The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/general/verify.asc

Text File | 2003-06-11 | 6.7 KB | 98 lines

                                 Verification
                               By Fred Steinbeck

From TAP issue # 88  10-83

   There has been a great deal of controversy in the realm of phreakdom over a
mysterious subject known under a number of different names, including
"Verification", "Autoverification", "Verify", "Autoverify", "Verify Busy", and
even "VFY BY".  All of these names basically mean the same thing: the ability
to listen to another person's telephone line from any telephone in the
direct-dialable world.
   Needless to say, Bell System is very tight lipped about knowledge regarding
verification.  Indeed, the infamous book 'Notes on long distance dialing' ('68
edition) says, "Care must be taken to insure that the customer never gains
verification capabilities."  With a printed policy like that, you can imagine
what their real-world policy is like!  Even their own rate and route operators
will not give verification on routing codes (at least in my experience), one
even responding, "What?! You must be crazy! We don't give those out!" Before
you get too far into this article, I will state simply: I don't know how to
verify. However, I have been fooling with various things related to it, and
collecting information on it for some time now. Therefore, while I can't do it
(yet), I may be able to point some other bright TAPer on the right track, and
perhaps he or she will show us all how.  If you have knowledge not covered in
this article, but don't want to write an article on your own, please send your
ideas, comments, or information to Project Verify, C/O TAP   Verify has also
been called "Autoverify", and I have no idea why.  This is not, to my
knowledge, a Bell System term (at least I've never seen it in any manuals)  As
far as I know, there is verify, which means being able to listen to speech
(kind of; see below) on a line, and there is the "Emergency Interrupt which
allows you to take part in the conversation taking place on the line in
question.  It has been suggested that "Autoverify" is the same as an emergency
interrupt , but I tend to disagree with this idea.  It should be noted that the
verification circuitry does not actually let an operator listen to a
conversation without making a beep on the line every so often.  Instead, she
will hear encrypted speech.  However, I believe with the proper methods, verify
can be converted to an emergency interrupt.
   Verification is normally done either by your normal "0" (TSPS) operator, if
the call is in your home NPA (HNPA), or by an inward operator (IO).  If the
call is outside your HNPA, your normal operator will call the IO for the
NPA,and say, "Verify Busy" or "Emergency Interrupt" please, 555 1212."  The IO
will perform whatever magic he or she must, and then report back.  If the call
is in your HNPA, though, the "0" operator can do the verification herself by
using the "VFY BY" key on her keyshelf.  However, in some areas, the operator
uses a routing code to accomplish verification, and this the is loop hole we
shall attack.
  It follows that if a IO or "0" operator can do it, so can we, with a blue box
Now, courtesy of Robert Allen (who brought it to my attention) and Susan
Thunder (who apparently discovered it), here is what used to work for getting
operators to hook you into conversations with other people (i.e.,let you listen
to them till you hung up): You'd call the operator and say "Operator, TSPS
Maintenance Engineer Calling.  Ring forward to 001 + NPA + 7d, ring back to my
number, hit ring forward, no AMA, and then position release.
   This creates some problems, and you must be familiar with the TSPS
console(by dialing "0"), you are on the "back", or incoming part of a loop.
When she places a call for you, the call goes out on the "forward", or outgoing
part of the loop.  If an operator wants to make a call, she punches KP FWD
(keypulse forward), the number, and ST. Ring FWD puts a 90 volt ringing signal
across the forward part of the line (and may dial the number as well).  The
problem arises from the fact that I don't know if Ring FWD will actually dial a
call, and if there is some other subtle difference between it an KP FWD.
   Let us assume ringing forward makes a call from the TSPS console to whatever
number is given.  Ring back causes your phone to ring (it is assumed you hung
up after giving her your instructions; if you didn't you'd hear an annoying 90
volts across the earpiece...) "No AMA" means "no automatic message accounting",
so nobody gets billed for the call, although it will show up on a tape
somewhere.  "Position Release" removes the operator from the circuit, and
allows her to receive other calls.  This leaves an unaccounted-for ring
forward.
   The verification circuit, as you know, likes to encrypt conversation, which
is something we don't want.  Well, the second Ring FWD sends another  90 volts
crashing against the verify circuitry, which Juda Gerad thinks removes the
voice encryption from the line, puts the operator (and you) in circuit, and
puts a beep tone on the line every five seconds.  This seems to make sense, and
I am inclined to agree with him.
   The bit about "....001 + NPA + 7D" causes the thought "MF routing code" to
spring immediately to mind.  Now, the above trick was supposed to work in the
213 NPA.  I have tried both "KP+001+213+7D+ST", and some other area codes.  I
generally get nothing, a reorder signal, or a tandem recording.
   Here's some food for thought: On an official Telco sheet I have, labeled "
213 NPA MF Routing Codes", 001 is listed as "VFY BY", or verify busy for the
213 NPA.  002 is listed for the 805 NPA.  Ma Bell likes to have standardized
routing codes, such logical, then, that 001 would be a sort of "standard"
verify code, and other prefixes would be tacked on at 002,003, etc. However, I
have heard from a retired operator that verification codes are different from
area to area, and are not always nice numbers like 001, 002.  Ah, well, a guy
can hope, can't he?
   Some suggestions for future attacks on this dilemma: Everyone call your
operators and subtly ask questions.  I have found the tend to give information
out easier if you ask for something that you would ordinarily have to be a
company employee to know about, such as rate steps, operator routings, etc.
    Casually let slip that you used to be (or still are) an operator, or that
you work for company security.  Also, you might want to blue box some codes
like 001 followed by your NPA and the last 7D of a busy number.  If you get a
sort of "whispery noise", try blasting the line with a ringing signal (you
might piggyback another line onto yours and call the piggyback to generate the
90 volts) and see if that does anything.