The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/general/step.phk

Text File | 2003-06-11 | 9.0 KB | 147 lines

File: STEP BY STEP OFFICES
 Read 10 times

             THE SIMPLE PLEASURES OF A STEP OFFICE
                  [2600 -- May 1984]

   There are still more than a few step offices in the United States today.
Most of them are in rural areas, but there are still a few cities (mostly in
south, southwest, and west ares of the country) that have step.  These
antiquated telephone systems can best be described as a bunch of relays and
wires--clicking and stumbling over themselves.

   It's easy to find out if you're in a step office--especially if you're using
a rotary dial phone.  (In many step areas, that's all you can have, particulary
on the east coast since they don't have what's known as common control, which
allows for touch-tones(R).  Some offices have been converted, however, using
some sort of tone to pulse converter--every time you hit a tone, you hear it
being pulsed out.)  With a rotary dial phone, you can hear the actual
switching.  If, say, you're dialing 675-9112--you'd dial a 6 and you'd hear
what's known as the selector kick in (more on that later) with a kind of a
clunk.    Then you'd dial a 7, and hear a second thing kick in with a mild
click--that's what's known as the digit absorbing relay.  Depending on the
office, this relay can kick in on any or none of the numbers.  What it does
basically is absorb an extra digit which is only needed to make the telephone
number 7 digits long.  So, in this case, the second digit of the number, which
is 7, is the extra digit.  You would probably be able to substitute any number
for the 7 and still have the call go through, since that digit is ignored.
Some offices absorb two of their digits, which means that they had five digit
phone nmbers before uniformity struck.    To continue with our Demonstration,
you'd next dial a 5, and hear another click at the end of your dialing
sequence. After dialing 9, you'd hear click, pop, snap--several things kicking
in, then th 1, clunk-clink, and then the last two digits which wouldn't produce
any sounds at the end of them.    Then it will go into a ring cycle, assuming
that's a valid number in the office.

   Step offices usually have a very mechanical sounding ring, similar to
crossbar.  Ring generators, though, can make step sound like ESS.  Often you
hear what sounds like a busy signal or static in the background as the number
rings.    An easy way to tell if you're dialing into a step office is to try
dialing XXX-1111 and see how long it takes to get a ring or reorder or
whatever.  Then try calling XXX-0000.  If it takes more time to get to the same
point, it's a step office bacause step is the only system that actually pulses
out the numbers all over again.

                 A Phreaker's Delight

   It's much safer to blue box and phreak from a step office bacause they're
very basic, crude offices with no safety features (safety for them, that is).
And if you're lucky enough to live in a fairly large metropolitian area that's
still on step, you might dial up a number that you know is ESS from you step
area and flash the switchhook.    You'll get what's known as a wink.  That's the
equivalent of whistling 2600 hertz for about a half second to reset the trunk.
You'll hear click-click  That's you cue to put in various multifrequency tones
(KP + number + ST).  2600 hertz is not needed at all, and since that's the tone
that usually sets off alarms, this is a very safe way to blue box.
(Incidentally, this occurs more through a flaw with ESS and not step.)

   If you really know what you're doing and you know a few things about step
switching, you can, on a touch tone(R) phone, dial up a number and listen in
the background for the switch level.  Let's say you're dialing 941-0226.  You
won't hear it rotary dial those numbers, but you will hear another number or
series of numbers in rotary step pulses.  That's the selector we mentioned
earlier.  Let's say that after you dialed 941-0226, you heard a 5 being pulsed
out.  What does that mean?  The selector is the decision-making part of the
phone call.  Different prefixes are stored in different levels in each central
office.  In this particular case, 941 happens to be stored in level 5 in
whatever office you're calling from.  There's no rhyme or reason to it; the
selector level could be anything up to three digits in length.    (If it was
three digits, you'd hear each individual digit get pulsed out.)  The toll
center is usually level 1 and the operator is usually level 0.    So what can be
done with this information?  If, after dialing 941-0226, you enter your own
rotary five, you'll once again hear the click-click which is your cue for MF
tones.

   While step offices have no special phone phreak trapping capabilities, they
a just as dangerous as any other office as far as being traced.  They have
what's known as trap and trace.  If a certain person (or computer) is begin
harrassed, they'll put a trap plug on a particular line.  If you happen to call
into that number, you won't be able to hang up until the other party does.

                   Some More Tricks

   In some step areas, local calls are limited to certain exchanges that have
th same first digits as yours.    For example, the 222 exchange can dial 235 and
263 as local calls.  But in order to call the 637 exchange, you must first dial
a 1 which makes the call non-local.  If you dial a 6, you'll get an immediate
reorder.  But somewhere between you and the 637 exchange, is the 231, 233, 235,
and 239 exchanges.  There's no 237.  So you dial 2.  Clunk-clunk.  You dial 3.
Click. And then you dial 7. Ching-clunk. It goes to the 637 exchange!
Similarly, a 281 from he 287 exchange could wind up in 471.  Why?  Because
these numbers are all coming from the same switching center.  That just happens
to be the way step works (and in some cases crossbar).    If you could seize the
222 trunk, you'd enter KP+25500+ST to reach 222-5500.  To reach 637-5500, you'd
enter KP+755000+ST.

   Then there's "step crashing"--if the number you're calling is 675-2888, and
it's busy, you can dial 675-2887, and in between the last pulse of your rotary
dial and the time it would start to ring, you can flash you switchhook
extremely fast.  If you time it right, you'll hear an enormous loud click at
your end.  Then, all of the sudden, you'll cut into your party's conversation.
(This works bacause of step's realy system.  One relay has determined that the
line you dialed is open.  Then, before a second relay sends along the ring
pulse, you throw in a 1, which jumps the number you dialed up by one, and fools
the system into connecting you to a busy number.)  There is one drawback to
this, though.  You, the party you've crashed in on, and the party they were
talking to are all stuck together until you all hang up at the same time.

   If you're in a step office where 411 is used for directory assistance,
chances are that there are test codes in the format of 11XXX.  1191 might be
ringback, etc. In such places, dialing 1141 will also get you directory
assistance, but at no charge!  In some of the newer step offices, 410X is the
format for tests.  There, you can dial 4101 for free directory assistance.
Other test numbers are (usually):  4100 -- off-the-hook recording, 4102 -- test
board, 4103 -- miscellaneous, 4104 -- ringback, 4105 -- disconnects you line
for about 5 minutes, 4106 -- various tests, 4107 -- pulse test, 4108 -- test
board, 4109 -- your telephone number in touch tones (R).

              Different Varieties of Step

   There's more than one kind of step office.  We've been talking about the
most common type, used by both GTE and Western Electric (Bell).  It was
invented by Automatic Electric early in the century.  214-281 is a typical Bell
step office (not the reorder in the background ring) while 214-256 is a typical
GTE step office (the ring sounds like it's underwater).  For both of these, a
suffix of 1798 will always provide a busy signal, free of charge.

   There is also something known as XY step, which is strange, unusual, and for
the most part put together very poorly.  It looks similar to a crossbar in
appearance.  Instead of a round switch, it's tall and rectangular-shaped.  To
dial a number, it moves up and across a ladder of contacts, as if it was a
piece of graph paper, hence the name XY.  On these systems, the last digit in
th phone number is usually up for grabs.  You can accept collect calls on a
number with a different last digit from yours.    The calls will still reach your
number, but it won't show up on your bill.  Also, suffixes beginning with 9 and
2 are usually interchangeable.    A typical XY step office is 518-789.  A suffix
of 3299 will get you a standard step test.

   Great Britian uses the Stroger system and there is also the all-relay step,
which is very rare.  It was developed presumably to save switches.  One such
system exists in Heath Canyon, Texas with only 36 subscribers at 915-376.  A
neighboring town that's also all-relay can be found at 915-386.

[Courtesy of BIOC Agent 003 & Sherwood Forest ][ -- [phone]]

-----End of File