The Anarchist Cookbook (31 page)

use, the existing connection is broken and immediately re-established through the

other two ports of the busy verification circuit without interruption. Busy verification

circuit is controlled by access code. A dedicated trunk can be used but is not

necessary.

The busy verification circuit also can be used for test verify from the wire chiefs test

panel B. Additional busy verification conference circuits (002749) there it is right out

of an ESS manual word for word! And I'm getting 25 linear feet of ESS manuals! ! Not

counting the stack received so far!

109.White Box Plans by The Jolly Roger

Introduction:

The White Box is simply a portable touch-tone keypad. For more information on touch-

tone, see my Silver Box Plans.

Materials:



1 Touch-Tone Keypad



1 Miniature 1000 to 8 Ohm Transformer (Radio Shack # 273-1380)



1 Standard 8 Ohm Speaker



2 9V Batteries



2 9V Battery Clips

Procedure:

Connect the Red Wire from the Transformer to either terminal on the speaker.

Connect the White Wire from the transformer to the other terminal on the speaker.

Connect the Red Wire from one Battery Clip to the Black Wire from the other Battery

Clip.

Connect the Red Wire from the second Battery Clip to the Green Wire from the Keypad.

Connect the Blue Wire from the Keypad to the Orange/Black Wire from the Keypad.

Connect the Black Wire from the first Battery Clip to the two above wires (Blue and

Black/Orange).

Connect the Black Wire from the Keypad to the Blue Wire from the Transformer.

Connect the Red/Green Wire from the Keypad to the Green Wire from the Transformer.

Make sure the Black Wire from the Transformer and the remaining wires from the Keypad

are free.

Hook up the Batteries.

Optional:

Put it all in a case.

Add a Silver Box to it.

Use:

Just use it like a normal keypad, except put the speaker next to the receiver of the phone

you're using.

110.The BLAST Box by The Jolly Roger

Ever want to really make yourself be heard? Ever talk to someone on the phone who just

doesn't shut up? Or just call the operator and pop her eardrum? Well, up until recently it

has been impossible for you to do these things. That is, unless of course you've got a blast

box. All a blast box is, is a really cheap amplifier, (around 5 watts or so) connected in place

of the microphone on your telephone. It works best on model 500 AT&T Phones, and if

constructed small enough, can be placed inside the phone.

Construction:

Construction is not really important. Well it is, but since I'm letting you make

your own amp, I really don't have to include this.

Usage:

Once you've built your blast box, simply connect a microphone (or use the microphone from

the phone) to the input of the amplifier, and presto. There it is. Now, believe it or not, this

device actually works. (At least on crossbar.) It seems that Illinois bell switching systems

allow quite a lot of current to pass right through the switching office, and out to whoever

you're calling. When

you talk in the phone, it comes out of the other phone (again it works best if the phone

that you're calling has the standard western electric earpiece) incredibly loud. This device

is especially good for PBS Subscription drives. Have "Phun", and don't get caught!

111.Dealing with the Rate & Route Operator by The Jolly Roger

It seems that fewer and fewer people have blue boxes these days, and that is really too

bad. Blue boxes, while not all that great for making free calls (since the TPC can tell when

the call was made, as well as where it was too and from), are really a lot of fun to play

with. Short of becoming a real live TSPS operator, they are about the only way you can

really play with the network.

For the few of you with blue boxes, here are some phrases which may make life easier

when dealing with the rate & route (R&R) operators. To get the R&R op, you send a KP + 141

+ ST. In some areas you may need to put another NPA before the 141 (i.e., KP + 213 + 141 +

ST), if you have no local R&R ops.

The R&R operator has a myriad of information, and all it takes to get this data is mumbling

cryptic phrases. There are basically four special phrases to give the R&R ops. They are

NUMBERS route, DIRECTORY route, OPERATOR route, and PLACE NAME.

To get an R&R an area code for a city, one can call the R&R operator and ask for the

numbers route. For example, to find the area code for Carson City, Nevada, we'd ask the

R&R op for "Carson City, Nevada, numbers route, please." and get the answer, "Right... 702

plus." meaning that 702 plus 7 digits gets us there.

Sometimes directory assistance isn't just NPA+131. The way to get these routings is to

call R&R and ask for "Anaheim, California, directory route, please." Of course, she'd tell us

it was 714 plus, which means 714 + 131 gets us the D.A. op there. This is sort of pointless

example, but I couldn't come up with a better one on short notice.

Let's say you wanted to find out how to get to the inward operator for Sacremento,

California. The first six digits of a number in that city will be required (the NPA and an

NXX). For example, let us use 916 756. We would call R&R, and when the operator

answered, say, "916 756, operator route, please." The

operator would say, "916 plus 001 plus." This means that 916 + 001 + 121 will get you the

inward operator for Sacramento. Do you know the city which corresponds to 503 640?

The R&R operator does, and will tell you that it is Hillsboro, Oregon, if you sweetly ask for

"Place name, 503 640, please."

For example, let's say you need the directory route for Sveg, Sweden. Simply call R&R, and

ask for, "International, Baden, Switzerland. TSPS directory route, please." In response to

this, you'd get, "Right... Directory to Sveg, Sweden. Country code 46 plus 1170." So you'd

route yourself to an international sender, and send 46 + 1170 to get the D.A. operator in

Sweden.

Inward operator routings to various countries are obtained the same way "International,

London, England, TSPS inward route, please." and get "Country code 44 plus 121."

Therefore, 44 plus 121 gets you inward for London.

Inwards can get you language assistance if you don't speak the language. Tell the foreign

inward, "United States calling. Language assistance in completing a call to (called party) at

(called number)."

R&R operators are people are people too, y'know. So always be polite, make sure use of

'em, and dial with care.

112.Cellular Phreaking by The Jolly Roger

The cellular/mobile phone system is one that is perfectly set up to be exploited by phreaks

with the proper knowledge and equipment. Thanks to deregulation, the regional BOC's (Bell

Operating Companies) are scattered and do not communicate much with each other.

Phreaks can take advantage of this by pretending to be mobile phone customers whose

"home base" is a city served by a different BOC, known as a "roamer". Since it is

impractical for each BOC to keep track of the customers of all the other BOC's, they will

usually allow the customer to make the calls he wishes, often with a surcharge of some

sort.

The bill is then forwarded to the roamer's home BOC for collection. However, it is fairly

simple (with the correct tools) to create a bogus ID number for your mobile phone, and

pretend to be a roamer from some other city and state, that's "just visiting". When your

BOC tries to collect for the calls from your alleged "home BOC", they will discover you are

not a real customer; but by then, you can create an entirely new electronic identity, and

use that instead.

How does the cellular system know who is calling, and where they are? When a mobile

phone enters a cell's area of transmission, it transmits its phone number and its 8 digit ID

number to that cell, who will keep track of it until it gets far enough away that the sound

quality is sufficiently diminished, and then the phone is "handed off" to the cell that the

customer has walked or driven into. This process continues as long as the phone has power

and is turned on. If the phone is turned off (or the car is), someone attempting to call the

mobile phone will receive a recording along the lines of "The mobile phone customer you

have dialed has left the vehicle or driven out of the service area." When a call is made to

a mobile phone, the switching equipment will check to see if the mobile phone being called

is "logged in", so to speak, or present in one of the cells. If it is, the call will then act (to

the speaking parties) just like a normal call - the caller may hear a busy tone, the phone

may just ring, or the call may be answered.

How does the switching equipment know whether or not a particular phone is authorized to

use the network? Many times, it doesn't. When a dealer installs a mobile phone, he gives

the phone's ID number (an 8 digit hexadecimal number) to the local BOC, as well as the

phone number the BOC assigned to the customer. Thereafter, whenever a phone is present

in one of the cells, the two numbers are checked - they should be registered to the same

person. If they don't match, the telco knows that an attempted fraud is taking place (or

at best, some transmission error) and will not allow calls to be placed or received at that

phone. However, it is impractical (especially given the present state of deregulation) for

the telco to have records of every cellular customer of every BOC. Therefore, if you're

going to create a fake ID/phone number combination, it will need to be "based" in an area

that has a cellular system (obviously), has a different BOC than your local area does, and

has some sort of a "roamer"

agreement with your local BOC.

How can one "phreak" a cellular phone? There are three general areas when phreaking

cellular phones; using one you found in an unlocked car (or an unattended walk-about

model), modifying your own chip set to look like a different phone, or recording the phone

number/ID number combinations sent by other local cellular phones, and using those as

your own. Most cellular phones include a crude "password" system to keep unauthorized

users from using the phone - however, dealers often set the password (usually a 3 to 5

digit code) to the last four digits of the customer's mobile phone number. If you can find

that somewhere on the phone, you're in luck. If not, it shouldn't be TOO hard to hack,

since most people aren't smart enough to use something besides "1111", "1234", or

whatever. If you want to modify the chip set in a cellular phone you bought (or stole),

there are two chips (of course, this depends on the model and

manufacturer, yours may be different) that will need to be changed - one installed at the

manufacturer (often epoxied in) with the phone's ID number, and one installed by the

dealer with the phone number, and possible the security code. To do this, you'll obviously

need an EPROM burner as well as the same sort of chips used in the phone (or a friendly

and unscrupulous dealer!). As to recording the numbers of other mobile phone customers

and using them; as far as I know, this is just theory... but it seems quite possible, if you've

got the equipment to record and decode it. The cellular system would probably freak out if

two phones (with valid ID/phone number combinations) were both present in the network

at once, but it remains to be seen what will happen.

113.Cheesebox Plans by The Jolly Roger

A Cheesebox (named for the type of box the first one was found in) is a type of box which

will, in effect, make your telephone a Pay-Phone.....This is a simple, modernized, and easy

way of doing it....

Inside Info: These were first used by bookies many years ago as a way of making calls to

people without being called by the cops or having their numbers traced and/or tapped......

How To Make A Modern Cheese Box

Ingredients:



1 Call Forwarding service on the line



1 Set of Red Box Tones



The number to your prefix's Intercept operator (do some scanning for this one)

How To:

After you find the number to the intercept operator in your prefix, use your call-

forwarding and forward all calls to her. .this will make your phone stay off the

hook(actually, now it waits for a quarter to be dropped in)...you now have a cheese box... In

Order To Call Out On This Line: You must use your Red Box tones and generate the

quarter dropping in...then, you can make phone calls to people...as far as I know, this is

fairly safe, and they do not check much...Although I am not sure, I think you can even

make credit-card calls from a cheesebox phone and not get traced...