Hacker Chronicles 1/HACKER1.ISO/miscpub1/hu1.txt

Text File | 1992-09-26 | 23KB | 323 lines

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                          "The Blue Box And Ma Bell"
                     Herb Friedman, Communications Editor
                           Radio Electroncs Magazine
                                 November 1987


                                  Typed By :
                                Cardiac Arrest

Before the breakup of AT&T, Ma Bell was everyone's favorite enemy.  So it was
not surprising that so many people worked so hard and so successfully at
perfecting various means of making free and untracable telephone calls.
Whether it was a "Red Box" used by Joe and Jane College to call home, or a
"Blue Box" used by organized crime to lay off untracable bets, the technology
that provided the finest telephone system in the world contained the seeds of
it's own destruction.
        The fact of the matter is that the Blue Box was so effective at making
untracable calls that there is no estimate as to how many calls were made or
who made them.  No one knows for certain whether Ma Bell lost revenues of $100,
$100-million, or $1-billion on the Blue Box.  Blue Boxes were so effective at
making free, untracable calls that Ma Bell didn't want anyone to know about
them, and for many years denied their existence.  They even went as far as
strong-arming a major consumer science magazine into killing an article that
had already been prepared on the Blue and Red boxes.  Further, the police
records of a major city contain a report concerning a break-in at the residence
of the author of that article.  The only item missing following the break-in
was the folder containing copies of the earliest Blue-Box designs and a
Bell-System booklet that described how subscriber billing was done by the AMA
machine--a booklet that Ma Bell denied ever existed [article includes picture
proving otherwise - Cardiac].  Since the AMA (Automatic Message Accounting)
machine was the means whereby Ma Bell eventually tracked down both the Blue
and Red Boxes, we'll take time out to explain it.  Besides, knowing how the AMA
machine works will help you to better understand "phone phreaking."

WHO MADE THE CALL
        Back in the early days of the telephone, a customer's billing was
originated in a mechanical counting device, which was usually called a
"register" or a "meter."  Each subscriber's line was connected to a meter that
was part of a wall of meters.  The meter clicked off the message units, and
once a month someone simply wrote down the meter's reading, which was later
interpolated into message-unit billing for those subscriber's who were charged
by the message unit.  (Flat rate subscriber's could make unlimited calls only
within a designated geographic area.  The meter clicked off message units for
calls outside that area.)  Because eventually there were too many meters to
read individually, and because more subscribers started questioning their
monthly bills, the local telephone companies turned to photography.  A
photograph of a large number of meters served as an incontestable record of
their reading at a given date and time, and was much easier to convert to
customer billing by the accounting department.
        As you might imagine, even with photographs billing was cumbersome and
did not reflect the latest technical developments.  A meter didn't provide any
indication of what the subscriber was doing with the telephone, nor did it
indicate how the average subscriber made calls or the efficiency of the
information service (how fast the operators could handle requests).  So the
meters were replaced by the AMA machine.  One machine handled up to 20,000
subscribers.  It produced a punched tape for a 24-hour period that showed,
among other things, the time a phone was picked up (went off-hook), the number
dialed, the time the called party answered, and the time the originating phone
was hung up (placed on-hook).
        One other point, which will answer some questions that you're certain
to think of as we discuss the Red and Blue boxes: Ma Bell did not want persons
outside their system to know about the AMA machine.  The reason?  Almost
everyone had complaints--usually unjustified--about their billing.  Had the
public been aware of the AMA machine they would have asked for a monthly list
of their telephone calls.  It wasn't that Ma Bell feared errors in billing;
rather, they were fearful of being buried under an avalanche of paperwork and
customer complaints.  Also, the public beleived their telephone calls were
personal and untraceable, and Ma Bell didn't want to admit that they knew about
the who, when, and where of every call.  And so Ma Bellalways insisted that
billing was based on a meter unit that simply "clicked" for each message unit;
thatthere was no record, other than for long-distance calls, as to who called
whom.  Long distance was handled by, and the billing information was done by
and operator, so there was a written record Ma Bell could not deny.
        The secrecy surrounding the AMA machine was so pervasive that local,
state, and even federal police were told that local calls made by criminals
were untraceable, and that people who made obscene telephone calls could not be
tracked down unless the person receiving the cals could keep the caller on the
line for some 30 to 50 minutes so the connections could be physically traced by
technicians.  Imagine asking a woman or child to put up with almost an hours
worth of the most horrendous obscenities in the hope someone could trace the
line.  Yet in areas where the AMA machine had replaced meters, it would have
been a simple, though perhaps time-consuming task, to track down the numbers
called by any telephone during a 24-hour period.  But Ma Bell wanted the AMA
machince kept as secret as possible, and so many a criminal was not caught, and
many a woman was harried by the obscene calls of a potential rapist, because
existence of the AMA machine was denied.
        As a sidelight as to the secrecy surrounding the AMA machine, someone
at Ma Bell or the local operating company decided to put the squeeze on the
author of the article on Blue Boxes, and reported to the treasury Department
that he was, in fact, manufacturing them for organized crime--the going rate in
the mid 1960's was supposedly $20,000 a box.  (Perhaps Ma Bell figured the
author would get the obvious message: Forget about the Blue Box and the AMA
machine or you'll spend lots of time, and much money on lawyer's fees to get
out of the hassles it will cause.)  The author was suddenly visited ay his
place of employment by a Treasury agent.  Fortunately, it took just a few
        minutes to convince the agent that the author was really just that, and
the a technical wizard working for the mob.  But one conversation led to
another, and the Treasury agent was astounded to learn about the AMA machine.
(Wow!  Can an author whose story is squelched spill his guts.)  According to
the treasury agent, his department had been told that it was impossible to get
a record of local calls made by gangsters: The Treasury department had never
been informed of the existence of automatic message accounting.  Needless to
say, the agent left with his own copy of the Bell System publication about the
AMA machine, and the author had an appointment with the local Treasury-Bureau
director to fill him in on the AMA Machine.  That information eventually ended
up with Senator Dodd, who was conducting a congressional investigation into,
among other things, telephone company surveillance of subscriber lines--which
was a common practice for which there was detailed instructions, Ma Bell's own
switching equipment ("crossbar") manual.

THE BLUE BOX
        The Blue Box permitted free telephone calls because it used Ma Bell's
own internal frequency-sensitive circuits.  When direct long-distance dialing
was introduced, the crossbar equipment knew a long-distance call was being
dialed by the three-digit area code.  The crossbar then converted the dial
pulses the the CCITT tone groups, shown in Table 1 [I'll put the table in at
the end of the file - Cardiac], that are used for international and truckline
signalling.  (Not that those do not correspond to Touch-Tone frequencies.)  As
you can see in that table, the tone groups represent more than just numbers;
among other things there are tone groups indentified as KP (prime) and ST
(start)--keep them in mind.  When a subscriber dialed an area code and a
        telephone number on a rotary-dial telephone, the crossbar automatically
conneceted the subscriber's telephone to a long-distance truck, converted the
dial pulses to CCITT tones sent out on the long-distance trunk that set up or
selected the routing and caused electro-mechanical equipment in the target city
to dial the called telephone.
        Operator-assisted long-distance calls worked the same way.  The
operator simply logged into a long-distance trunk and pushed the appropriate
buttons, which generated the same tones as direct-dial equipment.  The button
sequence was KP (which activated the long-distance equipment), then the
complete area code and telephone number.  At the target city, the connection
was made to the called number but ringing did not occur until the operator
there pressed the ST button.  The sequence of events of early Blue Boxes went
        like this: The caller dialed information in a distant city, which
caused his AMA machine to record a free call to information.  When the
information operator answered, he pressed the KP key on the Blue Box, which
disconnected the operator and gave him access to a long-distance trunk.  He
then dialed the desired number and ended with an ST, which caused the target
phone to ring.  For as long as the conversation took place, the AMA machine
indicated a free call to an information operator.  The technique required a
long-distance information operator because the local operator, not being on a
long-distance trunk, was accessed through local wire switching, not the CCITT
tones.

CALL ANYWHERE
        Now imagine the possibilities.  Assume the Blue Box user was in
Philadelphia.  He would call Chicago information, disconnect from the operator
with a KP tone, and then dial anywhere that was on direct-dialing service: Los
Angeles, Dallas, or anywhere in the world in the Blue Boxer could get the
internatioal codes.
        The legend often told of one Blue Boxer who, in the 1960's, lived in
New York and had a girlfriend at a college near Boston.  Now back in the
1960's, making a telephone call to a college town on the weekend was even more
difficult than it is today to make a call from New York to Florida on a
reduced-rate holiday using one of the cut-rate long-distance carriers.  So our
Blue Boxer got on an international operator's circuit to Rome, Blue Boxed
through to a Hamburg operator, and asked Hamburg to patch through to Boston.
The Hamburg operator thought the call originated in Rome and inquired as to the
"operator's" good English, to which the Blue Boxer replied that he was an
expatriate hired to handle calls by American tourists back to their homeland.
Every weekend, while the Northeast was strangled by reduced-rate long-distance
calls, our Blue Boxer had no trouble sending his voice almost 7,000 miles for
free.

VACUUM TUBES
        Assembly plans for Blue Boxes were sold through classified
advertisements in the electronic-hobbyist magazines.  One of the earliest
designs was a two-tube poertable model that used a 1.5-volt "A" battery for the
filaments and a 125-volt "B" battery for the high-voltage (B+) power supply.
The portable Blue Box's functional circuit in shown in Fig. 2 [It's nothing you
can't find in any good Blue Box g-file, so I won't try to draw it - Cardiac].
it consisted of two phase-shift oscillators sharing a common speaker that mixed
the tones from both oscillators.  Switches S1 and S2 each represent 12
switching circuits used to generate the tones. (No, we will not supply a
working circuit, so please don't write in and ask--Editor)[That's the real
editor, not me - Cardiac]  The user placed the speaker over the telephone
handset's transmitter and simply pressed the buttons that corresponded to the
disired CCITT tones.  It was just that simple.
        Actually, it was even easier then it reads because Blue Boxers
dicovered they did not need the operator.  If they dialed an active telephone
located in certain nearby, but different, area codes, they could Blue Box just
as if they had Blue Boxed through an information operator's circuit.  The
subscriber whose line was blue Box conversatio was short, the "dead" phone
suddenly came to life the next time it was picked up.  Using a list of
"distant" numbers, a Blue Boxer would never hassle plain to the telephone
        company.  The difference between Blue Boxing off a subscriber rather
than an informatio operator was that the Blue Boxer's AMA tape indicated a real
long-distance telephone call--perhaps costing 15 or 25 cents--instead of a
freebie.  Of course, that is the reason why when Ma Bell finally decided to go
public with "assisted" newspaper articles about the Blue Box users they had
apprehended, it was usually about some college kid or "phone phreak."  One
never read of a mobster being caught.  Greed and stupidity were the reasons why
the kid's were caught.  It was the transistor that led to Ma Bell going public
with the Blue Box.  By using transistors and RC phase-shift networks for the
oscillators, a portable Blue Box could be made inexpensively, and small enough
to be used unobstrusively from a public telephone.  The college crowdin the
many technical schools went crazy with the partable Blue Box; they could call
the folks back home, their friends, or get a free network (the Alberta and
Carolina connections--which could be a topic for a whole separate article) and
never pay a dime to Ma Bell.  Unlike the mobsters who were willing to pay a
small long-distance charge when Blue Boxing, the kids wanted it, wanted it all
free, and so they used the information operator routing, and would often talk
"free-of-charge" for hours on end.
        Ma Bell finally realized that Blue Boxing was costing them big bucks,
and decided a few articles on the criminal penalties might scare the Blue
Boxers enough to cease and desist.  But who did Ma Bell catch?  The college
kids and the greedies.  When Ma Bell decided to catch the Blue Boxers she
simply examined the AMA tapes for calls to an information operator that were
excessively long.  No one talked to an operator for 5, 10, 30 minutes, or
several hours.  Once a long call to an operator appeared several times on an
AMA tape, Ma Bell simply monitored the line and the Blue Boxer was caught.
(Now do you understand why we opened with an explanation of the AMA machince?)
If the Blue Boxer worked from a telephone boothk, Ma Bell simply monitored the
booth.  Ma Bell might not have known who originated the call, but she did know
who got the call, and getting that party to spill their guts was no problem.
The mob and a few Blue Box hobbyists (maybe even thousands) knew of the AMA
machine, and so they used a real telephone number for the KP skip.  Their AMA
tapes looked perfectly legitimate.  Even if Ma Bell had told the authorities
they could provide a list of direct-dialed calls made by local mobsters, the
AMA tapes would never show who was called through a Blue Box.  For example, if
a bookmaker in New York wanted to lay off some action in Chicago, he could make
a legitimate call to a phone in New Jersey and then Blue Box to Chicago.  Of
course, automatic tone monitoring, computerized billing, and ESS (Electronic
Switchin Systems) now make that all virtually impossible. but that's the way it
was.
        You might wonder how Ma Bell discovered the tricks of the Blue Boxers.
Simple, they hired the perpetrators as consultants.  While the initial
newspaper articles detailed the potential jail penalties for apprehended Blue
Boxers, except for Ma Bell employees who assisted a Blue Boxer, it is almost
impossible to find an article on the resolution of the cases because most
hobbyist Blue Boxers got suspended sentences and/or probation if they assisted
Ma Bell in developing anti-Blue Box techniques.  It is asserted, although it
can't be easily proven, that cooperating ex-Blue Boxers were paid as
consultants.  (If you can't beat them, hire them to work for you.)
        Should you get any ideas about Blue Boxing, keep in mind that modern
switching equipment has the capacity to recognize unauthorized tones.  It's the
reason why a local office can leave their subscriber Touch-Tone circuits
actives, almost inviting you to use the Touch-Tone service.  A few days after
you use an unauthorized Touch-Tone service, the business office will call and
inquire whether you'd like to pay for the service or have it disconnected.  The
very same central-office equipment that knows you're using Touch-Tone
frequencies knows if your line is originating CCITT signals.

THE RED BOX
        The Red Box was primarily used by the college crowd to avoid charges
when fequent calls were made between two particular locations, say the college
and a student's home.  Unlike the somewhat complex circuitry of the Blue Box, a
Red Box was nothing more than a modified telephone; in some instances nothing
more than a capacitor, a momentary switch, and a battery.  As you recall from
        our discussion of the Blue Box, a telephone circuit is really
established before the target phone ever rings, and the circuit is capable of
carrying an AC signal in either direction.  When the caller hears the ringing
in his or her handset, nothing is happening at the receiving end because the
ringing signal he hears is really a tone generator at his local telephone
office.  The target (called) telephone actually gets it 20 pulses-per-second
ringing voltage when the person who dialed hears nothing--in the "dead" spaces
between hearing the ringing tone.  When the called phone is answered and taken
off hook, the telephone completes a local-office DC loop that is the signal to
stop the ringing voltage.  About three seconds later the DC loop results in a
signal being sent all the way back to the caller's AMA machine that the called
telephone was answered.  Keep that three-second AMA delay in mind.  (By now you
should have a pretty good idea of what's coming!) [I'm skipping a paragraph
        talking about how a telephone circuit works.  It is referring to a
simple phone schematic that isn't worth drawing, so I ommited the whole
paragraph - Cardiac] Now as we said earlier, the circuit can actually carry AC
        before the DC loop is closed.  The Red Box is simply a device that
provides a telephone with a local battery so that the phone can generate an AC
signal without having a DC connection to the telephone line.  The earliest of
the Red Boxes was the surplus military field telephone, of which there were
thousands upon thousands in the marketplace during the 1950's and 1960's.  The
field telephone was a portable telephone unit having a manual ringer worked by
a crank--just like the telephone Grandpa used on the farm--and two D-cells.  A
selector switch set up the unit so that it could be connected to a combat
switchboard, with the DC power supplied by the switchboard.  But if a combat
unit wasn't connected to a switchboard, and the Lieutenant yelled "Take a
wire," the signalman threw a switch on his field telephone that switched in the
        local batteries.  To prevent the possibility of having both ends of the
circuit feeding battery current into the line in opposite polarity--thereby
resulting in silence--the output from the field telephone when running from its
internal batteries was only the AC representing the voice input, not modulated
DC.  [I ommited the next two paragraphs, which talk about how to make one.  It
too has a complicated schematic, so I wont draw it.  It's the same stuff you
get from any Red Box g-file - Cardiac]

PRESS ONCE TO TALK
        The Red Box was used at the receiving end; let's assume it's the old
homestead.  The call was originated by Junior (or Sis) at their college 1000
miles away from home.  Joe gave the family one ring and then hung up, which
told them that he's calling.  Pop set up the Red Box.  Then Junior redialed the
old homestead.  Pop lifted the handset when the phone rang.  Then Pop closed a
momentary-switch for about a half-second, which caused the local telephone
office to silence the ringing signal.  When Pop released the switch, the folks
cantalk to Junior without Junior getting charged because his AMA tape did not
show his call was answered--the DC loop must be closed for at least
three-seconds for the AMA tape to show Junior's call was answered.  All the AMA
tape showed is that Junior let the phone ring at the old homestead for almost
30 minutes; a length of time that no Bell Operating Company is likely to
believe twice!
        A modern Red Box is simpy a conventional telephone that's been modified to
emulate the vintage 1940 military field telephone.  Aside from the fact that
the operating companies can now nail every Red Box user because all modern
billing equipment shows the AMA information concerning the length of time a
caller let the target phone ring, it's use has often put severe psychological
strain on the users.
        [I ommited another paragraph here.  It was just some closing stuff.
Nothing special - Cardiac]
        There are no hard facts concerning how many Red Boxes were in use, or
how much money Ma Bell lost, but one thing is known: she had little difficulty
in closing down Red Boxes in virtually all instances where the old folks were
involved because Mom and Pop usually would not tolerate what to them was
stealing.  If you as a reader have any ideas about using a Red Box, bear in
mind that the AMA machine (or it's equivilent) will get you every time, even if
you use a phone booth, because the record will show the number being called,
and as with the Blue Box, the people on the receiving end will spill their guts
to the cops.



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Downloaded From P-80 International Information Systems 304-744-2253 12yrs+