The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/general/nfx_001.txt

Text File | 2003-06-11 | 16.4 KB | 324 lines

      The newsletter of the Society for the Freedom of Information (SFI)

                    =======================================
                    T H E   N E W   F O N E   E X P R E S S
                    =======================================


                              Electronic Edition
                Central distribution site is Secret Society BBS
                      [phone], WWIVNet 3460, 24hrs

------------------------------------------------------------------------------

The publisher, SFI, distribution site(s), and authors contributing  to  the  NFX
are protected by the Bill of Rights in the U.S. Constitution, which specifically
permits freedom of speech and freedom of the press.

We    accept    article    submissions    of    nearly    any    sort,     about
hack/phreak/anarchy/gov't/etc.  Send mail to the publisher (The Cavalier) at any
of these addresses:

WWIVnet  [120@3460]
VMB      [phone]. hit #, then 140.
The Internet address is temporarily closed.


The printed edition of the newsletter may  be  available  soon.  The  info  will
appear here as soon as possible.  To be quite honest, the printed version  looks
a hell of a lot better; but as of now, only the members of SFI receive it.

------------------------------------------------------------------------------








Highlights for Issue #1/Jun 1991
--------------------------------
Signaling System 7 Special Issue

   * Dialup List
     (see ref on page 2 top)

   * Reference of Recent Telco Terms
     (see ref on page 2 middle)

   * Signaling System 7 Updates
     (see ref on page 3 middle)
     * SUPPLEMENT: Known areas with Signaling System 7

   * Caller ID .. What does it mean to you?
     (see ref on page 4 top)

   * The State of Surveillance
     (see ref on page 4 middle)

   * Trend Watcher
     (see ref on page 5)

   * Editorial
     (see ref on page 5 middle)


                   National Dialup Table (updated 05/18/91)

Phone Number       Owned by       Status        Descript
-------------------------------------------------------------------------------
[phone]     MCI            Dangerous          6N/7N
[phone]     ?              ? (new)            7N
[phone]     Access         Billing            7N
[phone]     ? (SDN?)       ? (new)            6N
[phone]     ITT/Metro      Safe/?            13I
[phone]     ?              ?                  6N
[phone]     ? (SDN)        ?                 10N
[phone]     ? (SDN)        ?                 10N
[phone]     ? (SDN)        ?                 10N
[phone]     ? (SDN)        ?                 10N
[phone]     ? (SDN)        ?                 10N
[phone]     ? (SDN)        ?                 10N
[phone]     ? (SDN)        ?                 10N
[phone]     ?              ?                  7N
[phone]     ?              ?                  7I
[phone]     ? (Sprint?)    Uncer., watch it   6N
-------------------------------------------------------------------------------

* Notes on the above table:

    Description format is this standard: <Code Length><Code Format>, i.e. 7I is
a dialup that is ACN+7 digits.  6N is 6 digits+ACN.
    SDN is a type of system.  It is suspected AT&T, however some of these
dialups may be owned by other LD companies.
    The regional 950-XXXX dialups have been left out; they differ from LATA to
LATA (roughly an area code), and often the codes on them are regional.  However,
a few of them are 950-1407, 950-0511, 950-1011, etc.  1407 seems to be reliable
in CA.  I don't really recommend the use of 950s in particular - I will probably
have a table of 950s coming out in the future.
    Several people have had good results with 800-635-1167.

    By the way, any changes/additions/alerts are accepted.  Contact me or call
the SFI VMB.  PLEASE do not post any codes/etc on this box, just vague updates.
Thanks.



Telco Term Reference

     I strongly recommend you review this list before reading the article on
Signaling System 7.  These are by far not all of them, just essential ones
needed to deal with the article below.
SS7 - Signaling System 7.  See article.  Note: You need the DMS switch to run
SS7.
CCS - Common Channel Signaling.  Basically, sending call information across the
same line as voice.  A major part of SS7.
CO - Central Office.  The building(s) in your city that house the local
switching equipment.  Your telephone line is connected to one.
RBOC - Regional Bell Operating Company.  The seven companies that AT&T was split
up in the early '80s.  Also known as RHCs, or Regional Holding Companies.
ONA - Open Network Architecture.  A plan to open the telephone network up to
ESPs, who will provide services beyond basic switching.  Such services might be
cable TV, fast computer data channels, etc.  See ISDN, ESP, SS7.
ESP - Enhanced Service Provider.  See ONA definition.  The ESPs, who will
provide services such as computer linkups and cable TV when ONA is implemented,
are frustrated at the limitations of the RBOCs' ONA plans.  Some ESPs are the
major long-distance companies.
PSC - Public Service Commission.  The bureaucrats who set tariffs and decide on
exactly what your local Telco can do.
CLASS - Custom Local Area Signaling Services.  Part of the RBOC's SS7 plans,
these services, for example, include Caller ID, automatic call return and call
blocking.
LATA - Local Access Transport Area.  Roughly synonymous with area codes.  Your
LATA is defined by where you can call locally without having to call
long-distance.  In certain areas, like the Northeast, this may comprise three to
four area codes.
Call Control Options - Services such as call trace and call blocking that do not
need to be run using SS7.  They can be utilized on 5ESS switches.
DMS - Digital Multiplex Switch.  One of the most advanced phone company switches
on the market, this switch is necessary for SS7.  It is produced by Northern
Telecom.
ISDN - Integrated Services Digital Network.  A critical part of ONA, this is
basically a plan to provide optical fiber interconnects to households.  It will
allow much more than just a telephone conversation; it will also allow (among
other things) cable TV signals and SS7 communications.                    ><



Signaling System Seven Update

    Once again, your intrepid editor is back with the current compilation of
information regarding Signaling System Seven, or SS7.  If you haven't heard
about SS7 recently, or at all, here's your chance to catch up.  First, the
technical notes:

    SS7 is an international high-speed telecommunications network signaling
standard publicly announced in 1988.  It is a protocol for digital communication
between COs, ESPs and telephone subscribers.  It is made up of four basic
levels:  the bottom three (Signaling Data Link Functions, Signaling Link
Functions, and Signaling Network Functions) control the message transfer part,
and the top layer (Signaling Connection Control) controls additional services.

    The message transfer part controls the network itself, which is
packet-switched.  It handles all call control functions, and enables COs and
ESPs to transparently switch the call internally.  For example, if AT&T's SS7
software had been working properly, the network crash on 15 Jan 1990 would
probably have had negligible effects.  The network would have been able to route
the call around the malfunctioning switch while it reset.

    The signaling connection control part supports other services that may be
provided; such as call forwarding, caller ID, call trace, etc.  This layer is
the one that will be utilized by the ESPs when ONA is implemented; the message
transfer part is controlled by the RBOCs.

    The architecture of SS7 will bring the telecommunications network into
tomorrow, and coupled with broadband ISDN and ONA, is the network of the future.
However, this will also insure that the RBOCs have a major part in this future.
Not to mention the fact that this will put the RBOCs in control of everything
that comes down the cable.

    Now, what SS7 really means:

    Signaling System Seven will basically allow the phone company to route your
call information from point to point until your final destination.  In other
words, in 1991 (in most regions), if you wanted to make sure a system didn't
trace you back, you could call through a few diverters, PABXs, etc.  However,
when SS7 is installed throughout the nation, your call information will be
routed from diverter to PABX to system instead of stopping at the first
diverter.   Us common people can buy this feature too -- see "Caller ID - What
does it mean to me?" below.
><


                         Areas with SS7 as of 04/17/91
-------------------------------------------------------------------------------
All of New Jersey            United & NJ Bell
Las Vegas, Nevada            Centel
Northeast Virginia           Bell Atlantic?
Washington, D.C.             Bell Atlantic?
Austin, Texas                Southwestern Bell
Kentucky (unknown where)     GTE
Olathe, Kansas               Southwestern Bell
-------------------------------------------------------------------------------
    As with all our tables, any additions/corrections? Let us know.



Caller ID ... what does it mean to me?

    Caller ID is probably the most anticipated and feared part of Signaling
System 7.  This service, only available in SS7 areas (see above table), keeps
track of the last 10 numbers that called and the time and date they did so.
Example:  Let's say you are in an SS7 area.  You call a friend with a Caller ID
device (generally costing about $40).  Between the first and second ring, they
have your number.  It's as easy as that.  The problem is, when SS7 goes
nationwide, ANY system you hack/phreak/phuck/whatever pegs you within 5 seconds
of your call.  I can hear you say, "What about diverters, and stuff like that?"
Well, for one thing, there won't BE too many diverters left after this goes
worldwide.  The second thing is that if the system is serious enough about
getting your number, it can pick the call information straight up off layer 4 of
the call -- in other words, your call information, instead of stopping stone
cold at the diverter, was passed from node to node up to your intended system.
Cute, eh? .. but only if you're BEHIND the trigger.  So, what can be done about
it?  Well, I am told that PSCs around the nation have been requiring that your
local RBOC provide per-call blocking of Caller ID whenever they decide to go
install SS7.  This is good: You dial something like *67 and then the number, and
the information is blocked.  However, the Telco still gets the call info (but
then again, they always have..).  Also, you hardware people out there, I suggest
you work on finding out more about Caller ID - and figure out where in the
bandwidth this info is... sigh..                                       ><


The State of Surveillance
(part one of a series)

    I figured it was about time for an update on government and private
surveillance techniques and what you can do about them.  First, we'll start off
with ways to spy, if you will.  The all-time favorite technique seems to be
tapping the telephone in some way - whether it be from wiring your phone for an
infinity transmitter, wiring your junction box, induction tapping your wires, or
taps at the local CO, the phone line is one of the most commonly tapped items.
An infinity transmitter, aka a harmonica bug, has to be installed inside your
phone.  It works by intercepting all calls into the house and looking for a tone
around the first ring.  It then uses the microphone on the handset to pick up
what's going on inside the house, while the phone is on the hook.  What the
person would do is call your house, and while the phone is ringing, he would
send a tone down through the line.  You wouldn't hear that first ring because
the bug traps it, and he could listen to anything going on in the house.  The
way to check for one of these is to either open up your phone or to call a tone
sweep, available in most areas.  At a certain frequency, the bug would kick in
and your phone would start either ringing or making strange noises.

    Another popular technique is wiring junction boxes, aka pedestals or cans.
This is the large, 6 foot green box with the Bell logo on it with 1000
connections inside, or the small, 3 or 4 foot green box with the Bell logo on it
with 7 through 60 connections.  These boxes contain rows of wire pairs.  Your
adversary could open one of these up, find your wire pair with an ANI, and hook
up some sort of recording device or jumper cable to it.  In effect, it is like
picking up an extension outside the building.  The way to detect it is to either
look for a marked impedance drop on your phone, notice that people sound softer,
or go outside and find your pedestal and examine it.

    The perennial inductance tap is a relatively secure tap - unless you catch
your 'bugger' outside near your phone wires doing strange things, it's
undetectable.  Basically, a coil of wire and an amplifier are hooked together
and brought near your telephone wires somewhere -- he doesn't have to splice
them.  Through the principles of electric induction, he can hear everything said
on that line.  As I said, this bug is very hard to detect.

    And finally, perhaps the hardest bug to detect at all: the telephone CO bug.
If the Feds are really serious about tapping you, they won't hook up
crude-as-hell wiretaps -- they'll go to your local central office and monitor
your line from there.  It is virtually undetectable if done right; if done
wrong, you have no way of proving they did it...

    The next installment will cover non-telephone audio bugs.               ><



Trend Watcher

    This column will cover small interesting bits of information and trends that
either I or any of you notice.  Have any?  Let me know.

AT&T makes money selling 5ESS switches to other countries.
MCI 800 ANI network pegs your number in under one minute in xESS areas.
18-Gigahertz transmission is now economically feasible; radio waves at that
frequency act like light.
In a vote of 5-0, the FCC approves an independently-developed stage of ONA to
the dismay of the Baby Bells, opening up the fiber network to ESPs of all kinds.
Las Vegas telephone network is the most advanced in the nation.
In 1989, the FCC busted 144 pirate radio station operators, both medium-wave and
shortwave, and charged a total of $347,000 in fines.                     ><


Editorial
"Too much to say, and not enough space to say it in"

    Well, you're almost at the end of our first issue.  Do you like it?  Can you
write better articles? (Which won't be hard, considering I wrote all of them in
this issue..)  By all means, send them to me.  An article on IBM Phonemail? Or
maybe a doc on how the gov't is really putting one over on us this time?  I'll
take it.  You know how to get in touch with me... A slower way to do so is to
use the VMB, at 301-771-1151 box #140. You might have to press the pound key
first, I don't remember.  But in any case, don't put anything illegal on the SFI
box, like codes, etc - just news and messages to me.  By the way, if you stumble
upon a small bit of news that's important, call it and leave it there..

    The reason that our first issue is on Signaling System Seven is because this
will be one of the most important phone company developments since the invention
of the ESS switch.  Read the set of articles that are on it and maybe you will
understand why.  Loss of privacy and profiteering of the phone networks just so
Domino's Pizza can route a call from a WATS number to the closest Domino's
location nearest you so you don't have to go through the mental and physical
anguish of looking it up in the telephone book.  Brighten up, men, this is
progress at work!

    In any case, what I can leave you with are these thoughts: support the
Electronic Frontier Foundation, the Free Software Foundation, the League for
Programming Freedom, and any organization that supports open thought.  Fight the
secret policies and projects of a dishonest government that perpetuates
hypocrisy, and keep looking over your shoulder for Big Brother.         ><