TAP YIPL/TAP_and_YIPL_Collection_CD.iso/PHREAK/BOXES/PHREAK3.TXT

Text File | 1993-06-27 | 6KB | 121 lines

            Brought to you by: The World of Cryton  [414] 246-3965
              Formatted for 80 colunms - Use your damn printer !

This is the tone matrix for a box which generates tones that operators
use to dial. Rotary works as well, on operator lines, but this is
technological (!). Now I agree with the opinion of a well known phreak
that 'boxing' is/will be for the most part dead, but this is
tradition... First, you dial dir.asst, or an oper. Etc , then you blast
the line with a 2600hz tone. This gives you the line, this is also how
Ma Bell tracks down blue boxers... There are 2600hz detectors systems,
and even on old #4 crossbars... Once on a oper.trunk line, you use your
Blue box/rotary to dial...

So, if you use 2600hz, which is necessary, unless you are *very*
careful, you will be snagged.

Finally, this is what you read! So long and hard for:

700   :   1   :   2   :   4 :   7   : 11   :
900   :   +   :   3   :   5 :   8   : 12   :
1100  :   +   :   +   :   6 :   9   : kp   :
1300  :   +   :   +   :   + :  10   : kp2  :
1500  :   +   :   +   :   + :   +   : st   :
      : 700  :  900  : 1100  : 1300 : 1500 :

Use KP to start a call, and ST to stop, with the beloved 2600hz tone to
disconnect. I also hear that 2600hz resets Sprint nodes and gives you
their initial tone..

Now, if you're wondering about what to call from an operator trunk, here
are some goodies to help you out:

XXX+101 - Toll switching
XXX+121 - Local operator
XXX+131 - Information
XXX+141 - Rate & route
XXX+181 - Coin refund operator
XXX+11501 - Mobile operator
XXX+11521 - Mobile operator
XXX+11511 - Conference operator

These work with rotary or operators tones, but only on oper.

                             Blue boxing - Part II

     While reading the fine article on the blue box I saw that there a
lot of data left out of the document. I hope this a DDS, in some small
way, to the information.

     First the tones. While all the information is correct, the timing
specs were not included. The tone pairs are to remain on for 1/10 sec.
With 1/10 sec. Of slience between digits. The 'KP' tones should be sent
for 2/10 sec. A way to defeat the 2600hz traps is to send along with the
2600hz some pink noise (most of the energy in this signal should be
above 3000hz, this side won't make it over the toll network, but should
carry as far as your local toll center) so that the traps won't find
'pure' 2600hz on the trunk. This Is not a perfectly safe way to box, but
it should slow down the discovery.

     As to use, the first thing you need to understand is that there are
two (2) types of toll completing trunk, inward and outward. The names
are reference to the office that is switching the call (the toll center
that serves the wats line you called) and each type of trunk has a
different class of service. From an inward toll completing trunk, you
can reach the different service operators, the toll test board, and the
inward operator. Some offices also allow remote testing and it is in
these offices that you can access the outward toll completing trunks.
The outward trunks allow you to make verification (emergency) calls, do
service monitoring (tapping), stack trunks (busy out all trunks between
LA and NYC), enable and disable TSPS positions, and in some cases (on
some 4A's) issue temporary rerouting instructions (send all calls from
LA to NYC via Miami, Boston, or any other class 5 office or offices).
Both type of trunk allow you to place a 'standard' call with a box.

     In some offices, mostly the small ones with a toll test board that
is unattended at night and on weekends, you change to an outward toll
completing trunk as well as performing other test and routing functions.
You do this by using three digit codes that are invalid exchanges (not
of the pattern NNX [see note 1]). During the sixites the codes used were
fairly standard and consistent, however when the boxes became popular
and the phreaks started doing things like routing all calls from Dallas
to Ft. Worth via Washtngton DC, Mother started changing the test codes
on a random (as far as I know ) basis. What I would suggest is that
everybody interested in doing this sort of thing pick out a nice quiet
little office somewhere and work on discovering the codes acceptable to
that office. Numbering Plan Area (NPA, also known as area code) has an
office designated as its master office. This office controls all of the
other toll offices in the area as well as serving as a concentration
point for most out of area calls. To access the services of a non master
office you need its 'city  code', this is a three (3) digit code that is
of the form 0XX, and is sent after the area code [see note 2 ]. As an
example, the 'city code' for Canton, OH. Is 042; thus to reach the
inward operator in Canton, you would send 'KP-216-042-121-S' where as if
you wanted the inward operator in Cleveland, you would send
'KP-216-121-S'. The reason this is necessary is that the operator in
Cleveland can't verify a number in Canton, so if you want to verify
someone in Canton you need the city code. Also, most area master offices
have dedicated data trunks to the network control center and thus don't
accept test and rerouting commands over the switched network. In
conclusion, the switching network will do a lot more for you then
connect you to people and the small offices that require a 'city code'
are the type of office to try to break.

                       Nickie Haflinger, The Coven.



     Note 1: The normal format for telephone numbers is as follows:
NYN/NNX-XXXX.  Where N=any digit except 1 and 0; Y=0 or 1, and X=any
digit. Yes I know that in some area codes the NNX format has changed to
NXX.  This is a new occurrence and only occur where there has be an
outrageous population increase in the last few years and all of the
funny exchanges are connected directly to master offices and thus don't
conflict with the 'city code' format

     Note 2: You can obtain the 'city code' for a number by calling rate
and route and asking for the 'numbers route' to NYN/NNX (IE. 914/725).
Or if you leave me a message with the area code and first three of a
number, I will get you the 'city code'.