The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/sysinfo/foneinfo.doc

Text File | 2003-06-11 | 19.8 KB | 431 lines

Bridging heads, residential and business multiline distribution boxes,line
and trunk splitters, and  other Bell system wire terminations.
   - How to use, and/or abuse them -
(including a tutorial on basic telephone eavesdropping techniques.)
***************************************
            Agent     07/29/84
                    04
***************************************
        In this article, I will first bescribe the termination, wiring, and
terminal hardware most commonly used in the Bell System, and I will include
a section on methods of using them.
***************************************
-------------
Local Network
-------------
        The local telephone network between the central office/exchange and
the telephone subscribers can be breifly described as follows:
        From the central office (or local exchange) of a certain prefix
(es), underground area trunks go to each area that has that prefix. (usu-
ally more than one prefix per area) at every few streets or tract areas,
the underground cables surface. they then go to the telephone pole (or
back underground, depending on the area) and then to the subsribers house
(or in the case of an apartment building or mutliline business, to
a splitter or distribution box/panel).

Now that we have the basics, I'll try and go in-depth on the subject.
------------------
Underground cables
------------------
        These are sometimes interoffice trunks, but usually in a resid-
ential area they are trunk lines that go oto bridging heads or distribution
cases. the cables are about 2-3 inches thick (varies), and are either in a
metal or pvc-type pipe (or similar).Rarely (maybe not in some remote rural
areas) are the cables just 'alone' in the ground. Instead, they are usually
in an underground cement tunnel (resembles a small sewer or stormdrain)
. The manholes are >heavy< and will say 'bell system' on them. They can be open
ed with a 1/2 inch wide crowbar (hook side) inserted in the top rectangular
hole. If you get it open, go inside!! There are ladder rungs to help you
climb down. You will see the cable pipes on the wall, with the blue and
white striped one being the interoffice trunk (at least in my area).
The others are local lines, and are usually marked or color coded. There
is almost always a posted color code chart on the wall, not to mention
telco manuals describing the cables and terminals, so I need not get into
detail. Again: >if you can get into a bell manhole, do it!, It will pay off
<. Also, there is usually some kind of test equipment, and often bell
test sets are left in there. So get your crowbars!

--------------
Bridging Heads
--------------
        The innocent-looking grayish-green boxes. These can be either
trunk bridges or bridging for residences. The major trunk bridging heads
are usually larger, and they have the 'western electric' logo at the bottom,
whereas the normal bridging heads (which may be different in some areas-
depending on the company you are served by. Gte b.h.'s look slightly
different. Also, do not be fooled by sprinkler boxes!) can be found in just
about every city. To open a bridging head:
If it is locked (and you're feeling destructive), put a hammer or crowbar
(the same one you used on the manhole) in the slot above the top hinge of
the right door. Pull hard, and the door will rip off. Very effective!
   If it isn't locked (as usual), take a 7/16 inch hex socket and
with it, turn the bolt about 1/8 of a turn to the right (you should hear
a spring release inside). holding the bolt, turn the handle all the way to
the left and pull out.
        Now inside, first check for a test-set (which are often left by
bell employees). There should be a panel of terminals and wires. Push
the panel back about an inch or so, and rotate the top latch (round with
a flat section) downward. Release the panel and it will fall all the way
forward. There is usually a large amo-unt of wire and extra terminals.
The test-sets are often hidden here, so dont overlook it (manuals, as
well, are sometimes placed in the head). On the right door is a metal box of
alligator clips. Take a few (compliments of bell...). On each door is a
useful little round metal device. (Says 'insert gently' or 'clamp gently - do
not overtighten' etc..) On the front of the disc, you should find two
terminals. These are for your test set. (If you dont have one, dont depair -
I'll show you ways to make basic test sets later in this article).
Hooking the ring (-) wire to the 'r' terminal; and the tip (+) wire
to the other. (By the way, an easy way to determine the correct polarity is
with a 1.5v led. Tap it to the term. pair, if i doesnt light, switch the
poles until it does. When it lights, find the longer of the two led poles.
This one will be on the tip wire (+)). Behind the disc is a coiled up cord.
This should have two alligator clips on it..its very useful, because you
dont have to keep connecting and disconnecting the fone (test set)
itself, and the clips work [DATA ERROR DATA LOST] e terminal pair
, and you're set! Dial out if you want,or just listen (if someone's on the
line). Later, I'll show you a way to set up a true 'tap' that you can set
up, and will let the person dial out on his line and receive calls as
normal, and you can listen in the whole time. More about this later...
        On major prefix-area bridging heads, you can see 'local loops',
which are two cable pairs (cable pair = ring+tip, a fone line) that
are directly connected to each other on the terminal board. These 'cheap
loops' as they are called, do not work nearly as well as the existing
ones set up in the switching hardware at the exchange office. (Try scanning
your prefixes' 00xx or 99xx #'s. The tone sides will announce themselves
with the 1000 hz loop tone, and the hang side will give no response. The
first person should dial the 'hang' side, and the other person dial the
tone side, and the tone should stop if you have got the right loop)
        If you want to find the number of the line that you're on, you can
either try to decipher the 'bridging log' (or whatever), which is on the
left door. if that doesnt work, you can use the follwing:
---
ANI # (Automatic Number Indentication)
---
        This is a telco test number that reports to you the number that
youre calling from (it's the same, choppy 'bell bitch' voice that you
get when you reach a disconnected #)

For the 213 NPA - dial 1223
        408 NPA - dial 760
        914 NPA - dial 990

These are extremely useful when messing with any kind of line terminals,
house boxes, etc.
        Now that we have bridging heads wired, we can go on... (dont forget to
close and latch the box after..wouldnt want to get and telco people mad, now,
would we?)
***************************************
------
"CANS" - Telephone pole distribution
------           boxes
Basically, two types:

1> Large, rectangular silver box at
    the end of each street.

2> Black, round or rectangular thing
    at every telephone pole.

Type 1 -   This is the case that takes the underground cable from the bridger
and runs it to the telephone pole cable (the lowest, largest wire on the
telephone pole). The box is always on the pole nearest the briging head,
where the line comes up. Look for the 'call before you dig - Underground
cable' stickers..
        The case box is hinged, so if you want to climb the pole, you can
open it with no problems. These usually have 2 rows of terminal sets. These
are all the cable pairs for your street. (Its similar to a miniature bridging
head). Use/abuse it in the same manner as we did before. (Note: all the active
lines carry from 15 to 48 vdc, and even 90vac (when ringing), so be
careful - It's not going to hurt you, but it can surprise you (and if
you're hanging by one hand from a telepole, it >can< be harmful!))
        Oh, by the way, if you use ANI on every pair and you find one
that isnt in use on your street, you can hook it up for yourself (almost).
Also, you have to be able to impersonate a telco technician and report
the number as 'new active' (giving a fake name and fake report, etc)
I dont recommend this and it probably wont (almost positively wont) work,
but this is basically what telco linemen do).

Type 2 - This is the splitter box
for the group of houses around the pole. (usually 4 or 5 houses). Use it
like i mentioned before. The terminals (8 or so) will be in 2 horizontal
rows of sets. The extra wires that are just 'hanging there' are provisions
for extra lines to residences (1 extra line per house, thats why the insane
charge for line #3!) If its the box for your house also, have fun and swap
lines with your neighbor! 'piggyback' them and wreak havoc on the neighborh
ood (it's eavesdropping time...) again, I dont recommend this, and its
difficult to do it correctly.
Moving right along..
***************************************
------------------------------
Apartment / Business Multiline
 Distribution Boxes
----------------------------
        Found outside the buliding (most often on the right side, but not
always..just follow the wire from the telephone pole) or in the basement.
It has the terminals for all the lines in the building. Use it just like any
other termination box as before. Usually says 'bell system' or similar.
Has up to 20 terminals on it (usually) the middle ones are grounds (forget
these). The wires come from the cable to one row (usually the left one)
, with the other row of terminals for the building fone wire pairs. The
ring (-) wire is usually the top terminal if the set in the row (1 of 10
or more), and the tip is in the clampscrew below it. This can be reversed,
but the cable pair is always terminated one-on-top-of-each-other, not on the
one next to it. (Im not sure why the other one is there, probably as a
provision for extra lines) dont use it though, it is usually to close to
the other terminals, and in my experiences you get a noisy connection.

Final note: Almost every apartment, business, hotel, or anywhere there
 is more than 2 lines this termination method is used. If you can master
 this type, you can be in control of many things... Look around in your
  area for a building that uses this type, and practice hooking up to
    the line, etc.

As an added help, here is the basic 'standard' color-code for multiline
   terminals/wiring/etc...

Single line:    red = ring
              green = tip
             yellow = ground (connected to l1 ringer coil in individual and
                      bridged ringer phones (bell only)) usually connected
                      to the green (tip)

Ring (-) = red
           white/red stripe
           brown
           white/orange stripe
           black/yellow stripe
Tip (+)  = green (sometimes yellow, see above ^)
           white/green stripe
           white/blue stripe
           blue
           black/white stripe
Ground   = black
           yellow
***************************************
----------------------
Residence terminal box
----------------------
Small, gray (can be either a rubber (pacific telephone) or hard plastic
(at & t) housing) deal that connects the cable pair from the splitter box
(see type 2, above) on the pole to your house wiring. Only 2 (or 4,
the 2 top terminals are hooked in parallel with the same line) terminals
, and is very easy to use. This can be used to add more lines to your
house or add an external line outside the house.
***************************************
Well, now you can consider yourself a minor expert on the terminals and
wiring of the local telephone network. Now you can apply it to whatever you
want to do.. heres another helpful item--
How to make a basic test-set and how to use it to dial out, eavsdrop, or
seriously tap and record line activity.

---------
TEST-SETS
---------

These are the (usually) orange hand set fones used by telco technicians to
test lines. To make a very simple one, take any bell (or other, but i recom-
mend a good bell fone like a princess or a trimline. GTE flip fones work
excellently, though..) Fone and cut off all the wires (including the
modular jack , if any) except the red (ring - ) and the green (tip +). If
they arent color-coded, they are usually the inner most two in the 4 con
ductor cable (the fone cord). Put alligator clips on it and use it as
described earlier. This will enable you to dial out and listen, but no extra
abilities.( You are in effect just an extension of their line).
        If you want to get more technical, or you just want to listen
without being heard (or detected in any normal way) you can use one of the
following test-set/tap fone designs, or make your own.

Test Set Version # 1
---------------- - -
        A 'black box' type fone mod will let you tap into their line,
and with the box on, it's as if youwerent there. They can recieve calls
and dial out, and you can be listening the whole time! very useful. With the
box off, you have a normal fone test set.
 Instructions:
Basic black box. Works well with good results. Take the cover off the
fone to expose the network box (bell type fones only). The <rr>
terminal should have a green wire going to it (orange or different
if touch tone - doesnt matter, its the same thing). Disconnect the
wire and connect it to one pole of an spst switch. Connect a piece of wire
to the other pole of the switch and connect it to the <rr> terminal. Now
take a 10k ohm 1/2 watt 10% resistor and put it between the <rr> terminal
and the <f> terminal, which should have a blue and a white wire going to
it (different for touch tone). It should look like this:

-----BLUE WIRE-----<F>
---WHITE WIRE-----/ !
                    !
               10K RESISTOR
                    !
--GREEN WIRE-     -<RR>
             !    !
             !    !
              SPST

What this does in effect is keep the hookswitch / dial pulse switch ( f
to rr loop) open while holding the line high with the resistor. This gives
the same voltage effect as if the fone was 'on-hook', while the 10k ohms holds
the voltage right above the 'off hook' threshold (around 22 volts or so, as
compared to 15-17 for normal off hook, 48 volts for normal 'on-hook'), giving
the best line volume and signal strength attainable without an external
amplifier.

Test-set version # 2
---------------- - -
        Another design (which I use on a GTE flip phone II with good res-
ults), is similar to the 'type 1' test set (above), but has some added
features:

FROM >-----------------TIP---<TO TEST
ALLIGATOR                     SET
CLIP >------ ----------RING--<PHONE
            !              !
            X              ^
            !             ! !
            O             < !
            !             > !
            !             > !
            !             ! !
            !    X--------- !
            !    X          !
            !----X          !
                 X----0-----!
X= SPST SWITCH
O= RED LED            0=GREEN LED
\/\/\=1.8K 1/2 WATT   XXXX= DPST SWITCH
        RESISTOR

        When the spst switch in on, the led will light, and the fone will become
active. The green light should be on. If it isn't, switch the dpst. If it
still isnt, check the polarity of the line and the leds. With both lights
on, hang up the fone. They should all be off now. Now flip the dpst and
pick up the fone. The red should be on, but the green shouldn't. If it is,
something is wrong with the circuit. You wont get a dial tone if all is
correct.
        When you hook up to the line with the alligator clips (assuming you have
put this circuit inside your fone and have put alligator clips on the ring
and tip wires (as we did before)) you should have the spst #1 in the off
posistion. This will greaty reduce the static noise involved in hooking up
to a line. the red led can also be used to check if you have the correct
polarity.
        With this fone you will have the ability to listen in on >all<
audible line activity, and the people (the 'eavesdropees') can use their
fone as normal.

Note that test sets #1 and #2 have
true 'black boxes', and can be used
for free calls (see an article about
black boxes).

Test Set version # 3
---------------- - -
        (Courtesy of> Lex Luthor <,
Sysop of Plover Net)
        Using a trimline (or similar) phone, remove the base and cut all of
the wire leads off except for the red (ring -) and the green (tip +).
Solder alligator clips to the lugs. The wire itself is 'tinsel' wrapped
on rayon, and doesnt solder well. Inside the fone handset, remove the
night light socket (if it has one) and install a small slide or toggle
switch (radio shack's microminiature spst works well). Locate the
connection of the ring and the tip wires on the pc board near where the jack is
located at the bottom of the handset. (The wires are sometimes black or brown
Instead of red and green, respectively). Cut the foil and run 2 pieces
of wire to your switch. In parallel with the switch add a .25 mf 200 vdc
capacitor (mylar, silvered mica, ceramic, not an electrolytic). When
the switch is closed, the handset functions normally. With the switch in
the other position, you can listen with out being heard.
(I would, once again, like to give credit to lex luthor for this simple
and effective design).

NOTE: To reduce the noise involved in connecting the clips to a line, add
a switch selectable 1000 ohm 1/2 watt resistor in series with the tip wire.
Flip it in circuit when connecting, and once on the line, flip it off
again. (Or just use the 'line disconect' type switch as in the type
2 test set (above)). Also avoid touching the alligator clips to any
metal parts or other terminals, for it causes static on the line and raises
poeple's suspicions.

Recording
---------

        If you would like to record any activity, use test set 1 or 2
above (for unattended recording of >all< line activity), or just any
test set if you are going to be there to monitor when they are dialing,
talking, etc. Place a telephone pickup coil (I recommend the recoton t-5 tp coil
or equivalent) onto the test set, and put the tp plug into the mic. Jack
of any standard tape recorder. Hit play, rec, and pause. Alternate pause
when you want to record (I dont think anyone should have any difficulty with
this at all...)

**************************************

Well, if you still cant make a test set or you dont have the parts, there's
still hope. Alternate methods:

1> Find a bell test set in a manhole or a bridging head and
   'borrow it indefinately'...

2> According to Sir Francis Drake, Test sets can be purchased from:

     Techni-Tool
    5 APOLLO ROAD
       BOX 368
   Plymouth Meeting
      PA., 19462

  ASK FOR CATALOG #28

They are usually $300 - $600, and are supposed to have mf dialing
capability as well as tt dialing. They are also of much higher quality
than the standard bell test sets.

***************************************
If you would like to learn more about
the subjects covered here, I suggest:

1> Follow bell trucks and linemen or technicians and ask subtle quest-
   ions. Also try 611 (repair service) and ask questions.
2> Explore your area for any bell hardware, and experiment with it.
   Dont try something if you are not sure what youre doing, because you
   wouldnt want to cause problems, Would you?

I hope the article was informative. Be looking for
'Invading the Bell System - Part II'

***************************************
WRITTEN BY:
              PHUCKED
        ***     AGENT    ***
                   04
07-29-84
           A.K.A.
                   PHREAK ADVISOR
> THE                C.O.R.E. DELTA
> SPINOFF MASTER      PVPC INNER CORE
***************************************















Downloaded from Just Say Yes. 2 lines, More than 500 files online!
         Full access on first call. 415-922-2008 CASFA