The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/boxes/blue2.phk

Text File | 2003-06-11 | 5.9 KB | 105 lines

                                    THE
                                   BLUEBOX


   THE "BLUE BOX" WAS SO NAMED BECAUSE OF THE COLOR OF THE FIRST ONE FOUND.
THE DESIGN AND HARDWARE USED IN THE BLUE BOX IS FAIRLY SOPHISTICATED, AND
ITS SIZE VARIES FROM A LARGE PIECE OF EQUIPMENT TO THE SIZE OF A PACK OF
CIGARETTES.

   THE BLUE BOX CONTAINS 12 OR 13 BUTTONS OR SWITCHES THAT EMIT MULTI-
FREQUENCY TONES CHARACTERISTIC OF THE TONES USED IN THE NORMAL OPERATION OF
THE TELEPHONE TOLL (LONG DISTANCE) SWITCHING NETWORK. THE BLUE BOX ENABLES
THE USER TO PLACE PHREE LONG DISTANCE CALLS BY CIRCUMVENTING TOLL BILLING
EQUIPMENT. THE BLUE BOX MAY BE DIRECTLY CONNECTED TO A PHONE LINE,
OR IT MAY BE ACOUSTICALLY COUPLED TO A TELEPHONE HANDSET BY PLACING THE
BLUE BOX'S SPEAKER NEXT TO THE TRANSMITTER OR THE TELEPHONE HANDSET.

    TO UNDERSTAND THE NATURE OF A FRAUDULENT BLUE BOX CALL, IT IS
NECESSARY TO UNDERSTAND THE BASIC OPERATION OF THE DIRECT DISTANCE
DIALING (DDD) TELEPHONE NETWORK. WHEN A DDD CALL IS PROPERLY ORIGINATED, THE
CALLING NUMBER IS IDENTIFIED AS AN INTEGRAL PART OF ESTABLISHING THE
CONNECTION. THIS MAY BE DONE EITHER AUTOMATICALLY OR, IN SOME CASES, BY AN
OPERATOR ASKING THE CALLING PARTY FOR HIS TELEPHONE NUMBER. THIS INFORMATION
IS ENTERED ON A TAPE IN THE AUTOMATIC MESSAGE ACCOUNTING (AMA) OFFICE. THIS
TAPE ALSO CONTAINS THE NUMBER ASSIGNED TO THE TRUNK LINE OVER WHICH THE CALL
IS TO BE SENT. THE INFORMATION RELATING TO THE CALL CONTAINED ON THE TAPE
INCLUDES: CALLED NUMBER INDENTIFICATION, TIME OF ORIGINATION OF CALL, AND INFO
THAT THE CALLED NUMBER ANSWERED THE CALL AND TIME OF DISCONNECT AT THE END
OF THE CALL.

   ALTHOUGH THE TAPE CONTAINS INFO WITH RESPECT TO MANY DIFFERENT CALLS, THE
VARIOUS DATA ENTRIES WITH RESPECT TO A SINGLE CALL ARE EVENTUALLY CORRELATED
TO PROVIDE BILLING INFO FOR USE BY YOUR BELL'S ACCOUNTING DEPARTMENT.

   THE TYPICAL BLUE BOX USER USUALLY DIALS A NUMBER THAT WILL ROUTE THE CALL
INTO THE TELEPHONE NETWORK WITHOUT CHARGE. FOR EXAMPLE, THE USER WILL VERY
OFTEN CALL A WELL-KNOWN INWATS (TOLL-FREE) CUSTOMER'S NUMBER. THE BLUE BOX
USER, AFTER GAINING THIS ACCESS TO THE NETWORK AND, IN EFFECT, "SEIZING"
CONTROL AND COMPLETE DOMINION OVER THE LINE, OPERATES A KEY ON THE BLUE BOX
WHICH EMITS A 2600 HERTZ (CYCLES PER SECOND) TONE. THIS TONE CAUSES THE
SWITCHING EQUIPMENT TO RELEASE THE CONNECTION TO THE INWATS CUSTOMER'S LINE.
THE 2600HZ TONE IS A SIGNAL THAT THE CALLING PARTY HAS HUNG UP. THE BLUE BOX
SIMULATES THIS CONDITION. HOWEVER, IN FACT THE LOCAL TRUNK ON THE CALLING
PARTY'S END IS STILL CONNECTED TO THE TOLL NETWORK. THE BLUE BOX USER NOW
OPERATES THE "KP" (KEY PULSE) KEY ON THE BLUE BOX TO NOTIFY THE TOLL SWITCH-
ING EQUIPMENT THAT SWITCHING SIGNALS ARE ABOUT TO BE EMITTED. THE USER THEN
PUSHES THE "NUMBER" BUTTONS ON THE BLUE BOX CORRESPONDING TO THE TELEPHONE #
BEING CALLED. AFTER DOING SO HE/SHE USES THE "ST" (START) KEY TO TELL
THE SWITCHING EQUIPMENT THAT SIGNALLING IS COMPLETE. IF THECALL IS COMPLETED,
ONLY THE PORTION OF THE ORIGINAL CALL PRIOR TO THE 'BLAST' OF 2600HZ TONE IS
RECOR
   ALTHOUGH THE ABOVE IS A DESCRIPTION OF A TYPICAL BLUE BOX CALL USING A
COMMON WAY OF GETTING INTO THE NETWORK, THE OPERATION OF A BLUE BOX MAY VARY
IN ANY ONE OR ALL OF THE PHOLLOWING RESPECTS:

      (A) THE BLUE BOX MAY INCLUDE A ROTARY DIAL TO APPLY THE 2600HZ TONE
          AND THE SWITCHING SIGNALS. THIS TYPE OF BLUE BOX IS CALLED A "DIAL
PULSER" OR "ROTARY SF" BLUE BOX.

      (B) GETTING INTO THE DDD TOLL NETWORK MAY BE DONE BY CALLING ANY
          OTHER TOLL-FREE # SUCH AS UNIVERSAL DIRECTORY ASSISTANCE (555-1212)
OR ANY NUMBER IN THE INWATS NETWORK, EITHER INTER-STATE OR INTRA-STATE,
WORKING OR
      (C) ENTRANCE INTO THE DDD TOLL NETWORK MAY ALSO BE IN THE FORM OF
          "SHORT HAUL" CALLING. A "SHORT HAUL" CALL IS A CALL TO ANY # WHICH
WILL RESULT IN A LESSER AMOUNT OF TOLL CHARGES THAN THE CHARGES FOR THE CALL
TO BE COMPLETED BY THE BLUE BOX. FOR EXAMPLE, A CALL TO BIRMINGHAM FROM
ATLANTA MAY COST $.80 FOR THE FIRST 3 MINUTES WHILE A CALL FROM ATLANTA TO
LOS ANGELES IS $1.85 FOR 3 MINUTES. THUS, A SHORT HAUL, 3-MINUTE CALL TO
BIRMINGHAM FROM ATLANTA, SWITCHED BY USE OF A BLUE BOX TO LOS ANGELES, WOULD
RESULT IN A NET FRAUD OF $1.05 FOR A 3 MINUTE CALL.

       (D) A BLUE BOX MAY BE WIRED INTO THE TELEPHONE LINE OR ACOUSTICALLY
           COUPLED BY PLACING THE SPEAKER OF THE BLUE BOX NEAR THE TRANSMITTER
OF THE PHONE HANDSET. THE BLUE BOX MAY EVEN BE BUILT INSIDE A REGULAR
TOUCH-TONE
       (E) A MAGNETIC TAPE RECORDING MAY BE USED TO RECORD THE BLUE BOX
           TONES FOR CERTAIN PHONE NUMBERS.  THIS WAY, IT'S LESS CONSPICOUS TO
USE SINCE YOU JUST MAKE IT LOOK LIKE A WALKMAN OR WHATEVER, INSTEAD OF A BOX.

   ALL BLUE BOXES, EXCEPT "DIAL PULSE" OR "ROTARY SF" BLUE BOXES, MUST HAVE
THE FOLLOWING 4 COMMON OPERATING CAPABILITIES:

       (A) IT MUST HAVE SIGNALLING CAPABILITY IN THE FORM OF A 2600HZ
           TONE. THIS TONE IS USED BY THE TOLL NETWORK TO INDICATE, EITHER BY
ITS PRESENCE OR ITS ABSENCE, AN "ON HOOK" (IDLE) OR "OFF HOOK" (BUSY) CONDITION
OF THE TRUNK.

       (B) THE BLUE BOX MUST HAVE A "KP" TONES THAT UNLOCKS OR READIES THE
           MULTI-FREQUENCY RECIEVER AT THE CALLED END TO RECEIVE THE TONES
CORRESPONDING TO THE CALLED PHONE #.

       (C) THE TYPICAL BLUE BOX MUST BE ABLE TO EMIT MF TONES WHICH ARE USED TO
TRANSMIT PHONE #'S OVER THE TOLL NETWORK. EACH DIGIT OF A PHONE # IS
REPRESENTED BY A COMBINATION OF 2 TONES.  FOR EXAMPLE, THE DIGIT 2 IS X-MITTED
BY A COMBINATION OF 700HZ AND 1100HZ.

       (D) THE BLUE BOX MUST HAVE AN "ST" KEY WHICH CONSISTS OF A COMBINA-
           TION OF 2 TONES THAT TELL THE EQUIPMENT AT THE CALLED END THAT ALL
DIGITS HAVE BEEN SENT AND THAT THE EQUIPMENT SHOULD START SWITCHING THE CALL
TO TH
THE "DIAL PULSER" OR "ROTARY SF" BLUE BOX REQUIRES ONLY A DIAL WITH A
SIGNALLING CAPABILITY TO PRODUCE A 2600HZ TONE.