUR IN WATER, AND COME BACK THE NEXT DAY WHEN THE WATER WILL
HAVE
FROZE THUS EXPANDING AND CRACKING THE FONE OPEN.
IN ONE CASE, "UNAUTHORIZED COIN COLLECTORS" WHERE CAUGHT WHEN THEY
BROUGHT $6,000 IN CHANGE TO A BANK AND THE BANK BECAME SUSPICIOUS...
AT ANY RATE, THE MAIN LOCK IS AN EIGHT LEVEL TUMBLER LOCATED ON THE RIGHT
SIDE
OF THE COIN BOX.  THIS LOCK HAS 390,625 POSSIBLE POSITIONS (5 ^ 8, SINCE
THERE
ARE 8 TUMBLERS EACH WITH 5 POSSIBLE POSITIONS) THUS IT IS HIGHLY PICK
RESISTANT!  THE LOCK IS HELD IN PLACE BY 4 SCREWS.  IF THERE IS SUFFICIENT
CLEARANCE TO THE RIGHT OF THE FONE, IT IS CONCEIVABLE TO PUNCH OUT THE
SCREWS
USING THE DRILLING PATTERN BELOW (PROVIDED BY ALEXANDER MUNDY IN TAP #32):

====================================



                       !!        ^
                       !!        !
           ! 1- 3/16 " !!        !
           !<---   --->!!      1-1/2"
       --------------------      !
       !   !           !! !      !
       !  (+)         (+)-! -----------
    ---!               !! !      ^
    !  !               !! ! !
    !  !        (Z)    !! !      !
    !  !               !! !   2-3/16"
    ---!               !! !      !
       !  (+)         (+) !      !
       !               !! !      !
       -------------------- -----------
                       !!
                       !!
        (Z) KEYHOLE   (+) SCREWS
                       !!
===================================

AFTER THIS IS ACCOMPLISHED, THE LOCK CAN BE PUSHED BACKWARDS DISENGAGING
THE LOCK FROM THE COVER PLATE.  THE FOUR BOLTS OF THE COVER PLATE CAN THEN
BE RETRACTED BY TURNING THE BOLTWORKS WITH A SIMPLE KEY IN THE SHAPE OF THE
HOLE ON THE COIN PLATE (SEE DIAGRAM BELOW).  OF COURSE, THERE ARE OTHER
METHODS AND DRILLING PATTERNS.

:-------------------------------------:
                   _
                  ! !
                  ( )
                  !_!
               [ROUGHLY]
    DIAGRAM OF COVER PLATE KEYHOLE
:-------------------------------------:

THE TOP COVER USES A SIMILAR (BUT NOT AS STRONG) LOCKING METHOD WITH THE
KEYHOLE DEPICTED ABOVE ON THE TOP LEFT HIDE AND A REGULAR LOCK (PROBABLY
TUMBLER ALSO) ON THE TOP RIGHT-HAND SIDE. IT IS INTERESTING TO EXPERIMENT
WITH THE COIN SHUTE AND THE FORTRESSES OWN "RED BOX" (WHICH BELL DIDN'T
HAVE
THE 'BALLS' TO COLOR RED).

MISCELLANEOUS:
--------------

IN A FEW AREAS (RURAL & CANADA), POST-PAY SERVICE EXISTS.  WITH THIS TYPE
OF
SERVICE, THE MOUTHPIECE IS CUT OFF UNTIL THE CALLER DEPOSITS MONEY WHEN
THE CALLED PARTY ANSWERS.  THIS ALSO ALLOWS FOR FREE CALLS TO WEATHER AND
OTHER DIAL-IT SERVICES!  RECENTLY, 2600 MAGAZINE ANNOUNCED THE CLEAR BOX
WHICH
CONSISTS OF A TELEPHONE PICKUP COIL AND A SMALL AMP.  IT IS BASED ON THE≡ ≡
RINCIPAL THAT THE RECEIVER IS ALSO A WEAK TRANSMITTER AND THAT BY
AMPLIFYING
YOUR SIGNAL YOU CAN TALK VIA THE TRANSMITTER THUS AVOIDING COSTLY
TELEPHONE CHARGES! MOST FORTRESSES ARE FOUND IN THE 9XXX
AREA.  UNDER FORMER BELL AREAS, THEY USUALLY START AT 98XX (RIGHT BELOW THE



99XX OFFICIAL SERIES) AND MOVE DOWNWARD.
SINCE THE LINE, NOT THE FONE, DETERMINES WHETHER OR NOT A DEPOSIT
MUST BE MADE, DTF & CHARGE-A-CALL FONES MAKE GREAT EXTENSIONS!
FINALLY, FORTRESS FONES ALLOW FOR A NEW HOBBY--INSTRUCTION PLATE
COLLECTING.
ALL THAT IS REQUIRED IS A FLAT-HEAD SCREWDRIVER AND A PAIR OF NEEDLE-NOSE
PLIERS.  SIMPLY USE THE SCREWDRIVER TO LIFT UNDERNEATH THE PLATE SO THAT
YOU
CAN GRAB IT WITH THE PLIERS AND YANK DOWNWARDS. I WOULD SUGGEST COVERING
THE
TIPS OF THE PLIERS WITH ELECTRICAL TAPE TO PREVENT SCRATCHING.  TEN CENT
PLATES
ARE DEFINITELY BECOMING A "RARITY!"

FORTRESS SECURITY:
------------------

WHILE A LONELY FORTRESS MAY SEEM THE PERFECT TARGET, BEWARE!  THE GESTAPO
HAS BEEN KNOWN TO STAKE OUT FORTRESSES FOR AS LONG AS 6 YEARS ACCORDING TO
THE
GRASS ROOTS QUARTERLY.  TO AVOID ANY PROBLEMS, DO NOT USE THE SAME FONES
REPEATEDLY FOR BOXING, CALLING CARDS, & OTHER EXPERIMENTS.  THE TELCO KNOWS
HOW
MUCH MONEY SHOULD BE IN THE COIN BOX AND WHEN ITS NOT THERE THEY TEND TO
GET
PERTURBED (READ:  PISSED OFF).

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

                                          --------Jolly Roger

p.s. This was originally written back in my old Apple ][ days,
hence the upper case. I just did not think I should waste the
little time I have to work on this shit converting it to lower-
case. Hell, I thought 80-columns was pretty nice of me.. heh heh.
Well, enjoy this and the rest of this Cookbook! ---------JR


Black Box Plans                                 by The Jolly Roger

Introduction:
------------
At any given time, the voltage running through your phone is about 20
Volts. When someone calls you, this voltage goes up to 48 Volts and rings
the bell. When you answer, the voltage goes down to about 10 Volts.
The phone company pays attention to this. When the voltage drops to 10,
they start billing the person who called you.

Function:
--------
The Black Box keeps the voltage going through your phone at 36 Volts,
so that it never reaches 10 Volts. The phone company is thus fooled
into thinking you never answered the phone and does not bill the caller.
However, after about a half hour the phone company will get suspicious
and disconnect your line for about 10 seconds.

Materials:
---------



1 1.8K 1/2 Watt Resistor
1 1.5V LED
1 SPST Switch

Procedure:
---------
(1) Open your phone by loosening the two screws on the bottom and
lifting the case off.
(2) There should be three wires: Red, Green, and Yellow. We'll be working
with the Red Wire.
(3) Connect the following in parallel:
     A. The Resistor and LED.
     B. The SPST Switch.
In other words, you should end up with this:
              (Red Wire)
           !---/\/\/\--O--!
(Line)-----!              !-----(Phone)
           !-----_/_------!
          /\/\/\ = Resistor
          O      = LED
          _/_    = SPST

Use:
---
The SPST Switch is the On/Off Switch of the Black Box. When the box is off,
your phone behaves normally. When the box is on and your phone rings,
the LED flashes. When you answer, the LED stays on and the voltage
is kept at 36V, so the calling party doesn't get charged. When the box
is on, you will not get a dial tone and thus cannot make calls.
Also remember that calls are limited to half an hour.

                                      ------------Jolly Roger

p.s. Due to new Fone Company switching systems & the like, this
may or may not work in your area. If you live in bumfuck Kentucky,
then try this out. I make no guarantees! (I never do...) ----JR

The Infamous Blotto Box!!                       by The Jolly Roger

        (I bet that NOONE has the balls to build this one!)

Finally, it is here! What was first conceived as a joke to fool the
innocent
phreakers around America has finally been conceived!
Well, for you people who are unenlightened about the Blotto Box,
here is a brief summery of a legend.

--*-=> The Blotto Box <=-*--

For years now every pirate has dreamed of the Blotto Box. It was at first
made as a joke to mock more ignorant people into thinking that
the function of it actually was possible. Well, if you are The Voltage
Master, it is possible. Originally conceived by King Blotto of much fame,
the Blotto Box is finally available to the public.
NOTE: Jolly Roger can not be responsible for the information disclosed
in the file! This file is strictly for informational purposes and
should not be actually built and used! Usage of this electronical impulse
machine could have the severe results listed below and could result in



high federal prosecution! Again, I TAKE NO RESPONSIBILITY!
All right, now that that is cleared up, here is the basis of the box
and it's function.
The Blotto Box is every phreaks dream... you could hold AT&T down on its
knee's with this device. Because, quite simply, it can turn off the phone
lines everywhere. Nothing. Blotto. No calls will be allowed out of an area
code, and no calls will be allowed in. No calls can be made inside it for
that matter. As long as the switching system stays the same, this box will
not stop at a mere area code. It will stop at nothing. The electrical
impulses that emit from this box will open every line. Every line will
ring and ring and ring... the voltage will never be cut off until the
box/generator is stopped. This is no 200 volt job, here.
We are talking GENERATOR. Every phone line will continue to ring, and
people
close to the box may be electricuted if they pick up the phone.
But, the Blotto Box can be stopped by merely cutting of the line or
generator.
If they are cut off then nothing will emit any longer. It will take
a while for the box to calm back down again, but that is merely a
superficial aftereffect. Once again: Construction and use of this box is
not advised! The Blotto Box will continue as long as there is
electricity to continue with.
OK, that is what it does, now, here are some interesting things for you
to do with it...

-*-=>Blotto Functions/Installin'<=-*-

Once you have installed your Blotto, there is no turning back. The
following are the instructions for construction and use of this box.
Please read and heed all warnings in the above section before you attempt
to construct this box.

Materials:
  - A Honda portable generator or a main power outlet like in a
    stadium or some such place.
  - 400 volt rated coupler that splices a female plug into a
    phone line jack.
  - A meter of voltage to attach to the box itself.
  - A green base (i.e. one of the nice boxes about 3' by 4' that
    you see around in your neighborhood. They are the main switch
    boards and would be a more effective line to start with.
    or: A regular phone jack (not your own, and not in your area
    code!
  - A soldering iron and much solder.
  - A remote control or long wooden pole.
Now. You must have guessed the construction from that. If not, here goes,
I will explain in detail. Take the Honda Portable Generator and all of
the other listed equiptment and go out and hunt for a green base. Make
sure it is one on the ground or hanging at head level from a pole,
not the huge ones at the top of telephone poles. Open it up with anything
convienent, if you are two feeble that fuck don't try this.
Take a look inside... you are hunting for color-coordinating lines of
green and red. Now, take out your radio shack cord and rip the meter thing
off. Replace it with the voltage meter about. A good level to set the
voltage to is about 1000 volts. Now, attach the voltage meter to the cord
and set the limit for one thousand. Plug the other end of the cord
into the generator. Take the phone jack and splice the jack part off.
Open it up and match the red and green wires with



the other red and green wires. NOTE: If you just had the generator on
and have done this in the correct order, you will be a crispy critter.
Keep the generator off until you plan to start it up. Now, solder those
lines together carefully. Wrap duck tape or insultation tape around all
of the wires. Now, place the remote control right on to the startup
of the generator. If you have the long pole, make sure it is very long
and stand back as far away as you can get and reach the pole over.
NOTICE: If you are going right along with this without reading the file
first, you still realize now that your area code is about to become
null! Then, getting back, twitch the pole/remote control and run for your
damn life. Anywhere, just get away from it. It will be generating
so much electricity that if you stand to close you will kill yourself.
The generator will smoke, etc. but will not stop. You are now killing your
area code, because all of that energy is spreading through all of the
phone lines around you in every direction.

Have a nice day!

--*-=>The Blotto Box: Aftermath<=-*--
Well, that is the plans for the most devastating and ultimately deadly
box ever created. My hat goes off to: King Blotto (for the original idea).

                                          ---------Jolly Roger


Blowgun                                         by The Jolly Roger

In this article I shall attempt to explain the use and manufacture
of a powerfull blow-gun and making darts for the gun.The possesion of
the blow gun described in this article IS a felony.
So be carefull where you use it. I don't want to get you all busted.

Needed:

1. Several strands of yarn (About 2 inches a-piece)
2. A regular pencil
3. A 2 1/4 inch long needle (hopefully with a beaded head. If not
   obtainable,wrap tape around end of needle.
4. 2-3 1/4 foot pipe. (PVC or Aluminum) Half a inch in diameter

Constructing the dart:

1st- Carefully twist and pull the metal part (Along with eraser)
of the pencil till it comes off.
2nd- Take Pin and start putting about 5-7 Strands of yarn on the pin. Then
push them up to the top of the pin. But not over the head of the pin (orthe
tape).
3rd- Push pin through the hollow part of the head where the pencil was
before.
4th- That should for a nice looking dart. (see illustration)

     #####
>>>>>-----/    #  is the yarn
               >  is the head of the pencil
               -  is the pin it-self
               /  is the head of the pin

Using the Darts:




1st- Now take the finished dart and insert it in the tube
(if it is too small put on more yarn.)
2nd- Aim the tube at a door, wall, sister, ect.
3rd- blow on the end of the pipe.
4th- Sometimes the end of the pipe may be sharp. When this happens I
suggest you wrap it with some black electrician tape.It should feel
a lot better.
                                -------Jolly Roger

Brown Box Plans                                 by The Jolly Roger

This is a fairly simple mod that can be made to any phone. All it does
is allow you to take any two lines in your house and create a party
line. So far I have not heard of anyone who has any problems
with it. There is one thing that you will notice when you are
one of the two people who is called by a person with a brown box. The other
person will sound a little bit faint. I could overcome this with some
amplifiers but then there wouldn't be very many of these made [Why not?].
I think the convenience of having two people on the line at once will
make up for any minor volume loss.

Here is the diagram:
---------------------------------------
KEY:___________________________________
    |  PART               | SYMBOL    |
    |---------------------------------|
    | BLACK WIRE          |   *       |
    | YELLOW WIRE         |   =       |
    | RED WIRE            |   +       |
    | GREEN WIRE          |   -       |
    | SPDT SWITCH         |  _/_      |
    |                        _/_      |
    | VERTICAL WIRE       |   |       |
    | HORIZONTAL WIRE     |   _       |
    -----------------------------------
          *    =    -    +
          *    =    -    +
          *    =    -    +
          *    =    -    +
          *    =    -    +
          *    ==_/_-    +
          *******_/_++++++
          |              |
          |              |
          |              |
          |              |
          |              |
          |              |
          |_____PHONE____|

                                ------------Jolly Roger

Calcium Carbide Bomb                            by The Jolly Roger

This is EXTREMELY DANGEROUS. Exercise extreme caution.... Obtain some
calcium carbide. This is the stuff that is used in carbide lamps and
can be found at nearly any hardware store. Take a few pieces of this



stuff (it looks like gravel) and put it in a glass jar with some
water. Put a lid on tightly. The carbide will react with the water to
produce acetylene carbonate which is similar to the gas used in
cutting torches. Eventually the glass with explode from internal
pressure. If you leave a burning rag nearby, you will get a nice
fireball!
                            -----------Jolly Roger

More Ways to Send a Car to Hell                 by The Jolly Roger

Due to a lot of compliments, I have written an update to file #14.
I have left the original intact. This expands upon the original
idea, and could be well called a sequal. -----JR

How to have phun with someone else's car.  If you really detest
someone, and I mean detest, here's a few tips on what to do in your
spare time.  Move the windshield wiper blades, and insert and glue
tacks.  The tacks make lovely designs.  If your "friend" goes to
school with you, Just before he comes out of school.  Light a lighter
and then put it directly underneath his car door handle.
Wait...Leave...Listen.  When you hear a loud "shit!", you know he
made it to his car in time.  Remove his muffler and pour approximately
1 Cup of gas in it. Put the muffler back, then wait till their car starts.
Then you have a cigarette lighter.  A 30 foot long cigarette lighter.
This one is effective, and any fool can do it.  Remove the top
air filter. That's it!  Or a oldie but goodie: sugar in the gas tank.
Stuff rags soaked in gas up the exhaust pipe.  Then you wonder why
your "friend" has trouble with his/her lungs.  Here's one that takes
time and many friends.  Take his/her car then break into their house
and reassemble it, in their living or bedroom.  Phun eh?  If you're
into engines, say eeni mine moe and point to something and remove it.
They wonder why something doesn't work. There are so many others, but
the real good juicy ones come by thinking hard.

                                    -----------Jolly Roger

Ripping off Change Machines                     by the Jolly Roger

Have you ever seen one of those really big changer machines in airports
laundrymats or arcades that dispense change when you put in your 1 or 5
dollar bill?  Well then, here is an article for you.

1)  Find the type of change machine that you slide in your bill length
wise, not the type where you put the bill in a tray and then slide the
tray in!!!
2)  After finding the right machine, get a $1 or $5 bill.  Start crumpling
up into a ball.  Then smooth out the bill, now it should have a very
wrinkly
surface.
3) Now the hard part.  You must tear a notch in the bill on the
left side about 1/2 inch below the little 1 dollar symbol (See Figure).
4) If you have done all of this right then take the bill and go out the
machine.  Put the bill in the machine and wait.  What should happen is:
when you put your bill in the machine it thinks everything is fine.
When it gets to the part of the bill with the notch cut out, the
machine will reject the bill and (if you have done it right)
give you the change at the same time!!! So, you end up getting your bill
back, plus the change!!  It might take a little practice, but once



you get the hang of it, you can get a lot of money!
                  !--------------------------------!
                  !                                !
                  ! (1)         /-------\      (1) !
                  !             !       !          !
                  !             !  Pic. !          !
                  ! (1)  /\     \-------/      (1) !
                  !      !!                        !
                  !-----/  \-----------------------!
                          \-------Make notch here. About 1/2 " down from
(1)

P.S. Sorry for the "text work" but you should be able to get the
idea. Have fun!!! -----------------------Jolly Roger


Clear Box Plans                                 by The Jolly Roger

The clear box is a new device which has just been invented that can be
used throughout Canada and rural United States. The clear box works on
"PostPay" payphones (fortress fones). Those are the payphones
that don't require payment until after the connection is established.
You pick up the fone, get a dial tone, dial your number, and then
insert your money after the person answers.
If you don't deposit the money then you can not speak to the person on
the other end because your mouth piece is cut off but not the ear-piece.
(obviously these phones are nice for free calls to weather or time or
other such recordings). All you must do is to go to your nearby Radio
Shack, or electronics store, and get a four-transistor amplifier and a
telephone suction cup induction pick-up. The induction pick-up would be
hooked up as it normally would to record a conversation, except
that it would be plugged into the output of the amplifier and a
microphone would be hooked to the input. So when the party
that is being called answers, the caller could speak through the little
microphone instead. His voice then goes through the amplifier and out
the induction coil, and into the back of the receiver where
it would then be broadcast through the phone lines and the other
partywould be able to hear the caller. The Clear Box thus
'clears up' the problem of not being heard. Luckily, the line will
not be cut-off after a certain amount of time because it will wait
forever for the coins to be put in.
The biggest advantage for all of us about this new clear box is the
fact that this type of payphone will most likely become very common.
Due to a few things: 1st, it is a cheap way of getting the DTF,
dial-tone-first service, 2nd, it doesn't require any special equipment,
(for the phone company) This payphone will work on any phone line.
Usually a payphone line is different, but this is a regular phone line
and it is set up so the phone does all the charging, not the company.

                              ------------Jolly Roger

CNA List                               Courtesy of The Jolly Roger

NPA  TEL NO          NPA  TEL NO
--------------------------------------
201  201-676-7070    601  601-961-8139
202  304-343-7016    602  303-293-8777
203  203-789-6815    603  617-787-5300



204  204-949-0900    604  604-432-2996
205  205-988-7000    605  402-580-2255
206  206-382-5124    606  502-583-2861
207  617-787-5300    607  518-471-8111
208  303-293-8777    608  608-252-6932
209  415-543-2861    609  201-676-7070
212  518-471-8111    612  402-580-2255
213  415-781-5271    613  416-443-0542
214  214-464-7400    614  614-464-0123
215  412-633-5600    615  615-373-5791
216  614-464-0123    616  313-223-8690
217  217-525-5800    617  617-787-5300
218  402-580-2255    618  217-525-5800
219  317-265-4834    619  818-501-7251
301  304-343-1401    701  402-580-2255
302  412-633-5600    702  415-543-2861
303  303-293-8777    703  304-344-7935
304  304-344-8041    704  912-784-0440
305  912-784-0440    705  416-979-3469
306  306-347-2878    706  *** NONE ***
307  303-293-8777    707  415-543-6374
308  402-580-2255    709  *** NONE ***
309  217-525-5800    712  402-580-2255
312  312-796-9600    713  713-861-7194
313  313-223-8690    714  818-501-7251
314  314-721-6626    715  608-252-6932
315  518-471-8111    716  518-471-8111
316  816-275-2782    717  412-633-5600
317  317-265-4834    718  518-471-8111
318  504-245-5330    801  303-293-8777
319  402-580-2255    802  617-787-5300
401  617-787-5300    803  912-784-0440
402  402-580-2255    804  304-344-7935
403  403-425-2652    805  415-543-2861
404  912-784-0440    806  512-828-2501
405  405-236-6121    807  416-443-0542
406  303-293-8777    808  212-334-4336
408  415-543-6374    809  212-334-4336
409  713-861-7194    812  317-265-4834
412  413-633-5600    813  813-228-7871
413  617-787-5300    814  412-633-5600
414  608-252-6932    815  217-525-5800
415  415-543-6374    816  816-275-2782
416  416-443-0542    817  214-464-7400
417  314-721-6626    818  415-781-5271
418  514-725-2491    819  514-725-2491
419  614-464-0123    901  615-373-5791
501  405-236-6121    902  902-421-4110
502  502-583-2861    904  912-784-0440
503  206-382-5124    906  313-223-8690
504  504-245-5330    907  *** NONE ***
505  303-293-8777    912  912-784-0440
506  506-648-3041    913  816-275-2782
507  402-580-2255    914  518-471-8111
509  206-382-5124    915  512-828-2501
512  512-828-2501    916  415-543-2861
513  614-464-0123    918  405-236-6121
514  514-725-2491    919  912-784-0440



515  402-580-2255    516  518-471-8111
517  313-223-8690    518  518-471-8111
519  416-443-0542    900  201-676-7070

Electronic Terrorism                            by The Jolly Roger

It starts when a big, dumb lummox rudely insults you.  Being of a
rational, intelligent disposition, you wisely choose to avoid a
(direct) confrontation.  But as he laughs in your face, you smile
inwardly---your revenge is already planned.
Step 1:  follow your victim to his locker, car, or house.  Once you
have chosen your target site, lay low for a week or more,
letting your anger boil.
Step 2:  in the mean time, assemble your versatile terrorist
kit(details below.)
Step 3:  plant your kit at the designated target site on a monday
morning between the hours of 4:00 am and 6:00 am.  Include a
calm, suggestive note that quietly hints at the possibility
of another attack.  Do not write it by hand!  An example of
an effective note:
  "don't be such a jerk, or the next one will take off your
   hand.  Have a nice day."
Notice how the calm tone instills fear.  As if written by a
homicidal psychopath.
Step 5:  choose a strategic location overlooking the target site.  Try
to position yourself in such a way that you can see his facial contortions.
Step 6:  sit back and enjoy the fireworks! Assembly of the versatile,
economic, and effective terrorist kit #1: the parts you'll need are:
1) 4 aa batteries
2) 1 9-volt battery
3) 1 spdt mini relay (radio shack)
4) 1 rocket engine(smoke bomb or m-80)
5) 1 solar ignitor (any hobby store)
6) 1 9-volt battery connector


Step 1:  take the 9-volt battery and wire it through the relay's coil.
This circuit should also include a pair of contacts that when
separated cut off this circuit.  These contacts should be held together
by trapping them between the locker,mailbox, or car door.
Once the door is opened, the contacts fall apart and the 9-volt circuit
is broken, allowing the relay to fall to the closed postion
thus closing the ignition circuit. (If all this is confusing take a
look at the schematic below.)

Step 2:  take the 4 aa batteries and wire them in succession.
Wire the positive terminal of one to the negative terminal of another,
until all four are connected except one positive terminal and one negative
terminal.  Even though the four aa batteries only combine to create 6
volts, the increase in amperage is necessary to activate the solar
ignitor quickly and effectively.

Step 3:  take the battery pack (made in step 2) and wire one end of it
to the relay's single pole and the other end to one prong of the solar
ignitor.  Then wire the other prong of the solar ignitor back to the open
position on the relay.

Step 4:  using double sided carpet tape mount the kit in his locker,



mailbox, or car door. And last, insert the solar ignitor into the
rocket engine (smoke bomb or m-80).



Your kit is now complete!

        ---------><---------
        I    (CONTACTS)    I
        I                  I
        I                  -  (BATTERY)
        I                 ---
        I                  I
        I      (COIL)      I
        ------///////-------
          /-----------
         /           I
        /            I
       /             I
   (SWITCH) I        I
            I        I
            I       --- (BATTERY)
            I        -  ( PACK  )
            I       ---
            I        I
            I        I
            ---- -----
               I I
                *
         (SOLAR IGNITOR)

                               ---------Jolly Roger

How to Start A Conference w/o 2600hz or M-F         by The Jolly Roger

        (Originally an Apple ][ file, forgive the upper case!)

THIS METHOD OF STARTING THE CONF. DEPENDS ON YOUR ABILITY TO BULLSHIT THE
OPERATOR INTO DIALING A NUMBER WHICH CAN ONLY BE REACHED WITH AN OPERATOR'S
M-F TONES.  WHEN BULLSHITTING THE OPERATOR REMEMBER OPERATOR'S ARE NOT
HIRED TO THINK BUT TO DO.

HERE IS A STEP-BY-STEP WAY TO THE CONF.:
1. CALL THE OPERATOR THROUGH A PBX OR EXTENDER, YOU COULD JUST CALL ONE
THROUGH YOUR LINE BUT I WOULDN'T RECOMMEND IT.
2. SAY TO THE OPERATOR:
TSPS MAINTENENCE ENGINEER, RING-FORWARD TO 213+080+1100, POSITION RELEASE,
THANKYOU.
(SHE WILL PROBABLY ASK YOU FOR THE NUMBER AGAIN)

DEFINITIONS: RING-FORWARD - INSTRUCTS HER TO DIAL THE NUMBER.
POSITION RELEASE - INSTUCTS HER TO RELEASE THE TRUNK AFTER SHE HAS
DIALED THE NUMBER.
+ - REMBER TO SAY 213PLUS080 PLUS1100.
3. WHEN YOU ARE CONNECTED WITH THE CONF. YOU WILL HERE A WHISTLE BLOW
TWICE AND A RECORDING ASKING YOU FOR YOUR OPERATOR #. DIAL IN ANY FIVE
DIGITS AND HIT THE POUNDS SIGN A COUPLE OF TIMES. SIMPLY DIAL IN THE #
OF THE BILLING LINE ECT. WHEN THE RECORDING ASK FOR IT.



3. WHEN IN THE CONTROL MODE OF THE CONF. HIT '6' TO TRANSFER CONTROL.
HIT '001' TO REENTER THE # OF CONFEREE'S AND TIME AMOUNT WHICH YOU
GAVE WHEN YOU STARED THE CONF. REMEMBER THE SIZE CAN BE FROM
2-59 CONFEREE'S. I HAVE NOT FOUND OUT THE 'LENGTHS' LIMITS.



How to Make Dynamite                            by The Jolly Roger

Dynamite is nothing more than just nitroglycerin and a stablizing
agent to make it much safer to use.  For the sake of saving time, I
will abbreviate nitroglycerin with a plain NG.  The numbers
are percentages, be sure to mix these carefully and be sure to use the
exact amounts.  These percentages are in weight ratio, not volume.

no.  ingredients                 amount
---------------------------------------
#1   NG                          32
     sodium nitrate              28
     woodmeal                    10
     ammonium oxalate            29
     guncotten                    1
#2   NG                          24
     potassium nitrate            9
     sodium nitate               56
     woodmeal                     9
     ammonium oxalate             2
#3   NG                          35.5
     potassium nitrate           44.5
     woodmeal                     6
     guncotton                    2.5
     vaseline                     5.5
     powdered charcoal            6
#4   NG                          25
     potassium nitrate           26
     woodmeal                    34
     barium nitrate               5
     starch                      10
#5   NG                          57
     potassium nitrate           19
     woodmeal                     9
     ammonium oxalate            12
     guncotton                    3
#6   NG                          18
     sodium nitrate              70
     woodmeal                     5.5
     potassium chloride           4.5
     chalk                        2
#7   NG                          26
     woodmeal                    40
     barium nitrate              32
     sodium carbonate             2
#8   NG                          44
     woodmeal                    12
     anhydrous sodium sulfate    44
#9   NG                          24
     potassium nitrate           32.5
     woodmeal                    33.5



     ammonium oxalate            10
#10  NG                          26
     potassium nitrate           33
     woodmeal                    41
#11  NG                          15
     sodium nitrate              62.9
     woodmeal                    21.2
     sodium carbonate              .9
#12  NG                          35
     sodium nitrate              27
     woodmeal                    10
     ammonium oxalate             1
#13  NG                          32
     potassium nitrate           27
     woodmeal                    10
     ammonium oxalate            30
     guncotton                    1
#14  NG                          33
     woodmeal                    10.3
     ammonium oxalate            29
     guncotton                     .7
     potassium perchloride       27
#15  NG                          40
     sodium nitrate              45
     woodmeal                    15
#16  NG                          47
     starch                      50
     guncotton                    3
#17  NG                          30
     sodium nitrate              22.3
     woodmeal                    40.5
     potassium chloride           7.2
#18  NG                          50
     sodium nitrate              32.6
     woodmeal                    17
     ammonium oxalate              .4
#19  NG                          23
     potassium nitrate           27.5
     woodmeal                    37
     ammonium oxalate             8
     barium nitrate               4
     calcium carbonate             .5

Household equivalants for chemicles

It has come to my attention that many of these chemicles are
sold under brand names, or have household equivalants.  here is a list
that might help you out. Also, see elsewhere in this Cookbook for
a more complete listing............

acetic acid                vinegar
aluminum oxide             alumia
aluminum potassium sulfate alum
aluminum sulfate           alum
ammonium hydroxide         ammonia
carbon carbonate           chalk
calcium hypochloride       bleaching powder
calcium oxide              lime



calcium sulfate            plaster of paris
carbonic acid              seltzer
carbon tetrachloride       cleaning fluid
ethylene dichloride        Dutch fluid
ferric oxide               iron rust
glucose                    corn syrup
graphite                   pencil lead
hydrochloric acid          muriatic acid
hydrogen peroxide          peroxide
lead acetate               sugar of lead
lead tetrooxide            red lead
magnesium silicate         talc
magnesium sulfate          Epsom salts
naphthalene                mothballs
phenol                     carbolic acid
potassium bicarbonate      cream of tartar
potassium chromium sulf.   chrome alum
potassium nitrate          saltpeter
sodium dioxide             sand
sodium bicarbonate         baking soda
sodium borate              borax
sodium carbonate           washing soda
sodium chloride            salt
sodium hydroxide           lye
sodium silicate            water glass
sodium sulfate             glauber's salt
sodium thiosulfate         photographer's hypo
sulferic acid              battery acid
sucrose                    cane sugar
zinc chloride              tinner's fluid

Keep this list handy at all times. If you can't seem to get one
or more of the ingredients try another one.  If you still can't, you
can always buy small amounts from your school, or maybe from various
chemical companies.  When you do that, be sure to say as little as
possible, if during the school year, and they ask, say it's for a
experiment for school.
                              -------------Jolly Roger

Auto Exhaust Flame Thrower                      by The Jolly Roger

For this one, all you need is a car, a sparkplug, ignition wire and a
switch. Install the spark plug into the last four or five inches of
the tailpipeby drilling a hole that the plug can screw into easily.
Attach the wire (this is regular insulated wire) to one side of the
switch and to the spark plug. The other side of the switch is attached
to the positive terminal on the battery. With the car running, simply
hit the switch and watch the flames fly!!! Again be careful that no
one is behind you! I have seen some of these flames go 20 feet!!!

                               -------------Jolly Roger

Breaking into BBS Express              Courtesy of the Jolly Roger

If you have high enough access on any BBS Express BBS you can get the
Sysop's password without any problems and be able to log on as him and do
whatever you like. Download the Pass file, delete the whole BBS, anything.
Its all a matter of uploading a text file and d/ling it from the BBS. You



must have high enough access to see new uploads to do this. If you can see
a file you just uploaded you have the ability to break into the BBS in a
few easy steps.
Why am I telling everyone this when I run BBS Express myself?
Well there is one way to stop this from happening and I want other Sysops
to be aware of it and not have it happen to them.
Breaking in is all based on the MENU function of BBS Express. Express
will let you create a menu to display different text files by putting the
word MENU at the top of any text file and stating what files are to be
displayed. But due to a major screw up by Mr. Ledbetter you can use this
MENU option to display the USERLOG and the Sysop's Passwords or anything
else you like. I will show you how to get the Sysop's pass and therefore
log on as the Sysop. BBs Express Sysop's have 2 passwords. One like
everyone else gets in the form of X1XXX, and a Secondary password
to make it harder to hack out the Sysops pass.
The Secondary pass is found in a file called SYSDATA.DAT.
This file must be on drive 1 and is therefore easy to get. All you have to
do is upload this simple Text file:

MENU
1
D1:SYSDATA.DAT

Ripoff time!

after you upload this file you d/l it non-Xmodem. Stupid Express thinks
it is displaying a menu and you will see this:

Ripoff time!

Selection [0]:

Just hit 1 and Express will display the SYSDATA.DAT file.OPPASS is where
the Sysop's Secondary pass will be. D1:USERLOG.DAT is where you will find
the name and Drive number of the USERLOG.DAT file. The Sysop might have
renamed this file or put it in a Subdirectory or even on a different
drive. I Will Assume he left it as D1:USERLOG.DAT. The other parts of this
file tell you where the .HLP screens are and where the LOG is saved and
all the Download path names.

Now to get the Sysop's primary pass you upload a text file like this:

MENU
1
D1:USERLOG.DAT

Breaking into Bedwetter's BBS

Again you then d/l this file non-Xmodem and you will see:

Breaking into Bedwetter's BBS

Selection [0]:

You then hit 1 and the long USERLOG.DAT file comes flying at you.
The Sysop is the first entry in this very long file so it is easy. You will
see:




SYSOP'S NAME        X1XXX
You should now have his 2 passwords.

There is only one easy way out of this that I can think of, and that is
to make all new uploads go to SYSOP level (Level 9) access only. This way
nobody can pull off what I just explained.
I feel this is a major Bug on Mr. Ledbetter's part. I just don't know why
no one had thought of it before. I would like to give credit to
Redline for the message he left on Modem Hell telling about this problem,
and also to Unka for his ideas and input about correcting it.

This has been brought to you from [_The_Piper_] and the S.O.D. BBS
Network!
Firebombs                                       by the Jolly Roger

Most fire bombs are simply gasoline filled bottles with a fuel
soaked rag in the mouth (the bottle's mouth, not yours). The original
Molotov cocktail, and still about the best, was a mixture of one part
gasoline and one part motor oil. The oil helps it to cling to what it
splatters on.
Some use one part roofing tar and one part gasoline. Fire bombs
have been found which were made by pouring melted wax into gasoline.

                                  -------------Jolly Roger

Fuse Ignition Bomb                              by The Jolly Roger

A four strand homemade fuse is used for this. It burns like fury.
It is held down and concealed by a strip of bent tin cut from a can.
The exposed end of the fuse is dipped into the flare igniter. To use
this one, you light the fuse and hold the fire bomb until the fuse has
burned out of sight under the tin. Then throw it and when it breaks,
the burning fuse will ignite the contents.

                                   -------------Jolly Roger

Generic Bomb                                    by the Jolly Roger

1) Aquire a glass container
2) Put in a few drops of gasoline
3) Cap the top
4) Now turn the container around to coat the inner surfaces and then
evaporates
5) Add a few drops of potassium permanganate (<-Get this stuff from a
snake bite kit)
6) The bomb is detonated by throwing aganist a solid object.
*AFTER THROWING THIS THING RUN LIKE HELL THIS THING PACKS ABOUT 1/2
STICK OF DYNAMITE*

                            ---------------Jolly Roger

Green Box Plans                                 by the Jolly Roger

Paying the initial rate in order to use a red box (on certain
fortresses) left a sour taste in many red boxers mouths, thus the
green box was invented. The green box generates useful tones such as
COIN COLLECT, COIN RETURN, AND RINGBACK. These are the tones that
ACTS or the TSPS operator would send to the CO when appropriate.



Unfortunately, the green box cannot be used at the fortress station but
must be used by the CALLED party.

Here are the tones:
COIN COLLECT     700+1100hz
COIN RETURN      1100+1700hz
RINGBACK         700+1700hz

Before the called party sends any of these tones, an operator realease
signal should be sent to alert the MF detectors at the CO.
This can be done by sending 900hz + 1500hz or a single 2600 wink (90 ms.)
Also do not forget that the initial rate is collected shortly before the
3 minute period is up. Incidentally, once the above MF
tones for collecting and returning coins reach the CO, they are
converted into an appropriate DC pulse (-130 volts for return and
+130 for collect). This pulse is then sent down the tip to the
fortress. This causes the coin relay to either return or collect the coins.
The alledged "T-network" takes advantage of this information.
When a pulse for coin collect (+130 VDC) is sent down the line,
it must be grounded somewhere. This is usually the yellow or black wire.
Thus, if the wires are exposed, these wires can be cut to prevent
the pulse from being grounded. When the three minute initial
period is almost up, make sure that the black and yellow wires are
severed, then hang up, wait about 15 seconds in case of a second
pulse, reconnect the wires, pick up the phone, and if all goes well,
it should be "JACKPOT" time.
                               ---------Jolly Roger

Portable Grenade Launcher                       by the Jolly Roger

If you have a bow, this one is for you. Remove the ferrule from an
aluminum arrow, and fill the arrow with black powder (I use grade
FFFF, it burns easy)and then glue a shotshell primer into the hole
left where the ferrule went. Next, glue a BB on the primer, and you
are ready to go! Make sure no one is nearby.... Little shreds of
aluminum go all over the place!!
                                    ------------Jolly Roger


Hacking Tutorial                       Courtesy of the Jolly Roger

What is hacking?
----------------
According to popular belief the term hacker and hacking was founded at mit
it comes from the root of a hack writer,someone who keeps "hacking" at
the typewriter until he finishes the story.a computer hacker would be
hacking at the keyboard or password works.

What you need:
--------------
To hack you need a computer equipped with a modem (a device that lets you
transmit data over phone lines) which should cost you from $100 to $1200.

How do you hack?
----------------
Hacking recuires two things:
1. The phone number
2. Answer to identity elements



çHow do you find the phone #?
----------------------------
There are three basic ways to find a computers phone number.
1. Scanning,
2. Directory
3. Inside info.

What is scanning?
-----------------
Scanning is the process of having a computer search for a carrier tone.
For example,the computer would start at [phone] and wait for carrier
if there is none it will go on to 111-1112 etc.if there is a carrier it
will record it for future use and continue looking for more.

What is directory assictance?
-----------------------------
This way can only be used if you know where your target computer is. For
this
example say it is in menlo park, CA and the company name is sri.

1. Dial 411 (or 415-555-1212)
2. Say "Menlo park"
3. Say "Sri"
4. Write down number
5. Ask if there are any more numbers
6. If so write them down.
7. Hang up on operator
8. Dial all numbers you were given
9. Listen fir carrier tone
10. If you hear carrier tone write down number, call it on your modem and
your
    set to hack!
                            ---------------Jolly Roger

The Basics of Hacking II               Courtesy of the Jolly Roger

Basics to know before doing anything, essential to your continuing
career as one of the elite in the country...  This article, "the
introduction to the world of hacking" is meant to help you by telling you
how not to get caught, what not to do on a computer system, what type of
equipment should I know about now, and just a little on the history, past
present future, of the hacker.

Welcome to the world of hacking! We, the people who live outside of the
normal rules, and have been scorned and even arrested by those from the
'civilized world', are becomming scarcer every day.  This is due to the
greater fear of what a good hacker (skill wise, no moral judgements
here)|can do nowadays, thus causing anti- hacker sentiment in the masses.
Also, few hackers seem to actually know about the computer systems they
hack, or what equipment they will run into on the front end, or what they
could do wrong on a system to alert the 'higher' authorities who monitor
the system. This article is intended to tell you about some things not to
do, even before you get on the system.  I will tell you about the new wave
of front end security devices that are beginning to be used on computers.
I will attempt to instill in you a second identity, to be brought up at
time of great need, to pull you out of trouble. And, by the way, I take no,
repeat,
no, responcibility for what we say in this and the forthcoming articles.



Enough of the bullshit, on to the fun: after logging on your favorite bbs,
you see on the high access board a phone number!  It says it's a great
system to "fuck around with!" This may be true, but how many other people
are going to call the same number?  So:  try to avoid calling a number
given to the public. This is because there are at least every other
user calling, and how many other boards will that number spread to?
If you call a number far, far away, and you plan on going thru an
extender or a re-seller, don't keep calling the same access number
(I.E. As you would if you had a hacker running), this looks very suspicious
and can make life miserable when the phone bill comes in the mail.
Most cities have a variety of access numbers and services,
so use as many as you can. Never trust a change in the system...
The 414's, the assholes, were caught for this reason: when one of them
connected to the system, there was nothing good there.  The next time,
there was a trek game stuck right in their way!  They proceded to play said
game for two, say two and a half hours, while telenet was tracing them!
Nice job, don't you think?  If anything looks suspicious, drop the line
immediately!!  As in, yesterday!! The point we're trying to get accross is:
if you use a little common sence, you won't get busted.  Let the little
kids who aren't smart enough to recognize a trap get busted, it will take
the heat off of the real hackers. Now, let's say you get on a computer
system...  It looks great, checks out, everything seems fine.
Ok, now is when it gets more dangerous.  You have to know the computer
system to know what not to do.
Basically, keep away from any command something, copy a new file into the
account, or whatever!  Always leave the account in the same status you
logged in with.  Change *nothing*... If it isn't an account with priv's,
then don't try any commands that require them! All, yes all, systems are
going to be keeping log files of what users are doing, and that will
show up.  It is just like dropping a trouble-card in an ESS system,
after sending that nice operator a pretty tone.
Spend no excessive amounts of time on the account in one stretch.
Keep your calling to the very late night ifpossible, or during
business hours (believe it or not!).  It so happens
that there are more users on during business hours, and it is very
difficult to read a log file with 60 users doing many commnds every minute.
Try to avoid systems where everyone knows each other, don't try to bluff.
And above all:  never act like you own the system, or are the best there
is. They always grab the people who's heads swell... There is some very
interesting front end equipment around nowadays, but first let's
define terms... By front end, we mean any device that you must
pass thru to get at the real computer. There are devices that are made to
defeat hacker programs, and just plain old multiplexers.
To defeat hacker programs, there are now devices that pick up the phone
and just sit there...  This means that your device gets no carrier,
thus you think there isn't a computer on the other end.  The
only way around it is to detect when it was picked up.  If it pickes up
after the same number ring, then you know it is a hacker-defeater.
These devices take a multi-digit code to let you into the system.
Some are, in fact, quite sophisticated to the point where it
will also limit the user name's down, so only one name or set of names
can be valid logins after they input the code... Other devices input a
number code, and then they dial back a pre-programmed number for that code.
These systems are best to leave alone,
because they know someone is playing with their phone.  You may think "but
i'll just reprogram the dial-back." Think again, how stupid that is...
Then they have your number, or a test loop if you were just a little
smarter. If it's your number, they have your balls (if male...),



If its a loop, then you are screwed again, since those loops
are *monitored*. As for multiplexers...  What a plexer is supposed
to do is this:
The system can accept multiple users. We have to time share, so we'll let
the front-end processor do it...  Well, this is what a multiplexer does.
Usually they will ask for something like "enter class" or "line:".  Usually
it is programmed for a double digit number, or a four to five letter word.
There are usually a few sets of numbers it accepts, but those numbers also
set your 300/1200/2400 baud data type.
These multiplexers are inconvenient at best, so not to worry. A little
about the history of hacking: hacking, by my definition, means a great
knowledge of some special area. Doctors and lawyers
are hackers of a sort, by this definition.  But most often, it is
being used in the computer context, and thus we have a definition of
"anyone who has a great amount of computer or telecommunications
knowledge."  You are not a hacker because you have a list of codes...
Hacking, by my definition, has then been around only about 15 years.
It started, where else but, mit and colleges where they had computer
science or electrical engineering departments.
Hackers have created some of the best computer languages, the
most awesome operating systems, and even gone on to make millions.
Hacking used to have a good name, when we could honestly say
"we know what we are doing".  Now it means (in the public eye):
the 414's, ron austin, the nasa hackers, the arpanet hackers...
All the people who have been caught,
have done damage, and are now going to have to face fines and sentences.
Thus we come past the moralistic crap, and to our purpose:  educate the
hacker community, return to the days when people actually knew something...

                                  --------------Jolly Roger


Hacking DEC's                                 by the Jolly Roger

In this article you will learn how to log in to dec's, logging out, and all
the fun stuff to do in-between.  All of this information is based on a
standard dec system.
Since there are dec systems 10 and 20, and I favor, the dec 20,
there will be more info on them in this article.  It just so happens
that the dec 20 is also the more common of the two, and is used by much
more interesting people (if you know what I mean...) Ok, the first thing
you want to do when you are receiving carrier from a dec system is to find
out the format of login names.  You can do this by looking at who is on the
system.
Dec=> `  (the 'exec' level prompt)
you=> sy
sy is short for sy(stat) and shows you the system status.
You should see the format of login names...
A systat usually comes up in this form:
job  line  program  user
job:  the job number (not important unless you want to log them off later)
line:  what line they are on (used to talk to them...)
These are both two or three digit numbers.
Program:  what program are they running under?  If it says 'exec'
they aren't doing anything at all...
User:  ahhhahhhh!  This is the user name they are logged in under...
Copy the format, and hack yourself outa working code... Login format is as
such:



dec=> `
you=> login username password
username is the username in the format you saw above in the systat.
After you hit the space after your username, it will stop echoing
characters back to your screen.  This is the password you are typing in...
Remember, people  usually use their name, their dog's name, the name of a
favorite character in a book, or something like this. A few clever
people have it set to a key cluster (qwerty or asdfg).  Pw's can be from 1
to 8 characters long, anything after that is ignored. You are finally in...
It would be nice to have a little help, wouldn't it?  Just type a ? Or the
word help, and it will give you a whole list of topics...
Some handy characters for you to know would be the control keys,
wouldn't it? Backspace on a dec 20 is rub which is 255 on your ascii chart.
On the dec 10 it is cntrl-h. To abort a long listing or a program,
cntrl-c works fine.  Use cntrl-o to stop long output to the terminal.
This is handy when playing a game, but you don't want to cntrl-c out.
Cntrl-t for the time. Cntrl-u will kill the whole line you are typing at
the moment.  You may accidently run a program where the only way out is
a cntrl-x, so keep that in reserve. Cntrl-s to stop listing, cntrl-q to
continue on both systems. Is your terminal having trouble??
Like, it pauses for no reason, or it doesn't backspace right?  This is
because both systems support many terminals, and you haven't told it what
yours is yet... You are using a vt05
so you need to tell it you are one.
Dec=> `
you=> information terminal
or...
You=> info
this shows you what your terminal is set up as...
Dec=>all sorts of shit, then the `
you=> set ter vt05 this sets your terminal
type to vt05.
Now let's see what is in the account (here after abbreviated acct.)
that you have hacked onto... Say
=> dir
short for directory, it shows
you what the user of the code has save to the disk.  There should be a
format
like this:    xxxxx.Oooxxxxx is the file name, from 1 to 20 characters
long.  Ooo is the file type, one of: exe, txt, dat, bas, cmd   and a few
others that are system dependant.
Exe is a compiled program that can be run (just by typing its name at the
`).
Txt is a text file, which you can see by
typing=>
type xxxxx.Txt
Do not try to=>
type xxxxx.Exe this is very bad for your terminal and will tell you
absolutly nothing.
Dat is data they have saved.
Bas is a basic program, you can have it typed out for you.
Cmd is a command type file, a little too
complicated to go into here.
Try =>
take xxxxx.Cmd
By the way, there are other users out there who may have files you can use
(gee, why else am I here?).
Type => dir <*.*> (Dec 20)



     => dir [*,*]   (dec 10)
* is a wildcard, and will allow you to access the files on other accounts
if the user has it set for public access. If it isn't set for public
access,
then you won't see it. To run that program:
dec=> `
you=> username program-name
username is the directory you saw the
file listed under, and file name was
what else but the file name?
**  You are not alone  **
remember, you said (at the very start) sy  short for systat,
and how we said this showed the other users on the system?  Well, you
can talk to them, or at least send a message to anyone you see listed in a
systat.  You can do this by:
dec=> the user list (from your systat)
you=> talkusername (dec 20)
      send username (dec 10)
talk allows you and them immediate transmission of whatever you/they type
to be sent to the other.  Send only allow you one message to be sent, and
send, they will send back to you, with talk you can just keep going. By the
way, you may be noticing with the talk command that what you type is still
acted upon by the parser (control program).  To avoid the constant error
messages type either:
you=>  ;your message
you=>  rem your message
the semi-colon tells the parser that what follows is just a comment.  Rem
is short for 'remark' and ignores you from then on until you type a cntrl-z
or cntrl-c, at which point it puts you back in the exec mode. To break the
connection from a talk command type:
you=>  break priv's:
if you happen to have privs, you can do all sorts of things.
First of all, you have to activate those privs.
You=> enable
this gives you a $ prompt, and allows you to do this:
whatever you can do to your own directory you can now do to any
other directory. To create a new acct. Using your privs, just type
=>build username
if username is old, you can edit it, if it is new, you can
define it to be whatever you wish. Privacy means nothing to a user with
privs.  By the way, there are various levels of privs:  operator, wheel,
cia.
wheel is the most powerful, being that he can log in from anywhere and
have his powers.
Operators have their power because they are at a special terminal
allowing them the privs.  Cia is short for 'confidential information
access', which allows you a low level amount of privs.
Not to worry though, since you can read the system log file, which also
has the passwords to all the other accounts.
To de-activate your privs, type
you=> disable
when you have played your greedy heart out, you can finally leave the
system with the command=>
logout
this logs the job you are using off the system (there may be varients
of this such as kjob, or killjob).

                                ----------------Jolly Roger



çHarmless Bombs                                  by the Jolly Roger

To all those who do not wish to inflict bodily damage on their victims
but only terror.
These are weapons that should be used from high places.
1) The flour bomb.
Take a wet paper towel and pour a given amount of baking flour in
the center. Then wrap it up and put on a rubber band to keep it
together. When thrown it will fly well but when it hits, it covers
the victim with the flower or causes a big puff of flour which will
put the victim in terror since as far as they are concerned, some
strange white powder is all over them. This is a cheap method of
terror and for only the cost of a roll of paper towels and a bag of
flour you and your friends can have loads of fun watching people
flee in panic.
2) Smoke bomb projectile.
All you need is a bunch of those little round smoke bombs and a
wrist rocket or any sling-shot. Shoot the smoke bombs and watch the
terror since they think it will blow up!
3) Rotten eggs (good ones)
Take some eggs and get a sharp needle
and poke a small hole in the top of each one.
Then let them sit in a warm place for about a week. Then you've got a
bunch of rotten eggs that will only smell when they hit.
4) Glow in the dark terror.
Take one of those tubes of glow in the dark stuff and pour the
stuff on whatever you want to throw and when it gets on the victim,
they think it's some deadly chemical or a radioactive substance so
they run in total panic. This works especially well with flower
bombs since a gummy, glowing substance gets all over the victim.
5) Fizzling panic.
Take a baggie of a water-baking soda solution and seal it. (Make
sure there is no air in it since the solution will form a gas and
you don't want it to pop on you.) Then put it in a bigger plastic
bag and fill it with vinegar and seal it. When thrown, the two
substances will mix and cause a violently bubbling substance to go
all over the victim.
                             ---------------Jolly Roger

Breaking Into Houses                            by the Jolly Roger

Okay You Need:
1.  Tear Gas or Mace
2.  A BB/Pelet Gun
3.  An Ice Pick
4.  Thick Gloves

What You Do Is:

1.  Call the ###-#### of the house, or ring doorbell,  To find out if
    they're home.
2.  If they're not home then...
3.  Jump over the fence or walk through gate (whatever).
4.  If you see a dog give him the mace or tear gas.
5.  Put the gloves on!!!!!!!
6.  Shoot the BB gun slightly above the window locks.
7.  Push the ice-pick through the hole (made by the BB gun).
8.  Enter window.



9.  FIRST...Find the LIVING ROOM. (they're neat things there!).
10.  Then goto the Bed-room to get a pillow  case.  Put the goodies in
     the pillow case.
11.  Get out <-* FAST! -*>

Notes:   You should have certian targets worked out (like computers,
Radios, Ect.,Ect.).    Also <-* NEVER *-> Steal from your own
neigborhood. If you think they have an alarm...<-* FORGET IT! *->.

                                  ---------------Jolly Roger


A Guide to Hypnotism                     Courtesy of the Jolly Roger
      (Originally an Apple ][ file, forgive the uppercase!)

+-------------------+
! WHAT HYPNOTISM IS !
+-------------------+

HYPNOTISM, CONTRARY TO COMMON BELEIF, IS MERELY STATE WHEN YOUR MIND AND
BODY ARE IN A STATE OF RELAXATION AND YOUR MIND IS OPEN TO POSITIVE, OR
CLEVERLY WORDED NEGATIVE, INFLUENCES.  IT IS NOT A TRANCE WHERE YOU:
                  > ARE TOTALLY INFLUENCABLE.
                  > CANNOT LIE.
                  > A SLEEP WHICH YOU CANNOT WAKE UP FROM
                    WITHOUT HELP.
THIS MAY BRING DOWN YOUR HOPE SOMEWHAT, BUT, HYPNOTISM IS A POWERFUL FOR
SELF HELP, AND/OR MISCHEIF.

+-----------------------+
! YOUR SUBCONCIOUS MIND !
+-----------------------+

BEFORE GOING IN FURTHER, I'D LIKE TO STATE THAT HYPNOTISM NOT ONLY IS
GREAT IN THE WAY THAT IT RELAXES YOU AND GETS YOU (IN THE LONG RUN) WHAT
YOU WANT, BUT ALSO THAT IT TAPS A FORCE OF INCREDIBLE POWER, BELEIVE IT OR
NOT, THIS POWER IS YOUR SUBCONCIOUS MIND.
THE SUBCONCIOUS MIND ALWAYS KNOWS WHAT IS GOING ON WITH EVERY PART OF YOUR
BODY,
EVERY MOMENT OF THE DAY.  IT PROTECTS YOU FROM NEGATIVE INFLUENCES,
AND RETAINS THE POWER TO SLOW YOUR HEARTBEAT DOWN AND STUFF LIKE THAT.
THE SUBCONCIOUS MIND HOLDS JUST ABOUT ALL THE INFO YOU WOULD LIKE TO KNOW
ABOUT YOURSELF, OR, IN THIS CASE, THE PERSON YOU WILL BE HYPNOTISING.
THERE ARE MANY WAYS TO TALK TO YOUR SUBCONCIOUS AND HAVE IT TALK BACK TO
YOU. ONE WAY IS THE OUJA BOARD, NO ITS NOT A SPIRIT, MERELY THE
MINDS OF THOSE WHO ARE USING IT.  ANOTHER, WHICH I WILL DISCUSS HERE,
IS THE PENDULUM METHOD.  OK, HERE IS HOW IT GOES.
FIRST, GET A RING OR A WASHER AND TIE IT TO A THREAD A LITTLE LONGER THAN
HALF OF YOUR FOREARM.  NOW, TAKE A SHEET OF PAPER AND DRAW A BIG CIRCLE IN
IT.  IN THE BIG CIRCLE YOU MUST NOW DRAW A CROSSHAIR (A BIG +).  NOW, PUT
THE SHEET OF PAPER ON A TABLE.  NEXT, HOLD THE THREAD WITH THE RING OR
WASHER ON IT AND PLACE IT (HOLDING THE THREAD SO THAT THE RING IS 1 INCH
ABOVE THE PAPER SWINGING) IN THE MIDDLE OF THE CROSSHAIR.  NOW, SWING
THE THREAD SO THE WASHER GOES UP AND DOWN, SAY TO YOURSELF THE WORD "YES"
NOW, DO IT SIDE TO SIDE AND SAY THE WORD "NO".
DO IT COUNTER CLOCKWISE AND SAY "I DON'T KNOW".
AND LASTLY, DO IT CLOCKWISE AND SAY "I DONT WANT TO SAY." NOW, WITH THE
THREAD BACK IN THE MIDDLE OF THE CROSSHAIR, ASK YOURSELF QUESTIONS AND



WAIT FOR THE PENDULUM TO SWING IN THE DIRECTION FOR THE ANSWER. (YES, NO,
I DONT KNOW OR I DONT WANNA SAY...). SOON, TO YOUR AMAZEMENT, IT WILL BE
ANSWERING QUESTIONS LIKE ANYTHING... LET THE PENDULUM ANSWER, DONT TRY..
WHEN YOU TRY YOU WILL NEVER GET AN ANSWER.  LET THE ANSWER COME TO YOU.

+-------------------------+
! HOW TO INDUCE HYPNOTISM !
+-------------------------+

NOW THAT YOU KNOW HOW TO TALK TO YOUR SUBCONCIOUS MIND, I WILL NOW TELL YOU
HOW TO GUIDE SOMEONE INTO HYPNOSIS. NOTE THAT I SAID GUIDE, YOU CAN NEVER,
HYNOTISE SOMEONE, THEY MUST BE WILLING. OK, THE SUBJECT MUST BE LYING OR
SITTING IN A COMFORTABLE POSITION, RELAXED, AND AT A TIME WHEN THINGS ARENT
GOING TO BE INTERRUPTED.
TELL THEM THE FOLLOWING OR SOMETHING CLOSE TO IT, IN A PEACEFUL, MONOTINOUS
TONE (NOT A COMMANDING TONE OF VOICE)

NOTE:  LIGHT A CANDLE AND PLACE IT SOMEWHERE WHERE IT CAN BE EASILY SEEN.

TAKE A DEEP BREATH THROUGH YOUR NOSE AND HOLD IT IN FOR A COUNT OF 8. NOW,
THROUGH YOUR MOUTH, EXHALE COMPLETELY AND SLOWLY. CONTINUED BREATHING LONG,
DEEP, BREATHS THROUGH YOUR NOSE AND EXHALING THROUGH YOUR MOUTH.  TENSE UP
ALL YOUR MUSCLES VERY TIGHT, NOW, COUNTING FROM TEN TO ONE, RELEASE THEM
SLOWLY, YOU WILL FIND THEM VERY RELAXED.  NOW, LOOK AT THE CANDLE, AS
YOU LOOK AT IT, WITH EVERY BREATH AND PASSING MOMEMENT, YOU ARE FEELING
INCREASINGLY MORE AND MORE PEACEFUL AND RELAXED.  THE CANDLES FLAME IS
PEACEFUL AND BRIGHT.
AS YOU LOOK AT IT I WILL COUNT FROM 100 DOWN, AS A COUNT, YOUR EYES WILL
BECOME MORE AND MORE RELAXED, GETTING MORE AND MORE TIRED WITH EACH
PASSING MOMENT."
NOW, COUNT DOWN FROM 100, ABOUT EVERY 10 NUMBERS SAY "WHEN I REACH XX YOUR
EYES (OR YOU WILL FIND YOUR EYES) ARE BECOMING MORE AND MORE TIRED."  TELL
THEM THEY MAY CLOSE THEIR EYES WHENEVER THEY FEEL LIKE IT.  IF THE PERSONS
EYES ARE STILL OPEN WHEN YOU GET TO 50 THEN INSTEAD OF SAYING
"YOUR EYES WILL.."
SAY "YOUR EYES ARE...".
WHEN THEIR EYES ARE SHUT SAY THE FOLLOWING. AS YOU LIE (OR SIT) HERE WITH
YOUR EYES COMFORTABLY CLOSE YOU FIND YOURSELF RELAXING MORE AND
MORE WITH EACH MOMENT AND BREATH.
THE RELAXATION FEELS PLEASANT AND BLISSFUL SO, YOU HAPPILY GIVE WAY TO
THIS WONDERFUL FEELING. IMAGINGE YOURSELF ON A CLOUD, RESTING PEACEFULLY,
WITH A SLIGHT BREEZE CARESSING YOUR BODY.  A TINGLING SENSASION BEGINS
TO WORK ITS WAY, WITHIN AND WITHOUT YOUR TOES, IT SLOWLY MOVES UP YOUR
FEET, MAKING THEM WARM, HEAVY AND RELAXED. THE CLOUD IS SOFT AND SUPPORTS
YOUR BODY WITH ITS SOFT TEXTURE, THE SCENE IS PEACEFUL AND ABSORBING,
THE PEACEFULNESS ABSORBS YOU COMPLETELY...
THE TINGLING GENTLY AND SLOWLY MOVES UP YOUR LEGS, RELAXING THEM.
MAKING THEM WARM AND HEAVY.  THE RELAXATION FEELS VERY GOOD, IT FEELS SO
GOOD TO RELAX AND LET GO. AS THE TINGLING CONTINUES ITS JOURNEY UP INTO
YOUR SOLAR PLEXUS, YOU FEEL YOUR INNER STOMACH BECOME VERY RELAXED.  NOW,
IT MOVES SLOWLY INTO YOUR CHEST, MAKING YOUR BREATHING RELAXED AS WELL.
THE FEELING BEGINS TO MOVE UP YOUR ARMS TO YOUR SHOULDERS, MAKING YOUR ARMS
HEAVY AND RELAXED AS WELL.  YOU ARE AWARE OF THE TOTAL RELAXATION YOU ARE
NOW EXPERIENCING, AND YOU GIVE WAY TO IT.  IT IS GOOD AND PEACEFUL, THE
TINGLING NOW MOVEVES INTO YOUR FACE AND HEAD, RELAXING YOUR JAWS, NECK, AND
FACIAL MUSCLES, MAKING YOUR CARES AND WORRIES FLOAT AWAY. AWAY INTO THE
BLUE SKY AS YOU REST BLISFUlLY ON THE CLOUD....
IF THEY ARE NOT RESPONSIVE OR YOU THINK THEY (HE OR SHE..) IS GOING TO



SLEEP, THEN ADD IN A "...ALWAYS CONCENTRATING UPON MY VOICE, INGORING ALL
OTHER SOUNDS.  EVEN THOUGH OTHER SOUNDS EXSIST, THEY AID YOU IN YOUR
RELAXATION..." THEY SHOULD SOON LET OUT A SIGH AS IF THEY WERE LETTING GO,
AND THEIR FACE SHOULD HAVE A "WOODENESS" TO IT, BECOMING FEATURLESS... NOW,
SAY THE FOLLOWING "....  YOU NOW FIND YOURSELF IN A HALLWAY, THE HALLWAY IS
PEACEFUL AND NICE. AS I COUNT FROM 10 TO 1 YOU WILL IMAGINE YOURSELF
WALKING FURTHER AND FURTHER DOWN THE HALL. WHEN I REACH ONE YOU WILL FIND
YOURSELF WHERE YOU WANT TO BE, IN ANOTHER, HIGHER STATE OF CONCIOUS AND
MIND. (COUNT FROM TEN TO ONE)....." DO THIS ABOUT THREE OR FOUR TIMES.
THEN, TO TEST IF THE SUBJECT IS UNDER HYPNOSIS OR NOT, SAY....
"...YOU FEEL A STRANGE SENSATION IN YOUR (ARM THEY WRITE WITH) ARM, THE
FEELING BEGINS AT YOUR FINGERS AND SLOWLY MOVES UP YOUR ARM, AS IT MOVES
THROUGH YOUR ARM YOUR ARM BECOMES LIGHTER AND LIGHTER, IT WILL SOON BE SO
LIGHT IT WILL .....  BECOMING LIGHTER AND LIGHTER WHICH EACH BREATH AND
MOMENT..."
THEIR FINGERS SHOULD BEGIN TO TWITCH AND THEN MOVE UP, THE ARM FOLLOWING,
NOW MY FRIEND, YOU HAVE HIM/HEP IN HYPNOSIS.  THE FIRST TIME YOU DO THIS,
WHILE HE/SHE IS UNDER SAY GOOD THINGS, LIKE:  "YOUR GOING TO FEEL GREAT
TOMORROW" OR "EVERY DAY IN EVERY WAY YOU WILL FIND YOURSELF BECOMING BETTER
AND BETTER".. OR SOME CRAP LIKE THAT... THE MORE THEY GO UNDER, THE DEEPER
IN HYPNOSIS THEY WILL GET EACH TIME YOU DO IT.

+----------------------------+
! WHAT TO DO WHEN HYPNOTISED !
+----------------------------+

WHEN YOU HAVE THEM UNDER YOU MUST WORD THINGS VERY CAREFULLY TO GET YOUR
WAY. YOU CANNOT SIMPLY SAY...  TAKE OFF YOUR CLOTHES AND FUCK THE PILLOW.
NO, THAT WOULD NOT REALLY DO THE TRICK. YOU MUST SAY SOMETHING LIKE....
"YOU FIND YOUR SELF AT HOME, IN YOUR ROOM AND YOU HAVE TO TAKE A SHOWER
(VIVIDLY DESCRIBE THEIR ROOM AND WHATS HAPPENING), YOU BEGIN TO TAKE OFF
YOUR CLOTHES..."  NOW, IT CANT BE THAT SIMPLE, YOU MUST KNOW THE PERSONS
HOUSE, ROOM, AND SHOWER ROOM. THEN DESCRIBE THINGS VIVIDLY AND TELL THEM
TO ACT IT OUT (THEY HAVE TO BE DEEPLY UNDER TO DO THIS...).  I WOULD JUST
SUGGEST THAT YOU EXPERIMENT A WHILE, AND GET TO KNOW HO; TO DO THINGS.

+-----------+
! WAKING UP !
+-----------+

WAKING UP IS VERY EASY, JUST SAY.. "...AS I COUNT FROM 1 TO 5 YOU WILL
FIND YOURSELF BECOMMING MORE AND MORE AWAKE, MORE AND MORE LIVELY.  WHEN
YOU WAKE UP YOU WILL FIND YOURSELF COMPLETELY ALIVE, AWAKE, AND REFRESHED.
MENTALLY AND PHYSICALLY, REMEMBERING THE PLEASANT SENSATION THAT HYPNOSIS
BRINGS...  WAKING UP FEELING LIKE A NEW BORN BABY, REBORN WITH LIFE AND
VIGOR, FEELING EXCELLENT. REMEMBERING THAT NEXT TIME YOU ENTER HYPNOSIS IT
WILL BECOME AN EVER INCREASING DEEPER AND DEEPER STATE THAN BEFORE.
1- YOU FEEL ENERGY COURSE THROUGHOUT YOUR LIMBS.
2- YOU BEGIN TO BREATHE DEEPLY, STIRRING.
3- BEGINING TO MOVE MORE AND MORE YOUR EYES OPEN, BRINGING YOU UP TO
FULL CONCIOUS.
4- YOU ARE UP,UP, UP AND AWAKENING MORE AND MORE.
5- YOU ARE AWAKE AND FEELING GREAT."

AND THATS IT!  YOU NOW KNOW HOW TO HYPNOTISE YOURSELF AND SOMEONE ELSE.
YOU WILL LEARN MORE AND MORE AS YOU EXPERIMENT.

                            ------------------Jolly Roger



ç##########################################################################
#                                                                        #
#                           The Remote Informer                          #
#                                                                        #
#------------------------------------------------------------------------#
#             Reader supported newsletter for the underworld             #
#------------------------------------------------------------------------#
#                                                                        #
#                    Editors: Tracker and Norman Bates                   #
#                                                                        #
#========================================================================#
# September 1987                                               Issue: 01 #
#========================================================================#
#                              The Headlines                             #
#------------------------------------------------------------------------#
#                     1) Introduction                                    #
#                     2) Hacking Sprint: The Easy Way                    #
#                     3) Rumors: Why spread them?                        #
#                     4) The New Sprint FON Calling Cards                #
#                     5) Automatic Number Identifier (ANI)               #
##########################################################################

                   Introduction
--------------------------------------------------------------------------
Welcome to the first issue of 'The Remote Informer'!  This newsletter
is reader supported.  If the readers of this newsletter do not help
support it, then it will end.  We are putting this out to help out the
ones that would like to read it.  If you are one of those who thinks they
know everything, then don't bother reading it.  This newsletter is not
anything like the future issues.  The future issues will contain several
sections, as long as reader input is obtained.  Below is an outline
overview of the sections in the future issues.

I/O Board (Input/Output Board)

The I/O Board is for questions you have, that we might be able to
answer or atleast refer you to someone or something.  We will be honest if
we cannot help you.  We will not make up something, or to the effect, just
to make it look like we answered you.  There will be a section in the I/O
Board for questions we cannot answer, and then the readers will have the
opportunity to answer it.  We will print anything that is reasonable in
the newsletter, even complaints if you feel like you are better than
everyone.

NewsCenter

This section will be for news around the underworld.  It will talk of
busts of people in the underworld and anything else that would be
considered news.  If you find articles in the paper, or something happens
in your local area, type it up, and upload it to one of the boards listed
at the end of the newsletter.  Your handle will be placed in the article.
If you do enter a news article, please state the date and from where you
got it.

Feature Section

The Feature Section will be the largest of the sections as it will be
on the topic that is featured in that issue.  This will be largely reader



input which will be sent in between issues.  At the end of the issue at
hand, it will tell the topic of the next issue, therefore, if you have
something to contribute, then you will have ample time to prepare your
article.

Hardware/Software Review
In this section, we will review the good and bad points of hardware
and software related to the underworld.  It will be an extensive review,
rather than just a small paragraph.

The Tops

This section will be the area where the top underworld BBS's, hacking
programs, modem scanners, etc. will be shown.  This will be reader
selected and will not be altered in anyway.  The topics are listed below.
Underworld BBS's (Hack, Phreak, Card, Anarchy, etc.)
Hacking programs for Hayes compatables
Hacking programs for 1030/Xm301 modems
Modem scanners for Hayes compatables
Modem scanners for 1030/Xm301 modems
Other type illegal programs
You may add topics to the list if enough will support it.

Tid Bits

This will contain tips and helpful information sent in by the users.
If you have any information you wish to contribute, then put it in a text
file and upload it to one of the BBS's listed at the end of the
newsletter.
Please, no long distance codes, mainframe passwords, etc.
We may add other sections as time goes by.  This newsletter will not
be put out on a regular basis.  It will be put out when we have enough
articles and information to put in it.  There may be up to 5 a month, but
there will always be at least one a month.  We would like you, the readers,
to send us anything you feel would be of interest to others, like hacking
hints, methods of hacking long distance companies, companies to card from,
etc.  We will maintain the newsletter as long as the readers support it.
That is the end of the introduction, but take a look at this newsletter,
as it does contain information that may be of value to you.
==========================================================================
                      Hacking Sprint: The Easy Way
-------------------------------------------------------------------------
                             By: Tracker

If you hack US Sprint, 950-0777 (by the way it is no longer GTE
Sprint), and you are fustrated at hacking several hours only to find one
or two codes, then follow these tips, and it will increase your results
tremendously.  First, one thing that Mr. Mojo proved is that Sprint will
not store more than one code in every hundred numbers.  (ex: 98765400 to
98765499 may contain only one code).   There may NOT be a code in that
hundred, but there will never be more than one.
Sprint's 9 digit codes are stored from 500000000 through 999999999.
In the beginning of Sprint's 950 port, they only had 8 digit codes.  Then
they started converting to 9 digit codes, storing all 8 digit codes
between 10000000 and 49999999 and all 9 digit codes between 500000000 and
999999999.  Sprint has since cancelled most 8 digit codes, although there
are a few left that have been denoted as test codes.  Occaisionally, I
hear of phreaks saying they have 8 digit codes, but when verifying them,



the codes were invalid.
Now, where do you start?  You have already narrowed the low and high
numbers in half, therefore already increasing your chances of good results
by 50 percent.  The next step is to find a good prefix to hack.  By the
way, a prefix, in hacking terms, is the first digits in a code that can be
any length except the same number of digits the code is.  (ex: 123456789
is a code.  That means 1, 12, 123, 1234, 12345, 123456, 1234567, and
12345678 are prefixes)  The way you find a good prefix to hack is to
manually enter a code prefix.  If when you enter the code prefix and a
valid destination number and you do not hear the ringing of the recording
telling you that the code is invalid until near the end of the number,
then you know the prefix is valid.  Here is a chart to follow when doing
this:
Code      - Destination    Range good codes exist
-------------------------------------------------
123456789 - 6192R           123400000 - 123499999
123456789 - 619267R         123450000 - 123459999
123456789 - 61926702R       123456000 - 123456999
123456789 - 6192670293R     123456700 - 123456799
-------------------------------------------------
( R - Denotes when ring for recording starts)
To prove
this true, I ran a test using OmniHack 1.3p, written by
Jolly Joe.  In this test I found a prefix where the last 3 digits were all
I had to hack.  I tested each hundred of the 6 digit prefix finding that
all but 4 had the ring start after the fourth digit was dialed in the
destination number.  The other four did not ring until I had finished the
entire code.  I set OmniHack to hack the prefix + 00 until prefix + 99.
(ex: xxxxxxy00 to xxxxxxy99: where y is one of the four numbers that the
ring did not start until the dialing was completed.)  Using this method, I
found four codes in a total of 241 attempts using ascending hacking (AKA:
Sequential).  Below you will see a record of my hack:
Range of hack            Codes found     Tries
----------------------------------------------
xxxxxx300 - xxxxxx399     xxxxxx350        50
xxxxxx500 - xxxxxx599     xxxxxx568        68
xxxxxx600 - xxxxxx699     xxxxxx646        46
xxxxxx800 - xxxxxx899     xxxxxx877        77
----------------------------------------------
Totals                     4 codes        241
As you see, these methods work.  Follow these guidlines and tips and
you should have an increase in production of codes in the future hacking
Sprint.  Also, if you have any hints/tips you think others could benefit
from, then type them up and upload them to one of the boards at the end of
the newsletter.
==========================================================================
                         Rumors: Why Spread Them?
--------------------------------------------------------------------------
                              By: Tracker
Do you ever get tired of hearing rumors?  You know, someone gets an
urge to impress others, so they create a rumor that some long distance
company is now using tracing equipment.  Why start rumors?  It only scares
others out of phreaking, and then makes you, the person who started the
rumor, look like Mr. Big.  This article is short, but it should make you
aware of the rumors that people spread for personal gain.  The best thing
to do is to denote them as a rumor starter and then leave it at that.  You
should not rag on them constantly, since if the other users cannot
determine if it is fact or rumor, then they should suffer the



consequences.
==========================================================================
                     The New Sprint FON Calling Cards
--------------------------------------------------------------------------
                               By: Tracker
US Sprint has opened up a new long distance network called the Fiber
Optic Network (FON), in which subscribers are given calling cards.  These
calling cards are 14 digits, and though, seem randomly generated, they are
actually encrypted.  The rumors floating around about people getting
caught using the Sprint FON calling cards are fact, not rumors.  The
reason people are getting caught is that they confuse the FON calling
cards with the local 950 port authorization codes.  If you will remember,
you never use AT&T calling cards from you home phone.  It has ANI
capability, which is not tracing, but rather the originating phone number
is placed on the bill as soon as the call is completed.  They know your
phone number when you call the 800 access port, but they do not record it
until your call is completed.  Also, through several of my hacks, I came
up with some interesting information surrounding the new Sprint network.
They are listed below.
800-877-0000
This number is for information on US Sprint's 800 calling card
service.  I have not played around with it, but I believe it is for
trouble or help with the FON calling cards.  I am not sure if it is for
subscribing to the FON network.
800-877-0002 - You hear a short tone, then nothing.
800-877-0003 - US Sprint Alpha Test Channel #1
800-877-(0004-0999)
When you call these numbers, you get a recording saying: "Welcome to
US Sprint's 1 plus service."  When the recording stops, if you hit the
pound key (#) you will get the calling card dial tone.
Other related Sprint numbers
800-521-4949   This is the number that you subscribe to US Sprint with.
You may also subscribe to the FON network on this number.  It will take 4
to 5 weeks for your calling card to arrive.
10777
This is US Sprint's equal access number.  When you dial this number,
you then dial the number you are calling, and it will be billed through US
Sprint, and you will receive their long distance line for that call.  Note
that you will be billed for calls made through equal access.  Do not
mistake it to be a method of phreaking, unless used from a remote
location.
If you are in US Sprint's 1+ service then call 1+700-555-1414, which
will tell you which long distance company you are using.  When you hear:
"Thank you for choosing US Sprint's 1 plus service," hit the pound key
(#), and then you will get the US Sprint dial tone.  This however is just
the same as if you are calling from your home phone if you dial direct, so
you would be billed for calls made through that, but there are ways to use
this to your advantage as in using equal access through a PBX.
==========================================================================
                   Automatic Number Identification (ANI)
--------------------------------------------------------------------------
                             By: Tracker

The true definition for Automatic Number Identification has not been
widely known to many.  Automatic Number Identification, (AKA: ANI), is the
process of the destination number knowing the originating number, which is
where you are calling from.  The method of achieving this is to send the
phone number that you are calling from in coded form ahead of the



destination number. Below is an example of this.
ANI Method
Dial: 267-0293
Sent: ********2670293
* - Denotes the originating number which is coded and sent before the
    number
As you noticed there are 8 digits in the coded number.  This is
because, at least I believe, it is stored in a binary-like form.
Automatic Number Identification means a limited future in phreaking. ANI
does not threaten phreaking very much yet, but it will in the near future.
A new switching system will soon be installed in most cities that are
covered by ESS, Electronic Switching System, now.
The system will have ANI capabilities which will be supplied to the
owners of phone lines as an≡ ≡added extra.  The owner's phone will have
an LED read-out that will show the phone number of the people that
call you.  You will be able to block some numbers, so that people
cannot call you.  This system is in the testing stages currently, but will
soon be installed across most of the country.  As you see, this will
end a large part of phreaking, until we, the phreakers, can come up with
an alternative.  As I have been told by several, usually reliable,
people, this system is called ISS, which I am not sure of the meaning of
this, and is being tested currently in Rhode Island.
800 in-watts lines set up by AT&T support ANI.  The equipment to
decode an ANI coded origination number does not costs as much as you would
expect.  950 ports do not offer ANI capability, no matter what you have
been told.  The 950 ports will only give the city in which they are based,
this usually being the largest in the state, sometimes the capitol.
One last thing that I should tell you is that ANI is not related to
tracing.  Tracing can be done on any number whether local, 950, etc.  One
way around this, especially when dialing Alliance TeleConferencing, is to
dial through several extenders or ports.  ANI will only cover the number
that is calling it, and if you call through a number that does not support
ANI, then your number will never be known.
==========================================================================
                              The Disclaimer!
--------------------------------------------------------------------------

We, the editors, take no responsibility for your actions and use of
the information in this newsletter.  This newsletter is for informational
purposes only.  There will never be any long distance codes, passwords,
etc. in this newsletter.  If you are easily offended by telecommunication
discussions, then we suggest that you not read this newsletter.  But for
those who are truely interested in the information in this newsletter,
enjoy it.

Brought to you in Cookbook, courtesy of the Jolly Roger!!!!!!!!!!


Jackpotting ATM Machines                courtesy of the Jolly Roger

JACKPOTTING was done rather successfully a while back in (you guessed it)
New York. What the culprits did was:
Sever (actually cross over) the line between the ATM and the
host. insert a microcomputer between the ATM and the host. insert
a fradulent card into the ATM.  (card=cash card, not hardware)
What the ATM did was: send a signal to the host, saying "Hey!  Can I
give this guy money, or is he broke, or is his card invalid?"
What the microcomputer did was: intercept the signal from the host,



discard it, send "there's no one using the ATM" signal.
What the host did was: get the "no one using" signal, send back "okay,
then for God's sake don't spit out any money!" signal to ATM.
What the microcomputer did was:
intercept signal (again), throw it away (again), send "Wow!  That
guy is like TOO rich!  Give him as much money as he wants.  In
fact, he's so loaded, give him ALL the cash we have!  He is
really a valued customer." signal.
What the ATM did:
what else?  Obediently dispense cash till the cows came home (or
very nearly so).
What the crooks got:
well in excess of $120,000 (for one weekend's work), and several
years when they were caught.
This story was used at a CRYPTOGRAPHY conference I attended a while
ago to demonstrate the need for better information security.  The
lines between ATM's & their hosts are usually 'weak' in the sense that
the information transmitted on them is generally not encrypted in any
way.  One of the ways that JACKPOTTING can be defeated is to encrypt
the information passing between the ATM and the host.  As long as the
key cannot be determined from the ciphertext, the transmission (and
hence the transaction) is secure.
A more believable, technically accurate story might concern a person
who uses a computer between the ATM and the host to determine the key
before actually fooling the host.  As everyone knows, people find
cryptanalysis a very exciting and engrossing subject...don't they?
(Hee-Hee)

_____             ______
|   |-<<-|   |-<<-|    |
|ATM|    micro    |Host|
|___|->>-|   |->>-|____|

The B of A ATM's are connected through dedicated lines to a host
computer as the Bishop said. However, for maintenance purposes, there
is at least one separate dial-up line also going to that same host
computer. This guy basically bs'ed his way over the phone till he
found someone stupid enough to give him th number. After finding that,
he had has Apple hack at the code. Simple.
Step 2: He had a friend go to an ATM with any B of A ATM card. He
stayed at home with the Apple connected to the host. When his friend
inserted the card, the host displayed it. The guy with the Apple
modified the status & number of the card directly in the host's
memory. He turned the card into a security card, used for testing
purposes. At that point, the ATM did whatever it's operator told it to
do.
The next day, he went into the bank with the $2000 he received,
talked to the manager and told him every detail of what he'd done. The
manager gave him his business card and told him that he had a job
waiting for him when he got out of school.
Now, B of A has been warned, they might have changed the system. On
the other hand, it'd be awful expensive to do that over the whole
country when only a handful of people have the resources and even less
have the intelligence to duplicate the feat. Who knows?
Jug Bomb                                        by the Jolly Roger

Take a glass jug, and put 3 to 4 drops of gasoline into it. Then put
the cap on, and swish the gas around so the inner surface of the jug



is coated.  Then add a few drops of potassium permanganate solution
into it and cap it.  To blow it up, either throw it at something, or
roll it at something.
                          ------------Jolly Roger

Fun at K-Mart                                   by the Jolly Roger

Well, first off, one must realise the importance of K-Marts in
society today. First off, K-Marts provide things cheaper to those who
can't afford to shop at higher quality stores.  Although, all I ever
see in there is minorities and Senior Citizens, and the poor people in
our city.  Personally, I wouldn't be caught dead in there.  But, once,
I did.
You see, once, after The Moon Roach and Havoc Chaos(Dear friends of
mine) and I were exploring such fun things as rooftops, we came along
a K-Mart.  Amused, and cold for that matter, we wandered in.  The
Tension mounts.
As we walked up to the entrance, we were nearly attacked by Youth
Groups selling cheap cookies, and wheelchair sticken people selling
American Flags.  After laughing at these people, we entered. This is
where the real fun begins...
First, we wandered around the store, and turned on all the blue
lights we could find. That really distracts and confuses the
attendents...Fun to do...
The first neat thing, is to go to the section of the store where
they sell computers. Darkness engulf the earth the day they find Apple
Computers being sold there.  Instead, lesser computers like the
laughable C-64 can be found there...Turn it on, and make sure
nobody's looking...Then, once in Basic, type...

]10 PRINT "Fuck the world!  Anarchy Rules!" (or something to that
                                             effect.)
]20 GOTO 10 and walk away.

Also, set the sample radios in the store to a santanic rock station,
and turn the radio off.  Then, set the alarm for two minutes ahead of
the time displayed there.  Turn the volume up all the way, and walk
away.  After about two minutes, you will see the clerk feebly attempt
to turn the radio down or off.  It's really neat to set ten or more
radios to different stations, and walk away.
One of my favorite things to do, is to get onto the intercom system
of the store.  Easier typed then done.  First, check out the garden
department.  You say there's no attendent there? Good.  Sneak
carefully over to the phone behind the cheap counter there, and pick
it up.  Dial the number corrisponding to the item that says 'PAGE'...
And talk.  You will note that your voice will echo all over the bowels
of K-Mart.
I would suggest announcing something on the lines of: "Anarchy
rules!!"
                                 ---------------Jolly Roger

Mace Substitute                                 by the Jolly Roger

3 PARTS: Alcohol
1/2 PARTS: Iodine
1/2 PARTS: Salt
Or:
3 PARTS: Alcohol



1 PARTS: Iodized Salt (Mortons)

It's not actual mace, but it does a damn good job on the eyes...

                     --------------Jolly Roger

How to grow Marijuana                       courtesy of the Jolly Roger

                           MARIJUANA
Marijuana is a deciduous plant which grows from seeds. The fibrous section
of the plant was (has been replaced by synthetics) used to make rope.
The flowering tops, leaves, seeds, and resin of the plant is
used by just about everyone to get HIGH.
Normally, the vegetable parts of the plant are smoked to produce this
"high," but thay can also be eaten. The axtive ingredient in marijuana
resin is THC (tetahydrocannabinol). Marijuana contains from 1 - 4 per
cent THC (4 per cent must be considered GOOD dope).
Marijuana grows wild in many parts of the world, and is cultivated in
Mexice, Vietnam, Africa, Nepal, India, South America, etc.,etc. The
marijuana sold in the United States comes primarily from, yes, the
Uniited States.
It is estimated that at least 50 per cent of the grass on the streets
in America is homegrown. The next largest bunch comes actoss the
borders from Mexico, with smaller amounts filtering in from Panama,
occasionally South America, and occasinally, Africa.
Hashish is the pure resin of the marijuana plant, which is scraped from
the flowering tops of the plant and lumped together. Ganja is the
ground-up tops of the finest plants. (It is also the name given to any
sort of marijuana in Jamaica.)
Marijuana will deteriorate in about two years if exposed to light,
air or heat. It should always be stored in cool places.
Grass prices in the United States are a direct reflection of the laws
of supply and demand (and you thought that high school economics
would never be useful). A series of large border busts, a short growing
season, a bad crop, any number of things can drive the price of marijuana
up. Demand still seems to be on the increase in the U.S., so prices seldom
fall below last year's level.
Each year a small seasonal drought occurs, as last year's supply runs
low, and next year's crop is not up yet. Prices usually rase about
20 - 75 per cent during this time and then fall back to "normal."
Unquestionably, a large shortage of grass causes a percentage of smokers
to turn to harder drugs instead. For this reason, no grass control
program can ever be beneficial or "successful."
                                GROW IT!
There is one surefire way of avoiding high prices and the grass DT's:
Grow your own. This is not as difficult as some "authorities" on the
subject would make you believe. Marijuana is a weed, and a fairly
vivacious one at that, and it will grow almost in spite of you.
                               OUTDOORS
Contrary to propular belief, grass grows well in many place on the
North American continent. It will flourish even if the temperature does
not raise above 75 degrees.
The plants do need a minimum of eight hours of sunlight per day and
should be planted in late April/early May, BUT DEFINITELY, after the
last frost of the year.
Growing an outdoor, or "au naturel", crop has been the favored method
over the years, because grass seems to grow better without as much
attention when in its natural habitat.



Of course, an outdoors setting requires special precautions not encoun-
tered with an indoors crop; you must be able to avoid detection, both from
law enforcement freaks and common freaks, both of whom will take your
weed and probably use it. Of course, one will also arrest you. You must
also have access to the area to prepare the soil and harvest the crop.
There are two schools of thought about starting the seeds. One says you
should start the seedlings for about ten days in an indoor starter box
(see the indoor section) and then transplant. The other theory is that
you should just start them in the correct location. Fewer plants will
come up with this method, but there is no shock of transplant to
kill some of the seedlings halfway through.
The soil should be preprepared for the little devils by turning it
over a couple of times and adding about one cup of hydrated lime per
square yard of soil and a little bit (not too much, now) of good water
soluble nitrogen fertilizer. The soil should now be watered several
times and left to sit about one week.
The plants should be planted at least three feet apart, getting too
greedy and stacking them too close will result in stunted plants.
The plants like some water during their growing season, BUT not too
much. This is especially true around the roots, as too much water will
rot the root system.
Grass grows well in corn or hops, and these plants will help provide
some camouflage. It does not grow well with rye, spinach, or pepperweed.
It is probally a good idea to plant in many small, broken patches, as
people tend to notice patterns.
                       GENERAL GROWING INFO
Both the male and he female plant produce THC resin, although the male
is not as strong as the female. In a good crop, the male will still be
plenty smokable and should not be thrown away under any circumstances.
Marijuana can reach a hight of twenty feet (or would you rather wish on
a star) and obtain a diameter of 4 1/2 inches. If normal, it has a sex
ratio of about 1:1, but this can be altered in several ways.
The male plant dies in the 12th week of growing, the female will live
another 3 - 5 weeks to produce her younguns. Females can weigh twice as
much as males when they are mature.
Marijuana soil should compact when you squeeze it, but should also break
apart with a small pressure and absorb water well. A nice test
for either indoor or outdoor growing is to add a bunch of worms to the
soil, if they live and hang aroung, it is good soil, but if they don't,
well, change it. Worms also help keep the soil loose enough for the
plants to grow well.
                                SEEDS
To get good grass, you should start with the right seeds. A nice starting
point is to save the seeds form the best batch you have consumed. The
seeds should be virile, that is, they should not be grey and shiriveled
up, but green, meaty, and healthy appearing. A nice test is to drop the
seeds on a hot frying pan. If they "CRACK," they are probably good for
planting purposes.
The seeds should be soaked in distilled water overnight before planting.
BE SURE to plant in the ground with the pointy end UP. Plant about 1/2"
deep. Healthy seeds will sprout in about five days.
                             SPROUTING
The best all around sprouting method is probably to make a sprouting box
(as sold in nurseries) with a slated bottom or use paper cups with holes
punched in the bottoms. The sprouting soil should be a mixture of humus,
soil, and five sand with a bit of organic fertilizer and water mixed
in about one week before planting.
When ready to transplant, you must be sure and leave a ball of soil



around the roots of each plant. This whole ball is dropped into a
baseball-sized hold in the permanent soil.
If you are growing/transplanting indoors, you should use a green
safe light (purchased at nurseries) during the transplanting operation.
If you are transplanting outdoors, you should time it about two
hours befor sunset to avoid damage to the plant. Always wear cotton
gloves when handling the young plants.
After the plants are set in the hole, you should water them. It is also
a good idea to use a commercial transplant chemical (also purchased at
nurseries) to help then overcome the shock.
                          INDOOR GROWING
Indoor growing has many advantages, besides the apparent fact that it
is much harder to have your crop "found," you can control the ambient
conditions just exactly as you want them and get a guaranteed "good"
plant.
Plants grown indoors will not appear the same as their outdoor cousins.
They will be scrawnier appearing with a weak stems and may even require
you to tie them to a growing post to remain upright, BUT THEY WILL HAVE
AS MUCH OR MORE RESIN!
If growing in a room, you should put tar paper on the floors and then
buy sterilized bags of soil form a nursery. You will need about one
cubic foot of soil for eavh plant.
The plants will need about 150 ml. of water per plant/per week. They
will also need fresh air, so the room must be ventilated. (however,
the fresh air should contain NO TOBACCO smoke.)
At least eight hours of light a day must be provided. As you increase
the light, the plants grow faster and show more females/less males.
Sixteen hours of light per day seems to be the best combination, beyond
this makes little or no appreciable difference in the plant quality.
Another idea is to interrupt the night cycle with about one hour of
light. This gives you more females.
The walls of your growing room should be painted white or covered with
aluminum foil to reflect the light.
The lights themselves can be either bulbs of fluorescent. Figure about
75 watts per plant or one plant per two feet of flouresent tube.
The fluorescents are the best, but do not use "cool white" types. The
light sources should be an average of twenty inches from the
plant and NEVER closer than 14 inches. They may be mounted on a rack
 and moved every few days as the plants grow.
The very best light sources are those made by Sylvania and others
especially for growing plants (such as the "gro lux" types).
                       HARVESTING AND DRYING
The male plants will be taller and have about five green or yellow sepals,
which will split open to fertilize the female plant with pollen.
The female plant is shorter and has a small pistillate flower, which
really doesn't look like a flower at all but rather a small bunch of
leaves in a cluster.
If you don't want any seeds, just good dope, you should pick the males
before they shed their pollen as the female will use some of her resin
to make the seeds.
After another three to five weeks, after the males are gone, the females
will begin to wither and die (from loneliness?), this is the time to pick.
In some nefarious Middle Eastren countries, farmers reportedly put their
beehives next to fiels of marijuana. The little devils collect the grass
pollen for their honey, which is supposed to contain a fair dosage
of THC.
The honey is then enjoyed by conventional methods or made into ambrosia.
If you want seeds - let the males shed his pollen then pick him. Let



the female go another month and pick her.
To cure the plants, they must be dried. On large crops, this is
accomplished by constructing a drying box or drying room.
You must have a heat source (such as an electric heater) which will make
the box/room each 130 degrees. The box/room must be ventilated
to carry off the water-vapor-laden air and replace it with fresh.
A good box can be constructed from an orange crate with fiberglass
insulated walls, vents in the tops, and screen shelves to hold the leaves.
There must be a baffle between the leaves and the heat source.
A quick cure for smaller amounts is to: cut the plant at the soil level
and wrap it in a cloth so as not to loose any leavs. Take out any seeds
by hand and store. Place all the leaves on a cookie sheet or aluminum
foil and put them in the middle sheld of the oven, which is set on "broil."
In a few seconds, the leaves will smoke and curl up, stir them around and
give another ten seconds before you take them out.
                    TO INCREASE THE GOOD STUFF
There are several tricks to increase the number of females, or the THC
content of plants:
You can make the plants mature in 36 days if you are in a hurry, by cutting
back on the light to about 14 hours, but the plants will not be as big.
You should gradually shorten the light cycle until you reach fourteen
hours.
You can stop any watering as the plants begin to bake the resin rise to
the flowers. This will increse the resin a bit.
You can use a sunlamp on the plants as they begin to develop flower stalks.
You can snip off the flower, right at the spot where it joins the plant,
and a new flower will form in a couple of weeks.
This can be repeated two or three times to get several times more flowers
than usual.
If the plants are sprayed with Ethrel early in their growing stage, they
will produce almost all female plants. This usually speeds up the flowering
also, it may happen in as little as two weeks.
You can employ a growth changer called colchicine. This is a bit hard to
get and expensive. (Should be ordered through a lab of some sort and
costs about $35 a gram.)
To use the colchicine, you should prepare your presoaking solution of
distilled water with about 0.10 per cent colchicine. This will cause
many of the seeds to die and not germinate, but the ones that do come
up will be polyploid plants. This is the accepted difference between
such strains as "gold" and normal grass, and yours will DEFINITELY
be superweed.
The problem here is that colchicine is a posion in larger quanities and
may be poisonous in the first generation of plants. Bill Frake, author
of CONNOISSEUR'S HANDBOOK OF MARIJUANA runs a very complete colchicine
treatment down and warns against smoking the first generation plants
(all succeeding generations will also be polyploid) bacause of this
poisonous quality.
However, the Medical Index shows colchicine being given in very small
quantities to people for treatment if various ailments. Although these
quantities are small, they would appear to be larger than any you could
recive form smoaking a seed-treated plant.
It would be a good idea to buy a copy of CONNOISSEUR'S, if you are planning
to attempt this, and read Mr. Drake's complete instructions.
Another still-experimental process to increase the resin it to pinch off
the leaf tips as soon as they appear from the time the plant is in the
seedling stage on through its entire life-span. This produces a distorted,
wrecked-looking plant which would be very difficuly to recognize as
marijuana. Of course, there is less substance to this plant, but such



wrecked creatures have been known to produve so much resin that it
crystallizes a strong hash all over the surface of the plant - might
be wise to try it on a plant or two and see what happens.
                        PLANT PROBLEM CHART
Always check the overall enviromental conditions prior to passing
judgment - soil aroung 7 pH or slightly less - plenty of water, light,
fresh air, loose soil, no water standing in pools.
        SYMPTOM                       PROBABLY PROBLEM/CURE
Larger leaves turning yellow -      Nitrogen dificiency - add
smaller leaves still green.         nitrate of soda or
                                    organic fertilizer.
Older leaves will curl at edges,    Phosphorsus dificiency -
turn dark, possibaly with a purple  add commercial phosphate.
cast.
Mature leaves develop a yellowish   Magnesium dificiency -
cast to least veinal areas.         add commercial fertilizer
                                    with a magnesium content.
Mature leaves turn yellow and then  Potassium dificiency -
become spotted with edge areas      add muriate of potash.
turning dark grey.
Cracked stems, no healthy support   Boron dificiency - add
tissue.                             any plant food containing
                                    boron.
Small wrinkled leaves with          Zinc dificiency - add
yelloish vein systems.              commercial plant food
                                    containing zinc.
Young leaves become deformed,       Molybedum dificiency -
possibaly yellowing.                use any plant food with a
                                    bit of molydbenum in it.
                         EXTRA SECTION:
                       BAD WEED/GOOD WEED
Can you turn bad weed into good weed? Surprisingly enough, the answer
to this oft-asked inquiry is, yes!
Like most other things in life, the amount of good you are going
to do relates directly to how much effort you are going to put into it.
There are no instant, supermarket products which you can spray on Kansas
catnip and have wonderweed, but there are a number of simplified,
inexpensive processes (Gee, Mr. Wizard!) thich will enhance mediocre
grass somewhat, ant there are a couple of fairly involved processes
which will do up even almost-parsley weed into something worth writing
home about.
                                   EASES
1. Place the dope in a container which allows air to enter in a restricted
fashion (such as a can with nail holes punched in its lid) and add a
bunch of dry ice, and the place the whold shebang in the freezer for a
few days. This process will add a certain amount of potency to the product,
however, this only works with dry ice, if you use normal, everyday
freezer ice, you will end up with a soggy mess...
2. Take a quantity of grass and dampen it, place in a baggie or another
socially acceptable container, and store it in a dark, dampish place
for a couple of weeks (burying it also seems to work). The grass will
develop a mold which tastes a bit harsh, a and burns a tiny bit funny,
but does increase the potency.
3. Expose the grass to the high intensity light of a sunlamp for a full
day or so. Personally, I don't feel that this is worth the effort, but
if you just spent $400 of your friend's money for this brick of
super-Colombian, right-from-the-President's-personal-stash,
and it turns out to be Missouri weed, and you're packing your bags to



leave town before the people arrive for their shares, well, you might
at least try it. Can't hurt.
4. Take the undisirable portions of our stash (stems, seeds, weak weed,
worms, etc.) and place them in a covered pot, with enough rubbing
alchol to cover everything.
Now CAREFULLY boil the mixture on an ELECTRIC stove or lab burner. DO
NOT USE GAS - the alchol is too flammable. After 45 minutes of heat,
remove the pot and strain the solids out, SAVING THE ALCOHOL.
Now, repeat the process with the same residuals, but fresh alchol.
When the second boil is over, remove the solids again, combine the two
quantities of alcohol and reboil until you have a syrupy mixture.
Now, this syrupy mixture will contain much of the THC formerly hidden
in the stems and such. One simply takes this syrup the throughly
combines it with the grass that one wishes to improve upon.
          SPECIAL SECTION ON RELATED SUBJECT MARYGIN:
Marygin is an anagram of the words marijuana and gin, as in Eli Whitney.
It is a plastic tumbler which acts much like a commercial cottin gin.
One takes about one ounce of an harb and breaks it up. This is then placed
in the Marygin and the protuding knod is roatated. This action turns
the internal wheel, which separates the grass from the debris (seeds,
stems).
It does not pulberize the grass as screens have a habit of doing and is
easily washable.
Marygin is available from:
     P.O. Box 5827
     Tuscon, Arizona 85703
     $5.00

     GRASS
     Edmund Scientific Company
     555 Edscorp Building
     Barrington, New Jersy 08007
     Free Catalog is a wonder of good things for the potential grass
grower. They have an electric thermostat greenhouse for starting
plants for a mere $14.95.
Soil test kits for PH - $2.40
Al test - $9.95
Soil thermometer - $2.75
Lights which approzimate the true color balance of the sun and are
probably the most beneficial types available: 40 watt, 48 inch - 4 for
$15.75.
Indoor sun bulb, 75 or 150 watt - $5.75.
And, they have a natural growth regualtor for plants (Gibberellin) which
can change height, speed growth, and maturity, promote blossoming,
etc. Each plant reacts differently to treatment with Gibberellin...there's
no fun like experimenting - $2.00
                        SUGGESTED READING
THE CONNOISSEUR'S HANDBOOK OF MARIJUANA, Bill Drake
Straight Arrow Publishing - $3.50
625 Third Street
San Francisco, California

FLASH
P.O.Box 16098
San Fransicso, California 94116
Stocks a series of pamphlets on grass, dope manufacture, cooking.
Includes the Mary Jane Superweed series.




Match Head Bomb                                 by the Jolly Roger

Simple safety match heads in a pipe, capped at both ends, make a
devestating bomb. It is set off with a regular fuse.
A plastic Baggie is put into the pipe before the heads go in to
prevent detonation by contact with the metal.
Cutting enough match heads to fill the pipe can be tedious work for
one but an evening's fun for the family if you can drag them away from
the TV.
                           ----------------Jolly Roger


How To Terrorize McDonalds                       by the Jolly Roger
     (Originally an Apple ][ file so excuse the upper case!!!)

NOW, ALTHOUGH Mc DONALDS IS FAMOUS FOR IT'S ADVERTISING AND MAKING THE
WHOLE WORLD THINK THAT THE BIG MAC IS THE BEST THING TO COME ALONG SINCE
SLICED BREAD (BUNS?), EACH LITTLE RESTAURANT IS AS AMATEUR AND SIMPLE AS
A NEW-FOUND BUSNESS. NOT ONLY ARE ALL THE EMPLOYEES RATHER INEXPERIENCED
AT WHAT THEY'RE =SUPPOSED= TO DO, BUT THEY WILL JUST LOOSE ALL CONTROL WHEN
AN EMERGENCY OCCURS....HERE WE GO!!! FIRST, GET A FEW FRIENDS (4 IS
GOOD...I'LL GET TO THIS LATER) AND ENTER THE MCDONALDS RESTAURANT, TALKING
LOUDLY AND REAKING OF SOME STRANGE SMELL THAT AUTOMATICALLY MAKES THE OLD
COUPLE SITTING BY THE DOOR LEAVE. IF ONE OF THOSE PIMPLY-FACED GOONS IS
WIPING THE FLOOR, THEN TRACK SOME CRAP ALL OVER IT (YOU COULD PRETEND TO
SLIP AND BREAK YOUR HEAD, BUT YOU MIGHT ACTUALLY DO SO).
NEXT, BEFORE YOU GET THE FOOD, FIND A TABLE. START YELLING AND RELEASING
SOME STRANGE BODY ODOR SO =ANYBODY= WOULD LEAVE THEIR TABLE AND WALK OUT
THE DOOR. SIT 2 FRIENDS THERE, AND GO UP TO THE COUNTER WITH ANOTHER.
FIND A PLACE WHERE THE LINE IS SHORT, OR IF THE LINE IS LONG SAY "I ONLY
WANNA BUY A COKE" AND YOU GET MOVED UP. NOW, YOU GET TO DO THE =ORDERING=
...HEH HEH HEH. SOMEBODY =ALWAYS= MUST WANT A PLAIN
HAMBURGER WITH ABSOLUTELY NOTHING ON IT (THIS TAKES EXTRA TIME TO MAKE, AND
DRIVES THE LITTLE HAMBURGER-MAKERS INSANE)..ORDER A 9-PACK OF CHICKEN
MCNUGGETS...NO, A 20 PACK...NO, THREE 6 PACKS...WAIT...GO BACK TO THE TABLE
AND ASK WHO WANTS WHAT. YOUR OTHER FRIEND WAITS BY THE COUNTER AND MAKES A
PASS AT THE FEMALE CLERK. GET BACK TO THE THING AND ORDER THREE 6-PACKS OF
CHICKEN ETC....NOW SHE SAYS "WHAT KIND OF SAUCE WOULD YOU LIKE?".OF COURSE,
SAY THAT YOU ALL WANT BARBECUE SAUCE ONE OF YOUR FRIENDS WANTS 2 (ONLY IF
THERE ARE ONLY 2 CONTAINERS OF BARBECUE SAUCE LEFT).THEN THEY HAFTA GO INTO
THE STOREROOM AND OPEN UP ANOTHER BOX. FINALLY, THE DRINKS...SOMEBODY WANTS
COKE, SOMEBODY ROOT BEER, AND SOMEBODY DIET COKE. AFTER THESE ARE
DELIVERED,
BRING THEM BACK AND SAY "I DIDN'T ORDER A DIET COKE! I ORDERED A SPRITE!"
THIS GETS THEM MAD; BETTER YET, TURN DOWN SOMETHING TERRIBLE THAT NOBODY
WANTS TO DRINK, SO THEY HAFTA THROW THE DRINK AWAY; THEY CAN'T SELL IT.
AFTER ALL THE FOOD(?) IS HANDED TO YOU, YOU MUST =NEVER= HAVE ENOUGH MONEY
TO PAY. THE CLERK WILL BE SO ANGRY AND CONFUSED THAT SHE'LL LET YA GET
AWAY WITH IT (ANOTHER INFLUENCE ON HER IS YOUR FRIEND ASKING HER "IF YOU
LET US GO I'LL GO OUT WITH YOU" AND GIVING HER A FAKE FONE NUMBER).
NOW, BACK TO YOUR TABLE. BUT FIRST, SOMEBODY LIKES KETCHUP AND MUSTARD.
AND PLENTY (TOO MUCH) OF NAPKINS. OH, AND SOMEBODY LIKES FORKS AND KNIVES,
SO ALWAYS END UP BREAKING THE ONES YOU PICK OUTTA THE BOX. HAVE YOUR
FRIENDS YELL OUT,"YAY!!!!! WE HAVE MUNCHIES!!" AS LOUD AS THEY CAN.
THAT'LL WORRY THE ENTIRE RESTAURANT. PROCEED TO SIT DOWN. SO, YOU ARE
SITTING IN THE SMOKING SECTION (BY ACCIDENT) EH? WELL, WHILE ONE OF THE
TOBACCO-BREATHERS ISN'T LOOKING, PUT A SIGN FROM THE OTHER SIDE OF THE
ROOM SAYING "DO NOT SMOKE HERE" AND HE'LL HAFTA MOVE...THEN HE GOES INTO



THE REAL NON-SMOKING SECTION, AND GETS YELLED AT. HE THEN THINKS THAT
NO SMOKING IS ALLOWED IN THE RESTAURANT, SO HE EATS OUTSIDE (IN THE POUR-
ING RAIN) AFTER YOUR MEAL IS FINISHED (AND QUITE A FEW SPLATTERED-OPENED
KETCHUP PACKETS ARE ALL OVER YER TABLE), TRY TO LEAVE. BUT OOPS! SOMEBODY
HAS TO DO HIS DUTY IN THE MEN'S ROOM. AS HE GOES THERE, HE STICKS AN
UNEATED HAMBURGGR (WOULD YOU DARE TO EAT ONE OF THEIR HAMBURGERS?)
INSIDE THE TOILET, FLUSHES IT A WHILE,UNTIL IT RUNS ALL OVER THE BATHROOM.
OOPS! SEND A PIMPLY-FACED TEENAGER TO CLEAN IT UP. (HE WON'T KNOW THAT
BROWN THING IS A HAMBURGER, AND HE'LL GET SICK. WHEEE!)
AS YOU LEAVE THE RESTCURANT, LOOKING BACK AT YOUR UNCLEANED TABLE, SOMEBODY
MUST REMEMBER THAT THEY LEFT THEIR CHOCOLATE SHAKE THERE! THE ONE THAT'S
ALMOST FULL!!!! HE TAKES IT THEN SAYS "THIS TASTES LIKE CRAP!", THEN HE
TAKES OFF THE LID AND THROWS IT INTO THE GARBAGE CAN...OOPS! HE MISSED,
AND NOW THE SAME POOR SOUL WHO'S CLEANING UP THE BATHROOM NOW HASTA CLEAN
UP CHOCOLATE SHAKE. THEN LEAVE THE JOINT, REVERSING THE "YES, WE'RE OPEN"
SIGN (AS A REMINDER OF YER VISIT THERE YOU HAVE IT! YOU HAVE JUST PUT
ALL OF MCDONALDS INTO COMPLETE MAYHEM. AND SINCE THERE IS NO PENALTY FOR
LITTERING IN A RESTAURANT, BUGGING PEOPLE IN A PUBLIC EATERY (OR
THROW-UPERY, IN THIS CASE) YOU GET OFF SCOT-FREE. WASN'T THAT FUN?

                                --------------Jolly Roger

"Mentor's Last Words"                  courtesy of the Jolly Roger

The following file is being reprinted in honor and sympathy for the many
phreaks and hackers that have been busted recently by the Secret Service.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  \/\The Conscience of a Hacker/\
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
      Another one got caught today, it's all over the papers.  "Teenager
Arrested in Computer Crime Scandal", "Hacker Arrested after Bank
Tampering"... Damn kids.  They're all alike. But did you, in your three-
piece psychology and 1950's technobrain, ever take a look behind the
eyes of the hacker?  Did you ever wonder what made him tick, what forces
shaped him, what may have molded him? I am a hacker, enter my world...
Mine is a world that begins with school... I'm smarter than most of the
other kids, this crap they teach us bores me...  Damn underachiever.
They're all alike. I'm in junior high or high school.  I've listened to
teachers explain for the fifteenth time how to reduce a fraction.
I understand it.  "No, Ms. Smith, I didn't show my work.  I did it in
my head..." Damn kid.  Probably copied it.  They're all alike.
I made a discovery today.  I found a computer.  Wait a second, this is
cool.  It does what I want it to.  If it makes a mistake, it's because I
screwed it up.  Not because it doesn't like me...  Or feels threatened by
me.. Or thinks I'm a smart ass.. Or doesn't like teaching and shouldn't be
here... Damn kid.  All he does is play games.  They're all alike. And then
it happened... a door opened to a world... rushing through the phone line
like heroin through an addict's veins, an electronic pulse is sent out,
a refuge from the day-to-day incompetencies is sought... a board is found.
"This is it... this is where I belong..." I know everyone here... even
if I've never met them, never talked to them, may never hear from them
again... I know you all... Damn kid.  Tying up the phone line again.
They're all alike... You bet your ass we're all alike... we've been
spoon-fed baby food at school when we hungered for steak... the bits of
meat that you did let slip through were pre-chewed and tasteless.
We've been dominated by sadists, or ignored by the apathetic.  The few
that had something to teach found us willing pupils, but those few are
like drops of water in the desert.



   This is our world now... the world of the electron and the switch, the
beauty of the baud.  We make use of a service already existing without
paying for what could be dirt-cheap if it wasn't run by profiteering
gluttons, and you call us criminals.  We explore... and you call us
criminals.  We seek after knowledge... and you call us criminals.  We
exist without skin color, without nationality, without religious bias...
and you call us criminals. You build atomic bombs, you wage wars, you
murder, cheat, and lie to us and try to make us believe it's for our
own good, yet we're the criminals.
   Yes, I am a criminal.  My crime is that of curiosity.  My crime is
that of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never
forgive me for. I am a hacker, and this is my manifesto.  You may stop
this individual,but you can't stop us all... after all, we're all alike.
                            +++The Mentor+++
[May the members of the phreak community never forget his words -JR]

The Myth of the 2600hz Detector        courtesy of the Jolly Roger
    (Imported from the Apple ][ so forgive the upper case!!)

JUST ABOUT EVERYONE I TALK TO THESE DAYS ABOUT ESS SEEMS TO BE SCARED
WITLESS ABOUT THE 2600HZ DETECTOR. I DON'T KNOW WHO THOUGHT THIS ONE UP,
BUT IT SIMPLY DOES NOT EXIST. SO MANY OF YOU PEOPLE WHINE ABOUT THIS SO
-CALLED PHREAK CATCHING DEVICE FOR NO REASON.
SOMEONE WITH AT&T SAID THEY HAD IT TO CATCH PHREAKERS.  THIS WAS JUST TO
SCARE THE BLUE-BOXERS ENOUGH TO MAKE THEM QUIT BOXING FREE CALLS.
I'M NOT SAYING ESS IS WITHOUT ITS HANG-UPS, EITHER. ONE THING THAT ESS CAN
DETECT READILY IS THE KICK-BACK THAT THE TRUNK CIRCUITRY SENDS BACK TO THE
ESS MACHINE WHEN YOUR LITTLE 2600HZ TONE RESETS THE TOLL TRUNK. AFTER AN
ESS DETECTS A KICKBACK IT TURNS AN M-F DETECTOR ON AND RECORDES ANY M-F
TONES X-MITTED.

---------------------------------------
   DEFEATING THE KICK-BACK DETECTOR
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

AS MENTIONED IN MY PREVIOUS NOTE, KICK-BACK DETECTION CAN BE A SERIOUS
NUISANCE TO ANYONE INTERESTED IN GAINING CONTROL OF A TRUNK LINE.
THE EASIEST WAY TO BY-PASS THIS DETECTION CIRCUITRY IS NOT REALLY
BY-PASSING IT AT ALL, IT IS JUST LETTING THE KICK-BACK GET DETECTED ON
SOME OTHER LINE. THIS OTHER LINE IS YOUR LOCAL MCI, SPRINT, OR OTHER LONG
DISTANCE CARRIER (EXCEPT AT&T).  THE ONLY CATCH IS THAT THE SERVICE
YOU USE MUST NOT DISCONNECT THE LINE WHEN YOU HIT THE 2600HZ TONE.
THIS IS HOW YOU DO IT:  CALL UP YOUR LOCAL EXTENDER, PUT IN THE CODE,
AND DIAL A NUMBER IN THE 601 AREA CODE AND THE 644 EXCHANGE. LOTS OF OTHER
EXCHANGES WORK ACROSS THE COUNTRY, I'M SURE, BUT THIS IS THE ONLY ONE
THAT I HAVE FOUND SO FAR.  ANYWAY, WHEN IT STARTS RINGING, SIMPLY HIT
2600HZ AND YOU'LL HEAR THE KICK-BACK, (KA-CHIRP, OR WHATEVER). THEN YOU ARE
READY TO DIAL WHOEVER YOU WANT (CONFERENCES, INWARD, ROUTE AND RATE,
OVERSEAS, ETC.) FROM THE TRUNK LINE IN OPERATOR TONES! SINCE BLOWING
2600HZ DOESN'T MAKE YOU YOU A PHREAKER UNTIL THE TOLL EQUIPMENT RESETS
THE LINE, KICKBACK DETECTION IS THE METHOD AT&T CHOOSES (FOR NOW)
THIS INFORMATION COMES AS A RESULT OF MY EXPERIMENTS & EXPERIENCE AND
HAS BEEN VERIFIED BY LOCAL AT&T EMPLOYEES I HAVE AS ACQUAINTANCES.
THEY COULD ONLY SAY THAT THIS IS TRUE FOR MY AREA, BUT WERE PRETTY SURE
THAT THE SAME IDEA IS IMPLEMENTED ACROSS THE COUNTRY.

=======================================



çNOW THAT YOU KNOW HOW TO ACCESS A TRUNK LINE OR AS OPERATORS SAY A LOOP, I
WILL TELL YOU THE MANY THINGS YOU CAN DO WITH IT.
HERE IS A LIST OF AT&T SERVICES ACCESSIBLE TO YOU BY USING A BLUE BOX.

A/C+101    TOLL SWITCHING
A/C+121    INWARD OPERATOR
A/C+131    INFORMATION
A/C+141    ROUTE & RATE OP.
A/C+11501  MOBILE OPERATOR
A/C+11521  MOBILE OPERATOR

STARTING CONFERANCES:---------------------

THIS IS ONE THE MOST USEFUL ATTRIBUTES OF BLUE BOXING. NOW THE CONFS.
ARE UP 24 HOURS/DAY AND 7 DAYS/WEEK AND THE BILLING LINES ARE BEING
BILLED.
SINCE I BELEIVE THE ABOVE IS TRUE (ABOUT THE BILLING LINES BEING BILLED)
I WOULD RECOMMEND THAT YOU NEVER LET YOUR # SHOW UP ON THE CONF. IF YOU
STARTED IT, PUT IT ON A LOOP AND THEN CALL THE LOOP. ENOUGH
BULLSHIT!!!!! TO START THE CONF. DIAL ONE OF THESE THREE NUMBERS IN
M-F WHILE YOU ARE ON THE TRUNK.
213+080+XXXX
XXXX=1050,3050
SPECIAL XXXX=1000,1100,1200,1500,2200,2500.
THESE #S ARE IN L.A. AND ARE THE MOST WATCHED, I DO NOT ADVISE USING THIS
NPA.
312+001+1050 OR 3050
914+042+1050 OR 1100,1200 ECT..
***************************************
UPDATE, I BELEIVE ONLY 914 WORKS AT THE MOMENT
***************************************
ONCE CONNECTED WITH ONE OF THESE YOU WILL EITHER HEAR A RE-ORDER,
BUSY, OR CHERP. WHEN YOU HEAR THE CHERP ENTER THE BILLING LINE IN M-F.
I USE THE CONF. DIAL- UP.
A BILLING LINE EXAMPLE: KP312+001+1050ST
YOU WILL THEN HEAR TWO TUTES AND A RECORDING ASKING YOU FOR THE # OF
CONFERREES INCLUDING YOURSELF.  ENTER A # BETWEEN 20 AND 30.
IF YOU EVER GET OVER 30 PEOPLE ON A CONFERANCE ALL YOU WILL HEAR IS
JUMBLED VOICES.  AFTER THE IT SAYS
"YOUR CONFERANCE SIZE IS XX" THEN HIT # SIGN.  ADD YOUR FAVORITE LOOP
ON AND HIT 6 TO TRANSFER CONTROL TO IT. AFTER IT SAYS CONTROL WILL BE
TRANSFERED HANG UP AND CALL THE OTHER SIDE OF THE LOOP,
HIT # SIGN AND FOLLOW THE INSTRUCTIONS. A BONUS FOR CONF. IS TO ADD AN
INTERNATIONAL # DIAL 1+011+CC+NUMBER PRETTY COOL EHHH.
A FEW EXTRA NOTES.
DO NOT ADD #S THAT YOU WILL WANT TO HANG UP, ADD THESE THROUGH MCI OR
SPRINT. YOU CANNOT BLOW ANYONE OFF W/2600HZ UNLESS THEY ARE IN AN
OLD X-BAR OR OLDER SYSTEM.
MANY D.A. OPERATORS WILL STAY ON AFTER YOU ABUSE THEM; YOU MAY HAVE TO
START ANOTHER OR AT LEAST DON'T SAY ANY NUMBERS.
NEVER ADD THE TONE SIDE OF A LOOP ONTO A CONF.
NEVER ADD MORE THAN ONE MCI NODE ON YOUR CONF.
ROUTE & RATE:
-------------
NOTE ROUTE & RATE AND RQS PERFORM THE SAME SERVICE.
R&R SIMPLY TELLS YOU ROUTE AND RATE INFO WHICH IS VERY VALUBLE, EX.
SUCH AS THE INWARD ROUTING FOR AN EXCHANGE IN AN AREA CODE.
AN INWARD ROUTING WILL LET YOU CALL HER AND SHE CAN DO AN EMERGENCY



INTERUPT FOR YOU. SHE CAN TELL YOU HOW TO GET INTERNATIONAL OPERATORS,ECT.
HERE ARE THE TERMS YOU ARE REQUIRED TO USE:
INTERNATIONAL,
-OPERATOR ROUTE FOR [COUNTRY, CITY]. *GIVES YOU INWARD OP.
-DIRECTORY ROUTE FOR [COUNTRY, CITY]. *GIVES YOU DIRECTORY ASS.
-CITY ROUTE FOR [COUNTRY, CITY]. *GIVES YOU COUNTRY AND CITY CODE.
OPERATOR ROUTE FOR [A/C]+ [EXCHANGE] *GIVES YOU INWARD OP. ROUTE
EX. [A/C]+ OR [A/C]+0XX+ WHEN SHE SAYS PLUS SHE MEANS PLUS 121.
NUMBERS ROUTE FOR [STATE, CITY] *GIVES YOU A/C.
PLACE NAME [A/C]+[EXCHANGE] *GIVES YOU CITY/STATE FOR THAT A/C AND
EXCHANGE.
INTERNATIONAL CALLS:
--------------------
TO CALL INTERNATIONAL OVER CABLE SIMPLY ACCESS A TRUNK AND DIAL
KP011XXXST WAIT FOR SENDER TONE, KPXXXCC-NUMBERST
XXX - A 3 DIGIT COUNTRY CODE, IT MAY NOT BE 3 DIGITS SO JUST PUT
1 OR 2 0'S IN FRONT OF IT. CC - IS THE CITY CODE
TO GO BY SATELLITE:
DIAL KP18XST    X - NUMBERS 2-8 WAIT FOR SENDER TONE THEN
KPXXXCCNUMBERST

Blue Box                               courtesy of the Jolly Roger

To quote Karl Marx, blue boxing has always been the most noble form of
phreaking. As opposed to such things as using an MCI code to make a free
fone call, which is merely mindless pseudo-phreaking, blue boxing
is actual interaction with the Bell System toll network.
It is likewise advisable to be more cautious when blue boxing, but the
careful phreak will not be caught, regardless of what type of switching
system he is under.
In this part, I will explain how and why blue boxing works, as well as
where. In later parts, I will give more practical information for blue
boxing and routing information. To begin with, blue boxing is simply
communicating with trunks. Trunks must not be confused with subscriber
lines (or "customer loops") which are standard telefone lines. Trunks are
those lines that connect central offices. Now, when trunks are not in
use (i.e., idle or "on-hook" state) they have 2600Hz applied to them. If
they are two-way trunks, there is 2600Hz in both directions. When a trunk
IS in use (busy or "off-hook" state), the 2600Hz is removed from the side
that is off-hook. The 2600Hz is therefore known as a supervisory
signal, because it indicates the status of a trunk; on hook (tone) or
off-hook (no tone). Note also that 2600Hz denoted SF (single frequency)
signalling and is "in-band." This is very important. "In-band" means that
is within the band of frequencies that may be transmitted over normal
telefone lines. Other SF signals, such as 3700Hz are used also. However,
they cannot be carried over the telefone network normally (they are
"out-of-band" and are therefore not able to be taken advantage of as
2600Hz is. Back to trunks. Let's take a hypothetical phone call. You pick
up your fone and dial 1+806-258-1234 (your good friend in Amarillo, Texas).
For ease, we'll assume that you are on #5 Crossbar switching and not in the
806 area. Your central office (CO) would recognize that 806 is a foreign
NPA, so it would route the call to the toll centre that serves you.
[For the sake of accuracy here, and for the more experienced readers,
note that the CO in question is a class 5 with LAMA that uses out-of-band
SF supervisory signalling]. Depending on where you are in the country,
the call would leave your toll centre (on more trunks) to another toll
centre, or office of higher "rank". Then it would be routed to central
office 806-258 eventually and the call would be completed.



ç            Illustration
A---CO1-------TC1------TC2----CO2----B

A.... you
CO1=your central office
TC1.. your toll office.
TC2.. toll office in Amarillo.
CO2.. 806-258 central office.
B.... your friend (806-258-1234)

In this situation it would be realistic to say that CO2 uses SF
in-band (2600Hz) signalling, while all the others use out-of-band signal-
ling (3700Hz). If you don't understand this, don't worry. I am pointing
this out merely for the sake of accuracy. The point is that while you
are connected to 806-258-1234, all those trunks from YOUR central office
(CO1) to the 806-258 central office (CO2) do *NOT* have 2600Hz on them,
indicating to the Bell equipment that a call is in progress and the trunks
are in use.
Now let's say you're tired of talking to your friend in Amarillo, so you
send a 2600Hz down the line. This tone travels down the line to your
friend's central office (CO2) where it is detected. However, that CO thinks
that the 2600Hz is originating from Bell equipment, indicating to it
that you've hung up, and thus the trunks are once again idle (with 2600Hz
present on them). But actually, you have not hung up, you have fooled the
equipment atyour friend's CO into thinking you have. Thus,it disconnects
him and resets the equipment to prepare for the next call. All this happens
very quickly (300-800ms for step-by-step equipment and 150-400ms for other
equipment). When you stop sending 2600Hz (after about a second), the
equipment thinks that another call is coming towards
--> on hook, no tone -->off hook.
Now that you've stopped sending 2600Hz, several things happen:

1) A trunk is seized.
2) A "wink" is sent to the CALLING end from the CALLED end indicating that
the CALLED end (trunk) is not ready to receive digits yet.
3) A register is found and attached to the CALLED end of the trunk within
about two seconds (max).
4) A start-dial signal is sent to the CALLING end from the CALLED end
indicating that the CALLED end is ready to receive digits.
Now, all of this is pretty much transparent to the blue boxer. All he
really hears when these four things happen is a <beep><kerchunk>. So,
seizure of a trunk would go something like this:

1> Send a 2600Hz
2> Terminate 2600Hz after 1-2 secs.
3> [beep][kerchunk]

Once this happens, you are connected to a tandem that is ready to obey your
every command. The next step is to send signalling information in order to
place your call. For this you must simulate the signalling used by
operators and automatic toll-dialing equipment for use on trunks. There are
mainly two systems, DP and MF. However, DP went out with the dinosaurs, so
I'll only discuss MF signalling. MF (multi-frequency) signalling is the
signalling used by the majority of the inter- and intra-lata network. It is
also used in international dialing known as the CCITT no.5 system.
MF signals consist of 7 frequecies, beginning with 700Hz and separated by
200Hz. A different set of two of the 7 frequencies represent the digits 0
thru 9, plus an additional 5 special keys. The frequencies and uses are as



follows:

Frequencies (Hz)  Domestic    Int'l
-------------------------------------
 700+900             1          1
 700+1100            2          2
 900+1100            3          3
 700+1300            4          4
 900+1300            5          5
1100+1300            6          6
 700+1500            7          7
 900+1500            8          8
1100+1500            9          9
1300+1500            0          0
 700+1700           ST3p       Code 1
 900+1700           STp        Code 1
1100+1700           KP         KP1
1300+1700           ST2p       KP2
1500+1700           ST         ST
 The timing of all the MF signals is a nominal 60ms, except for KP, which
should have a duration of 100ms. There should also be a 60ms silent period
between digits. This is very flexible however, and most Bell equipment will
accept outrageous timings. In addition to the standard uses
listed above, MF pulsing also has expanded usages known as "expanded
inband signalling" that include such things as coin collect, coin return,
ringback, operator attached, and operator attached, and operator
released. KP2, code 11, and code 12 and the ST_ps (STart "primes" all have
special uses which will be mentioned only briefly here.
To complete a call using a blue box once seizure of a trunk has been
accomplished by sending 2600Hz and pausing for the <beep><kerchunk>, one
must first send a KP. This readies the register for the digits that follow.
For a standard domestic call, the KP would be followed by either 7 digits
(if the call were in the same NPA as the seized trunk) or 10 digits (if the
call were not in the same NPA as the seized trunk). [Exactly like dialing
normal fone call]. Following either the KP and 7 or 10 digits, a STart is
sent to signify that no more digits follow. Example of a complete call:

1> Dial 1-806-258-1234
2> wait for a call-progress indication (such as ring,busy,recording,etc.)
3> Send 2600Hz for about 1 second.
4> Wait for about ll-progress indication (such as ring,busy,recording,etc.)
5> Send KP+305+994+9966+ST
The call will then connect if everything was done properly. Note that if a
call to an 806 number were being placed in the same situation, the are code
would be omitted and only KP + seven digits + ST would be sent.
Code 11 and code 12 are used in international calling to request
certain types of operators. KP2 is used in international calling to route a
call other than by way of the normal route, whether for economic or
equipment reasons. STp, ST2p, and ST3p (prime, two prime, and three prime)
are used in TSPS signalling to indicate calling type of call (such as
coin-direct dialing.
Napalm (Another way to make it...)              by the Jolly Roger

   (See file #021 of the Cookbook for an easy way to make it!!)

About the best fire bomb is napalm. It has a thick consistancy,
like jam and is best for use on vehilces or buildings.
Napalms is simply one part gasoline and one part soap. The soap is



either soap flakes or shredded bar soap. Detergents won't do.
The gasoline must be heated in order for the soap to melt. The
usual way is with a double boiler where the top part has at least a
two-quart capicity. The water in the bottom part is brought to a boil
and the double boiler is taken from the stove and carried to where
there is no flame.
Then one part, by volume, of gasoline is put in the top part and
allowed to heat as much as it will and the soap is added and the mess
is stirred until it thickens. A better way to heat gasoline is to fill
a bathtub with water as hot as you can get it. It will hold its heat
longer and permit a much larger container than will the double boiler.

                                ---------------Jolly Roger

Nitroglycerin Recipe                            by the Jolly Roger

Like all chemists I must advise you all to take the greatest care
and caution when you are doing this.  Even if you have made this stuff
before.
This first article will give you information on making
nitroglyerin, the basic ingredient in a lot of explosives such as
straight dynamites, and geletin dynamites.
Making nitroglycerin
1. Fill a 75-milliliter beaker to the 13 ml. Level with fuming
   red nitric acid, of 98% pure concentration.
2. Place the beaker in an ice bath and allow to cool below room
   temp.
3. After it has cooled, add to it three times the amount of
   fuming sulferic acid (99% h2so4).  In other words, add to the
   now-cool fuming nitric acid 39 ml. Of fuming sulferic acid.
   When mixing any acids, always do it slowly and carefully to
   avoid splattering.
4. When the two are mixed, lower thier temp. By adding more ice
   to the bath, about 10-15 degrees centigrade. (Use a
   mercury-operated thermometer)
5. When the acid solution has cooled to the desired temperature,
   it is ready for the glycerin. The glycerin must be added in
   small amounts using a medicine dropper.  (Read this step about
   10 times!)  Glycerin is added slowly and carefully (i mean
   careful!) Until the entire surface of the acid it covered with
   it.
6. This is a dangerous point since the nitration will take place
   as soon as the glycerin is added. The nitration will produce
   heat, so the solution must be kept below 30 degrees
   centigrade! If the solution should go above 30 degrees,
   immediately dump the solution into the ice bath!  This will
   insure that it does not go off in your face!
7. For the first ten minutes of nitration, the mixture should be
   gently stirred.  In a normal reaction the nitroglycerin will
   form as a layer on top of the acid solution, while the sulferic
   acid will absorb the excess water.
8. After the nitration has taken place, and the nitroglycerin has
   formed on the top of the solution, the entire beaker should be
   transferred slowly and carefully to another beaker of water.
   When this is done the nitroglycerin will settle at the bottem
   so the other acids can be drained away.
9. After removing as much acid as posible without disturbing the
   nitroglycerin, remove the nitroglycerin with an eyedropper and



   place it in a bicarbonate of soda (sodium bicarbonate in case
   you didn't know) solution.  The sodium is an alkalai and will
   nuetralize much of the acid remaining. This process should be
   repeated as much as necesarry using blue litmus paper to check
   for the presence of acid.  The remaining acid only makes the
   nitroglycerin more unstable than it already is.
10. Finally! The final step is to remove the nitroglycerin from
    the bicarbonate.  His is done with and eye- dropper, slowly
    and carefully.  The usual test to see if nitration has been
    successful is to place one drop of the nitroglycerin on metal
    and ignite it.  If it is true nitroglycerin it will burn with
    a clear blue flame.
** Caution **
Nitro is very sensative to decomposition, heating dropping, or
jarring, and may explode if left undisturbed and cool.
                              -------------Jolly Roger

Operation: Fuckup                                 by the Jolly Roger

This is a guide for Anarchists and can be funny for non-believers and 12
and 13 year old runts, and can be a lexicon of deadly knowledge for True
Anarchists... Serious damage is intended to be dealt here. Do not try
this stuff unless you want to do a lot of serious Anarchy.
[Simulation]
Asshole - 'Listen, you little teenager punk shit, shut the fuck up, or I'll
knock you down!'
Anarchist - 'O.K.....You can't say I didn't warn you. You don't know my
rue power...' (soooo casually)
Asshole - 'Well, er, what do you mean? Anarchist - '<demoniac grin>'
As you can see, the Anarchist knows something that this asshole doesn't...

[Operation Fuckup]
Geta wheel barrel or two. Fill with gasoline. Get 16 rolls of toilet
paper, unroll & drench in the gasoline. Rip to shreds in gasoline. Get
asbestos gloves. Light a flare (to be punk), grab glob of
saturated toilet paper (you can ignite the glob or not). Throw either
flaming or dripping glob into:
any window (picture is the best)
front doors
rough grain siding
and best of all, brick walls.
First of all, this bitch is near impossible to get off once dried, and
is a terror to people inside when lit! After this... during the
night, get a pickup truck, a few wheel-barrels, and a dozen friends with
shovels. The pickup can be used only for transporting people
and equipment, or doing that, and carting all the dirt. When it gets
around 12:00 (after the loser goes beddie - bye), dig a gargantuan hole
in his front yard until about 3:00. You can either assign three or four
of your friends to cart the dirt ten miles away in the pickup-bed, or
bury his front door in 15' of dirt! After that is done, get
three or four buckets of tar, and coat his windows. You can make an
added twist by igniting the tar when you are all done and ready to
run! That is if the loser has a house. If he lives inside an apartment
building, you must direct the attack more toward his car, and front door.
I usually start out when he goes to work...I find out what his cheap car
looks like, and memorize it for future abuse...It is always fun to paint
his front door (apt.) hot pink with purple polka-dots, and off-neon
colors in diagonal stripes. You can also pound a few hundred or so four



inch nails into his front door (this looks like somebody really
doesn't like you from the inside). Another great is to fill his keyhole
with liquid steel so that after the bastard closes his door - the
only way to get back in is to break it down. If you can spare it, leave
him an axe - that is, implanted three inches into, and through the door!
Now, this next one is difficult, but one of the best! Get a piece of wood
siding that will more than cover his front door completely. Nail two by
fours on the edges of the siding (all except the bottom) so you have
a barge - like contraption. Make a hole at the top that will be large
enough for a cement slide. Mix about six or seven LARGE bags of QUICK
drying cement. Use the cement slide to fill the antichamber created by
the 'barge' that is around his door. Use more two by fours to brace
your little cement-filled barge, and let the little gem dry. When it is,
remove the 'barge' so only a stone monolith remains that covers his door.
Use any remaining cement to make a base around this so he can't just push
it over. When I did this, he called the fire department, and they thought
he meant wood, so they brought axes. I watched with a few dozen or so
other tenants, and laughed my damn ass off! This is only his door! After
he parks his car for the night, the fun really begins...I start out
by opening up the car by jamming a very thin, but loack - inside and out!
Then proceed to put orange-juice syrup all over the seats, so after he
gets through all the other shit that you do, he will have the stickiest
seats in the world. You can then get a few Sunday papers, and crack one of
the windows about four inches. Lightly crumple the papers, and continue to
completely fill the inside of his car with the newspapers. A copy of the
Sunday New York Times will nicely fill a Volkeswagon! What is also quite
amusing is to put his car on cinder blocks, slash his tires at the top, and
fill them with cement! Leave the cinder blocks there so that, after he
knocks the car off of them, he will get about 3 miles to the gallon with
those tires, and do 0 to 60 in about two minutes! It is even more
hilarious when he doesn't know why the hell why! Another is to open his
hood, and then run a few wires from the sparkplugs to the METAL body.
The sure is one HOT car when it is running! Now, I like to pour two pounds
of sugar down his gas tank. If this doesn't blow every gasket in his
engine it will do something called 'carmelizing his engine'. This is when
the extreme heat turns the sugar to carmel, and you literally must
completely take the engine out and apart, and clean each and every
individual part!
Well, if this asshole does not get the message, you had better start to
get serious. If this guide was used properly & as it was intended (no,
not as kindling for the fire), this asshole will either move far away,
seek professional psychological help, commit suicide,
or all of the above!

                               --------------Jolly Roger


*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*
*            How to "steal" local calls from most Payphones         *
*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*-+-*
                           by the Jolly Roger

Now to make free local calls, you need a finishing nail.  I highly
recommend "6D E.G. FINISH C/H, 2 INCH" nails.  These are about 3/32 of
an inch in diameter and 2 inches long (of course).  You also need a large
size paper clip. By large  I  mean they  are  about  2  inches  long
(FOLDED). Then  you  unfold the paper clip.  Unfold it by taking each piece
and moving it out 90 degrees.  When it is done it should look somewhat



like this:

                               /----------\
                               :          :
                               :          :
                               :          :
                               :          :
                                          \-----

Now,  on to the neat stuff.  What you do,  instead of unscrewing the
glued-on  mouthpiece,  is  insert the nail into the center  hole  of
the mouthpiece  (where you talk) and push it in with
pressure or just hammer it in by hitting the nail on something.
Just DON'T KILL THE  MOUTHPIECE! You  could  damage  it
if you insert the nail too far or  at  some  weird angle.  If  this
happens then the other party won't be able to hear  what you say.
You now have a hole in the mouthpiece in which you can easily insert the
paper clip. So, take out the nail and put in the paper  clip.
Then take the other end of the paper clip and shove it under the rubber
cord protector at the bottom of the handset (you know, the blue guy...).
This should end up looking remotely like...like this:
                            /----------\      Mouthpiece
                            :          :
            Paper clip -->  :          :     /
                            :      /---:---\
                            :      :   :
                            :------------>
        ====================\---))):
                                   :  To earpiece ->
                                   ^              ^
                                   \-------------------->
                                   :              :
                                   :              :
                                 Cord          Blue guy
(The  paper clip is shoved under the blue guy to make a  good  connection
between the inside of the mouthpiece and the metal cord.)
Now,  dial  the number of a local number you wish to  call,  sayyyy,
MCI.  If  everything  goes okay, it should ring and not answer with the
"The Call You Have Made Requires a 20 Cent Deposit" recording.  After the
other  end  answers  the phone, remove the  paper  clip.  It's  all  that
simple, see?
There  are  a couple problems,  however.  One  is,  as  I mentioned
earlier, the mouthpiece not working after you punch it.  If this
happens to you,  simply move on to the next payphone.  The one you are
now on  is lost.  Another problem is that the touch tones won't work
when the paper clip is in the mouthpiece. There are two ways around this..
A> Dial the first 6 numbers.  This should be done without the  paper
clip making the connection, i.e., one side should not be connected.
Then connect  the paper clip,  hold down the last digit,  and slowly
pull  the paper clip out at the mouthpiece's end.
B> Don't  use  the paper clip at all.  Keep the nail  in  after  you punch
it.  Dial the first 6 digits.  Before dialing the last digit, touch
the nail head to the plate on the main body of the phone,  the money
safe thingy..then press the last number. The  reason  that this method
is sometimes called  clear  boxing  is because  there is
another type of phone which lets you actually make  the call  and  listen
to  them say "Hello,  hello?"  but  it  cuts  off  the mouthpiece  so they
can't hear you.  The Clear Box is used  on  that  to amplify your voice
       α.ê,9  
signals and send it through the earpiece. If you  see how  this  is
even slightly similar to the method I have just described up there,
kindly explain it to ME!! Cause I don't GET IT!  Anyways,  this DOES
work on almost all single slot,  Dial Tone First payphones (Pacific Bell
for sure).  I do it all the time.  This  is  the least,  I STRESS
*LEAST*, risky form of Phreaking.

                        ---------------Jolly Roger

Pool Fun                                        by the Jolly Roger

First of all, you need know nothing about pools.  The only thing
you need know is what a pool filter looks like.  If you don't know that.
Second, dress casual.  Preferably, in black.  Visit your
"friends" house, the one whose pool looks like fun!!)  Then you
reverse the polarity of his/her pool, by switching the wires around.
They are located in the back of the pump. This will have quite an
effect when the pump goes on.  In other words. Boooooooooooommm!
Thats right, when you mix + wires with - plugs, and vice- versa, the
4th of july happens again.
Not into total destruction??? When the pump is off, switch the
pump to "backwash".  Turn the pump on and get the phuck out!  When you
look the next day, phunny.  The pool is dry.  If you want permanant
damage, yet no great display like my first one mentioned, shut the
valves of the pool off. (There are usually 2)  One that goes to the
main drain and one that goes to the filter in the pool.  That should
be enough to have one dead pump.  The pump must take in water, so when
there isn't any...
Practical jokes:  these next ones deal with true friends and
there is *no* permanent damage done.  If you have a pool, you must
check the pool with chemicals.  There is one labeled orthotolidine.
The other is labeled alkaline (ph).  You want orthotolidine. (It
checks the chlorine).
Go to your local pool store and tell them you're going into the pool
business, and to sell you orthotolidine (a
CL detector)   Buy this in great quantities if possible.  The solution
is clear.  You fill 2 baggies with this chemical.  And sew the bags to
the inside of your suit.  Next, go swimming with your friend!
Then open the bags and look like you're enjoying a piss.  And anyone
there will turn a deep red!  They will be embarrased so much,
Especially if they have guests there! Explain what it is, then add
vinegar to the pool.  Only a little.  The "piss" disappears.

HAHA!!          --------------------Jolly Roger


Free Postage                                    by the Jolly Roger

The increasing cost of postage to mail letters and packages is
bringing down our standard of living.  To remedy this deplorable
situation, some counter control measures can be applied.
For example, if the stamps on a letter are coated with Elmer's
Glue by the sender, the cancellation mark will not destroy the stamp:
the Elmer/s drives to form an almost invisible coating that protects
the stamps from the cancellation ink. Later, the receiver of the
letter can remove the cancellation mark with water and reuse the
stamps. Furthermore, ecological saving will also result from recycling
the stamps.  Help save a tree.



The glue is most efficently applied with a brush with stiff,
short bristles.  Just dip the brush directly into the glue and spread
it on evenly, covering the entire surface of the stamp.  It will dry
in about 15 minutes.
For mailing packages, just follow the same procedure as outlined
above; however, the package should be weighed and checked to make sure
that it has the correct amount of postage on it before it is taken to
the Post Office.
Removing the cancellation and the glue from the stamps can be
easily accomplished by soaking the stamps in warm water until they
float free from the paper.  The stamps can then be put onto a paper
towel to dry.  Processing stamps in large batches saves time too.
Also, it may be helpful to write the word 'Elmer' at the top of the
letter (not on the envelope) to cue the receiving party in that the
stamps have been protected with the glue.
We all know that mailing packages can be expensive.  And we also
know that the handicapped are sometimes discriminated against in jobs.
The Government, being the generous people they are, have given the
blind free postal service.
Simply address you envelope as usual, and make one modification.
In the corner where the stamp would go, write in (or stamp) the words
'FREE MATTER FOR THE BLIND".  Then drop you package or letter in one
of the blue fedral mailboxes.  DO NOT TAKE THE LETTER TO THE POST
OFFICE, OR LEAVE IT IN YOUR MAILBOX.
Sounds very nice of the government to do this, right?  Well, they
aren't that nice.  The parcel is sent library rate, that is below
third class.  It may take four to five days to send a letter to just
the next town.
This too is quite simple, but less effective.  Put the address
that you are sending the letter to as the return address.  If you were
sending a $20 donation to the pirate's Chest, you would put our
address (po box 644, lincoln ma. 01773) as the return address.
Then you would have to be carless and forget to put the stamp on
the envelope.  A nice touch is to put a bullshit address in the center
of the envelope.
Again, you MUST drop the letter in a FEDRAL mailbox.  If the post
office doesn't send the letter to the return address for having no
stamp, they will send it back for the reason of "No such address".
Example--

Pirates Chest  Dept. 40DD
P.O. Box 644865
Lincol, Ma. 41773

                 Tom Bullshit
                 20 Fake Road
                 What Ever, XX     99851

One last thing you might try doing is soaking a cancelled stamp
off of an envelope, and gluing it onto one you are sending.  Then burn
the stamp, leaveing a little bit to show that there was one there.

                                     --------------Jolly Roger

Unstable Explosives                             by the Jolly Roger

Mix solid Nitric Iodine with househould ammonia. Wait overnight and
then pour off the liquid. You will be left with a muddy substance. Let



this dry till it hardens.  Now throw it at something!!!!

                                ----------------Jolly Roger

Weird Drugs                                     by the Jolly Roger

Bananas:
1. Obtain 15 pounds of ripe yellow bananas
2. Peel all and eat the fruit. Save the peelings
3. Scrape all the insides of the peels with a sharp knife.
4. Put all the scraped material in a large pot and add water.
5. Boil 3 or 4 hours until it has attained a solid paste considtency.
6. Spread paste onto cookie sheets and dry in ofen for about 20
   minutes. This will result in fine black powder. Usually one will
   feel the effects after smoking three to four cigarettes.

Cough syrup:
mix robitussion a-c with an equal amount of ginger ale and drink. The
effect are sedation and euphoria. Never underestimate the effects of
any drug! You can od on cough syrup!

Toads:
1. Collect five to ten toads, frogs will not work. The best kind are
   tree toads.
2. Kill them as painlessly as possible, and skin immediately.
3. Allow the skins to dry in a refrigerator four four to five days, or
   until the skins are brittle.
4. Now crush the skins into powder and smoke. Due to its bad taste you
   can mix it with a more fragrent smoking medium.

Nutmeg:
1. Take several whole nutmegs and grind them up in an old grinder.
2. After the nutmegs are ground. Place in a mortar and pulverize with
   a pestle.
3. The usual dosage is about 10 or 15 grams. A larger dose may
   produce excessive thirst,anxiety,and rapid hart beat, but
   hallucinations are rare.

Peanuts:
1. Take 1 pound of raw peanuts (not roasted)
2. Shell them, saving the skins and discarding the shells.
3. Eat the nuts.
4. Grind up the skins and smoke them.

                                    ------------------Jolly Roger

The Art of Carding                              by the Jolly Roger

Obtaining a credit card number: There are many ways to obtain the
information needed to card something.
The most important things needed are the card number and the expiration
date.  Having the card-holders name doesn't hurt, but it is not essential.
The absolute best way to obtain all the information needed is by trashing.
The way this is done is simple.  You walk around your area or any other
area and find a store, mall, supermarket, etc., that throws their
garbage outside on the sidewalk or dumpster.  Rip the bag open and see
if you can find any carbons at all.  If you find little shreds of
credit card carbons, then it is most likely not worth your time to tape



together.  Find a store that does not rip their carbons at all or only in
half.
Another way is to bullshit the number out of someone.  That is call them
up and say "Hello, this is Visa security and we have a report that
your card was stolen." They will deny it and you will try to get it out
of them from that point on.  You could say, "It wasn't stolen?  Well what
is the expiration date and maybe we can fix the problem....
Ok and what is the number on your card?......Thank you very much and
have a nice day."  Or think of something to that degree.
Another way to get card numbers is through systems such as TRW and CBI,
this is the hard way, and probably not worth the trouble, unless you are
an expert on the system.  Using credit card numbers posted on BBS's is
risky.  The only advantage is that there is a good chance that other
people will use it, thus decreasing the chances of being the
sole-offender.  The last method of getting numbers is very good also.
In most video rental stores, they take down your credit card number
when you join to back-up your rentals.  So if you could manage to steal
the list or make a copy of it, then you are set for a LONG time.
Choosing a victim: Once you have the card number, it is time to make the
order.  The type of places that are easiest to victimize are small
businesses that do mail order or even local stores that deliver.
If you have an ad for a place with something you want and the order number
is NOT a 1-800 number then chances are better that you will succeed.
Ordering: When you call the place up to make the order, you must have
several things readily at hand.
These are the things you will need: A name, telephone number, business
phone, card number (4 digit bank code if the card is MasterCard),
expiration date, and a complete shipping and billing address.
I will talk about all of these in detail.  A personal tip: When I call
to make an order, it usually goes much smoother if the person you are
talking to is a woman.  In many cases they are more gullible than men.
The name:  You could use the name on the card or the name of the person
who you are going to send the merchandise to.  Or you could use the name
on the card and have it shipped to the person who lives at the drop
(Say it is a gift or something).
The name is really not that important because when the company verifies
the card, the persons name is never mentioned, EXCEPT when you have a
Preffered Visa card.  Then the name is mentioned.  You can tell if you
have a Preffered Visa card by the PV to the right of the expiration
date on the carbon. Nophone all day long waiting for the company to call
(Which they will), then the phone number to give them as your home-phone
could be one of the following: A number that is ALWAYS busy, a number
that ALWAYS rings, a payphone number, low end of a loop (and you will wait
on the other end), or a popular BBS.
NEVER give them your home phone because they will find out as soon as
the investigation starts who the phone belongs to.  The best thing would
be to have a payphone call forward your house
(via Cosm The business number:  When asked for, repeat the number you
used for your home phone.
Card number: The cards you will use will be Visa, Mastercard, and
American Express.  The best is by far Visa.  It is the most
straight-forward.  Mastercard is pretty cool except for the bank code.
When they ask for the bank code, they sometimes also ask for the bank
that issued it.  When they ask that just say the biggest bank you know of
in your area.  Try to avoid American Express.  They tend to lead full
scale investigations.  Unfortunately, American Express is the most popular
card out.   When telling the person who is taking your call the card
number, say it slow, clear, and with confidence.



e.g. CC# is 5217-1234-5678-9012.  Pause after each set of four so you
don't have to repeat it.
Expiration date: The date must be at LEAST in that month.  It is best
to with more than three months to go.
The address: More commonly referred to as the 'drop'.  Well the drop
can range from an abandoned building to your next door neighbors
apartment.  If you plan to send it to an apartment building then be
sure NOT to include an apartment number.  This will confuse UPS or postage
men a little and they will leave the package in the lobby.
Here is a list of various drops: The house next door whose family is on
vacation, the apartment that was just moved out of, the old church that
will be knocked down in six months, your friends house who has absolutely
nothing to do with the type of merchandise you will buy and who will
also not crack under heat from feds, etc..
There are also services that hold merchandise for you, but personally
I would not trust them.  And forget about P.O. Boxes because you need
ID to get one and most places don't ship to them anyway.
Other aspects of carding:Verifying cards, seeing if they were reported
stolen.
Verifying cards: Stores need to verify credit cards when someone purchases
something with one.  They call up a service that checks to see if the
customer has the money in the bank.
The merchant identifies himself with a merchant number.  The service
then holds the money that the merchant verified on reserve.  When the
merchant sends in the credit card form, the service sends the merchant
the money.  The service holds the money for three days and if no form
appears then it is put back into the bank.  The point is that if you
want to verify something then you should verify it for a little amount
and odds are that there will be more in the bank.
The good thing about verification is that if the card doesn't exist or
if it is stolen then the service will tell you.  To verify MasterCard
and Visa try this number.  It is voice:1-800-327-1111 merchant code is
596719.
Stolen cards: Mastercard and Visa come out with a small catalog every
week where they publish EVERY stolen or fraudulantly used card.
I get this every week by trashing the same place on the same day.
If you ever find it trashing then try to get it every week.
Identifying cards: Visa card numbers begin with a 4 and have either 13
or 16 digits.  MasterCard card numbers begin with a 5 and have 16 digits.
American Express begins with a 3 and has 15 digits.  They all have the
formats of the following:
3xxx-xxxxxx-xxxxx   American Express
4xxx-xxx-xxx-xxx    Visa
4xxx-xxxx-xxxx-xxxx Visa
5xxx-xxxx-xxxx-xxxx MasterCard
Gold cards: A gold card simply means that credit is good for $5000.
Without a gold card, credit would be normally $2000.
To recognize a gold card on a carbon there are several techniques:
American Express-none.
Visa-PV instead of CV.
Note-When verifying a PV Visa, you have to have the real name of the
cardholder.
Mastercard-An asterix can signify a gold card, but this changes depending
when the card was issued.
I am going to type out a dialog between a carder and the phone operator
to help you get the idea.
Operator: "Over-priced Computer Goods, may I help you?"
Carder:   "Hi, I would like to place an order please."



Operator: "Sure, what would you like to order?"
Carder:   "400 generic disks and a double density drive."
Operator: "Ok, is there anything else?"
Carder:   "No thank you, that's all for today."
Operator: "Ok, how would you like to pay for this?  MasterCard or Visa?"
Carder:   "Visa."
Operator: "And your name is?"
Carder:   "Lenny Lipshitz." (Name on card)
Operator: "And your Visa card number is?"
Carder:   "4240-419-001-340" (Invalid card)
Operator: "Expiration date?"
Carder:   "06-92."
Operator: "And where would you like the package shipped to?"
Carder:   "6732 Goatsgate Port.  Paris,texas,010166."
Operator: "And what is your home telephone number?"
Carder:   "212-724-9970" (This number is actually always busy)
Operator: "I will also need your business phone number in case we have
to reach you."
Carder:   "You can reach me at the same number. 212-724-9970"
Operator: "O.K. Thank you very much and have nice day."
Carder:   "Excuse me, when will the package arrive?"
Operator: "In six to seven days UPS."
Carder:   "Thanks alot, and have a pleasant day."
Now you wait 6-7 days when the package will arrive to the address which
is really a house up for sale.  There will be a note on the door
saying, "Hello UPS, please leave all packages for Lenny Lipshitz in the
lobby or porch.  Thanks alot, Lenny Lipshitz" (Make the signature half-way
convincing)

                                  ------------------Jolly Roger

Recognizing credit cards                        by the Jolly Roger

  [Sample: American Express]
      XXXX XXXXXX XXXXX
      MM/Y1 THRU MM/Y2       Y1
      John Doe               AX

Explanation:
The first date is the date the person got the card, the second
date is the expriation date, after the expiration date is the same
digits in the first year.The American Express Gold has many more
numbers (I think 6 8 then 8). If you do find a Gold card keep it
for it has a $5000.00 backup even when the guy has no money!

[Sample: Master Card]
   5XXX XXXX XXXX XXXX
   XXXX AAA DD-MM-YY MM/YY
   John Doe.

Explanation:
The format varies, I have never seen a card that did not start with
a 5XXX there is another 4 digits on the next line that is sometimes
asked for when ordering stuff, (and rarely a 3 digit letter combo
(e. ANB). The first date is the date the person got the card
and the second date is the expiration date.
Master Card is almost always accepted at stores.
[Sample: VISA]



   XXXX XXX(X) XXX(X) XXX(X)
   MM/YY    MM/YY*VISA
   John Doe

Explanation:
Visa is the most straight forward
of the cards,for it has the name right on the card itself, again the
first date is the date he got the card and the second is the
expiration date. (Sometimes the first date is left out). The
numbers can eather be 4 3 3 3 or 4 4 4 4. Visa is also almost always
accepted at stores, therefore, the best of cards to use.
How To Create A New Indentity                    By The Walking Glitch
                     Courtesy of the Jolly Roger!

You might be saying, "Hey Glitch, what do I need a new identity for?"
The answer is simple. You might want to go buy liquor somewhere, right?
You might want to go give the cops the false name when you get busted
so you keep your good name, eh?  You might even want to use the new
identity for getting a P.O. Box for carding. Sure! You might even
want the stuff for renting yourself a VCR at some dickless loser of a
convenience store. Here we go:
Getting a new ID isn't always easy, no one said it would be. By following
these steps, any bozo can become a new bozo in a coupla weeks.

STEP 1

The first step is to find out who exactly you'll become. The
most secure way is to use someone's ID who doesn't use it themselves.
The people who fit that bill the best are dead. As an added bonus they
don't go complaining one bit. Go to the library and look
through old death notices. You have to find someone who was born about
the same time as you were, or better yet, a year or two older
so you can buy booze, etc. You should go back as far as you can for the
death because most states now cross index deaths to births so people
can't do this in the future. The cutoff date in Wisconsin is 1979, folks
in this grand state gotta look in 1978 or earlier. Anything earier there
is cool. Now, this is the hardest part if you're younger. Brats that
young happen to be quite resilient, takin' falls out of three story windows
and eating rat poison like its Easter candy, and not a scratch or
dent. There ain't many that die, so ya gotta look your ass off. Go
down to the library and look up all the death notices you can,
if it's on microfilm so much the better. You might have to go through
months of death notices though, but the results are well worth it.
You gotta get someone who died locally in most instances: the death
certificate is filed only in the county of death. Now you go down to
the county courthouse in the county where he died and get the
death certificate, this will cost you around $3-$5 depending on the state
you're in. Look at this hunk of paper, it could be your way to
vanish in a clould of smoke when the right time comes, like right after
that big scam. If You're lucky, the slobs parents signed him up with
social security when he was a snot nosed brat. That'll be another piece
of ID you can get. If not, thats ok too. It'll be listed on the death
certificate if he has one. If you're lucky, the stiff was born
locally and you can get his birth certificate right away.

STEP 2

Now check the place of birth on the death certificate, if it's in



the same place you standing now you're all set. If not, you can mail
away for one from that county but its a minor pain and it might
take a while to get, the librarian at the desk has listings of where
to write for this stuff and exactly how much it costs. Get the Birth
cirtificate, its worth the extra money to get it certified
because thats the only way some people will accept it for ID. When yur
gettin this stuff the little forms ask for the reason you want it,
instead of writing in "Fuck you", try putting in the word "Geneology".
They get this all the time.  If the Death certificate looks good for
you, wait a day or so before getting the certified birth certificate
in case they recognize someone wanting it for a dead guy.

STEP 3

Now your cookin! You got your start and the next part's easy.
Crank out your old Dot matrix printer and run off some mailing labels
addressed to you at some phony address. Take the time to check your
phony address that there is such a place. Hotels that rent by the month
or large apartment buildings are good, be sure to get the right zip
code for the area. These are things that the cops might notice that
will trip you up.  Grab some old junk mail and paste your new lables
on them. Now take them along with the birth certificate down to the
library.
Get a new library card. If they ask you if you had one before say that
you really aren't sure because your family moved around alot when
you were a kid. Most libraries will allow you to use letters as a form
of ID when you get your card. If they want more give them a sob story
about how you were mugged and got your wallet stolen with all your
identification. Your card should be waiting for you in about two weeks.
Most libraries ask for two forms of ID, one can be your trusty Birth
Certificate, and they do allow letters addressed to you as a second
form.

STEP 4

Now you got a start, it isn't perfect yet, so let's continue. You should
have two forms of ID now. Throw away the old letters, or better yet
stuff them inside the wallet you intend to use with this stuff.
Go to the county courthouse and show them what nice ID you got and get
a state ID card. Now you got a picture ID. This will take about two weeks
and cost about $5, its well worth it.

STEP 5

If the death certificate had a social security number on it you can go
out and buy one of those metal SS# cards that they sell.
If it didn't, then you got all kinds of pretty ID that shows exactly
who you are. If you don't yet have an SS#, Go down and apply for one,
these are free but they could take five or six weeks to get,
Bureaucrats you know... You can invent a SS# too if ya like, but the motto
of 'THE WALKING GLITCH' has always been "Why not excellence?".

STEP 6

If you want to go whole hog you can now get a bank account in your new
name.  If you plan to do alot of traveling then you can put alot
of money in the account and then say you lost the account book.  After
you get the new book you take out all the cash. They'll hit you



with a slight charge and maybe tie-up your money some, but if you're
ever broke in some small town that bank book will keep you from being
thrown in jail as a vagrant.

ALL DONE?

So kiddies, you got ID for buying booze, but what else? In some towns
(the larger the more likely) the cops if they catch you for something
petty like shoplifting stuff under a certain dollar amount, will just
give you a ticket, same thing for pissing in the street. Thats it!
No fingerprints or nothing, just pay the fine (almost always over $100)
or appear in court.  Of course they run a radio check on your ID, you'll
be clean and your alter-ego gets a blot on his record.
Your free and clear.  Thats worth the price of the trouble you've gone
through right there.  If your smart, you'll toss that ID away if this
happens, or better yet, tear off your picture and give the ID to someone
you don't like, maybe they'll get busted with it.
If you're a working stiff, here's a way to stretch your dollar. Go to work
for as long as it takes to get unemployment and then get yourself fired.
Go to work under the other name while your getting the unemployment.
With a couple of sets of ID, you can live like a king.  These concepts
for survival in the new age come to you compliments of THE WALKING GLITCH.
First release of this phile 7/7/88.

                      brought to you in the Cookbook courtesy of...
                                       ---------------The Jolly Roger


##########################################################################
#                                                                        #
#                           The Remote Informer                          #
#                                                                        #
#------------------------------------------------------------------------#
#                                                                        #
#              Editors: Tracker, Norman Bates, and Ye Cap'n              #
#                                                                        #
#========================================================================#
# September 26, 1987                                           Issue: 02 #
#========================================================================#
##########################################################################
#                                                                        #
#   Brought to you by the 'new' TUFF:  The Underground Fone Federation   #
#                                                                        #
##########################################################################
==========================================================================
                                 The News
==========================================================================
     Sprint Strikes Back      |    Celestial Elite/TUFF Come to an End
==============================|===========================================
   Sprint caught a guy dealing|   Celestial  Elite  and  TUFF, the  famous
codes  on  the  street  in  LA|hack/phreak groups came to an end  a couple
this  past  week.  Information|weeks ago.  TUFF, however, is being  reborn
on  this  bust  is limited  at|and you can  expect it to  be back  to full
this time.                    |force within a month.  Sources have it that
   A seventeen  year  old  was|Magnus Adept, head  of the  now  terminated
busted  in Arizona  last week.|group, Celestial  Elite, has  started a new
The name of the  teenager will|group called Avalon Kingdom.  We are unsure
not be printed to  protect him|what plans are in store for it.



from harassment calls.        |   TUFF has  several ideas  and  plans that
                              |will be out to the  public soon.  Look  for
>This information was supplied|future  issues  of The Remote Informer (tm)
     by Phreaky Phone II      |for new updates.

==========================================================================
        Beige Box Bust        |   TeleNet Hacker   |  Bate's Motel Moves
==============================|====================|======================
   One  of our  editors and  a|   Crusader released|   Bate's  Motel  BBS,
member of  TUFF, Norman  Bates|his  TeleNet hacking|run  by  Norman Bates,
was  caught  for  Beige boxing|program on September|was forced to move. It
that he had done over 3 months|20, 1987.  Look  for|is temporarily  set up
ago.  The  calls  he had  made|it on a  good  board|at  [phone].  It
were inside his state and cost|you  call.  A review|will remain 1200 baud,
a total  of $12.  He  paid the|will be in the  next|and a  member  of  the
bill and no charges were filed|issue of The Remote |TUFF  Network.  It  is
against him.                  |Informer.           |open to the public.
==========================================================================
   Phreaky Phones Return: Amazing?   | LDDS Buys Out TMC: Companies Merge
=====================================|====================================
   The original Phreaky Phone numbers|   LDDS bought  out TMC last  month.
now support  the new  Phreaky Phones.|They merged into  LDDS, since it was
The guys running  them  had protested|bigger  and   more  widespread.  Any
that the  lines were being monitored.|companies that  were  subscribing to
There is no way that could have been,|the  TMC  long distance service were
and  they contradicted  themselves by|automatically coverted to LDDS.  All
restarting Phreaky Phones on the same|local TMC ports still work, but will
numbers.  They  gave  alot of  credit|soon be disconnected.  Refer  to the
to the people calling to suggest they|article  on  LDDS  in this issue for
believe a story like that.           |more  information on LDDS  dial-ups.
==========================================================================
   US Sprint Calls Destinations  |  Pirate's Hollow Is Back With 10 Megs
==========================================================================
   US Sprint  now  calls  all the|   Pirate's Hollow is  back on-line.  It
numbers called  with unauthorized|now is run a  10 meg hard drive.  Unlike
codes.   Their  dis-advantage  is|most boards that have #'s  of megs, this
that  they are  delayed by  about|one will stress more  attention  on it's
two  months  in  calling  because|database.  The  database is scheduled to
they  have to  wait  till  people|be online by October 1st. This database
report they did not make calls to|will  contain 800+ text files on various
the numbers they were billed for.|topics, with  about 60% - 70% pertaining
Best advice is  to not call voice|to  illegal  activities.  Unfortunately,
with Sprint  except to  those who|Trax Xe is being redesigned, so until it
have   private  lines  other than|is finished, it will run on Carina.  The
their regular phone line.        |number is [phone] (300/1200 baud).
==========================================================================
                           Raggers and Braggers
==========================================================================
   This section is to make  you aware  of well-known raggers and braggers.
Since this is  the first time this  section is being printed, we will tell
you what classifies people as raggers and braggers.  In  the future issues
the top raggers and braggers will be  listed in this newsletter to let the
SysOps  know who not to let on their board, or to  atleast keep an eye on.
   A ragger is someone who will put someone else  down for something.  The
person might post a message  asking a novice  question  about hacking  and
phreaking, or may  say  something  that is completely wrong, and a  ragger
will  put the  other person  down for he said, posted, etc.  The ones that
usually classify in this category are the ones that think they know it all



and consider themselves right  no matter  what anyone  says.  Most  of the
users that  use codes and  consider  themselves a  master phreaker usually
become raggers.
   A bragger is someone who either does or thinks he does know everything,
and puts it upon himself to tell  the  whole  world that he  knows it all.
This  person is also  one who thinks he is better  than  everyone else and
he believes he is Elite, and no one else is.  People  who tend to  do this
are those who have, for some reason, become well-known in the  underworld,
and as  a result become a bragger.  Those  usually not too well-known will
not tend  to brag as  much as  those who think  everyone would  love to be
their friend and be like them.
   As a well-known ragger and  bragger, The Toad, learned that it does not
help to be one or both of those.  He  has since  changed and is now easily
accepted by  most.  Most people  disliked him because others they knew had
said something bad about him.  This  is called peer pressure and  is a bad
influence to those who  are new to the underworld.  I would suggest in the
future,  to not judge someone by what others  say, but rather by  how they
act around/to you.
   The current  most  popular Atarian  that  classifies as a  ragger and a
bragger is Ace of Aces, and  is well-hated by many users and SysOps, since
he tends to put  down anything anyone  says and considers himself the best
at writing hacking programs.  He is commonly  referred to as  Ass of Asses
and Ass of Assholes.  Even holding an open  mind about this guy, you would
soon come to find that what others said  coincides  with what you see from
him.
==========================================================================
                          A New 950 has arrived!
==========================================================================
   LDDS, who as  mentioned above bought out TMC, is  installing  a new 950
port to most major  cities.  By the time  you read  this, it should  be in
almost every area that supports 950 ports.  The number is  950-1450.  This
port will dial 976 numbers, but not 700, 800, or 900 numbers.  The dialing
method  for LDDS is:  7 digit code, then  even if the code is  bad it will
give you a dial tone.  Then  dial the area  code  plus the number.  If you
have a bad code it will simply say your call cannot be completed as it was
dialed.  There is a default code used on the system that  currently works.
The code is simply, 1234567.  I have seen codes from 5 different companies
and they all are in the format of 00xxxxx.  I do  not  know  what  type of
software they use, but I  will  know by  the next  issue exactly what they
place  on  the bills.  This  could  be  the  answer  to  alot  of people's
problems with fear of Sprint and ITT, especially  AllNets.  Just remember,
Tracker  is the one  who  found  this, and all  information  about it.  If
someone  is seen saying  they found  this, then they will be listed in the
next issue which will contain an article on leeches.
==========================================================================
                             Mailbox Systems
==========================================================================
   Mailbox systems are the link between information and the underworld. If
you have ever called one, then you will know the advantages of having one,
especially the ones that are  open to whole underworld, rather than just a
select few.  There are two types  of mailbox systems that are widely used.
   The first  type we will  talk about is the multiple mailbox systems, or
commonly referred to  as  message  systems.  These  systems  have several
mailboxes set up on one number.  Usually, you  can access other  mailboxes
from that  number  by  pressing '*' or '#'.  Sometimes you  just enter the
mailbox number and you are connected.  These are the safest systems to use
to protect information from US Sprint and other  long distance  companies.
Since US Sprint and other companies  call  the destination  numbers, it is



safer to  have 800 mailbox systems, and  most  of  the time, the  multiple
mailbox systems  are on 800 numbers.  The  passcode on  these  systems can
vary in length and can be accessed by several  different methods, so it is
impossible to explain exactly how to hack these systems.
   The other type is the single mailbox system.  These  are usually set up
in a reserved  prefix in an area  code.  (Ex: 713-684-6xxx)  These systems
are usually  controlled by the  same type of hardware/software.  To access
the area  where you  enter the  passcode, just hit '0' for a second or so.
The passcodes are  four (4)  digits  long.  The only way to hack  these is
manually.  The best thing you could do is to  find one that does not  have
a recording from a person, but just the  digitized voice.  If you hack one
that  someone already  owns, they will  report it and  it will not last as
long.
   Here is a list mailboxes or prefixes to help you get started
--------------------------------------------------------------------------
   Single                          Multiple                        Digits
------------                     ------------                     --------
213-281-8xxx                     212-714-2770                         3
213-285-8xxx                     216-586-5000                         4
213-515-2xxx                     415-338-7000 Aspen Message System    3
214-733-5xxx                     714-474-2033 Western Digital
214-855-6xxx                     800-222-0651 Vincent and Elkins      4
214-978-2xxx                     800-233-8488                         3
215-949-2xxx                     800-447-8477 Fairylink               7
312-450-8xxx                     800-521-5344                         3
313-768-1xxx                     800-524-2133 RCA                     4
405-557-8xxx                     800-527-0027 TTE TeleMessager        6
602-230-4xxx                     800-632-7777 Asynk                   6
619-492-8xxx                     800-645-7778 SoftCell Computers      4
713-684-6xxx                     800-648-9675 Zoykon                  4
                                 800-847-0003 Communications World    3
==========================================================================
                           The Disclaimer!
==========================================================================
   We, the editors, take no  responsibility  for  your actions and  use of
the information in this newsletter.  This newsletter is for  informational
purposes  only.  If  you   are  easily   offended   by   telecommunication
discussions, then we suggest  that you not read  this newsletter.  But for
those  who are  truely interested in the  information in this  newsletter,
enjoy it.
==========================================================================
                         Coming in the next issue!
==========================================================================
   In the next issue, we  will  be open  for suggestions from  the readers
of this issue.  We will have some featured articles though, which include:
1) Study of bridges
2) Review of Crusader's new TeleNet Hacker
3) More information on the new LDDS 950 port
4) Review of Code Hackers for all modems
5) List of TeleNet addresses
6) Credit Card checkers
7) Ideas from the readers
==========================================================================

      Brought to you in the Cookbook by the Jolly Roger!!!!!!!!!!!!!!!

###########################################################################╝###



#                      _________________________________
#
#                       /he Remote Informer Newsletter!
#
#
#
#--------------------------------------------------------------------------╝--#
# November                                                     TRI Issue:
03 #
#--------------------------------------------------------------------------╝--#
#
#
#     The Editors:  Tracker, Ye Cap'n, Norman Bates, and The Reporter
#
#
#
###########################################################################╝###
===========================================================================╝===
=                            Introduction
=
===========================================================================╝===
It's been a month now, and ALOT has happened.  So much, in fact, that the
information will be split into several issues.  This should be no shock
since
I mentioned in the first issue that we may put several issues out
sometimes.
     I want to congratulate the readers for finally contributing to the
newsletter.  This first two issues were all on information that I, myself,
obtained.  Several people gave me information for these issues, and their
handle and information is included in the articles.
===========================================================================╝===
=                                 In The News!
=
===========================================================================╝===
     ITT has 9 digits!     |       Phreaky Phones Go Down!
|Information!
===========================================================================╝===
   For those of you who did|   The famed Phreaky Phones  are down|   We
have
not know this, ITT has nine|again. Modem Man, the original person|so much
info
digit codes.  They are said|that started them, has said that they|to put
out,
to give  better connections|will be down until further notice. In|that  we
are
to some extent.  This info.|the meantime, other independent boxes|putting
out
was  originally given to us|are being started.   A listing can be|many
issues
by Party Beast.            |made of current ones on request.     |at one



time.
=================================================================|If you
want
  Magnus Adept Gets Busted  |    Sprint Codes Are Dying Fast!    |all
issues
=================================================================|that are
out
   Fellow Atarian  and well-|   Sprint codes  are hard to get and|now,
then
known  phreak  Magnus  Adept|when they are obtained, they tend to|call  one
of
got caught  by MCI.  Details|die rather  quickly.  Phreakers have|the
boards
of the  how, when, and where|been  saying that  the 950-0777 port|at  the
end
are not known at  this time.|is dead, but  on the contrary, it is|of the
issue
He got caught with 150 codes|still  available in states  that are|or look
for
and  may  have to pay  up to|not highly  abused by phreaks.  Here|an editor
on
50 dollars  for  each  code.|again, rumors are being spread.     |a hack
BBS.
===========================================================================╝===
=                          The Best BBS of the Month
=
===========================================================================╝===
     Starting from now on, we will have a BBS of the month.  We will choose
a
BBS, ragardless of computer type, and look at the user participation in
phreak
related matters, as well as quality discussions on the various illegal
topics.
A BBS can remain the BBS of the month as long as they reside above the rest
of
the BBS systems.  Even though we will sometimes bring out more than one
issue
in a month, the board will remain BBS of the month until the first issue
inthe
next month comes out.
     This month's BBS of the month is FBI PirateNet.  We chose this board
because of the large numbers of posts in the bases, and not only
information,
but discussions as well, with a minimum number of posts from raggers and
braggers.  The number for it is 516-661-7360.  The SysOp of FBI PirateNet
is
The Phantom, not to be confused with an earlier narc.
===========================================================================╝===
=           US Sprint Expected to Trim Staff, Consolidate Divisions
=
===========================================================================╝===
     New York -- US Sprint Communications Corp., the troubled long distance
carrier, is expected to announce soon that it will cut its work force by
several hundred people and reduce its seven regional divisions to 3



operating
groups, sources familiar with the company said.
     The company's Pacific division is based in Burlingame, CA.  The
layoffs
and reorganization are part of a plan by US Sprint's new president, Robert
H.
Snedaker, to reduce heavy operating losses, which analysts expect to reach
more than $800 million this year.
     Snedaker replaced Charles M. Slibo, who was forced to resign in July
because losses were running much higher than the parent companies had
expected.  Problems with the company's computerized billing system also
contributed to Skibo's ouster.  US Sprint is owned and operated by the GTE
Corp. and United TeleCom.
     According to sources close to Snedaker, who was vice chairman and
chief
operating officer of United TeleCom, he is planning to consolidate the
company's 7 divisions, which operate in the same geographical regions as
the
seven regional Bell operating companies, into 3 divisions.
     The rationale for the move, according to idustry analysts, is that the
company will need a much smaller work force once it begins handling all
it's
phone traffic on it's new fiber optic network, which can carry a greater
number of telephone calls at less cost.  Company officials have said that
they expect to have most of the traffic on the network by early next year.
     One source said that there would be more than one round of layoffs in
the
coming months and that the company ultimately plans to reduce its 14,000
member work force by 15 percent.
     Several top managers are expected to resign as soon as US Sprint
centralizes its marketing and support operations as its headquarters in
Kansas
City, MO., according to a report in the latest issue of Business Week
magazine.
     A spokesman for US Sprint said on Friday that the company would not
comment on the rumors.  The company is the nation's third largest long
distance company, after the American Telephone and Telegraph Co. (AT&T) and
MCI Communications Co.
     Last year, Washington based MCI undertook a similar reorganization in
which it posted a $502.5 million loss to write down old inventory and
restructure operations.
     Analysts said that is US Sprint is to turn a profit, the company must
increase its market share.  "To do this, US Sprint must gain more large
business customers, which account for about 80 percent of industry
revenues,"
said Robert B. Morris III, Securities in San Francisco.
     Morris said that by using a slick marketing campaign to differentiate
its
all-fiber telephone network from those of competitors, US Sprint more than
doubled its customer base last year.  But "most of these customers were
residential and small business users that added little to Sprint's bottom
line," he added.  "If the company expects to be profitable, it will have to
concentrate on providing the best service to volume users."
] This information was supplied by Ye Cap'n
===========================================================================╝===
=             Secret Service Cracks Down on Teen Hackers
=



===========================================================================╝===
     Mount Lebanon, PA -- The US Secret Service and local police
departments
have put a scare into the hacker community with a nationwide crackdown on
computer crime that has resulted in the arrests of teenage hackers in at
least
three cities.
     "People who monitor the bulletin boards say there are a lot of nervous
hackers out there, wondering who will be arrested next," says Ronald E.
Freedman, vice-president of Advanced Information Management, a Woodbridge,
VA
base computer security firm.
     Nine teenagers from Mount Lebanon Junior-Senior High School near
Pittsburg, PA, were arrested recently and charged with computer fraud.  The
juveniles allegedly used home computers to gain illegal access to a credit
card authorization center.  They obtained valid credit card numbers and
used
them to purchase thousands of dollars worth of mail order merchandise, the
police said.
     Freedman says it appears the hackers used some relatively
sophisticated
techniques in the scheme, including specially written software that enabled
them to bypass security controls and navigate through credit records to
obtain
key information.
     Police officials say that the hackers also obtained access codes from
pirate bulletin board systems to make free long distance calls and gain
access
to various business and government computers.
     The arrests were the result of a 6 week investigation by the Secret
Service and the Mount Lebanon police. The police were tipped off by parents
who were suspicious about how their son managed to obtain a skateboard
valued
at $140.
     The Secret Service was also involved in investigations that led to the
arrests of several hackers in San Francisco and New York last July.
     Secret Service spokesman William Corbett says that although some
reports
have portrayed the hackers as part of a national crime ring, the cases are
unrelated.  "It's just that a few of these computers hacking cases came to
a
head at about the same time," he says.
     Federal Legislation enacted in 1984 gives the Secret Service, part of
the
Department of the Treasury, a major role in investigating computer crimes.
Under the federal Computer Fraud and Abuse Act of 1986, computer fraud is a
felony that carries a maximum penalty of 5 years for the first offense, and
10
years for the second.  Displaying unauthorized passwords on hacking
bulletin
boards carries a maximum penalty of 1 year in prison for the first offense,
and 10 years for the second.
] This information was supplied by Ye Cap'n
===========================================================================╝===
=                          German Teens Crack NASA
=



===========================================================================╝===
     Washington, D.C. -- A group of West German teenagers from the Chaos
Computer Club penetrated a NASA network recently, saying they were doing it
to
"test the security."
     What they got into was SPAN Net, a computer network with about 700
notes,
which is actually based at the Goddard Space Center in Maryland.  All
that's
in there is unclassified data, space science information, and post-flight
data
anaysis.  "Anyone with NASA related research can apply for access to SPAN"
says a spokesman, who adds that the network runs on DEC VAX hardware.  "We
picked up three attempts to gain access and put in security precautions so
it
would't happen."  His personal opinion is, "We're happy that they couldn't
get
back in, and decided to go public."  He also added that NASA has many other
networks, many of the classified and "probably inpenetrable.  But I do not
want to challenge anybody."
     How'd they get in?  Probably they got a West German NASA licensee,
which
gave them a visitor's pass, then they created new passwords with unlimited
security for themselves, after which getting around the network was easy.
] Supplied by Ye Cap'n
===========================================================================╝===
    We look for information in anyway related to the newsletter.  If you
have
something of interests, or something that you saw on television, or in the
newspaper, then upload it to one of the boards listed below.  You will
receive
full credit.
Pirate's
Hollow..................................................[phone]
Bate's
Motel.....................................................[phone]
===========================================================================╝===


###########################################################################╝###
#                     _________________________________
#
#                      /he Remote Informer Newsletter!
#
#
#
#--------------------------------------------------------------------------╝--#
# November                                                     TRI Issue:
04 #
#--------------------------------------------------------------------------╝--#
#
#



#     The Editors: Tracker, Ye Cap'n, Norman Bates and The Reporter
#
#
#
###########################################################################╝###
===========================================================================╝===
=                 FCC Charges Much Ado About Not Much
=
===========================================================================╝===
     New Cannan, CT -- International Resource Develope of New Cannan, CT
says
that the market bubble for packet switch networks like TeleNet is going to
burst by 1991, regardless of what the Federal Communications Commission
does
about access charges.  Cheap fiber, which greatly increases the capacity,
and
ISDN services, which let you share a phone line with your computer, will do
the business in, the report says.  Over the next four years, however, the
demand for packet switch services to will grow from $650 million to $1,612
million (If the Baby Bells are allowed to add competition to the market,
the
$5/hour access charge cannot be passed though to the customers anyway).
] Supplied by Ye Cap'n
===========================================================================╝===
=                   Pirate's Hollow Update
=
===========================================================================╝===
     San Carlos, CA -- The Pirate's Hollow, one of the more popular BBS's
in
the Bay Area, is installing several new features that will even add to it's
popularity.  For one, users will be able to gamble against each other by
betting on NFL games and participating in the Pirate's Hollow Lottery.
Also,
in order to support one of the best newsletters around, the Pirate's Hollow
will soon be adding a seperate module that will act as an outpost for The
Remote Informer.  This module will feature the older issues of the
newsletter,
a section that will keep you abreast of updates of recently released
information, and a section that will show what is upcoming in the next
issues
of The Remote Informer.
     The long-awaited database will soon be put online.  Over 800 textfiles
on a variety of subjects will be available to the users that pay the access
fee that will be determined at a later date.  Many more are on the way, and
will be included at no charge. The charge will be a one time charge though,
rather than a yearly payment.
     Another new option will be available by early December.  PC Pursuit
callback will be installed.  This will allow people to call and then get
called back if your area code is supported by PC Pursuit.  This will also
require a charge, to be set at a later date.
     The Pirate's Hollow has been doing well in its comeback to the
telecommunications world, but we need more callers in order to formulate a
more diverse user base.  Please spread the BBS # around while also trying



to
make others aware of the newsletter.
===========================================================================╝===
=                               Switching Systems
=
===========================================================================╝===
     There are currently three different forms of switching systems that
are
present in the United States today. Step by Step (SxS), Crossbar, and the
Electronic Switching System (ESS) make up the group.  Phreaks have always
been
a little tenative when it comes to "doing their work" once they have heard
about effects of switching systems on their hobby.  After researching this
topic, I have found that there really is not that much to be worried about.
Read on, while I share with you information which I have compiled about all
of
these switching systems and their distinct features.
     The first switching system that was used in the country was called
Step
by Step.  This was adopted in 1918 by Bell, and until 1978, they had over
53%
of all their exchanges using Step by Step (SxS).  This system is known for
it's long, confusing train of switches that are used for its step by step
switching.
     Step by Step has many disadvantages to phone users.  The switch train
becomes jammed fairly often, and it causes calls to be blocked.  Also, SxS
does not allow the use of DTMF dialing. This accounts for some of the areas
in
the United States that cannot have touch tone dialing abilities.  A
tremendous
amount of electricity and maintenance needs to accompany the SxS switching
system, which makes it even more impratical.  All in all, this is probably
the
most archaic switching system around.
    There are a number of ways to see if you are on SxS.  You will notice
that
there are no pulsing digits after dialing.  Most sources say that the phone
company will sound like many typewriters.  SxS does not offer features such
as
speed calling, call forwarding, three-way calling, call waiting, and other
such services.  Pay phones on SxS also will want your money before you
receive
a dial tone.  This adds to the list of disadvantages labelled to that of
the
Step by Step switching systems.
     Another type of switching system that is prevalent in the United
States
is Crossbar.  Crossbar has been Bell's primary switcher after 1960, and
three
types of it exists.  Number 1 Crossbar (1xB), Number 4 Crossbar (4xB), and
the
Number 5 Crossbar (5xB).  In Crossbar, a switching matrix is used for all
the
phones in an area, and when someone calls, the route is determined and is
met
up with the other phone.  This matrix is set-up in horizontal and vertical



paths.  Unlike other swichting systems, in my research, I could not come up
with any true and definate distinguishing features of the Crossbar
switching
systems.
     The Electronic Switching System (ESS) is yet another switching system
used in the United States and the most used of all three swicthing systems.
ESS is an extremely advanced and multi-faced type of switching system, and
is
feared by marauders of the phone company everywhere.  With ESS, your phone
company is able to know every digit dialed (including mistakes), who you
call,
when you called, and how long you were connected.  ESS is also programmed
to
print out the numbers of people who make excessive calls to WATS numbers
(800
services) or directory assistance.  This feature of ESS is called 800
Exceptional Calling Report, and has spelled the end of some forms of
continuous code hacks to certain extenders.  ESS can also be programmed to
print logs of who called and abused certain numbers as well.  Everything is
kept track of in its records.
     The aforementioned facts show that ESS has made the jobs of
organizations
such as the FBI, NSA, and other phone company security forces easier.
Tracing
can be done in a matter of microseconds, and the result will be
conveniently
printed out on the monitor of a phone company officer.  ESS is also
programmed
to pick up any "foreign tones" on the phone line such as the many varied
tones
emulated by boxes.
     ESS can be identified by a few features common in it.  The 911
emergency
service is covered in the later versions of ESS.  Also, you are given the
dial
tone first when using a pay phone unlike that of SxS.  Calling services
like
call forwarding, speed calling, and call waiting are also common to ESS.
One
other feature common to ESS is ANI (Automatic Number Identification) for
long
distance calls.  As you can see, ESS is basically the zenith of all
switching
systems, and it will probably plague the entire country by the early
1990's.
Soon after, we should be looking forward to a system called CLASS.  This
switching system will contain the feature of having the number of the
person
that is calling you printed out on your phone.
     What have I concluded about these switching systems?  Well, they are
not
good enough.  I know a few people employed by the phone company, and I know
for a fact that they do not have enough time these days to worry about code
users, especially in large, metropolitan areas.  So, I will go out on a
limb
here, and say that a large portion of people will never have to worry about
the horrors of ESS.
] Written by Ye Cap'n



===========================================================================╝===
=                  New Gizmo Can Change Voice Gender
=
===========================================================================╝===
     The most amazing device has turned up in the new Hammacher Schlemmer
catalog:  the telephone voice gender changer.
     What it does is change the pitch of your voice from, say, soprano to
bass
-- a most efficient way to dissuade an obscene phone caller just as he's
getting warmed up.
     That is not the same as running a 45 r.p.m. record at 33. In digital
conversion, the pitch can be changed without altering the speed.
     The device runs on a 9-volt batter and attaches to the telephone mouth
piece with a rubber coupler that takes but a moment to slip on and off.
     With the changer switched on, says Lloyd Gray, a Hammacher Schlemmer
technical expert, "the effect is similar to what you hear when they
interview
an anonymous woman on television and disguise her voice by deepening it."
"It's better for changing a woman's voice to a man's than the other way
around," Gray said.  A man can use it to raise the pitch of his voice, but
he
still won't sound like a woman."
     A man could, however, use the changer to disguise his voice. But with
the
device set on high, Gray's voice still could be identified as his own. On
low,
his normal tenor became so gravel like that the words were unintelligible.
] Supplied by Tracker and The Reporter
===========================================================================╝===

     We look for information in anyway related to the newsletter.  If you
have
something of interests, or something that you saw on television, or in the
newspaper, then upload it to one of the boards listed below.  You will
receive
full credit.
Pirate's
Hollow..................................................[phone]
Bates
Motel......................................................[phone]
===========================================================================╝===

   Brought to you by the Jolly Roger in the Cookbook!!!!!!!!!!!!!!!!!!

###########################################################################╝###
#                      _________________________________
#
#                       /he Remote Informer Newsletter!
#
#
#
#--------------------------------------------------------------------------╝--#



# November                                                     TRI Issue:
05 #
#--------------------------------------------------------------------------╝--#
#
#
#    The Editors:  Tracker, Ye Cap'n, Norman Bates, and The Reporter
#
#
#
###########################################################################╝###
===========================================================================╝===
=                                 AT&T Rates
=
===========================================================================╝===
     WASHINGTON -- American Telephone & Telegraph Co. proposed Tuesday to
lower its interstate long-distance rates by an average of 3.6 percent to
reflect reduced costs in connecting to the local telephone network.
     The largest decrease -- 6.3 percent -- would be seen in day time
prices
"because of the need to make those rates more competitive," AT&T said.
     Rates for calls made during evening hours would drop 2.2 percent and
calls made during the late night and weekends would be cut by 0.8 percent,
the
company said.
     The rate reductions would take effect Jan. 1, if they are approved by
the
Federal Communications Commission.
     Reacting to the proposed price cuts, MCI Communications Corp. and US
Sprint Communications Co., the nation's second-largest and third-largest
long
distance companies respectively, said their response would depend on what
the
FCC finally approves but both said they intended to remain competitive with
AT&T. AT&T, the nation's largest long-distance company, proposed to the FCC
that its rates drop as much as $800 million, but AT&T said the exact amount
will depend on the access charges the FCC allows the local telephone
companies
to collect from long distance carriers, which must pay the fees to hook
into
the phone local network.
     AT&T has challenged the new access rates filed by the regional Bell
operating companies, contending they are more than $1 billion too high.
In proposing its new rates, the long-distance leader told the FCC it
expects local companies' access fees to fall by at least $200 million --
which
would amount to an average rate reduction of less than 1 percent.  But the
company said it believes the FCC will order an additional $600 million in
reductions based on AT&T's challenge.
     "We're confident the FCC will recognize that access charges filed by
the
local telephone companies need to be substantially reduced, which would
mean
more savings for our customers," said Larry Garfinkel, AT&T vice president
for



marketing.
     He said the company filed its proposed rates based on disputed charges
because "we wanted to let the public react ... and further to let the FCC
have
full knowledge of where we were heading given our expectation that we had a
valid basis for our dispute."
     AT&T's long-distance rates have fallen by about 34 percent since the
company was stripped of its local operating companies by an antitrust
decree
nearly four years ago.
     Since then, phone rate payers have been paying a larger share of the
costs
of maintaining the local network through monthly subscriber line charges,
now
$2.60 for residential customers.
     That has reduced the long-distance companies' share of local network
expenses, which they pay in the form of access charges.
     Jack Grubman, a telephone analyst with PaineWebber Inc., said AT&T's
proposal targets business customers because "that's where the competition
is
and where the better (profit) margins are." In addition, it aims to keep
the
pressure on competition in international calling by extending discounts to
more customers. Grubman added that, if the company's rate proposal is
approved
by the FCC, he would expect no further cuts in AT&T rates in 1988.
     Wendell Lind, AT&T administrator of rates and tariffs, said the cuts
for
business and residential customers are about the same because business cuts
are offset by a proposed $128 million increase in AT&T's private line
rates.
     AT&T is the only long-distance company whose rates are regulated by
the
FCC, but its prices set the pace for the industry. Though AT&T is far
larger
than any of its competitors, its market share has been declining since
divestiture and the company now says it serves about 75 percent of the
market.
     In addition to the reductions in basic long-distance rates, AT&T
proposed
cutting prices by 5 percent and 5.7 percent for its Pro-America calling
plans.
     The company also proposed to reduce prices by 2.9 percent for its 800
Service customers and 4.4 percent for WATS customers, although it would
increase the monthly access line charges for those plans by $3.20 to
reflect
higher special access charges filed by the local phone companies.
] Supplied by Tracker and The Reporter
===========================================================================╝===
=               US Sprint Operator Service Traffic Increases 40%
=
=                          New Center Added In Dallas
=
===========================================================================╝===
     ORLANDO, Fla. -- US Sprint Wednesday announced its long distance
operators who began saying, "May I help you?" just five months ago, are now



handling 3.5 million calls a month.
     The fiber-optic long-distance carrier, offering the only operator
service
alternative to AT&T has experienced a 40 percent growth in operator service
calls since it announced its service July 1.
     Amanda Weathersby, US Sprint vice president of product marketing, said
Tuesday, "More and more people are taking advantage of our call completion
assistance and alternative billing arrangements.
     "Customer surcharges are the same as AT&T with the added benefit of US
Sprint's fiber-optic quality and lower long-distance rates."
     US Sprint currently offers person-to-person, station-to-station, call
completion and collect calling. US Sprint has announced an agreement with
US
WEST Service Link that will allow anyone to call on US Sprint and charge
their calls to a Regional Bell Operating Co. calling card beginning in
first
quarter 1988.
     "Previously, our operator service was available only on pre-subscribed
US Sprint phones and recently we added operator assistance for US Sprint
FON
CARD customers," Weathersby said.
     "With this new agreement, we'll be able to expand our operator service
to markets such as pay phones, hospitals, and hotels/motels."
     The newest 24-hour operator service center in Dallas began operations
on
Oct. 5.  US Sprint's other operator service centers are  in:  Cherry Hill,
N.J.; Atlanta; Lombard, Ill. and Reno, Nev.
     US Sprint is a joint venture of United Telecommunications Inc. of
Kansas
City, Mo. and GTE Corp. of Stamford, Conn.
] Supplied by Tracker and The Reporter
===========================================================================╝===
=             Pacific Bell Pursuing Calling Card Thief
=
===========================================================================╝===
     SAN FRANCISCO--(BW)--Pacific Bell is warning consumers to protect
their
telephone calling cards like any other credit card in the wake of a series
of
frauds by people posing as phone company employees.
     A Pacific Bell spokesman says customers in the 213, 805 and 916 area
codes are being victimized by someone who says he is a telephone company
employee investigating calling card fraud.  The individual calls people at
home at odd hours, asking for their calling card numbers.  He then sells
the
numbers to people who use the numbers to make long distance phone calls.
     As recently as Monday of this week, 180 long distance calls were
billed
to a Sacramento area resident who had given his number to the thief just
three
hours earlier.
     According to Pacific Bell, this kind of scheme and other forms of
calling
card fraud cost telephone customers nationwide half a billion dollars a
year.
     The company offered these tips to consumers to avoid becoming a victim



of
calling card fraud:
     Never give your calling card number or personal identification number
to
anyone.  Any telephone company employee with a legitimate need to know the
number has access to it.
     Treat your calling card like any other credit card.  Report its loss
immediately by calling the 800 number on the back of the card 800-621-0430.
     If you receive a suspicious call regarding your telephone calling
card,
report it by calling the 800 number on the back of the card.
     If you receive a call from someone claiming to be a telephone company
employee and asking for your calling card number, ask for a name and number
to
call back.  Then call the local Pacific Bell business office to report the
incident.
     One suspect was arrested in Southern California last week by a quick
thinking customer who did just that.  Pacific Bell immediately contacted
the
local police department.  A suspect holding seven stolen calling card
numbers
was arrested minutes later.
     Pacific Bell and long-distance telephone companies will credit
customers
for calling card charges determined to be fraudulent.  Pacific Bell is a
subsidiary of Pacific Telesis Group, a diversified telecommunications
corporation based in San Francisco.
] Supplied by Tracker and The Reporter
===========================================================================╝===
     We look for information in anyway related to the newsletter.  If you
have
something of interests, or something that you saw on television, or in the
newspaper, then upload it to one of the boards listed below.  You will
receive
full credit.
Pirate's
Hollow..................................................[phone]
Bates
Motel......................................................[phone]
===========================================================================╝===

  Brought to you in the Cookbook courtesy of the Jolly Roger!!!!!!!!!!!

The Phreaker's Guide to Loop Lines          courtesy of the Jolly Roger

    A loop is a wonderous device which the telephone company created as
test
numbers for telephone repairmen when testing equipment.  By matching the
tone of the equipment with the tone of the loop, repairmen can adjust and
test
the settings of their telephone equipment.
    A loop, basically, consists of two different telephone numbers.  Let's
use A and B as an example.  Normally if you call A, you will hear a loud
tone (this is a 1004 hz tone), and if you call B, the line will connect,
and
will be followed by silence.



    This is the format of a loop line. Now, if somebody calls A and someone
else calls B--Viola!--A and B loop together, and one connection is made.
Ma Bell did this so repairmen can communicate with each other without
having to call their own repair office. They can also use them to exchange
programs, like for ANA or Ringback. Also, many CO's have a "Loop Assignment
Center".  If anyone has any information on these centers please tell me.
    Anyway, that is how a loop is constructed.  From this information,
anyone can find an actual loop line. Going back to the A and B example,
Note: the tone side and the silent side can be either A or B.  Don't be
fooled
if the phone company decides to scramble them around to be cute.
   As you now know, loops come in pairs of numbers.  Usually, right after
each
other.
 For example: 817-972-1890
                 and
              817-972-1891
   Or, to save space, one loop line can be written as 817-972-1890/1.
   This is not always true.  Sometimes, the pattern is in the tens or
hundreds,
and, occaisionally, the numbers are random.
   In cities, usually the phone company has set aside a phone number suffix
that loops will be used for.  Many different prefixes will correspond
with that one suffix.
   In Arlington, Texas, a popular suffix for loops is 1893 and 1894, and
a lot of prefixes match with them to make the number.
 For Example:  817-460-1893/4
               817-461-1893/4
               817-465-1893/4
               817-467-1893/4
               817-469-1893/4
        ...are all loops...
   or a shorter way to write this is:
              817-xxx-1893/4
      xxx= 460, 461, 465, 467, 469
   Note: You can mix-and-match a popular suffix with other prefixs in a
city, and almost always find other loops or test numbers.
   Note: For Houston, the loop suffixes are 1499 and 1799.  And for Detroit
it's 9996 and 9997.
   When there are a large number of loops with the same prefix format,
chances are that many loops will be inter-locked.  Using the above example
of Arlington loops again, (I will write the prefixes to save space) 460,
461,
and 469 are interlocked loops.  This means that only one side can be used
at
a given time.  This is because they are all on the same circuit.
   To clarify, if 817-461-1893 is called, 817-460 and 469-1893 cannot be
called because that circuit is being used.  Essentialy, interlocked loops
are all the same line, but there are a variety of telephone numbers to
access
the line.
   Also, if the operator is asked to break in on a busy loop line he/she
will say that the circuit is overloaded, or something along those
lines.  This is because Ma Bell has taken the checking equipment off
the line.  However, there are still many rarely used loops which can
be verfied and can  have emergency calls taken on them.
   As you have found out, loops come in many types.  Another type of loop
is a



filtered loop.  These are loop lines that the tel co has put a filter on,
so
that normal human voices cannot be heard on either line.  However, other
frequencies may be heard.  It all depends on what the tel co wants the
loop to be used for. If a loop has gotten to be very popular with the
local population or used frequently for conferences, etc. the tel co may
filter
the loop to stop the unwanted "traffic".  Usually, the filter will be
removed after a few months, though.

                   ----------------Brought to you by the Jolly Roger


How Ma Bell Works                               by the Jolly Roger

In  this  article,  I  will first describe  the  termination,
wiring,  and  terminal  hardware most commonly used in  the  Bell
system, and I will include section on methods of using them.
     -------------
     LOCAL NETWORK
     -------------
The   local   telephone   network   between   the    central
office/exchange  and  the  telephone subscribers can  be  briefly
described as follows:
From  the  central office (or local exchange) of  a  certain
prefix(es), underground area trunks go to each area that has that
prefix  (Usually  more than one prefix per area.)  At  every  few
streets or tract areas, the underground cables surface. They then
go to the telephone pole (or back underground,  depending on  the
area)  and  then  to the subsribers house (or in the case  of  an
apartment building or mutliline business,  to a splitter or  dis-
tribution box/panel).
Now  that  we have the basics,  I'll try and go in-depth  on  the
subject.
    ------------------
    UNDERGROUND CABLES
    ------------------
These  are sometimes inter-office trunks,  but usually in  a
residential  area they are trunk lines that go to bridging  heads
or  distribution  cases.  The cables are about 2-3  inches  thick
(varies),  and  are  either  in  a metal  or  pvc-type  pipe  (or
similiar).  Rarely (maybe not in some remote rural areas) are the
cables  just 'alone' in the ground.   Instead they are usually in
an  underground cement tunnel (resembles a small sewer or  storm-
drain.)   The manholes are >heavy< and will say 'Bell system'  on
them.  they can be opened with a 1/2 inch wide crowbar (Hookside)
inserted  in the top rectangular hole.  There are ladder rungs to
help you climb down.  You will see  the cable  pipes on the wall,
with the blue and white striped one being  the inter-office trunk
(at  least  in my  area).  The others  are local  lines,  and are
usually marked or color  coded.  There is almost  always a posted
color code  chart on the wall, not to mention  Telco manuals de-
scribing the cables and terminals, so I need not get into detail.
Also, there is usually  some kind  of  test equipment,  and often
Bell test sets are  left  in there.
       --------------
       BRIDGING HEADS
       --------------



The  innocent-looking  grayish-green boxes.   These  can  be
either trunk bridges or bridging for residences.  The major trunk
bridging  heads  are usually larger,  and they have the  'Western
Electric' logo at the bottom,  whereas the normal bridging  heads
(which  may  be different in some areas-depending on the  company
you are served by.  GTE B.H.'s look slightly different.  Also, do
not  be  fooled by sprinkler boxes!)  They can be found  in  just
about every city.
To open a bridging head: if it is locked (and you're feeling
destructive),  put a hammer or crowbar (the same one you used  on
the  manhole) in the slot above the top hinge of the right  door.
Pull hard, and the door will rip off. Very effective! If it isn't
locked (as usual),  take a 7/8 inch hex socket and with it,  turn
the bolt  about 1/8 of a turn  to the  right  (you  should hear a
spring release inside). Holding the bolt, turn the handle all the
way to the left and pull out.
To Check for a test-set (which are often left by Bell employees),
go inside - First check  for a test-set  (which  are  often  left
by  Bell  employees).   There should be a panel of terminals  and
wires.   Push the panel back about an inch or so,  and rotate the
top  latch  (round with a flat section)  downward.   Release  the
panel  and it will fall all the way forward.  There is usually  a
large  amount  of wire and extra terminals.   The  test-sets  are
often hidden here,  so don't overlook it (Manuals,  as  well,  are
sometimes placed in the head).   On the right door is a metal box
of alligator clips.   Take a few (Compliments of Bell.).  On each
door is a useful little round metal device. (Says 'insert gently'
or'  clamp  gently - do not overtighten' etc..)  On the front  of
the disc, you should find two terminals.  These are for your test
set.   (If you dont have one, dont despair -I'll show you ways to
make basic test sets later in this article).
Hook the ring (-) wire to the 'r' terminal;  and the tip (+)
wire  to the other.  (By the way,  an easy way to  determine  the
correct polarity is with a 1.5v LED.   Tap it to the term.  pair,
if  it  doesnt light,  switch the poles until it does.   When  it
lights,find the longer of the two LED poles:  This one will be on
the  tip wire (+).   Behind the disc is a coiled  up  cord.  This
should have two alligator clips on it..  Its very useful, because
you dont have to keep connecting and disconnecting the fone (test
set) itself, and the clips work nicely.
On  the  terminal  board,  there should be  about  10  screw
terminals  per  side.   Follow the wires,  and you can see  which
cable pairs are active.  Hook the clips to the terminal pair, and
you're set!   Dial out if you want,  or just listen (If someone's
on theline).  Later,  I'll show you a way to set up a true  'tap'
that  will let the person dial out on his line and receive  calls
as normal, and you can listen in the whole time.  More about this
later...
On  major  prefix-area bridging heads,  you can  see  'local
loops' ,which are two cable pairs (cable pair = ring+tip,  a fone
line)  that are directly connected to each other on the  terminal
board.   These  'cheap  loops' as they are called,  do  not  work
nearLy  as  well  as the existing ones set up  in  the  switching
hardware  at the exchange office.   (Try scanning your  prefixes'
00xx  to 99xx #'s.)  The tone sides will announce themselves with
the 1008 hz loop tone,  and the hang side will give no  response.
The  first  person  should dial the 'hang' side,  and  the  other
person dial the tone side,  and the tone should stop if you  have



got the right loop.)
If  you want to find the number of the line that you're  on,
you  can either try to decipher the 'bridging log' (or whatever),
which is on the left door.  If that doesnt work,  you can use the
follwing:
     ---------------------------
     ANI # (Automatic Number ID)
     ---------------------------
This  is a Telco test number that reports to you the  number
that youre calling from (It's the same, choppy 'Bell bitch' voice
that you get when you reach a disconnected #)
For the   213 NPA - Dial 1223
          408 NPA - Dial 760
          914 NPA - Dial 990
These  are  extremely useful when messing with any  kind  of line
terminals, house boxes, etc.
Now that we have bridging heads wired, we can go on... (don't
forget to close and latch the box after all... Wouldnt want GE
and Telco people mad, now, would we?)
     -------------------------------------
     "CANS" - Telephone Distribution Boxes
     -------------------------------------

Basically, two types:
1> Large, rectangular silver box at the end of each street.
2> Black, round, or rectangular thing at every telephone pole.
Type 1 -   This is the case that takes the underground cable from
the  bridge and runs it to the telephone pole cable (The  lowest,
largest  one  on the telephone pole.)  The box is always  on  the
pole nearest the briging head, where the line comes up.  Look for
the 'Call before you Dig - Underground cable' stickers..
The  case box is hinged,  so if you want to climb the  pole,
you  can open it with no problems.   These usually have 2 rows of
terminal sets.
You  could try to impersonate a Telco technician and  report
the  number as 'new active' (giving a fake name and fake  report,
etc.)   I  dont recommend this,  and it  probably  won't  (almost
positively won't) work,  but this is basically what Telco linemen
do).
Type  2 - This is the splitter box for the group of houses around
the  pole  (Usually  4 or 5 houses).   Use it  like  I  mentioned
before.   The terminals (8 or so) will be in 2 horizontal rows of
sets.   The  extra  wires  that  are  just  'hanging  there'  are
provisions for extra lines to residences (1 extra line per house,
thats  why  the insane charge for line #3!)  If its the  box  for
your  house  also,  have fun and swap lines with  your  neighbor!
'Piggyback'  them  and  wreak havoc  on  the  neighborhood  (It's
eavesdropping  time...)  Again,  I don't recommend this,  and its
difficult to do it correctly.  Moving right along...
     ------------------------------
     APARTMENT / BUSINESS MULTILINE
           DISTRIBUTION BOXES
     ------------------------------
Found  outside the buliding (most often on the  right  side,
but not always...   Just follow the wire from the telephone pole)
or  in the basement.   It has a terminal for all the lines in the
building.   Use it just like any other termination box as before.
Usually says 'Bell system' or similar.  Has up to 20 terminals on



it (usually.) the middle ones are grounds (forget   these).   The
wires come from the cable to one row (usually the left one), with
the other row of terminals for the other row of terminals for the
building  fone wire pairs.   The ring (-) wire is usually the top
terminal if the set in the row (1 of 10 or more),  and the tip is
in the clamp/screw below it.  This can be reversed, but the cable
pair is always terminated one-on-top-of-each- other,  not on  the
one  next  to  it.  (I'm  not sure why the other  one  is  there,
probably as aprovision for extra lines) Don't use it  though,  it
is usually to close to the other terminals, and in my experiences
you get a noisy connection.
Final note:  Almost every apartment, business, hotel, or anywhere
there   is  more  than  2  lines  this  termination  lines   this
termination method is used.  If you can master this type, you can
be  in control of many things...   Look around in your area for a
building  that  uses this type,  and practice hooking up  to  the
line, etc.
As  an  added  help,here is the basic  'standard'  color-code  for
multiline terminals/wiring/etc...
Single line:  Red = Ring
            Green = Tip
           Yellow = Ground *
*  (Connected  to  the ringer coil  in  individual  and  bridged
    ringer   phones (Bell only)  Usually  connected to the  green
    (Tip)
Ring (-) = Red
           White/Red Stripe
           Brown
           White/Orange Stripe
           Black/Yellow Stripe
Tip (+) =  Green (Sometimes
            yellow, see above.)
           White/Green Stripe
           White/Blue Stripe
           Blue
           Black/White Stripe
Ground =   Black
           Yellow
      ----------------------
      RESIDENCE TERMINAL BOX
      ----------------------
Small,  gray (can be either a rubber (Pacific Telephone) or  hard
plastic  (AT & T) housing deal that connects the cable pair  from
the  splitter box (See type 2,  above) on the pole to your  house
wiring.  Only 2 (or 4, the 2 top terminals are hooked in parallel
with the same line) terminals, and is very easy to use.  This can
be  used to add more lines to your house or add an external  line
outside the house.
      ---------
      TEST SETS
      ---------
Well,  now  you  can  consider  yourself a minor  expert  on  the
terminals and wiring of the local telephone network.  Now you can
apply  it  to whatever you want to do..  Here's another  helpful
item:
How  to  make  a Basic Test-Set and how to use it  to  dial  out,
eavsdrop, or seriously tap and record line activity.
These are  the  (usually) orange hand set fones  used  by  Telco



technicians to test lines.   To make a very simple one,  take any
Bell (or other,  but I recommend a good Bell fone like a princess
or a trimline. gte flip fones work excllently, though..) fone and
follow the instructions below.
Note:    A 'black box' type fone mod will let you tap into  their
line,  and with the box o,  it's as if you werent there. they can
recieve  calls and dial out,  and you can be listening the  whole
time! very useful.  With the box off, you have a normal fone test
set.
Instructions:
A  basic black box works well with good results.   Take the cover
off  the fone to expose the network box (Bell type  fones  only).
The <RR> terminal should have a green wire going to it (orange or
different  if  touch tone - doesnt matter,  its the same  thing).
Disconnect the wire and connect it to one pole of an SPST switch.
Connect  a  piece  of wire to the other pole of  the  switch  and
connect it to the <RR> terminal.   Now take a 10k hm 1/2 watt 10%
resistor  and  put  it  between the <RR>  terminal  ad  the  <F>
terminal,  which  should have a blue and a white wire going to it
(different for touch tone).  It should look like this:
-----Blue wire----------<F>
                   !
----White wire-----!
                   !
              10k Resistor
                   !
                   !
--Green wire--     !----<RR>
              !    !
               SPST
What  this  does in effect is keep the hookswitch  /  dial  pulse
switch (F to RR loop) open while holding the line high with  the
resistor.   This gives the same voltage effect as if the fone was
'on-hook',  while  the 10k ohms holds the voltage right above the
'off hook' threshold (around 22 volts or so, as compared to 15-17
or normal off hook 48 volts for normal 'on-hook'), giving
Test Set Version 2.
Another  design is similar to the 'type 1' test set (above),
but has some added features:
From >----------------Tip------<To Test
Alligator                        set
Clip >----------------Ring-----<phone
            !                !
            x                !
            !                !
            o                !
            !    x---RRRRR---!
            !   x            !
            !---x            !
                 x----0------!
x    = Spst Switch
o    = Red LOD        0   = Green LED
RRRRR= 1.8k 1/2 watt  xxxx= Dpst switch
        resistor
When the SPST switch in on, the LED will light, and the fone
will become active.   The green light should be on.  If it isn't,
switch  the dpst.   If it still isnt,  check the polarity of  the
line and the LEDs.   With both lights on, hang up the fone.  They



should all be off now.   Now flip the dpst and pick up the  fone.
The  red  LED shold be on,  but the green shouldnt.   If  it  is,
something is wrong with the circuit.  You wont get a dial tone if
all is correct.
When  you  hook  up  to the line with  the  alligator  clips
(Assuming you have put this circuit inside our fona and have  put
alligator clips on the ring and tip wires (As we did before)) you
should  have the spst #1 in the off posistion.  This will greatly
reduce the static noise involved in hooking up to a line. The red
LED can also be used to check if you have the correct polarity.
With  this  fone you will have the ability to listen  in  on
>all< audible line activity,  and the people (the 'eavesdropees')
can use their fone as normal.
Note that test sets #1 and #2 have true 'black boxes', and can be
used for free calls (see an article about black boxes).

Test Set Version 3

To do test set 3:
Using a trimline (or similar) phone, remove the base and cut
all  of  the wire leads off except for the red (ring -)  and  the
green  (tip +).   Solder alligator clips to the  lug.   The  wire
itself  is  'tinsel' wrapped in rayon,  and doesnt solder  well.
Inside  the one handset,  remove the light socket (if it has one)
and install a small slide or  toggle switch (Radio Shack's micro-
miniature  spst works well).   Locate the connection of the  ring
and the tip wires on the pc board near where the jack is  located
at the bottom of the handset.  (The wires are sometimes black or
brow instead of red and green,  respectively).   Cut the foil and
run 2 pieces of wire to your switch.  In parallel with the switch
add  a .25 uf 200 VDC capacitor (mylar,  silvered mica,  ceramic,
not  an electrolytic).  When the switch is  closed,  the  handset
functions normally.   With the switch in the other position,  you
can listen without being heard.
Note:  To  reduce the noise involved in connecting the clips to a
line,  add  a  switch selectable 1000 ohm 1/2  watt  resistor  in
series with the tip wire. Flip it in circuit when connecting, and
once on the line, flip it off again. (or just use the 'line disc-
onect'  type  switch as in the type 2 test  set  (above)).   Also
avoid   touching the alligator clips to any metal parts or  other
terminals,  for  i causes static on the line and raises  poeple's
suspicions.
      ---------
      RECORDING
      ---------
If you would like to record any activity,  use test set 1 or
2  above  (for unattended recording of >all< line  activity),  or
just  any test set if you are going to be there to  monitor  when
they are dialing, talking, etc.
Place  a  telephone pickup coil (I recommend the Becoton  T-5  TP
coil  or equivalent) onto the test set,  and put the TP plug into
the mic.  jack of any standard tape recorder.  Hit play, rec, and
pause.   Alternate  pause when you want to record (I  dont  think
anyone should have any difficulty with this at all...)
Well,  if  you  still can't make a test set or you dont have  the
parts, there's still hope.  Alternate methods:
1>  Find  a  bell test set in a manhole or a  bridging  head  and
'Borrow it indefinately...



2>  Test sets can  be  purchased from:
    Techni-Tool
    5 Apollo Road
    Box 368
    Plymouth Meeting PA., 19462
Ask for catalog #28
They  are usually $300 - $600, and are supposed to have  MF
dialing  capability as well as TT dialing.  They are also of much
higher quality than the standard bell test sets.
If you would like to learn more about the subjects covered here,
I suggest:
1>  Follow Bell trucks and linemen or technicians and ask  subtle
    questions. also try 611 (repair service) and ask questions..
2> Explore your area for any Bell hardware,  and experiment  with
   it.  Don't try something if you are not sure what youre doing,
   because you wouldnt want to cause problems, would you?

                               ------------------Jolly Roger

Getting Money out of Pay Phones                by the Jolly Roger

I will now share with you my experiences with pay telephones.  You will
discover
that it is possible to get money from a pay phone with a minimum of effort.
Theory: Most pay phones use four wires for the transmission of data and
codes to the central office.  Two of them are used for voice (usually red
and
green), one is a ground, and the last is used with the others for the
transmission of codes.
It is with this last wire that you will be working with.  On the pay phone
that
I usually did this to, it was colored purple, but most likely will be
another
color.
What you will do is simply find a pay phone which has exposed wires, such
that
one of them can be disconnected and connected at ease without
fear of discovery. You will discover that it is usually a good idea to
have some electrical tape along with you and some tool for cutting this
tape.
Through trial and error, you will disconnect one wire at a time starting
with
the wires different than green and red.  You do want a dial tone during
this operation.
What you want to disconnect is the wire supplying the codes to the
telephone
company so that the pay phone will not get the 'busy' or 'hang-up' command.
Leave this wire disconnected when you discover it.
What will happen:  Anytime that someone puts any amount of money into the
pay
phone, the deposit will not register with the phone company and it
will be held in the 'temporary' chamber of the pay phone.
Then, (a day later or so) you just code back to the phone, reconnect the
wire,
and click the hook a few times and the phone will dump it all out the
shute.
(What is happening is that the 'hangup' code that the phone was not
receiving due to the wire being disconnected suddenly gets the code and



dumps its' 'temporary' storage spot.)
You can make a nice amount of money this way, but remember
that a repairman will stop by every few times it is reported broken and
repair it, so check it at least once a day.
Enjoy and have fun.. Many phones I have done this to, and it works
well with each..
                             --------------------Jolly Roger

Computer Based PBX                     Courtesy of the Jolly Roger
    (Originally an Apple ][ file for forgive the upper case!)

TO GET A BETTER UNDERSTANDING OF WHAT A PBX CAN DO, HERE ARE A FEW BASIC
FUNDAMENTALS.THE MODERN PBX IS A COMBINED COMPUTER,MASS STORAGE DEVICE,
AND OF COURSE A SWITCHING SYSTEM THAT CAN:
      [1] PRODUCE ITEMIZED,AUTOMATED BILLING PROCEDURES,TO ALLOW THE
          IDENTIFICATION AND MANAGEMENT OF TOLL CALLS. [HAHAHA]
      [2] COMBINE DAYTIME VOICE GRADE COMMUNICATION CIRCUITS INTO
          WIDEBAND DATA CHANNELS FOR NIGHT TIME HIGH SPEED DATA
          TRANSFERS.
      [3] HANDLES ELECTRONIC MAIL [ INCLUDING OFFICE MEMOS ].
      [4] COMBINE VOICE CHANNELS INTO A WIDEBAND AUDIO/VISUAL
          CONFERENCE CIRCUIT,WITH THE ABILITY TO XFER AND
          CAPTURE SLIDES,FLIPCHARTS,PICTURES OF ANY KIND.
BOTH THE EXTERNAL AND INTERNAL CALLING CAPACITY OF THE PBX SYSTEM MUST BE
CAREFULLY CONSIDERED BECAUSE MANY BUSINESS OPERATIONS RUN A VERY HIGH RATIO
OF INTERNAL STATION TO STATION DIALING AND A LOW CAPACITY SYSTEM WILL NOT
HANDLE THE REQUESTED TRAFFIC LOAD.
A CRITICAL FACTOR IS THE NUMBER OF TRUNKS AND THE CENTRAL OFFICE FACILITIES
THAT ARE USED FOR OUTSIDE CONNECTIONS.ANOTHER IS THE NUMBER OF JUNCTIONS OR
[LINKS] THAT MAKE UP THE INTERNAL CALLING PATHS.
TO UNDERSTAND THE SERVICES AVAILABLE ON A TYPICAL COMPUTER RUN PBX IT IS
NECESSARY TO INTRODUCE THE SUBJECT OF TIME DIVISION SWITCHING.IN A TIME
DIVISION SWITCHING NETWORK ALL CONNECTIONS ARE MADE VIA A SINGLE COMMON BUS
CALLED (OF COURSE) A 'TIME-DIVISION BUS'.EVERY LINE TRUNK THAT REQUIRES A
CONNECTION WITH ANOTHER IS PROVIDED WITH A PORT CIRCUIT.ALL PORT CIRCUITS
HAVE ACCESS TO THE TIME DIVISION BUS THROUGH A TIME DIVISION SWITCH.
[WHEN TWO PORTS REQUKRE CONNECTION,THEIR TIME DIVISION SWITCHES OPERATE AT
A VERY HIGH FREQUENCY (16,000 TIMES PER SECOND).THIS TECHNIQUE,WHICH IS
CALLED 'SPEECH SAMPLING',ALLOWS MANY SIMULTANEOUS CONNECTIONS OVER THE SAME
TIME DIVKSION BUS.EACH CONNECTION IS ASSIGNED A TIME INTERVAL,THE 'TIME
SLOT'
,AND THE NUMBER OF TIME SLOTS IDENTIFIES THE NUMBER OF SIMULTANEOUS
CONNECT-
IONS AMONG PORTS.]
THE NEXT CRITICAL ITEM IS CIRCUIT PACKS.THE SYSTEM ELEMENTS THAT WE WILL BE
DESCRIBING IN FUTURE TUTORIALS [LINES/TRUNKS/SWITCHES,MEMORY AND CONTROL]
ARE
CONTAINED ON PLUG IN CIRCUIT PACKS.EACH LINE CIRCUIT PACK CONTAINS A NUMBER
OF LINES,IN EXAMPLE,FOUR.BUT THE ASSIGNMENT OF STATION NUMBERS TO ACTUAL
PHONE LINE CIRCUITS IS FLEXIBLE.
THE SYSTEM MEMORY IS CONTAINED IN CIRCUIT PACKS WHICH PROVIDE THE CALL
PROCESSING FUNCTIONS.THE CIRCUIT PACKS ARE HELD IN SMALL FRAMES CALLED
'CARRIERS'.WITHIN EACH CARRIER,THE CIRCUIT PACKS ARE PLUGGED INTO
POSITIONS:
THE 'SLOTS'.EVERY CIRCUIT CAN BE ADDRESSED BY,SAY A FIVE DIGIT NUMBER WHICH
TELLS ITS LOCATION BY CARRIER-SLOT-CIRCUIT.... [STARTING TO GET THE IDEA?]
THERE CAN BE THREE TYPES OF CARRIERS IN A MODERN PBX SYSTEM:
                O LINE CARRIERS



                O TRUNK CARRIERS
                O CONTROL CARRIERS
THE LINE CARRIERS CONTAIN STATION LINES.IN A.T.& T.'S "DIMENSION" MODEL,FOR
EXAMPLE,A TOTAL OF 52 TO 64 LINES ARE PROVIDED.THE TRUNK CARRIERS CONTAIN
SLOTS FOR 16 TRUNK CIRCUIT PACKS.THE CONTROL CARRIER INCLUDES PROCESSOR,
MEMORY,CONTROL CIRCUITRY,DATA CHANNELS FOR ATTENDANT CONSOLE CONTROL AND
TRAFFIC MEASUREMENT OUTPUTS.
PBX SYSTEMS WILL DIRECTLY REFLECT THE TYPES OF SERVICES OFFERED AT THE C.O.
           O CCSA
           O CCIS
           O PICTUREPHONES [SOONER THAN YOU THINK MY PHRIENDS]
COMMON CONTROL SWITCHING ARRANGEMENTS ( CCSA ) PERMIT ANY UNRESTRICTED
TELE-
PHONE STATION TO CALL ANY OTHET INTERNAL OR EXTERNAL SYSTEM STATION BY
USING
THE STANDARD SEVEN DIGIT NUMBER.ALTERNATE ROUTING IS A FEATURE OF CCSA
SERVICE
THE INTERFACILITY,ALTERNATE ROUTED CALLING PATHS ARE ACCOMPLISHED AT THE
TELE-
PHONE COMPANY CENTRAL OFFICE LEVEL,NOT AT THE PBX LEVEL.
A SYSTEM OF INTEREST TO LARGE SCALE TELEPHONE USERS IS COMMON CHANNEL
INTER-
OFFICE SIGNALLING (CCIS).TYPICALLY,THIS TECHNIQUE EMPLOYS COMMON CHANNELS
TO
CARRY ALL INTERFACILITY SIGNALLING INSTRUCTIONS: DIAL PULSES,ON HOOK
(IDLE),
OFF HOOK (BUSY),AND SO ON,BETWEEN TWO SWITCHING CENTERS. [ GETTING WARM ].
CCIS REPLACES OLDER METHODS OF INTEROFFICE SIGNALLING SUCH AS 'IN BAND' AND
'OUT OF BAND' TECHNIQUES. BY THE WAY,REAL PHREAKS ARE SELLING THEIR BOXES
TO
IDIOTS WHO STILL THINK THE'RE WORTH ALOT...THE FORMER (IN BAND) TRANSMITS
SIGNALLING DATA WITHIN THE NORMAL CONVERSATION BANDWIDTH.IT'S SHORTCOMING
IS
THAT FALSE INFORMATION MAY BE TRANSMITTED DUE TO UNIQUE TONE OR NOISE
COMBINATIONS SET UP IN THE TALKING PATH. [THIS IS THE OFFICIAL REASONING].
OUT OF BAND SIGNALLING TECHNIQUES PLACED THE INTEROFFICE DATA IN SPECIAL
CHANNELS,GENERALLY ADJACENT TO AND IMMEDIATELY ABOVE THE VOICE PATH.TO PRE-
SERVE INTERCHANNEL INTEGRITY,OUT OF BAND SIGNALLING REQUIRES VERY EFFECIENT
FILTERING OR GREATER 'BAND GUARD' SEPERATION BETWEEN CHANNELS.

Brought to you in the Cookbook courtesy of the Jolly Roger!!!!!!!!!!!!



         Subject:    PC-Pursuit Port Statistic's
         Date:       06/29/89
         Written by: PC-Pursuit Users
         ============================================================
         Introduction:
         =============
              The last 30 days of PC-Pursuit have been extremely
         controversial.  Users and ex-users have demanded accurate
         statistics, and Telenet has provided us with very little.
         And the data that was provided is questionable.  Well, here
         is some data that is guaranteed to be accurate and make
         Telenet scream. If you wish to update this data on your own,
         we will tell you how later in this text.
              The following chart consists of all the direct Telenet



         addresses of the PC-Pursuit city nodes and the total number
         of modems on each node.  Here is what the data means:
         NJNEW/3 2011    .12    56
         !     ! !        !      \-- Total Number of Modems in NJNEW
         !     ! !        \- Last Working Suffix of Address sequence.
         !     ! \- Direct Telenet Address Prefix.
         !     \--- Baud Rate of This Port is 300.
         \--------- Mnemonic.
         Please note that there are several perfectly legal ways to
         connect to a PC-Pursuit port such as NJNEW/3:
              Ways To Connect to NJNEW/3:
                   1)   C D/NJNEW/3,PCP10000,<password>   [HUNT]
                   2)   C 2011,PCP10000,<password>        [HUNT]
                   3)   C 2011.10,PCP10000,<password>     [NON HUNT]
         The first, is self explanatory.  The second does the same
         thing as the first, only that it is slightly faster and gives
         the user much greater flexibility.  The third is an example
         the flexibility, because a request is made to connect to the
         tenth, and only the tenth, modem on the NJNEW/3 port.
              By simply attempting to connect to every single modem
         in the 2011 chain, we were able to count the number of modems
         on each port and come up with the following charts which were
         extracted on June the twenty ninth of the year 1989:
         Rotary   Direct  Max.  City     Rotary   Direct  Max.  City
         Port     Address Range Total    Port     Address Range Total
         -------- ------- ---   -----    -------- ------- ---   -----
         NJNEW/3  2011    .12   56       CAOAK/3  4155    . 4   16
              /12 201301  .40                 /12 415216  . 8
              /24 20122   . 4                 /24 41511   . 4
         DCWAS/3  202115  . 6   46       CAPAL/3  415106  . 4   12
              /12 202116  .24                 /12 415224  . 8
              /24 202117  .16                 /24 <NONE> <NONE>
         CTHAR/3  <NONE> <NONE>  8       CASFA/3  415215  . 6   20
              /12 203120  . 8                 /12 415217  .10
              /24 <NONE> <NONE>               /24 41523   . 4
         WASEA/3  20617   . 4   30       ORPOR/3  50320   . 2    8
              /12 20619   .22                 /12 50321   . 6
              /24 20621   . 4                 /24 <NONE> <NONE>
         NYNYO/3  212315  . 4   22       AZPHO/3  60222   . 4   20
              /12 212316  .14                 /12 60223   .12
              /24 21228   . 4                 /24 60226   . 4
         CALAN/3  213412  . 8   40       MNMIN/3  612120  . 4   22
              /12 213413  .28                 /12 612121  .14
              /24 21323   . 4                 /24 61222   . 4
         TXDAL/3  214117  . 6   30       MABOS/3  617311  . 4   32
              /12 214118  .22                 /12 617313  .20
              /24 21422   . 4                 /24 61726   . 8
         PAPHI/3  215112  . 6   36       TXHOU/3  713113  . 8   42
              /12 2155    .22                 /12 713114  .24
              /24 21522   . 8                 /24 71324   .10
         OHCLE/3  21620   . 4   26       CACOL/3  71423   . 4   18
              /12 21621   .18                 /12 7144    .10
              /24 216120  . 4                 /24 71424   . 4
         CODEN/3  303114  . 4   40       CASAN/3  714119  . 4   20
              /12 303115  .18                 /12 714213  .12
              /24 30321   .22                 /24 714124  . 4
         FLMIA/3  305120  . 6   28       CASDI/3  714102  . 4   22
              /12 305121  .18            (619)/12 714210  .14



              /24 305122  . 4                 /24 714121  . 4
         ILCHI/3  312410  . 8   40       UTSLC/3  80120   . 4   22
              /12 312411  .28                 /12 80121   .14
              /24 31224   . 4                 /24 80112   . 4
         MIDET/3  313214  . 6   30       FLTAM/3  81320   . 4   18
              /12 313216  .18                 /12 81321   .10
              /24 31324   . 6                 /24 813124  . 4
         MOSLO/3  3145    . 4   16       MOKCI/3  816104  . 4   20
              /12 314421  . 8                 /12 816221  .12
              /24 31420   . 4                 /24 816113  . 4
         GAATL/3  404113  . 8   32       CAGLE/3                ??
              /12 404114  .20                 /12 81821   .18
              /24 40422   . 4                 /24
         CASJO/3  408111  . 4   34       CASAC/3  9167    . 4   16
              /12 40821   .26                 /12 91611   . 8
              /24 408110  . 4                 /24 91612   . 4
         WIMIL/3  41420   . 4   24       NCRTP/3  91920   . 4   20
              /12 41421   .16                 /12 91921   .12
              /24 414120  . 4                 /24 919124  . 4

         01/29/89       PC-Pursuit Modems Statistics Chart
                                 Number of Modems         City
              Mnemonic        300      1200      2400     Total
              ---------- -------- --------- --------- ---------
              NJNEW            12        40         4        56
              DCWAS             6        24        16        46
              CTHAR             0         8         0         8
              WASEA             4        22         4        30
              NYNYO             4        14         4        22
              CALAN             8        28         4        40
              TXDAL             6        22         4        32
              PAPHI             6        22         8        36
              OHCLE             4        18         4        26
              CODEN             4        18        22        44
              FLMIA             6        18         4        28
              ILCHI             8        28         4        40
              MIDET             6        18         6        30
              MOSLO             4         8         4        16
              GAATL             8        20         4        32
              CASJO             4        26         4        34
              WIMIL             4        16         4        24
              CAOAK             4         8         4        16
              CAPAL             4         8         0        12
              CASFA             6        10         4        20
              ORPOR             2         6         0         8
              AZPHO             4        12         4        20
              MNMIN             4        14         4        22
              MABOS             4        20         8        32
              TXHOU             8        24        10        42
              CACOL             4        10         4        18
              CASAN             4        12         4        20
              CASDI             4        14         4        22
              UTSLC             4        14         4        22
              FLTAM             4        10         4        18
              MOKCI             4        12         4        20
              CAGLE             4        18         4        26
              CASAC             4         8         4        16
              NCRTP             4        12         4        20



                         -------- --------- --------- ---------
              Total           166       562       170       898
                         ======== ========= ========= =========
              Average   4.8823529 16.529412         5 26.411765
              NOTE: CASAC/3, CASAC/24 were estimated.
         I think the statistics basically speak for themselves.
         I am sure there will no doubt be hundreds of people who will
         not smile at the number of specific kinds of ports supported,
         not to mention the number of 'dead' or 'down' modems you will
         find when you verify the totals.  Usually, 2% to perhaps 10%
         of the modems are 'dead' with specific ones repeatedly
         failing week after week.
         History Of This Collection:
         ===========================
              Almost a year ago a small selected group of devoted
         individuals got together to discuss problems with the PC-
         Pursuit Network, in the middle of our discussions a question
         was asked as to how the network really processes our calls.
         This was intended to help us assess SET? commands and other
         such matters.  When the address hypothesis was offered we
         quickly set out to prove it.  It was proved in about 3
         minutes with the discovery of 2011 (First try was xxx1).  The
         data has continually been collected and analyzed ever since,
         but until now, has never been mass released.
              A small group of teen age hackers discovered several
         interesting things that can be done with these addresses--
         many of which will not be discussed here short of mentioning
         that these ports connected to via these addresses are not
         limited to PC-Pursuiters.  You can, however, fight "dead"
         dialout modems in cities via the address method.  Dead modems
         can be located in about 10 seconds (faster than Telenet), and
         can either be reported or skipped past by the user connecting
         to the next modem in the sequence after the "dead" one.
         (Note: Say 2011.3 is dead, connect to 2011.4 and you will be
         past it.  If 2011.4 is busy, go to 2011.5.  The reader should
         notice 2011.3 is the same as 2011C.)
              The most interesting value of these addresses is that
         one can count the number of ports that Telenet keeps so
         secret (Grin).  When there were only 28 cities in operation
         there were an average of 2.7 300 baud, 9.4 1200 baud, and 2.5
         2400 baud modems in each city.  Some cities had as little as
         2 modems on a port and as many as 12.  Only recently has the
         number of modems per city begun to jump.
         How To Update The Count Yourself:
         =================================
              An ID is not required to "request" one of these ports,
         thus the tallying can be done any time of day by simply
         typing the number at the @ prompt.  Here is an example with
         four modems (NJNEW/24):
         @20122.1
         201 22A REFUSED COLLECT CONNECTION 19 80
         @20122.2
         201 22B REFUSED COLLECT CONNECTION 19 80
         @20122.3
         201 22C REFUSED COLLECT CONNECTION 19 80
         @20122.4
         201 22D REFUSED COLLECT CONNECTION 19 80
         @20122.5



         201 22E ILLEGAL ADDRESS 19 80
         The reader should be aware that PC-Pursuit ports always
         respond with '19 80'.  Do not confuse it with '19 00', which
         are not PC-Pursuit ports.  In the above example we know there
         are four ports because the forth was the last existing port
         before we encountered the 'ILLEGAL ADDRESS.'  There are
         several ways to signify that you have gone one beyond the end
         of the ports:
            1)  xxx xxx ILLEGAL ADDRESS 19 80
            2)  xxx xxx NOT OPERATING 19 80
            3)  The request freezes (Note: Issue a BREAK then D <C/R>
                to abort the attempt yielding 'ATTEMPT ABORTED'.)
         You should be aware that modems which are out of order in the
         middle of the sequence can respond with 'NOT OPERATING' or
         may freeze the request.  You should also note that when
         updating the existing list, all you need to do is try to
         request the next modem beyond the end as of the last check.
         Finding Newly Added Ports:
         ==========================
              Many ports have not yet been installed; hence, we do not
         yet know the addresses.  New ports may be found by entering
         the first three digits of the area code and appending (1-29,
         101-129, 201-229, 301-329, etc.) until the 'REFUSED COLLECT
         CONNECTION 19 80' appears.  Once this is found, simply log
         onto the port address with your ID and R/V dial some silly
         series of digits, disconnect the port, then connect to the
         PC-Pursuit mnemonic you think it might be and R/V redial the
         last number.  If the numbers match, you found it.


Pearl Box Plans                                  by the Jolly Roger

The Pearl Box:Definition - This is a box that may substitute for many boxes
which produce tones in hertz. The Pearl Box when operated correctly can
produce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and other
crucial tones are obviously in its sound spectrum.

Materials you will need in order to build The Pearl Box:
========================================================
C1, C2:.5mf or .5uf ceramic disk
       capacitors
Q1.....NPN transistor (2N2222 works
       best)
S1.....Normally open momentary SPST
       switch
S2.....SPST toggle switch
B1.....Standard 9-Volt battery
R1.....Single turn, 50k potentiometer
R2.....  "     "    100k potentiometer
R3.....  "     "    500k potentiometer
R4.....  "     "    1meg potentiometer
SPKR...Standard 8-ohm speaker
T1.....Mini transformer (8-ohm works
       best)
Misc...Wire, solder, soldering iron, PC
       board or perfboard, box to
       contain the completed unit,
       battery clip



çInstructions for building Pearl Box:
======================================
Since the instruction are EXTREMELY difficult to explain in words, you will
be given a schematic instead. It will be quite difficult to follow but try
it any way.

(Schematic for The Pearl Box)
+---+------------+---------+
    !            !          \
    C1            C2          \
    !             !            +
    +             +       -----+T1
    !\            +------------+-+
    !  b  c-------!              +
    !   Q1                   !   +-S1-
    !     e-----S2---+       !    SPKR
    !                !       !   +----
    !               B1       !
    !                !       !
    !                +-------+
    !R1   R2   R3   R4!
    /\/\ /\/\ /\/\ /\/\
      +--+ +--+ +--+
Now that you are probably thoroughly confused, let me explain a few
minor details. The potentiometer area is rigged so that the left pole is
connected to the center pole of the potentiometer next to it.
The middle terminal of T1 is connected to the piece of wire that runs down
to the end of the battery.

Correct operation of The Pearl Box:
===================================
You may want to get some dry-transfer decals at Radio Shack to make this
job a lot easier. Also, some knobs for the tops of the potentiometers
may be useful too. Use the decals to calibrate the knobs. R1 is the knob
for the ones place, R2 is for the tens place, R3 if for the hundreds
place and R4 is for the thousands place. S1 is for producing the all the
tones and S2 is for power.
Step 1: Turn on the power and adjust the knobs for the desired tone.
       (Example: For 2600 hz-
         R1=0:R2=0:R3=6:R4=2)
Step 2